hippo-memory 1.63.2 → 1.64.0

package/dist/store/handoffs.d.ts

@@ -1,18 +1,20 @@
 import { type SessionHandoff, type HandoffOutcome, type HandoffEvidence } from '../handoff.js';
 import type { TaskSnapshot } from './rows.js';
+import { type ContinuityKey } from './sessions.js';
 /** Column list shared by every session_handoffs SELECT; store-cards.ts reuses it for the card handoff lookup. */
 export declare const HANDOFF_COLUMNS = "id, session_id, repo_root, task_id, summary, next_action, artifacts_json, scope, created_at, constraints_json, evidence_json, outcome, target_runtime, card_id";
 /**
  * Save a session handoff record. Returns the persisted handoff.
  */
-export declare function saveSessionHandoff(hippoRoot: string, tenantId: string, handoff: Omit<SessionHandoff, 'updatedAt'>): SessionHandoff;
-/** Load the most recent handoff, optionally filtered by session ID. */
-export declare function loadLatestHandoff(hippoRoot: string, tenantId: string, sessionId?: string, opts?: {
+export declare function saveSessionHandoff(hippoRoot: string, tenantId: string, handoff: Omit<SessionHandoff, 'updatedAt'>, key?: ContinuityKey): SessionHandoff;
+interface HandoffFilter {
     unfinishedOnly?: boolean;
     maxAgeMs?: number;
     scopeFilter?: 'default-deny';
     excludeSessionId?: string;
-}): SessionHandoff | null;
+}
+/** Load the most recent handoff, optionally filtered by session ID. */
+export declare function loadLatestHandoff(hippoRoot: string, tenantId: string, sessionId?: string, opts?: HandoffFilter, key?: ContinuityKey): SessionHandoff | null;
 /**
  * Load a specific handoff by its row ID.
  */
@@ -21,6 +23,7 @@ export declare function loadHandoffById(hippoRoot: string, tenantId: string, id:
 export declare function stampHandoffOutcome(hippoRoot: string, tenantId: string, sessionId: string, outcome: HandoffOutcome): number;
 /** Auto-write a handoff at session-end from the session's active snapshot, else from `derived`, its transcript state.
  * @param evidence best-effort git state; outcome comes from the newest session_complete event.
- * @returns null when neither source is the session's, a newer handoff covers the snapshot, or the session's latest handoff was not read off its transcript. */
-export declare function writeSessionEndHandoff(hippoRoot: string, tenantId: string, sessionId: string, evidence: HandoffEvidence | null, derived?: Pick<TaskSnapshot, 'task' | 'summary' | 'next_step'> | null): SessionHandoff | null;
+ * @returns null when neither source is the session's, a newer handoff covers the snapshot, or the session's latest handoff was not read off its transcript or already holds `derived`. */
+export declare function writeSessionEndHandoff(hippoRoot: string, tenantId: string, sessionId: string, evidence: HandoffEvidence | null, derived?: Pick<TaskSnapshot, 'task' | 'summary' | 'next_step'> | null, key?: ContinuityKey): SessionHandoff | null;
+export {};
 //# sourceMappingURL=handoffs.d.ts.map

package/dist/store/handoffs.js

@@ -1,32 +1,29 @@
 import { closeHippoDb, openHippoDb } from '../db.js';
 import { rowToSessionHandoff, isHandoffOutcome, } from '../handoff.js';
-import { RECALL_DEFAULT_DENY_SCOPES } from '../recall-scope.js';
+import { scopeAdmitSql } from '../recall-scope.js';
 import { assertTenantId } from '../tenant.js';
 import { openStore } from './open.js';
-import { loadActiveTaskSnapshot } from './sessions.js';
+import { continuityStamp, continuityWhere, loadActiveTaskSnapshot } from './sessions.js';
 /** Column list shared by every session_handoffs SELECT; store-cards.ts reuses it for the card handoff lookup. */
 export const HANDOFF_COLUMNS = 'id, session_id, repo_root, task_id, summary, next_action, artifacts_json, scope, created_at, constraints_json, evidence_json, outcome, target_runtime, card_id';
 /**
  * Save a session handoff record. Returns the persisted handoff.
  */
-export function saveSessionHandoff(hippoRoot, tenantId, handoff) {
+export function saveSessionHandoff(hippoRoot, tenantId, handoff, key) {
     assertTenantId('saveSessionHandoff', tenantId);
+    const stamp = key ? continuityStamp(key) : null;
     const db = openStore(hippoRoot);
     const now = new Date().toISOString();
     // Scope is stored as given; read-side default-deny in api.recall + cmdRecall
     // continuity excludes slack:private:* and 'unknown:legacy'.
     try {
         const result = db.prepare(`
-      INSERT INTO session_handoffs(session_id, repo_root, task_id, summary, next_action, artifacts_json, scope, tenant_id, created_at, constraints_json, evidence_json, outcome, target_runtime, card_id)
-      VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?)
-    `).run(handoff.sessionId, handoff.repoRoot ?? null, handoff.taskId ?? null, handoff.summary, handoff.nextAction ?? null, JSON.stringify(handoff.artifacts ?? []), handoff.scope ?? null, tenantId, now, JSON.stringify(handoff.constraints ?? []), handoff.evidence ? JSON.stringify(handoff.evidence) : null, handoff.outcome ?? null, handoff.targetRuntime ?? null, handoff.cardId ?? null);
+      INSERT INTO session_handoffs(session_id, repo_root, task_id, summary, next_action, artifacts_json, scope, tenant_id, created_at, constraints_json, evidence_json, outcome, target_runtime, card_id, owner_subject, origin_project)
+      VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?)
+    `).run(handoff.sessionId, handoff.repoRoot ?? null, handoff.taskId ?? null, handoff.summary, handoff.nextAction ?? null, JSON.stringify(handoff.artifacts ?? []), handoff.scope ?? null, tenantId, now, JSON.stringify(handoff.constraints ?? []), handoff.evidence ? JSON.stringify(handoff.evidence) : null, handoff.outcome ?? null, handoff.targetRuntime ?? null, handoff.cardId ?? null, stamp?.owner ?? null, stamp?.origin ?? null);
         const id = Number(result.lastInsertRowid ?? 0);
         // SAFETY: row's shape matches HANDOFF_COLUMNS.
-        const row = db.prepare(`
-      SELECT ${HANDOFF_COLUMNS}
-      FROM session_handoffs
-      WHERE id = ?
-    `).get(id);
+        const row = db.prepare(`SELECT ${HANDOFF_COLUMNS} FROM session_handoffs WHERE id = ?`).get(id);
         if (!row) {
             throw new Error('Failed to reload saved session handoff');
         }
@@ -36,38 +33,48 @@ export function saveSessionHandoff(hippoRoot, tenantId, handoff) {
         closeHippoDb(db);
     }
 }
+function handoffConditions(tenantId, sessionId, opts, key) {
+    const owned = key ? continuityWhere(key) : null;
+    const conditions = ['tenant_id = ?'];
+    const params = [tenantId];
+    if (owned) {
+        conditions.push(owned.sql);
+        params.push(...owned.params);
+    }
+    if (sessionId) {
+        conditions.push('session_id = ?');
+        params.push(sessionId);
+    }
+    if (opts.excludeSessionId) {
+        conditions.push('session_id != ?');
+        params.push(opts.excludeSessionId);
+    }
+    if (opts.unfinishedOnly) {
+        // Restrict to each session's newest revision first: stampHandoffOutcome
+        // only stamps the newest row, so an older null-outcome revision must not resurrect.
+        // Keyed, the newest is the owner's own, so another owner's newer revision cannot hide it.
+        conditions.push(`id IN (SELECT MAX(id) FROM session_handoffs WHERE tenant_id = ?${owned ? ` AND ${owned.sql}` : ''} GROUP BY session_id)`);
+        params.push(tenantId, ...(owned?.params ?? []));
+        conditions.push(`(outcome IS NULL OR outcome IN ('partial','failure'))`);
+    }
+    if (opts.maxAgeMs != null) {
+        conditions.push('created_at >= ?');
+        params.push(new Date(Date.now() - opts.maxAgeMs).toISOString());
+    }
+    if (opts.scopeFilter === 'default-deny') {
+        // Admit scope before LIMIT 1, else a newer denied row hides an older eligible one.
+        const deny = scopeAdmitSql('');
+        conditions.push(deny.sql);
+        params.push(...deny.params);
+    }
+    return { conditions, params };
+}
 /** Load the most recent handoff, optionally filtered by session ID. */
-export function loadLatestHandoff(hippoRoot, tenantId, sessionId, opts = {}) {
+export function loadLatestHandoff(hippoRoot, tenantId, sessionId, opts = {}, key) {
     assertTenantId('loadLatestHandoff', tenantId);
     const db = openStore(hippoRoot);
     try {
-        const conditions = ['tenant_id = ?'];
-        const params = [tenantId];
-        if (sessionId) {
-            conditions.push('session_id = ?');
-            params.push(sessionId);
-        }
-        if (opts.excludeSessionId) {
-            conditions.push('session_id != ?');
-            params.push(opts.excludeSessionId);
-        }
-        if (opts.unfinishedOnly) {
-            // Restrict to each session's newest revision first: stampHandoffOutcome
-            // only stamps the newest row, so an older null-outcome revision must not resurrect.
-            conditions.push(`id IN (SELECT MAX(id) FROM session_handoffs WHERE tenant_id = ? GROUP BY session_id)`);
-            params.push(tenantId);
-            conditions.push(`(outcome IS NULL OR outcome IN ('partial','failure'))`);
-        }
-        if (opts.maxAgeMs != null) {
-            conditions.push('created_at >= ?');
-            params.push(new Date(Date.now() - opts.maxAgeMs).toISOString());
-        }
-        if (opts.scopeFilter === 'default-deny') {
-            // Admit scope before LIMIT 1, else a newer denied row hides an older eligible one.
-            const placeholders = RECALL_DEFAULT_DENY_SCOPES.map(() => '?').join(', ');
-            conditions.push(`(scope IS NULL OR (scope NOT IN (${placeholders}) AND scope NOT LIKE '%:private:%'))`);
-            params.push(...RECALL_DEFAULT_DENY_SCOPES);
-        }
+        const { conditions, params } = handoffConditions(tenantId, sessionId, opts, key);
         // SAFETY: row's shape matches HANDOFF_COLUMNS.
         const row = db.prepare(`
       SELECT ${HANDOFF_COLUMNS}
@@ -123,11 +130,13 @@ export function stampHandoffOutcome(hippoRoot, tenantId, sessionId, outcome) {
 }
 /** Auto-write a handoff at session-end from the session's active snapshot, else from `derived`, its transcript state.
  * @param evidence best-effort git state; outcome comes from the newest session_complete event.
- * @returns null when neither source is the session's, a newer handoff covers the snapshot, or the session's latest handoff was not read off its transcript. */
-export function writeSessionEndHandoff(hippoRoot, tenantId, sessionId, evidence, derived = null) {
+ * @returns null when neither source is the session's, a newer handoff covers the snapshot, or the session's latest handoff was not read off its transcript or already holds `derived`. */
+export function writeSessionEndHandoff(hippoRoot, tenantId, sessionId, evidence, derived = null, key) {
     assertTenantId('writeSessionEndHandoff', tenantId);
-    const active = loadActiveTaskSnapshot(hippoRoot, tenantId);
-    const existing = loadLatestHandoff(hippoRoot, tenantId, sessionId);
+    if (key)
+        continuityStamp(key); // a partial key is a caller bug, so fail loud rather than write nothing
+    const active = loadActiveTaskSnapshot(hippoRoot, tenantId, key);
+    const existing = loadLatestHandoff(hippoRoot, tenantId, sessionId, {}, key);
     let snapshot;
     let handoffEvidence = evidence;
     if (active && active.session_id === sessionId) {
@@ -140,24 +149,13 @@ export function writeSessionEndHandoff(hippoRoot, tenantId, sessionId, evidence,
         // Only an earlier transcript read gives way; `hippo handoff create` and unmarked older handoffs keep winning.
         if (!derived || (existing && existing.evidence?.derivedFrom !== 'transcript'))
             return null;
+        // A retried session end reads the same transcript, so it must not add a second revision.
+        if (existing && existing.taskId === derived.task && existing.summary === derived.summary && existing.nextAction === derived.next_step)
+            return null;
         snapshot = { ...derived, scope: null };
         handoffEvidence = { ...evidence, derivedFrom: 'transcript' };
     }
-    const db = openHippoDb(hippoRoot);
-    let outcome = null;
-    try {
-        // SAFETY: row's shape matches the single `content` column below.
-        const completeEvent = db.prepare(`
-      SELECT content FROM session_events
-      WHERE tenant_id = ? AND session_id = ? AND event_type = 'session_complete'
-      ORDER BY created_at DESC, id DESC LIMIT 1
-    `).get(tenantId, sessionId);
-        if (isHandoffOutcome(completeEvent?.content))
-            outcome = completeEvent.content;
-    }
-    finally {
-        closeHippoDb(db);
-    }
+    const outcome = sessionOutcome(hippoRoot, tenantId, sessionId);
     // A same-task refresh carries forward envelope fields nobody cleared; a scope
     // mismatch must not leak private metadata into an unscoped envelope.
     const carryForward = existing != null && existing.taskId === snapshot.task
@@ -176,6 +174,21 @@ export function writeSessionEndHandoff(hippoRoot, tenantId, sessionId, evidence,
         constraints: carryForward ? existing.constraints : undefined,
         targetRuntime: carryForward ? existing.targetRuntime : undefined,
         cardId: carryForward ? existing.cardId : undefined,
-    });
+    }, key);
+}
+function sessionOutcome(hippoRoot, tenantId, sessionId) {
+    const db = openHippoDb(hippoRoot);
+    try {
+        // SAFETY: row's shape matches the single `content` column below.
+        const content = db.prepare(`
+      SELECT content FROM session_events
+      WHERE tenant_id = ? AND session_id = ? AND event_type = 'session_complete'
+      ORDER BY created_at DESC, id DESC LIMIT 1
+    `).get(tenantId, sessionId)?.content;
+        return isHandoffOutcome(content) ? content : null;
+    }
+    finally {
+        closeHippoDb(db);
+    }
 }
 //# sourceMappingURL=handoffs.js.map

package/dist/store/index-and-stats.js

@@ -24,7 +24,7 @@ export function loadIndex(hippoRoot) {
 export function saveIndex(hippoRoot, index) {
     const db = openStore(hippoRoot);
     try {
-        db.exec('BEGIN');
+        db.exec('BEGIN IMMEDIATE');
         try {
             setMeta(db, 'last_retrieval_ids', JSON.stringify(index.last_retrieval_ids ?? []));
             setMeta(db, 'last_trace_id', index.last_trace_id ?? '');
@@ -52,7 +52,7 @@ export function rebuildIndex(hippoRoot) {
         const existingIds = new Set(db.prepare(`SELECT id FROM memories`).all().map((row) => row.id));
         const legacyEntries = loadLegacyEntriesFromMarkdown(hippoRoot).filter((entry) => !existingIds.has(entry.id));
         if (legacyEntries.length > 0) {
-            db.exec('BEGIN');
+            db.exec('BEGIN IMMEDIATE');
             try {
                 // Guard with per-row skip, like bootstrapLegacyStore: a stale markdown mirror could resurrect a
                 // rejected value here. Refusal audit is written inline because nothing rolls back on a skip.

package/dist/store/open.d.ts

@@ -6,7 +6,9 @@ export declare function getHippoRoot(cwd?: string, opts?: ResolveProjectIdentity
 export declare function isInitialized(hippoRoot: string): boolean;
 export declare function initStore(hippoRoot: string): void;
 /** One open connection with init done on it, for callers who used to pay for `initStore` + a second `openHippoDb`. */
-export declare function openStore(hippoRoot: string): DatabaseSyncLike;
+export declare function openStore(hippoRoot: string, opts?: {
+    busyWaitMs?: number;
+}): DatabaseSyncLike;
 /** `meta` key holding the default half-life base a store's memories are on (src/half-life-migration.ts). */
 export declare const HALF_LIFE_BASE_META_KEY = "default_half_life_base";
 /** `meta` key set once no memory of a decision, incident or other object sits on the old flat 90 days. */

package/dist/store/open.js

@@ -24,9 +24,9 @@ export function initStore(hippoRoot) {
     closeHippoDb(openStore(hippoRoot));
 }
 /** One open connection with init done on it, for callers who used to pay for `initStore` + a second `openHippoDb`. */
-export function openStore(hippoRoot) {
+export function openStore(hippoRoot, opts) {
     ensureMirrorDirectories(hippoRoot);
-    const db = openHippoDb(hippoRoot);
+    const db = openHippoDb(hippoRoot, opts);
     try {
         const bootstrapped = bootstrapLegacyStore(db, hippoRoot);
         if (bootstrapped) {
@@ -74,7 +74,7 @@ function bootstrapLegacyStore(db, hippoRoot) {
     const legacyEntries = loadLegacyEntriesFromMarkdown(hippoRoot);
     if (legacyEntries.length === 0)
         return false;
-    db.exec('BEGIN');
+    db.exec('BEGIN IMMEDIATE');
     try {
         importLegacyEntries(db, hippoRoot, legacyEntries);
         importLegacyIndexAndStats(db, hippoRoot);

package/dist/store/search-rows.d.ts

@@ -15,17 +15,19 @@ import { type DatabaseSyncLike } from '../db.js';
  *  surface (not re-exported from `src/index.ts`). Subject to change. */
 export type RecallScopeFilter = {
     mode: 'default-deny';
+    ownScope?: string;
 } | {
     mode: 'exact';
     value: string;
 } | {
     mode: 'default-deny-or-exact';
     value: string;
+    ownScope?: string;
 };
 /** One project name, or every name a project's rows carry. */
 export type OriginFilter = string | readonly string[];
-/** Scope rule for recall: none requested is default-deny; 'exact' narrows to the request; 'additive' adds it to the default set. */
-export declare function recallScopeFilter(requestedScope: string | undefined, mode: 'exact' | 'additive'): RecallScopeFilter;
+/** Scope rule for recall: none requested is default-deny; 'exact' narrows to the request; 'additive' adds it to the default set, unless it is personal, which only `ownScope` opens. */
+export declare function recallScopeFilter(requestedScope: string | undefined, mode: 'exact' | 'additive', ownScope?: string): RecallScopeFilter;
 /**
  * Load likely search candidates directly from SQLite.
  * Uses FTS5 when available, falls back to LIKE matching, then full-store fallback.
@@ -38,7 +40,7 @@ export declare function loadSearchEntries(hippoRoot: string, query: string, limi
  * Recall-mode loader. Pushes the recall-side scope predicate into SQL so
  * `unknown:legacy` cannot leak via any consumer that hasn't remembered to re-filter.
  *
- * - `requestedScope` undefined / '': default-deny on `unknown:legacy`.
+ * - `requestedScope` undefined / '': default-deny on `unknown:legacy`, admitting `ownScope`, the caller's personal scope.
  * - `requestedScope` non-empty string: exact match on `m.scope = requestedScope`.
  *
  * Private scopes: SQL applies a conservative `NOT LIKE '%:private:%'` before the LIMIT window so private
@@ -51,8 +53,8 @@ export declare function loadSearchEntries(hippoRoot: string, query: string, limi
  *
  * `tenantId` is optional because searchBothHybrid's is; undefined means no tenant filter.
  */
-export declare function loadRecallSearchEntries(hippoRoot: string, query: string, limit?: number, tenantId?: string, requestedScope?: string, explicitScopeMode?: 'exact' | 'additive', includeSuperseded?: boolean, originProjects?: OriginFilter): MemoryEntry[];
-export declare function loadRecallSearchEntriesFromDb(db: DatabaseSyncLike, query: string, limit?: number, tenantId?: string, requestedScope?: string, explicitScopeMode?: 'exact' | 'additive', includeSuperseded?: boolean, originProjects?: OriginFilter): MemoryEntry[];
+export declare function loadRecallSearchEntries(hippoRoot: string, query: string, limit?: number, tenantId?: string, requestedScope?: string, explicitScopeMode?: 'exact' | 'additive', includeSuperseded?: boolean, originProjects?: OriginFilter, ownScope?: string): MemoryEntry[];
+export declare function loadRecallSearchEntriesFromDb(db: DatabaseSyncLike, query: string, limit?: number, tenantId?: string, requestedScope?: string, explicitScopeMode?: 'exact' | 'additive', includeSuperseded?: boolean, originProjects?: OriginFilter, ownScope?: string): MemoryEntry[];
 /** Which rows the vector arm of hybrid search may add: the same tenant, scope and superseded rules as the lexical load. */
 export interface VectorCandidateSpec {
     tenantId?: string;
@@ -60,6 +62,7 @@ export interface VectorCandidateSpec {
     includeSuperseded: boolean;
     /** How many nearest rows to add; default 50. */
     limit?: number;
+    origin?: OriginFilter;
 }
 /** The rows nearest `queryVector` that pass `spec`, nearest first. */
 export declare function loadVectorCandidateEntries(hippoRoot: string, queryVector: readonly number[], spec: VectorCandidateSpec): MemoryEntry[];

package/dist/store/search-rows.js

@@ -1,7 +1,7 @@
 import { envForceLikePath } from '../env.js';
 import { isFtsAvailable, closeHippoDb } from '../db.js';
 import { tokenize } from '../tokenize.js';
-import { RECALL_DEFAULT_DENY_SCOPES } from '../recall-scope.js';
+import { isPersonalScope, scopeAdmitSql } from '../recall-scope.js';
 import { RAREST_TERM_COUNT, rarestPromptTerms } from '../prompt-recall.js';
 import { log } from '../log.js';
 import { originInSql } from '../project-identity.js';
@@ -15,14 +15,11 @@ function recallScopeClause(col, scopeFilter) {
         return { sql: '', params: [] };
     if (scopeFilter.mode === 'exact')
         return { sql: ` AND ${col}scope = ?`, params: [scopeFilter.value] };
-    // `IS NULL OR` admits NULL scopes, which NOT IN alone drops. NOT LIKE denies a superset of private scopes before the
-    // window cut so private rows cannot starve admitted ones; the anchored JS regex stays the exact post-filter.
-    const placeholders = RECALL_DEFAULT_DENY_SCOPES.map(() => '?').join(', ');
-    const admitted = `${col}scope IS NULL OR (${col}scope NOT IN (${placeholders}) AND ${col}scope NOT LIKE '%:private:%')`;
+    const admit = scopeAdmitSql(col, scopeFilter.ownScope);
     if (scopeFilter.mode === 'default-deny')
-        return { sql: ` AND (${admitted})`, params: [...RECALL_DEFAULT_DENY_SCOPES] };
+        return { sql: ` AND ${admit.sql}`, params: admit.params };
     // The trailing arm keeps a deliberately requested scope loadable, private or quarantined included.
-    return { sql: ` AND (${admitted} OR ${col}scope = ?)`, params: [...RECALL_DEFAULT_DENY_SCOPES, scopeFilter.value] };
+    return { sql: ` AND (${admit.sql} OR ${col}scope = ?)`, params: [...admit.params, scopeFilter.value] };
 }
 // In SQL, not after the window cut, so other projects' matches cannot crowd the project's own rows out of the LIMIT.
 function withProject(scope, col, origin) {
@@ -32,11 +29,11 @@ function withProject(scope, col, origin) {
     const originProjects = [origin].flat();
     return { sql: `${scope.sql} AND (${col}origin_project = '' OR ${originInSql(originProjects, `${col}origin_project`)})`, params: [...scope.params, ...originProjects] };
 }
-/** Scope rule for recall: none requested is default-deny; 'exact' narrows to the request; 'additive' adds it to the default set. */
-export function recallScopeFilter(requestedScope, mode) {
-    if (!requestedScope)
-        return { mode: 'default-deny' };
-    return mode === 'additive' ? { mode: 'default-deny-or-exact', value: requestedScope } : { mode: 'exact', value: requestedScope };
+/** Scope rule for recall: none requested is default-deny; 'exact' narrows to the request; 'additive' adds it to the default set, unless it is personal, which only `ownScope` opens. */
+export function recallScopeFilter(requestedScope, mode, ownScope) {
+    if (!requestedScope || (mode === 'additive' && isPersonalScope(requestedScope)))
+        return { mode: 'default-deny', ownScope };
+    return mode === 'additive' ? { mode: 'default-deny-or-exact', value: requestedScope, ownScope } : { mode: 'exact', value: requestedScope };
 }
 const FTS_QUERY_SYNTAX_RE = /fts5: syntax error|unterminated string/i;
 function loadSearchRows(db, query, limit, tenantId, scopeFilter, includeSuperseded = true, originProjects) {
@@ -158,7 +155,7 @@ export function loadSearchEntries(hippoRoot, query, limit = DEFAULT_SEARCH_CANDI
  * Recall-mode loader. Pushes the recall-side scope predicate into SQL so
  * `unknown:legacy` cannot leak via any consumer that hasn't remembered to re-filter.
  *
- * - `requestedScope` undefined / '': default-deny on `unknown:legacy`.
+ * - `requestedScope` undefined / '': default-deny on `unknown:legacy`, admitting `ownScope`, the caller's personal scope.
  * - `requestedScope` non-empty string: exact match on `m.scope = requestedScope`.
  *
  * Private scopes: SQL applies a conservative `NOT LIKE '%:private:%'` before the LIMIT window so private
@@ -171,10 +168,10 @@ export function loadSearchEntries(hippoRoot, query, limit = DEFAULT_SEARCH_CANDI
  *
  * `tenantId` is optional because searchBothHybrid's is; undefined means no tenant filter.
  */
-export function loadRecallSearchEntries(hippoRoot, query, limit = DEFAULT_SEARCH_CANDIDATE_LIMIT, tenantId, requestedScope, explicitScopeMode = 'exact', includeSuperseded = true, originProjects) {
+export function loadRecallSearchEntries(hippoRoot, query, limit = DEFAULT_SEARCH_CANDIDATE_LIMIT, tenantId, requestedScope, explicitScopeMode = 'exact', includeSuperseded = true, originProjects, ownScope) {
     const db = openStore(hippoRoot);
     try {
-        return loadRecallSearchEntriesFromDb(db, query, limit, tenantId, requestedScope, explicitScopeMode, includeSuperseded, originProjects);
+        return loadRecallSearchEntriesFromDb(db, query, limit, tenantId, requestedScope, explicitScopeMode, includeSuperseded, originProjects, ownScope);
     }
     finally {
         closeHippoDb(db);
@@ -182,12 +179,12 @@ export function loadRecallSearchEntries(hippoRoot, query, limit = DEFAULT_SEARCH
 }
 // Split out so callers with an already-open db (the prompt-recall path) skip
 // the initStore+open/close cycle per store per call.
-export function loadRecallSearchEntriesFromDb(db, query, limit = DEFAULT_SEARCH_CANDIDATE_LIMIT, tenantId, requestedScope, explicitScopeMode = 'exact', includeSuperseded = true, originProjects) {
-    return loadSearchRows(db, query, limit, tenantId, recallScopeFilter(requestedScope, explicitScopeMode), includeSuperseded, originProjects).map(rowToEntry);
+export function loadRecallSearchEntriesFromDb(db, query, limit = DEFAULT_SEARCH_CANDIDATE_LIMIT, tenantId, requestedScope, explicitScopeMode = 'exact', includeSuperseded = true, originProjects, ownScope) {
+    return loadSearchRows(db, query, limit, tenantId, recallScopeFilter(requestedScope, explicitScopeMode, ownScope), includeSuperseded, originProjects).map(rowToEntry);
 }
 /** The rows nearest `queryVector` that pass `spec`, nearest first. */
 export function loadVectorCandidateEntries(hippoRoot, queryVector, spec) {
-    const scope = recallScopeClause('m.', spec.scope);
+    const scope = withProject(recallScopeClause('m.', spec.scope), 'm.', spec.origin);
     const tenant = spec.tenantId !== undefined ? ' AND m.tenant_id = ?' : '';
     const current = spec.includeSuperseded ? '' : ' AND m.superseded_by IS NULL';
     const params = [...(spec.tenantId !== undefined ? [spec.tenantId] : []), ...scope.params];

package/dist/store/sessions.d.ts

@@ -1,13 +1,31 @@
 import { type TaskSnapshot, type SessionEvent } from './rows.js';
-export declare function saveActiveTaskSnapshot(hippoRoot: string, tenantId: string, snapshot: {
+/** A shared-store caller's task state bucket: its owner and every name its project's rows carry. */
+export interface ContinuityKey {
+    readonly owner: string;
+    readonly project: readonly string[];
+}
+export interface ContinuityFilter {
+    readonly sql: string;
+    readonly params: readonly string[];
+}
+export interface ContinuityStamp {
+    readonly owner: string;
+    readonly origin: string;
+}
+/** All or nothing: a key missing its owner or every project name matches no row, never the tenant's newest. */
+export declare function continuityWhere(key: ContinuityKey): ContinuityFilter;
+/** The columns a keyed write stamps; a partial key throws, since a row it wrote would match no reader. */
+export declare function continuityStamp(key: ContinuityKey): ContinuityStamp;
+type SnapshotInput = {
     task: string;
     summary: string;
     next_step: string;
     source?: string;
     session_id?: string | null;
     scope?: string | null;
-}): TaskSnapshot;
-export declare function loadActiveTaskSnapshot(hippoRoot: string, tenantId: string): TaskSnapshot | null;
+};
+export declare function saveActiveTaskSnapshot(hippoRoot: string, tenantId: string, snapshot: SnapshotInput, key?: ContinuityKey): TaskSnapshot;
+export declare function loadActiveTaskSnapshot(hippoRoot: string, tenantId: string, key?: ContinuityKey): TaskSnapshot | null;
 /**
  * Default freshness bound for AMBIENT active-task-snapshot reads: 72h, chosen over 48h so
  * a Friday-evening orphan still offers continuity on Monday morning.
@@ -41,18 +59,18 @@ export declare const SNAPSHOT_AMBIENT_MAX_AGE_MS: number;
 export declare function loadFreshActiveTaskSnapshot(hippoRoot: string, tenantId: string, opts?: {
     maxAgeMs?: number;
     sessionId?: string | null;
-}): TaskSnapshot | null;
+}, key?: ContinuityKey): TaskSnapshot | null;
 export declare function clearActiveTaskSnapshot(hippoRoot: string, tenantId: string, clearedStatus?: string): boolean;
 /**
  * Close the `active` task snapshot(s) owned by `sessionId`, for the
  * session-end death path.
- * Only one `active` row exists per tenant in practice (supersession happens
+ * Only one `active` row exists per tenant (per owner and project when keyed) in practice (supersession happens
  * at save), but the WHERE clause scopes on `session_id` too — not just
  * `status='active' AND tenant_id=?` — so an ending session can never close a
  * different, newer session's active snapshot. Returns the number of rows
  * closed (0 when no active row is owned by `sessionId`).
  */
-export declare function closeTaskSnapshotsForSession(hippoRoot: string, tenantId: string, sessionId: string, status?: string): number;
+export declare function closeTaskSnapshotsForSession(hippoRoot: string, tenantId: string, sessionId: string, status?: string, key?: ContinuityKey): number;
 export declare function appendSessionEvent(hippoRoot: string, tenantId: string, event: {
     session_id: string;
     event_type: string;
@@ -79,4 +97,5 @@ export declare function findPromotableSessions(hippoRoot: string, tenantId: stri
  * already exists.
  */
 export declare function traceExistsForSession(hippoRoot: string, tenantId: string, session_id: string): boolean;
+export {};
 //# sourceMappingURL=sessions.d.ts.map

package/dist/store/sessions.js

@@ -1,22 +1,55 @@
+import { isSharedStore } from '../config.js';
 import { closeHippoDb } from '../db.js';
+import { raiseMinBinary } from '../db/meta.js';
+import { originInSql } from '../project-identity.js';
 import { assertTenantId } from '../tenant.js';
 import { redactSecretsStrict } from '../secret-detect.js';
+import { TASK_OWNER_MIN_BINARY } from '../version.js';
 import { rowToTaskSnapshot, rowToSessionEvent, } from './rows.js';
 import { writeActiveTaskMirror, removeActiveTaskMirror, writeRecentSessionMirror } from './mirrors.js';
 import { openStore } from './open.js';
-export function saveActiveTaskSnapshot(hippoRoot, tenantId, snapshot) {
+/** All or nothing: a key missing its owner or every project name matches no row, never the tenant's newest. */
+export function continuityWhere(key) {
+    const names = key.project.filter((n) => n !== '');
+    if (key.owner === '' || names.length === 0)
+        return { sql: '0', params: [] };
+    return { sql: `owner_subject = ? AND ${originInSql(names)}`, params: [key.owner, ...names] };
+}
+/** The columns a keyed write stamps; a partial key throws, since a row it wrote would match no reader. */
+export function continuityStamp(key) {
+    const origin = key.project.find((n) => n !== '');
+    if (key.owner === '' || origin === undefined)
+        throw new Error('continuity key needs an owner and a project');
+    return { owner: key.owner, origin };
+}
+// An unkeyed write acts on the tenant's newest or every active row, which on a shared store belong to other owners.
+function assertKeyedOnSharedStore(fn, hippoRoot, key) {
+    if (!key && isSharedStore(hippoRoot))
+        throw new Error(`${fn}: a shared store keeps one task snapshot per owner and project, so this write needs their continuity key`);
+}
+function insertSnapshot(db, tenantId, snapshot, now, stamp) {
+    const result = db.prepare(`
+    INSERT INTO task_snapshots(task, summary, next_step, status, source, session_id, scope, tenant_id, created_at, updated_at, owner_subject, origin_project)
+    VALUES (?, ?, ?, 'active', ?, ?, ?, ?, ?, ?, ?, ?)
+  `).run(redactSecretsStrict(snapshot.task), redactSecretsStrict(snapshot.summary), redactSecretsStrict(snapshot.next_step), snapshot.source ?? 'cli', snapshot.session_id ?? null, snapshot.scope ?? null, tenantId, now, now, stamp?.owner ?? null, stamp?.origin ?? null);
+    return Number(result.lastInsertRowid ?? 0);
+}
+export function saveActiveTaskSnapshot(hippoRoot, tenantId, snapshot, key) {
     assertTenantId('saveActiveTaskSnapshot', tenantId);
+    assertKeyedOnSharedStore('saveActiveTaskSnapshot', hippoRoot, key);
+    const stamp = key ? continuityStamp(key) : null;
+    const owned = key ? continuityWhere(key) : null;
     const db = openStore(hippoRoot);
     const now = new Date().toISOString();
     try {
-        db.exec('BEGIN');
-        db.prepare(`UPDATE task_snapshots SET status = 'superseded', updated_at = ? WHERE status = 'active' AND tenant_id = ?`).run(now, tenantId);
-        const result = db.prepare(`
-      INSERT INTO task_snapshots(task, summary, next_step, status, source, session_id, scope, tenant_id, created_at, updated_at)
-      VALUES (?, ?, ?, 'active', ?, ?, ?, ?, ?, ?)
-    `).run(redactSecretsStrict(snapshot.task), redactSecretsStrict(snapshot.summary), redactSecretsStrict(snapshot.next_step), snapshot.source ?? 'cli', snapshot.session_id ?? null, snapshot.scope ?? null, tenantId, now, now);
+        db.exec('BEGIN IMMEDIATE');
+        db.prepare(`UPDATE task_snapshots SET status = 'superseded', updated_at = ? WHERE status = 'active' AND tenant_id = ?${owned ? ` AND ${owned.sql}` : ''}`)
+            .run(now, tenantId, ...(owned?.params ?? []));
+        const id = insertSnapshot(db, tenantId, snapshot, now, stamp);
+        // An older binary's tenant-wide supersede would close other owners' rows, so the first owner row shuts it out.
+        if (stamp)
+            raiseMinBinary(db, TASK_OWNER_MIN_BINARY);
         db.exec('COMMIT');
-        const id = Number(result.lastInsertRowid ?? 0);
         // SAFETY: row's shape matches the ten columns named in the SELECT above.
         const row = db.prepare(`
       SELECT id, task, summary, next_step, status, source, session_id, scope, created_at, updated_at
@@ -27,7 +60,9 @@ export function saveActiveTaskSnapshot(hippoRoot, tenantId, snapshot) {
             throw new Error('Failed to reload saved active task snapshot');
         }
         const loaded = rowToTaskSnapshot(row);
-        writeActiveTaskMirror(hippoRoot, tenantId, loaded);
+        // The mirror is one file per store, so only the local, unkeyed path writes it.
+        if (!key)
+            writeActiveTaskMirror(hippoRoot, tenantId, loaded);
         return loaded;
     }
     catch (error) {
@@ -43,24 +78,27 @@ export function saveActiveTaskSnapshot(hippoRoot, tenantId, snapshot) {
         closeHippoDb(db);
     }
 }
-export function loadActiveTaskSnapshot(hippoRoot, tenantId) {
+export function loadActiveTaskSnapshot(hippoRoot, tenantId, key) {
     assertTenantId('loadActiveTaskSnapshot', tenantId);
+    const owned = key ? continuityWhere(key) : null;
     const db = openStore(hippoRoot);
     try {
         // SAFETY: row's shape matches the ten columns named in the SELECT above.
         const row = db.prepare(`
       SELECT id, task, summary, next_step, status, source, session_id, scope, created_at, updated_at
       FROM task_snapshots
-      WHERE status = 'active' AND tenant_id = ?
+      WHERE status = 'active' AND tenant_id = ?${owned ? ` AND ${owned.sql}` : ''}
       ORDER BY updated_at DESC, id DESC
       LIMIT 1
-    `).get(tenantId);
+    `).get(tenantId, ...(owned?.params ?? []));
         if (!row) {
-            removeActiveTaskMirror(hippoRoot, tenantId);
+            if (!key)
+                removeActiveTaskMirror(hippoRoot, tenantId);
             return null;
         }
         const loaded = rowToTaskSnapshot(row);
-        writeActiveTaskMirror(hippoRoot, tenantId, loaded);
+        if (!key)
+            writeActiveTaskMirror(hippoRoot, tenantId, loaded);
         return loaded;
     }
     finally {
@@ -103,8 +141,8 @@ function isNonEmptySessionId(value) {
  *
  * No SQL change — age derives from the existing `updated_at` column.
  */
-export function loadFreshActiveTaskSnapshot(hippoRoot, tenantId, opts = {}) {
-    const snapshot = loadActiveTaskSnapshot(hippoRoot, tenantId);
+export function loadFreshActiveTaskSnapshot(hippoRoot, tenantId, opts = {}, key) {
+    const snapshot = loadActiveTaskSnapshot(hippoRoot, tenantId, key);
     if (!snapshot)
         return null;
     const callerSessionId = opts.sessionId;
@@ -119,6 +157,7 @@ export function loadFreshActiveTaskSnapshot(hippoRoot, tenantId, opts = {}) {
 }
 export function clearActiveTaskSnapshot(hippoRoot, tenantId, clearedStatus = 'cleared') {
     assertTenantId('clearActiveTaskSnapshot', tenantId);
+    assertKeyedOnSharedStore('clearActiveTaskSnapshot', hippoRoot, undefined);
     const db = openStore(hippoRoot);
     const now = new Date().toISOString();
     try {
@@ -139,18 +178,21 @@ export function clearActiveTaskSnapshot(hippoRoot, tenantId, clearedStatus = 'cl
 /**
  * Close the `active` task snapshot(s) owned by `sessionId`, for the
  * session-end death path.
- * Only one `active` row exists per tenant in practice (supersession happens
+ * Only one `active` row exists per tenant (per owner and project when keyed) in practice (supersession happens
  * at save), but the WHERE clause scopes on `session_id` too — not just
  * `status='active' AND tenant_id=?` — so an ending session can never close a
  * different, newer session's active snapshot. Returns the number of rows
  * closed (0 when no active row is owned by `sessionId`).
  */
-export function closeTaskSnapshotsForSession(hippoRoot, tenantId, sessionId, status = 'session-ended') {
+export function closeTaskSnapshotsForSession(hippoRoot, tenantId, sessionId, status = 'session-ended', key) {
     assertTenantId('closeTaskSnapshotsForSession', tenantId);
+    if (key)
+        continuityStamp(key); // a partial key is a caller bug, so fail loud rather than close nothing
+    const owned = key ? continuityWhere(key) : null;
     const db = openStore(hippoRoot);
     const now = new Date().toISOString();
     try {
-        const result = db.prepare(`UPDATE task_snapshots SET status = ?, updated_at = ? WHERE status = 'active' AND tenant_id = ? AND session_id = ?`).run(status, now, tenantId, sessionId);
+        const result = db.prepare(`UPDATE task_snapshots SET status = ?, updated_at = ? WHERE status = 'active' AND tenant_id = ? AND session_id = ?${owned ? ` AND ${owned.sql}` : ''}`).run(status, now, tenantId, sessionId, ...(owned?.params ?? []));
         return Number(result.changes ?? 0);
     }
     finally {

package/dist/store/summaries.d.ts

@@ -65,7 +65,7 @@ export interface RebuildPatch {
 }
 /**
  * Apply a rebuild result to a dirty summary. Atomic: one
- * prepared UPDATE statement plus syncFtsRow inside one SAVEPOINT.
+ * prepared UPDATE statement plus syncFtsRow inside one write scope.
  * WHERE includes `AND summary_dirty = 1` so concurrent sleep's race-loser
  * becomes a no-op (no rebuild_count bump, no audit row).
  *