hippo-memory 1.70.0 → 1.71.0

package/dist/store/conflicts.js

@@ -1,30 +1,30 @@
-import { closeHippoDb, openHippoDb, withWriteScope } from '../db/index.js';
+import { DEFAULT_TENANT_ID } from '../util/env.js';
+import { closeHippoDb, withWriteScope } from '../db/index.js';
 import { rejectionDigest, insertRejectedValue, normalizeValueForRejection } from './rejection.js';
 import { archiveRawMemory } from './raw-archive.js';
 import { rowToMemoryConflict } from './rows.js';
 import { audit } from './audit-event.js';
 import { syncChangedMirrors, purgeMirrorBestEffort } from './mirrors.js';
-import { selectEntriesByIds } from './entry-reads.js';
-import { openStore } from './open.js';
+import { chunked, selectEntriesByIds } from './entry-reads.js';
+import { onHandle, openStore } from './open.js';
 import { deleteEntryCore } from './delete-and-batch.js';
 import { BadRequestError } from '../core/api-errors.js';
 import { canTouchScope, isPersonalScope } from './recall-scope.js';
 import { selectMemoryReach } from './tenant-lookup.js';
+// The one place MemoryConflictRow's columns are listed; CONFLICT_COLS_MC is the same list under the `mc` alias.
+const CONFLICT_COLS = 'id, memory_a_id, memory_b_id, reason, score, status, detected_at, updated_at';
+const CONFLICT_COLS_MC = CONFLICT_COLS.split(', ').map((c) => `mc.${c}`).join(', ');
 function canonicalConflictPair(aId, bId) {
     return aId < bId
         ? { memory_a_id: aId, memory_b_id: bId }
         : { memory_a_id: bId, memory_b_id: aId };
 }
 function selectConflictRowsInTenant(db, status, allStatuses, tenantId) {
-    // Tenanted query — JOIN to memories on both conflict members and require
-    // each in-tenant, so neither a normal cross-tenant pair nor a stale
-    // pre-fix row surfaces (consistent with resolveConflict).
-    // SAFETY: both branches select the same eight mc.* columns (aliased
-    // to MemoryConflictRow's field names) from memory_conflicts.
+    // Tenanted query: JOIN memories on both members and require each in-tenant, so no cross-tenant or stale pre-fix pair surfaces.
+    // SAFETY: both branches select CONFLICT_COLS_MC, MemoryConflictRow's columns.
     return allStatuses
         ? db.prepare(`
-        SELECT mc.id, mc.memory_a_id, mc.memory_b_id, mc.reason, mc.score,
-               mc.status, mc.detected_at, mc.updated_at
+        SELECT ${CONFLICT_COLS_MC}
         FROM memory_conflicts mc
         JOIN memories ma ON ma.id = mc.memory_a_id
         JOIN memories mb ON mb.id = mc.memory_b_id
@@ -32,8 +32,7 @@ function selectConflictRowsInTenant(db, status, allStatuses, tenantId) {
         ORDER BY mc.updated_at DESC, mc.id DESC
       `).all(tenantId, tenantId)
         : db.prepare(`
-        SELECT mc.id, mc.memory_a_id, mc.memory_b_id, mc.reason, mc.score,
-               mc.status, mc.detected_at, mc.updated_at
+        SELECT ${CONFLICT_COLS_MC}
         FROM memory_conflicts mc
         JOIN memories ma ON ma.id = mc.memory_a_id
         JOIN memories mb ON mb.id = mc.memory_b_id
@@ -43,37 +42,29 @@ function selectConflictRowsInTenant(db, status, allStatuses, tenantId) {
 }
 function selectConflictRowsUnscoped(db, status, allStatuses) {
     // Unscoped query — legacy direct-mode (CLI, tests, consolidate).
-    // SAFETY: both branches select the same eight columns matching
-    // MemoryConflictRow's field set.
+    // SAFETY: both branches select CONFLICT_COLS, MemoryConflictRow's columns.
     return allStatuses
         ? db.prepare(`
-        SELECT id, memory_a_id, memory_b_id, reason, score, status, detected_at, updated_at
+        SELECT ${CONFLICT_COLS}
         FROM memory_conflicts
         ORDER BY updated_at DESC, id DESC
       `).all()
         : db.prepare(`
-        SELECT id, memory_a_id, memory_b_id, reason, score, status, detected_at, updated_at
+        SELECT ${CONFLICT_COLS}
         FROM memory_conflicts
         WHERE status = ?
         ORDER BY updated_at DESC, id DESC
       `).all(status);
 }
 export function listMemoryConflicts(hippoRoot, status = 'open', tenantId) {
-    const db = openStore(hippoRoot);
-    try {
-        // v0.28 — '*' is a sentinel meaning "no status filter, return all rows".
-        // Pre-v0.28 callers (cli/mcp/dashboard) always passed 'open' or default,
-        // so this sentinel is purely additive. The 4 SQL branches below cover
-        // {tenanted | unscoped} × {all-statuses | specific-status}.
+    return onHandle(hippoRoot, (db) => {
+        // '*' is a sentinel for no status filter; the 4 SQL branches below cover {tenanted | unscoped} x {all-statuses | specific-status}.
         const allStatuses = status === '*';
         const rows = tenantId !== undefined
             ? selectConflictRowsInTenant(db, status, allStatuses, tenantId)
             : selectConflictRowsUnscoped(db, status, allStatuses);
         return rows.map(rowToMemoryConflict);
-    }
-    finally {
-        closeHippoDb(db);
-    }
+    }, openStore);
 }
 // listMemoryConflicts' tenanted open set: both members in the tenant.
 const OPEN_IN_TENANT = `FROM memory_conflicts mc
@@ -82,22 +73,17 @@ const OPEN_IN_TENANT = `FROM memory_conflicts mc
   WHERE mc.status = 'open' AND ma.tenant_id = ? AND mb.tenant_id = ?`;
 /** How many open conflicts listMemoryConflicts returns for a tenant, without loading one. */
 export function countOpenConflicts(hippoRoot, tenantId) {
-    const db = openStore(hippoRoot);
-    try {
+    return onHandle(hippoRoot, (db) => {
         // SAFETY: one row with the single aliased count column.
         const row = db.prepare(`SELECT COUNT(*) AS n ${OPEN_IN_TENANT}`).get(tenantId, tenantId);
         return Number(row.n);
-    }
-    finally {
-        closeHippoDb(db);
-    }
+    }, openStore);
 }
 /** A tenant's open conflicts naming `memoryId`, in listMemoryConflicts' order, each with its other member read in one batch. */
 export function loadOpenConflictsOf(hippoRoot, tenantId, memoryId) {
-    const db = openStore(hippoRoot);
-    try {
-        // SAFETY: selects the eight mc.* columns of MemoryConflictRow.
-        const rows = db.prepare(`SELECT mc.id, mc.memory_a_id, mc.memory_b_id, mc.reason, mc.score, mc.status, mc.detected_at, mc.updated_at
+    return onHandle(hippoRoot, (db) => {
+        // SAFETY: selects CONFLICT_COLS_MC, MemoryConflictRow's columns.
+        const rows = db.prepare(`SELECT ${CONFLICT_COLS_MC}
        ${OPEN_IN_TENANT} AND (mc.memory_a_id = ? OR mc.memory_b_id = ?)
        ORDER BY mc.updated_at DESC, mc.id DESC`).all(tenantId, tenantId, memoryId, memoryId);
         const conflicts = rows.map(rowToMemoryConflict);
@@ -110,44 +96,47 @@ export function loadOpenConflictsOf(hippoRoot, tenantId, memoryId) {
                 out.push({ conflict, other });
         }
         return out;
-    }
-    finally {
-        closeHippoDb(db);
-    }
+    }, openStore);
 }
 /** Conflicts whose two rows `actor` may both touch; someone else's personal row hides its whole pair. */
 export function listTouchableConflicts(hippoRoot, status, tenantId, actor) {
     const conflicts = listMemoryConflicts(hippoRoot, status, tenantId);
-    const db = openHippoDb(hippoRoot);
-    try {
+    return onHandle(hippoRoot, (db) => {
         return conflicts.filter((c) => [c.memory_a_id, c.memory_b_id].every((id) => canTouchScope(actor, selectMemoryReach(db, id)?.scope ?? null)));
-    }
-    finally {
-        closeHippoDb(db);
-    }
+    });
 }
 export function replaceDetectedConflicts(hippoRoot, detected, detectedAt = new Date().toISOString()) {
-    const db = openStore(hippoRoot);
-    try {
-        const changedIds = writeConflictRefresh(db, readConflictRefresh(db), detected, detectedAt);
+    onHandle(hippoRoot, (db) => {
+        const changedIds = writeConflictRefresh(db, readConflictRefresh(db, detected), detected, detectedAt);
         syncChangedMirrors(hippoRoot, db, [...selectEntriesByIds(db, changedIds).values()]);
-    }
-    finally {
-        closeHippoDb(db);
-    }
+    }, openStore);
 }
-/** The refresh's read of the whole memories table, kept out of the write lock because it grows with the store. */
-function readConflictRefresh(db) {
+/** The refresh's reads, kept out of the write lock; only rows holding refs, in an open conflict or in `detected` are loaded, not the whole table. */
+function readConflictRefresh(db, detected) {
     // Tenant guard (E2): a conflict is meaningful only within one tenant, so cross-tenant pairs are
     // skipped on insert and on rebuild, and a stale cross-tenant row can neither persist nor leak a foreign id.
     const tenantById = new Map();
     const storedRefs = new Map();
     // SAFETY: rows' shape matches the three columns named in the SELECT.
-    for (const r of db.prepare(`SELECT id, tenant_id, conflicts_with_json FROM memories`).all()) {
+    const rows = db.prepare(`
+    SELECT id, tenant_id, conflicts_with_json FROM memories
+    WHERE conflicts_with_json != '[]'
+      OR id IN (SELECT memory_a_id FROM memory_conflicts WHERE status = 'open')
+      OR id IN (SELECT memory_b_id FROM memory_conflicts WHERE status = 'open')
+  `).all();
+    for (const r of rows) {
         tenantById.set(r.id, r.tenant_id);
         if (r.conflicts_with_json !== '[]')
             storedRefs.set(r.id, r.conflicts_with_json);
     }
+    const given = [...new Set(detected.flatMap((c) => [c.memory_a_id, c.memory_b_id]))].filter((id) => !tenantById.has(id));
+    for (const ids of chunked(given)) {
+        const marks = ids.map(() => '?').join(',');
+        // SAFETY: rows' shape matches the two columns named in the SELECT.
+        const found = db.prepare(`SELECT id, tenant_id FROM memories WHERE id IN (${marks})`).all(...ids);
+        for (const r of found)
+            tenantById.set(r.id, r.tenant_id);
+    }
     const sameTenant = (a, b) => {
         const ta = tenantById.get(a);
         const tb = tenantById.get(b);
@@ -170,10 +159,9 @@ function writeConflictRefresh(db, reads, detected, detectedAt) {
 }
 function resolveStaleOpenConflicts(db, canonicalDetected, sameTenant, detectedAt) {
     const detectedKeys = new Set(canonicalDetected.map((conflict) => `${conflict.memory_a_id}::${conflict.memory_b_id}`));
-    // SAFETY: openRows' shape matches the eight columns named in the SELECT
-    // above.
+    // SAFETY: openRows' shape matches the columns named in CONFLICT_COLS.
     const openRows = db.prepare(`
-    SELECT id, memory_a_id, memory_b_id, reason, score, status, detected_at, updated_at
+    SELECT ${CONFLICT_COLS}
     FROM memory_conflicts
     WHERE status = 'open'
   `).all();
@@ -181,11 +169,7 @@ function resolveStaleOpenConflicts(db, canonicalDetected, sameTenant, detectedAt
     for (const row of openRows) {
         const key = `${row.memory_a_id}::${row.memory_b_id}`;
         const stale = !detectedKeys.has(key);
-        // v1.11.0 residue: auto-resolve any open cross-tenant row. The insert
-        // loop in upsertDetectedConflicts and the refMap rebuild skip
-        // cross-tenant pairs, but the resolve-stale loop previously left
-        // re-detected cross-tenant rows lingering status='open'. The
-        // sameTenant() helper is already built one block up; no extra query.
+        // Auto-resolve any open cross-tenant row: the insert loop and refMap rebuild skip those pairs, so re-detected ones would linger as 'open'.
         const crossTenant = !sameTenant(row.memory_a_id, row.memory_b_id);
         if (stale || crossTenant)
             resolve.run(detectedAt, row.id);
@@ -242,10 +226,8 @@ function rebuildConflictsWithJson(db, { sameTenant, storedRefs }) {
     }
     return changedIds;
 }
-// When tenantId is set, the conflict lookup requires BOTH members in-tenant
-// and every memories mutation carries AND tenant_id = ?. A cross-tenant probe
-// then returns null, indistinguishable from a bad id. Omitted tenantId =
-// legacy unscoped behaviour (CLI direct mode, tests, consolidate.ts).
+// With tenantId, both members must be in-tenant and every memories mutation carries AND tenant_id = ?; a cross-tenant probe returns null like a bad id.
+// Omitted tenantId = unscoped (CLI direct mode, tests).
 function conflictMemScope(tenantId) {
     return {
         memScope: tenantId !== undefined ? ' AND tenant_id = ?' : '',
@@ -268,21 +250,8 @@ function findResolvableConflict(db, conflictId, keepId, tenantId) {
         return null;
     return { conflict, loserId };
 }
-/**
- * Resolve a conflict by keeping one memory and weakening the other.
- * Sets conflict status to 'resolved' and halves the loser's half-life.
- * If --forget is used, the loser is removed entirely (kind-aware: raw rows
- * are archived via archiveRawMemory, others deleted via deleteEntryCore —
- * AT1 fix for the pre-existing crash where a raw loser aborted the whole
- * resolve transaction against the append-only trigger). `opts.rejectLoserValue`
- * additionally tombstones the loser's normalized digest so it cannot be
- * re-asserted later.
- *
- * Every resolution path (weaken / forget / reject) emits a `conflict_resolve`
- * audit row (AT1 — previously resolveConflict wrote zero audit rows on any path).
- *
- * Returns the resolved conflict, or null if not found.
- */
+/** Resolve a conflict by keeping one memory and halving the loser's half-life; `--forget` removes the loser, `opts.rejectLoserValue` also tombstones its
+ * digest. Every path emits a `conflict_resolve` audit row. Returns the resolved conflict, or null if not found. */
 export function resolveConflict(hippoRoot, conflictId, keepId, forgetLoser = false, tenantId, opts) {
     const db = openStore(hippoRoot);
     const scope = conflictMemScope(tenantId);
@@ -312,19 +281,17 @@ export function resolveConflict(hippoRoot, conflictId, keepId, forgetLoser = fal
     }
 }
 function selectConflictRow(db, conflictId, tenantId) {
-    // SAFETY: both branches select the same eight columns (aliased in the
-    // tenanted branch) matching MemoryConflictRow's field set.
+    // SAFETY: the branches select CONFLICT_COLS_MC and CONFLICT_COLS, MemoryConflictRow's columns.
     return (tenantId !== undefined
         ? db.prepare(`
-        SELECT mc.id, mc.memory_a_id, mc.memory_b_id, mc.reason, mc.score,
-               mc.status, mc.detected_at, mc.updated_at
+        SELECT ${CONFLICT_COLS_MC}
         FROM memory_conflicts mc
         JOIN memories ma ON ma.id = mc.memory_a_id
         JOIN memories mb ON mb.id = mc.memory_b_id
         WHERE mc.id = ? AND ma.tenant_id = ? AND mb.tenant_id = ?
       `).get(conflictId, tenantId, tenantId)
         : db.prepare(`
-        SELECT id, memory_a_id, memory_b_id, reason, score, status, detected_at, updated_at
+        SELECT ${CONFLICT_COLS}
         FROM memory_conflicts WHERE id = ?
       `).get(conflictId));
 }
@@ -335,21 +302,13 @@ function weakenConflictLoser(db, t) {
     return { loserRemoved: false, loserWasRaw: false, rejectedDigest: undefined, extraRemovedIds: [], extraRemovedRawIds: [] };
 }
 function removeConflictLoser(db, t) {
-    // AT1 (plan §5): removal (forgetLoser OR rejectLoserValue — a tombstoned
-    // value cannot be left live) is now kind-aware. The old bare
-    // `DELETE FROM memories WHERE id = ?` aborted the whole transaction when
-    // the loser was kind='raw' (append-only trigger fires); route through
-    // the same helpers the reject verb uses (both db-scoped, both compose
-    // inside this BEGIN/COMMIT). loserRemoved / loserWasRaw drive both the
-    // conflicts_with_json skip below and the post-commit mirror purge.
+    // Removal is kind-aware: a bare DELETE on a raw loser fires the append-only trigger, so use the same helpers as the reject verb.
+    // loserRemoved / loserWasRaw drive the conflicts_with_json skip below and the post-commit mirror purge.
     const removal = {
         loserRemoved: false,
         loserWasRaw: false,
         rejectedDigest: undefined,
-        // AT1 P1 fix (codex): same-tenant duplicates of the loser's content that
-        // rejectLoserValue also removes (see below) — separate from loserId so
-        // the audit + post-commit mirror purge can cover ALL of them, not just
-        // loserId.
+        // Same-tenant duplicates of the loser's content that rejectLoserValue also removes; kept apart from loserId so audit and mirror purge cover all of them.
         extraRemovedIds: [],
         extraRemovedRawIds: [],
     };
@@ -380,7 +339,7 @@ function removeConflictLoser(db, t) {
 }
 function recordRejectedLoserValue(db, t, loserRow, digest, who) {
     insertRejectedValue(db, {
-        tenantId: loserRow.tenant_id ?? 'default',
+        tenantId: loserRow.tenant_id ?? DEFAULT_TENANT_ID,
         digest,
         reason: who.reason,
         rejectedBy: who.actor,
@@ -397,19 +356,9 @@ function tombstoneLoserValue(db, t, loserRow, who, removal) {
     const { actor, reason } = who;
     const rejectedDigest = rejectionDigest(loserRow.content);
     recordRejectedLoserValue(db, t, loserRow, rejectedDigest, who);
-    // AT1 P1 fix (codex): reject-flow.ts's `rejectValue` removes ALL
-    // live same-tenant rows whose normalized digest matches, not just
-    // the one id passed — but this branch only ever removed loserId,
-    // leaving same-TENANT duplicates live while their shared content
-    // was tombstoned. Same O(N) scan pattern as reject-flow.ts (human-
-    // triggered command, tenant's row count is human-scale). CRITICAL
-    // BOUNDARY: tenant-scoped ONLY — tombstones are tenant-scoped by
-    // design, so a same-content row in ANOTHER tenant is legitimately
-    // live and must NOT be touched here. `keepId` is excluded even if
-    // its content coincidentally matches: the human explicitly chose
-    // to keep it in this same resolution, and this branch must not
-    // undo that choice in the same transaction.
-    const loserTenantId = loserRow.tenant_id ?? 'default';
+    // Remove ALL live same-tenant rows whose digest matches (as reject-flow.ts rejectValue does), not just loserId; the O(N) scan is human-scale.
+    // Tenant-scoped ONLY, since tombstones are; `keepId` is excluded even if its content matches, because the human chose to keep it.
+    const loserTenantId = loserRow.tenant_id ?? DEFAULT_TENANT_ID;
     // SAFETY: dupRows' shape matches the four columns named in the SELECT above.
     const dupRows = db
         .prepare(`SELECT id, kind, content, scope FROM memories WHERE tenant_id = ? AND id != ? AND id != ?`)
@@ -434,9 +383,8 @@ function tombstoneLoserValue(db, t, loserRow, who, removal) {
 function stripConflictRefs(db, t, loserRemoved) {
     const { memScope, memArgs } = t.scope;
     const { keepId, loserId } = t;
-    // Clean up conflicts_with references
-    // SAFETY: keepRow's shape matches the single `conflicts_with_json`
-    // column selected above.
+    // Clean up conflicts_with references.
+    // SAFETY: keepRow's shape matches the single `conflicts_with_json` column selected above.
     const keepRow = db.prepare(`SELECT conflicts_with_json FROM memories WHERE id = ?${memScope}`).get(keepId, ...memArgs);
     if (keepRow) {
         const refs = JSON.parse(keepRow.conflicts_with_json || '[]');
@@ -458,56 +406,29 @@ function stripConflictRefs(db, t, loserRemoved) {
 }
 function auditConflictResolve(db, t, removal, tenantId) {
     const { loserRemoved, loserWasRaw, rejectedDigest, extraRemovedIds } = removal;
-    // AT1: the missing audit (plan §5 — resolveConflict wrote ZERO audit_log
-    // rows on any path before this). Every path — weaken, forget, reject —
-    // lands exactly one conflict_resolve row.
+    // Every path (weaken, forget, reject) lands exactly one conflict_resolve audit row.
     const conflictResolveMeta = {
         conflictId: t.conflictId,
         keepId: t.keepId,
         loserId: t.loserId,
         disposition: loserRemoved ? (loserWasRaw ? 'archived_raw' : 'deleted') : 'weakened',
         rejected: Boolean(t.opts?.rejectLoserValue),
-        // AT1 P1 fix: every row this call removed, not just loserId — the
-        // same-tenant duplicate sweep above (extraRemovedIds) needs an
-        // audit trail too.
+        // Every row this call removed, not just loserId, so the duplicate sweep (extraRemovedIds) is audited too.
         removedIds: loserRemoved ? [t.loserId, ...extraRemovedIds] : [],
     };
     // Assigned only when present so the serialized audit payload keeps
     // omitting the key, exactly as the pre-migration object literal did.
     if (rejectedDigest !== undefined)
         conflictResolveMeta.rejectedDigest = rejectedDigest;
-    // Fresh spread literal: ConflictResolveMeta is a closed interface (no
-    // index signature) and isn't directly assignable to audit()'s
-    // Record<string, JsonValue> metadata param; a spread into a fresh
-    // object literal satisfies it without widening the declared type above.
+    // Fresh spread literal: ConflictResolveMeta is a closed interface, not assignable to audit()'s Record<string, JsonValue> metadata otherwise.
     audit(db, 'conflict_resolve', { targetId: t.keepId, metadata: { ...conflictResolveMeta }, actor: t.opts?.rejectedBy ?? 'cli', tenantId });
 }
 function purgeRemovedLoserMirrors(hippoRoot, db, loserId, removal) {
-    // AT1 P1b fix: mirror purge + reaper stamp for EVERY removed loser, not
-    // just the rejectLoserValue path. Pre-AT1, the plain forgetLoser path on
-    // a raw loser crashed outright (bare DELETE FROM memories hit the
-    // append-only trigger) — there is no legacy "successful forget, no
-    // purge" behavior to preserve for that case. Post-AT1's kind-aware
-    // removal (archiveRawMemory / deleteEntryCore above) makes plain
-    // --forget succeed on every kind, but until this fix the mirror was
-    // only purged when rejectLoserValue was ALSO set: a plain raw --forget
-    // left its markdown mirror orphaned (the reaper still catches it
-    // eventually, since archiveRawMemory's own raw_archive insert leaves
-    // mirror_cleaned_at NULL) and a plain non-raw --forget left its mirror
-    // orphaned FOREVER (no reaper exists for non-raw rows). Same post-commit
-    // purge+reaper pattern as the reject verb (src/trust/reject-flow.ts) and
-    // api.archiveRaw — reusing removeEntryMirrors + raw_archive bookkeeping.
-    // AT1 P1 fix: loop over loserId AND every same-tenant duplicate the
-    // rejectLoserValue sweep above removed (extraRemovedIds) — previously
-    // only loserId's mirror was purged, leaving duplicate mirrors orphaned
-    // despite their rows being gone.
+    // Mirror purge and reaper stamp for EVERY removed loser (loserId and each extraRemovedIds duplicate), post-commit like the reject verb.
+    // A non-raw mirror has no reaper, so skipping the purge would orphan it forever.
     for (const removedId of [loserId, ...removal.extraRemovedIds]) {
         const isRaw = removedId === loserId ? removal.loserWasRaw : removal.extraRemovedRawIds.includes(removedId);
-        // AT1 fix: purgeMirrorBestEffort retries once, then — for non-raw ids,
-        // which cleanupArchivedMirrors' reaper never scans — reports the
-        // EXPLICIT leftover path(s) instead of the false "will retry via
-        // reaper" claim. See its own doc comment (store.ts, near
-        // removeEntryMirrors) for the full rationale.
+        // purgeMirrorBestEffort retries once, then reports the explicit leftover paths for non-raw ids, which the cleanupArchivedMirrors reaper never scans.
         const mirrorOk = purgeMirrorBestEffort(hippoRoot, removedId, isRaw, 'resolveConflict');
         if (mirrorOk && isRaw) {
             db.prepare(`UPDATE raw_archive SET mirror_cleaned_at = ? WHERE memory_id = ?`).run(new Date().toISOString(), removedId);
@@ -516,7 +437,7 @@ function purgeRemovedLoserMirrors(hippoRoot, db, loserId, removal) {
 }
 /** The conflict and loser ids every conflict_resolve audit row names. */
 export function conflictResolveAuditsAt(db) {
-    // SAFETY: SELECT of two fields every conflict_resolve audit row carries (ConflictResolveMeta in store.ts).
+    // SAFETY: SELECT of two fields every conflict_resolve audit row carries (ConflictResolveMeta above).
     return db.prepare(`SELECT json_extract(metadata_json, '$.conflictId') AS conflictId, json_extract(metadata_json, '$.loserId') AS loserId FROM audit_log WHERE op = 'conflict_resolve'`).all();
 }
 /** Every resolved conflict with both sides. */

package/dist/store/connectors/github.d.ts

@@ -1,6 +1,6 @@
 import { type DatabaseSyncLike } from '../../db/index.js';
 /** One github_event_log row to write; `memoryId` is null for an event that produced no memory. */
-export interface GithubEventLogEntry {
+export interface GitHubEventLogEntry {
     idempotencyKey: string;
     deliveryId: string;
     eventName: string;
@@ -9,12 +9,12 @@ export interface GithubEventLogEntry {
 export declare function eventSeenAt(db: DatabaseSyncLike, idempotencyKey: string): boolean;
 export declare function eventMemoryAt(db: DatabaseSyncLike, idempotencyKey: string): string | null;
 /** False when the key was already logged, so a caller inside a write scope can roll its own row back. */
-export declare function logEventAt(db: DatabaseSyncLike, entry: GithubEventLogEntry): boolean;
+export declare function logEventAt(db: DatabaseSyncLike, entry: GitHubEventLogEntry): boolean;
 /** The memory an already-seen key points at, or null when the key is new. */
 export declare function seenEvent(hippoRoot: string, idempotencyKey: string): {
     memoryId: string | null;
 } | null;
-export declare function logEvent(hippoRoot: string, entry: GithubEventLogEntry): void;
+export declare function logEvent(hippoRoot: string, entry: GitHubEventLogEntry): void;
 export interface ArtifactDeletion {
     tenantId: string;
     artifactRef: string;
@@ -46,7 +46,7 @@ export interface DlqItem {
     bucket: DlqBucket | string;
 }
 /** One github_dlq row to write, already redacted by the caller; the four GitHub-only columns are stored NULL when left out. */
-export interface GithubDlqWrite {
+export interface GitHubDlqInsert {
     tenantId: string;
     rawPayload: string;
     error: string;
@@ -57,12 +57,12 @@ export interface GithubDlqWrite {
     repoFullName?: string | null;
     bucket: DlqBucket;
 }
-export declare function insertDlq(hippoRoot: string, row: GithubDlqWrite): number;
-export declare function listDlqRows(hippoRoot: string, tenantId: string, limit: number): DlqItem[];
-export declare function dlqEntry(hippoRoot: string, id: number): DlqItem | null;
-export declare function bumpDlqRetry(hippoRoot: string, id: number): void;
+export declare function insertGitHubDlq(hippoRoot: string, row: GitHubDlqInsert): number;
+export declare function listGitHubDlq(hippoRoot: string, tenantId: string, limit: number): DlqItem[];
+export declare function githubDlqEntry(hippoRoot: string, id: number): DlqItem | null;
+export declare function bumpGitHubDlqRetryCount(hippoRoot: string, id: number): void;
 /** What the routing tables say about one webhook; `tenant` is the installation match, or the repo match when no installation was sent. */
-export interface GithubRouting {
+export interface GitHubRouting {
     installations: number;
     repositories: number;
     tenant: string | null;
@@ -70,7 +70,7 @@ export interface GithubRouting {
 export declare function githubRouting(hippoRoot: string, args: {
     installationId?: string | null;
     repoFullName?: string | null;
-}): GithubRouting;
+}): GitHubRouting;
 export type HwmColumn = 'issues_hwm' | 'issue_comments_hwm' | 'pr_review_comments_hwm';
 export interface StoredCursors {
     issues: string | null;

package/dist/store/connectors/github.js

@@ -47,7 +47,7 @@ export function archiveDeletedArtifact(hippoRoot, del) {
         return { duplicate: false, archived: memoryIds.length };
     });
 }
-function insertDlqAt(db, row) {
+function insertGitHubDlqAt(db, row) {
     const result = db
         .prepare(`INSERT INTO github_dlq
         (tenant_id, raw_payload, error, event_name, delivery_id, signature,
@@ -56,8 +56,8 @@ function insertDlqAt(db, row) {
         .run(row.tenantId, row.rawPayload, row.error, row.eventName ?? null, row.deliveryId ?? null, row.signature, row.installationId ?? null, row.repoFullName ?? null, new Date().toISOString(), row.bucket);
     return Number(result.lastInsertRowid);
 }
-export function insertDlq(hippoRoot, row) {
-    return onHandle(hippoRoot, (db) => insertDlqAt(db, row));
+export function insertGitHubDlq(hippoRoot, row) {
+    return onHandle(hippoRoot, (db) => insertGitHubDlqAt(db, row));
 }
 const SELECT_COLUMNS = `id, tenant_id, raw_payload, error, event_name, delivery_id,
             signature, installation_id, repo_full_name, retry_count,
@@ -79,7 +79,7 @@ function rowToItem(r) {
         bucket: r.bucket == null ? 'parse_error' : String(r.bucket),
     };
 }
-function listDlqAt(db, tenantId, limit) {
+function listGitHubDlqAt(db, tenantId, limit) {
     // SAFETY: SELECT_COLUMNS projects exactly DlqRawRow's fields.
     const rows = db
         .prepare(`SELECT ${SELECT_COLUMNS}
@@ -90,10 +90,10 @@ function listDlqAt(db, tenantId, limit) {
         .all(tenantId, limit);
     return rows.map(rowToItem);
 }
-export function listDlqRows(hippoRoot, tenantId, limit) {
-    return onHandle(hippoRoot, (db) => listDlqAt(db, tenantId, limit));
+export function listGitHubDlq(hippoRoot, tenantId, limit) {
+    return onHandle(hippoRoot, (db) => listGitHubDlqAt(db, tenantId, limit));
 }
-function dlqEntryAt(db, id) {
+function githubDlqEntryAt(db, id) {
     // SAFETY: SELECT_COLUMNS projects exactly DlqRawRow's fields.
     const row = db
         .prepare(`SELECT ${SELECT_COLUMNS}
@@ -104,10 +104,10 @@ function dlqEntryAt(db, id) {
         return null;
     return rowToItem(row);
 }
-export function dlqEntry(hippoRoot, id) {
-    return onHandle(hippoRoot, (db) => dlqEntryAt(db, id));
+export function githubDlqEntry(hippoRoot, id) {
+    return onHandle(hippoRoot, (db) => githubDlqEntryAt(db, id));
 }
-export function bumpDlqRetry(hippoRoot, id) {
+export function bumpGitHubDlqRetryCount(hippoRoot, id) {
     onHandle(hippoRoot, (db) => {
         db.prepare(`UPDATE github_dlq
           SET retry_count = retry_count + 1,

package/dist/store/dashboard-reads.js

@@ -5,7 +5,7 @@ import { withReadSnapshot } from '../db/busy.js';
 import { pragmaDataVersion } from '../db/meta.js';
 import { tableExists } from '../db/tables.js';
 import { storedVectorIds } from '../db/vector-store.js';
-import { openStore } from './open.js';
+import { onHandle, openStore } from './open.js';
 import { QUARANTINE_SCOPE_PREFIX } from './quarantine.js';
 import { parseJsonArray } from './rows.js';
 const LIVE_COLUMNS = 'id, created, last_retrieved, retrieval_count, half_life_days, layer, tags_json, emotional_valence, outcome_positive, outcome_negative, pinned, confidence, content, superseded_by, kind, scope, origin_project';
@@ -24,7 +24,7 @@ function toDashboardRow(row) {
         retrieval_count: Number(row.retrieval_count ?? 0),
         half_life_days: Number(row.half_life_days ?? 7),
         layer: row.layer,
-        tags: parseJsonArray(row.tags_json),
+        tags: parseJsonArray(row.tags_json, { table: 'memories', id: row.id, column: 'tags_json' }),
         emotional_valence: row.emotional_valence ?? 'neutral',
         outcome_positive: Number(row.outcome_positive ?? 0),
         outcome_negative: Number(row.outcome_negative ?? 0),
@@ -39,8 +39,7 @@ function toDashboardRow(row) {
 }
 /** One tenant's live rows and the counts of the rest, read in one transaction so the two agree. */
 export function loadDashboardRows(hippoRoot, tenantId) {
-    const db = openStore(hippoRoot);
-    try {
+    return onHandle(hippoRoot, (db) => {
         return withReadSnapshot(db, () => {
             // SAFETY: the SELECT names exactly LiveRow's columns.
             const live = db.prepare(`SELECT ${LIVE_COLUMNS} FROM memories WHERE tenant_id = ? AND ${LIVE} ORDER BY created ASC, id ASC`).all(tenantId);
@@ -56,10 +55,7 @@ export function loadDashboardRows(hippoRoot, tenantId) {
                     excluded[why] = Number(n);
             return { live: live.map(toDashboardRow), excluded };
         });
-    }
-    finally {
-        closeHippoDb(db);
-    }
+    }, openStore);
 }
 /** The dashboard's one read-only connection, kept across refreshes for the commit signal; it opens on the first read that finds a database. */
 export class DashboardConnection {

package/dist/store/delete-and-batch.d.ts

@@ -8,16 +8,8 @@ export declare const MEMORY_BACKED_TABLES: readonly ["predictions", "decisions",
 export declare function memoriesBackingObjects(hippoRoot: string): Set<string>;
 /** memoriesBackingObjects on the caller's handle. */
 export declare function memoriesBackingObjectsOn(db: DatabaseSyncLike): Set<string>;
-/**
- * db-scoped delete core, so a delete can compose inside a caller's transaction.
- * NO filesystem I/O: the caller's transaction may still roll back, and mirrors are written post-commit.
- *
- * `opts.suppressForgetAudit` (default false): `rejectValue` and `resolveConflict` set it because each
- * writes its own aggregate audit row, so a removed row must not ALSO emit a `forget` row.
- *
- * Returns `{tenantId, dagParentId}` for the removed row, or `null` if no row with `id`
- * existed or `automatic` refused it (pinned, raw, kept for good or backing an object at DELETE time, so a late pin wins).
- */
+/** db-scoped delete core, composable inside a caller's transaction; NO filesystem I/O, mirrors are written post-commit. `suppressForgetAudit` is set by
+ * rejectValue and resolveConflict (own audit row). Returns `{tenantId, dagParentId}`, or null if absent or `automatic` refused it. */
 export declare function deleteEntryCore(db: ReturnType<typeof openHippoDb>, id: string, opts?: {
     actor?: string;
     suppressForgetAudit?: boolean;
@@ -27,29 +19,17 @@ export declare function deleteEntryCore(db: ReturnType<typeof openHippoDb>, id:
     tenantId: string;
     dagParentId: string | null;
 } | null;
-/**
- * Delete an entry from SQLite and mirrors.
- *
- * `opts.actor` defaults to 'cli'. The api.* layer threads `ctx.actor` so HTTP
- * callers land with `api_key:<key_id>` in the audit log without a duplicate
- * emit from the api wrapper.
- *
- * Thin wrapper over `deleteEntryCore` (open → core → mirrors → close);
- * behavior is byte-identical to the pre-split implementation for every
- * existing caller.
- */
+/** Delete an entry from SQLite and mirrors; thin wrapper over `deleteEntryCore` (open, core, mirrors, close).
+ * `opts.actor` defaults to 'cli'; the api layer threads `ctx.actor` so HTTP callers land as `api_key:<key_id>` in the audit log. */
 export declare function deleteEntry(hippoRoot: string, id: string, opts?: {
     actor?: string;
     reason?: string;
     automatic?: boolean;
 }): boolean;
-/** Writes, deletes and dormant moves in one transaction. With `snapshot` (rows as the caller loaded them), a write keeps only
- *  the fields the caller changed, takes the rest from the live row, and never resurrects a row that is gone.
- *
- *  `dormant` (src/store/dormant.ts): each move's snapshot is inserted into `dormant_memories` and its `memories` row
- *  leaves exactly like a delete (FTS row, DAG parent dirty-mark, mirrors), in the same transaction, so a memory
- *  is never in both places or in neither. Deletes and moves both skip rows that are no longer auto-deletable
- *  (pinned, raw, kept for good or backing an object since the caller decided). Returns the ids that left `memories`, deleted or moved. */
+/** Each row as the caller loaded it, by id; a `ReadonlyMap` fits. */
+export type LoadedRows = Pick<ReadonlyMap<string, MemoryEntry>, 'get'>;
+/** Writes, deletes and dormant moves in one transaction. With `snapshot`, a write keeps only the fields the caller changed and never resurrects a gone row.
+ * Dormant moves (src/store/dormant.ts) leave `memories` like a delete; both skip rows no longer auto-deletable. Returns ids that left `memories`. */
 export declare function batchWriteAndDelete(hippoRoot: string, toWrite: MemoryEntry[], toDeleteIds: string[], opts?: {
     snapshot?: ReadonlyMap<string, MemoryEntry>;
     dormant?: DormantMove[];
@@ -70,10 +50,10 @@ export declare function deleteEntriesOneByOne(hippoRoot: string, targets: readon
     actor?: string;
     automatic?: boolean;
 }): boolean[];
-/** Commits whole components in transactions of about `budget.holdMs` on one store handle, letting other writers in between; returns the ids that left `memories`.
- *  The snapshot keeps what other writers changed after the caller loaded its rows. */
+/** Commits whole components in transactions of about `budget.holdMs`, letting other writers in between; returns the ids that left `memories`.
+ * The snapshot keeps what other writers changed after the caller loaded its rows. */
 export declare function commitInChunks(hippoRoot: string, components: readonly FlushComponent[], opts: {
-    snapshot: ReadonlyMap<string, MemoryEntry>;
+    snapshot: LoadedRows;
     budget: WriteBudget;
     busyWaitMs: number;
 }): Promise<string[]>;