hippo-memory 1.69.0 → 1.70.0

package/dist/db/migrations/v22.js

@@ -1,19 +1,5 @@
 import { tableHasColumn } from '../tables.js';
-export const v22 = {
-    version: 22,
-    up: (db) => {
-        // session_events and session_handoffs predate the v16 tenant migration and were
-        // never added to it: a cross-tenant leak whenever continuity primitives are used.
-        // Adds tenant_id (NOT NULL DEFAULT 'default') with smart backfill from
-        // task_snapshots.session_id when unambiguous, plus an optional scope
-        // column so a private-channel-derived handoff can default-deny via the
-        // same rule recall already enforces.
-        //
-        // Self-heal partial-init stores: re-run the v4/v5 CREATE TABLE IF NOT
-        // EXISTS bodies before ALTERing. A silent skip would otherwise stamp
-        // schema_version=22 on a DB missing the underlying tables, leaving
-        // them permanently absent.
-        db.exec(`
+const CREATE_TABLE_SESSION_EVENTS_SQL = `
         CREATE TABLE IF NOT EXISTS session_events (
           id INTEGER PRIMARY KEY AUTOINCREMENT,
           session_id TEXT NOT NULL,
@@ -34,7 +20,42 @@ export const v22 = {
           artifacts_json TEXT NOT NULL DEFAULT '[]',
           created_at TEXT NOT NULL
         );
-      `);
+      `;
+const BACKFILL_SESSION_EVENTS_TENANT_SQL = `
+        UPDATE session_events
+           SET tenant_id = (
+             SELECT MAX(t.tenant_id) FROM task_snapshots t
+              WHERE t.session_id = session_events.session_id
+           )
+         WHERE tenant_id = 'default'
+           AND (SELECT COUNT(DISTINCT t.tenant_id) FROM task_snapshots t
+                 WHERE t.session_id = session_events.session_id) = 1
+      `;
+const BACKFILL_SESSION_HANDOFFS_TENANT_SQL = `
+        UPDATE session_handoffs
+           SET tenant_id = (
+             SELECT MAX(t.tenant_id) FROM task_snapshots t
+              WHERE t.session_id = session_handoffs.session_id
+           )
+         WHERE tenant_id = 'default'
+           AND (SELECT COUNT(DISTINCT t.tenant_id) FROM task_snapshots t
+                 WHERE t.session_id = session_handoffs.session_id) = 1
+      `;
+export const v22 = {
+    version: 22,
+    up: (db) => {
+        // session_events and session_handoffs predate the v16 tenant migration and were
+        // never added to it: a cross-tenant leak whenever continuity primitives are used.
+        // Adds tenant_id (NOT NULL DEFAULT 'default') with smart backfill from
+        // task_snapshots.session_id when unambiguous, plus an optional scope
+        // column so a private-channel-derived handoff can default-deny via the
+        // same rule recall already enforces.
+        //
+        // Self-heal partial-init stores: re-run the v4/v5 CREATE TABLE IF NOT
+        // EXISTS bodies before ALTERing. A silent skip would otherwise stamp
+        // schema_version=22 on a DB missing the underlying tables, leaving
+        // them permanently absent.
+        db.exec(CREATE_TABLE_SESSION_EVENTS_SQL);
         if (!tableHasColumn(db, 'session_events', 'tenant_id')) {
             db.exec(`ALTER TABLE session_events ADD COLUMN tenant_id TEXT NOT NULL DEFAULT 'default'`);
         }
@@ -53,26 +74,8 @@ export const v22 = {
         // tenant boundaries on guesses. The COUNT(DISTINCT) gate is the load-
         // bearing check; without it, rows with multiple tenants under the same
         // session_id would silently pick whichever group came first.
-        db.exec(`
-        UPDATE session_events
-           SET tenant_id = (
-             SELECT MAX(t.tenant_id) FROM task_snapshots t
-              WHERE t.session_id = session_events.session_id
-           )
-         WHERE tenant_id = 'default'
-           AND (SELECT COUNT(DISTINCT t.tenant_id) FROM task_snapshots t
-                 WHERE t.session_id = session_events.session_id) = 1
-      `);
-        db.exec(`
-        UPDATE session_handoffs
-           SET tenant_id = (
-             SELECT MAX(t.tenant_id) FROM task_snapshots t
-              WHERE t.session_id = session_handoffs.session_id
-           )
-         WHERE tenant_id = 'default'
-           AND (SELECT COUNT(DISTINCT t.tenant_id) FROM task_snapshots t
-                 WHERE t.session_id = session_handoffs.session_id) = 1
-      `);
+        db.exec(BACKFILL_SESSION_EVENTS_TENANT_SQL);
+        db.exec(BACKFILL_SESSION_HANDOFFS_TENANT_SQL);
         db.exec(`CREATE INDEX IF NOT EXISTS idx_session_events_tenant_session ON session_events(tenant_id, session_id, created_at DESC, id DESC)`);
         db.exec(`CREATE INDEX IF NOT EXISTS idx_session_handoffs_tenant_session ON session_handoffs(tenant_id, session_id, created_at DESC)`);
     },

package/dist/db/migrations/v24.js

@@ -1,9 +1,4 @@
-export const v24 = {
-    version: 24,
-    up: (db) => {
-        // GitHub connector schema.
-        // Six tables + a min_compatible_binary meta row for rollback safety.
-        db.exec(`
+const CREATE_TABLE_GITHUB_EVENT_LOG_SQL = `
         CREATE TABLE IF NOT EXISTS github_event_log (
           idempotency_key TEXT PRIMARY KEY,
           delivery_id TEXT NOT NULL,
@@ -11,10 +6,8 @@ export const v24 = {
           ingested_at TEXT NOT NULL,
           memory_id TEXT
         )
-      `);
-        db.exec(`CREATE INDEX IF NOT EXISTS idx_github_event_log_memory ON github_event_log(memory_id) WHERE memory_id IS NOT NULL`);
-        db.exec(`CREATE INDEX IF NOT EXISTS idx_github_event_log_delivery ON github_event_log(delivery_id)`);
-        db.exec(`
+      `;
+const CREATE_TABLE_GITHUB_CURSORS_SQL = `
         CREATE TABLE IF NOT EXISTS github_cursors (
           tenant_id TEXT NOT NULL,
           repo_full_name TEXT NOT NULL,
@@ -24,8 +17,8 @@ export const v24 = {
           updated_at TEXT NOT NULL,
           PRIMARY KEY (tenant_id, repo_full_name)
         )
-      `);
-        db.exec(`
+      `;
+const CREATE_TABLE_GITHUB_DLQ_SQL = `
         CREATE TABLE IF NOT EXISTS github_dlq (
           id INTEGER PRIMARY KEY AUTOINCREMENT,
           tenant_id TEXT NOT NULL,
@@ -41,27 +34,39 @@ export const v24 = {
           retried_at TEXT,
           bucket TEXT NOT NULL DEFAULT 'parse_error'
         )
-      `);
-        db.exec(`CREATE INDEX IF NOT EXISTS idx_github_dlq_tenant_received ON github_dlq(tenant_id, received_at)`);
-        db.exec(`
+      `;
+const CREATE_TABLE_GITHUB_INSTALLATIONS_SQL = `
         CREATE TABLE IF NOT EXISTS github_installations (
           installation_id TEXT PRIMARY KEY,
           tenant_id TEXT NOT NULL,
           added_at TEXT NOT NULL
         )
-      `);
-        // PAT-mode multi-tenant routing. Maps repo_full_name to
-        // tenant when the webhook envelope has no `installation` field. Composite
-        // PK so the same repo can intentionally be visible to multiple tenants
-        // (e.g., shared tooling accounts) — collision is on (repo, tenant) pair.
-        db.exec(`
+      `;
+const CREATE_TABLE_GITHUB_REPOSITORIES_SQL = `
         CREATE TABLE IF NOT EXISTS github_repositories (
           repo_full_name TEXT NOT NULL,
           tenant_id TEXT NOT NULL,
           added_at TEXT NOT NULL,
           PRIMARY KEY (repo_full_name, tenant_id)
         )
-      `);
+      `;
+export const v24 = {
+    version: 24,
+    up: (db) => {
+        // GitHub connector schema.
+        // Six tables + a min_compatible_binary meta row for rollback safety.
+        db.exec(CREATE_TABLE_GITHUB_EVENT_LOG_SQL);
+        db.exec(`CREATE INDEX IF NOT EXISTS idx_github_event_log_memory ON github_event_log(memory_id) WHERE memory_id IS NOT NULL`);
+        db.exec(`CREATE INDEX IF NOT EXISTS idx_github_event_log_delivery ON github_event_log(delivery_id)`);
+        db.exec(CREATE_TABLE_GITHUB_CURSORS_SQL);
+        db.exec(CREATE_TABLE_GITHUB_DLQ_SQL);
+        db.exec(`CREATE INDEX IF NOT EXISTS idx_github_dlq_tenant_received ON github_dlq(tenant_id, received_at)`);
+        db.exec(CREATE_TABLE_GITHUB_INSTALLATIONS_SQL);
+        // PAT-mode multi-tenant routing. Maps repo_full_name to
+        // tenant when the webhook envelope has no `installation` field. Composite
+        // PK so the same repo can intentionally be visible to multiple tenants
+        // (e.g., shared tooling accounts) — collision is on (repo, tenant) pair.
+        db.exec(CREATE_TABLE_GITHUB_REPOSITORIES_SQL);
         // Rollback-safety guard: an older binary lacks the *:private:* default-deny and would leak
         // github:private:* rows; the startup guard refuses a DB whose min_compatible_binary is newer.
         db.prepare(`INSERT INTO meta(key, value) VALUES('min_compatible_binary', ?) ON CONFLICT(key) DO UPDATE SET value=excluded.value`).run('1.2.1');

package/dist/db/migrations/v29.js

@@ -1,24 +1,5 @@
 import { tableExists } from '../tables.js';
-export const v29 = {
-    version: 29,
-    up: (db) => {
-        // Prediction first-class object: a predictions table for the reference-class /
-        // planning-fallacy detector. Predictions
-        // duplicate claim_text in the table itself so memory deletion
-        // (forget/consolidate/archive) does not lose prediction data; FK
-        // memory_id is NULLABLE with ON DELETE SET NULL.
-        //
-        // Cross-tenant safety: BEFORE INSERT + BEFORE UPDATE triggers
-        // enforce tenant_id match against the referenced memory. SQLite's
-        // ON DELETE SET NULL is incompatible with composite FK where one
-        // side is NOT NULL, so the trigger pattern replaces a composite
-        // FK target. Precedent: v14 memories.kind trigger pair at db.ts:298-322.
-        //
-        // CHECK constraint pins closure_state to (open|closed|closed-unknown).
-        // Accuracy (clean vs regressed) is computed from (estimate_value,
-        // actual_value) at query time.
-        if (!tableExists(db, 'predictions')) {
-            db.exec(`
+const CREATE_TABLE_PREDICTIONS_SQL = `
           CREATE TABLE predictions (
             id INTEGER PRIMARY KEY AUTOINCREMENT,
             memory_id TEXT,
@@ -36,19 +17,16 @@ export const v29 = {
             created_at TEXT NOT NULL,
             FOREIGN KEY (memory_id) REFERENCES memories(id) ON DELETE SET NULL
           )
-        `);
-            db.exec(`
+        `;
+const CREATE_INDEX_IDX_PREDICTIONS_TENANT_CLASS_SQL = `
           CREATE INDEX IF NOT EXISTS idx_predictions_tenant_class
           ON predictions(tenant_id, class_tag, closure_state)
-        `);
-            db.exec(`
+        `;
+const CREATE_INDEX_IDX_PREDICTIONS_MEMORY_SQL = `
           CREATE INDEX IF NOT EXISTS idx_predictions_memory
           ON predictions(memory_id) WHERE memory_id IS NOT NULL
-        `);
-            // Cross-tenant safety: tenant_id must match the referenced memory's
-            // tenant_id when memory_id IS NOT NULL. INSERT + UPDATE pair, mirroring
-            // v14 memories.kind enforcement (db.ts:298-322).
-            db.exec(`
+        `;
+const CREATE_TRIGGER_TRG_PREDICTIONS_TENANT_MATCH_INSERT_SQL = `
           CREATE TRIGGER IF NOT EXISTS trg_predictions_tenant_match_insert
           BEFORE INSERT ON predictions
           WHEN NEW.memory_id IS NOT NULL
@@ -58,8 +36,8 @@ export const v29 = {
               THEN RAISE(ABORT, 'predictions.tenant_id must match memories.tenant_id for the referenced memory')
             END;
           END
-        `);
-            db.exec(`
+        `;
+const CREATE_TRIGGER_TRG_PREDICTIONS_TENANT_MATCH_UPDATE_SQL = `
           CREATE TRIGGER IF NOT EXISTS trg_predictions_tenant_match_update
           BEFORE UPDATE ON predictions
           WHEN NEW.memory_id IS NOT NULL
@@ -70,7 +48,34 @@ export const v29 = {
               THEN RAISE(ABORT, 'predictions.tenant_id must match memories.tenant_id for the referenced memory')
             END;
           END
-        `);
+        `;
+export const v29 = {
+    version: 29,
+    up: (db) => {
+        // Prediction first-class object: a predictions table for the reference-class /
+        // planning-fallacy detector. Predictions
+        // duplicate claim_text in the table itself so memory deletion
+        // (forget/consolidate/archive) does not lose prediction data; FK
+        // memory_id is NULLABLE with ON DELETE SET NULL.
+        //
+        // Cross-tenant safety: BEFORE INSERT + BEFORE UPDATE triggers
+        // enforce tenant_id match against the referenced memory. SQLite's
+        // ON DELETE SET NULL is incompatible with composite FK where one
+        // side is NOT NULL, so the trigger pattern replaces a composite
+        // FK target. Precedent: v14 memories.kind trigger pair at db.ts:298-322.
+        //
+        // CHECK constraint pins closure_state to (open|closed|closed-unknown).
+        // Accuracy (clean vs regressed) is computed from (estimate_value,
+        // actual_value) at query time.
+        if (!tableExists(db, 'predictions')) {
+            db.exec(CREATE_TABLE_PREDICTIONS_SQL);
+            db.exec(CREATE_INDEX_IDX_PREDICTIONS_TENANT_CLASS_SQL);
+            db.exec(CREATE_INDEX_IDX_PREDICTIONS_MEMORY_SQL);
+            // Cross-tenant safety: tenant_id must match the referenced memory's
+            // tenant_id when memory_id IS NOT NULL. INSERT + UPDATE pair, mirroring
+            // v14 memories.kind enforcement (db.ts:298-322).
+            db.exec(CREATE_TRIGGER_TRG_PREDICTIONS_TENANT_MATCH_INSERT_SQL);
+            db.exec(CREATE_TRIGGER_TRG_PREDICTIONS_TENANT_MATCH_UPDATE_SQL);
         }
     },
 };

package/dist/db/migrations/v31.js

@@ -1,24 +1,5 @@
 import { tableExists } from '../tables.js';
-export const v31 = {
-    version: 31,
-    up: (db) => {
-        // Incident first-class object.
-        // Mirrors the v30 decisions block but for an open -> resolved -> closed
-        // lifecycle (NOT supersede): there is no superseded_by self-FK and no
-        // supersede trigger. An incident is a postmortem capsule: a recorded
-        // operational event with a lifecycle and optional linked receipts (the
-        // memories that are its evidence, stored as a JSON array of ids in
-        // linked_memory_ids). The memory mirror is kept for recall but is not
-        // authoritative; memory_id is NULLABLE with ON DELETE SET NULL so
-        // forget/consolidate/archive does not lose an incident.
-        //
-        // status (open|resolved|closed): resolved records a resolution_text +
-        // resolved_at and stays on record; closed is a terminal retire reachable
-        // from open or resolved. Cross-tenant safety: BEFORE INSERT + BEFORE
-        // UPDATE triggers enforce incidents.tenant_id == the referenced memory's
-        // tenant_id (verbatim mirror of the v30 decisions tenant-match triggers).
-        if (!tableExists(db, 'incidents')) {
-            db.exec(`
+const CREATE_TABLE_INCIDENTS_SQL = `
           CREATE TABLE incidents (
             id INTEGER PRIMARY KEY AUTOINCREMENT,
             memory_id TEXT,
@@ -34,18 +15,16 @@ export const v31 = {
             created_at TEXT NOT NULL,
             FOREIGN KEY (memory_id) REFERENCES memories(id) ON DELETE SET NULL
           )
-        `);
-            db.exec(`
+        `;
+const CREATE_INDEX_IDX_INCIDENTS_TENANT_STATUS_SQL = `
           CREATE INDEX IF NOT EXISTS idx_incidents_tenant_status
           ON incidents(tenant_id, status)
-        `);
-            db.exec(`
+        `;
+const CREATE_INDEX_IDX_INCIDENTS_MEMORY_SQL = `
           CREATE INDEX IF NOT EXISTS idx_incidents_memory
           ON incidents(memory_id) WHERE memory_id IS NOT NULL
-        `);
-            // Cross-tenant safety vs the referenced memory (verbatim mirror of the
-            // v30 decisions tenant-match triggers; no supersede trigger).
-            db.exec(`
+        `;
+const CREATE_TRIGGER_TRG_INCIDENTS_TENANT_MATCH_INSERT_SQL = `
           CREATE TRIGGER IF NOT EXISTS trg_incidents_tenant_match_insert
           BEFORE INSERT ON incidents
           WHEN NEW.memory_id IS NOT NULL
@@ -55,8 +34,8 @@ export const v31 = {
               THEN RAISE(ABORT, 'incidents.tenant_id must match memories.tenant_id for the referenced memory')
             END;
           END
-        `);
-            db.exec(`
+        `;
+const CREATE_TRIGGER_TRG_INCIDENTS_TENANT_MATCH_UPDATE_SQL = `
           CREATE TRIGGER IF NOT EXISTS trg_incidents_tenant_match_update
           BEFORE UPDATE ON incidents
           WHEN NEW.memory_id IS NOT NULL
@@ -67,7 +46,33 @@ export const v31 = {
               THEN RAISE(ABORT, 'incidents.tenant_id must match memories.tenant_id for the referenced memory')
             END;
           END
-        `);
+        `;
+export const v31 = {
+    version: 31,
+    up: (db) => {
+        // Incident first-class object.
+        // Mirrors the v30 decisions block but for an open -> resolved -> closed
+        // lifecycle (NOT supersede): there is no superseded_by self-FK and no
+        // supersede trigger. An incident is a postmortem capsule: a recorded
+        // operational event with a lifecycle and optional linked receipts (the
+        // memories that are its evidence, stored as a JSON array of ids in
+        // linked_memory_ids). The memory mirror is kept for recall but is not
+        // authoritative; memory_id is NULLABLE with ON DELETE SET NULL so
+        // forget/consolidate/archive does not lose an incident.
+        //
+        // status (open|resolved|closed): resolved records a resolution_text +
+        // resolved_at and stays on record; closed is a terminal retire reachable
+        // from open or resolved. Cross-tenant safety: BEFORE INSERT + BEFORE
+        // UPDATE triggers enforce incidents.tenant_id == the referenced memory's
+        // tenant_id (verbatim mirror of the v30 decisions tenant-match triggers).
+        if (!tableExists(db, 'incidents')) {
+            db.exec(CREATE_TABLE_INCIDENTS_SQL);
+            db.exec(CREATE_INDEX_IDX_INCIDENTS_TENANT_STATUS_SQL);
+            db.exec(CREATE_INDEX_IDX_INCIDENTS_MEMORY_SQL);
+            // Cross-tenant safety vs the referenced memory (verbatim mirror of the
+            // v30 decisions tenant-match triggers; no supersede trigger).
+            db.exec(CREATE_TRIGGER_TRG_INCIDENTS_TENANT_MATCH_INSERT_SQL);
+            db.exec(CREATE_TRIGGER_TRG_INCIDENTS_TENANT_MATCH_UPDATE_SQL);
         }
     },
 };

package/dist/db/migrations/v35.js

@@ -79,7 +79,7 @@ export const v35 = {
         // change_summary). This table = the v34 skills table with
         // skill_name/trigger_text replaced by `repo` (the repo-scoping dimension)
         // PLUS `summary` (the brief body). The distinguishing op (refreshBrief, in
-        // src/project-briefs.ts) auto-assembles the summary from the repo's receipts
+        // src/objects/project-briefs.ts) auto-assembles the summary from the repo's receipts
         // (memory rows tagged path:<repo>); it needs no schema support beyond `repo`.
         // All column names were checked against SQLite reserved words:
         // repo/summary/version/status/etc. are non-reserved.

package/dist/db/migrations/v39.js

@@ -1,6 +1,6 @@
 import * as os from 'os';
 import * as path from 'path';
-import { deriveOriginProject, originFromSource, isGlobalStoreRoot } from '../../project-identity.js';
+import { deriveOriginProject, originFromSource, isGlobalStoreRoot } from '../../core/project-identity.js';
 import { raiseMinBinary } from '../meta.js';
 import { tableHasColumn } from '../tables.js';
 export const v39 = {

package/dist/db/migrations/v40.js

@@ -1,16 +1,4 @@
-export const v40 = {
-    version: 40,
-    up: (db) => {
-        // Retrieval-trace persistence.
-        // Follows the v18 goal_recall_log style: one parent trace row per
-        // recall, a WITHOUT ROWID child table for the ranked results, and a
-        // separate append-only outcomes table so audit_log pruning can never
-        // erase training data.
-        //
-        // No min_compatible_binary bump, on purpose: an old binary ignores these tables and
-        // recordTraceOutcome re-validates trace ids, so its stale writes are skipped; a bump
-        // would lock old binaries out of the whole store for an observability feature.
-        db.exec(`
+const RECALL_TRACES_SCHEMA_SQL = `
         CREATE TABLE IF NOT EXISTS recall_traces (
           id INTEGER PRIMARY KEY AUTOINCREMENT,
           ts TEXT NOT NULL,
@@ -56,7 +44,20 @@ export const v40 = {
           memory_ids_json TEXT NOT NULL      -- ids actually credited by this outcome event
         );
         CREATE INDEX IF NOT EXISTS idx_recall_trace_outcomes_trace ON recall_trace_outcomes(trace_id);
-      `);
+      `;
+export const v40 = {
+    version: 40,
+    up: (db) => {
+        // Retrieval-trace persistence.
+        // Follows the v18 goal_recall_log style: one parent trace row per
+        // recall, a WITHOUT ROWID child table for the ranked results, and a
+        // separate append-only outcomes table so audit_log pruning can never
+        // erase training data.
+        //
+        // No min_compatible_binary bump, on purpose: an old binary ignores these tables and
+        // recordTraceOutcome re-validates trace ids, so its stale writes are skipped; a bump
+        // would lock old binaries out of the whole store for an observability feature.
+        db.exec(RECALL_TRACES_SCHEMA_SQL);
     },
 };
 //# sourceMappingURL=v40.js.map

package/dist/db/migrations/v43.js

@@ -1,8 +1,4 @@
-export const v43 = {
-    version: 43,
-    up: (db) => {
-        // W2a work-queue cards (trajectories/01M2D5VSYJFK4YXQ0RG2NGCPYJ/plan.md). Additive only, v41 precedent.
-        db.exec(`
+const CARDS_SCHEMA_SQL = `
         CREATE TABLE IF NOT EXISTS cards (
           id TEXT PRIMARY KEY,
           title TEXT NOT NULL,
@@ -61,7 +57,12 @@ export const v43 = {
 
         CREATE INDEX IF NOT EXISTS idx_session_handoffs_tenant_card
           ON session_handoffs(tenant_id, card_id, created_at DESC);
-      `);
+      `;
+export const v43 = {
+    version: 43,
+    up: (db) => {
+        // W2a work-queue cards (trajectories/01M2D5VSYJFK4YXQ0RG2NGCPYJ/plan.md). Additive only, v41 precedent.
+        db.exec(CARDS_SCHEMA_SQL);
     },
 };
 //# sourceMappingURL=v43.js.map

package/dist/db/migrations/v44.js

@@ -1,7 +1,7 @@
 export const v44 = {
     version: 44,
     up: (db) => {
-        // Dormant memories (src/dormant.ts): with `dormant.enabled`, the sleep
+        // Dormant memories (src/store/dormant.ts): with `dormant.enabled`, the sleep
         // decay pass moves a faded memory here instead of deleting it. The row
         // leaves `memories` in the same transaction, so recall, context and
         // every sleep pass stop seeing it; entry_json is the full MemoryEntry

package/dist/db/migrations/v45.js

@@ -1,7 +1,7 @@
 export const v45 = {
     version: 45,
     up: (db) => {
-        // Token ledger (src/token-ledger.ts): one row per block of
+        // Token ledger (src/store/token-ledger.ts): one row per block of
         // memory text hippo hands an agent (hook, CLI, MCP, HTTP). `event` is 'inject'
         // (sent), 'skip' (unchanged since the session's last inject, not sent), 'reset'
         // (compaction dropped earlier injections, so the next one must be sent) or

package/dist/db/migrations/v46.js

@@ -1,7 +1,7 @@
 export const v46 = {
     version: 46,
     up: (db) => {
-        // Failure log (src/failure-log.ts): hashes only, since failure text can carry paths and secrets.
+        // Failure log (src/store/failure-log.ts): hashes only, since failure text can carry paths and secrets.
         // Additive only: no min_compatible_binary bump.
         db.exec(`
         CREATE TABLE IF NOT EXISTS failure_log (

package/dist/db/migrations/v47.js

@@ -1,7 +1,7 @@
 export const v47 = {
     version: 47,
     up: (db) => {
-        // Scope grants (src/auth.ts): a member key reads a
+        // Scope grants (src/store/auth.ts): a member key reads a
         // restricted scope only by an explicit row here. Additive only: no
         // min_compatible_binary bump.
         db.exec(`

package/dist/db/migrations/v48.js

@@ -2,7 +2,7 @@ import { MEMORY_QUARANTINE_DDL } from '../continuity.js';
 export const v48 = {
     version: 48,
     up: (db) => {
-        // Quarantine (src/quarantine.ts): a poisoned or suspect memory sits here pending
+        // Quarantine (src/trust/quarantine.ts): a poisoned or suspect memory sits here pending
         // admin review instead of being hidden with no record. Additive only: no min_compatible_binary bump.
         db.exec(MEMORY_QUARANTINE_DDL);
     },

package/dist/db/migrations/v49.js

@@ -1,7 +1,7 @@
 export const v49 = {
     version: 49,
     up: (db) => {
-        // Compaction record (src/compaction-record.ts): one row per Claude Code compaction, written before it (started)
+        // Compaction record (src/capture/compaction-record.ts): one row per Claude Code compaction, written before it (started)
         // and after it (summarised, done). Not a memory row. Additive only: no min_compatible_binary bump.
         db.exec(`
         CREATE TABLE IF NOT EXISTS compactions (

package/dist/db/migrations/v50.js

@@ -1,9 +1,4 @@
-export const v50 = {
-    version: 50,
-    up: (db) => {
-        // Per-turn delivery events (src/recall-trace.ts). Additive only: no min_compatible_binary bump; rollback drops both tables
-        // and sets schema_version back to 49. No CHECK on enum columns since SQLite cannot alter one; delivery-recorder.ts unions are the allowlist.
-        db.exec(`
+const DELIVERY_EVENTS_SCHEMA_SQL = `
         CREATE TABLE IF NOT EXISTS delivery_events (
           id                INTEGER PRIMARY KEY AUTOINCREMENT,
           ts                TEXT NOT NULL,
@@ -61,7 +56,13 @@ export const v50 = {
           tokens       INTEGER,
           PRIMARY KEY (event_id, memory_id)
         ) WITHOUT ROWID;
-      `);
+      `;
+export const v50 = {
+    version: 50,
+    up: (db) => {
+        // Per-turn delivery events (src/store/recall-trace.ts). Additive only: no min_compatible_binary bump; rollback drops both tables
+        // and sets schema_version back to 49. No CHECK on enum columns since SQLite cannot alter one; delivery-recorder.ts unions are the allowlist.
+        db.exec(DELIVERY_EVENTS_SCHEMA_SQL);
     },
 };
 //# sourceMappingURL=v50.js.map

package/dist/db/migrations/v52.js

@@ -1,4 +1,4 @@
-import { MEMORY_VECTORS_DDL } from '../../vector-store.js';
+import { MEMORY_VECTORS_DDL } from '../vector-store.js';
 export const v52 = {
     version: 52,
     // Vectors move out of embeddings.json so hybrid search reads only the rows it ranks. Additive only; the JSON import runs after COMMIT.

package/dist/db/open.d.ts

@@ -1,5 +1,5 @@
 import { type DatabaseSyncLike } from './sqlite.js';
-import { getHippoDbPath } from './connect.js';
+import { getHippoDbPath, type OpenedDb } from './connect.js';
 export { getHippoDbPath };
 /** Lock wait for hook commands: under the 5 s prompt-hook budget even after a few skipped writes, and far above a normal write's hold. */
 export declare const HOOK_DB_WAIT_MS = 1000;
@@ -20,6 +20,10 @@ export declare function scopedBusyWait(): number | undefined;
 export declare function withSqliteBlocked<T>(storeKind: string, fn: () => T): T;
 /** Runs `fn` with hippo.db opens allowed again, for a store whose own methods are backed by hippo.db, or a copy that reads the old hippo.db. */
 export declare function withSqliteAllowed<T>(fn: () => T): T;
+/** Runs `fn` so that a hippo.db open on this thread throws, across awaits; a block of another store, when one is open, already refuses and stays as it is. */
+export declare function withSqliteOffLoop<T>(fn: () => T): T;
+/** Leaves withSqliteOffLoop's block and nothing else: another store's block and the folder marker still refuse, which withSqliteAllowed would waive. */
+export declare function outsideSqliteOffLoop<T>(fn: () => T): T;
 /** First line of a best-effort catch around a hippo.db open: an unported path must fail closed, not fall back silently. */
 export declare function rethrowIfSqliteBlocked<E>(err: E): void;
 /** store init --db, store copy --db and serve --db write this file in the hippo root; its text is the store kind. */
@@ -30,6 +34,10 @@ export declare function assertSqliteAllowed(hippoRoot: string): void;
 export declare function openHippoDb(hippoRoot: string, opts?: {
     busyWaitMs?: number;
 }): DatabaseSyncLike;
+/** openHippoDb, with what the open's probe read when this call made the connection. */
+export declare function openHippoDbWithFacts(hippoRoot: string, opts?: {
+    busyWaitMs?: number;
+}): OpenedDb;
 /** Open an existing store without changing it: no mkdir, WAL switch, migration or mirror cleanup. Throws when hippo.db is missing. */
 export declare function openHippoDbReadOnly(hippoRoot: string): DatabaseSyncLike;
 export declare function closeHippoDb(db: DatabaseSyncLike): void;

package/dist/db/open.js

@@ -1,13 +1,13 @@
 import { AsyncLocalStorage } from 'node:async_hooks';
 import { existsSync, readFileSync } from 'node:fs';
 import { join } from 'node:path';
-import { errorMessage, log } from '../log.js';
+import { errorMessage, log } from '../util/log.js';
 import { DatabaseSync } from './sqlite.js';
 import { tableExists } from './tables.js';
 import { assertBinaryCompatible } from './migrate.js';
-import { connectHippoDb, getHippoDbPath } from './connect.js';
+import { connectWithFacts, getHippoDbPath } from './connect.js';
 import { currentRequestStores, isScopedHandle, runWithRequestStores } from './request-stores.js';
-import { OtherStoreFolderError, SqliteBlockedError } from './sqlite-blocked.js';
+import { OtherStoreFolderError, SqliteBlockedError } from '../util/sqlite-blocked.js';
 export { getHippoDbPath };
 /** Lock wait for hook commands: under the 5 s prompt-hook budget even after a few skipped writes, and far above a normal write's hold. */
 export const HOOK_DB_WAIT_MS = 1000;
@@ -38,6 +38,17 @@ export function withSqliteBlocked(storeKind, fn) {
 export function withSqliteAllowed(fn) {
     return sqliteBlockedBy.exit(() => markerWaived.run(true, fn));
 }
+// Not a store kind: the block of a route whose SQLite work belongs on a worker thread, under the hippo.db store itself.
+const OFF_LOOP = 'sqlite (off the event loop)';
+const OFF_LOOP_MESSAGE = 'hippo.db was opened on the server thread by a route whose SQLite work runs on a worker thread';
+/** Runs `fn` so that a hippo.db open on this thread throws, across awaits; a block of another store, when one is open, already refuses and stays as it is. */
+export function withSqliteOffLoop(fn) {
+    return sqliteBlockedBy.getStore() === undefined ? sqliteBlockedBy.run(OFF_LOOP, fn) : fn();
+}
+/** Leaves withSqliteOffLoop's block and nothing else: another store's block and the folder marker still refuse, which withSqliteAllowed would waive. */
+export function outsideSqliteOffLoop(fn) {
+    return sqliteBlockedBy.getStore() === OFF_LOOP ? sqliteBlockedBy.exit(fn) : fn();
+}
 /** First line of a best-effort catch around a hippo.db open: an unported path must fail closed, not fall back silently. */
 export function rethrowIfSqliteBlocked(err) {
     if (err instanceof SqliteBlockedError)
@@ -59,6 +70,8 @@ function markerKind(marker) {
 /** Throws where hippo.db must not open; checked on every open, not cached, since the marker can appear while a process runs. */
 export function assertSqliteAllowed(hippoRoot) {
     const storeKind = sqliteBlockedBy.getStore();
+    if (storeKind === OFF_LOOP)
+        throw new SqliteBlockedError('sqlite', OFF_LOOP_MESSAGE);
     if (storeKind !== undefined)
         throw new SqliteBlockedError(storeKind);
     if (markerWaived.getStore())
@@ -69,9 +82,13 @@ export function assertSqliteAllowed(hippoRoot) {
 }
 /** `busyWaitMs` shortens every lock wait of this open, for a hook that must finish inside its own timeout. */
 export function openHippoDb(hippoRoot, opts) {
+    return openHippoDbWithFacts(hippoRoot, opts).db;
+}
+/** openHippoDb, with what the open's probe read when this call made the connection. */
+export function openHippoDbWithFacts(hippoRoot, opts) {
     assertSqliteAllowed(hippoRoot);
     const stores = currentRequestStores();
-    return stores ? stores.get(hippoRoot, opts) : connectHippoDb(hippoRoot, opts?.busyWaitMs);
+    return stores ? stores.getWithFacts(hippoRoot, opts) : connectWithFacts(hippoRoot, opts?.busyWaitMs);
 }
 /** Open an existing store without changing it: no mkdir, WAL switch, migration or mirror cleanup. Throws when hippo.db is missing. */
 export function openHippoDbReadOnly(hippoRoot) {