hippo-memory 1.70.0 → 1.71.0

package/dist/store/recall-scope.js

@@ -1,54 +1,20 @@
-/**
- * Recall-side scope predicates, in a leaf module so shared.ts (which api.ts
- * imports) can apply the same default-deny rule to searchBothHybrid's internal
- * candidate loads without an import cycle. api.ts imports
- * these for its own call sites AND re-exports them for back-compat
- * (`api.isPrivateScope`, test imports of `passesScopeFilterForRecall`).
- */
+/** Recall-side scope predicates, in a leaf module so search-both.ts can apply the same default-deny rule to searchBothHybrid's candidate loads without an
+ * import cycle. src/api/index.ts imports these and re-exports them for back-compat (`api.isPrivateScope`, tests importing `passesScopeFilterForRecall`). */
 import { BadRequestError, ForbiddenError } from '../core/api-errors.js';
 import { MAX_ID_LEN } from '../util/http-util.js';
-/**
- * Literal scopes excluded from recall by default-deny when the
- * caller passes no `scope`. The SQL clause in `loadSearchRows` and the JS
- * helper `passesScopeFilterForRecall` (src/api/index.ts) both read from this
- * constant. Adding a deny scope is a one-place change.
- *
- * Regex-based denies (e.g. `<source>:private:*`) stay in
- * `passesScopeFilterForRecall` as a separate JS step — they don't translate
- * cleanly to SQL.
- *
- * Invariant: never empty. An empty array would silently allow quarantine
- * scopes through both paths (SQL clause omitted, JS check vacuous). The
- * module-load assertion below pins this loudly.
- */
+/** Literal scopes excluded from recall by default-deny when the caller passes no `scope`; read by the SQL clause in `loadSearchRows` and by
+ * `passesScopeFilterForRecall`. Invariant: never empty, or quarantine scopes would pass both paths silently (the module-load assertion below pins this). */
 export const RECALL_DEFAULT_DENY_SCOPES = ['unknown:legacy'];
-/**
- * @internal Runtime guard against a future maintainer blanking a
- * load-bearing literal array. Extracted from the inline guard so the throw
- * path is directly testable. `as const` arrays widen via `readonly T[]` at
- * the call site so the empty case is reachable at runtime.
- */
+/** @internal Runtime guard against blanking a load-bearing literal array; `as const` arrays widen via `readonly T[]` at the call site, so the empty case
+ * is reachable and testable. */
 export function assertNonEmpty(arr, name) {
     if (arr.length === 0) {
         throw new Error(`${name} cannot be empty — would silently allow quarantine scopes`);
     }
 }
 assertNonEmpty(RECALL_DEFAULT_DENY_SCOPES, 'RECALL_DEFAULT_DENY_SCOPES');
-/**
- * Source-agnostic private-scope detector. A scope string is treated
- * as private when it has the shape `<lowercase-source>:private:<rest>`.
- *
- * Examples that match:
- *   slack:private:Cabc, github:private:owner/repo, jira:private:PROJ-1
- * Examples that DO NOT match:
- *   slack:public:Cgeneral, acme:public:my-private-channel, null, '',
- *   'unknown:legacy', 'private' (alone), 'private:foo' (no source prefix).
- *
- * Used by api.recall, mcp/server.ts (hippo_recall + hippo_context),
- * cli.ts (cmdRecall + cmdExplain + continuity), shared.ts (searchBothHybrid
- * recall mode). Keep these in sync — the export is the single source of
- * truth so connector work cannot drift.
- */
+/** Source-agnostic private-scope detector: private means `<lowercase-source>:private:<rest>` (`slack:private:Cabc`; not `slack:public:x`, null, '',
+ * 'private:foo'). The single source of truth for api.recall, the MCP server, the CLI and search-both.ts, so connector work cannot drift. */
 export const PRIVATE_SCOPE_RE = /^[a-z][a-z0-9_-]*:private:/;
 function isScopeString(value) {
     return typeof value === 'string';
@@ -89,15 +55,8 @@ export function canTouchScope(actor, scope) {
 export function ownScopeTouches(ownScope, scope) {
     return !isPersonalScope(scope) || scope === ownScope;
 }
-/**
- * Recall-side scope filter — the canonical JS half of the recall default-deny
- * rule (the SQL half lives in `loadSearchRows` via `loadRecallSearchEntries`).
- *
- * - When `requested` is set and non-empty: exact match required.
- * - When `requested` is undefined/empty: default-deny on any
- *   `<source>:private:*` scope and on the `RECALL_DEFAULT_DENY_SCOPES`
- *   quarantine buckets. `null` and public scopes pass, and so does `ownScope`, the caller's own personal scope.
- */
+/** JS half of the recall default-deny rule (SQL half: `loadSearchRows`). A non-empty `requested` needs an exact match;
+ * otherwise `<source>:private:*` and `RECALL_DEFAULT_DENY_SCOPES` buckets are denied, while null, public scopes and the caller's `ownScope` pass. */
 export function passesScopeFilterForRecall(scope, requested, ownScope) {
     if (requested !== undefined && requested !== '') {
         return scope === requested;
@@ -113,40 +72,23 @@ export function scopeAdmitSql(col, ownScope) {
     // The own arm sits inside the outer parentheses so a caller's `AND ${sql}` cannot split it off.
     return { sql: `(${admitted} OR ${col}scope = ?)`, params: [...RECALL_DEFAULT_DENY_SCOPES, ownScope] };
 }
-/** SQL twin of canTouchScope, which is also canReadScope for an admin: every row but another person's personal one. LIKE folds ASCII case as isPersonalScope's /i does. */
+/** SQL twin of canTouchScope, which is also canReadScope for an admin: every row but
+ * another person's personal one. LIKE folds ASCII case as isPersonalScope's /i does. */
 export function touchableScopeSql(col, ownScope) {
     const notPersonal = `${col}scope IS NULL OR ${col}scope NOT LIKE '${PERSONAL_SCOPE_PREFIX}%'`;
     if (ownScope == null)
         return { sql: `(${notPersonal})`, params: [] };
     return { sql: `(${notPersonal} OR ${col}scope = ?)`, params: [ownScope] };
 }
-/**
- * The CLI `--scope` variant of the recall filter (JS half of the
- * SQL 'default-deny-or-exact' mode in loadSearchRows).
- *
- * The CLI flag predates the envelope column as a TAG-boost ranking hint
- * (`scope:<v>` tags, HIPPO_SCOPE, detectScope()), so an explicit `--scope X`
- * UNLOCKS envelope scope X in addition to the default-admitted set — it does
- * NOT narrow the result to X (that would return zero rows for every
- * tag-scoped workflow, whose envelope scope is NULL). api.recall keeps the
- * narrowing 'exact' semantics via `passesScopeFilterForRecall`.
- *
- * Note the unlock applies to whatever scope was explicitly named — including
- * a private scope or a quarantine bucket (`--scope unknown:legacy`). That is
- * deliberate owner access, identical in reach to api.recall's exact-match
- * for the same input; only NON-requested private/quarantine scopes stay
- * denied. A named personal scope never unlocks: the CLI has no caller identity to check it against.
- */
+/** CLI `--scope` variant: an explicit `--scope X` UNLOCKS scope X on top of the default-admitted set rather than narrowing to X (api.recall keeps 'exact').
+ * Includes private/quarantine scopes (owner access); a named personal scope never unlocks: the CLI has no caller identity. */
 export function passesCliRecallScopeFilter(scope, requested) {
     if (requested !== undefined && requested !== '' && !isPersonalScope(requested) && scope === requested) {
         return true;
     }
     return passesScopeFilterForRecall(scope, undefined);
 }
-/**
- * Thrown when a caller requests a scope its role may not read. The HTTP layer
- * maps it to 403.
- */
+/** Thrown when a caller requests a scope its role may not read; the HTTP layer maps it to 403. */
 export class ScopeForbiddenError extends ForbiddenError {
     scope;
     constructor(scope) {
@@ -155,20 +97,17 @@ export class ScopeForbiddenError extends ForbiddenError {
         this.scope = scope;
     }
 }
-/**
- * True for scopes that default-deny hides: `<source>:private:*` and the
- * quarantine buckets. Naming one explicitly is what unlocks it, so naming one
- * is the act that needs authorization.
- */
+/** True for scopes default-deny hides (`<source>:private:*` and the quarantine buckets); naming one explicitly unlocks it, so naming one needs
+ * authorization. */
 export function isRestrictedScope(scope) {
     if (!isScopeString(scope))
         return false;
-    // SAFETY: RECALL_DEFAULT_DENY_SCOPES is a readonly tuple of string
-    // literals; widening the array (not the input) lets .includes() take any scope.
-    // `:private:` anywhere, any case, matches the store's SQL default-deny (store/search-rows.ts) so JS never admits what SQL hides.
+    // SAFETY: RECALL_DEFAULT_DENY_SCOPES is a readonly tuple of string literals; widening the array lets .includes() take any scope.
+    // `:private:` anywhere, any case, matches the SQL default-deny in src/store/search-rows.ts so JS never admits what SQL hides.
     return isPrivateScope(scope) || /:private:/i.test(scope) || RECALL_DEFAULT_DENY_SCOPES.includes(scope);
 }
-/** Personal rows answer to their owner alone: role, key grants and resolver scopes never open one. Else admin reads all; a member needs an exact grant on a restricted scope. */
+/** Personal rows answer to their owner alone: role, key grants and resolver scopes never
+ * open one. Else admin reads all; a member needs an exact grant on a restricted scope. */
 export function canReadScope(actor, scope) {
     if (isPersonalScope(scope))
         return scope === personalScopeOf(actor);

package/dist/store/recall-trace.d.ts

@@ -1,19 +1,6 @@
-/**
- * Retrieval-trace persistence.
- *
- * Single producer for the `recall_traces` / `recall_trace_results` /
- * `recall_trace_outcomes` tables (schema v40). Every recall on the three
- * wired paths (api.recall, api.getContext, CLI cmdRecall) writes a trace
- * row: the ids + ranks + scores actually returned. Outcome events that
- * resolve their targets from last-retrieval state link back to the trace
- * they judge via `recordTraceOutcome`. This is the (query, shown, outcome)
- * training triple every Track LC learned component needs.
- *
- * All writes here are fail-soft: a broken trace write must never break the
- * surrounding recall or outcome call. Failures are logged to stderr and
- * swallowed (matches the api.ts ~2843 "audit emit failed" precedent — no
- * new debug env var).
- */
+/** Retrieval-trace persistence: the single producer for `recall_traces`, `recall_trace_results` and `recall_trace_outcomes`.
+ * One trace row per recall on api.recall, api.getContext and CLI cmdRecall: the (query, shown, outcome) triple the learned components train on.
+ * All writes are fail-soft: a failed trace write is logged to stderr and swallowed, never breaking the surrounding call. */
 import { type DatabaseSyncLike } from '../db/index.js';
 import type { RerankStep } from '../core/search-types.js';
 import { type DeliveryEventInput } from './delivery-recorder.js';
@@ -31,7 +18,7 @@ export interface RecallTraceInput {
     sessionId?: string | null;
     pipeline: 'api' | 'cli' | 'context' | 'mcp';
     /** Raw query text. NEVER persisted — only its sha256/16 hash + length are
-     *  stored (GDPR Path A / audit convention, cli.ts:1532). */
+     *  stored (GDPR Path A / audit convention, CLI). */
     query: string;
     /** True when the caller ran with explain/--why (per-result rerank steps
      *  may be present). Defaults to false. */
@@ -39,39 +26,11 @@ export interface RecallTraceInput {
     /** Results in returned rank order (index 0 = rank 1). */
     results: RecallTraceResultInput[];
 }
-/**
- * Insert a `recall_traces` row + its `recall_trace_results` rows in ONE
- * transaction, on the connection handed in. Fail-soft: never throws —
- * logs to stderr and returns null on any failure.
- *
- * Connection policy: api.recall and api.getContext reach this through
- * `finishRecallAt`, on the handle that recall's other writes use. CLI
- * cmdRecall goes through `writeRecallTraceAtRoot` instead, since its audit
- * handle is already closed by the time tracing runs.
- */
+/** Insert a `recall_traces` row and its results rows in ONE transaction on the given connection. Fail-soft: logs to stderr and returns null on failure.
+ * api.recall/getContext reach this via `finishRecallAt` on their own handle; CLI cmdRecall uses `writeRecallTraceAtRoot` (its audit handle is closed). */
 export declare function writeRecallTrace(db: DatabaseSyncLike, input: RecallTraceInput): number | null;
-/**
- * Convenience wrapper: opens a fresh short-lived connection at `root`,
- * writes the trace, and closes. Returns the new trace id, or null on any
- * failure (fail-soft).
- *
- * Used at CLI cmdRecall, where the block's own convention is per-call
- * handles (writeEntry, saveIndex) and the earlier audit handle is already
- * closed. NOT used by api.recall, which must reuse the caller's open handle
- * (no-side-effects contract, tests/api-recall-no-side-effects.test.ts).
- *
- * This function does NOT touch the `last_trace_id` meta key: its own connection
- * would commit apart from `saveIndex`, so a crash could advance one key alone. LOCKSTEP
- * INVARIANT: `last_trace_id` must only ever advance in the SAME write as
- * `last_retrieval_ids`. The caller now does: call this function FIRST, set
- * `localIndex.last_trace_id` from the returned id, THEN call `saveIndex`
- * once — `saveIndex` persists both meta keys in one transaction
- * (store.ts). Call sites that trace WITHOUT advancing `last_retrieval_ids`
- * (CLI cmdRecall's zero-result path) simply never touch `localIndex` at
- * all, so they can't desync by construction.
- *
- * Fail-soft: never throws, including on connection failure.
- */
+/** Short-lived connection at `root`: writes the trace, closes; returns the id or null (fail-soft). For CLI cmdRecall; api.recall must reuse its open handle.
+ * LOCKSTEP: never touches `last_trace_id`, which advances only in the same `saveIndex` write as `last_retrieval_ids`; the caller sets it from the id. */
 export declare function writeRecallTraceAtRoot(root: string, input: RecallTraceInput): number | null;
 /** Input to `recordTraceOutcome`. */
 export interface RecordTraceOutcomeInput {
@@ -81,34 +40,8 @@ export interface RecordTraceOutcomeInput {
     /** Ids actually credited by this outcome event (post tenant-filtering). */
     memoryIds: string[];
 }
-/**
- * Record an outcome event against a trace, linking the (query, shown,
- * outcome) triple. Called ONLY where the credited ids actually come from
- * the last-retrieval mechanism (api.outcomeForLastRecall and any outcome
- * flow that resolves its targets from last-retrieval state) or from an
- * SDK caller's explicit `traceId` opt — never unconditionally from
- * api.outcome, which would mislink an explicit-id caller to a stale,
- * unrelated trace.
- *
- * Lives in its own append-only table, not audit_log metadata: audit_log is
- * pruned by `pruneAuditLog`, and pruning must never erase training data.
- *
- * Validation: `traceId`/`memoryIds` reach
- * this function from caller-side state (`last_trace_id` / applied outcome
- * ids) that can go stale relative to the trace it names — a forgotten
- * memory, a tenant switch mid-session, or a race between two callers. Two
- * checks run before the insert, both skip with one log.warn line
- * rather than throw:
- *   1. The named trace must exist and belong to `input.tenantId` — a
- *      tenant mismatch or a dangling id (deleted trace) skips.
- *   2. `input.memoryIds` is intersected against the trace's OWN
- *      `recall_trace_results.memory_id` set — only ids that trace actually
- *      returned are recorded. An id that was never in this trace's result
- *      set (stale caller state) is silently dropped rather than recorded
- *      as a false credit. If the intersection is empty, no row is written.
- *
- * Fail-soft: never throws.
- */
+/** Record an outcome against a trace; call ONLY with ids from last-retrieval state or an SDK `traceId`, never from api.outcome (stale-trace mislink).
+ * Skips (log.warn) unless the trace is in `input.tenantId`; keeps only memoryIds it returned. Own table so `pruneAuditLog` cannot erase training data. */
 export declare function recordTraceOutcome(db: DatabaseSyncLike, input: RecordTraceOutcomeInput): void;
 /** Pruned on write, counted back from the event's ts capped at the real clock, so a far-future fake time spares real rows. */
 export declare const DELIVERY_LEDGER_RETENTION_DAYS = 90;

package/dist/store/recall-trace.js

@@ -1,33 +1,13 @@
-/**
- * Retrieval-trace persistence.
- *
- * Single producer for the `recall_traces` / `recall_trace_results` /
- * `recall_trace_outcomes` tables (schema v40). Every recall on the three
- * wired paths (api.recall, api.getContext, CLI cmdRecall) writes a trace
- * row: the ids + ranks + scores actually returned. Outcome events that
- * resolve their targets from last-retrieval state link back to the trace
- * they judge via `recordTraceOutcome`. This is the (query, shown, outcome)
- * training triple every Track LC learned component needs.
- *
- * All writes here are fail-soft: a broken trace write must never break the
- * surrounding recall or outcome call. Failures are logged to stderr and
- * swallowed (matches the api.ts ~2843 "audit emit failed" precedent — no
- * new debug env var).
- */
-import { createHash } from 'node:crypto';
+/** Retrieval-trace persistence: the single producer for `recall_traces`, `recall_trace_results` and `recall_trace_outcomes`.
+ * One trace row per recall on api.recall, api.getContext and CLI cmdRecall: the (query, shown, outcome) triple the learned components train on.
+ * All writes are fail-soft: a failed trace write is logged to stderr and swallowed, never breaking the surrounding call. */
 import { openHippoDb, closeHippoDb, rethrowIfSqliteBlocked, withWriteScope } from '../db/index.js';
 import { DELIVERY_LEDGER_VERSION, isBoundaryEvent } from './delivery-recorder.js';
-import { errorMessage, log } from '../util/log.js';
+import { errorFields, errorMessage, log } from '../util/log.js';
 import { DAY_MS } from '../util/time.js';
-/**
- * Strip a RerankStep down to {stage, multiplier, scoreBefore, scoreAfter}
- * before persisting. `note` is
- * free-form human text — the CLI's goal-boost step embeds matched goal tag
- * text there, so persisting it verbatim would leak raw user content into
- * training data via `rerank_json`. Only the four structured fields survive;
- * any other/future free-form field is dropped by construction (allowlist,
- * not a denylist).
- */
+import { blockHash } from '../util/token-text.js';
+/** Strip a RerankStep to {stage, multiplier, scoreBefore, scoreAfter}: `note` is free-form (the CLI goal-boost step embeds goal tag text) and would leak
+ * user content into `rerank_json`; an allowlist, so any future free-form field is dropped too. */
 function sanitizeRerankSteps(steps) {
     return steps.map((s) => ({
         stage: s.stage,
@@ -36,19 +16,11 @@ function sanitizeRerankSteps(steps) {
         scoreAfter: s.scoreAfter,
     }));
 }
-/**
- * Insert a `recall_traces` row + its `recall_trace_results` rows in ONE
- * transaction, on the connection handed in. Fail-soft: never throws —
- * logs to stderr and returns null on any failure.
- *
- * Connection policy: api.recall and api.getContext reach this through
- * `finishRecallAt`, on the handle that recall's other writes use. CLI
- * cmdRecall goes through `writeRecallTraceAtRoot` instead, since its audit
- * handle is already closed by the time tracing runs.
- */
+/** Insert a `recall_traces` row and its results rows in ONE transaction on the given connection. Fail-soft: logs to stderr and returns null on failure.
+ * api.recall/getContext reach this via `finishRecallAt` on their own handle; CLI cmdRecall uses `writeRecallTraceAtRoot` (its audit handle is closed). */
 export function writeRecallTrace(db, input) {
     try {
-        const queryHash = createHash('sha256').update(input.query).digest('hex').slice(0, 16);
+        const queryHash = blockHash(input.query);
         const ts = new Date().toISOString();
         return withWriteScope(db, 'write_recall_trace', () => {
             const insertTrace = db.prepare(`
@@ -68,32 +40,12 @@ export function writeRecallTrace(db, input) {
         });
     }
     catch (error) {
-        log.error(`recall trace write failed: ${errorMessage(error)}`);
+        log.error(`recall trace write failed: ${errorMessage(error)}`, errorFields(error));
         return null;
     }
 }
-/**
- * Convenience wrapper: opens a fresh short-lived connection at `root`,
- * writes the trace, and closes. Returns the new trace id, or null on any
- * failure (fail-soft).
- *
- * Used at CLI cmdRecall, where the block's own convention is per-call
- * handles (writeEntry, saveIndex) and the earlier audit handle is already
- * closed. NOT used by api.recall, which must reuse the caller's open handle
- * (no-side-effects contract, tests/api-recall-no-side-effects.test.ts).
- *
- * This function does NOT touch the `last_trace_id` meta key: its own connection
- * would commit apart from `saveIndex`, so a crash could advance one key alone. LOCKSTEP
- * INVARIANT: `last_trace_id` must only ever advance in the SAME write as
- * `last_retrieval_ids`. The caller now does: call this function FIRST, set
- * `localIndex.last_trace_id` from the returned id, THEN call `saveIndex`
- * once — `saveIndex` persists both meta keys in one transaction
- * (store.ts). Call sites that trace WITHOUT advancing `last_retrieval_ids`
- * (CLI cmdRecall's zero-result path) simply never touch `localIndex` at
- * all, so they can't desync by construction.
- *
- * Fail-soft: never throws, including on connection failure.
- */
+/** Short-lived connection at `root`: writes the trace, closes; returns the id or null (fail-soft). For CLI cmdRecall; api.recall must reuse its open handle.
+ * LOCKSTEP: never touches `last_trace_id`, which advances only in the same `saveIndex` write as `last_retrieval_ids`; the caller sets it from the id. */
 export function writeRecallTraceAtRoot(root, input) {
     let db;
     try {
@@ -101,7 +53,7 @@ export function writeRecallTraceAtRoot(root, input) {
     }
     catch (error) {
         rethrowIfSqliteBlocked(error);
-        log.error(`recall trace connection failed: ${errorMessage(error)}`);
+        log.error(`recall trace connection failed: ${errorMessage(error)}`, errorFields(error));
         return null;
     }
     try {
@@ -111,34 +63,8 @@ export function writeRecallTraceAtRoot(root, input) {
         closeHippoDb(db);
     }
 }
-/**
- * Record an outcome event against a trace, linking the (query, shown,
- * outcome) triple. Called ONLY where the credited ids actually come from
- * the last-retrieval mechanism (api.outcomeForLastRecall and any outcome
- * flow that resolves its targets from last-retrieval state) or from an
- * SDK caller's explicit `traceId` opt — never unconditionally from
- * api.outcome, which would mislink an explicit-id caller to a stale,
- * unrelated trace.
- *
- * Lives in its own append-only table, not audit_log metadata: audit_log is
- * pruned by `pruneAuditLog`, and pruning must never erase training data.
- *
- * Validation: `traceId`/`memoryIds` reach
- * this function from caller-side state (`last_trace_id` / applied outcome
- * ids) that can go stale relative to the trace it names — a forgotten
- * memory, a tenant switch mid-session, or a race between two callers. Two
- * checks run before the insert, both skip with one log.warn line
- * rather than throw:
- *   1. The named trace must exist and belong to `input.tenantId` — a
- *      tenant mismatch or a dangling id (deleted trace) skips.
- *   2. `input.memoryIds` is intersected against the trace's OWN
- *      `recall_trace_results.memory_id` set — only ids that trace actually
- *      returned are recorded. An id that was never in this trace's result
- *      set (stale caller state) is silently dropped rather than recorded
- *      as a false credit. If the intersection is empty, no row is written.
- *
- * Fail-soft: never throws.
- */
+/** Record an outcome against a trace; call ONLY with ids from last-retrieval state or an SDK `traceId`, never from api.outcome (stale-trace mislink).
+ * Skips (log.warn) unless the trace is in `input.tenantId`; keeps only memoryIds it returned. Own table so `pruneAuditLog` cannot erase training data. */
 export function recordTraceOutcome(db, input) {
     try {
         // SAFETY: row shape matches the single `tenant_id` column named in the
@@ -165,7 +91,7 @@ export function recordTraceOutcome(db, input) {
     `).run(input.traceId, new Date().toISOString(), input.tenantId, input.outcome, JSON.stringify(credited));
     }
     catch (error) {
-        log.error(`recall trace outcome write failed: ${errorMessage(error)}`);
+        log.error(`recall trace outcome write failed: ${errorMessage(error)}`, errorFields(error));
     }
 }
 /** Pruned on write, counted back from the event's ts capped at the real clock, so a far-future fake time spares real rows. */
@@ -258,8 +184,7 @@ export function writeDeliveryEvent(db, input) {
         });
     }
     catch (error) {
-        // The prompt hook's stderr shows this exact `[hippo] delivery ledger` line, so it stays off the logger's format.
-        console.error(`[hippo] delivery ledger write failed: ${errorMessage(error)}`);
+        log.error(`delivery ledger write failed: ${errorMessage(error)}`);
         return null;
     }
 }
@@ -270,8 +195,7 @@ export function writeDeliveryEventAtRoot(root, input) {
         db = openHippoDb(root);
     }
     catch (error) {
-        // Same hook stderr line as writeDeliveryEvent above.
-        console.error(`[hippo] delivery ledger write failed: ${errorMessage(error)}`);
+        log.error(`delivery ledger write failed: ${errorMessage(error)}`);
         return null;
     }
     try {

package/dist/store/rejected-values.js

@@ -9,7 +9,7 @@ import { entryRejectRowAt, selectAllEntries } from './entry-reads.js';
 import { stampOriginProject } from './entry-row.js';
 import { writeEntryDbOnly, writeEntryMirrors } from './entry-writes.js';
 import { purgeMirrorBestEffort } from './mirrors.js';
-import { openStore } from './open.js';
+import { onHandle, openStore } from './open.js';
 import { archiveRawMemory, markMirrorCleaned } from './raw-archive.js';
 import { RejectedValueError, checkRejectionGuard, deleteRejectedValue, insertRejectedValue, listRejectedValues, normalizeValueForRejection, rejectionDigest, } from './rejection.js';
 function removeLiveRows(db, hippoRoot, rejection, holdsValue, removal) {
@@ -81,8 +81,7 @@ function purgeRemovedMirrors(db, hippoRoot, removal) {
  *  text (live or dormant, whole or inside a merged row) and one reject_value audit row. Markdown mirrors follow the commit. */
 export function applyRejection(hippoRoot, rejection) {
     const { tenantId, actor, reason, memoryId } = rejection;
-    const db = openStore(hippoRoot);
-    try {
+    return onHandle(hippoRoot, (db) => {
         const content = rejection.textOf(memoryId === undefined ? undefined : entryRejectRowAt(db, memoryId));
         const digest = rejectionDigest(content);
         const rejectedAt = new Date().toISOString();
@@ -108,16 +107,12 @@ export function applyRejection(hippoRoot, rejection) {
         purgeRemovedMirrors(db, hippoRoot, removal);
         const { removedIds, removedRawIds, successors, dormantSuccessorIds } = removal;
         return { digest, content, removedIds, removedRawIds, successorIds: successors.map((s) => s.id), dormantSuccessorIds };
-    }
-    finally {
-        closeHippoDb(db);
-    }
+    }, openStore);
 }
 /** Deletes the tenant's one rejected value whose digest starts with `digestPrefix` and writes its unreject_value audit row.
  *  No match, or more than one, writes nothing. */
 export function liftRejection(hippoRoot, tenantId, digestPrefix, actor) {
-    const db = openStore(hippoRoot);
-    try {
+    return onHandle(hippoRoot, (db) => {
         const matches = listRejectedValues(db, tenantId).filter((r) => r.digest.startsWith(digestPrefix));
         const target = matches[0];
         if (target === undefined)
@@ -127,20 +122,13 @@ export function liftRejection(hippoRoot, tenantId, digestPrefix, actor) {
         deleteRejectedValue(db, tenantId, target.digest);
         audit(db, 'unreject_value', { tenantId, actor, targetId: target.sourceMemoryId ?? undefined, metadata: { digest: target.digest, reason: target.reason } });
         return { status: 'ok', digest: target.digest, reason: target.reason };
-    }
-    finally {
-        closeHippoDb(db);
-    }
+    }, openStore);
 }
 /** The tenant's rejected values, newest first. */
 export function loadRejectedValues(hippoRoot, tenantId) {
-    const db = openStore(hippoRoot);
-    try {
+    return onHandle(hippoRoot, (db) => {
         return listRejectedValues(db, tenantId);
-    }
-    finally {
-        closeHippoDb(db);
-    }
+    }, openStore);
 }
 /** Whether the write guard would refuse `content` under `entryId`, as a write of that row would find it. Reads on a plain open
  *  and writes nothing, so a dry run counts the values a real run refuses. */

package/dist/store/rejection.d.ts

@@ -1,38 +1,14 @@
-/**
- * Rejected-value tombstone: core invariant.
- *
- * Exact-normalized-value semantics: a human who rejects a fact can refuse
- * byte-stable re-ingestion of the same value across remember/capture/import/
- * sync surfaces. Paraphrase/semantic matching is explicitly out of scope
- * (documented limitation, plan "Design").
- *
- * Kept db-agnostic (helpers take a `DatabaseSyncLike` handle) and does NOT
- * import from store.ts — store.ts imports from here, and the reverse would
- * be a cycle.
- */
+/** Rejected-value tombstone: a human can refuse byte-stable re-ingestion of a rejected fact (exact normalized value); paraphrase matching is out of scope.
+ * db-agnostic (helpers take a `DatabaseSyncLike`) and imports nothing from the store layer above it, which imports this (the reverse is a cycle). */
 import type { DatabaseSyncLike } from '../db/index.js';
 import { BadRequestError } from '../core/api-errors.js';
-/**
- * Normalize content for rejection-digest comparisons: Unicode NFC →
- * lowercase → collapse whitespace runs to a single space → trim. No
- * punctuation stripping — over-normalization creates false refusals, which
- * are worse than misses (plan §1).
- */
+/** Normalize content for rejection digests: NFC, lowercase, collapse whitespace runs, trim. No punctuation stripping: over-normalizing causes false
+ * refusals, worse than misses. */
 export declare function normalizeValueForRejection(content: string): string;
-/**
- * Full sha256 hex (64 chars) of the normalized content. Reuses the strong-
- * identity convention (importers.ts:814 content-hash tag), NOT the privacy-
- * lossy 16-char convention (recall-trace query hashing) — a tombstone lookup
- * key needs collision resistance, not redaction (plan §1).
- */
+/** Full 64-char sha256 hex of the normalized content: a tombstone key needs collision resistance, not the 16-char redaction hash used for query hashing. */
 export declare function rejectionDigest(content: string): string;
-/**
- * Thrown by the write-path guard (checkRejectionGuard, called from
- * upsertEntryRow) when an incoming write would introduce a value matching a
- * tombstoned digest. Carries enough context for the transaction-owner catch
- * blocks (writeEntry, api.supersede) to write a post-rollback
- * `reject_refusal` audit row via `auditRejectionRefusal` (plan §3).
- */
+/** Thrown by the write-path guard (checkRejectionGuard, via upsertEntryRow) when a write would introduce a tombstoned value; carries what the
+ * transaction-owner catch blocks (writeEntry, api.supersede) need to write the post-rollback `reject_refusal` audit row via `auditRejectionRefusal`. */
 export declare class RejectedValueError extends BadRequestError {
     readonly digest: string;
     readonly tenantId: string;
@@ -56,15 +32,9 @@ export interface RejectedValueRow {
     sourceMemoryId: string | null;
     normalizedChars: number | null;
 }
-/**
- * Look up a tombstone by tenant + digest. One indexed point query — the
- * guard's common-case cost, a miss ends the guard (plan §3).
- */
+/** Look up a tombstone by tenant + digest: one indexed point query, the guard's common-case cost; a miss ends the guard. */
 export declare function findRejectedValue(db: DatabaseSyncLike, tenantId: string, digest: string): RejectedValueRow | null;
-/**
- * Insert (or refresh) a tombstone row. Caller owns the transaction — used by
- * the `reject` verb and `resolveConflict`'s `rejectLoserValue` path.
- */
+/** Insert (or refresh) a tombstone row; the caller owns the transaction (used by the `reject` verb and `resolveConflict`'s `rejectLoserValue`). */
 export declare function insertRejectedValue(db: DatabaseSyncLike, opts: {
     tenantId: string;
     digest: string;
@@ -74,27 +44,11 @@ export declare function insertRejectedValue(db: DatabaseSyncLike, opts: {
     sourceMemoryId?: string | null;
     normalizedChars: number;
 }): void;
-/**
- * Delete a tombstone by tenant + exact digest: the `unreject` verb, the
- * only escape hatch.
- */
+/** Delete a tombstone by tenant + exact digest: the `unreject` verb, the only escape hatch. */
 export declare function deleteRejectedValue(db: DatabaseSyncLike, tenantId: string, digest: string): boolean;
 /** List tombstones for a tenant, newest first: the `rejections` verb. */
 export declare function listRejectedValues(db: DatabaseSyncLike, tenantId: string): RejectedValueRow[];
-/**
- * The write-path guard's check helper, called from `upsertEntryRow`
- * (store.ts). Fires when the incoming content's digest matches a tombstone
- * AND the write *introduces* that content: the row is new, OR the stored
- * row's content digest differs from the incoming one — an UPSERT editing a
- * same-id row TO a rejected value is a content introduction and must be
- * refused. Unchanged same-id re-persists (recall boost, decay, star toggle)
- * are exempt by construction (plan §3).
- *
- * Ordering minimizes queries on the common (miss) path: (a) caller has
- * already computed nothing yet — this does the digest + point lookup first;
- * (b) a miss returns immediately (ONE indexed point query); (c) only on a
- * tombstone hit does it SELECT the stored row's content to classify
- * new-row vs content-introduction (+1 query, rare path).
- */
+/** Write-path guard check: fires when the digest matches a tombstone AND the write introduces that content (a new row, or a same-id UPSERT changing it).
+ * Unchanged same-id re-persists (recall boost, decay, star toggle) are exempt. A miss costs ONE indexed point query; only a hit SELECTs the stored row. */
 export declare function checkRejectionGuard(db: DatabaseSyncLike, tenantId: string, entryId: string, content: string): void;
 //# sourceMappingURL=rejection.d.ts.map