hippo-memory 1.70.0 → 1.72.0

package/dist/store/delete-and-batch.js

@@ -1,6 +1,9 @@
-import { AUTO_DELETABLE_SQL } from '../core/memory.js';
-import { openHippoDb, closeHippoDb, withWriteScope } from '../db/index.js';
-import { checkRejectionGuard, RejectedValueError } from './rejection.js';
+import { DEFAULT_TENANT_ID } from '../util/env.js';
+import { RawAppendOnlyError } from '../core/raw-append-only.js';
+import { AUTO_DELETABLE_SQL } from './rule-sql.js';
+import { closeHippoDb, withWriteScope } from '../db/index.js';
+import { checkRejectionGuard } from './rejection.js';
+import { RejectedValueError } from '../core/api-errors.js';
 import { markSummaryDirtyInTx } from './summary-dirty.js';
 import { insertDormantRow } from './dormant.js';
 import { log } from '../util/log.js';
@@ -8,21 +11,18 @@ import { MEMORY_SELECT_COLUMNS, rowToEntry } from './rows.js';
 import { audit } from './audit-event.js';
 import { deleteFtsRow, replaceFtsRows, stampOriginProject, upsertMemoryRow } from './entry-row.js';
 import { purgeMirrorBestEffort, mirrorBestEffort, writeMarkdownMirror } from './mirrors.js';
-import { openStore } from './open.js';
+import { onHandle, openStore } from './open.js';
 import { clock } from '../util/write-budget.js';
+import { chunked } from '../util/chunked.js';
 /** Tables whose rows keep a first-class object's backing memory in `memory_id` (ON DELETE SET NULL); tests/dormant-memories.test.ts pins it to the schema. */
 export const MEMORY_BACKED_TABLES = ['predictions', 'decisions', 'incidents', 'processes', 'policies', 'skills', 'project_briefs', 'customer_notes'];
 /** Deleting a memory that backs an object nulls the object's link, and no restore can repair it, so no automatic pass may. */
 const AUTOMATIC_DELETE_SQL = `${AUTO_DELETABLE_SQL}${MEMORY_BACKED_TABLES.map((t) => ` AND NOT EXISTS (SELECT 1 FROM ${t} WHERE ${t}.memory_id = memories.id)`).join('')}`;
 /** Ids of memories that back a first-class object, for passes that plan deletes before making them. A table missing from an older schema is skipped. */
 export function memoriesBackingObjects(hippoRoot) {
-    const db = openHippoDb(hippoRoot);
-    try {
+    return onHandle(hippoRoot, (db) => {
         return memoriesBackingObjectsOn(db);
-    }
-    finally {
-        closeHippoDb(db);
-    }
+    });
 }
 /** memoriesBackingObjects on the caller's handle. */
 export function memoriesBackingObjectsOn(db) {
@@ -42,25 +42,33 @@ export function memoriesBackingObjectsOn(db) {
     }
     return ids;
 }
-/**
- * db-scoped delete core, so a delete can compose inside a caller's transaction.
- * NO filesystem I/O: the caller's transaction may still roll back, and mirrors are written post-commit.
- *
- * `opts.suppressForgetAudit` (default false): `rejectValue` and `resolveConflict` set it because each
- * writes its own aggregate audit row, so a removed row must not ALSO emit a `forget` row.
- *
- * Returns `{tenantId, dagParentId}` for the removed row, or `null` if no row with `id`
- * existed or `automatic` refused it (pinned, raw, kept for good or backing an object at DELETE time, so a late pin wins).
- */
+// The abort text of trg_memories_raw_append_only (migration v14), the one place src matches it.
+const RAW_TRIGGER_TEXT = 'raw is append-only';
+function isRawTriggerAbort(cause) {
+    return cause instanceof Error && cause.message.includes(RAW_TRIGGER_TEXT);
+}
+/** Runs the DELETE and returns the rows it removed; the raw-row trigger's abort becomes RawAppendOnlyError. */
+function deleteMemoryRow(db, sql, id) {
+    try {
+        return Number(db.prepare(sql).run(id).changes ?? 0);
+    }
+    catch (cause) {
+        throw isRawTriggerAbort(cause) ? new RawAppendOnlyError(cause) : cause;
+    }
+}
+/** db-scoped delete core, composable inside a caller's transaction; NO filesystem I/O, mirrors are written post-commit. `suppressForgetAudit` is set by
+ * rejectValue and resolveConflict (own audit row). Returns `{tenantId, dagParentId}`, or null if absent or `automatic` refused it. */
 export function deleteEntryCore(db, id, opts) {
     // SAFETY: row's shape matches the three columns named in the SELECT above.
     const row = db
         .prepare(`SELECT id, tenant_id, dag_parent_id FROM memories WHERE id = ?`)
         .get(id);
-    if (!row?.id)
-        return null;
+    return row?.id ? deleteTargetRow(db, row, opts) : null;
+}
+function deleteTargetRow(db, row, opts) {
+    const { id } = row;
     const guard = opts?.automatic ? ` AND ${AUTOMATIC_DELETE_SQL}` : '';
-    if (Number(db.prepare(`DELETE FROM memories WHERE id = ?${guard}`).run(id).changes ?? 0) === 0)
+    if (deleteMemoryRow(db, `DELETE FROM memories WHERE id = ?${guard}`, id) === 0)
         return null;
     deleteFtsRow(db, id);
     if (!opts?.suppressForgetAudit) {
@@ -69,29 +77,16 @@ export function deleteEntryCore(db, id, opts) {
     // Forgetting a child of a summary marks the parent dirty. Not atomic with the DELETE, but
     // markSummaryDirtyInTx is idempotent, so the next child mutation re-marks the parent if this fails.
     if (row.dag_parent_id) {
-        markSummaryDirtyInTx(db, row.dag_parent_id, row.tenant_id ?? 'default', opts?.actor ?? 'cli');
+        markSummaryDirtyInTx(db, row.dag_parent_id, row.tenant_id ?? DEFAULT_TENANT_ID, opts?.actor ?? 'cli');
     }
-    return { tenantId: row.tenant_id ?? 'default', dagParentId: row.dag_parent_id ?? null };
+    return { tenantId: row.tenant_id ?? DEFAULT_TENANT_ID, dagParentId: row.dag_parent_id ?? null };
 }
-/**
- * Delete an entry from SQLite and mirrors.
- *
- * `opts.actor` defaults to 'cli'. The api.* layer threads `ctx.actor` so HTTP
- * callers land with `api_key:<key_id>` in the audit log without a duplicate
- * emit from the api wrapper.
- *
- * Thin wrapper over `deleteEntryCore` (open → core → mirrors → close);
- * behavior is byte-identical to the pre-split implementation for every
- * existing caller.
- */
+/** Delete an entry from SQLite and mirrors; thin wrapper over `deleteEntryCore` (open, core, mirrors, close).
+ * `opts.actor` defaults to 'cli'; the api layer threads `ctx.actor` so HTTP callers land as `api_key:<key_id>` in the audit log. */
 export function deleteEntry(hippoRoot, id, opts) {
-    const db = openStore(hippoRoot);
-    try {
+    return onHandle(hippoRoot, (db) => {
         return deleteEntryOn(db, hippoRoot, id, opts);
-    }
-    finally {
-        closeHippoDb(db);
-    }
+    }, openStore);
 }
 /** deleteEntry on the caller's open store, so a loop of deletes opens the store once; each delete still commits alone. */
 function deleteEntryOn(db, hippoRoot, id, opts) {
@@ -101,6 +96,35 @@ function deleteEntryOn(db, hippoRoot, id, opts) {
     purgeMirrorBestEffort(hippoRoot, id, false, 'deleteEntry');
     return true;
 }
+/** deleteEntry with `automatic` for each removal and its own forget row and reason, all in one transaction after one read of the id set.
+ *  Returns the ids deleted, in `removals` order; a missing, repeated, pinned, raw or object-backing id is left out. */
+export function deleteEntriesAutomatically(hippoRoot, removals, actor) {
+    if (removals.length === 0)
+        return [];
+    const deleted = onHandle(hippoRoot, (db) => withWriteScope(db, 'delete_entries_automatically', () => {
+        const rows = selectDeleteTargets(db, removals.map((removal) => removal.id));
+        return removals
+            .filter(({ id, reason }) => {
+            const row = rows.get(id);
+            return row !== undefined && deleteTargetRow(db, row, { actor, reason, automatic: true }) !== null;
+        })
+            .map((removal) => removal.id);
+    }), openStore);
+    for (const id of deleted)
+        purgeMirrorBestEffort(hippoRoot, id, false, 'deleteEntry');
+    return deleted;
+}
+function selectDeleteTargets(db, ids) {
+    const rows = new Map();
+    for (const chunk of chunked([...new Set(ids)])) {
+        // SAFETY: rows' shape matches the three columns named in the SELECT.
+        const found = db.prepare(`SELECT id, tenant_id, dag_parent_id FROM memories WHERE id IN (${chunk.map(() => '?').join(',')})`)
+            .all(...chunk);
+        for (const row of found)
+            rows.set(row.id, row);
+    }
+    return rows;
+}
 // The child fields a level-2/3 summary is built from (loadChildrenOfSummary, generateDagSummary).
 const SUMMARY_INPUTS = ['content', 'created', 'dag_parent_id', 'kind'];
 function mergeOwnChanges(base, ours, live) {
@@ -112,26 +136,17 @@ function mergeOwnChanges(base, ours, live) {
     }
     return row;
 }
-/** Writes, deletes and dormant moves in one transaction. With `snapshot` (rows as the caller loaded them), a write keeps only
- *  the fields the caller changed, takes the rest from the live row, and never resurrects a row that is gone.
- *
- *  `dormant` (src/store/dormant.ts): each move's snapshot is inserted into `dormant_memories` and its `memories` row
- *  leaves exactly like a delete (FTS row, DAG parent dirty-mark, mirrors), in the same transaction, so a memory
- *  is never in both places or in neither. Deletes and moves both skip rows that are no longer auto-deletable
- *  (pinned, raw, kept for good or backing an object since the caller decided). Returns the ids that left `memories`, deleted or moved. */
+/** Writes, deletes and dormant moves in one transaction. With `snapshot`, a write keeps only the fields the caller changed and never resurrects a gone row.
+ * Dormant moves (src/store/dormant.ts) leave `memories` like a delete; both skip rows no longer auto-deletable. Returns ids that left `memories`. */
 export function batchWriteAndDelete(hippoRoot, toWrite, toDeleteIds, opts) {
     const dormant = opts?.dormant ?? [];
     if (toWrite.length === 0 && toDeleteIds.length === 0 && dormant.length === 0)
         return [];
-    const db = openStore(hippoRoot);
-    try {
+    return onHandle(hippoRoot, (db) => {
         // One component, so every op keeps the statement order this call has always had.
         const all = { writes: toWrite, deletes: toDeleteIds, dormant };
         return batchWriteAndDeleteOn(db, hippoRoot, [all], 0, { snapshot: opts?.snapshot, holdMs: Infinity }).removedIds;
-    }
-    finally {
-        closeHippoDb(db);
-    }
+    }, openStore);
 }
 const failedUnits = new WeakMap();
 /** Tags a flush error with the ids of the component it stopped at, for the partial sleep audit row; the first tag wins. */
@@ -149,7 +164,13 @@ export function failedUnitOf(err) {
  *  first component boundary after `holdMs`. Returns the next component's index and the ids that left `memories`. */
 function batchWriteAndDeleteOn(db, hippoRoot, components, from, opts) {
     const now = opts.clock ?? clock;
-    const out = { written: [], removedIds: [], rejectedSkips: 0, fts: { rows: [], staleIds: [] }, dirty: { parents: new Set(), tenantById: new Map() } };
+    const out = {
+        written: [],
+        removedIds: [],
+        rejectedSkips: 0,
+        fts: { rows: [], staleIds: [] },
+        dirty: { parents: new Set(), tenantById: new Map() }
+    };
     let next = from;
     // IMMEDIATE: the tombstone probes below read before the first write, and under a deferred BEGIN a
     // concurrent `hippo reject` would make the lock upgrade fail with SQLITE_BUSY and roll back the batch.
@@ -171,7 +192,7 @@ function batchWriteAndDeleteOn(db, hippoRoot, components, from, opts) {
         // Fire dirty-mark for every collected parent INSIDE the BEGIN, so the
         // dirty flag commits atomically with the writes + deletes.
         for (const parentId of out.dirty.parents) {
-            markSummaryDirtyInTx(db, parentId, out.dirty.tenantById.get(parentId) ?? 'default', 'batch');
+            markSummaryDirtyInTx(db, parentId, out.dirty.tenantById.get(parentId) ?? DEFAULT_TENANT_ID, 'batch');
         }
     });
     reportChunk(hippoRoot, out);
@@ -231,7 +252,7 @@ function selectAutoDeletableRows(db, ids, dirty) {
     for (const row of rows) {
         if (row.dag_parent_id) {
             dirty.parents.add(row.dag_parent_id);
-            dirty.tenantById.set(row.dag_parent_id, row.tenant_id ?? 'default');
+            dirty.tenantById.set(row.dag_parent_id, row.tenant_id ?? DEFAULT_TENANT_ID);
         }
     }
     return rows;
@@ -272,7 +293,7 @@ function applyBatchWrites(db, stampedWrites, snapshot, out) {
 }
 /** True, after auditing the refusal, when the write would introduce a rejected value. */
 function isRejectedBatchWrite(db, row) {
-    const entryTenantId = row.tenantId ?? 'default';
+    const entryTenantId = row.tenantId ?? DEFAULT_TENANT_ID;
     // checkRejectionGuard, not a bare tombstone probe: a tombstone can coexist with a live same-content row,
     // and skipping every re-persist would starve it of decay/replay updates; only new or changed content is refused.
     try {
@@ -291,16 +312,12 @@ function isRejectedBatchWrite(db, row) {
 export function deleteEntriesOneByOne(hippoRoot, targets, opts) {
     if (targets.length === 0)
         return [];
-    const db = openStore(hippoRoot);
-    try {
+    return onHandle(hippoRoot, (db) => {
         return targets.map((target) => deleteEntryOn(db, hippoRoot, target.id, { ...opts, reason: target.reason }));
-    }
-    finally {
-        closeHippoDb(db);
-    }
+    }, openStore);
 }
-/** Commits whole components in transactions of about `budget.holdMs` on one store handle, letting other writers in between; returns the ids that left `memories`.
- *  The snapshot keeps what other writers changed after the caller loaded its rows. */
+/** Commits whole components in transactions of about `budget.holdMs`, letting other writers in between; returns the ids that left `memories`.
+ * The snapshot keeps what other writers changed after the caller loaded its rows. */
 export async function commitInChunks(hippoRoot, components, opts) {
     if (components.length === 0)
         return [];

package/dist/store/delivery-recorder.d.ts

@@ -1,8 +1,8 @@
 import type { MemoryEntry } from '../core/memory.js';
 import { type PromptRecallGate } from '../core/prompt-recall.js';
 export type DeliveryRuntime = 'claude-code' | 'codex' | 'copilot' | 'unknown';
-export type DeliveryEventType = 'prompt-submit' | 'pinned-manual' | 'pre-compact' | 'compact-resume';
-/** True for the two compaction boundary types. */
+export type DeliveryEventType = 'prompt-submit' | 'pinned-manual' | 'pre-compact' | 'compact-resume' | 'session-end' | 'context' | 'tool-failure';
+/** True for the boundary types: a compaction's two hooks and the end of a session. */
 export declare const isBoundaryEvent: (type: DeliveryEventType) => boolean;
 export type DeliverySurface = 'hook' | 'context';
 export type DeliveryWriteStore = 'local' | 'global';
@@ -12,8 +12,9 @@ export type DeliveryPool = 'pin' | 'recent' | 'prompt-recall' | 'strength' | 'se
 export type DeliveryStage = 'load' | 'eligible' | 'gate' | 'budget' | 'limit' | 'final';
 export type DeliveryOutcome = 'emitted' | 'reused' | 'rejected';
 export type DeliveryRejectReason = 'budget' | 'gate-below-threshold' | 'gate-max-items' | 'duplicate' | 'scope' | 'quality' | 'limit';
-/** Row format version in `delivery_events.ledger_version`: 2 = written by a binary that can write boundary rows, so `event_type` has four values. */
-export declare const DELIVERY_LEDGER_VERSION = 2;
+/** Row format version in `delivery_events.ledger_version`: 4 = written by a binary that can write `tool-failure` rows and hashes the
+ * store's resolved root. */
+export declare const DELIVERY_LEDGER_VERSION = 4;
 /** Rejected candidate rows kept per event; the rest only add to `rejected_unlisted`. */
 export declare const DELIVERY_REJECTED_ROW_CAP = 16;
 export interface DeliveryCandidateInput {
@@ -61,6 +62,10 @@ export interface DeliveryEventInput {
     recallHash: string | null;
     emittedHash: string | null;
     elapsedMs: number;
+    /** The host's id for the tool call; set on `tool-failure` rows only. */
+    toolUseId?: string | null;
+    /** The `failure_log` row the failure was logged as; set on `tool-failure` rows only. */
+    failureId?: number | null;
     candidates: readonly DeliveryCandidateInput[];
 }
 export interface DeliveryFacts {
@@ -98,6 +103,10 @@ export interface DeliveryObserver {
         };
     }[]): void;
     selected(items: readonly DeliverySelected[]): void;
+    /** A searching call's query, `*` for none; kept as its hash, the one the recall trace stores. */
+    queried(query: string): void;
+    /** The recall trace a call that returned rows wrote; null when the write failed or the store answers no id. */
+    traced(traceId: number | null): void;
 }
 /** What the renderer sent, reported once at its exit. */
 export interface DeliveryOutcomeInput {
@@ -112,6 +121,8 @@ export interface DeliveryOutcomeInput {
 export interface DeliveryRecorder extends DeliveryObserver {
     readonly root: string;
     delivered(outcome: DeliveryOutcomeInput): void;
+    /** The failure log row id a `tool-failure` event links to; null when the log write threw. */
+    logged(failureId: number | null): void;
     /** Builds the event and hands it to `write` once per call; throws on an injected fault, and writes nothing once broken. */
     flush(write: (input: DeliveryEventInput) => number | null): void;
 }

package/dist/store/delivery-recorder.js

@@ -1,12 +1,15 @@
 import { evalNow } from '../core/ablation.js';
 import { scoreOverlap } from '../core/prompt-recall.js';
-import { hookPayloadSessionId, hookPayloadString, isSubagentPayload } from './token-ledger.js';
+import { hookPayloadSessionId, hookPayloadString, isSubagentPayload } from '../util/hook-payload.js';
 import { blockHash, estimateTokens } from '../util/token-text.js';
-import { errorMessage } from '../util/log.js';
-/** True for the two compaction boundary types. */
-export const isBoundaryEvent = (type) => type === 'pre-compact' || type === 'compact-resume';
-/** Row format version in `delivery_events.ledger_version`: 2 = written by a binary that can write boundary rows, so `event_type` has four values. */
-export const DELIVERY_LEDGER_VERSION = 2;
+import { errorMessage, log } from '../util/log.js';
+/** True for the boundary types: a compaction's two hooks and the end of a session. */
+export const isBoundaryEvent = (type) => type === 'pre-compact' || type === 'compact-resume' || type === 'session-end';
+/** Only the per-prompt calls keep prompt facts; a boundary or a `hippo context` run is not a prompt. */
+const carriesPrompt = (type) => type === 'prompt-submit' || type === 'pinned-manual';
+/** Row format version in `delivery_events.ledger_version`: 4 = written by a binary that can write `tool-failure` rows and hashes the
+ * store's resolved root. */
+export const DELIVERY_LEDGER_VERSION = 4;
 /** Rejected candidate rows kept per event; the rest only add to `rejected_unlisted`. */
 export const DELIVERY_REJECTED_ROW_CAP = 16;
 // Deeper stages were closer to being sent, so the row cap keeps them first.
@@ -33,10 +36,13 @@ function readPayload(init) {
     const rawTurnId = hookPayloadString(init.stdinText, 'turn_id');
     const hostTurnId = rawTurnId !== null && rawTurnId.trim() !== '' ? rawTurnId : null;
     const hookEvent = hookPayloadString(init.stdinText, 'hook_event_name');
+    const rawToolUseId = hookPayloadString(init.stdinText, 'tool_use_id')?.trim() ?? '';
+    // Cut as failure_log cuts its payload fields: the payload is not trusted to be short.
+    const toolUseId = rawToolUseId !== '' ? rawToolUseId.slice(0, 128) : null;
     const sessionState = subagent
         ? 'subagent'
         : payloadSession !== null ? 'payload' : envSession !== null ? 'env' : 'missing';
-    return { payloadSession, envSession, prompt, hostTurnId, hookEvent, sessionState };
+    return { payloadSession, envSession, prompt, hostTurnId, hookEvent, toolUseId, sessionState };
 }
 function rejectId(state, id, rejection) {
     const { stage, reason, score, tokens } = rejection;
@@ -46,15 +52,22 @@ function rejectId(state, id, rejection) {
         return;
     state.candidates.set(id, { ...held, stage, reason, score, tokens });
 }
+function pickedPool(p, held) {
+    if (p.promptRecall)
+        return 'prompt-recall';
+    // A ranked call's rows keep the ranking that chose them, a pinned hit included.
+    if (held?.pool === 'search' || held?.pool === 'strength')
+        return held.pool;
+    return held?.pool === 'pin' || p.entry.pinned ? 'pin' : 'recent';
+}
 function pickedRows(state) {
     const staticReused = state.outcome.staticReused === true;
     const rows = [];
     for (const p of state.picked.values()) {
-        const held = state.candidates.get(p.entry.id);
         rows.push({
             memoryId: p.entry.id,
             sourceStore: p.sourceStore,
-            pool: p.promptRecall ? 'prompt-recall' : held?.pool === 'pin' || p.entry.pinned ? 'pin' : 'recent',
+            pool: pickedPool(p, state.candidates.get(p.entry.id)),
             stage: 'final',
             outcome: staticReused && !p.promptRecall ? 'reused' : 'emitted',
             reason: null,
@@ -92,14 +105,14 @@ function buildEvent(init, payload, state, ts, startedMs) {
     const rows = [...picked, ...rejected.rows];
     const emitted = outcome.emittedText ?? null;
     const eventType = init.eventType ?? (payload.hookEvent === 'UserPromptSubmit' ? 'prompt-submit' : 'pinned-manual');
-    // A boundary row carries no prompt facts, whatever the payload holds.
-    const prompt = isBoundaryEvent(eventType) ? null : payload.prompt;
+    // Whatever the payload holds, so a hook-run `hippo context` is never matched to an earlier row by its prompt.
+    const prompt = carriesPrompt(eventType) ? payload.prompt : null;
     return {
         ts,
         tenantId: init.tenantId,
         runtime: init.runtime ?? (payload.hostTurnId !== null ? 'codex' : payload.hookEvent !== null ? 'claude-code' : 'unknown'),
         eventType,
-        surface: 'hook',
+        surface: eventType === 'context' ? 'context' : 'hook',
         storeHash: init.storeHash,
         writeStore: init.writeStore,
         projectHash: facts !== null && facts.projectName !== '' ? blockHash(facts.projectName) : null,
@@ -108,8 +121,8 @@ function buildEvent(init, payload, state, ts, startedMs) {
         hostTurnId: payload.hostTurnId,
         promptHash: prompt !== null ? blockHash(prompt) : null,
         promptLength: prompt?.length ?? 0,
-        queryHash: null,
-        recallTraceId: null,
+        queryHash: state.queryHash,
+        recallTraceId: state.recallTraceId,
         blockState: state.disabledSeen ? 'disabled' : outcome.state,
         promptRecall: facts?.promptRecall === true,
         consideredCount: new Set([...state.candidates.keys(), ...state.picked.keys()]).size,
@@ -127,6 +140,8 @@ function buildEvent(init, payload, state, ts, startedMs) {
         recallHash: outcome.recallHash ?? null,
         emittedHash: emitted !== null ? blockHash(emitted) : null,
         elapsedMs: Math.max(0, Date.now() - startedMs),
+        toolUseId: eventType === 'tool-failure' ? payload.toolUseId : null,
+        failureId: eventType === 'tool-failure' ? state.failureId : null,
         candidates: rows,
     };
 }
@@ -196,7 +211,7 @@ export function createDeliveryRecorder(init) {
     const payload = readPayload(init);
     const state = {
         candidates: new Map(), picked: new Map(), filtered: new Set(), facts: null, shown: 0, dropped: 0,
-        disabledSeen: false, outcome: { state: 'empty' }, broken: null, flushed: false,
+        disabledSeen: false, outcome: { state: 'empty' }, queryHash: null, recallTraceId: null, failureId: null, broken: null, flushed: false,
     };
     const guard = guardFor(state, fault);
     const { qualityDropped, offer, reject, dropMissing, gated, selected } = candidateMethods(state, guard);
@@ -217,14 +232,16 @@ export function createDeliveryRecorder(init) {
         dropMissing,
         gated,
         selected,
+        queried: (query) => guard(() => { state.queryHash = blockHash(query); }),
+        traced: (traceId) => guard(() => { state.recallTraceId = traceId; }),
         delivered: (o) => guard(() => { state.outcome = { ...o }; }),
+        logged: (failureId) => guard(() => { state.failureId = failureId; }),
         flush: (write) => {
             if (state.flushed)
                 return;
             state.flushed = true;
             if (state.broken !== null) {
-                // Same pinned `[hippo] delivery ledger` hook stderr line as recall-trace.ts's write failure.
-                console.error(`[hippo] delivery ledger skipped: recorder failed: ${state.broken}`);
+                log.warn(`delivery ledger skipped: recorder failed: ${state.broken}`);
                 return;
             }
             if (fault === 'build')

package/dist/store/descendant-page.js

@@ -1,4 +1,5 @@
-import { chunked, selectEntriesByIds, TENANT_IS } from './entry-reads.js';
+import { selectEntriesByIds, TENANT_IS } from './entry-reads.js';
+import { chunked } from '../util/chunked.js';
 import { MEMORY_SELECT_COLUMNS, rowToEntry } from './rows.js';
 const marks = (ids) => ids.map(() => '?').join(',');
 /** The walk `summaryWithDescendants` documents, with `levels` cut to the first `page.rows` rows and each level's full count in `sizes`. */
@@ -53,7 +54,8 @@ function countedLevel(db, walk, parents, room) {
     const perParent = new Map();
     for (const chunk of chunked([...parents])) {
         // SAFETY: the SELECT names exactly ChildGroup's four fields, and the WHERE keeps dag_parent_id a string.
-        const groups = db.prepare(`SELECT dag_parent_id, scope, origin_project, COUNT(*) AS n FROM memories WHERE dag_parent_id IN (${marks(chunk)}) AND ${TENANT_IS} AND id <> ? GROUP BY dag_parent_id, scope, origin_project`).all(...chunk, walk.tenantId, walk.summary.id);
+        const groups = db.prepare(`SELECT dag_parent_id, scope, origin_project, COUNT(*) AS n FROM memories ` +
+            `WHERE dag_parent_id IN (${marks(chunk)}) AND ${TENANT_IS} AND id <> ? GROUP BY dag_parent_id, scope, origin_project`).all(...chunk, walk.tenantId, walk.summary.id);
         for (const group of groups) {
             if (!walk.page.admit(group))
                 return null;
@@ -85,7 +87,8 @@ function childrenInOrder(db, walk, parents, limit) {
     const byParent = new Map();
     for (const chunk of chunked([...parents])) {
         // SAFETY: selects exactly MEMORY_SELECT_COLUMNS, matching MemoryRow's field set.
-        const rows = db.prepare(`SELECT ${MEMORY_SELECT_COLUMNS} FROM memories WHERE dag_parent_id IN (${marks(chunk)}) AND ${TENANT_IS} AND id <> ? ORDER BY created ASC, id ASC LIMIT ?`).all(...chunk, walk.tenantId, walk.summary.id, limit);
+        const rows = db.prepare(`SELECT ${MEMORY_SELECT_COLUMNS} FROM memories WHERE dag_parent_id IN (${marks(chunk)}) AND ${TENANT_IS} AND id <> ? ` +
+            `ORDER BY created ASC, id ASC LIMIT ?`).all(...chunk, walk.tenantId, walk.summary.id, limit);
         for (const row of rows) {
             const bucket = byParent.get(row.dag_parent_id ?? '');
             if (bucket)

package/dist/store/diagnostics.js

@@ -1,5 +1,6 @@
 // What `hippo doctor` and `hippo support-bundle` read from a store: one read-only open each, plain data out.
-import { closeHippoDb, countTableRows, ftsRowCounts, getMeta, getSchemaVersion, openHippoDbReadOnly } from '../db/index.js';
+import { countTableRows, ftsRowCounts, getMeta, getSchemaVersion, openHippoDbReadOnly } from '../db/index.js';
+import { onHandle } from './open.js';
 import { listTableNames } from '../db/tables.js';
 import { errorMessage } from '../util/log.js';
 import { compactionCountsAt, tokenTallySince } from './doctor-reads.js';
@@ -16,8 +17,7 @@ function attempt(read) {
 }
 /** Everything `hippo doctor` reads from one store; throws when it cannot be opened or its schema version read. */
 export function readStoreHealth(hippoRoot, cutoffs) {
-    const db = openHippoDbReadOnly(hippoRoot);
-    try {
+    return onHandle(hippoRoot, (db) => {
         return {
             schemaVersion: getSchemaVersion(db),
             memories: countTableRows(db, 'memories'),
@@ -28,24 +28,17 @@ export function readStoreHealth(hippoRoot, cutoffs) {
             lastSleep: attempt(() => lastConsolidationAt(db)),
             compactions: attempt(() => compactionCountsAt(db, cutoffs.stuckBefore, cutoffs.transcriptFloor)),
         };
-    }
-    finally {
-        closeHippoDb(db);
-    }
+    }, openHippoDbReadOnly);
 }
 /** Schema version, oldest allowed binary and row count of every table, for a support bundle; never reads a memory column. */
 export function readStoreInventory(hippoRoot) {
-    const db = openHippoDbReadOnly(hippoRoot);
-    try {
+    return onHandle(hippoRoot, (db) => {
         const schemaVersion = getSchemaVersion(db);
         const minCompatibleBinary = getMeta(db, 'min_compatible_binary', '') || null;
         const tables = {};
         for (const name of listTableNames(db))
             tables[name] = countTableRows(db, name);
         return { schemaVersion, minCompatibleBinary, tables };
-    }
-    finally {
-        closeHippoDb(db);
-    }
+    }, openHippoDbReadOnly);
 }
 //# sourceMappingURL=diagnostics.js.map

package/dist/store/dormant.d.ts

@@ -1,27 +1,12 @@
-/**
- * Dormant memories: what sleep does with a faded memory instead of deleting
- * it (config `dormant.enabled`, on by default; `retentionDays` bounds how
- * long one is kept).
- *
- * A dormant memory keeps its full content in `dormant_memories` (schema v44)
- * but is no longer a `memories` row, so recall, context, every sleep pass and
- * every other reader of `memories` stop seeing it exactly as if it had been
- * deleted. `hippo dormant` lists and searches them, `hippo dormant restore`
- * brings one back, `hippo dormant forget` deletes one for good.
- *
- * Not to be confused with the raw archive (`raw_archive`, `archiveRawMemory`,
- * `hippo forget --archive`): that path removes a raw receipt's content and
- * keeps only its metadata. A dormant memory keeps its content.
- *
- * The db-taking helpers leave the handle and any transaction to the caller.
- * The hippoRoot-taking functions at the end open one of their own, for
- * api.listDormant / restoreDormant / forgetDormant / isDormant.
- */
+/** Dormant memories: what sleep does with a faded memory instead of deleting it (config `dormant.enabled`; `retentionDays` bounds how long one is kept).
+ * Content stays in `dormant_memories` (schema v44) and the `memories` row goes, so every reader of `memories` stops seeing it, as if deleted.
+ * Not the raw archive (`raw_archive`, `archiveRawMemory`), which keeps metadata only. db-taking helpers leave the handle and transaction to the caller. */
 import { type DatabaseSyncLike } from '../db/index.js';
 import type { MemoryEntry } from '../core/memory.js';
-import type { SqlFragment } from './recall-scope.js';
+import type { SqlFragment } from './rule-sql.js';
 import type { WriteBudget } from '../util/write-budget.js';
-/** Why a memory went dormant: sleep's decay pass, an imported agent memory whose note was deleted, `hippo projects repair` splitting a two-project merge, or `hippo audit repair` setting aside an automatic memory with a certain defect. */
+/** Why a memory went dormant: sleep's decay pass, an imported agent memory whose note was deleted, `hippo projects repair`
+ * splitting a two-project merge, or `hippo audit repair` setting aside an automatic memory with a certain defect. */
 export type DormantReason = 'decay' | 'source-deleted' | 'project-repair' | 'quality-repair';
 /** One memory that sleep is moving out of active memory into the dormant store. */
 export interface DormantMove {
@@ -53,11 +38,7 @@ export interface ListDormantOpts {
     /** Maximum rows returned, newest first. Default 20. */
     limit?: number;
 }
-/**
- * Insert (or refresh) the dormant snapshot for `move.entry`. Does not touch
- * the `memories` row: the caller deletes it in the same transaction, so the
- * memory is never in both places or in neither.
- */
+/** Insert (or refresh) the dormant snapshot for `move.entry`; the caller deletes the `memories` row in the same transaction. */
 export declare function insertDormantRow(db: DatabaseSyncLike, move: DormantMove): void;
 /** A dormant memory's stored snapshot plus when and why it went dormant. */
 export interface DormantSnapshot {
@@ -66,10 +47,7 @@ export interface DormantSnapshot {
     strength: number;
     dormantAt: string;
 }
-/**
- * The stored snapshot for a tenant's dormant memory, or null when the tenant
- * has no dormant memory with that id (another tenant's id reads as absent).
- */
+/** A tenant's stored dormant snapshot, or null when it has none with that id (another tenant's id reads as absent). */
 export declare function readDormantSnapshot(db: DatabaseSyncLike, tenantId: string, id: string): DormantSnapshot | null;
 /** Every dormant memory of a tenant whose snapshot still reads back. */
 export declare function listDormantSnapshots(db: DatabaseSyncLike, tenantId: string): DormantSnapshot[];