hippo-memory 1.68.0 → 1.70.0

package/dist/consolidate/decay.js

@@ -1,7 +1,8 @@
-import { calculateStrength } from '../memory.js';
-import { detectSecret } from '../secret-detect.js';
-import { rescueSet, rankNonPinnedByTenant, validateWeights } from '../memory-value.js';
-import { MEMORY_VALUE_WEIGHTS, SOURCE_ARTIFACT_SHA256 } from '../memory-value-weights.js';
+import { calculateStrength } from '../core/memory.js';
+import { detectSecret } from '../util/secret-detect.js';
+import { rescueSet, rankNonPinnedByTenant, validateWeights } from './memory-value.js';
+import { MEMORY_VALUE_WEIGHTS, SOURCE_ARTIFACT_SHA256 } from './memory-value-weights.js';
+const STRENGTH_DECIMALS = 4;
 export const DECAY_THRESHOLD = 0.05;
 // A faded, unpinned, unrescued memory leaves active memory one of three
 // ways. A raw receipt is append-only: trg_memories_raw_append_only aborts
@@ -12,7 +13,7 @@ export const DECAY_THRESHOLD = 0.05;
 // Only called for rows `retirable` allows (never pinned, raw, kept for good or backing a first-class object).
 function retireFaded(run, entry, strength) {
     const { result } = run;
-    const why = `(strength ${strength.toFixed(4)} < ${DECAY_THRESHOLD})`;
+    const why = `(strength ${strength.toFixed(STRENGTH_DECIMALS)} < ${DECAY_THRESHOLD})`;
     // A faded secret is deleted, never kept dormant: keeping it would hold a
     // credential on disk that the user reasonably expects forgetting removed.
     if (run.config.dormant.enabled && !detectSecret(entry).flagged) {
@@ -65,35 +66,44 @@ function reportNonFiniteScores(result, rankById) {
             `with non-finite computed features (never rescued): ${nonFiniteIds.join(', ')}`);
     }
 }
-function decayWithMemoryValue(run) {
-    const { all, now, result } = run;
-    // Carried forward to logRun, where the mv_rescue audit rows are written: writing them here, before
-    // batchWriteAndDelete, would assert rescues whose effects might never land if a later phase throws.
-    const rescuedEntries = [];
-    let rescuedIds = new Set();
-    let rankById = new Map();
-    // --- Phase 1: classify (zero commits) ---
+// --- Phase 1: classify (zero commits) ---
+function classifyByStrength(run) {
     const condemned = [];
     const strengthById = new Map();
-    for (const entry of all) {
-        const strength = calculateStrength(entry, now, run.decayOpts);
+    for (const entry of run.all) {
+        const strength = calculateStrength(entry, run.now, run.decayOpts);
         strengthById.set(entry.id, strength);
         if (run.retirable(entry) && strength < DECAY_THRESHOLD) {
             condemned.push(entry);
         }
     }
+    return { strengthById, condemnedIds: new Set(condemned.map((e) => e.id)) };
+}
+function reportRescue(result, entry, strength, rank) {
+    const rankNote = rank
+        ? ` - rescued (rank ${rank.rank}/${rank.totalNonPinned} in tenant ${rank.tenantId}, top ${rank.keepN})`
+        : ' - rescued';
+    result.details.push(`  🛟 ${entry.id} (strength ${strength.toFixed(STRENGTH_DECIMALS)} < ${DECAY_THRESHOLD})${rankNote}`);
+}
+function decayWithMemoryValue(run) {
+    const { all, now, result } = run;
+    // Carried forward to logRun, where the mv_rescue audit rows are written: writing them here, before
+    // batchWriteAndDelete, would assert rescues whose effects might never land if a later phase throws.
+    const rescuedEntries = [];
+    let rescuedIds = new Set();
+    let rankById = new Map();
+    const { strengthById, condemnedIds } = classifyByStrength(run);
     // --- Phase 2a: rescue decision (pure compute) ---
     // Runs under --dry-run too (only the pendingDeletes flush and the audit write in
     // logRun stay !dryRun-gated), so the preview matches what a
     // real run would decide.
-    const condemnedIds = new Set(condemned.map((e) => e.id));
     // Fail-loud must not depend on condemnation traffic: validate the frozen weights even when nothing is condemned.
     validateWeights();
     if (condemnedIds.size > 0) {
         // Rank per tenant ONCE: rankById feeds both rescueSet (via precomputedRanks) and the detail/audit
         // context below, so the whole-store ranking runs once per sleep and only when something is condemned.
         rankById = rankNonPinnedByTenant(all, now);
-        rescuedIds = rescueSet(all, condemnedIds, now, MEMORY_VALUE_WEIGHTS, SOURCE_ARTIFACT_SHA256, rankById);
+        rescuedIds = rescueSet(all, condemnedIds, now, { weights: MEMORY_VALUE_WEIGHTS, digest: SOURCE_ARTIFACT_SHA256, precomputedRanks: rankById });
         reportNonFiniteScores(result, rankById);
     }
     // --- Phase 2b: commit, one pass over `all` in ITS ORIGINAL ORDER ---
@@ -106,11 +116,7 @@ function decayWithMemoryValue(run) {
                 // Confidence is left alone here: it is an epistemic tier, not a
                 // cached computation, so resolveConfidence derives it on read.
                 rescuedEntries.push(keepSurvivor(run, entry, strength));
-                const rank = rankById.get(entry.id);
-                const rankNote = rank
-                    ? ` - rescued (rank ${rank.rank}/${rank.totalNonPinned} in tenant ${rank.tenantId}, top ${rank.keepN})`
-                    : ' - rescued';
-                result.details.push(`  🛟 ${entry.id} (strength ${strength.toFixed(4)} < ${DECAY_THRESHOLD})${rankNote}`);
+                reportRescue(result, entry, strength, rankById.get(entry.id));
             }
             else {
                 retireFaded(run, entry, strength);

package/dist/{dedupe.js → consolidate/dedupe.js}

@@ -20,15 +20,13 @@
  * WITHIN each tenant group; cross-tenant pairs are never compared. Raw and
  * superseded rows are not candidates at all (v1.38.1).
  */
-import { textOverlap } from './tokenize.js';
-import { loadAllEntries } from './store/entry-reads.js';
-import { deleteEntryOn, memoriesBackingObjects } from './store/delete-and-batch.js';
-import { openStore } from './store/open.js';
-import { closeHippoDb } from './db.js';
-import { compareEntryIdentity } from './compare.js';
-import { canAutoDelete } from './memory.js';
-import { derivationPartitionKey } from './recall-scope.js';
-import { duplicateKey } from './same-text.js';
+import { textOverlap } from '../util/tokenize.js';
+import { loadCurrentDistilledEntries } from '../store/entry-reads.js';
+import { deleteEntriesOneByOne, memoriesBackingObjects } from '../store/delete-and-batch.js';
+import { compareEntryIdentity } from '../core/compare.js';
+import { canAutoDelete } from '../core/memory.js';
+import { derivationPartitionKey } from '../store/recall-scope.js';
+import { duplicateKey } from '../util/same-text.js';
 /** Quantization step for strength-tie comparisons. The historical 0.01
  *  epsilon (see `strengthBucket` below) applied via rounding instead of a
  *  raw abs-diff threshold, so the tiebreak is transitive. */
@@ -136,7 +134,7 @@ export function deduplicateStore(hippoRoot, options = {}) {
     const dryRun = options.dryRun ?? false;
     // Only current distilled rows compete: raw rows are append-only (the delete
     // trigger would abort sleep mid-loop) and superseded rows are history, as in consolidate.ts.
-    const entries = loadAllEntries(hippoRoot).filter((e) => e.kind === 'distilled' && !e.superseded_by);
+    const entries = loadCurrentDistilledEntries(hippoRoot);
     const entriesByTenant = entriesByPartition(entries);
     // Shared across tenant groups: safe because memory ids are globally
     // unique (crypto.randomUUID at creation), so an id in `removed` can never
@@ -156,14 +154,8 @@ export function deduplicateStore(hippoRoot, options = {}) {
 }
 /** The pairs whose loser was deleted; one store handle, one transaction per delete. */
 function deletePairs(hippoRoot, pairs, actor) {
-    if (pairs.length === 0)
-        return [];
-    const db = openStore(hippoRoot);
-    try {
-        return pairs.filter((p) => deleteEntryOn(db, hippoRoot, p.removed, { actor, reason: `dedup: duplicate of ${p.kept}`, automatic: true }));
-    }
-    finally {
-        closeHippoDb(db);
-    }
+    const targets = pairs.map((p) => ({ id: p.removed, reason: `dedup: duplicate of ${p.kept}` }));
+    const gone = deleteEntriesOneByOne(hippoRoot, targets, { actor, automatic: true });
+    return pairs.filter((_, i) => gone[i]);
 }
 //# sourceMappingURL=dedupe.js.map

package/dist/consolidate/flush-units.d.ts

@@ -1,5 +1,5 @@
-import type { MemoryEntry } from '../memory.js';
-import type { DormantMove } from '../dormant.js';
+import type { MemoryEntry } from '../core/memory.js';
+import type { DormantMove } from '../store/dormant.js';
 import type { FlushComponent } from '../store/delete-and-batch.js';
 /** Components that share no id, ordered by each one's first op across writes, then deletes, then dormant moves. */
 export declare function groupFlush(writes: readonly MemoryEntry[], deletes: readonly string[], dormant: readonly DormantMove[], units: readonly (readonly string[])[]): FlushComponent[];

package/dist/{half-life-migration.d.ts → consolidate/half-life-migration.d.ts}

@@ -19,13 +19,9 @@
  * (7 days when never recorded) to the configured `defaultHalfLifeDays`. Once per store it also
  * moves memories of live decisions, incidents and other objects off the flat 90 days they used to get.
  */
-import { type MemoryEntry } from './memory.js';
-import { HALF_LIFE_BASE_META_KEY } from './store/open.js';
-/** The base every store used before the base was recorded. */
-export declare const LEGACY_HALF_LIFE_BASE = 7;
-/** The flat half-life the decision, incident and other object writers gave their memories before they took the default. */
-export declare const LEGACY_TYPED_HALF_LIFE = 90;
-export { HALF_LIFE_BASE_META_KEY };
+import { type MemoryEntry } from '../core/memory.js';
+import { HALF_LIFE_BASE_META_KEY, LEGACY_TYPED_HALF_LIFE } from '../store/open.js';
+export { HALF_LIFE_BASE_META_KEY, LEGACY_TYPED_HALF_LIFE };
 /** What {@link migrateDefaultHalfLife} did, or would do under `dryRun`. */
 export interface HalfLifeMigrationResult {
     from: number;
@@ -49,8 +45,6 @@ export declare function planHalfLifeMigration(entries: readonly MemoryEntry[], f
 export declare function planTypedHalfLifeMigration(entries: readonly MemoryEntry[], to: number): MemoryEntry[];
 /** The base this store's memories are on. */
 export declare function storeHalfLifeBase(hippoRoot: string): number;
-/** The base an object writer gives its memory: the flat 90 days until this store's typed migration has run, which then moves them, and the default after. */
-export declare function objectHalfLifeDays(hippoRoot: string): number;
 /**
  * Move the store's memories from the base they are on, and those of objects from
  * the old flat 90 days, to `to`, once. Under `dryRun` nothing is written, the recorded

package/dist/consolidate/half-life-migration.js

@@ -0,0 +1,106 @@
+/**
+ * Moving a store's memories to a new default half-life.
+ *
+ * Each memory stores its own `half_life_days`, set at write from the
+ * default base and a few write-time multipliers (`deriveHalfLife`). Changing
+ * the default therefore reaches only new memories; without this migration a
+ * store would mix old-base and new-base memories, a state the decay
+ * evaluation never tested. The rule, declared before any run:
+ *
+ * - only a memory still on the old base is rescaled: its half-life is
+ *   `deriveHalfLife(from, entry)` plus its recall bonus. A memory hippo shortened since
+ *   (invalidated, superseded, a merge source, marked bad) or one with its own
+ *   fixed half-life (decisions, incidents, customer notes) keeps its value;
+ * - every rescale is written to the audit log with the ids, so it can be
+ *   undone, and the store records the base it is on (`meta`), so the
+ *   migration runs once.
+ *
+ * `hippo sleep` runs it before its decay pass, from the base the store is on
+ * (7 days when never recorded) to the configured `defaultHalfLifeDays`. Once per store it also
+ * moves memories of live decisions, incidents and other objects off the flat 90 days they used to get.
+ */
+import { deriveHalfLife } from '../core/memory.js';
+import { HALF_LIFE_BASE_META_KEY, LEGACY_TYPED_HALF_LIFE } from '../store/open.js';
+import { moveHalfLives, recordedHalfLifeBase } from '../store/half-life.js';
+const TYPED_SOURCES = new Set(['decision', 'incident', 'process', 'policy', 'skill', 'project_brief', 'customer_note']);
+export { HALF_LIFE_BASE_META_KEY, LEGACY_TYPED_HALF_LIFE };
+/** Recall bonus over `written`, the half-life `entry` got at write, or null when off it; each recall added 2 days. */
+export function halfLifeRecallBonus(entry, written) {
+    if (entry.superseded_by || entry.tags.includes('invalidated') || entry.tags.includes('superseded'))
+        return null;
+    const bonus = entry.half_life_days - written;
+    const k = Math.round(bonus / 2);
+    return Math.abs(bonus - 2 * k) < 1e-9 && k >= 0 && k <= entry.retrieval_count ? bonus : null;
+}
+/** The entries to rescale from `from` to `to`, as copies that keep their recall bonus. Pure. */
+export function planHalfLifeMigration(entries, from, to) {
+    if (from === to)
+        return [];
+    return entries.flatMap((e) => {
+        const bonus = halfLifeRecallBonus(e, deriveHalfLife(from, e));
+        return bonus === null ? [] : [{ ...e, half_life_days: deriveHalfLife(to, e) + bonus }];
+    });
+}
+/** Memories of decisions, incidents and other objects still on the flat 90 days, as copies on `to` that keep their recall bonus. Pure. */
+export function planTypedHalfLifeMigration(entries, to) {
+    return entries.flatMap((e) => {
+        const bonus = TYPED_SOURCES.has(e.source) ? halfLifeRecallBonus(e, LEGACY_TYPED_HALF_LIFE) : null;
+        const next = bonus === null ? e.half_life_days : deriveHalfLife(to, e) + bonus;
+        return next === e.half_life_days ? [] : [{ ...e, half_life_days: next }];
+    });
+}
+/** The base this store's memories are on. */
+export function storeHalfLifeBase(hippoRoot) {
+    return recordedHalfLifeBase(hippoRoot);
+}
+/**
+ * Move the store's memories from the base they are on, and those of objects from
+ * the old flat 90 days, to `to`, once. Under `dryRun` nothing is written, the recorded
+ * base included.
+ */
+export function migrateDefaultHalfLife(hippoRoot, to, opts = {}) {
+    const dryRun = opts.dryRun ?? false;
+    const { from, outcome } = moveHalfLives(hippoRoot, to, { dryRun, actor: opts.actor ?? 'system' }, (rows) => {
+        const { basePlan, typedPlan } = planMoves(rows, to);
+        const plan = [...basePlan, ...typedPlan];
+        return {
+            moves: [{ from: rows.from, to, entries: basePlan }, { from: LEGACY_TYPED_HALF_LIFE, to, entries: typedPlan }],
+            outcome: { rescaled: basePlan.length, typed: typedPlan.length, kept: rows.all.length - plan.length, halfLives: new Map(plan.map((e) => [e.id, e.half_life_days])) },
+        };
+    });
+    const moved = outcome ?? { rescaled: 0, typed: 0, kept: 0, halfLives: new Map() };
+    return { from, to, rescaled: moved.rescaled, typed: moved.typed, kept: moved.kept, dryRun, halfLives: moved.halfLives };
+}
+/** The base move and the move of object memories, planned from one read of the store. Pure. */
+function planMoves(rows, to) {
+    const { all, typedPending } = rows;
+    const objects = objectMemoryIds(rows.objectRows);
+    const losers = conflictLosers(rows.conflictAudits, rows.resolvedConflicts);
+    const copies = new Set(all.flatMap((e) => (e.superseded_by ? [e.superseded_by] : [])));
+    // Provenance before shape: an object's memory came from its writer, a supersede copy from the base (it keeps the source). Shape decides the rest.
+    const objectWritten = (e) => objects.all.has(e.id) || (!copies.has(e.id) && TYPED_SOURCES.has(e.source) && halfLifeRecallBonus(e, LEGACY_TYPED_HALF_LIFE) !== null);
+    const typedPlan = typedPending ? planTypedHalfLifeMigration(all.filter((e) => objectWritten(e) && !objects.retired.has(e.id) && !losers.has(e.id)), to) : [];
+    const basePlan = planHalfLifeMigration(typedPending ? all.filter((e) => !objectWritten(e)) : all, rows.from, to);
+    return { basePlan, typedPlan };
+}
+/** Memories behind every object, and those behind a superseded or closed one. Retiring an object leaves its memory untouched, so only its table knows. */
+function objectMemoryIds(objectRows) {
+    const all = new Set();
+    const retired = new Set();
+    for (const r of objectRows) {
+        all.add(r.memory_id);
+        if (r.status === 'superseded' || r.status === 'closed')
+            retired.add(r.memory_id);
+    }
+    return { all, retired };
+}
+/** Memories that lost a conflict, which resolveConflict halved untagged. A resolved conflict with no audit row (resolved before resolves were audited, or found stale) names no winner, so both sides count. */
+function conflictLosers(audited, resolved) {
+    const losers = new Set(audited.map((a) => a.loserId));
+    const named = new Set(audited.map((a) => a.conflictId));
+    for (const c of resolved)
+        if (!named.has(c.id))
+            losers.add(c.memory_a_id).add(c.memory_b_id);
+    return losers;
+}
+//# sourceMappingURL=half-life-migration.js.map

package/dist/consolidate/llm-passes.js

@@ -1,8 +1,8 @@
-import { envAnthropicApiKey, envDagRebuildCap } from '../env.js';
-import { Layer } from '../memory.js';
-import { log } from '../log.js';
+import { envAnthropicApiKey, envDagRebuildCap } from '../util/env.js';
+import { Layer } from '../core/memory.js';
+import { log } from '../util/log.js';
 import { keptAsWritten } from './run.js';
-import { isReusable } from '../memory-quality.js';
+import { isReusable } from '../core/memory-quality.js';
 /** The key, model options and once-per-line error reporter every LLM phase shares. */
 function sleepLlm(run, fetcher) {
     const { config, result } = run;
@@ -30,7 +30,7 @@ export async function llmPasses(run, fetcher) {
     run.result.extractionCandidates = extractionCandidates.length;
     const llm = sleepLlm(run, fetcher);
     if (llm.apiKey && extractionCandidates.length > 0 && !run.dryRun) {
-        const { extractFacts, storeExtractedFacts } = await import('../extract.js');
+        const { extractFacts, storeExtractedFacts } = await import('../learn/extract.js');
         const batchLimit = 20;
         let extractedCount = 0;
         for (const candidate of extractionCandidates.slice(0, batchLimit)) {
@@ -60,7 +60,7 @@ async function dagBuildPass(run, { apiKey, llmError, llmOpts }) {
     if (!(apiKey && extractedFacts.length >= 3 && !run.dryRun))
         return;
     try {
-        const { buildDag } = await import('../dag.js');
+        const { buildDag } = await import('./dag.js');
         const dagResult = await buildDag(run.hippoRoot, extractedFacts, { ...llmOpts, onError: llmError('dag') });
         run.result.dagCandidateClusters = dagResult.candidateClusters;
         run.result.dagSummariesCreated = dagResult.summariesCreated;
@@ -83,7 +83,7 @@ async function dagBuildPass(run, { apiKey, llmError, llmOpts }) {
 async function dagRebuildPass(run, { llmError, llmOpts }) {
     const { result } = run;
     try {
-        const { rebuildDirtySummaries } = await import('../dag.js');
+        const { rebuildDirtySummaries } = await import('./dag.js');
         const rawCap = envDagRebuildCap();
         // Hard ceiling so a misconfigured env can't burn unbounded LLM cost.
         const cap = rawCap !== undefined ? Math.min(rawCap, 1000) : 20;
@@ -123,7 +123,7 @@ async function dagRebuildPass(run, { llmError, llmOpts }) {
 // L2s directly via writeEntry without pushing back into survivors.
 async function entityProfilePass(run, { llmError, llmOpts }) {
     try {
-        const { buildEntityProfiles } = await import('../dag.js');
+        const { buildEntityProfiles } = await import('./dag.js');
         const { loadAllL2Summaries } = await import('../store/summaries.js');
         const l2Summaries = loadAllL2Summaries(run.hippoRoot);
         if (l2Summaries.length >= 2) {

package/dist/{memory-value.d.ts → consolidate/memory-value.d.ts}

@@ -18,7 +18,7 @@
  * candidate set. Deletes(flag-on) subset Deletes(flag-off) by construction — this
  * function can only ever shrink the condemned set, never grow it.
  */
-import { type MemoryEntry } from './memory.js';
+import { type MemoryEntry } from '../core/memory.js';
 /** The 8 live feature dims (FIT_DIMS) — canonical order for iteration. */
 export declare const MV_FEATURE_NAMES: ReadonlyArray<keyof MvFeatureVector>;
 export interface MvFeatureVector {
@@ -91,6 +91,11 @@ export interface MvRankInfo {
  * the fail-loud path, never overridden by production callers.
  */
 export declare function rankNonPinnedByTenant(entries: MemoryEntry[], now: Date, weights?: Readonly<Record<string, number>>, digest?: string): Map<string, MvRankInfo>;
+export interface RescueSetOptions {
+    readonly weights?: Readonly<Record<string, number>>;
+    readonly digest?: string;
+    readonly precomputedRanks?: Map<string, MvRankInfo>;
+}
 /**
  * Rescue decision: a condemned entry is rescued iff it ranks in the top
  * 30% of its tenant's non-pinned candidate set by learned score. Returns the
@@ -109,5 +114,5 @@ export declare function rankNonPinnedByTenant(entries: MemoryEntry[], now: Date,
  * exactly once per sleep instead of twice. Omitted (the default), rescueSet
  * computes it internally as before — existing callers/tests are unaffected.
  */
-export declare function rescueSet(entries: MemoryEntry[], condemnedIds: Set<string>, now: Date, weights?: Readonly<Record<string, number>>, digest?: string, precomputedRanks?: Map<string, MvRankInfo>): Set<string>;
+export declare function rescueSet(entries: MemoryEntry[], condemnedIds: Set<string>, now: Date, options?: RescueSetOptions): Set<string>;
 //# sourceMappingURL=memory-value.d.ts.map

package/dist/{memory-value.js → consolidate/memory-value.js}

@@ -18,9 +18,10 @@
  * candidate set. Deletes(flag-on) subset Deletes(flag-off) by construction — this
  * function can only ever shrink the condemned set, never grow it.
  */
-import { calculateStrength } from './memory.js';
-import { compareEntryIdentity } from './compare.js';
+import { calculateStrength } from '../core/memory.js';
+import { compareEntryIdentity } from '../core/compare.js';
 import { MEMORY_VALUE_WEIGHTS, SOURCE_ARTIFACT_SHA256 } from './memory-value-weights.js';
+import { DAY_MS } from '../util/time.js';
 /** The 8 live feature dims (FIT_DIMS) — canonical order for iteration. */
 export const MV_FEATURE_NAMES = [
     'age_days',
@@ -62,7 +63,7 @@ const MIN_RESCUE_GROUP = 10;
  * FEATURE is clock-basis.
  */
 export function computeMvFeatures(entry, now) {
-    const ageDays = (now.getTime() - Date.parse(entry.created)) / (1000 * 60 * 60 * 24);
+    const ageDays = (now.getTime() - Date.parse(entry.created)) / DAY_MS;
     const pos = entry.outcome_positive ?? 0;
     const neg = entry.outcome_negative ?? 0;
     return {
@@ -97,11 +98,11 @@ export function validateWeights(weights = MEMORY_VALUE_WEIGHTS, digest = SOURCE_
         const v = weights[key];
         if (!isFiniteWeightValue(v)) {
             throw new Error(`memory-value: weights constant is malformed — "${key}" is not a finite number ` +
-                `(src/memory-value-weights.ts)`);
+                `(src/consolidate/memory-value-weights.ts)`);
         }
     }
     if (!isNonEmptyDigestString(digest)) {
-        throw new Error('memory-value: weights constant is malformed — SOURCE_ARTIFACT_SHA256 digest missing (src/memory-value-weights.ts)');
+        throw new Error('memory-value: weights constant is malformed — SOURCE_ARTIFACT_SHA256 digest missing (src/consolidate/memory-value-weights.ts)');
     }
 }
 /**
@@ -194,7 +195,7 @@ export function rankNonPinnedByTenant(entries, now, weights = MEMORY_VALUE_WEIGH
     const result = new Map();
     for (const [tenantId, group] of byTenant) {
         const scores = scoreEntries(group, now, weights);
-        // score DESC, then compareEntryIdentity, the shared tie-break of every score-primary sort (src/compare.ts).
+        // score DESC, then compareEntryIdentity, the shared tie-break of every score-primary sort (src/core/compare.ts).
         // `-Infinity - -Infinity` is NaN, which Array.sort leaves insertion-order-dependent, so NaN ties too.
         const sorted = [...group].sort((a, b) => {
             const diff = scores.get(b.id) - scores.get(a.id);
@@ -234,7 +235,8 @@ export function rankNonPinnedByTenant(entries, now, weights = MEMORY_VALUE_WEIGH
  * exactly once per sleep instead of twice. Omitted (the default), rescueSet
  * computes it internally as before — existing callers/tests are unaffected.
  */
-export function rescueSet(entries, condemnedIds, now, weights = MEMORY_VALUE_WEIGHTS, digest = SOURCE_ARTIFACT_SHA256, precomputedRanks) {
+export function rescueSet(entries, condemnedIds, now, options = {}) {
+    const { weights = MEMORY_VALUE_WEIGHTS, digest = SOURCE_ARTIFACT_SHA256, precomputedRanks } = options;
     validateWeights(weights, digest); // fail loud before any rescue computation
     const ranked = precomputedRanks ?? rankNonPinnedByTenant(entries, now, weights, digest);
     const rescued = new Set();

package/dist/consolidate/merge.js

@@ -1,15 +1,15 @@
-import { Layer, calculateStrength, createMemory } from '../memory.js';
-import { tokenize } from '../tokenize.js';
-import { jaccardMinShared, overlapPartners } from '../overlap-index.js';
-import { compareEntryIdentity } from '../compare.js';
-import { duplicateKey, mergedText } from '../same-text.js';
-import { successorAfterRetirement } from '../merged-row.js';
-import { rejectionDigest, findRejectedValue } from '../rejection.js';
-import { appendAuditEvent, reportAuditWriteFailure } from '../audit.js';
-import { derivationScope, derivationPartitionKey } from '../recall-scope.js';
+import { Layer, calculateStrength, createMemory } from '../core/memory.js';
+import { tokenize } from '../util/tokenize.js';
+import { jaccardMinShared, overlapPartners } from './overlap-index.js';
+import { compareEntryIdentity } from '../core/compare.js';
+import { duplicateKey, mergedText } from '../util/same-text.js';
+import { successorAfterRetirement } from './merged-row.js';
+import { rejectionDigest } from '../store/rejection.js';
+import { reportAuditWriteFailure } from '../store/audit.js';
+import { derivationScope, derivationPartitionKey } from '../store/recall-scope.js';
 import { jaccardSets } from './conflicts.js';
 import { keptAsWritten } from './run.js';
-import { isReusable } from '../memory-quality.js';
+import { isReusable } from '../core/memory-quality.js';
 const MERGE_OVERLAP_THRESHOLD = 0.35; // Jaccard similarity for "related"
 const MERGE_MIN_CLUSTER = 2; // minimum cluster size to merge
 const MERGE_MAX_SOURCES = 5; // with MERGE_MAX_CHARS, keeps a merged row near 500 tokens, a third of the 1,500-token context budget
@@ -23,10 +23,7 @@ const MERGE_SOURCE_HALF_LIFE_FACTOR = 0.3;
 export function retireHeldTexts(run) {
     const { survivors } = run;
     const byId = new Map(run.all.map((e) => [e.id, e]));
-    const rejectedIn = (tenantId) => (text) => {
-        const db = run.getConsolidateDb();
-        return db !== null && findRejectedValue(db, tenantId, rejectionDigest(text)) !== null;
-    };
+    const rejectedIn = (tenantId) => (text) => run.tombstones.find(tenantId, rejectionDigest(text)) !== null;
     for (let i = survivors.length - 1; i >= 0; i--) {
         const row = survivors[i];
         const successor = run.retirable(row) ? successorAfterRetirement(row, byId, rejectedIn(row.tenantId)) : undefined;
@@ -46,17 +43,13 @@ export function retireHeldTexts(run) {
         }
     }
 }
-// -------------------------------------------------------------------------
-// 3. Merge pass  - episodic entries only
-// -------------------------------------------------------------------------
-/** Returns how many clusters were skipped because their merged text matches a rejected value. */
-export function mergePass(run) {
-    const alreadyMergedIds = new Set(run.survivors.flatMap((e) => e.parents));
-    const mergeCandidates = run.survivors.filter((e) => e.layer === Layer.Episodic && !e.superseded_by && !keptAsWritten(e) && !alreadyMergedIds.has(e.id)
+/** The episodic survivors a merge may consume, grouped by the partition their merged row would land in. */
+function partitionMergeCandidates(survivors) {
+    const alreadyMergedIds = new Set(survivors.flatMap((e) => e.parents));
+    const mergeCandidates = survivors.filter((e) => e.layer === Layer.Episodic && !e.superseded_by && !keptAsWritten(e) && !alreadyMergedIds.has(e.id)
         && !e.pinned // a pin merged with a look-alike would read as one of two values
         && tokenize(e.content).length > 0 // two empty token sets overlap 1, so tokenless text would merge with any other
         && isReusable(e));
-    const used = new Set();
     // Partition BEFORE the overlap loop so a cluster can never span tenants and merge cross-tenant content.
     // Map keeps insertion order, so a single-tenant store gets one partition in the original order.
     const mergeCandidatesByTenant = new Map();
@@ -68,7 +61,16 @@ export function mergePass(run) {
         else
             mergeCandidatesByTenant.set(key, [entry]);
     }
-    // The rejection guard reuses the one consolidateDb handle opened lazily in consolidate(); a dry-run
+    return mergeCandidatesByTenant;
+}
+// -------------------------------------------------------------------------
+// 3. Merge pass  - episodic entries only
+// -------------------------------------------------------------------------
+/** Returns how many clusters were skipped because their merged text matches a rejected value. */
+export function mergePass(run) {
+    const used = new Set();
+    const mergeCandidatesByTenant = partitionMergeCandidates(run.survivors);
+    // The rejection guard reuses the run's one lazily opened tombstone handle; a dry-run
     // never reaches batchWriteAndDelete's guard bypass, so it has nothing to protect there.
     let mergesSkippedRejected = 0;
     for (const [, tenantCandidates] of mergeCandidatesByTenant) {
@@ -107,28 +109,9 @@ function mergeCluster(run, partition, cluster, related, used) {
     const { result, dryRun } = run;
     // Create a semantic summary
     const mergedContent = mergeContents(cluster);
-    const allTags = Array.from(new Set(cluster.flatMap((e) => e.tags))).sort();
-    const maxValence = pickStrongestValence(cluster);
     // Build the semantic entry FIRST (createMemory is cheap and pure) so the tombstone check below runs
     // under the partition's tenant, the one every cluster member shares and the row will land in.
-    let semantic = null;
-    if (!dryRun) {
-        semantic = {
-            ...createMemory(mergedContent, {
-                layer: Layer.Semantic,
-                tags: allTags,
-                emotional_valence: maxValence,
-                schema_fit: 0.7,
-                source: 'consolidation',
-                confidence: 'inferred',
-                tenantId: partition.tenantId,
-                scope: partition.scope,
-                baseHalfLifeDays: run.config.defaultHalfLifeDays,
-            }),
-            origin_project: partition.origin,
-            parents: cluster.map((e) => e.id),
-        };
-    }
+    const semantic = dryRun ? null : semanticSummary(mergedContent, cluster, partition, run.config.defaultHalfLifeDays);
     if (semantic && mergeRejected(run, semantic, cluster, related, used))
         return false;
     // Mark cluster members as used
@@ -150,14 +133,36 @@ function mergeCluster(run, partition, cluster, related, used) {
         // references as `survivors`, and the later detectConflicts(survivors)
         // pass in this same run must see the post-demotion half-life, or it
         // can persist conflicts for entries the just-written state excludes.
-        for (const e of cluster) {
-            e.half_life_days = Math.max(1, Math.floor(e.half_life_days * MERGE_SOURCE_HALF_LIFE_FACTOR));
-            e.strength = calculateStrength(e, run.now, run.decayOpts);
-            run.pendingWrites.push(e);
-        }
+        demoteMergedSources(run, cluster);
     }
     return true;
 }
+function semanticSummary(mergedContent, cluster, partition, baseHalfLifeDays) {
+    const allTags = Array.from(new Set(cluster.flatMap((e) => e.tags))).sort();
+    const maxValence = pickStrongestValence(cluster);
+    return {
+        ...createMemory(mergedContent, {
+            layer: Layer.Semantic,
+            tags: allTags,
+            emotional_valence: maxValence,
+            schema_fit: 0.7,
+            source: 'consolidation',
+            confidence: 'inferred',
+            tenantId: partition.tenantId,
+            scope: partition.scope,
+            baseHalfLifeDays,
+        }),
+        origin_project: partition.origin,
+        parents: cluster.map((e) => e.id),
+    };
+}
+function demoteMergedSources(run, cluster) {
+    for (const e of cluster) {
+        e.half_life_days = Math.max(1, Math.floor(e.half_life_days * MERGE_SOURCE_HALF_LIFE_FACTOR));
+        e.strength = calculateStrength(e, run.now, run.decayOpts);
+        run.pendingWrites.push(e);
+    }
+}
 // mergeContents is DETERMINISTIC CONCATENATION (not an LLM paraphrase)
 // — if a human rejected exactly this byte-identical rollup before, an
 // unguarded sleep would regenerate it every cycle and
@@ -167,13 +172,11 @@ function mergeCluster(run, partition, cluster, related, used) {
 // not demoted, not deleted — so a later sleep gets another chance if
 // the tombstone is lifted.
 function mergeRejected(run, semantic, cluster, related, used) {
-    const consolidateDb = run.getConsolidateDb();
-    if (!consolidateDb)
-        return false;
+    const { tombstones } = run;
     const newDigest = rejectionDigest(semantic.content);
     const oldDigest = rejectionDigest(legacyMergeContents(related)); // tombstones from older releases hold this format's digest
-    const newHit = findRejectedValue(consolidateDb, semantic.tenantId, newDigest);
-    const tombstone = newHit ?? findRejectedValue(consolidateDb, semantic.tenantId, oldDigest);
+    const newHit = tombstones.find(semantic.tenantId, newDigest);
+    const tombstone = newHit ?? tombstones.find(semantic.tenantId, oldDigest);
     const mergeDigest = newHit ? newDigest : oldDigest;
     if (!tombstone)
         return false;
@@ -184,7 +187,7 @@ function mergeRejected(run, semantic, cluster, related, used) {
     for (const e of rejected)
         used.add(e.id);
     try {
-        appendAuditEvent(consolidateDb, {
+        tombstones.audit({
             tenantId: semantic.tenantId,
             actor: 'sleep',
             op: 'reject_refusal',

package/dist/{merged-row.d.ts → consolidate/merged-row.d.ts}

@@ -1,4 +1,4 @@
-import { type MemoryEntry } from './memory.js';
+import { type MemoryEntry } from '../core/memory.js';
 /** The row that replaces a merged row once its retired texts leave: undefined when it holds none, null when nothing else is left. */
 export declare function mergedSuccessor(row: MemoryEntry, retired: (text: string) => boolean, retiredIds: ReadonlySet<string>): MemoryEntry | null | undefined;
 /** Sleep's check on a merged row: drops texts whose source was superseded since the merge, or that a rejection now covers. */

package/dist/{merged-row.js → consolidate/merged-row.js}

@@ -1,7 +1,7 @@
 // A sleep-merged row copies its sources' texts, so retiring a text (reject, or superseding its source) must reach the row too.
 // SHORTCUT: reject rewrites merged rows at once, live and dormant; supersede and `resolve --reject-loser` wait for the next sleep's check, which sees a dormant row only once restored.
-import { generateId } from './memory.js';
-import { duplicateKey, heldTexts, mergedText } from './same-text.js';
+import { generateId } from '../core/memory.js';
+import { duplicateKey, heldTexts, mergedText } from '../util/same-text.js';
 /** The row that replaces a merged row once its retired texts leave: undefined when it holds none, null when nothing else is left. */
 export function mergedSuccessor(row, retired, retiredIds) {
     const texts = heldTexts(row);