hippo-memory 1.69.0 → 1.70.0

package/dist/api/recall.js

@@ -1,26 +1,28 @@
 // Read path: recall (sync) and retrieve (async, adds the vector arm).
-import { envRequireSessionScopedFreshTail } from '../env.js';
+import { envRequireSessionScopedFreshTail } from '../util/env.js';
 import { DEFAULT_SEARCH_CANDIDATE_LIMIT } from '../store/rows.js';
-import { isRecallBoostAblated } from '../ablation.js';
 import { loadEntriesByIds, loadFreshRawMemories } from '../store/entry-reads.js';
 import { loadRecallSearchEntries, recallScopeFilter } from '../store/search-rows.js';
-import { estimateTokens } from '../token-ledger.js';
-import { formatHandoffEvidenceLine } from '../handoff.js';
-import { activeGoalsWithPolicies, boostByGoals } from '../goals.js';
-import { continuityAt, finishRecallAt, storeFor } from '../store-port.js';
+import { estimateTokens } from '../util/token-text.js';
+import { formatHandoffEvidenceLine } from '../core/handoff.js';
+import { activeGoalsWithPolicies, boostByGoals } from '../store/goals.js';
+import { continuityAt, finishRecallAt, storeFor } from '../store/index.js';
 import { hybridSearch } from '../search/hybrid.js';
 import { physicsSearch } from '../search/physics-search.js';
 import { churnStaleFactor } from '../search/boosts.js';
-import { compareEntryIdentity } from '../compare.js';
-import { dropHeldCopies, duplicateKey, storedTextKeys } from '../same-text.js';
-import { isSharedStore, loadConfig } from '../config.js';
-import { classifyOriginProject, projectNames } from '../project-identity.js';
-import { decidePlanningFallacy, detectPlanningClaim, planningFallacyEvidenceAt } from '../predictions/planning-fallacy.js';
-import { detectAnchoring, hashQueryText, biasHintEnabled } from '../recall-history.js';
-import { detectAvailabilityBias } from '../availability.js';
-import { passesScopeFilterForRecall, assertScopeRequestAllowed, personalScopeOf } from '../recall-scope.js';
+import { compareEntryIdentity } from '../core/compare.js';
+import { dropHeldCopies, duplicateKey, storedTextKeys } from '../util/same-text.js';
+import { isSharedStore, loadConfig } from '../core/config.js';
+import { classifyOriginProject, projectNames } from '../core/project-identity.js';
+import { decidePlanningFallacy, detectPlanningClaim } from '../predictions/planning-fallacy.js';
+import { planningFallacyEvidenceAt } from '../store/planning-fallacy-evidence.js';
+import { detectAnchoring, hashQueryText, biasHintEnabled } from './recall-history.js';
+import { detectAvailabilityBias } from './availability.js';
+import { passesScopeFilterForRecall, assertScopeRequestAllowed, personalScopeOf } from '../store/recall-scope.js';
 import { ownerOrSubject, RecallContractError } from './types.js';
-import { anchoringRows, availabilityRows, recallAuditMetadata, recallAuditRow } from './recall-record.js';
+import { anchoringRows, availabilityRows, callerOf, recallAuditMetadata, recallAuditRow, strengthenOf } from './recall-record.js';
+import { retrieveWithCliCore } from './recall-core.js';
+const DEFAULT_RECALL_LIMIT = 10;
 /**
  * Shared construction helper for `RecallSuppressionSummary`. Used by
  * `api.recall`, `cmdRecall`, and the MCP `hippo_recall` handler so all three
@@ -61,7 +63,7 @@ export function recall(ctx, opts) {
     const own = personalScopeOf(ctx.actor) ?? undefined;
     const all = loadRecallSearchEntries(ctx.hippoRoot, opts.query, windowSize, ctx.tenantId, opts.scope, 'exact', false, recallOrigin(opts), own);
     const plan = planRecall(ctx, opts, all, own);
-    const { result, writes } = composeRecall(ctx, opts, windowSize, all, plan, readRecallSync(ctx, opts, plan));
+    const { result, writes } = composeRecall(ctx, opts, { windowSize, all, plan, reads: readRecallSync(ctx, opts, plan) });
     finishRecallAt(ctx.hippoRoot, { ...writes, audit: [...(opts.leadingAudit ?? []), ...writes.audit] });
     return result;
 }
@@ -71,9 +73,11 @@ function recallOrigin(opts) {
 function inCallerProject(entry, opts) {
     return !opts.project || classifyOriginProject(entry.origin_project, opts.project) !== 'cross-project';
 }
-/** Mode-aware recall through the served store that strengthens each returned row; never writes last_retrieval_ids (contract lock). */
+/** The one recall entry: ranks with the ranker `opts` names, then writes the recall. Only the CLI core ranker writes last_retrieval_ids (contract lock). */
 export async function retrieve(ctx, opts) {
     assertScopeRequestAllowed(ctx.actor, opts.scope);
+    if (opts.cliCore)
+        return retrieveWithCliCore(ctx, opts, opts.cliCore);
     const windowSize = recallWindowSize(opts);
     // From the authenticated actor, never from RecallOpts, which a caller fills in.
     const own = personalScopeOf(ctx.actor) ?? undefined;
@@ -90,7 +94,7 @@ export async function retrieve(ctx, opts) {
         candidates = [...ranked.map((r) => r.entry), ...candidates.filter((e) => !rankedIds.has(e.id))];
     }
     const plan = planRecall(ctx, opts, candidates, own);
-    const { result, writes } = composeRecall(ctx, opts, windowSize, candidates, plan, await readRecall(store, ctx, opts, plan));
+    const { result, writes } = composeRecall(ctx, opts, { windowSize, all: candidates, plan, reads: await readRecall(store, ctx, opts, plan) });
     await store.finishRecall({ ...writes, audit: [...(opts.leadingAudit ?? []), ...writes.audit], strengthen: strengthenOf(ctx, result.results.map((r) => r.id)) });
     return result;
 }
@@ -106,9 +110,6 @@ function recallSearchArgs(ctx, opts, limit, own) {
         ownScope: own,
     };
 }
-function strengthenOf(ctx, ids) {
-    return { ids, opts: { tenantId: ctx.tenantId, recallBoostAblated: isRecallBoostAblated() } };
-}
 /** api.retrieve's vector arm: the recall load's exact-scope rule, current rows only. */
 function recallVectorSpec(ctx, opts, own) {
     return {
@@ -142,7 +143,7 @@ async function retrieveFromStore(ctx, opts, windowSize, show, own) {
     const window = ranked.slice(0, windowSize).map((r) => r.entry);
     const bandOpts = { ...opts, suppressRecallTrace: true };
     const plan = planRecall(ctx, bandOpts, window, own);
-    const { result, writes } = composeRecall(ctx, bandOpts, windowSize, window, plan, await readRecall(store, ctx, bandOpts, plan, goals), false);
+    const { result, writes } = composeRecall(ctx, bandOpts, { windowSize, all: window, plan, reads: await readRecall(store, ctx, bandOpts, plan, goals), auditBand: false });
     // Rows the vector arm added count as candidates too.
     const inPool = new Set(pool.map((e) => e.id));
     const candidates = [...pool, ...ranked.map((r) => r.entry).filter((e) => !inPool.has(e.id))];
@@ -187,7 +188,7 @@ function recallWindowSize(opts) {
 }
 const CONTINUITY_EVENT_LIMIT = 5;
 function planRecall(ctx, opts, all, own) {
-    const limit = opts.limit ?? 10;
+    const limit = opts.limit ?? DEFAULT_RECALL_LIMIT;
     const window = admitCandidates(opts, all, limit, own);
     return {
         limit,
@@ -228,9 +229,8 @@ function continuityKey(ctx, opts) {
         return null;
     return { owner: ownerOrSubject(ctx.actor), project: opts.project ? projectNames(opts.project) : [] };
 }
-/** The reply and the rows it writes, from the candidates and the plan's reads; touches no store.
- *  `auditBand` false: the caller shows a cut of the band and audits the rows it shows. */
-function composeRecall(ctx, opts, windowSize, all, plan, reads, auditBand = true) {
+function composeRecall(ctx, opts, options) {
+    const { windowSize, all, plan, reads, auditBand = true } = options;
     const { window } = plan;
     const bands = rankBands(opts, plan, reads);
     const rankedOut = bands.rankedOut;
@@ -319,7 +319,9 @@ function rankBands(opts, plan, reads) {
     const baseRanked = baseScored.map((r) => baseItem(r, opts, explainTrace));
     const summaryRanked = substituted.map((s) => summaryItem(s, opts));
     const freshRanked = (opts.freshTailCount ?? 0) > 0
-        ? freshTailBand(opts, reads.freshRaws, baseRanked, summaryRanked, opts.keepHeldCopies ? [] : [...baseSlice, ...substituted.map((s) => s.entry)], own)
+        ? freshTailBand(opts, {
+            recent: reads.freshRaws, baseRanked, summaryRanked, shownEntries: opts.keepHeldCopies ? [] : [...baseSlice, ...substituted.map((s) => s.entry)], own,
+        })
         : [];
     return {
         rankedOut: [...freshRanked, ...baseRanked, ...summaryRanked],
@@ -334,7 +336,7 @@ function rankBands(opts, plan, reads) {
 // `limit`. Each one is tenant-scoped and re-checked against the scope filter; drillDown recovers the children.
 function substituteOverflow(opts, overflowByParent, parents, limit, own) {
     const eligibleParents = parents.filter((p) => (p.dag_level ?? 0) === 2 && !p.superseded_by && passesScopeFilterForRecall(p.scope ?? null, opts.scope, own) && inCallerProject(p, opts));
-    const maxSub = Math.max(1, Math.ceil(limit * 0.3));
+    const maxSub = Math.max(1, Math.ceil(limit * SUMMARY_SUB_FRACTION));
     // Most overflowed children first; compareEntryIdentity only breaks a tie, which used to fall to scan order.
     eligibleParents.sort((a, b) => {
         const ac = overflowByParent.get(a.id)?.length ?? 0;
@@ -380,12 +382,16 @@ function baseItem(r, opts, explainTrace) {
     }
     return item;
 }
-// Score 0.5 keeps a summary below the strong top-N matches but above the weakest leaves.
+// A summary scores below the strong top-N matches but above the weakest leaves.
+const SUMMARY_ITEM_SCORE = 0.5;
+const FRESH_TAIL_ITEM_SCORE = 1.0;
+// Summaries may take this share of the limit.
+const SUMMARY_SUB_FRACTION = 0.3;
 function summaryItem(s, opts) {
     const item = {
         id: s.entry.id,
         content: s.entry.content,
-        score: 0.5,
+        score: SUMMARY_ITEM_SCORE,
         layer: s.entry.layer,
         strength: s.entry.strength,
         isSummary: true,
@@ -396,9 +402,8 @@ function summaryItem(s, opts) {
         item.rerankPipeline = 'api';
     return item;
 }
-// The last N raw rows, so "what did I just see" always covers the recent window. A recent row already in the BM25
-// band is only tagged isFreshTail; new ones are prepended, so every recent row appears exactly once.
-function freshTailBand(opts, recent, baseRanked, summaryRanked, shownEntries, own) {
+function freshTailBand(opts, options) {
+    const { recent, baseRanked, summaryRanked, shownEntries, own } = options;
     const recentScoped = recent.filter((m) => passesScopeFilterForRecall(m.scope ?? null, opts.scope, own) && inCallerProject(m, opts));
     const recentIdSet = new Set(recentScoped.map((m) => m.id));
     for (const r of baseRanked) {
@@ -415,7 +420,7 @@ function freshTailBand(opts, recent, baseRanked, summaryRanked, shownEntries, ow
         const item = {
             id: m.id,
             content: m.content,
-            score: 1.0,
+            score: FRESH_TAIL_ITEM_SCORE,
             layer: m.layer,
             strength: m.strength,
             isFreshTail: true,
@@ -471,9 +476,6 @@ function continuityTokensOf(c) {
         tokenize(filteredHandoff?.cardId) +
         c.recentSessionEvents.reduce((acc, e) => acc + tokenize(e.content), 0);
 }
-function callerOf(ctx) {
-    return { tenantId: ctx.tenantId, actor: ctx.actor.subject };
-}
 // A pure read of the caller's recallHistory snapshot against this top-1. HIPPO_ANCHORING=off skips even the detect
 // call; CLI paths pass no history (cmdRecall computes its own hint), so the hint stays absent there.
 function detectRecallAnchoring(opts, topMemoryId) {

package/dist/api/remember.d.ts

@@ -1,5 +1,5 @@
-import type { DatabaseSyncLike } from '../db.js';
-import { type MemoryKind } from '../memory.js';
+import type { ConnectorEvent } from '../store/port.js';
+import { type MemoryKind } from '../core/memory.js';
 import type { Context, StoreReply } from './types.js';
 export interface RememberOpts {
     content: string;
@@ -8,15 +8,8 @@ export interface RememberOpts {
     owner?: string;
     artifactRef?: string;
     tags?: string[];
-    /**
-     * Optional hook invoked inside the same transaction as the underlying
-     * memories INSERT. Used by ingestion connectors to stamp
-     * idempotency / cursor rows atomically with the memory row, so a crash
-     * mid-write cannot produce a memory without its corresponding side-effect
-     * log row (or vice versa). If the callback throws, the INSERT is rolled
-     * back and the error is rethrown.
-     */
-    afterWrite?: (db: DatabaseSyncLike, memoryId: string) => void;
+    /** The connector event this write answers. The store logs it in the memory's own transaction; an event logged before stores nothing and answers `duplicate`. */
+    event?: ConnectorEvent;
     /** Connector-ingested content an agent doesn't control; gates detectInstruction. CLI/HTTP/MCP never set this. */
     untrusted?: boolean;
     /** The caller's project: its name becomes the row's origin. Without it the store's fallback applies (NULL on a shared store). */
@@ -37,7 +30,12 @@ export interface RememberResult {
     };
     /** Set only when the content held secret material: untrusted text had it redacted, typed text was stored as sent. */
     warnings?: string[];
+    /** Set only when the write's event was logged before: nothing was stored, so `id` names no row; `memoryId` is the id the first write logged. */
+    duplicate?: {
+        memoryId: string | null;
+    };
 }
-/** Store one memory. With `ctx.store`, its entryWrites group writes the row and its remember row; hippo.db is opened only when there is no store. */
+/** Store one memory: the store's entryWrites group writes the row and its one remember audit row, under the caller's subject.
+ *  A write that carries a connector event or untrusted content goes through connectorWrites, which commits its companion rows with it. */
 export declare function remember<C extends Context>(ctx: C, opts: RememberOpts): StoreReply<C, RememberResult>;
 //# sourceMappingURL=remember.d.ts.map

package/dist/api/remember.js

@@ -1,15 +1,14 @@
 // Write path: remember stores one memory after secret vetting and, for untrusted content, the instruction check.
-import { writeEntry } from '../store/entry-writes.js';
 import { stampOriginProject } from '../store/entry-row.js';
-import { requireGroup } from '../store-port.js';
-import { detectInstruction } from '../instruction-detect.js';
-import { quarantineScopeFor, recordQuarantine } from '../quarantine.js';
-import { createMemory } from '../memory.js';
-import { loadConfig } from '../config.js';
-import { vetSecrets } from '../secret-detect.js';
-import { assertCallerProject } from '../project-identity.js';
-import { BadRequestError } from '../api-errors.js';
-import { assertClientScope, personalScopeOf } from '../recall-scope.js';
+import { detectInstruction } from './instruction-detect.js';
+import { quarantineScopeFor } from '../trust/quarantine.js';
+import { createMemory } from '../core/memory.js';
+import { loadConfig } from '../core/config.js';
+import { vetSecrets } from '../util/secret-detect.js';
+import { assertCallerProject } from '../core/project-identity.js';
+import { BadRequestError } from '../core/api-errors.js';
+import { assertClientScope, personalScopeOf } from '../store/recall-scope.js';
+import { andThen, notPorted, onStore } from './on-store.js';
 /** The scope a write lands in: the caller's own personal scope when asked for, else the client's, which may not be a personal one. */
 function rememberScope(ctx, opts) {
     if (!opts.personal) {
@@ -46,49 +45,34 @@ function prepareRemember(ctx, opts) {
     const stamped = origin !== undefined ? { ...entry, origin_project: origin } : entry;
     return { entry: stamped, requestedScope, detection, warnings: vetted.warnings };
 }
-function rememberResult(ctx, prepared) {
+function rememberResult(ctx, prepared, written) {
     const { entry, detection, warnings } = prepared;
     const result = { id: entry.id, kind: entry.kind, tenantId: ctx.tenantId };
     if (detection.flagged)
         result.quarantined = { reason: detection.reason ?? 'unknown' };
     if (warnings.length > 0)
         result.warnings = [...warnings];
+    if (written?.outcome === 'duplicate')
+        result.duplicate = { memoryId: written.memoryId };
     return result;
 }
-/** Store one memory. With `ctx.store`, its entryWrites group writes the row and its remember row; hippo.db is opened only when there is no store. */
-export function remember(ctx, opts) {
-    const reply = ctx.store ? rememberThroughStore(ctx, ctx.store, opts) : rememberOnHippoDb(ctx, opts);
-    // SAFETY: a C typed with a store gets the promise its path returns; a wide C is typed as the union, which a caller has to await anyway.
-    return reply;
-}
-/** afterWrite and the quarantine row write on hippo.db's own handle, and only connectors send them, so a store refuses both. */
-async function rememberThroughStore(ctx, store, opts) {
-    const entryWrites = requireGroup(store, 'entryWrites');
-    if (opts.afterWrite || opts.untrusted)
-        throw new Error('afterWrite and untrusted content are written to hippo.db only, never through a store');
-    const prepared = prepareRemember(ctx, opts);
-    // The store writes origin_project as given, so the served folder's fallback is stamped here.
-    await entryWrites.writeEntry({ entry: stampOriginProject(ctx.hippoRoot, prepared.entry), actor: ctx.actor.subject });
-    return rememberResult(ctx, prepared);
+/** A flagged row's review record, which the store writes in the row's own transaction. */
+function quarantineOf({ requestedScope, detection }) {
+    return detection.flagged ? { originalScope: requestedScope, reason: detection.reason ?? 'unknown' } : undefined;
 }
-function rememberOnHippoDb(ctx, opts) {
-    const prepared = prepareRemember(ctx, opts);
-    const { requestedScope, detection } = prepared;
-    // writeEntry threads ctx.actor.subject into its internal audit hook, so exactly
-    // one 'remember' event lands in the log with the supplied actor.
-    const afterWrite = detection.flagged
-        ? (db, memoryId) => {
-            recordQuarantine(db, {
-                tenantId: ctx.tenantId,
-                memoryId,
-                originalScope: requestedScope,
-                reason: detection.reason ?? 'unknown',
-                actor: ctx.actor.subject,
-            });
-            opts.afterWrite?.(db, memoryId);
-        }
-        : opts.afterWrite;
-    writeEntry(ctx.hippoRoot, prepared.entry, { actor: ctx.actor.subject, afterWrite });
-    return rememberResult(ctx, prepared);
+/** Store one memory: the store's entryWrites group writes the row and its one remember audit row, under the caller's subject.
+ *  A write that carries a connector event or untrusted content goes through connectorWrites, which commits its companion rows with it. */
+export function remember(ctx, opts) {
+    return onStore(ctx, (port) => {
+        const entryWrites = port.entryWrites ?? notPorted(port, 'entryWrites');
+        const prepared = prepareRemember(ctx, opts);
+        // A store writes origin_project as given, so the served folder's fallback is stamped here.
+        const write = { entry: stampOriginProject(ctx.hippoRoot, prepared.entry), actor: ctx.actor.subject };
+        if (opts.untrusted !== true && opts.event === undefined)
+            return andThen(entryWrites.writeEntry(write), () => rememberResult(ctx, prepared));
+        const connectorWrites = port.connectorWrites ?? notPorted(port, 'connectorWrites');
+        const written = connectorWrites.writeConnectorEntry({ ...write, event: opts.event, quarantine: quarantineOf(prepared) });
+        return andThen(written, (outcome) => rememberResult(ctx, prepared, outcome));
+    });
 }
 //# sourceMappingURL=remember.js.map

package/dist/api/session-owners.d.ts

@@ -0,0 +1,4 @@
+import { type Context } from './types.js';
+/** Binds `sessionId` to the caller's owner on first use; a session another owner holds is a 409, so the client can set it aside. */
+export declare function bindSessionOwner(ctx: Context, sessionId: string): void;
+//# sourceMappingURL=session-owners.d.ts.map

package/dist/api/session-owners.js

@@ -0,0 +1,17 @@
+// A session id belongs to the first owner that binds it, so one developer's client cannot write into another's session.
+import { ConflictError } from '../core/api-errors.js';
+import { ownerOrSubject } from './types.js';
+import { sessionOwnerOrBind } from '../store/sessions.js';
+import { assertTenantId } from '../store/tenant.js';
+import { DAY_MS } from '../util/time.js';
+/** Bindings older than this are pruned when a new session binds. */
+const BINDING_RETENTION_DAYS = 90;
+/** Binds `sessionId` to the caller's owner on first use; a session another owner holds is a 409, so the client can set it aside. */
+export function bindSessionOwner(ctx, sessionId) {
+    assertTenantId('bindSessionOwner', ctx.tenantId);
+    const owner = ownerOrSubject(ctx.actor);
+    const bound = sessionOwnerOrBind(ctx.hippoRoot, { tenantId: ctx.tenantId, sessionId, owner, retentionMs: BINDING_RETENTION_DAYS * DAY_MS });
+    if (bound !== owner)
+        throw new ConflictError('session id belongs to another caller');
+}
+//# sourceMappingURL=session-owners.js.map

package/dist/api/sleep-run.d.ts

@@ -1,13 +1,13 @@
 import { loadAllEntries } from '../store/entry-reads.js';
 import { deleteEntry } from '../store/delete-and-batch.js';
-import { auditMemories } from '../audit.js';
-import { autoShare } from '../shared.js';
+import { auditMemories } from '../store/audit.js';
+import { autoShare } from '../sharing/shared.js';
 import { consolidate } from '../consolidate/sleep.js';
-import { loadConfig } from '../config.js';
-import { deduplicateStore } from '../dedupe.js';
-import { computeAmbientState } from '../ambient.js';
-import { loadPendingExtractionTenants } from '../graph/read.js';
-import { type ExtractResult } from '../graph-extract.js';
+import { loadConfig } from '../core/config.js';
+import { deduplicateStore } from '../consolidate/dedupe.js';
+import { computeAmbientState } from '../core/ambient.js';
+import { loadPendingExtractionTenants } from '../store/graph-queue.js';
+import { type ExtractResult } from '../graph/extract.js';
 import type { Context } from './types.js';
 import type { SleepOpts, SleepResult } from './sleep.js';
 /** Test-only seam: `runSleep` overrides force a phase to throw into emitSleepAudit's `partial: true` row; production never sets them. */

package/dist/api/sleep-run.js

@@ -1,17 +1,17 @@
 // The sleep pipeline behind `sleep`, with its phase dependencies injectable; kept out of the package root.
-import { openHippoDb, closeHippoDb } from '../db.js';
 import { loadAllEntries } from '../store/entry-reads.js';
 import { deleteEntry, memoriesBackingObjects } from '../store/delete-and-batch.js';
-import { appendAuditEvent, reportAuditWriteFailure, auditMemories } from '../audit.js';
-import { autoShare } from '../shared.js';
+import { reportAuditWriteFailure, auditMemories } from '../store/audit.js';
+import { sqliteSyncStore } from '../store/sqlite/store.js';
+import { autoShare } from '../sharing/shared.js';
 import { consolidate } from '../consolidate/sleep.js';
 import { failedUnitOf } from '../store/delete-and-batch.js';
-import { loadConfig } from '../config.js';
-import { deduplicateStore } from '../dedupe.js';
-import { computeAmbientState } from '../ambient.js';
-import { loadPendingExtractionTenants } from '../graph/read.js';
-import { markPendingProcessedUpTo } from '../graph/write.js';
-import { extractGraphChunked } from '../graph-extract.js';
+import { loadConfig } from '../core/config.js';
+import { deduplicateStore } from '../consolidate/dedupe.js';
+import { computeAmbientState } from '../core/ambient.js';
+import { loadPendingExtractionTenants, markPendingProcessedUpTo } from '../store/graph-queue.js';
+import { extractGraphChunked } from '../graph/extract.js';
+import { errorMessage } from '../util/log.js';
 const DEFAULT_SLEEP_PHASES = {
     consolidate,
     deduplicateStore,
@@ -60,7 +60,7 @@ async function runSleepPhases(ctx, opts, phases, counts) {
     if (dedupResult.removed > 0)
         result.deduped = dedupSummary(dedupResult);
     // Phase 3: Quality audit (remove junk, report warnings; a dry run skips rows earlier phases would remove).
-    counts.auditDeleted = runQualityAudit(ctx, phases, dryRun, consolidateResult, dedupResult, result);
+    counts.auditDeleted = runQualityAudit(ctx, phases, { dryRun, consolidateResult, dedupResult, result });
     if (dryRun)
         return result;
     // Phase 4: Auto-share high-transfer-score memories to global.
@@ -80,10 +80,7 @@ function snapshotDirtyTenants(ctx, phases, dryRun) {
             snapshot.dirtyTenants = phases.loadPendingExtractionTenants(ctx.hippoRoot);
         }
         catch (snapErr) {
-            // SAFETY: this is a best-effort log message only; property access on
-            // any JS value is safe (undefined if absent), preserving the existing
-            // lenient formatting even when something non-Error was thrown.
-            snapshot.error = snapErr.message;
+            snapshot.error = errorMessage(snapErr);
         }
     }
     return snapshot;
@@ -118,8 +115,8 @@ function dedupSummary(dedupResult) {
         crossDups,
     };
 }
-/** Returns how many audit errors were deleted, or would be under dryRun. */
-function runQualityAudit(ctx, phases, dryRun, consolidateResult, dedupResult, result) {
+function runQualityAudit(ctx, phases, options) {
+    const { dryRun, consolidateResult, dedupResult, result } = options;
     const planned = new Set(dryRun ? [...(consolidateResult.removedIds ?? []), ...dedupResult.pairs.map((p) => p.removed)] : []);
     const allEntries = phases.loadAllEntries(ctx.hippoRoot).filter((e) => !planned.has(e.id));
     const auditOut = phases.auditMemories(allEntries, memoriesBackingObjects(ctx.hippoRoot));
@@ -180,49 +177,45 @@ async function drainGraphQueue(ctx, phases, snapshot, result) {
                 `graph: dirty-tenant snapshot failed (skipped graph refresh): ${snapshot.error}`,
             ];
         }
-        let gTenants = 0;
-        let gEntities = 0;
-        let gRelations = 0;
+        const rebuilt = { tenants: 0, entities: 0, relations: 0 };
         // dirtyTenants was snapshotted before the memory-deleting phases above.
         for (const { tenantId, maxPendingId } of snapshot.dirtyTenants) {
-            try {
-                const ext = await phases.extractGraph(ctx.hippoRoot, tenantId);
-                // Count the rebuild as soon as it succeeds — it happened regardless of
-                // the drain-mark below.
-                gTenants += 1;
-                gEntities += ext.entities;
-                gRelations += ext.relations;
-                if (ext.skipped) {
-                    result.details = [
-                        ...(result.details ?? []),
-                        `graph: ${ext.skipped} stale op(s) skipped for a tenant; the next sleep redoes them`,
-                    ];
-                }
-                // Watermark drain: only items enqueued before this rebuild started are marked; later arrivals stay pending.
-                // Marked only after the last chunk, so a run stopped between chunks leaves the tenant for the next one.
-                markPendingProcessedUpTo(ctx.hippoRoot, tenantId, maxPendingId);
-            }
-            catch (tenantErr) {
-                // SAFETY: this is a best-effort log message only; property access
-                // on any JS value is safe (undefined if absent), preserving the
-                // existing lenient formatting even when something non-Error was thrown.
-                result.details = [
-                    ...(result.details ?? []),
-                    `graph: extract failed for a dirty tenant (left pending): ${tenantErr.message}`,
-                ];
-            }
+            await rebuildDirtyTenant(ctx, phases, { tenantId, maxPendingId }, rebuilt, result);
         }
-        if (gTenants > 0) {
-            result.graph = { tenants: gTenants, entities: gEntities, relations: gRelations };
+        if (rebuilt.tenants > 0) {
+            result.graph = rebuilt;
         }
     }
     catch (graphErr) {
-        // SAFETY: this is a best-effort log message only; property access on
-        // any JS value is safe (undefined if absent), preserving the existing
-        // lenient formatting even when something non-Error was thrown.
         result.details = [
             ...(result.details ?? []),
-            `graph: drain phase failed (skipped): ${graphErr.message}`,
+            `graph: drain phase failed (skipped): ${errorMessage(graphErr)}`,
+        ];
+    }
+}
+/** Rebuilds one dirty tenant's graph into `rebuilt` and drains its queue; a failure is a detail line and the tenant stays pending. */
+async function rebuildDirtyTenant(ctx, phases, dirty, rebuilt, result) {
+    try {
+        const ext = await phases.extractGraph(ctx.hippoRoot, dirty.tenantId);
+        // Count the rebuild as soon as it succeeds — it happened regardless of
+        // the drain-mark below.
+        rebuilt.tenants += 1;
+        rebuilt.entities += ext.entities;
+        rebuilt.relations += ext.relations;
+        if (ext.skipped) {
+            result.details = [
+                ...(result.details ?? []),
+                `graph: ${ext.skipped} stale op(s) skipped for a tenant; the next sleep redoes them`,
+            ];
+        }
+        // Watermark drain: only items enqueued before this rebuild started are marked; later arrivals stay pending.
+        // Marked only after the last chunk, so a run stopped between chunks leaves the tenant for the next one.
+        markPendingProcessedUpTo(ctx.hippoRoot, dirty.tenantId, dirty.maxPendingId);
+    }
+    catch (tenantErr) {
+        result.details = [
+            ...(result.details ?? []),
+            `graph: extract failed for a dirty tenant (left pending): ${errorMessage(tenantErr)}`,
         ];
     }
 }
@@ -230,34 +223,29 @@ async function drainGraphQueue(ctx, phases, snapshot, result) {
 // Its own handle; an audit failure is logged and never replaces the original phase error.
 function emitSleepAudit(ctx, opts, dryRun, counts, phaseError) {
     try {
-        const db = openHippoDb(ctx.hippoRoot);
-        try {
-            const sleepAuditMetadata = {
-                consolidationCount: counts.consolidation,
-                dedupCount: counts.dedup,
-                auditDeletedCount: counts.auditDeleted,
-                ambientTotal: counts.ambient,
-                dryRun,
-                noShare: opts.noShare ?? false,
-                partial: phaseError !== null,
-                triggeredByTenant: ctx.tenantId, // preserve for audit forensics
-            };
-            if (phaseError)
-                sleepAuditMetadata.errorMessage = phaseError.message;
-            // A flush stopped between chunks names the unit it would have committed next, so a unit that fails every night can be found.
-            const nextUnitIds = failedUnitOf(phaseError);
-            if (nextUnitIds)
-                sleepAuditMetadata.nextUnitIds = nextUnitIds;
-            appendAuditEvent(db, {
+        // Tagged '__host__' because sleep is host-wide; the actor still names the operator who ran it.
+        const sleepAuditMetadata = {
+            consolidationCount: counts.consolidation,
+            dedupCount: counts.dedup,
+            auditDeletedCount: counts.auditDeleted,
+            ambientTotal: counts.ambient,
+            dryRun,
+            noShare: opts.noShare ?? false,
+            partial: phaseError !== null,
+            triggeredByTenant: ctx.tenantId, // preserve for audit forensics
+        };
+        if (phaseError)
+            sleepAuditMetadata.errorMessage = phaseError.message;
+        // A flush stopped between chunks names the unit it would have committed next, so a unit that fails every night can be found.
+        const nextUnitIds = failedUnitOf(phaseError);
+        if (nextUnitIds)
+            sleepAuditMetadata.nextUnitIds = nextUnitIds;
+        sqliteSyncStore(ctx.hippoRoot).appendAuditEvents([{
                 tenantId: '__host__',
                 actor: ctx.actor.subject,
                 op: 'consolidate',
                 metadata: { ...sleepAuditMetadata },
-            });
-        }
-        finally {
-            closeHippoDb(db);
-        }
+            }]);
     }
     catch (auditErr) {
         // Logged, never thrown: a second failure must not mask the original phaseError.

package/dist/api/sleep.d.ts

@@ -1,4 +1,4 @@
-import type { AmbientState } from '../ambient.js';
+import type { AmbientState } from '../core/ambient.js';
 import type { Context } from './types.js';
 /** Options for `sleep`, one consolidation cycle on a SQLite store that returns counts; unlike `hippo sleep` it skips the auto-learn step. */
 export interface SleepOpts {

package/dist/api/tokens.d.ts

@@ -1,5 +1,5 @@
-import { type TokenSummary, type TokenSurface } from '../token-ledger.js';
-import { type FailureSummary } from '../failure-log.js';
+import type { TokenSummary, TokenSurface } from '../store/token-ledger.js';
+import type { FailureSummary } from '../store/failure-log.js';
 import type { Context } from './types.js';
 /**
  * Record memory text handed to an agent in the token ledger.

package/dist/api/tokens.js

@@ -1,9 +1,9 @@
 // Token-use and failure reports.
-import { openHippoDb, closeHippoDb, rethrowIfSqliteBlocked } from '../db.js';
-import { summarizeTokenUse } from '../token-ledger.js';
-import { storeFor } from '../store-port.js';
-import { summarizeFailures } from '../failure-log.js';
-import { log } from '../log.js';
+import { rethrowIfSqliteBlocked } from '../db/index.js';
+import { storeFor } from '../store/index.js';
+import { failureLogSummary, tokenUseSummary } from '../store/usage-reports.js';
+import { errorMessage, log } from '../util/log.js';
+import { DAY_MS } from '../util/time.js';
 /**
  * Record memory text handed to an agent in the token ledger.
  * Best-effort: never throws, because a ledger failure must not fail the
@@ -22,7 +22,7 @@ export async function recordTokens(ctx, surface, use) {
     }
     catch (err) {
         rethrowIfSqliteBlocked(err);
-        log.warnThenDebug('api-token-ledger', `token ledger write failed; the reply is unaffected: ${err instanceof Error ? err.message : String(err)}`);
+        log.warnThenDebug('api-token-ledger', `token ledger write failed; the reply is unaffected: ${errorMessage(err)}`);
     }
 }
 /**
@@ -31,26 +31,14 @@ export async function recordTokens(ctx, surface, use) {
  * surface, with session counts and mean tokens per session.
  */
 export function tokenSummary(ctx, opts = {}) {
-    const db = openHippoDb(ctx.hippoRoot);
-    try {
-        return summarizeTokenUse(db, ctx.tenantId, reportWindowStart(opts.days));
-    }
-    finally {
-        closeHippoDb(db);
-    }
+    return tokenUseSummary(ctx.hippoRoot, ctx.tenantId, reportWindowStart(opts.days));
 }
 /** Failed tool calls by outcome, and repeats across sessions, over the last `days` days (default 30). */
 export function failureSummary(ctx, opts = {}) {
-    const db = openHippoDb(ctx.hippoRoot);
-    try {
-        return summarizeFailures(db, ctx.tenantId, reportWindowStart(opts.days));
-    }
-    finally {
-        closeHippoDb(db);
-    }
+    return failureLogSummary(ctx.hippoRoot, ctx.tenantId, reportWindowStart(opts.days));
 }
 function reportWindowStart(days) {
     const span = days !== undefined && Number.isFinite(days) && days > 0 ? days : 30;
-    return new Date(Date.now() - span * 86_400_000).toISOString();
+    return new Date(Date.now() - span * DAY_MS).toISOString();
 }
 //# sourceMappingURL=tokens.js.map