hippo-memory 1.69.0 → 1.71.0

package/dist/store/port.js

@@ -0,0 +1,17 @@
+import { StoreNotPortedError } from '../util/sqlite-blocked.js';
+/** Tells a refusal from the row a write answered; no row carries a `refused` key. */
+export function isObjectRefusal(written) {
+    return 'refused' in written;
+}
+export function hasGroup(store, group) {
+    return group === 'base' || store[group] !== undefined;
+}
+/** The group's methods; a store without them throws StoreNotPortedError, which answers 501 as any unported path does. */
+export function requireGroup(store, group) {
+    const groups = store;
+    const methods = groups[group];
+    if (methods === undefined)
+        throw new StoreNotPortedError(store.kind, group);
+    return methods;
+}
+//# sourceMappingURL=port.js.map

package/dist/{predictions/store.d.ts → store/predictions.d.ts}

@@ -1,28 +1,9 @@
-/**
- * Prediction first-class object.
- *
- * Canonical store for ex-ante claims that can be closed against ex-post
- * outcomes. The `predictions` table holds every field (including
- * `claim_text`); a memory row mirrors the claim for recall/inspect surfaces
- * but is NOT the source of truth — ON DELETE SET NULL on memory_id means
- * memory deletion gracefully orphans the prediction without losing data.
- *
- * Tenant scoping: every helper requires tenantId. The schema's BEFORE INSERT
- * + BEFORE UPDATE triggers (`trg_predictions_tenant_match_*`) enforce that
- * `predictions.tenant_id` matches the referenced memory's tenant_id when
- * `memory_id IS NOT NULL`. Cross-tenant references are unrepresentable at
- * the schema level.
- *
- * Dual-write atomicity: `savePrediction` writes the memory + predictions
- * row inside `writeEntry`'s SAVEPOINT 'write_entry' (store/entry-writes.ts). The
- * afterWrite hook (store/entry-writes.ts) runs inside the same SAVEPOINT, so
- * a failure in either step rolls back both. Pattern matches supersede
- * (api.ts:1486) and the Slack/GitHub connectors.
- *
- * The planning-fallacy detector reads `loadPredictionsByClass` and computes
- * per-class base rates from (estimate_value, actual_value) at query time.
- */
-import { type KeysetPosition } from '../keyset.js';
+/** First-class prediction: an ex-ante claim closed against an outcome. The `predictions` table is the source of truth; the memory row only mirrors the claim.
+ * Every helper requires tenantId; `trg_predictions_tenant_match_*` triggers enforce the prediction's tenant matches the referenced memory's.
+ * `savePrediction` writes memory and prediction inside `writeEntry`'s SAVEPOINT (via afterWrite), so a failure in either rolls back both. */
+import { type MemoryEntry } from '../core/memory.js';
+import { type KeysetPosition } from '../util/keyset.js';
+import type { PredictionSave } from './port.js';
 export type ClosureState = 'open' | 'closed' | 'closed-unknown';
 export declare const VALID_CLOSURE_STATES: ReadonlySet<ClosureState>;
 export interface Prediction {
@@ -60,23 +41,16 @@ export interface ListPredictionsOpts {
     /** Resume after this row: the position the previous page ended on. */
     after?: KeysetPosition;
 }
-/**
- * Create a new prediction. Writes a memory mirror + a predictions table
- * row atomically inside `writeEntry`'s SAVEPOINT 'write_entry'. On any
- * failure (audit write, predictions INSERT, trigger ABORT), the SAVEPOINT
- * rolls back — neither the memory row nor the predictions row lands.
- *
- * The memory is tagged `['prediction', classTag]` with `source='prediction'`
- * and `kind='distilled'`. It surfaces in `hippo recall` so the agent can
- * see open predictions naturally; the predictions table is the canonical
- * structured store used by the planning-fallacy detector.
- */
+/** Create a prediction: memory mirror and predictions row land atomically inside `writeEntry`'s SAVEPOINT; any failure rolls back both.
+ * The memory (tags `['prediction', classTag]`, kind 'distilled') surfaces in `hippo recall`; the predictions table feeds the planning-fallacy detector. */
 export declare function savePrediction(hippoRoot: string, tenantId: string, opts: SavePredictionOpts, actor?: string): Prediction;
-/**
- * Close an existing open prediction. Updates the predictions row only;
- * the memory mirror is NOT mutated in v1 (predictions table is canonical).
- * Accuracy is computed from (estimateValue, actualValue) at query time.
- */
+/** The memory row that mirrors a claim into recall, built here alone so every store keeps the same row for it. */
+export declare function predictionMirror(tenantId: string, claim: SavePredictionOpts, baseHalfLifeDays: number): MemoryEntry;
+/** The store port's save on hippo.db: the mirror goes in as the port's writeEntry has it, tenant
+ * check included, and its predictions row shares that write scope, so neither lands alone. */
+export declare function writePrediction(hippoRoot: string, tenantId: string, save: PredictionSave, actor: string): Prediction;
+/** Close an open prediction. Updates the predictions row only; the memory mirror is not mutated (the predictions table is the source of truth).
+ * Accuracy is computed from (estimateValue, actualValue) at query time. */
 export declare function closePrediction(hippoRoot: string, tenantId: string, id: number, opts: ClosePredictionOpts, actor?: string): Prediction;
 export declare function loadPredictionById(hippoRoot: string, tenantId: string, id: number): Prediction | null;
 export declare function loadPredictionsByClass(hippoRoot: string, tenantId: string, classTag: string, opts?: ListPredictionsOpts): Prediction[];
@@ -106,23 +80,22 @@ export interface PredictionBaserate {
      *  Empty when nClosed = 0. */
     summary: string;
 }
-/**
- * Compute base-rate stats for closed predictions in a class for the
- * planning-fallacy detector: Lovallo-Kahneman (2003) inside-vs-outside view.
- *
- * Filter: closure_state='closed' AND estimate_value IS NOT NULL AND
- * actual_value IS NOT NULL. Excludes closed-unknown (no actual to
- * compare against) and open (not yet resolved).
- *
- * Audit-emit is built in here, not at the 3 call sites, so callers cannot drift.
- */
+/** One closed prediction as the baserate reads it: both values set. */
+export interface BaserateRow {
+    estimate_value: number;
+    actual_value: number;
+}
+/** Base-rate stats for closed predictions in a class (Lovallo-Kahneman inside-vs-outside view): closure_state='closed' with estimate and actual non-null;
+ * closed-unknown and open are excluded. Audit-emit is built in here, not at the 3 call sites, so callers cannot drift. */
 export declare function computePredictionBaserate(hippoRoot: string, tenantId: string, classTag: string, actor?: string, 
 /** False skips the predict_baserate audit so that channel only records deliberate
  *  baserate calls, not every recall the planning-fallacy orchestrator inspects. */
 emitAudit?: boolean): PredictionBaserate;
+/** A class's stats over its closed rows, summed in the order given. Every store computes them here, so no two can disagree on the arithmetic. */
+export declare function predictionBaserateOf(classTag: string, rows: readonly BaserateRow[]): PredictionBaserate;
 export declare function loadOpenPredictions(hippoRoot: string, tenantId: string, opts?: {
     classTag?: string;
     limit?: number;
     after?: KeysetPosition;
 }): Prediction[];
-//# sourceMappingURL=store.d.ts.map
+//# sourceMappingURL=predictions.d.ts.map

package/dist/{predictions/store.js → store/predictions.js}

@@ -1,35 +1,19 @@
-/**
- * Prediction first-class object.
- *
- * Canonical store for ex-ante claims that can be closed against ex-post
- * outcomes. The `predictions` table holds every field (including
- * `claim_text`); a memory row mirrors the claim for recall/inspect surfaces
- * but is NOT the source of truth — ON DELETE SET NULL on memory_id means
- * memory deletion gracefully orphans the prediction without losing data.
- *
- * Tenant scoping: every helper requires tenantId. The schema's BEFORE INSERT
- * + BEFORE UPDATE triggers (`trg_predictions_tenant_match_*`) enforce that
- * `predictions.tenant_id` matches the referenced memory's tenant_id when
- * `memory_id IS NOT NULL`. Cross-tenant references are unrepresentable at
- * the schema level.
- *
- * Dual-write atomicity: `savePrediction` writes the memory + predictions
- * row inside `writeEntry`'s SAVEPOINT 'write_entry' (store/entry-writes.ts). The
- * afterWrite hook (store/entry-writes.ts) runs inside the same SAVEPOINT, so
- * a failure in either step rolls back both. Pattern matches supersede
- * (api.ts:1486) and the Slack/GitHub connectors.
- *
- * The planning-fallacy detector reads `loadPredictionsByClass` and computes
- * per-class base rates from (estimate_value, actual_value) at query time.
- */
-import { BadRequestError, NotFoundError } from '../api-errors.js';
-import { openHippoDb, closeHippoDb } from '../db.js';
-import { writeEntry } from '../store/entry-writes.js';
-import { assertTenantId } from '../tenant.js';
-import { createMemory, Layer } from '../memory.js';
-import { appendAuditEvent } from '../audit.js';
-import { loadConfig } from '../config.js';
-import { keysetAfter } from '../keyset.js';
+/** First-class prediction: an ex-ante claim closed against an outcome. The `predictions` table is the source of truth; the memory row only mirrors the claim.
+ * Every helper requires tenantId; `trg_predictions_tenant_match_*` triggers enforce the prediction's tenant matches the referenced memory's.
+ * `savePrediction` writes memory and prediction inside `writeEntry`'s SAVEPOINT (via afterWrite), so a failure in either rolls back both. */
+import { BadRequestError, NotFoundError } from '../core/api-errors.js';
+import { withWriteScope } from '../db/index.js';
+import { onHandle } from './open.js';
+import { writeEntryAt } from './sqlite/entry-writes-group.js';
+import { assertTenantId } from './tenant.js';
+import { createMemory, Layer } from '../core/memory.js';
+import { appendAuditEvent } from './audit.js';
+import { loadConfig } from '../core/config.js';
+import { keysetAfter } from '../util/keyset.js';
+const DEFAULT_PREDICTION_PAGE_SIZE = 100;
+const SELECT_COLUMNS = `id, memory_id, tenant_id, class_tag, claim_text,
+  estimate_value, estimate_unit, target_date,
+  actual_value, closure_state, closed_at, closure_note, created_at`;
 export const VALID_CLOSURE_STATES = new Set([
     'open',
     'closed',
@@ -54,45 +38,40 @@ function rowToPrediction(row) {
         createdAt: row.created_at,
     };
 }
-// ---------------------------------------------------------------------------
-// Public API
-// ---------------------------------------------------------------------------
-/**
- * Create a new prediction. Writes a memory mirror + a predictions table
- * row atomically inside `writeEntry`'s SAVEPOINT 'write_entry'. On any
- * failure (audit write, predictions INSERT, trigger ABORT), the SAVEPOINT
- * rolls back — neither the memory row nor the predictions row lands.
- *
- * The memory is tagged `['prediction', classTag]` with `source='prediction'`
- * and `kind='distilled'`. It surfaces in `hippo recall` so the agent can
- * see open predictions naturally; the predictions table is the canonical
- * structured store used by the planning-fallacy detector.
- */
+/** Create a prediction: memory mirror and predictions row land atomically inside `writeEntry`'s SAVEPOINT; any failure rolls back both.
+ * The memory (tags `['prediction', classTag]`, kind 'distilled') surfaces in `hippo recall`; the predictions table feeds the planning-fallacy detector. */
 export function savePrediction(hippoRoot, tenantId, opts, actor = 'cli') {
     assertTenantId('savePrediction', tenantId);
     if (!opts.classTag)
         throw new BadRequestError('savePrediction: classTag is required');
     if (!opts.claimText)
         throw new BadRequestError('savePrediction: claimText is required');
-    const now = new Date().toISOString();
-    const mem = createMemory(opts.claimText, {
-        tags: ['prediction', opts.classTag],
+    const mirror = predictionMirror(tenantId, opts, loadConfig(hippoRoot).defaultHalfLifeDays);
+    return writePrediction(hippoRoot, tenantId, { ...opts, mirror }, actor);
+}
+/** The memory row that mirrors a claim into recall, built here alone so every store keeps the same row for it. */
+export function predictionMirror(tenantId, claim, baseHalfLifeDays) {
+    return createMemory(claim.claimText, {
+        tags: ['prediction', claim.classTag],
         layer: Layer.Semantic,
         confidence: 'observed',
         source: 'prediction',
         // SAFETY: 'distilled' is a valid MemoryKind literal (see memory.ts).
         kind: 'distilled',
-        baseHalfLifeDays: loadConfig(hippoRoot).defaultHalfLifeDays,
+        baseHalfLifeDays,
         tenantId,
     });
+}
+/** The store port's save on hippo.db: the mirror goes in as the port's writeEntry has it, tenant
+ * check included, and its predictions row shares that write scope, so neither lands alone. */
+export function writePrediction(hippoRoot, tenantId, save, actor) {
+    assertTenantId('savePrediction', tenantId);
+    const now = new Date().toISOString();
     // Captured for the return value; populated inside afterWrite hook so the
     // INSERT and the memory write share a SAVEPOINT.
     let savedRow;
-    writeEntry(hippoRoot, mem, {
-        actor,
-        afterWrite: (db, memoryId) => {
-            savedRow = insertPredictionRow(db, memoryId, tenantId, opts, now, actor);
-        },
+    writeEntryAt(hippoRoot, { entry: save.mirror, actor }, (db, memoryId) => {
+        savedRow = insertPredictionRow(db, memoryId, tenantId, save, { now, actor });
     });
     if (!savedRow) {
         // Cannot reach here without the afterWrite throwing first; defensive.
@@ -100,8 +79,8 @@ export function savePrediction(hippoRoot, tenantId, opts, actor = 'cli') {
     }
     return rowToPrediction(savedRow);
 }
-/** Inserts, reloads and audits the predictions row inside writeEntry's SAVEPOINT. */
-function insertPredictionRow(db, memoryId, tenantId, opts, now, actor) {
+function insertPredictionRow(db, memoryId, tenantId, opts, stamp) {
+    const { now, actor } = stamp;
     const result = db.prepare(`
         INSERT INTO predictions(
           memory_id, tenant_id, class_tag, claim_text,
@@ -113,65 +92,47 @@ function insertPredictionRow(db, memoryId, tenantId, opts, now, actor) {
     const predictionId = Number(result.lastInsertRowid ?? 0);
     // SAFETY: row's shape matches the columns named in the SELECT above.
     const row = db.prepare(`
-        SELECT id, memory_id, tenant_id, class_tag, claim_text,
-               estimate_value, estimate_unit, target_date,
-               actual_value, closure_state, closed_at, closure_note, created_at
+        SELECT ${SELECT_COLUMNS}
         FROM predictions WHERE id = ?
       `).get(predictionId);
     if (!row) {
         throw new Error('Failed to reload saved prediction row');
     }
+    auditPredictionCreate(db, { tenantId, actor, predictionId }, opts);
+    return row;
+}
+function auditPredictionCreate(db, who, opts) {
     // GDPR-light audit metadata: prediction_id + class_tag + flags only.
     // No claim_text in metadata; the predictions table holds it canonically.
     appendAuditEvent(db, {
-        tenantId,
-        actor,
+        tenantId: who.tenantId,
+        actor: who.actor,
         op: 'predict_create',
-        targetId: String(predictionId),
+        targetId: String(who.predictionId),
         metadata: {
-            prediction_id: predictionId,
+            prediction_id: who.predictionId,
             class_tag: opts.classTag,
             has_estimate: opts.estimateValue !== undefined && opts.estimateValue !== null,
             target_date: opts.targetDate ?? null,
         },
     });
-    return row;
 }
-/**
- * Close an existing open prediction. Updates the predictions row only;
- * the memory mirror is NOT mutated in v1 (predictions table is canonical).
- * Accuracy is computed from (estimateValue, actualValue) at query time.
- */
+/** Close an open prediction. Updates the predictions row only; the memory mirror is not mutated (the predictions table is the source of truth).
+ * Accuracy is computed from (estimateValue, actualValue) at query time. */
 export function closePrediction(hippoRoot, tenantId, id, opts, actor = 'cli') {
     assertTenantId('closePrediction', tenantId);
     if (!VALID_CLOSURE_STATES.has(opts.closureState)) {
         throw new BadRequestError(`closePrediction: closureState must be one of ${Array.from(VALID_CLOSURE_STATES).join('|')}; got ${opts.closureState}`);
     }
     const now = new Date().toISOString();
-    const db = openHippoDb(hippoRoot);
-    try {
-        db.exec('BEGIN IMMEDIATE');
-        try {
-            const row = closeOpenPredictionRow(db, tenantId, id, opts, now, actor);
-            db.exec('COMMIT');
-            return rowToPrediction(row);
-        }
-        catch (e) {
-            try {
-                db.exec('ROLLBACK');
-            }
-            catch {
-                // Ignore rollback failures — the throw below is what matters.
-            }
-            throw e;
-        }
-    }
-    finally {
-        closeHippoDb(db);
-    }
+    return onHandle(hippoRoot, (db) => {
+        const row = withWriteScope(db, 'close_prediction', () => closeOpenPredictionRow(db, tenantId, id, opts, { now, actor }));
+        return rowToPrediction(row);
+    });
 }
 /** Closes the row, reloads it and audits the close; the caller owns the transaction. */
-function closeOpenPredictionRow(db, tenantId, id, opts, now, actor) {
+function closeOpenPredictionRow(db, tenantId, id, opts, stamp) {
+    const { now, actor } = stamp;
     // closure_state='open' in the WHERE stops a retried close from overwriting
     // actual_value and auditing twice; zero changed rows means not found or already closed.
     const updateResult = db.prepare(`
@@ -183,9 +144,7 @@ function closeOpenPredictionRow(db, tenantId, id, opts, now, actor) {
         throwCloseMiss(db, tenantId, id);
     // SAFETY: row's shape matches the columns named in the SELECT above.
     const row = db.prepare(`
-        SELECT id, memory_id, tenant_id, class_tag, claim_text,
-               estimate_value, estimate_unit, target_date,
-               actual_value, closure_state, closed_at, closure_note, created_at
+        SELECT ${SELECT_COLUMNS}
         FROM predictions WHERE id = ? AND tenant_id = ?
       `).get(id, tenantId);
     if (!row) {
@@ -205,10 +164,8 @@ function closeOpenPredictionRow(db, tenantId, id, opts, now, actor) {
     return row;
 }
 function throwCloseMiss(db, tenantId, id) {
-    // Distinguish "not found" from "already closed" so callers (CLI, HTTP)
-    // can surface the right error to the user.
-    // SAFETY: row shape matches the single `closure_state` column named
-    // in the SELECT above.
+    // Distinguish 'not found' from 'already closed' so callers (CLI, HTTP) surface the right error.
+    // SAFETY: row shape matches the single `closure_state` column named in the SELECT above.
     const existing = db.prepare(`
           SELECT closure_state FROM predictions WHERE id = ? AND tenant_id = ?
         `).get(id, tenantId);
@@ -220,27 +177,20 @@ function throwCloseMiss(db, tenantId, id) {
 }
 export function loadPredictionById(hippoRoot, tenantId, id) {
     assertTenantId('loadPredictionById', tenantId);
-    const db = openHippoDb(hippoRoot);
-    try {
+    return onHandle(hippoRoot, (db) => {
         // SAFETY: row's shape matches the columns named in the SELECT above.
         const row = db.prepare(`
-      SELECT id, memory_id, tenant_id, class_tag, claim_text,
-             estimate_value, estimate_unit, target_date,
-             actual_value, closure_state, closed_at, closure_note, created_at
+      SELECT ${SELECT_COLUMNS}
       FROM predictions WHERE id = ? AND tenant_id = ?
     `).get(id, tenantId);
         return row ? rowToPrediction(row) : null;
-    }
-    finally {
-        closeHippoDb(db);
-    }
+    });
 }
 export function loadPredictionsByClass(hippoRoot, tenantId, classTag, opts = {}) {
     assertTenantId('loadPredictionsByClass', tenantId);
-    const limit = opts.limit ?? 100;
+    const limit = opts.limit ?? DEFAULT_PREDICTION_PAGE_SIZE;
     const after = keysetAfter('created_at', 'id', opts.after);
-    const db = openHippoDb(hippoRoot);
-    try {
+    return onHandle(hippoRoot, (db) => {
         let rows;
         if (opts.closureState) {
             if (!VALID_CLOSURE_STATES.has(opts.closureState)) {
@@ -248,9 +198,7 @@ export function loadPredictionsByClass(hippoRoot, tenantId, classTag, opts = {})
             }
             // SAFETY: rows' shape matches the columns named in the SELECT above.
             rows = db.prepare(`
-        SELECT id, memory_id, tenant_id, class_tag, claim_text,
-               estimate_value, estimate_unit, target_date,
-               actual_value, closure_state, closed_at, closure_note, created_at
+        SELECT ${SELECT_COLUMNS}
         FROM predictions
         WHERE tenant_id = ? AND class_tag = ? AND closure_state = ?${after.sql}
         ORDER BY created_at DESC, id DESC
@@ -260,9 +208,7 @@ export function loadPredictionsByClass(hippoRoot, tenantId, classTag, opts = {})
         else {
             // SAFETY: rows' shape matches the columns named in the SELECT above.
             rows = db.prepare(`
-        SELECT id, memory_id, tenant_id, class_tag, claim_text,
-               estimate_value, estimate_unit, target_date,
-               actual_value, closure_state, closed_at, closure_note, created_at
+        SELECT ${SELECT_COLUMNS}
         FROM predictions
         WHERE tenant_id = ? AND class_tag = ?${after.sql}
         ORDER BY created_at DESC, id DESC
@@ -270,43 +216,26 @@ export function loadPredictionsByClass(hippoRoot, tenantId, classTag, opts = {})
       `).all(tenantId, classTag, ...after.params, limit);
         }
         return rows.map(rowToPrediction);
-    }
-    finally {
-        closeHippoDb(db);
-    }
+    });
 }
 /** Every prediction in the tenant, open and closed, across all classes: the `status=all` list without a class. */
 export function loadAllPredictions(hippoRoot, tenantId, opts = {}) {
     assertTenantId('loadAllPredictions', tenantId);
     const after = keysetAfter('created_at', 'id', opts.after);
-    const db = openHippoDb(hippoRoot);
-    try {
+    return onHandle(hippoRoot, (db) => {
         // SAFETY: rows' shape matches the columns named in the SELECT.
         const rows = db.prepare(`
-      SELECT id, memory_id, tenant_id, class_tag, claim_text,
-             estimate_value, estimate_unit, target_date,
-             actual_value, closure_state, closed_at, closure_note, created_at
+      SELECT ${SELECT_COLUMNS}
       FROM predictions
       WHERE tenant_id = ?${after.sql}
       ORDER BY created_at DESC, id DESC
       LIMIT ?
-    `).all(tenantId, ...after.params, opts.limit ?? 100);
+    `).all(tenantId, ...after.params, opts.limit ?? DEFAULT_PREDICTION_PAGE_SIZE);
         return rows.map(rowToPrediction);
-    }
-    finally {
-        closeHippoDb(db);
-    }
+    });
 }
-/**
- * Compute base-rate stats for closed predictions in a class for the
- * planning-fallacy detector: Lovallo-Kahneman (2003) inside-vs-outside view.
- *
- * Filter: closure_state='closed' AND estimate_value IS NOT NULL AND
- * actual_value IS NOT NULL. Excludes closed-unknown (no actual to
- * compare against) and open (not yet resolved).
- *
- * Audit-emit is built in here, not at the 3 call sites, so callers cannot drift.
- */
+/** Base-rate stats for closed predictions in a class (Lovallo-Kahneman inside-vs-outside view): closure_state='closed' with estimate and actual non-null;
+ * closed-unknown and open are excluded. Audit-emit is built in here, not at the 3 call sites, so callers cannot drift. */
 export function computePredictionBaserate(hippoRoot, tenantId, classTag, actor = 'cli', 
 /** False skips the predict_baserate audit so that channel only records deliberate
  *  baserate calls, not every recall the planning-fallacy orchestrator inspects. */
@@ -314,8 +243,8 @@ emitAudit = true) {
     assertTenantId('computePredictionBaserate', tenantId);
     if (!classTag)
         throw new BadRequestError('computePredictionBaserate: classTag is required');
-    const db = openHippoDb(hippoRoot);
-    try {
+    return onHandle(hippoRoot, (db) => {
+        // Ordered by id because the float sums differ with row order, and another store must reach the same figures.
         // SAFETY: rows' shape matches the two columns named in the SELECT above.
         const rows = db.prepare(`
       SELECT estimate_value, actual_value
@@ -325,34 +254,14 @@ emitAudit = true) {
         AND closure_state = 'closed'
         AND estimate_value IS NOT NULL
         AND actual_value IS NOT NULL
+      ORDER BY id
     `).all(tenantId, classTag);
-        const nClosed = rows.length;
-        if (nClosed === 0) {
-            // Audit zero-result reads too — agents probing empty classes is
-            // a signal worth recording. Skipped when emitAudit=false: the orchestrator's own
-            // recall_autodebias_hint audit fires only when nClosed > 0, so no signal is lost.
-            if (emitAudit)
-                auditBaserateRead(db, tenantId, actor, classTag, 0);
-            return {
-                classTag,
-                nClosed: 0,
-                nRatioEligible: 0,
-                meanEstimate: null,
-                meanActual: null,
-                meanRatio: null,
-                p50Ratio: null,
-                mae: null,
-                summary: '',
-            };
-        }
-        const baserate = baserateFromRows(classTag, rows);
+        const baserate = predictionBaserateOf(classTag, rows);
+        // An empty class is audited too, since an agent probing one is a signal; the recall path passes false and audits its own hint.
         if (emitAudit)
-            auditBaserateRead(db, tenantId, actor, classTag, nClosed);
+            auditBaserateRead(db, tenantId, actor, classTag, baserate.nClosed);
         return baserate;
-    }
-    finally {
-        closeHippoDb(db);
-    }
+    });
 }
 function auditBaserateRead(db, tenantId, actor, classTag, nClosed) {
     appendAuditEvent(db, {
@@ -363,9 +272,12 @@ function auditBaserateRead(db, tenantId, actor, classTag, nClosed) {
         metadata: { class_tag: classTag, n_closed: nClosed },
     });
 }
-/** Stats over a non-empty set of closed rows. */
-function baserateFromRows(classTag, rows) {
+/** A class's stats over its closed rows, summed in the order given. Every store computes them here, so no two can disagree on the arithmetic. */
+export function predictionBaserateOf(classTag, rows) {
     const nClosed = rows.length;
+    if (nClosed === 0) {
+        return { classTag, nClosed: 0, nRatioEligible: 0, meanEstimate: null, meanActual: null, meanRatio: null, p50Ratio: null, mae: null, summary: '' };
+    }
     const ratioEligible = rows.filter((r) => r.estimate_value > 0);
     const nRatioEligible = ratioEligible.length;
     const meanEstimate = rows.reduce((s, r) => s + r.estimate_value, 0) / nClosed;
@@ -399,17 +311,14 @@ function baserateFromRows(classTag, rows) {
 }
 export function loadOpenPredictions(hippoRoot, tenantId, opts = {}) {
     assertTenantId('loadOpenPredictions', tenantId);
-    const limit = opts.limit ?? 100;
+    const limit = opts.limit ?? DEFAULT_PREDICTION_PAGE_SIZE;
     const after = keysetAfter('created_at', 'id', opts.after);
-    const db = openHippoDb(hippoRoot);
-    try {
+    return onHandle(hippoRoot, (db) => {
         let rows;
         if (opts.classTag) {
             // SAFETY: rows' shape matches the columns named in the SELECT above.
             rows = db.prepare(`
-        SELECT id, memory_id, tenant_id, class_tag, claim_text,
-               estimate_value, estimate_unit, target_date,
-               actual_value, closure_state, closed_at, closure_note, created_at
+        SELECT ${SELECT_COLUMNS}
         FROM predictions
         WHERE tenant_id = ? AND class_tag = ? AND closure_state = 'open'${after.sql}
         ORDER BY created_at DESC, id DESC
@@ -419,9 +328,7 @@ export function loadOpenPredictions(hippoRoot, tenantId, opts = {}) {
         else {
             // SAFETY: rows' shape matches the columns named in the SELECT above.
             rows = db.prepare(`
-        SELECT id, memory_id, tenant_id, class_tag, claim_text,
-               estimate_value, estimate_unit, target_date,
-               actual_value, closure_state, closed_at, closure_note, created_at
+        SELECT ${SELECT_COLUMNS}
         FROM predictions
         WHERE tenant_id = ? AND closure_state = 'open'${after.sql}
         ORDER BY created_at DESC, id DESC
@@ -429,9 +336,6 @@ export function loadOpenPredictions(hippoRoot, tenantId, opts = {}) {
       `).all(tenantId, ...after.params, limit);
         }
         return rows.map(rowToPrediction);
-    }
-    finally {
-        closeHippoDb(db);
-    }
+    });
 }
-//# sourceMappingURL=store.js.map
+//# sourceMappingURL=predictions.js.map