hippo-memory 1.70.0 → 1.72.0

package/dist/sharing/search-both.js

@@ -0,0 +1,138 @@
+// Search across the local and global stores, merged into one ranked, budgeted list.
+import { compareScoresDesc } from '../core/compare.js';
+import * as fs from 'fs';
+import { loadSearchEntries, loadRecallSearchEntries, recallScopeFilter } from '../store/search-rows.js';
+import { passesScopeFilterForRecall, passesCliRecallScopeFilter } from '../core/recall-scope.js';
+import { search } from '../search/bm25-search.js';
+import { hybridSearch } from '../search/hybrid.js';
+import { fitBudget } from '../search/finalize.js';
+import { DEFAULT_LOCAL_BUMP, DEFAULT_RECALL_BUDGET } from '../core/search-types.js';
+import { startQueryEmbedDeadline } from '../search/vector.js';
+import { evalNow } from '../core/ablation.js';
+import { duplicateKey } from '../util/same-text.js';
+import { errorMessage, log } from '../util/log.js';
+// The rows are already copied; a failed background embed only delays vectors, so it warns instead of throwing.
+export function logEmbedAllFailure(caller, err) {
+    log.warn(`${caller}: background embed failed (${errorMessage(err)}); run 'hippo embed' to backfill`);
+}
+/** Search both local and global stores and merge: local results are boosted 1.2x to prefer project context.
+ *  Returns results sorted by adjusted score within the combined token budget. */
+export function searchBoth(query, localRoot, globalRoot, options = {}) {
+    const { budget = DEFAULT_RECALL_BUDGET, now = evalNow(), minResults, tenantId } = options;
+    const effectiveMin = minResults ?? 1;
+    const localEntries = fs.existsSync(localRoot) ? loadSearchEntries(localRoot, query, undefined, tenantId) : [];
+    const globalEntries = fs.existsSync(globalRoot) ? loadSearchEntries(globalRoot, query, undefined, tenantId) : [];
+    if (localEntries.length === 0 && globalEntries.length === 0)
+        return [];
+    // Search each store with full budget, then blend
+    const localResults = search(query, localEntries, { budget, now, minResults });
+    const globalResults = search(query, globalEntries, { budget, now, minResults });
+    const deduped = dedupeByContent(tagLocalAndGlobal(localResults, globalResults));
+    // PLAIN stable score sort on purpose: both inputs are deterministically ordered,
+    // and an exact tie keeps the LOCAL result ahead of the global one (concat order).
+    deduped.sort((a, b) => compareScoresDesc(a.score, b.score));
+    // Apply combined token budget (guarantee at least minResults items)
+    const results = [];
+    let usedTokens = 0;
+    for (let i = 0; i < deduped.length; i++) {
+        if (results.length >= effectiveMin && usedTokens + deduped[i].tokens > budget)
+            continue;
+        usedTokens += deduped[i].tokens;
+        results.push(deduped[i]);
+    }
+    return results;
+}
+function tagLocalAndGlobal(localResults, globalResults) {
+    // Tag global results. Local memories get a configurable priority bump.
+    return [
+        ...localResults.map((r) => ({
+            ...r,
+            isGlobal: false,
+            score: r.score * DEFAULT_LOCAL_BUMP,
+            breakdown: r.breakdown
+                ? { ...r.breakdown, sourceBump: DEFAULT_LOCAL_BUMP, final: r.breakdown.final * DEFAULT_LOCAL_BUMP }
+                : undefined,
+        })),
+        ...globalResults.map((r) => ({ ...r, isGlobal: true })),
+    ];
+}
+function dedupeByContent(tagged) {
+    // Remove duplicates by content (local/global IDs differ after promote/share)
+    const seen = new Set();
+    return tagged.filter((r) => {
+        const key = duplicateKey(r.entry.content);
+        if (seen.has(key))
+            return false;
+        seen.add(key);
+        return true;
+    });
+}
+/** Hybrid search across both local and global stores, using embeddings when available.
+ *  Async version of searchBoth that calls hybridSearch instead of search. */
+export async function searchBothHybrid(query, localRoot, globalRoot, options = {}) {
+    const { includeSuperseded, asOf, tenantId, entryFilter, recallScope } = options;
+    // With an admission filter, lift the per-store candidate cap (default 200) to a bounded 5000: excluded rows could otherwise fill the window first.
+    const searchWindow = entryFilter ? 5000 : undefined;
+    // Recall mode: push the scope predicate into SQL like api.recall, so quarantine/private rows never enter the candidates, shadow duplicates or use budget.
+    // The JS post-filter below is the regex-only `<source>:private:*` half plus defense in depth on exact match.
+    const loadEntries = (root) => {
+        if (!fs.existsSync(root))
+            return [];
+        return recallScope
+            ? loadRecallSearchEntries(root, query, searchWindow, tenantId, recallScope.requested, recallScope.additive ? 'additive' : 'exact', Boolean(includeSuperseded) || Boolean(asOf), undefined, recallScope.ownScope)
+            : loadSearchEntries(root, query, searchWindow, tenantId);
+    };
+    const passesScope = (e) => !recallScope || (recallScope.additive
+        ? passesCliRecallScopeFilter(e.scope ?? null, recallScope.requested) || passesScopeFilterForRecall(e.scope ?? null, undefined, recallScope.ownScope)
+        : passesScopeFilterForRecall(e.scope ?? null, recallScope.requested, recallScope.ownScope));
+    const admit = (e) => passesScope(e) && (!entryFilter || entryFilter(e));
+    const localEntries = loadEntries(localRoot).filter(admit);
+    const globalEntries = loadEntries(globalRoot).filter(admit);
+    // The vector arm loads under the same SQL rules as loadEntries, then the same JS admission.
+    const vectorCandidates = {
+        tenantId,
+        scope: recallScope ? recallScopeFilter(recallScope.requested, recallScope.additive ? 'additive' : 'exact', recallScope.ownScope) : undefined,
+        includeSuperseded: !recallScope || Boolean(includeSuperseded) || Boolean(asOf),
+        admit,
+    };
+    return rankBothStores(query, { local: localRoot, global: globalRoot }, { local: localEntries, global: globalEntries }, vectorCandidates, options);
+}
+/** Hybrid ranking of rows already loaded from each store: the local bump, one copy per text, then the shared budget. */
+export async function rankBothStores(query, roots, entries, vectorCandidates, options = {}) {
+    const { budget = DEFAULT_RECALL_BUDGET, now = evalNow(), embeddingWeight, explain, mmr, mmrLambda, localBump = DEFAULT_LOCAL_BUMP, minResults, cost, scope, includeSuperseded, asOf, summaryDeboost, summaryFreshness } = options;
+    if (entries.local.length === 0 && entries.global.length === 0)
+        return [];
+    // One deadline for both stores, so a provider that stalls on the first is not waited on again for the second.
+    const shared = {
+        budget, now, embeddingWeight, explain, mmr, mmrLambda, minResults, cost, scope, includeSuperseded, asOf, summaryDeboost, summaryFreshness,
+        vectorCandidates, queryEmbedDeadline: startQueryEmbedDeadline(),
+    };
+    const localResults = await hybridSearch(query, entries.local, { ...shared, hippoRoot: roots.local });
+    const globalResults = await hybridSearch(query, entries.global, { ...shared, hippoRoot: roots.global });
+    // Tag global results. Local memories get a configurable priority bump.
+    const tagged = [
+        ...localResults.map((r) => ({
+            ...r,
+            isGlobal: false,
+            score: r.score * localBump,
+            breakdown: r.breakdown
+                ? { ...r.breakdown, sourceBump: localBump, final: r.breakdown.final * localBump }
+                : undefined,
+        })),
+        ...globalResults.map((r) => ({ ...r, isGlobal: true })),
+    ];
+    // Remove duplicates by content (local/global IDs differ after promote/share)
+    const seen = new Set();
+    const deduped = tagged.filter((r) => {
+        const key = duplicateKey(r.entry.content);
+        if (seen.has(key))
+            return false;
+        seen.add(key);
+        return true;
+    });
+    // PLAIN stable score sort on purpose -- see searchBoth above;
+    // same rationale (deterministic inputs + stability; local-first on ties).
+    deduped.sort((a, b) => compareScoresDesc(a.score, b.score));
+    return fitBudget(deduped, budget, minResults ?? 1, cost);
+}
+//# sourceMappingURL=search-both.js.map

package/dist/sharing/share.d.ts

@@ -0,0 +1,40 @@
+import { MemoryEntry } from '../core/memory.js';
+/** Tags whose rows only a hand-run share or promote may copy to the global store; derived rows inherit them. */
+export declare const NEVER_AUTO_SHARE_TAGS: ReadonlySet<string>;
+export declare function neverAutoShareTags(sources: readonly MemoryEntry[]): string[];
+/** Tags whose rows sleep keeps as written: never merged, never sent to LLM extraction. Conflict detection keeps its own list. */
+export declare const NO_MERGE_TAGS: ReadonlySet<string>;
+/** The transfer score a memory needs before sleep or `hippo share --auto` copies it to the global store. */
+export declare const AUTO_SHARE_MIN_SCORE = 0.6;
+/** Estimate how well a memory would transfer to other projects.
+ *  Returns 0..1 where >0.5 = good candidate for sharing. */
+export declare function transferScore(entry: MemoryEntry): number;
+/** Share a memory to the global store with attribution (source enriched with project path and timestamp).
+ *  Returns the new entry, or null if the transfer score is too low. */
+export declare function shareMemory(localRoot: string, id: string, options?: {
+    force?: boolean;
+    tenantId?: string;
+    skipEmbed?: boolean;
+}): MemoryEntry | null;
+/** List all projects that contributed memories to the global store, parsed from 'shared:<project>:' or 'promoted:<path>' sources.
+ *  `tenantId` filters to one tenant; undefined is host-wide (legacy callers: CLI standalone, dashboard). */
+export declare function listPeers(globalRoot?: string, tenantId?: string): Array<{
+    project: string;
+    count: number;
+    latest: string;
+}>;
+type AutoShareStats = {
+    secretSkipped: number;
+    rejectedSkipped?: number;
+    neverAutoShareSkipped?: number;
+};
+/** Auto-share local memories with high transfer scores, not already global and without a NEVER_AUTO_SHARE_TAGS tag; `options.tenantId` scopes the LOCAL read.
+ *  `options.stats` is an opt-in out-param: `secretSkipped` counts shares the secret veto prevented, `rejectedSkipped` rejection refusals (0 under `dryRun`). */
+export declare function autoShare(localRoot: string, options?: {
+    minScore?: number;
+    dryRun?: boolean;
+    tenantId?: string;
+    stats?: AutoShareStats;
+}): MemoryEntry[];
+export {};
+//# sourceMappingURL=share.d.ts.map

package/dist/sharing/share.js

@@ -0,0 +1,229 @@
+// Sharing local memories to the global store: transfer scoring, share, peers and auto-share.
+import { BadRequestError, NotFoundError } from '../core/api-errors.js';
+import * as fs from 'fs';
+import * as path from 'path';
+import { generateId, COMPACTION_MEMORY_TAG } from '../core/memory.js';
+import { AGENT_MEMORY_SOURCE_PREFIX, AGENT_MEMORY_TAGS } from '../core/agent-memory-tools.js';
+import { writeEntriesSkippingRejected, writeEntry } from '../store/entry-writes.js';
+import { loadAllEntries, readEntry } from '../store/entry-reads.js';
+import { tallySources } from '../store/candidates.js';
+import { isPersonalScope } from '../core/recall-scope.js';
+import { fallbackOrigin } from '../core/project-identity.js';
+import { detectSecret } from '../util/secret-detect.js';
+import { isQuarantineScope } from '../trust/quarantine.js';
+import { embedMemory, embedAll } from '../search/embed-memories.js';
+import { duplicateKey, storedTextKeys } from '../util/same-text.js';
+import { isReusable } from '../core/memory-quality.js';
+import { log } from '../util/log.js';
+import { getGlobalRoot, initGlobal } from './global-store.js';
+import { logEmbedAllFailure } from './search-both.js';
+/** Tags that indicate project-specific memories (poor transfer candidates) */
+const PROJECT_SPECIFIC_TAGS = new Set([
+    'file-path', 'config', 'deploy', 'cron', 'url', 'auth',
+    'field-names', 'column-names', 'api-key', 'endpoint',
+]);
+/** Tags that indicate transferable memories (good transfer candidates) */
+const TRANSFERABLE_TAGS = new Set([
+    'error', 'platform', 'windows', 'encoding', 'python', 'shell',
+    'powershell', 'quant', 'backtest', 'pattern', 'rule', 'gotcha',
+    'sub-agent', 'review', 'best-practice',
+]);
+/** Tags whose rows only a hand-run share or promote may copy to the global store; derived rows inherit them. */
+export const NEVER_AUTO_SHARE_TAGS = new Set([
+    'git-learned',
+    'session-digest',
+    ...AGENT_MEMORY_TAGS,
+]);
+export function neverAutoShareTags(sources) {
+    return [...NEVER_AUTO_SHARE_TAGS].filter((tag) => sources.some((s) => s.tags.includes(tag)));
+}
+/** Tags whose rows sleep keeps as written: never merged, never sent to LLM extraction. Conflict detection keeps its own list. */
+export const NO_MERGE_TAGS = new Set([
+    'extracted',
+    'session-digest',
+    COMPACTION_MEMORY_TAG,
+    ...AGENT_MEMORY_TAGS,
+]);
+/** The transfer score a memory needs before sleep or `hippo share --auto` copies it to the global store. */
+export const AUTO_SHARE_MIN_SCORE = 0.6;
+/** Estimate how well a memory would transfer to other projects.
+ *  Returns 0..1 where >0.5 = good candidate for sharing. */
+export function transferScore(entry) {
+    let score = 0.5; // neutral default
+    // Boost for transferable tags
+    const transferableCount = entry.tags.filter((t) => TRANSFERABLE_TAGS.has(t)).length;
+    score += transferableCount * 0.1;
+    // Penalize for project-specific tags
+    const specificCount = entry.tags.filter((t) => PROJECT_SPECIFIC_TAGS.has(t)).length;
+    score -= specificCount * 0.15;
+    // High-retrieval memories are more likely to be universally useful
+    if (entry.retrieval_count >= 3)
+        score += 0.1;
+    // Pinned memories are important to their owner
+    if (entry.pinned)
+        score += 0.1;
+    // Error-tagged memories often encode universal lessons
+    if (entry.emotional_valence === 'negative' || entry.emotional_valence === 'critical')
+        score += 0.05;
+    return Math.min(1, Math.max(0, score));
+}
+/** Share a memory to the global store with attribution (source enriched with project path and timestamp).
+ *  Returns the new entry, or null if the transfer score is too low. */
+export function shareMemory(localRoot, id, options = {}) {
+    // tenantId is optional for single-tenant callers (autoShare passes only `{ force: true }`); MCP/REST hosts MUST pass it so tenant A cannot share
+    // tenant B's memory to global (readEntry returns null on a cross-tenant lookup).
+    const entry = readEntry(localRoot, id, options.tenantId);
+    if (!entry)
+        throw new NotFoundError(`Memory not found: ${id}`);
+    const globalEntry = toGlobalEntry(localRoot, entry, options.force === true);
+    if (!globalEntry)
+        return null;
+    initGlobal();
+    const globalRoot = getGlobalRoot();
+    writeEntry(globalRoot, globalEntry);
+    // Embed here unless the caller opts out: autoShare sets skipEmbed to batch one embedAll(), since embedMemory rewrites the whole index per call.
+    if (!options.skipEmbed) {
+        void embedMemory(globalRoot, globalEntry);
+    }
+    return globalEntry;
+}
+/** The global copy of a local row, or null when its transfer score is too low and `force` is off; throws when the row may not be shared. */
+function toGlobalEntry(localRoot, entry, force) {
+    assertShareable(entry, entry.id);
+    const score = transferScore(entry);
+    if (score < 0.3 && !force)
+        return null;
+    // The label keeps the folder name for a user-global row; a NULL row gets `shared::`, which originFromSource reads as no project.
+    const fallbackName = path.basename(path.resolve(localRoot, '..'));
+    const originName = entry.origin_project ?? fallbackOrigin(localRoot);
+    const label = originName === '' ? fallbackName : (originName ?? '');
+    return {
+        ...entry,
+        id: generateId('g'),
+        source: `shared:${label}:${new Date().toISOString()}`,
+        origin_project: originName,
+    };
+}
+function assertShareable(entry, id) {
+    // Secret veto: secrets never reach the global store, even with --force; throw loudly, since a silent null reads as "low transfer score" and invites retries.
+    const secret = detectSecret(entry);
+    if (secret.flagged) {
+        throw new BadRequestError(`Refusing to share ${id} to the global store: content matches secret material (${secret.reason}). ` +
+            `Secrets stay in their owning project's store.`);
+    }
+    // A quarantined row is unreviewed input, not a lesson; sharing it would spread poison globally.
+    if (isQuarantineScope(entry.scope)) {
+        throw new BadRequestError(`Refusing to share ${id}: it is quarantined pending review. Approve it first via 'hippo quarantine approve ${id}'.`);
+    }
+    if (isPersonalScope(entry.scope ?? null)) {
+        throw new BadRequestError(`Refusing to share ${id}: it is a personal memory and stays with its owner on this server.`);
+    }
+}
+/** List all projects that contributed memories to the global store, parsed from 'shared:<project>:' or 'promoted:<path>' sources.
+ *  `tenantId` filters to one tenant; undefined is host-wide (legacy callers: CLI standalone, dashboard). */
+export function listPeers(globalRoot, tenantId) {
+    const root = globalRoot ?? getGlobalRoot();
+    if (!fs.existsSync(root))
+        return [];
+    // Tenant-scoped by default when tenantId provided. Host-wide when
+    // undefined (preserves back-compat).
+    const tallies = tallySources(root, tenantId).sort((a, b) => (a.first < b.first ? -1 : a.first > b.first ? 1 : 0));
+    const peerMap = new Map();
+    for (const tally of tallies) {
+        let project = 'unknown';
+        if (tally.source.startsWith('shared:')) {
+            const parts = tally.source.split(':');
+            project = parts[1] || 'unknown';
+        }
+        else if (tally.source.startsWith('promoted:')) {
+            const promotedPath = tally.source.slice('promoted:'.length);
+            project = path.basename(path.resolve(promotedPath, '..'));
+        }
+        else if (tally.source === 'cli-global') {
+            project = 'global-cli';
+        }
+        const existing = peerMap.get(project);
+        if (!existing) {
+            peerMap.set(project, { count: tally.count, latest: tally.latest });
+        }
+        else {
+            existing.count += tally.count;
+            if (tally.latest > existing.latest)
+                existing.latest = tally.latest;
+        }
+    }
+    return Array.from(peerMap.entries())
+        .map(([project, data]) => ({ project, ...data }))
+        .sort((a, b) => b.count - a.count);
+}
+function isAutoShareCandidate(entry, globalContentSet, minScore, stats) {
+    // shareMemory refuses quarantined and personal rows; filtering here keeps sleep from aborting on one.
+    if (isQuarantineScope(entry.scope ?? null) || isPersonalScope(entry.scope ?? null) || !isReusable(entry))
+        return false;
+    // Before the score: these rows describe one project only, and a git seed's 'error' tag clears the bar.
+    if (entry.tags.some((t) => NEVER_AUTO_SHARE_TAGS.has(t)) || entry.source.startsWith(AGENT_MEMORY_SOURCE_PREFIX)) {
+        if (stats)
+            stats.neverAutoShareSkipped = (stats.neverAutoShareSkipped ?? 0) + 1;
+        return false;
+    }
+    const score = transferScore(entry);
+    if (score < minScore)
+        return false;
+    // Skip if already shared (same text apart from spacing)
+    if (globalContentSet.has(duplicateKey(entry.content)))
+        return false;
+    // Secret veto, checked LAST so the stats counter only counts rows it withheld (a row failing the score or dedupe gate was never going to share).
+    // shareMemory would throw here; filtering keeps the sleep pipeline fail-safe.
+    if (detectSecret(entry).flagged) {
+        if (stats)
+            stats.secretSkipped++;
+        return false;
+    }
+    return true;
+}
+// A row the GLOBAL store's rejection tombstones refuse is audited and skipped, so it cannot abort the autoShare sleep phase.
+// The candidates are rows already held, written in one transaction; the caller embeds once via embedAll() afterwards.
+function shareCandidates(localRoot, globalRoot, candidates, stats) {
+    const shared = [];
+    let rejectedSkipped = 0;
+    writeEntriesSkippingRejected(globalRoot, (put) => {
+        for (const entry of candidates) {
+            const globalEntry = toGlobalEntry(localRoot, entry, true);
+            if (!globalEntry)
+                continue;
+            if (put(globalEntry)) {
+                shared.push(globalEntry);
+                continue;
+            }
+            rejectedSkipped++;
+            if (stats)
+                stats.rejectedSkipped = (stats.rejectedSkipped ?? 0) + 1;
+        }
+    });
+    if (rejectedSkipped > 0) {
+        log.warn(`autoShare: skipped ${rejectedSkipped} candidate(s) refused by the global store's rejection tombstone`);
+    }
+    return shared;
+}
+/** Auto-share local memories with high transfer scores, not already global and without a NEVER_AUTO_SHARE_TAGS tag; `options.tenantId` scopes the LOCAL read.
+ *  `options.stats` is an opt-in out-param: `secretSkipped` counts shares the secret veto prevented, `rejectedSkipped` rejection refusals (0 under `dryRun`). */
+export function autoShare(localRoot, options = {}) {
+    const { minScore = AUTO_SHARE_MIN_SCORE, dryRun = false } = options;
+    const localEntries = loadAllEntries(localRoot, options.tenantId);
+    initGlobal();
+    const globalRoot = getGlobalRoot();
+    // Host-wide read. The global store IS the union across all tenants;
+    // per-tenant filtering on the global root would defeat the purpose.
+    const globalEntries = loadAllEntries(globalRoot);
+    // Build set of global content hashes to avoid duplicates
+    const globalContentSet = storedTextKeys(globalEntries);
+    const candidates = localEntries.filter((entry) => isAutoShareCandidate(entry, globalContentSet, minScore, options.stats));
+    if (dryRun)
+        return candidates;
+    const shared = shareCandidates(localRoot, globalRoot, candidates, options.stats);
+    if (shared.length > 0) {
+        void embedAll(globalRoot).catch((err) => logEmbedAllFailure('autoShare', err));
+    }
+    return shared;
+}
+//# sourceMappingURL=share.js.map

package/dist/store/ambient.js

@@ -1,12 +1,10 @@
-import { closeHippoDb } from '../db/index.js';
-import { strengthSql } from '../core/memory.js';
-import { scopeAdmitSql } from './recall-scope.js';
+import { strengthSql } from './rule-sql.js';
+import { scopeAdmitSql } from './rule-sql.js';
 import { SECRET_TAGS } from '../util/secret-detect.js';
-import { openStore } from './open.js';
+import { onHandle, openStore } from './open.js';
 import { jsonList } from './candidates.js';
 import { originInSql } from '../core/project-identity.js';
-import { isErrorTagged } from '../core/ambient.js';
-import { DAY_MS } from '../util/time.js';
+import { AMBIENT_FRESH_WINDOW_MS, HIGH_SCHEMA_FIT_ABOVE, isErrorTagged } from '../core/ambient.js';
 // SHORTCUT: mirrors loadContextCandidates' WHERE (request-path snapshots pin the match); share it once store.ts is split.
 function contextRowsWhere(tenantId, filter) {
     const where = ['tenant_id = ?', `COALESCE(superseded_by, '') = ''`, `COALESCE(kind, '') != 'archived'`];
@@ -40,9 +38,8 @@ function secretTaggedSql() {
 export function loadAmbientTallies(hippoRoot, tenantId, filter) {
     const { where, params } = contextRowsWhere(tenantId, filter);
     const secret = secretTaggedSql();
-    const sevenDaysAgo = new Date(filter.now.getTime() - 7 * DAY_MS).toISOString();
-    const db = openStore(hippoRoot);
-    try {
+    const freshAfter = new Date(filter.now.getTime() - AMBIENT_FRESH_WINDOW_MS).toISOString();
+    return onHandle(hippoRoot, (db) => {
         // SAFETY: one aggregate row whose columns are the aliases named below. Tag lists come back as one JSON array of
         // arrays and are counted in JS, which maps items through String() as parseJsonArray does.
         const row = db.prepare(`SELECT
@@ -50,7 +47,7 @@ export function loadAmbientTallies(hippoRoot, tenantId, filter) {
       COALESCE(SUM(${strengthSql(filter.now)}), 0) AS strengthSum,
       COALESCE(SUM(julianday(created) > julianday(?)), 0) AS fresh,
       COALESCE(SUM(emotional_valence IN ('negative', 'critical')), 0) AS negative,
-      COALESCE(SUM(COALESCE(schema_fit, 0.5) > 0.7), 0) AS highSchemaFit,
+      COALESCE(SUM(COALESCE(schema_fit, 0.5) > ?), 0) AS highSchemaFit,
       COALESCE(SUM(layer = 'semantic'), 0) AS semantic,
       COALESCE(SUM(layer = 'episodic'), 0) AS episodic,
       COALESCE(SUM(json_array_length(${jsonList('conflicts_with_json')})), 0) AS conflicts,
@@ -59,7 +56,7 @@ export function loadAmbientTallies(hippoRoot, tenantId, filter) {
       '[' || COALESCE(group_concat(${jsonList('tags_json')}, ','), '') || ']' AS tagLists
       FROM memories
       WHERE ${where.join(' AND ')}
-        AND ((${originInSql(filter.currentProject)} AND origin_project != '') OR NOT ${secret.sql})`).get(sevenDaysAgo, ...params, ...filter.currentProject, ...secret.params);
+        AND ((${originInSql(filter.currentProject)} AND origin_project != '') OR NOT ${secret.sql})`).get(freshAfter, HIGH_SCHEMA_FIT_ABOVE, ...params, ...filter.currentProject, ...secret.params);
         const tagCounts = new Map();
         let errors = 0;
         const lists = /* SAFETY: jsonList yields an array per row, joined into one array */ JSON.parse(row.tagLists);
@@ -84,9 +81,6 @@ export function loadAmbientTallies(hippoRoot, tenantId, filter) {
             maxDagLevel: Number(row.maxDagLevel),
             tagCounts,
         };
-    }
-    finally {
-        closeHippoDb(db);
-    }
+    }, openStore);
 }
 //# sourceMappingURL=ambient.js.map

package/dist/store/audit-event.d.ts

@@ -1,6 +1,6 @@
 import { openHippoDb } from '../db/index.js';
 import { type AuditOp } from './audit.js';
-import { RejectedValueError } from './rejection.js';
+import { RejectedValueError } from '../core/api-errors.js';
 import type { JsonValue } from '../util/json.js';
 export interface AuditOptions {
     readonly targetId?: string;
@@ -8,18 +8,10 @@ export interface AuditOptions {
     readonly actor?: string;
     readonly tenantId?: string;
 }
-/**
- * Emit an audit event for a mutation against `db`. Wrapped so a broken audit
- * log can never crash the surrounding mutation — the SQLite store is still the
- * source of truth and audit failures are diagnosable from the missing rows.
- */
+/** Emit an audit event for a mutation. Never throws: the SQLite store stays the source of truth,
+ * and a failed audit write shows up as missing rows. */
 export declare function audit(db: ReturnType<typeof openHippoDb>, op: AuditOp, options?: AuditOptions): void;
-/**
- * Refusal audit for the rejected-value guard. Written by the
- * transaction OWNER post-rollback — writeEntry's catch (no outer tx exists
- * there, so this lands in a fresh implicit transaction) and commitSupersede's
- * catch (after its own ROLLBACK) — never inside a scope the caller's own
- * rollback could claw back. Best-effort `audit()` semantics: never throws.
- */
+/** Refusal audit for the rejected-value guard, written by the transaction owner after rollback so the caller's own rollback cannot claw it back.
+ * Best-effort like `audit()`: never throws. */
 export declare function auditRejectionRefusal(db: ReturnType<typeof openHippoDb>, err: RejectedValueError, actor: string): void;
 //# sourceMappingURL=audit-event.d.ts.map

package/dist/store/audit-event.js

@@ -1,10 +1,7 @@
 import { resolveTenantId } from './tenant.js';
 import { appendAuditEvent, reportAuditWriteFailure } from './audit.js';
-/**
- * Emit an audit event for a mutation against `db`. Wrapped so a broken audit
- * log can never crash the surrounding mutation — the SQLite store is still the
- * source of truth and audit failures are diagnosable from the missing rows.
- */
+/** Emit an audit event for a mutation. Never throws: the SQLite store stays the source of truth,
+ * and a failed audit write shows up as missing rows. */
 export function audit(db, op, options = {}) {
     const { targetId, metadata, actor = 'cli', tenantId } = options;
     try {
@@ -21,13 +18,8 @@ export function audit(db, op, options = {}) {
         reportAuditWriteFailure(op, String(error), targetId);
     }
 }
-/**
- * Refusal audit for the rejected-value guard. Written by the
- * transaction OWNER post-rollback — writeEntry's catch (no outer tx exists
- * there, so this lands in a fresh implicit transaction) and commitSupersede's
- * catch (after its own ROLLBACK) — never inside a scope the caller's own
- * rollback could claw back. Best-effort `audit()` semantics: never throws.
- */
+/** Refusal audit for the rejected-value guard, written by the transaction owner after rollback so the caller's own rollback cannot claw it back.
+ * Best-effort like `audit()`: never throws. */
 export function auditRejectionRefusal(db, err, actor) {
     audit(db, 'reject_refusal', { targetId: err.entryId, metadata: { digest: err.digest, reason: err.reason }, actor, tenantId: err.tenantId });
 }

package/dist/store/audit.d.ts

@@ -1,22 +1,6 @@
-import { type MemoryEntry } from '../core/memory.js';
 import { type DatabaseSyncLike } from '../db/index.js';
 import type { JsonObject } from './working-memory.js';
 import { type KeysetPosition } from '../util/keyset.js';
-export type AuditSeverity = 'warning' | 'error';
-export interface AuditIssue {
-    memoryId: string;
-    content: string;
-    severity: AuditSeverity;
-    reason: string;
-}
-export interface AuditResult {
-    total: number;
-    issues: AuditIssue[];
-    clean: number;
-}
-export declare function auditMemory(entry: MemoryEntry, backsObject?: boolean): AuditIssue | null;
-/** `backing`: ids of memories that back an object (store.memoriesBackingObjects). */
-export declare function auditMemories(entries: MemoryEntry[], backing: ReadonlySet<string>): AuditResult;
 export declare const AUDIT_OPS: readonly ["remember", "recall", "promote", "supersede", "forget", "archive_raw", "auth_revoke", "auth_create", "outcome", "consolidate", "audit_prune", "summary_marked_dirty", "summary_marked_clean", "summary_rebuilt", "predict_create", "predict_close", "predict_baserate", "recall_autodebias_hint", "recall_autodebias_hint_no_class_match", "recall_autodebias_hint_tiebreak", "recall_anchor_detected_query_repeat", "recall_anchor_detected_memory_dominance", "recall_anchor_skipped_no_session", "recall_availability_detected", "decision_create", "decision_supersede", "decision_close", "incident_open", "incident_resolve", "incident_close", "process_create", "process_supersede", "process_close", "policy_create", "policy_supersede", "policy_close", "skill_create", "skill_supersede", "skill_close", "project_brief_create", "project_brief_supersede", "project_brief_close", "customer_note_create", "customer_note_supersede", "customer_note_close", "mv_rescue", "reject_value", "reject_refusal", "unreject_value", "conflict_resolve", "half_life_migrate", "dormant_restore", "auth_grant", "auth_ungrant", "quarantine", "quarantine_approve", "quarantine_reject", "agent_memory_restore", "agent_memory_set_aside", "project_merge", "project_repair", "quality_repair"];
 export type AuditOp = (typeof AUDIT_OPS)[number];
 export interface AppendAuditOpts {
@@ -66,11 +50,8 @@ export interface ListAuditAfterOpts {
     /** Omit for every tenant (deployment-wide export). */
     tenantId?: string;
 }
-/**
- * Cursor read: events with id > afterId, ascending by id. Ids are AUTOINCREMENT
- * and never reused, but deletes (retention prune) leave gaps, so resume from
- * the last id returned, never from a count.
- */
+/** Cursor read: events with id > afterId, ascending. Retention prune leaves gaps in the ids,
+ * so resume from the last id returned, never from a count. */
 export declare function listAuditEventsAfter(db: DatabaseSyncLike, opts: ListAuditAfterOpts): AuditEvent[];
 /** Latest time each target got a good outcome, from the audit rows, read on a handle of its own; unlike queryAuditEvents it has no row cap. */
 export declare function confirmedOutcomeTimes(hippoRoot: string, tenantId: string): Map<string, string>;