hippo-memory 1.68.0 → 1.70.0

package/dist/api/context.js

@@ -1,30 +1,27 @@
 // Ambient context injection: the admission policy and getContext.
 import { isInitialized } from '../store/open.js';
-import { strengthenRetrieved } from '../store/entry-writes.js';
-import { loadRecallSearchEntries } from '../store/search-rows.js';
 import { DEFAULT_SEARCH_CANDIDATE_LIMIT } from '../store/rows.js';
-import { loadAmbientCandidates, loadContextCandidates, } from '../store/candidates.js';
-import { loadIndex, saveIndex, updateStats } from '../store/index-and-stats.js';
-import { loadFreshActiveTaskSnapshot, listSessionEvents, SNAPSHOT_AMBIENT_MAX_AGE_MS } from '../store/sessions.js';
-import { loadLatestHandoff } from '../store/handoffs.js';
-import { estimateTokens } from '../token-ledger.js';
-import { markRetrieved, COMPACTION_MEMORY_TAG } from '../memory.js';
-import { isWorthSurfacing } from '../memory-quality.js';
-import { getGlobalRoot } from '../shared.js';
-import { writeRecallTraceAtRoot } from '../recall-trace.js';
-import { evalNow, isRecallBoostAblated } from '../ablation.js';
-import { dropHeldCopies } from '../same-text.js';
-import { BadRequestError } from '../api-errors.js';
-import { isSharedStore, loadConfig } from '../config.js';
-import { log } from '../log.js';
-import { resolveProjectIdentity, classifyOriginProject, isGlobalStoreRoot, projectId, projectNames } from '../project-identity.js';
-import { promptTokens } from '../prompt-recall.js';
-import { detectSecret } from '../secret-detect.js';
-import { isSessionDigestRow } from '../session-digest.js';
-import { addAmbientTallies, ambientStateFromTallies } from '../ambient.js';
-import { loadAmbientTallies } from '../ambient-store.js';
-import { passesScopeFilterForRecall, assertScopeRequestAllowed, personalScopeOf } from '../recall-scope.js';
+import { freshActiveSnapshot, SNAPSHOT_AMBIENT_MAX_AGE_MS } from '../store/sessions.js';
+import { estimateTokens } from '../util/token-text.js';
+import { markRetrieved, COMPACTION_MEMORY_TAG } from '../core/memory.js';
+import { isWorthSurfacing } from '../core/memory-quality.js';
+import { getGlobalRoot } from '../sharing/shared.js';
+import { evalNow } from '../core/ablation.js';
+import { dropHeldCopies } from '../util/same-text.js';
+import { BadRequestError } from '../core/api-errors.js';
+import { isSharedStore, loadConfig } from '../core/config.js';
+import { rethrowIfSqliteBlocked } from '../db/index.js';
+import { errorMessage, log } from '../util/log.js';
+import { resolveProjectIdentity, classifyOriginProject, isGlobalStoreRoot, projectId, projectNames } from '../core/project-identity.js';
+import { promptTokens } from '../core/prompt-recall.js';
+import { detectSecret } from '../util/secret-detect.js';
+import { isSessionDigestRow } from '../core/session-digest-row.js';
+import { addAmbientTallies, ambientStateFromTallies } from '../core/ambient.js';
+import { requireGroup, sqliteStore, storeFor } from '../store/index.js';
+import { passesScopeFilterForRecall, assertScopeRequestAllowed, personalScopeOf } from '../store/recall-scope.js';
 import { finiteOr, selectBySearch, selectPinned, selectStrongest, } from './context-select.js';
+import { andThen, onStore } from './on-store.js';
+import { strengthenOf } from './recall-record.js';
 import { ownerOrSubject } from './types.js';
 export { oneCopyPerMemory } from './context-select.js';
 /**
@@ -63,14 +60,28 @@ export function ambientSecretAdmit(e, currentProject) {
     return projectNames(currentProject).includes(origin);
 }
 /** Most rows per store a no-query context reads; past it, ranking and ambientState see the strongest by decay. */
-export const CONTEXT_CANDIDATE_CAP = 2000;
-// The pinned-only branch needs pins and recent-N candidates, not the corpus; `recent` and `recall` apply there only.
-function loadAmbientEntries(hippoRoot, tenantId, pinnedOnly, recent, admit, window, recall, onQualityDrop) {
+const CONTEXT_CANDIDATE_CAP = 2000;
+/** A store's base search and context reads; a store without the group throws StoreNotPortedError. */
+function sourceOf(store) {
+    return { store, reads: requireGroup(store, 'contextReads') };
+}
+// The pinned-only branch needs pins and recent-N candidates, not the corpus.
+async function loadAmbientEntries(source, tenantId, options) {
+    const { pinnedOnly, recent, admit, recheck, window, recall, onQualityDrop } = options;
+    const ownTenant = (e) => e.tenantId === tenantId;
     if (!pinnedOnly) {
         const rows = 'query' in window
-            ? loadRecallSearchEntries(hippoRoot, window.query, DEFAULT_SEARCH_CANDIDATE_LIMIT, tenantId, window.exactScope, 'exact', false, window.project, window.ownScope)
-            : loadContextCandidates(hippoRoot, tenantId, window);
-        return { entries: rows.filter(admit) };
+            ? await source.store.searchRecallEntries(window.query, {
+                limit: DEFAULT_SEARCH_CANDIDATE_LIMIT,
+                tenantId,
+                requestedScope: window.exactScope,
+                explicitScopeMode: 'exact',
+                includeSuperseded: false,
+                originProjects: window.project,
+                ownScope: window.ownScope,
+            })
+            : await source.reads.contextCandidates(tenantId, window);
+        return { entries: rows.filter((e) => ownTenant(e) && admit(e)) };
     }
     // The quality floor runs on the recent-N slice AFTER this load, so the load
     // counts by it too, or it stops short of a store whose newest rows are junk.
@@ -82,7 +93,10 @@ function loadAmbientEntries(hippoRoot, tenantId, pinnedOnly, recent, admit, wind
         onQualityDrop?.(e);
         return false;
     };
-    return loadAmbientCandidates(hippoRoot, tenantId, recent.needed, admitAmbient, recall, recent.origins);
+    const loaded = await source.reads.ambientCandidates(tenantId, { recentNeeded: recent.needed, admit: admitAmbient, recall, origins: recent.origins });
+    // Pins and recent rows reach core only through the store's own call to admit, so core applies it again with the tenant.
+    const entries = loaded.entries.filter((e) => ownTenant(e) && recheck(e));
+    return loaded.recall ? { entries, recall: loaded.recall.filter(ownTenant) } : { entries };
 }
 /**
  * Assemble a context bundle: recalled memories (pinned-only / strength-sorted
@@ -107,10 +121,10 @@ export async function getContext(ctx, opts = {}) {
     if (budget <= 0) {
         return { entries: [], tokens: 0 };
     }
-    const plan = planContext(ctx, opts);
-    const sections = loadTaskSections(ctx, opts, plan, openBlockBudget(plan, opts, budget));
+    const plan = planContext(ctx, opts, sourceOf(storeFor(ctx)));
+    const sections = await loadTaskSections(ctx, opts, plan, openBlockBudget(plan, opts, budget));
     const admission = ambientAdmission(opts, plan, sections.shownHandoff);
-    const pools = loadPools(ctx, plan, admission, promptRecallRequest(opts, plan));
+    const pools = await loadPools(ctx, plan, admission, promptRecallRequest(opts, plan));
     const noSections = !sections.shownSnapshot && !sections.shownHandoff && sections.shownEvents.length === 0;
     if (!plan.promptRecallPending && pools.local.entries.length === 0 && pools.global.entries.length === 0 && noSections) {
         return { entries: [], tokens: 0 };
@@ -127,14 +141,14 @@ export async function getContext(ctx, opts = {}) {
     if (items.length === 0 && noSections) {
         // A query that found nothing is the coverage-gap signal, so it still gets a trace; pinned-only stays read-only.
         if (!plan.pinnedOnly)
-            traceEmptyContext(ctx, opts, plan.query);
+            await traceEmptyContext(ctx, opts, plan);
         return { entries: [], tokens: 0 };
     }
     // pinnedOnly is the UserPromptSubmit hot path — read-only so pinned
     // memories don't inflate retrieval_count or extend half_life every turn.
     const recorded = plan.pinnedOnly
         ? { items, ambientState: undefined }
-        : recordRetrieval(ctx, opts, plan, items, sections.activeSnapshot);
+        : await recordRetrieval(ctx, opts, plan, items, sections.activeSnapshot);
     return {
         entries: recorded.items,
         tokens,
@@ -152,17 +166,29 @@ function warnIsolationIgnored(hippoRoot) {
     isolationWarned.add(hippoRoot);
     log.warn(`${hippoRoot}: "contextProjectIsolation": false is ignored on a shared store; a read opts in with cross_project.`);
 }
-function planContext(ctx, opts) {
-    const pinnedOnly = opts.pinnedOnly === true;
+/** Which stores this read can draw on, and what kind the primary one is. */
+function storesInReach(ctx, opts, local) {
+    const other = local.store.kind !== 'sqlite' ? local.store : undefined;
     // Global memories do not establish a project boundary for task state.
-    const hasLocal = isInitialized(ctx.hippoRoot);
-    const query = (opts.q ?? '').trim() || '*';
+    const hasLocal = other !== undefined || isInitialized(ctx.hippoRoot);
     const globalRoot = getGlobalRoot();
     // The store's own flag counts too, so no surface can read a shared store as its owner.
     const sharedStore = opts.sharedStore === true || isSharedStore(ctx.hippoRoot);
     // A store serving many people is not its operator's, so the operator's own global store stays out.
-    const hasGlobal = !sharedStore && isInitialized(globalRoot);
+    const hasGlobal = !sharedStore && other === undefined && isInitialized(globalRoot);
     const primaryIsGlobal = isGlobalStoreRoot(ctx.hippoRoot);
+    return { other, hasLocal, globalRoot, sharedStore, hasGlobal, primaryIsGlobal };
+}
+/** Prices one entry against the budget: the caller's cost model when it gave one, else a token estimate. */
+function entryPricer(cost, currentProject) {
+    return (entry, isGlobal, promptRecall) => cost
+        ? cost.entry({ entry, isGlobal, promptRecall, origin: entry.origin_project ?? null, category: classifyOriginProject(entry.origin_project, currentProject) })
+        : estimateTokens(entry.content);
+}
+function planContext(ctx, opts, local) {
+    const pinnedOnly = opts.pinnedOnly === true;
+    const { other, hasLocal, globalRoot, sharedStore, hasGlobal, primaryIsGlobal } = storesInReach(ctx, opts, local);
+    const query = (opts.q ?? '').trim() || '*';
     // opts.scope is only the tag boost, opts.exactScope the envelope request; other-project memories are
     // excluded unless the caller asks for them (crossProject) or isolation is disabled.
     const config = loadConfig(ctx.hippoRoot);
@@ -177,10 +203,10 @@ function planContext(ctx, opts) {
     // Decided before the ambient loads so the pinned-only FTS candidate query can share their connection.
     const promptRecallPending = pinnedOnly && Boolean(opts.prompt?.trim()) && config.pinnedInject.promptRecall === true;
     const cost = opts.cost;
-    const price = (entry, isGlobal, promptRecall) => cost
-        ? cost.entry({ entry, isGlobal, promptRecall, origin: entry.origin_project ?? null, category: classifyOriginProject(entry.origin_project, currentProject) })
-        : estimateTokens(entry.content);
+    const price = entryPricer(cost, currentProject);
     return {
+        local,
+        other,
         pinnedOnly,
         limit: opts.limit ?? Number.POSITIVE_INFINITY,
         includeRecent: opts.includeRecent ?? 0,
@@ -227,30 +253,25 @@ function openBlockBudget(plan, opts, budget) {
 }
 const NO_TASK_STATE = { snapshot: null, handoff: null, events: [] };
 // Keyed on the RAW snapshot: a scope-hidden active session must not fall through to another session's ambient handoff.
-function loadRawTaskState(ctx, opts, plan) {
+async function loadRawTaskState(ctx, opts, plan) {
     if (!plan.hasLocalTaskState)
         return NO_TASK_STATE;
+    const { store, reads } = plan.local;
     // On a shared store task state is one person's, keyed by owner and project so it follows them into their next session.
     const key = plan.sharedStore
         ? { owner: ownerOrSubject(ctx.actor), project: projectNames(plan.currentProject) }
-        : undefined;
+        : null;
+    const block = await store.continuity(ctx.tenantId, 5, key);
     // Bounded read: an orphaned snapshot ages out of this ambient surface; the owner session's read stays unbounded.
-    const snapshot = loadFreshActiveTaskSnapshot(ctx.hippoRoot, ctx.tenantId, { sessionId: opts.currentSessionId }, key);
-    const sessionId = snapshot?.session_id;
-    const handoff = sessionId
-        ? loadLatestHandoff(ctx.hippoRoot, ctx.tenantId, sessionId, {}, key)
-        : loadLatestHandoff(ctx.hippoRoot, ctx.tenantId, undefined, {
-            unfinishedOnly: true,
-            maxAgeMs: SNAPSHOT_AMBIENT_MAX_AGE_MS,
-            // Scope is admitted in SQL so a newer denied row can't hide an older eligible one before LIMIT 1.
-            scopeFilter: 'default-deny',
-        }, key);
-    // Raw session id here too: each event is admitted on its own scope, same as recall and the CLI.
-    const events = sessionId ? listSessionEvents(ctx.hippoRoot, ctx.tenantId, { session_id: sessionId, limit: 5 }) : [];
-    return { snapshot, handoff, events };
+    const snapshot = freshActiveSnapshot(block.activeSnapshot, { sessionId: opts.currentSessionId });
+    // The block's handoff and events are the raw snapshot's session's, so they stand only while that snapshot is fresh.
+    if (snapshot?.session_id)
+        return { snapshot, handoff: block.sessionHandoff, events: block.recentSessionEvents };
+    // An unfinished handoff's scope is admitted in the read, so a newer denied row can't hide an older eligible one.
+    return { snapshot, handoff: await reads.unfinishedHandoff(ctx.tenantId, SNAPSHOT_AMBIENT_MAX_AGE_MS, key), events: [] };
 }
 // Sections print ahead of the memories, so they are paid first; one that does not fit is dropped, as an oversize entry is.
-function loadTaskSections(ctx, opts, plan, startLeft) {
+async function loadTaskSections(ctx, opts, plan, startLeft) {
     const { exactScope, ownScope, cost } = plan;
     let left = startLeft;
     const pays = (tokens) => {
@@ -260,7 +281,7 @@ function loadTaskSections(ctx, opts, plan, startLeft) {
         return true;
     };
     const rowScope = (r) => r?.scope ?? null;
-    const raw = loadRawTaskState(ctx, opts, plan);
+    const raw = await loadRawTaskState(ctx, opts, plan);
     // The same envelope rule ambientAdmitEntry applies to memory rows.
     const activeSnapshot = raw.snapshot && passesScopeFilterForRecall(rowScope(raw.snapshot), exactScope, ownScope) ? raw.snapshot : null;
     const sessionHandoff = raw.handoff && passesScopeFilterForRecall(rowScope(raw.handoff), exactScope, ownScope) ? raw.handoff : null;
@@ -296,7 +317,7 @@ function recentOrigins(plan) {
         return { names: projectNames(plan.currentProject).filter((n) => n !== ''), userGlobal: false };
     return plan.originProject && { names: plan.originProject, userGlobal: true };
 }
-function loadPools(ctx, plan, admission, recallRequest) {
+async function loadPools(ctx, plan, admission, recallRequest) {
     const { obs, pinnedOnly, primaryIsGlobal, hasGlobal, exactScope, ownScope } = plan;
     const recent = { needed: plan.includeRecent, origins: recentOrigins(plan) };
     const searches = plan.query !== '*' && !pinnedOnly;
@@ -315,11 +336,12 @@ function loadPools(ctx, plan, admission, recallRequest) {
             now: evalNow(),
         };
     // Tenant-scoped loads: never resolveTenantId({}) here.
+    const read = { pinnedOnly, recent, admit: loadAdmit, recheck: poolAdmit, window, recall: recallRequest };
     const local = plan.hasLocal
-        ? loadAmbientEntries(ctx.hippoRoot, ctx.tenantId, pinnedOnly, recent, loadAdmit, window, recallRequest, qualityDrop(primaryIsGlobal))
+        ? await loadAmbientEntries(plan.local, ctx.tenantId, { ...read, onQualityDrop: qualityDrop(primaryIsGlobal) })
         : { entries: [] };
     const global = hasGlobal && !primaryIsGlobal
-        ? loadAmbientEntries(plan.globalRoot, ctx.tenantId, pinnedOnly, recent, loadAdmit, window, recallRequest, qualityDrop(true))
+        ? await loadAmbientEntries(sourceOf(sqliteStore(plan.globalRoot)), ctx.tenantId, { ...read, onQualityDrop: qualityDrop(true) })
         : { entries: [] };
     return { local, global };
 }
@@ -345,31 +367,32 @@ function finalizeSelection(picked, plan) {
     obs?.selected(selected);
     return { items: selected, tokens };
 }
-// Never touches the index, so it cannot desync last_retrieval_ids from last_trace_id; fail-soft, never throws.
-function traceEmptyContext(ctx, opts, query) {
+// Never touches the index, so it cannot desync last_retrieval_ids from last_trace_id.
+async function traceEmptyContext(ctx, opts, plan) {
     // No snapshot in this branch, so the caller's own id is the only session to stamp.
-    writeRecallTraceAtRoot(ctx.hippoRoot, {
+    const trace = {
         tenantId: ctx.tenantId,
         sessionId: opts.currentSessionId || null,
         pipeline: 'context',
-        query,
+        query: plan.query,
         explainMode: false,
         results: [],
-    });
+    };
+    // The empty reply is already decided, so a lost trace is logged and the call still answers.
+    try {
+        await onStore(ctx, (port) => port.finishRecall({ goalLog: [], audit: [], trace }));
+    }
+    catch (error) {
+        rethrowIfSqliteBlocked(error);
+        log.error(`recall trace write failed: ${errorMessage(error)}`);
+    }
 }
 /** Strengthens and marks the returned rows, then writes the trace and index together. */
-function recordRetrieval(ctx, opts, plan, selected, activeSnapshot) {
+async function recordRetrieval(ctx, opts, plan, selected, activeSnapshot) {
     const toUpdate = selected.map((s) => s.entry);
     const updatedEntries = markRetrieved(toUpdate);
-    const localIndex = loadIndex(ctx.hippoRoot);
     const retrievedIds = updatedEntries.map((u) => u.id);
-    const strengthenedHere = strengthenRetrieved(ctx.hippoRoot, retrievedIds, { recallBoostAblated: isRecallBoostAblated() });
-    if (plan.hasGlobal)
-        strengthenRetrieved(plan.globalRoot, retrievedIds.filter((id) => !strengthenedHere.has(id)), { recallBoostAblated: isRecallBoostAblated() });
-    localIndex.last_retrieval_ids = retrievedIds;
-    // Trace first on its own short-lived connection, then fold its id into localIndex so one saveIndex moves
-    // last_retrieval_ids and last_trace_id in lockstep; a failed trace write stores null, never a stale id.
-    const traceId = writeRecallTraceAtRoot(ctx.hippoRoot, {
+    const trace = {
         tenantId: ctx.tenantId,
         sessionId: opts.currentSessionId || activeSnapshot?.session_id || null,
         pipeline: 'context',
@@ -379,10 +402,10 @@ function recordRetrieval(ctx, opts, plan, selected, activeSnapshot) {
             memoryId: s.entry.id,
             score: s.score,
         })),
-    });
-    localIndex.last_trace_id = traceId !== null ? String(traceId) : null;
-    saveIndex(ctx.hippoRoot, localIndex);
-    updateStats(ctx.hippoRoot, { recalled: selected.length });
+    };
+    const writes = { goalLog: [], audit: [], trace, strengthen: strengthenOf(ctx, retrievedIds) };
+    // hippo.db keeps the ids as its last recall, which feeds only outcomeForLastRecall, and it alone reads a second root.
+    await onStore(ctx, (port, local) => andThen(local.finishLastRecall(writes, plan.hasGlobal ? plan.globalRoot : undefined), () => port.bumpRecallStats(selected.length)));
     // Replace selectedItems entries with markRetrieved-updated copies so
     // the returned ContextResult reflects post-recall state.
     const items = selected.map((s) => ({
@@ -390,12 +413,17 @@ function recordRetrieval(ctx, opts, plan, selected, activeSnapshot) {
         entry: updatedEntries.find((u) => u.id === s.entry.id) ?? s.entry,
     }));
     // Read after strengthenRetrieved commits, so the rows just retrieved count at their new strength.
-    return { items, ambientState: plan.config.ambient.enabled ? readAmbientState(ctx, plan) : undefined };
+    return { items, ambientState: plan.config.ambient.enabled ? await readAmbientState(ctx, plan) : undefined };
 }
-function readAmbientState(ctx, plan) {
+async function readAmbientState(ctx, plan) {
     const filter = { exactScope: plan.exactScope, ownScope: plan.ownScope, project: plan.originProject, currentProject: projectNames(plan.currentProject), now: evalNow() };
-    const roots = [...(plan.hasLocal ? [ctx.hippoRoot] : []), ...(plan.hasGlobal && !plan.primaryIsGlobal ? [plan.globalRoot] : [])];
-    const tallies = roots.map((root) => loadAmbientTallies(root, ctx.tenantId, filter));
+    const sources = [
+        ...(plan.hasLocal ? [plan.local.reads] : []),
+        ...(plan.hasGlobal && !plan.primaryIsGlobal ? [sourceOf(sqliteStore(plan.globalRoot)).reads] : []),
+    ];
+    const tallies = [];
+    for (const reads of sources)
+        tallies.push(await reads.ambientTallies(ctx.tenantId, filter));
     const total = tallies.length > 0 ? tallies.reduce(addAmbientTallies) : undefined;
     return total && total.total > 0 ? ambientStateFromTallies(total) : undefined;
 }

package/dist/api/dormant.d.ts

@@ -1,8 +1,8 @@
-import { type DormantMemory, type ListDormantOpts } from '../dormant.js';
-import { type MemoryEntry } from '../memory.js';
+import { type DormantMemory, type ListDormantOpts } from '../store/dormant.js';
+import { type MemoryEntry } from '../core/memory.js';
 import type { Context } from './types.js';
 /**
- * A tenant's dormant memories (src/dormant.ts): what sleep moved out of
+ * A tenant's dormant memories (src/store/dormant.ts): what sleep moved out of
  * active memory instead of deleting, when `dormant.enabled` is on. Newest
  * first; `opts.query` keeps rows containing every term (case-insensitive).
  */

package/dist/api/dormant.js

@@ -1,30 +1,19 @@
 // Dormant memories: list, restore, forget and check.
-import { openHippoDb, closeHippoDb } from '../db.js';
-import { ConflictError, NotFoundError } from '../api-errors.js';
-import { auditRejectionRefusal } from '../store/audit-event.js';
+import { ConflictError, NotFoundError } from '../core/api-errors.js';
 import { stampOriginProject } from '../store/entry-row.js';
-import { writeEntryDbOnly, writeEntryMirrors } from '../store/entry-writes.js';
 import { updateStatsUnlessBusy } from '../store/index-and-stats.js';
-import { RejectedValueError } from '../rejection.js';
-import { listDormantRows, readDormantSnapshot, deleteDormantRow, hasDormantRow, } from '../dormant.js';
-import { createMemory, calculateStrength } from '../memory.js';
-import { appendAuditEvent, reportAuditWriteFailure } from '../audit.js';
-import { loadConfig } from '../config.js';
-import { canTouchScope, personalScopeOf, touchableScopeSql } from '../recall-scope.js';
+import { loadDormantMemories, holdsDormantMemory, restoreDormantMemory, forgetDormantMemory, } from '../store/dormant.js';
+import { createMemory, calculateStrength } from '../core/memory.js';
+import { loadConfig } from '../core/config.js';
+import { canTouchScope, personalScopeOf, touchableScopeSql } from '../store/recall-scope.js';
 const touchable = (ctx) => touchableScopeSql('', personalScopeOf(ctx.actor));
 /**
- * A tenant's dormant memories (src/dormant.ts): what sleep moved out of
+ * A tenant's dormant memories (src/store/dormant.ts): what sleep moved out of
  * active memory instead of deleting, when `dormant.enabled` is on. Newest
  * first; `opts.query` keeps rows containing every term (case-insensitive).
  */
 export function listDormant(ctx, opts = {}) {
-    const db = openHippoDb(ctx.hippoRoot);
-    try {
-        return listDormantRows(db, ctx.tenantId, opts, touchable(ctx));
-    }
-    finally {
-        closeHippoDb(db);
-    }
+    return loadDormantMemories(ctx.hippoRoot, ctx.tenantId, opts, touchable(ctx));
 }
 /**
  * Bring a dormant memory back into active memory. It returns as if just
@@ -38,67 +27,34 @@ export function listDormant(ctx, opts = {}) {
  * throw the dormant copy stays where it is.
  */
 export function restoreDormant(ctx, id) {
-    const db = openHippoDb(ctx.hippoRoot);
-    try {
-        let restored;
-        db.exec('BEGIN IMMEDIATE');
-        try {
-            const dormant = readDormantSnapshot(db, ctx.tenantId, id);
-            if (!dormant || !canTouchScope(ctx.actor, dormant.entry.scope ?? null)) {
-                throw new NotFoundError(`dormant memory not found: ${id}`);
-            }
-            if (db.prepare(`SELECT 1 FROM memories WHERE id = ?`).get(id) !== undefined) {
-                throw new ConflictError(`memory ${id} is already active; forget it before restoring its dormant copy`);
-            }
-            const now = new Date();
-            // Dormant rows are long-lived, so a snapshot can predate a field added
-            // later: createMemory supplies a default for anything it lacks, then
-            // the snapshot overrides every field it does carry, content included.
-            // (The placeholder only satisfies createMemory's minimum length, so a
-            // legacy row shorter than 3 chars can still be restored.)
-            const revived = {
-                ...createMemory('dormant snapshot defaults', { baseHalfLifeDays: loadConfig(ctx.hippoRoot).defaultHalfLifeDays }),
-                ...dormant.entry,
-                last_retrieved: now.toISOString(),
-            };
-            if (dormant.reason === 'quality-repair')
-                revived.confidence = 'verified';
-            restored = stampOriginProject(ctx.hippoRoot, { ...revived, strength: calculateStrength(revived, now) });
-            writeEntryDbOnly(db, restored, { actor: ctx.actor.subject });
-            deleteDormantRow(db, ctx.tenantId, id);
-            // A restore is a labelled "forgot it, then needed it" event: the
-            // signal a learned lifecycle trains on. Same transaction
-            // as the restore, so the label exists exactly when the restore does.
-            appendAuditEvent(db, {
-                tenantId: ctx.tenantId,
-                actor: ctx.actor.subject,
-                op: 'dormant_restore',
-                targetId: id,
-                metadata: {
-                    reason: dormant.reason,
-                    strengthAtDormancy: dormant.strength,
-                    dormantAt: dormant.dormantAt,
-                    daysDormant: Math.max(0, (now.getTime() - Date.parse(dormant.dormantAt)) / (24 * 60 * 60 * 1000)),
-                },
-            });
-            db.exec('COMMIT');
-        }
-        catch (err) {
-            try {
-                db.exec('ROLLBACK');
-            }
-            catch { /* already rolled back */ }
-            if (err instanceof RejectedValueError) {
-                auditRejectionRefusal(db, err, ctx.actor.subject);
-            }
-            throw err;
-        }
-        writeEntryMirrors(ctx.hippoRoot, restored);
-        return restored;
-    }
-    finally {
-        closeHippoDb(db);
+    const outcome = restoreDormantMemory(ctx.hippoRoot, {
+        tenantId: ctx.tenantId,
+        id,
+        actor: ctx.actor.subject,
+        inReach: (scope) => canTouchScope(ctx.actor, scope),
+        revive: (snapshot, now) => reviveSnapshot(ctx, snapshot, now),
+    });
+    if (outcome.status === 'missing')
+        throw new NotFoundError(`dormant memory not found: ${id}`);
+    if (outcome.status === 'active') {
+        throw new ConflictError(`memory ${id} is already active; forget it before restoring its dormant copy`);
     }
+    return outcome.entry;
+}
+function reviveSnapshot(ctx, dormant, now) {
+    // Dormant rows are long-lived, so a snapshot can predate a field added
+    // later: createMemory supplies a default for anything it lacks, then
+    // the snapshot overrides every field it does carry, content included.
+    // (The placeholder only satisfies createMemory's minimum length, so a
+    // legacy row shorter than 3 chars can still be restored.)
+    const revived = {
+        ...createMemory('dormant snapshot defaults', { baseHalfLifeDays: loadConfig(ctx.hippoRoot).defaultHalfLifeDays }),
+        ...dormant.entry,
+        last_retrieved: now.toISOString(),
+    };
+    if (dormant.reason === 'quality-repair')
+        revived.confidence = 'verified';
+    return stampOriginProject(ctx.hippoRoot, { ...revived, strength: calculateStrength(revived, now) });
 }
 /**
  * Permanently delete a dormant memory: the explicit "forget it for good"
@@ -106,39 +62,14 @@ export function restoreDormant(ctx, id) {
  * dormant memory with that id.
  */
 export function forgetDormant(ctx, id) {
-    const db = openHippoDb(ctx.hippoRoot);
-    try {
-        if (!hasDormantRow(db, ctx.tenantId, id, touchable(ctx)) || !deleteDormantRow(db, ctx.tenantId, id)) {
-            throw new NotFoundError(`dormant memory not found: ${id}`);
-        }
-        try {
-            appendAuditEvent(db, {
-                tenantId: ctx.tenantId,
-                actor: ctx.actor.subject,
-                op: 'forget',
-                targetId: id,
-                metadata: { dormant: true },
-            });
-        }
-        catch (error) {
-            // Best-effort, like every other forget audit row: the delete stands.
-            reportAuditWriteFailure('forget', String(error), id);
-        }
-    }
-    finally {
-        closeHippoDb(db);
-    }
+    const forgotten = forgetDormantMemory(ctx.hippoRoot, { tenantId: ctx.tenantId, id, actor: ctx.actor.subject, admit: touchable(ctx) });
+    if (!forgotten)
+        throw new NotFoundError(`dormant memory not found: ${id}`);
     // Counted like every other permanent removal (forget, archiveRaw).
     updateStatsUnlessBusy(ctx.hippoRoot, { forgotten: 1 }, `removed ${id}`);
 }
 /** Whether the tenant holds a dormant memory with this id that the caller may touch (for "not found" hints). */
 export function isDormant(ctx, id) {
-    const db = openHippoDb(ctx.hippoRoot);
-    try {
-        return hasDormantRow(db, ctx.tenantId, id, touchable(ctx));
-    }
-    finally {
-        closeHippoDb(db);
-    }
+    return holdsDormantMemory(ctx.hippoRoot, ctx.tenantId, id, touchable(ctx));
 }
 //# sourceMappingURL=dormant.js.map

package/dist/api/drill-down.d.ts

@@ -1,4 +1,4 @@
-import type { CallerProject } from '../prompt-hook.js';
+import type { CallerProject } from './prompt-hook.js';
 import type { Context } from './types.js';
 export interface DrillDownOpts {
     /** Cap on number of children returned. Default 50. */
@@ -82,5 +82,5 @@ export type DrillDownOutcome = DrillDownResult | DrillDownFailure;
  * Pre-v1.6.4 returned null for all three cases. JS callers migrate via
  * `'failure' in result` checks; HTTP route maps `not_drillable` to 422.
  */
-export declare function drillDown(ctx: Context, summaryId: string, opts?: DrillDownOpts): DrillDownOutcome;
+export declare function drillDown(ctx: Context, summaryId: string, opts?: DrillDownOpts): Promise<DrillDownOutcome>;
 //# sourceMappingURL=drill-down.d.ts.map