hippo-memory 1.70.0 → 1.71.0

package/dist/store/rejection.js

@@ -1,43 +1,19 @@
-/**
- * Rejected-value tombstone: core invariant.
- *
- * Exact-normalized-value semantics: a human who rejects a fact can refuse
- * byte-stable re-ingestion of the same value across remember/capture/import/
- * sync surfaces. Paraphrase/semantic matching is explicitly out of scope
- * (documented limitation, plan "Design").
- *
- * Kept db-agnostic (helpers take a `DatabaseSyncLike` handle) and does NOT
- * import from store.ts — store.ts imports from here, and the reverse would
- * be a cycle.
- */
+/** Rejected-value tombstone: a human can refuse byte-stable re-ingestion of a rejected fact (exact normalized value); paraphrase matching is out of scope.
+ * db-agnostic (helpers take a `DatabaseSyncLike`) and imports nothing from the store layer above it, which imports this (the reverse is a cycle). */
 import { createHash } from 'node:crypto';
 import { BadRequestError } from '../core/api-errors.js';
 import { DIGEST_DISPLAY_CHARS } from '../util/token-text.js';
-/**
- * Normalize content for rejection-digest comparisons: Unicode NFC →
- * lowercase → collapse whitespace runs to a single space → trim. No
- * punctuation stripping — over-normalization creates false refusals, which
- * are worse than misses (plan §1).
- */
+/** Normalize content for rejection digests: NFC, lowercase, collapse whitespace runs, trim. No punctuation stripping: over-normalizing causes false
+ * refusals, worse than misses. */
 export function normalizeValueForRejection(content) {
     return content.normalize('NFC').toLowerCase().replace(/\s+/g, ' ').trim();
 }
-/**
- * Full sha256 hex (64 chars) of the normalized content. Reuses the strong-
- * identity convention (importers.ts:814 content-hash tag), NOT the privacy-
- * lossy 16-char convention (recall-trace query hashing) — a tombstone lookup
- * key needs collision resistance, not redaction (plan §1).
- */
+/** Full 64-char sha256 hex of the normalized content: a tombstone key needs collision resistance, not the 16-char redaction hash used for query hashing. */
 export function rejectionDigest(content) {
     return createHash('sha256').update(normalizeValueForRejection(content)).digest('hex');
 }
-/**
- * Thrown by the write-path guard (checkRejectionGuard, called from
- * upsertEntryRow) when an incoming write would introduce a value matching a
- * tombstoned digest. Carries enough context for the transaction-owner catch
- * blocks (writeEntry, api.supersede) to write a post-rollback
- * `reject_refusal` audit row via `auditRejectionRefusal` (plan §3).
- */
+/** Thrown by the write-path guard (checkRejectionGuard, via upsertEntryRow) when a write would introduce a tombstoned value; carries what the
+ * transaction-owner catch blocks (writeEntry, api.supersede) need to write the post-rollback `reject_refusal` audit row via `auditRejectionRefusal`. */
 export class RejectedValueError extends BadRequestError {
     digest;
     tenantId;
@@ -66,10 +42,7 @@ function rowToRejectedValue(row) {
         normalizedChars: row.normalized_chars,
     };
 }
-/**
- * Look up a tombstone by tenant + digest. One indexed point query — the
- * guard's common-case cost, a miss ends the guard (plan §3).
- */
+/** Look up a tombstone by tenant + digest: one indexed point query, the guard's common-case cost; a miss ends the guard. */
 export function findRejectedValue(db, tenantId, digest) {
     // SAFETY: row's shape matches the columns named in the SELECT above.
     const row = db
@@ -78,10 +51,7 @@ export function findRejectedValue(db, tenantId, digest) {
         .get(tenantId, digest);
     return row ? rowToRejectedValue(row) : null;
 }
-/**
- * Insert (or refresh) a tombstone row. Caller owns the transaction — used by
- * the `reject` verb and `resolveConflict`'s `rejectLoserValue` path.
- */
+/** Insert (or refresh) a tombstone row; the caller owns the transaction (used by the `reject` verb and `resolveConflict`'s `rejectLoserValue`). */
 export function insertRejectedValue(db, opts) {
     db.prepare(`INSERT INTO rejected_values(tenant_id, digest, reason, rejected_by, rejected_at, source_memory_id, normalized_chars)
      VALUES (?, ?, ?, ?, ?, ?, ?)
@@ -92,10 +62,7 @@ export function insertRejectedValue(db, opts) {
        source_memory_id = excluded.source_memory_id,
        normalized_chars = excluded.normalized_chars`).run(opts.tenantId, opts.digest, opts.reason, opts.rejectedBy, opts.rejectedAt, opts.sourceMemoryId ?? null, opts.normalizedChars);
 }
-/**
- * Delete a tombstone by tenant + exact digest: the `unreject` verb, the
- * only escape hatch.
- */
+/** Delete a tombstone by tenant + exact digest: the `unreject` verb, the only escape hatch. */
 export function deleteRejectedValue(db, tenantId, digest) {
     const result = db.prepare(`DELETE FROM rejected_values WHERE tenant_id = ? AND digest = ?`).run(tenantId, digest);
     return (result.changes ?? 0) > 0;
@@ -109,33 +76,14 @@ export function listRejectedValues(db, tenantId) {
         .all(tenantId);
     return rows.map(rowToRejectedValue);
 }
-/**
- * The write-path guard's check helper, called from `upsertEntryRow`
- * (store.ts). Fires when the incoming content's digest matches a tombstone
- * AND the write *introduces* that content: the row is new, OR the stored
- * row's content digest differs from the incoming one — an UPSERT editing a
- * same-id row TO a rejected value is a content introduction and must be
- * refused. Unchanged same-id re-persists (recall boost, decay, star toggle)
- * are exempt by construction (plan §3).
- *
- * Ordering minimizes queries on the common (miss) path: (a) caller has
- * already computed nothing yet — this does the digest + point lookup first;
- * (b) a miss returns immediately (ONE indexed point query); (c) only on a
- * tombstone hit does it SELECT the stored row's content to classify
- * new-row vs content-introduction (+1 query, rare path).
- */
+/** Write-path guard check: fires when the digest matches a tombstone AND the write introduces that content (a new row, or a same-id UPSERT changing it).
+ * Unchanged same-id re-persists (recall boost, decay, star toggle) are exempt. A miss costs ONE indexed point query; only a hit SELECTs the stored row. */
 export function checkRejectionGuard(db, tenantId, entryId, content) {
     const incomingDigest = rejectionDigest(content);
     const tombstone = findRejectedValue(db, tenantId, incomingDigest);
     if (!tombstone)
         return; // miss ends the guard — the overwhelmingly common case
-    // Deliberately id-only (no tenant filter): memory ids are globally unique
-    // ULIDs, this lookup only classifies new-row vs same-id re-persist for the
-    // id the caller is already writing, and the tombstone lookup above is the
-    // tenant-scoped decision. Matches deleteEntry's own by-id SELECT.
-    //
-    // Also read tenant_id: a same-id upsert that only changes tenantId introduces the
-    // content into the destination tenant, exactly as if the row were new there.
+    // Id-only on purpose (ids are global ULIDs; the tombstone lookup is tenant-scoped); tenant_id is read as a tenantId-only upsert introduces content there.
     // SAFETY: storedRow's shape matches the two columns named in the SELECT above.
     const storedRow = db.prepare(`SELECT content, tenant_id FROM memories WHERE id = ?`).get(entryId);
     const isNewRow = storedRow === undefined;

package/dist/store/report-reads.d.ts

@@ -0,0 +1,6 @@
+import type { MemoryEntry } from '../core/memory.js';
+/** Every superseded row, the row that replaced it and that row's extraction source, in loadAllEntries' order: all a correction-latency report reads. */
+export declare function loadCorrectionEntries(hippoRoot: string): MemoryEntry[];
+/** The kind='raw' rows in loadAllEntries' order: all a provenance-coverage report reads. */
+export declare function loadRawEntries(hippoRoot: string): MemoryEntry[];
+//# sourceMappingURL=report-reads.d.ts.map

package/dist/store/report-reads.js

@@ -0,0 +1,29 @@
+import { MEMORY_SELECT_COLUMNS, rowToEntry } from './rows.js';
+import { onHandle, openStore } from './open.js';
+/** Every superseded row, the row that replaced it and that row's extraction source, in loadAllEntries' order: all a correction-latency report reads. */
+export function loadCorrectionEntries(hippoRoot) {
+    return onHandle(hippoRoot, (db) => {
+        const superseded = `superseded_by IS NOT NULL AND superseded_by != ''`;
+        // SAFETY: selects exactly MEMORY_SELECT_COLUMNS, matching MemoryRow's field set.
+        const rows = db.prepare(`
+      SELECT ${MEMORY_SELECT_COLUMNS} FROM memories
+      WHERE (${superseded})
+        OR id IN (SELECT superseded_by FROM memories WHERE ${superseded})
+        OR id IN (
+          SELECT extracted_from FROM memories
+          WHERE extracted_from IS NOT NULL AND id IN (SELECT superseded_by FROM memories WHERE ${superseded})
+        )
+      ORDER BY created ASC, id ASC
+    `).all();
+        return rows.map(rowToEntry);
+    }, openStore);
+}
+/** The kind='raw' rows in loadAllEntries' order: all a provenance-coverage report reads. */
+export function loadRawEntries(hippoRoot) {
+    return onHandle(hippoRoot, (db) => {
+        // SAFETY: selects exactly MEMORY_SELECT_COLUMNS, matching MemoryRow's field set.
+        const rows = db.prepare(`SELECT ${MEMORY_SELECT_COLUMNS} FROM memories WHERE kind = 'raw' ORDER BY created ASC, id ASC`).all();
+        return rows.map(rowToEntry);
+    }, openStore);
+}
+//# sourceMappingURL=report-reads.js.map

package/dist/store/rows.d.ts

@@ -1,5 +1,6 @@
 import { Layer, type MemoryEntry, type ConfidenceLevel } from '../core/memory.js';
 import { type JsonValue } from '../util/json.js';
+import { type StoredJsonSite } from '../util/stored-json.js';
 export interface IndexEntry {
     id: string;
     file: string;
@@ -134,27 +135,16 @@ export interface SessionEvent {
     created_at: string;
 }
 export declare const INDEX_VERSION = 3;
-export declare const MEMORY_SELECT_COLUMNS = "id, created, last_retrieved, retrieval_count, strength, half_life_days, layer, tags_json, emotional_valence, schema_fit, source, outcome_score, outcome_positive, outcome_negative, conflicts_with_json, pinned, confidence, content, parents_json, starred, trace_outcome, source_session_id, valid_from, superseded_by, extracted_from, dag_level, dag_parent_id, kind, scope, owner, artifact_ref, tenant_id, origin_project, descendant_count, earliest_at, latest_at, summary_dirty, last_rebuilt_at, rebuild_count, dag_level_3_built_at";
-export declare const MEMORY_SEARCH_COLUMNS = "m.id AS id, m.created AS created, m.last_retrieved AS last_retrieved, m.retrieval_count AS retrieval_count, m.strength AS strength, m.half_life_days AS half_life_days, m.layer AS layer, m.tags_json AS tags_json, m.emotional_valence AS emotional_valence, m.schema_fit AS schema_fit, m.source AS source, m.outcome_score AS outcome_score, m.outcome_positive AS outcome_positive, m.outcome_negative AS outcome_negative, m.conflicts_with_json AS conflicts_with_json, m.pinned AS pinned, m.confidence AS confidence, m.content AS content, m.parents_json AS parents_json, m.starred AS starred, m.trace_outcome AS trace_outcome, m.source_session_id AS source_session_id, m.valid_from AS valid_from, m.superseded_by AS superseded_by, m.extracted_from AS extracted_from, m.dag_level AS dag_level, m.dag_parent_id AS dag_parent_id, m.kind AS kind, m.scope AS scope, m.owner AS owner, m.artifact_ref AS artifact_ref, m.tenant_id AS tenant_id, m.origin_project AS origin_project, m.descendant_count AS descendant_count, m.earliest_at AS earliest_at, m.latest_at AS latest_at, m.summary_dirty AS summary_dirty, m.last_rebuilt_at AS last_rebuilt_at, m.rebuild_count AS rebuild_count, m.dag_level_3_built_at AS dag_level_3_built_at, bm25(memories_fts) AS bm25_score";
-/**
- * Default candidate-pool size for `loadSearchEntries` when called with
- * `limit === undefined`. Single source of truth; `api.recall` imports
- * this for `RecallResult.windowSize` reporting so the two cannot drift.
- */
+export declare const MEMORY_SELECT_COLUMNS: string;
+export declare const MEMORY_SEARCH_COLUMNS: string;
+/** Default candidate-pool size for `loadSearchEntries` when `limit` is undefined; `api.recall` imports it for `RecallResult.windowSize` so the two cannot
+ * drift. */
 export declare const DEFAULT_SEARCH_CANDIDATE_LIMIT = 200;
 export declare function rowToEntry(row: MemoryRow): MemoryEntry;
-export declare function parseJsonArray(raw: string | null | undefined): string[];
-/**
- * Strict parse for the `last_trace_id` meta value.
- * A bare Number(raw) would turn '', whitespace, or garbage into a
- * usable-looking 0/NaN — a consumer INSERTing recall_trace_outcomes with
- * trace_id=0 would hit a masked FK violation (row id 0 never exists).
- * Require a clean positive integer string; anything else is treated as
- * unset. This is the ONE place that decides "clean" — every consumer of
- * `HippoIndex.last_trace_id` (outcomeForLastRecall, tests) reads the
- * already-validated value out of `buildIndexFromDb`'s result and never
- * re-parses the raw meta string itself.
- */
+/** A column that is not JSON reads as empty. With `site` the row is named at warn once; without it no row is known and the line stays at debug. */
+export declare function parseJsonArray(raw: string | null | undefined, site?: StoredJsonSite): string[];
+/** Strict parse for `last_trace_id`: Number(raw) turns '' or garbage into 0/NaN (a masked FK violation); require a clean positive integer string, else unset.
+ * The ONE place that decides 'clean'; consumers read the validated value from `buildIndexFromDb`'s result and never re-parse. */
 export declare function parseLastTraceId(raw: string | null | undefined): string | null;
 export declare function rowToTaskSnapshot(row: TaskSnapshotRow): TaskSnapshot;
 export declare function rowToMemoryConflict(row: MemoryConflictRow): MemoryConflict;

package/dist/store/rows.js

@@ -1,22 +1,29 @@
+import { DEFAULT_TENANT_ID } from '../util/env.js';
 import { FALLBACK_HALF_LIFE_DAYS, DEFAULT_SCHEMA_FIT } from '../core/memory.js';
 import { errorMessage, log } from '../util/log.js';
 import { isJsonObject } from '../util/json.js';
+import { warnDamagedColumn } from '../util/stored-json.js';
 export const INDEX_VERSION = 3;
-export const MEMORY_SELECT_COLUMNS = `id, created, last_retrieved, retrieval_count, strength, half_life_days, layer, tags_json, emotional_valence, schema_fit, source, outcome_score, outcome_positive, outcome_negative, conflicts_with_json, pinned, confidence, content, parents_json, starred, trace_outcome, source_session_id, valid_from, superseded_by, extracted_from, dag_level, dag_parent_id, kind, scope, owner, artifact_ref, tenant_id, origin_project, descendant_count, earliest_at, latest_at, summary_dirty, last_rebuilt_at, rebuild_count, dag_level_3_built_at`;
-// FTS-join columns for loadSearchRows: each is `m.<col> AS <col>` so rowToEntry's unqualified
-// reads still work, and the trailing bm25(memories_fts) AS bm25_score carries the FTS rank.
-export const MEMORY_SEARCH_COLUMNS = `m.id AS id, m.created AS created, m.last_retrieved AS last_retrieved, m.retrieval_count AS retrieval_count, m.strength AS strength, m.half_life_days AS half_life_days, m.layer AS layer, m.tags_json AS tags_json, m.emotional_valence AS emotional_valence, m.schema_fit AS schema_fit, m.source AS source, m.outcome_score AS outcome_score, m.outcome_positive AS outcome_positive, m.outcome_negative AS outcome_negative, m.conflicts_with_json AS conflicts_with_json, m.pinned AS pinned, m.confidence AS confidence, m.content AS content, m.parents_json AS parents_json, m.starred AS starred, m.trace_outcome AS trace_outcome, m.source_session_id AS source_session_id, m.valid_from AS valid_from, m.superseded_by AS superseded_by, m.extracted_from AS extracted_from, m.dag_level AS dag_level, m.dag_parent_id AS dag_parent_id, m.kind AS kind, m.scope AS scope, m.owner AS owner, m.artifact_ref AS artifact_ref, m.tenant_id AS tenant_id, m.origin_project AS origin_project, m.descendant_count AS descendant_count, m.earliest_at AS earliest_at, m.latest_at AS latest_at, m.summary_dirty AS summary_dirty, m.last_rebuilt_at AS last_rebuilt_at, m.rebuild_count AS rebuild_count, m.dag_level_3_built_at AS dag_level_3_built_at, bm25(memories_fts) AS bm25_score`;
-/**
- * Default candidate-pool size for `loadSearchEntries` when called with
- * `limit === undefined`. Single source of truth; `api.recall` imports
- * this for `RecallResult.windowSize` reporting so the two cannot drift.
- */
+const MEMORY_COLUMN_NAMES = [
+    'id', 'created', 'last_retrieved', 'retrieval_count', 'strength', 'half_life_days', 'layer', 'tags_json',
+    'emotional_valence', 'schema_fit', 'source', 'outcome_score', 'outcome_positive', 'outcome_negative',
+    'conflicts_with_json', 'pinned', 'confidence', 'content', 'parents_json', 'starred', 'trace_outcome',
+    'source_session_id', 'valid_from', 'superseded_by', 'extracted_from', 'dag_level', 'dag_parent_id', 'kind', 'scope',
+    'owner', 'artifact_ref', 'tenant_id', 'origin_project', 'descendant_count', 'earliest_at', 'latest_at',
+    'summary_dirty', 'last_rebuilt_at', 'rebuild_count', 'dag_level_3_built_at',
+];
+// FTS-join columns for loadSearchRows: `m.<col> AS <col>` keeps rowToEntry's unqualified reads working.
+export const MEMORY_SELECT_COLUMNS = MEMORY_COLUMN_NAMES.join(', ');
+export const MEMORY_SEARCH_COLUMNS = [
+    ...MEMORY_COLUMN_NAMES.map((c) => `m.${c} AS ${c}`),
+    'bm25(memories_fts) AS bm25_score',
+].join(', ');
+/** Default candidate-pool size for `loadSearchEntries` when `limit` is undefined; `api.recall` imports it for `RecallResult.windowSize` so the two cannot
+ * drift. */
 export const DEFAULT_SEARCH_CANDIDATE_LIMIT = 200;
 function rowToRetrievalFields(row) {
-    // SAFETY: every `as X` below narrows a SQLite column value to an
-    // enum/union member of MemoryEntry; `row` comes from MEMORY_SELECT_COLUMNS
-    // / MEMORY_SEARCH_COLUMNS, which are the only queries producing MemoryRow,
-    // and the DB layer only ever writes these columns from the same enums.
+    // SAFETY: every `as X` narrows a SQLite column to a MemoryEntry enum/union member; `row` comes from MEMORY_SELECT_COLUMNS / MEMORY_SEARCH_COLUMNS,
+    // the only queries producing MemoryRow, and the DB layer writes these columns only from the same enums.
     return {
         id: row.id,
         created: row.created,
@@ -25,18 +32,18 @@ function rowToRetrievalFields(row) {
         strength: Number(row.strength ?? 1),
         half_life_days: Number(row.half_life_days ?? FALLBACK_HALF_LIFE_DAYS),
         layer: row.layer,
-        tags: parseJsonArray(row.tags_json),
+        tags: parseJsonArray(row.tags_json, { table: 'memories', id: row.id, column: 'tags_json' }),
         emotional_valence: row.emotional_valence ?? 'neutral',
         schema_fit: Number(row.schema_fit ?? DEFAULT_SCHEMA_FIT),
         source: row.source ?? 'cli',
         outcome_score: row.outcome_score === null || row.outcome_score === undefined ? null : Number(row.outcome_score),
         outcome_positive: Number(row.outcome_positive ?? 0),
         outcome_negative: Number(row.outcome_negative ?? 0),
-        conflicts_with: parseJsonArray(row.conflicts_with_json),
+        conflicts_with: parseJsonArray(row.conflicts_with_json, { table: 'memories', id: row.id, column: 'conflicts_with_json' }),
         pinned: Boolean(row.pinned),
         confidence: row.confidence ?? 'observed',
         content: row.content,
-        parents: parseJsonArray(row.parents_json),
+        parents: parseJsonArray(row.parents_json, { table: 'memories', id: row.id, column: 'parents_json' }),
         starred: Boolean(row.starred),
         trace_outcome: row.trace_outcome ?? null,
     };
@@ -54,7 +61,7 @@ function rowToPlacementFields(row) {
         scope: row.scope ?? null,
         owner: row.owner ?? null,
         artifact_ref: row.artifact_ref ?? null,
-        tenantId: row.tenant_id ?? 'default',
+        tenantId: row.tenant_id ?? DEFAULT_TENANT_ID,
         origin_project: row.origin_project ?? null,
         descendant_count: Number(row.descendant_count ?? 0),
         earliest_at: row.earliest_at ?? null,
@@ -74,7 +81,8 @@ export function rowToEntry(row) {
     }
     return entry;
 }
-export function parseJsonArray(raw) {
+/** A column that is not JSON reads as empty. With `site` the row is named at warn once; without it no row is known and the line stays at debug. */
+export function parseJsonArray(raw, site) {
     if (!raw)
         return [];
     try {
@@ -82,28 +90,22 @@ export function parseJsonArray(raw) {
         return Array.isArray(parsed) ? parsed.map((item) => String(item)) : [];
     }
     catch (err) {
-        log.debug(`store: corrupt JSON array column read as empty: ${errorMessage(err)}`);
+        if (site)
+            warnDamagedColumn(site, 'not valid JSON');
+        else
+            log.debug(`store: corrupt JSON array column read as empty: ${errorMessage(err)}`);
         return [];
     }
 }
-/**
- * Strict parse for the `last_trace_id` meta value.
- * A bare Number(raw) would turn '', whitespace, or garbage into a
- * usable-looking 0/NaN — a consumer INSERTing recall_trace_outcomes with
- * trace_id=0 would hit a masked FK violation (row id 0 never exists).
- * Require a clean positive integer string; anything else is treated as
- * unset. This is the ONE place that decides "clean" — every consumer of
- * `HippoIndex.last_trace_id` (outcomeForLastRecall, tests) reads the
- * already-validated value out of `buildIndexFromDb`'s result and never
- * re-parses the raw meta string itself.
- */
+/** Strict parse for `last_trace_id`: Number(raw) turns '' or garbage into 0/NaN (a masked FK violation); require a clean positive integer string, else unset.
+ * The ONE place that decides 'clean'; consumers read the validated value from `buildIndexFromDb`'s result and never re-parse. */
 export function parseLastTraceId(raw) {
     const trimmed = (raw ?? '').trim();
     if (!/^\d+$/.test(trimmed) || Number(trimmed) <= 0)
         return null;
     return trimmed;
 }
-function parseJsonObject(raw) {
+function parseJsonObject(raw, site) {
     if (!raw)
         return {};
     try {
@@ -113,8 +115,8 @@ function parseJsonObject(raw) {
         }
         return {};
     }
-    catch (err) {
-        log.debug(`store: corrupt JSON object column read as empty: ${errorMessage(err)}`);
+    catch {
+        warnDamagedColumn(site, 'not valid JSON');
         return {};
     }
 }
@@ -153,7 +155,7 @@ export function rowToSessionEvent(row) {
         content: row.content,
         source: row.source,
         scope: row.scope ?? null,
-        metadata: parseJsonObject(row.metadata_json),
+        metadata: parseJsonObject(row.metadata_json, { table: 'session_events', id: row.id, column: 'metadata_json' }),
         created_at: row.created_at,
     };
 }

package/dist/store/rule-sql.d.ts

@@ -0,0 +1,5 @@
+/** calculateStrength's clock-basis formula as SQL over `memories` columns, flags and multipliers baked in; keep in step.
+ *  An unparseable date scores NULL here and 0 in JS, so sums agree. */
+export declare function strengthSql(now: Date): string;
+export declare const AUTO_DELETABLE_SQL: string;
+//# sourceMappingURL=rule-sql.d.ts.map

package/dist/store/rule-sql.js

@@ -0,0 +1,37 @@
+// The SQL twins of the model's strength and keep rules (src/core/memory.ts); keep in step with calculateStrength and canAutoDelete.
+import { DAY_MS } from '../util/time.js';
+import { isDecayAblated, isOutcomeSlowAblated, isRecallBoostAblated } from '../core/ablation.js';
+import { DECAY_BASE, EMOTIONAL_MULTIPLIERS, FALLBACK_HALF_LIFE_DAYS, KEEP_PAIRS, MAX_WRONG_HALVINGS, RETRIEVAL_BOOST_SLOPE, REWARD_SLOPE, applyLossAversionRatio, } from '../core/memory.js';
+const UNIX_EPOCH_JULIAN_DAY = 2440587.5;
+/** calculateStrength's clock-basis formula as SQL over `memories` columns, flags and multipliers baked in; keep in step.
+ *  An unparseable date scores NULL here and 0 in JS, so sums agree. */
+export function strengthSql(now) {
+    const num = (n) => (Number.isInteger(n) ? n.toFixed(1) : String(n));
+    const pos = 'COALESCE(outcome_positive, 0)';
+    const neg = 'COALESCE(outcome_negative, 0)';
+    const wrong = isOutcomeSlowAblated() || isDecayAblated() ? '0' : `MAX(0, ${neg} - ${pos})`;
+    const reward = isOutcomeSlowAblated()
+        ? '1.0'
+        : `(CASE WHEN ${pos} = 0 AND ${neg} = 0 THEN 1.0 ELSE 1.0 + ${REWARD_SLOPE} * (${pos} - ${neg}) / (${pos} + ${neg} + 1.0) END)`;
+    const halfLife = `(COALESCE(half_life_days, ${FALLBACK_HALF_LIFE_DAYS}) * ${reward})`;
+    const anchor = isRecallBoostAblated() ? 'created' : 'last_retrieved';
+    const nowJulian = num(now.getTime() / DAY_MS + UNIX_EPOCH_JULIAN_DAY);
+    const decay = isDecayAblated() ? '1.0' : `pow(${DECAY_BASE}, (${nowJulian} - julianday(${anchor})) / ${halfLife})`;
+    const boost = isRecallBoostAblated()
+        ? '1.0'
+        : `(CASE WHEN ${wrong} > 0 THEN 1.0 ELSE 1.0 + ${RETRIEVAL_BOOST_SLOPE} * log2(COALESCE(retrieval_count, 0) + 1) END)`;
+    const valences = /* SAFETY: a Record keyed by EmotionalValence */ Object.keys(EMOTIONAL_MULTIPLIERS);
+    const emotion = `(CASE COALESCE(emotional_valence, 'neutral') ${valences
+        .map((v) => `WHEN '${v}' THEN ${num(applyLossAversionRatio(v, EMOTIONAL_MULTIPLIERS[v]))}`)
+        .join(' ')} ELSE 1.0 END)`;
+    const penalty = `pow(${DECAY_BASE}, MIN(${wrong}, ${MAX_WRONG_HALVINGS}))`;
+    return `(CASE WHEN pinned THEN ${penalty} WHEN ${halfLife} <= 0 THEN 0.0
+    ELSE MIN(1.0, MAX(0.0, ${decay} * ${boost} * ${emotion})) * ${penalty} END)`;
+}
+const sqlText = (s) => `'${s.replace(/'/g, "''")}'`;
+// json_each matches the tag as a whole element; substr, not LIKE, keeps the prefix case-sensitive like startsWith.
+const keepPairSql = (p) => `(COALESCE(superseded_by, '') = '' AND EXISTS (SELECT 1 FROM json_each(CASE WHEN json_valid(tags_json) THEN tags_json ELSE '[]' END) WHERE value = ${sqlText(p.tag)}) AND substr(source, 1, ${p.sourcePrefix.length}) = ${sqlText(p.sourcePrefix)})`;
+// Pinned and kept rows stay (a superseded row is not kept: its successor carries the tag and
+// source); raw rows leave only through archiveRawMemory. The SQL twin guards the DELETE itself.
+export const AUTO_DELETABLE_SQL = `pinned = 0 AND kind != 'raw'${KEEP_PAIRS.map((p) => ` AND NOT ${keepPairSql(p)}`).join('')}`;
+//# sourceMappingURL=rule-sql.js.map

package/dist/store/search-rows.d.ts

@@ -1,18 +1,7 @@
 import type { MemoryEntry } from '../core/memory.js';
 import { type DatabaseSyncLike } from '../db/index.js';
-/**
- * Recall-mode scope filter shape, exported so callers and tests can name it. Three modes:
- *   - 'default-deny': exclude scopes in `RECALL_DEFAULT_DENY_SCOPES`.
- *   - 'exact': exact match on `m.scope = value` (api.recall's explicit-scope request semantics).
- *   - 'default-deny-or-exact': the default-admitted set PLUS rows whose scope equals `value` (CLI `--scope`).
- *     The flag began as a tag-boost hint, so narrowing would return zero rows for tag-scoped workflows.
- *
- * Background pipelines (`consolidate`, `embeddings`, `refine-llm`, ...) call
- * `loadSearchEntries` (no scopeFilter arg) and see all rows including
- * quarantine.
- */
-/** @internal Internal SQL-builder shape; not on the public API
- *  surface (not re-exported from `src/index.ts`). Subject to change. */
+/** Recall scope filter: 'default-deny' (exclude RECALL_DEFAULT_DENY_SCOPES), 'exact' (m.scope = value), 'default-deny-or-exact' (both; CLI `--scope`).
+ * @internal Internal SQL-builder shape; not re-exported from `src/index.ts`. Subject to change. */
 export type RecallScopeFilter = {
     mode: 'default-deny';
     ownScope?: string;
@@ -26,35 +15,15 @@ export type RecallScopeFilter = {
 };
 /** One project name, or every name a project's rows carry. */
 export type OriginFilter = string | readonly string[];
-/** Scope rule for recall: none requested is default-deny; 'exact' narrows to the request; 'additive' adds it to the default set, unless it is personal, which only `ownScope` opens. */
+/** Scope rule for recall: none requested is default-deny; 'exact' narrows to the request; 'additive' adds it to the default set, unless it is personal,
+ * which only `ownScope` opens. */
 export declare function recallScopeFilter(requestedScope: string | undefined, mode: 'exact' | 'additive', ownScope?: string): RecallScopeFilter;
 /** Sends term queries down the LIKE path on a build that has FTS. Only tests call it. */
 export declare function _forceLikePathForTests(on: boolean): void;
-/**
- * Load likely search candidates directly from SQLite.
- * Uses FTS5 when available, falls back to LIKE matching, then full-store fallback.
- *
- * When `tenantId` is provided, every SELECT (FTS join, LIKE, fallback) filters
- * by tenant_id. Cross-tenant memories never surface. Omitted = no filter.
- */
+/** Load likely search candidates: FTS5 when available, else LIKE, then full-store fallback. With `tenantId` every SELECT filters by it; omitted = no filter. */
 export declare function loadSearchEntries(hippoRoot: string, query: string, limit?: number, tenantId?: string): MemoryEntry[];
-/**
- * Recall-mode loader. Pushes the recall-side scope predicate into SQL so
- * `unknown:legacy` cannot leak via any consumer that hasn't remembered to re-filter.
- *
- * - `requestedScope` undefined / '': default-deny on `unknown:legacy`, admitting `ownScope`, the caller's personal scope.
- * - `requestedScope` non-empty string: exact match on `m.scope = requestedScope`.
- *
- * Private scopes: SQL applies a conservative `NOT LIKE '%:private:%'` before the LIMIT window so private
- * rows cannot starve admitted ones; `passesScopeFilterForRecall` stays the exact JS post-filter.
- *
- * Consumers: `api.recall`, `cmdRecall`/`cmdExplain` direct CLI paths
- * and `searchBothHybrid` recall mode. Background pipelines
- * (`consolidate`, `embeddings`, `refine-llm`, ...) keep using
- * `loadSearchEntries` so they can see quarantined rows when needed.
- *
- * `tenantId` is optional because searchBothHybrid's is; undefined means no tenant filter.
- */
+/** Recall-mode loader: scope predicate in SQL so `unknown:legacy` cannot leak. Empty `requestedScope` default-denies (admits `ownScope`); else exact match.
+ * SQL `NOT LIKE '%:private:%'` runs before the LIMIT so private rows cannot starve admitted ones; `passesScopeFilterForRecall` is the exact post-filter. */
 export declare function loadRecallSearchEntries(hippoRoot: string, query: string, limit?: number, tenantId?: string, requestedScope?: string, explicitScopeMode?: 'exact' | 'additive', includeSuperseded?: boolean, originProjects?: OriginFilter, ownScope?: string): MemoryEntry[];
 export interface RecallSearchEntriesOptions {
     readonly limit?: number;

package/dist/store/search-rows.js

@@ -6,7 +6,7 @@ import { errorMessage, log } from '../util/log.js';
 import { originInSql } from '../core/project-identity.js';
 import { topVectorMatches } from '../db/vector-store.js';
 import { MEMORY_SELECT_COLUMNS, MEMORY_SEARCH_COLUMNS, DEFAULT_SEARCH_CANDIDATE_LIMIT, rowToEntry, } from './rows.js';
-import { openStore } from './open.js';
+import { onHandle, openStore } from './open.js';
 import { escapeLike } from '../util/escape.js';
 /** The recall scope rule for a table column prefix (`m.` or none); `passesScopeFilterForRecall` in recall-scope.ts is its JS twin. */
 function recallScopeClause(col, scopeFilter) {
@@ -28,7 +28,8 @@ function withProject(scope, col, origin) {
     const originProjects = [origin].flat();
     return { sql: `${scope.sql} AND (${col}origin_project = '' OR ${originInSql(originProjects, `${col}origin_project`)})`, params: [...scope.params, ...originProjects] };
 }
-/** Scope rule for recall: none requested is default-deny; 'exact' narrows to the request; 'additive' adds it to the default set, unless it is personal, which only `ownScope` opens. */
+/** Scope rule for recall: none requested is default-deny; 'exact' narrows to the request; 'additive' adds it to the default set, unless it is personal,
+ * which only `ownScope` opens. */
 export function recallScopeFilter(requestedScope, mode, ownScope) {
     if (!requestedScope || (mode === 'additive' && isPersonalScope(requestedScope)))
         return { mode: 'default-deny', ownScope };
@@ -62,19 +63,14 @@ function loadSearchRows(db, query, limit, tenantId, options = {}) {
     return selectAllCandidates(db, p, limit);
 }
 function searchPredicates(tenantId, scopeFilter, includeSuperseded, originProjects) {
-    // tenantId undefined = no tenant filter (legacy callers / cross-deployment
-    // helpers). tenantId set = strict tenant isolation, leveraging the composite
-    // idx_memories_tenant_created (leading column tenant_id, O(log n) lookup).
+    // tenantId undefined = no tenant filter (legacy callers / cross-deployment helpers); set = strict isolation via the composite idx_memories_tenant_created.
     const tenantPredicate = tenantId !== undefined ? ` AND m.tenant_id = ?` : '';
     const tenantOnlyPredicate = tenantId !== undefined ? ` WHERE tenant_id = ?` : '';
     const tenantParams = tenantId !== undefined ? [tenantId] : [];
     // Defensive: kind='archived' is a transient sentinel inside archiveRawMemory's SAVEPOINT, so this only
     // guards against a dropped SAVEPOINT, a persisted 'archived' state, or direct-SQL writes.
     const archivedClauseAlias = ` AND m.kind != 'archived'`;
-    // For the "tenant-only" path: if no tenant set, tenantOnlyPredicate is '',
-    // so prepend WHERE; if tenant set, append AND. handled in each call site
-    // by always joining `tenantOnlyPredicate + archivedClauseTenantOnly` where
-    // the latter switches between " AND" and " WHERE" based on caller context.
+    // Tenant-only path: with no tenant `tenantOnlyPredicate` is '', so the archived clause switches between ' AND' and ' WHERE' by caller context.
     const archivedClauseTenantOnly = tenantId !== undefined ? ` AND kind != 'archived'` : ` WHERE kind != 'archived'`;
     const aliasScope = withProject(recallScopeClause('m.', scopeFilter), 'm.', originProjects);
     const plainScope = withProject(recallScopeClause('', scopeFilter), '', originProjects);
@@ -98,11 +94,8 @@ function selectAllCandidates(db, p, limit) {
 function selectFtsCandidates(db, terms, p, limit) {
     try {
         const ftsQuery = terms.map((t) => `"${t.replace(/"/g, '""')}"`).join(' OR ');
-        // memories_fts virtual table has no tenant_id column; filter via the
-        // joined memories row (cheap with idx_memories_tenant_created leading
-        // on tenant_id).
-        // SAFETY: MEMORY_SEARCH_COLUMNS aliases every column to the same name
-        // MEMORY_SELECT_COLUMNS uses (plus bm25_score), matching MemoryRow.
+        // memories_fts has no tenant_id column; filter via the joined memories row (cheap with idx_memories_tenant_created).
+        // SAFETY: MEMORY_SEARCH_COLUMNS aliases every column like MEMORY_SELECT_COLUMNS (plus bm25_score), matching MemoryRow.
         return db.prepare(`
         SELECT ${MEMORY_SEARCH_COLUMNS}
         FROM memories m
@@ -146,47 +139,18 @@ function selectLikeCandidates(db, terms, p, limit) {
     LIMIT ?
   `).all(...p.tenantParams, ...p.scopeParams, Math.max(limit, LIKE_WINDOW_ROWS), ...params, limit);
 }
-/**
- * Load likely search candidates directly from SQLite.
- * Uses FTS5 when available, falls back to LIKE matching, then full-store fallback.
- *
- * When `tenantId` is provided, every SELECT (FTS join, LIKE, fallback) filters
- * by tenant_id. Cross-tenant memories never surface. Omitted = no filter.
- */
+/** Load likely search candidates: FTS5 when available, else LIKE, then full-store fallback. With `tenantId` every SELECT filters by it; omitted = no filter. */
 export function loadSearchEntries(hippoRoot, query, limit = DEFAULT_SEARCH_CANDIDATE_LIMIT, tenantId) {
-    const db = openStore(hippoRoot);
-    try {
+    return onHandle(hippoRoot, (db) => {
         return loadSearchRows(db, query, limit, tenantId).map(rowToEntry);
-    }
-    finally {
-        closeHippoDb(db);
-    }
+    }, openStore);
 }
-/**
- * Recall-mode loader. Pushes the recall-side scope predicate into SQL so
- * `unknown:legacy` cannot leak via any consumer that hasn't remembered to re-filter.
- *
- * - `requestedScope` undefined / '': default-deny on `unknown:legacy`, admitting `ownScope`, the caller's personal scope.
- * - `requestedScope` non-empty string: exact match on `m.scope = requestedScope`.
- *
- * Private scopes: SQL applies a conservative `NOT LIKE '%:private:%'` before the LIMIT window so private
- * rows cannot starve admitted ones; `passesScopeFilterForRecall` stays the exact JS post-filter.
- *
- * Consumers: `api.recall`, `cmdRecall`/`cmdExplain` direct CLI paths
- * and `searchBothHybrid` recall mode. Background pipelines
- * (`consolidate`, `embeddings`, `refine-llm`, ...) keep using
- * `loadSearchEntries` so they can see quarantined rows when needed.
- *
- * `tenantId` is optional because searchBothHybrid's is; undefined means no tenant filter.
- */
+/** Recall-mode loader: scope predicate in SQL so `unknown:legacy` cannot leak. Empty `requestedScope` default-denies (admits `ownScope`); else exact match.
+ * SQL `NOT LIKE '%:private:%'` runs before the LIMIT so private rows cannot starve admitted ones; `passesScopeFilterForRecall` is the exact post-filter. */
 export function loadRecallSearchEntries(hippoRoot, query, limit = DEFAULT_SEARCH_CANDIDATE_LIMIT, tenantId, requestedScope, explicitScopeMode = 'exact', includeSuperseded = true, originProjects, ownScope) {
-    const db = openStore(hippoRoot);
-    try {
+    return onHandle(hippoRoot, (db) => {
         return loadRecallSearchEntriesFromDb(db, query, { limit, tenantId, requestedScope, explicitScopeMode, includeSuperseded, originProjects, ownScope });
-    }
-    finally {
-        closeHippoDb(db);
-    }
+    }, openStore);
 }
 // Split out so callers with an already-open db (the prompt-recall path) skip
 // the initStore+open/close cycle per store per call.