hippo-memory 1.70.0 → 1.72.0

package/dist/store/predictions.js

@@ -1,41 +1,21 @@
-/**
- * Prediction first-class object.
- *
- * Canonical store for ex-ante claims that can be closed against ex-post
- * outcomes. The `predictions` table holds every field (including
- * `claim_text`); a memory row mirrors the claim for recall/inspect surfaces
- * but is NOT the source of truth — ON DELETE SET NULL on memory_id means
- * memory deletion gracefully orphans the prediction without losing data.
- *
- * Tenant scoping: every helper requires tenantId. The schema's BEFORE INSERT
- * + BEFORE UPDATE triggers (`trg_predictions_tenant_match_*`) enforce that
- * `predictions.tenant_id` matches the referenced memory's tenant_id when
- * `memory_id IS NOT NULL`. Cross-tenant references are unrepresentable at
- * the schema level.
- *
- * Dual-write atomicity: `savePrediction` writes the memory + predictions
- * row inside `writeEntry`'s SAVEPOINT 'write_entry' (store/entry-writes.ts). The
- * afterWrite hook (store/entry-writes.ts) runs inside the same SAVEPOINT, so
- * a failure in either step rolls back both. Pattern matches supersede
- * (api.ts:1486) and the Slack/GitHub connectors.
- *
- * The planning-fallacy detector reads `loadPredictionsByClass` and computes
- * per-class base rates from (estimate_value, actual_value) at query time.
- */
+/** First-class prediction: an ex-ante claim closed against an outcome. The `predictions` table is the source of truth; the memory row only mirrors the claim.
+ * Every helper requires tenantId; `trg_predictions_tenant_match_*` triggers enforce the prediction's tenant matches the referenced memory's.
+ * `savePrediction` writes memory and prediction inside `writeEntry`'s SAVEPOINT (via afterWrite), so a failure in either rolls back both. */
+import { DEFAULT_LIST_LIMIT } from '../util/limits.js';
 import { BadRequestError, NotFoundError } from '../core/api-errors.js';
-import { openHippoDb, closeHippoDb, withWriteScope } from '../db/index.js';
+import { withWriteScope } from '../db/index.js';
+import { onHandle } from './open.js';
 import { writeEntryAt } from './sqlite/entry-writes-group.js';
 import { assertTenantId } from './tenant.js';
 import { createMemory, Layer } from '../core/memory.js';
 import { appendAuditEvent } from './audit.js';
 import { loadConfig } from '../core/config.js';
 import { keysetAfter } from '../util/keyset.js';
-const DEFAULT_PREDICTION_PAGE_SIZE = 100;
-export const VALID_CLOSURE_STATES = new Set([
-    'open',
-    'closed',
-    'closed-unknown',
-]);
+import { VALID_CLOSURE_STATES } from '../core/prediction.js';
+const DEFAULT_PREDICTION_PAGE_SIZE = DEFAULT_LIST_LIMIT;
+const SELECT_COLUMNS = `id, memory_id, tenant_id, class_tag, claim_text,
+  estimate_value, estimate_unit, target_date,
+  actual_value, closure_state, closed_at, closure_note, created_at`;
 function rowToPrediction(row) {
     return {
         id: row.id,
@@ -55,20 +35,8 @@ function rowToPrediction(row) {
         createdAt: row.created_at,
     };
 }
-// ---------------------------------------------------------------------------
-// Public API
-// ---------------------------------------------------------------------------
-/**
- * Create a new prediction. Writes a memory mirror + a predictions table
- * row atomically inside `writeEntry`'s SAVEPOINT 'write_entry'. On any
- * failure (audit write, predictions INSERT, trigger ABORT), the SAVEPOINT
- * rolls back — neither the memory row nor the predictions row lands.
- *
- * The memory is tagged `['prediction', classTag]` with `source='prediction'`
- * and `kind='distilled'`. It surfaces in `hippo recall` so the agent can
- * see open predictions naturally; the predictions table is the canonical
- * structured store used by the planning-fallacy detector.
- */
+/** Create a prediction: memory mirror and predictions row land atomically inside `writeEntry`'s SAVEPOINT; any failure rolls back both.
+ * The memory (tags `['prediction', classTag]`, kind 'distilled') surfaces in `hippo recall`; the predictions table feeds the planning-fallacy detector. */
 export function savePrediction(hippoRoot, tenantId, opts, actor = 'cli') {
     assertTenantId('savePrediction', tenantId);
     if (!opts.classTag)
@@ -91,7 +59,8 @@ export function predictionMirror(tenantId, claim, baseHalfLifeDays) {
         tenantId,
     });
 }
-/** The store port's save on hippo.db: the mirror goes in as the port's writeEntry has it, tenant check included, and its predictions row shares that write scope, so neither lands alone. */
+/** The store port's save on hippo.db: the mirror goes in as the port's writeEntry has it, tenant
+ * check included, and its predictions row shares that write scope, so neither lands alone. */
 export function writePrediction(hippoRoot, tenantId, save, actor) {
     assertTenantId('savePrediction', tenantId);
     const now = new Date().toISOString();
@@ -120,9 +89,7 @@ function insertPredictionRow(db, memoryId, tenantId, opts, stamp) {
     const predictionId = Number(result.lastInsertRowid ?? 0);
     // SAFETY: row's shape matches the columns named in the SELECT above.
     const row = db.prepare(`
-        SELECT id, memory_id, tenant_id, class_tag, claim_text,
-               estimate_value, estimate_unit, target_date,
-               actual_value, closure_state, closed_at, closure_note, created_at
+        SELECT ${SELECT_COLUMNS}
         FROM predictions WHERE id = ?
       `).get(predictionId);
     if (!row) {
@@ -147,25 +114,18 @@ function auditPredictionCreate(db, who, opts) {
         },
     });
 }
-/**
- * Close an existing open prediction. Updates the predictions row only;
- * the memory mirror is NOT mutated in v1 (predictions table is canonical).
- * Accuracy is computed from (estimateValue, actualValue) at query time.
- */
+/** Close an open prediction. Updates the predictions row only; the memory mirror is not mutated (the predictions table is the source of truth).
+ * Accuracy is computed from (estimateValue, actualValue) at query time. */
 export function closePrediction(hippoRoot, tenantId, id, opts, actor = 'cli') {
     assertTenantId('closePrediction', tenantId);
     if (!VALID_CLOSURE_STATES.has(opts.closureState)) {
         throw new BadRequestError(`closePrediction: closureState must be one of ${Array.from(VALID_CLOSURE_STATES).join('|')}; got ${opts.closureState}`);
     }
     const now = new Date().toISOString();
-    const db = openHippoDb(hippoRoot);
-    try {
+    return onHandle(hippoRoot, (db) => {
         const row = withWriteScope(db, 'close_prediction', () => closeOpenPredictionRow(db, tenantId, id, opts, { now, actor }));
         return rowToPrediction(row);
-    }
-    finally {
-        closeHippoDb(db);
-    }
+    });
 }
 /** Closes the row, reloads it and audits the close; the caller owns the transaction. */
 function closeOpenPredictionRow(db, tenantId, id, opts, stamp) {
@@ -181,9 +141,7 @@ function closeOpenPredictionRow(db, tenantId, id, opts, stamp) {
         throwCloseMiss(db, tenantId, id);
     // SAFETY: row's shape matches the columns named in the SELECT above.
     const row = db.prepare(`
-        SELECT id, memory_id, tenant_id, class_tag, claim_text,
-               estimate_value, estimate_unit, target_date,
-               actual_value, closure_state, closed_at, closure_note, created_at
+        SELECT ${SELECT_COLUMNS}
         FROM predictions WHERE id = ? AND tenant_id = ?
       `).get(id, tenantId);
     if (!row) {
@@ -203,10 +161,8 @@ function closeOpenPredictionRow(db, tenantId, id, opts, stamp) {
     return row;
 }
 function throwCloseMiss(db, tenantId, id) {
-    // Distinguish "not found" from "already closed" so callers (CLI, HTTP)
-    // can surface the right error to the user.
-    // SAFETY: row shape matches the single `closure_state` column named
-    // in the SELECT above.
+    // Distinguish 'not found' from 'already closed' so callers (CLI, HTTP) surface the right error.
+    // SAFETY: row shape matches the single `closure_state` column named in the SELECT above.
     const existing = db.prepare(`
           SELECT closure_state FROM predictions WHERE id = ? AND tenant_id = ?
         `).get(id, tenantId);
@@ -218,27 +174,20 @@ function throwCloseMiss(db, tenantId, id) {
 }
 export function loadPredictionById(hippoRoot, tenantId, id) {
     assertTenantId('loadPredictionById', tenantId);
-    const db = openHippoDb(hippoRoot);
-    try {
+    return onHandle(hippoRoot, (db) => {
         // SAFETY: row's shape matches the columns named in the SELECT above.
         const row = db.prepare(`
-      SELECT id, memory_id, tenant_id, class_tag, claim_text,
-             estimate_value, estimate_unit, target_date,
-             actual_value, closure_state, closed_at, closure_note, created_at
+      SELECT ${SELECT_COLUMNS}
       FROM predictions WHERE id = ? AND tenant_id = ?
     `).get(id, tenantId);
         return row ? rowToPrediction(row) : null;
-    }
-    finally {
-        closeHippoDb(db);
-    }
+    });
 }
 export function loadPredictionsByClass(hippoRoot, tenantId, classTag, opts = {}) {
     assertTenantId('loadPredictionsByClass', tenantId);
     const limit = opts.limit ?? DEFAULT_PREDICTION_PAGE_SIZE;
     const after = keysetAfter('created_at', 'id', opts.after);
-    const db = openHippoDb(hippoRoot);
-    try {
+    return onHandle(hippoRoot, (db) => {
         let rows;
         if (opts.closureState) {
             if (!VALID_CLOSURE_STATES.has(opts.closureState)) {
@@ -246,9 +195,7 @@ export function loadPredictionsByClass(hippoRoot, tenantId, classTag, opts = {})
             }
             // SAFETY: rows' shape matches the columns named in the SELECT above.
             rows = db.prepare(`
-        SELECT id, memory_id, tenant_id, class_tag, claim_text,
-               estimate_value, estimate_unit, target_date,
-               actual_value, closure_state, closed_at, closure_note, created_at
+        SELECT ${SELECT_COLUMNS}
         FROM predictions
         WHERE tenant_id = ? AND class_tag = ? AND closure_state = ?${after.sql}
         ORDER BY created_at DESC, id DESC
@@ -258,9 +205,7 @@ export function loadPredictionsByClass(hippoRoot, tenantId, classTag, opts = {})
         else {
             // SAFETY: rows' shape matches the columns named in the SELECT above.
             rows = db.prepare(`
-        SELECT id, memory_id, tenant_id, class_tag, claim_text,
-               estimate_value, estimate_unit, target_date,
-               actual_value, closure_state, closed_at, closure_note, created_at
+        SELECT ${SELECT_COLUMNS}
         FROM predictions
         WHERE tenant_id = ? AND class_tag = ?${after.sql}
         ORDER BY created_at DESC, id DESC
@@ -268,43 +213,26 @@ export function loadPredictionsByClass(hippoRoot, tenantId, classTag, opts = {})
       `).all(tenantId, classTag, ...after.params, limit);
         }
         return rows.map(rowToPrediction);
-    }
-    finally {
-        closeHippoDb(db);
-    }
+    });
 }
 /** Every prediction in the tenant, open and closed, across all classes: the `status=all` list without a class. */
 export function loadAllPredictions(hippoRoot, tenantId, opts = {}) {
     assertTenantId('loadAllPredictions', tenantId);
     const after = keysetAfter('created_at', 'id', opts.after);
-    const db = openHippoDb(hippoRoot);
-    try {
+    return onHandle(hippoRoot, (db) => {
         // SAFETY: rows' shape matches the columns named in the SELECT.
         const rows = db.prepare(`
-      SELECT id, memory_id, tenant_id, class_tag, claim_text,
-             estimate_value, estimate_unit, target_date,
-             actual_value, closure_state, closed_at, closure_note, created_at
+      SELECT ${SELECT_COLUMNS}
       FROM predictions
       WHERE tenant_id = ?${after.sql}
       ORDER BY created_at DESC, id DESC
       LIMIT ?
     `).all(tenantId, ...after.params, opts.limit ?? DEFAULT_PREDICTION_PAGE_SIZE);
         return rows.map(rowToPrediction);
-    }
-    finally {
-        closeHippoDb(db);
-    }
+    });
 }
-/**
- * Compute base-rate stats for closed predictions in a class for the
- * planning-fallacy detector: Lovallo-Kahneman (2003) inside-vs-outside view.
- *
- * Filter: closure_state='closed' AND estimate_value IS NOT NULL AND
- * actual_value IS NOT NULL. Excludes closed-unknown (no actual to
- * compare against) and open (not yet resolved).
- *
- * Audit-emit is built in here, not at the 3 call sites, so callers cannot drift.
- */
+/** Base-rate stats for closed predictions in a class (Lovallo-Kahneman inside-vs-outside view): closure_state='closed' with estimate and actual non-null;
+ * closed-unknown and open are excluded. Audit-emit is built in here, not at the 3 call sites, so callers cannot drift. */
 export function computePredictionBaserate(hippoRoot, tenantId, classTag, actor = 'cli', 
 /** False skips the predict_baserate audit so that channel only records deliberate
  *  baserate calls, not every recall the planning-fallacy orchestrator inspects. */
@@ -312,8 +240,7 @@ emitAudit = true) {
     assertTenantId('computePredictionBaserate', tenantId);
     if (!classTag)
         throw new BadRequestError('computePredictionBaserate: classTag is required');
-    const db = openHippoDb(hippoRoot);
-    try {
+    return onHandle(hippoRoot, (db) => {
         // Ordered by id because the float sums differ with row order, and another store must reach the same figures.
         // SAFETY: rows' shape matches the two columns named in the SELECT above.
         const rows = db.prepare(`
@@ -331,10 +258,7 @@ emitAudit = true) {
         if (emitAudit)
             auditBaserateRead(db, tenantId, actor, classTag, baserate.nClosed);
         return baserate;
-    }
-    finally {
-        closeHippoDb(db);
-    }
+    });
 }
 function auditBaserateRead(db, tenantId, actor, classTag, nClosed) {
     appendAuditEvent(db, {
@@ -386,15 +310,12 @@ export function loadOpenPredictions(hippoRoot, tenantId, opts = {}) {
     assertTenantId('loadOpenPredictions', tenantId);
     const limit = opts.limit ?? DEFAULT_PREDICTION_PAGE_SIZE;
     const after = keysetAfter('created_at', 'id', opts.after);
-    const db = openHippoDb(hippoRoot);
-    try {
+    return onHandle(hippoRoot, (db) => {
         let rows;
         if (opts.classTag) {
             // SAFETY: rows' shape matches the columns named in the SELECT above.
             rows = db.prepare(`
-        SELECT id, memory_id, tenant_id, class_tag, claim_text,
-               estimate_value, estimate_unit, target_date,
-               actual_value, closure_state, closed_at, closure_note, created_at
+        SELECT ${SELECT_COLUMNS}
         FROM predictions
         WHERE tenant_id = ? AND class_tag = ? AND closure_state = 'open'${after.sql}
         ORDER BY created_at DESC, id DESC
@@ -404,9 +325,7 @@ export function loadOpenPredictions(hippoRoot, tenantId, opts = {}) {
         else {
             // SAFETY: rows' shape matches the columns named in the SELECT above.
             rows = db.prepare(`
-        SELECT id, memory_id, tenant_id, class_tag, claim_text,
-               estimate_value, estimate_unit, target_date,
-               actual_value, closure_state, closed_at, closure_note, created_at
+        SELECT ${SELECT_COLUMNS}
         FROM predictions
         WHERE tenant_id = ? AND closure_state = 'open'${after.sql}
         ORDER BY created_at DESC, id DESC
@@ -414,9 +333,6 @@ export function loadOpenPredictions(hippoRoot, tenantId, opts = {}) {
       `).all(tenantId, ...after.params, limit);
         }
         return rows.map(rowToPrediction);
-    }
-    finally {
-        closeHippoDb(db);
-    }
+    });
 }
 //# sourceMappingURL=predictions.js.map

package/dist/store/project-tags.d.ts

@@ -0,0 +1,62 @@
+import { type DatabaseSyncLike } from '../db/index.js';
+import { type MemoryEntry } from '../core/memory.js';
+import { type AppendAuditOpts, type AuditEvent } from './audit.js';
+import { type DormantReason, type DormantSnapshot } from './dormant.js';
+import { type SetAsideResult, type SetAsideWhy } from './set-aside.js';
+export type ProjectTagOp = 'project_merge' | 'project_repair';
+export interface ProjectTagReads {
+    entries(): MemoryEntry[];
+    liveEntriesBySourcePrefix(prefix: string): MemoryEntry[];
+    entriesByIds(ids: readonly string[]): Map<string, MemoryEntry>;
+    dormant(): DormantSnapshot[];
+    auditEvents(op: ProjectTagOp): AuditEvent[];
+    compactionTranscripts(): Array<{
+        transcript: string;
+        cwd: string | null;
+    }>;
+    compactionOriginsWithCwd(): Array<{
+        origin: string;
+        cwd: string;
+    }>;
+    holdsOrigin(table: 'memories' | 'compactions', name: string): boolean;
+}
+export interface ProjectTagWrites extends ProjectTagReads {
+    setAside(tag: string, row: MemoryEntry, why: SetAsideWhy): SetAsideResult;
+    restampOrigin(from: string, into: string): void;
+    restampCompactions(from: string, into: string): number;
+    replaceDormant(id: string, entry: MemoryEntry): void;
+    stampOrigins(rows: ReadonlyArray<{
+        readonly id: string;
+        readonly origin: string;
+    }>): void;
+    /** A live row to dormant storage, restorable, as sleep's dormant move does. */
+    retire(row: MemoryEntry, reason: DormantReason, now: Date): void;
+    audit(op: ProjectTagOp, metadata: AppendAuditOpts['metadata']): void;
+}
+/** A rewrite's answer plus the ids whose mirrors are rewritten, and those whose mirrors go, once it commits. */
+export interface TagRewrite<T> {
+    readonly result: T;
+    readonly rewrite: readonly string[];
+    readonly purge: readonly string[];
+}
+export interface ProjectTagStore extends ProjectTagReads {
+    readonly hippoRoot: string;
+    /** One transaction; a dry run rolls back with no backup, else the store is backed up first and mirrors follow the commit. */
+    rewrite<T>(opts: {
+        readonly dryRun: boolean;
+        readonly backupLabel: string;
+    }, body: (tx: ProjectTagWrites, backup: string | null) => TagRewrite<T>): T;
+    repairedOnce(): boolean;
+    markRepairedOnce(): void;
+}
+export interface ProjectTagScope {
+    readonly hippoRoot: string;
+    readonly tenantId: string;
+    /** Who the audit rows name. */
+    readonly actor: string;
+}
+/** Reads on a handle the caller opened and closes, for doctor's read-only check and the note sync. */
+export declare function projectTagReads(db: DatabaseSyncLike, tenantId: string): ProjectTagReads;
+/** Runs `fn` on hippo.db under `scope.hippoRoot`, opened for this call and closed after. */
+export declare function onProjectTags<T>(scope: ProjectTagScope, fn: (store: ProjectTagStore) => T): T;
+//# sourceMappingURL=project-tags.d.ts.map

package/dist/store/project-tags.js

@@ -0,0 +1,67 @@
+// The rows `hippo projects` and sleep's tag repair read and write, bound to one hippo.db handle and tenant,
+// so the merge and repair rules in src/sharing/project-merge.ts decide without holding the handle.
+import { getMeta, setMeta, withTrialScope, withWriteScope } from '../db/index.js';
+import { withBackup } from '../db/backup.js';
+import { calculateStrength } from '../core/memory.js';
+import { appendAuditEvent, queryAuditEvents } from './audit.js';
+import { compactionOriginsWithCwd, compactionTranscripts, holdsOrigin, restampCompactionOrigin } from './compactions.js';
+import { insertDormantRow, listDormantSnapshots, replaceDormantEntry } from './dormant.js';
+import { selectAllEntries, selectEntriesByIds, selectLiveEntriesBySourcePrefix } from './entry-reads.js';
+import { deleteEntryRowInTx, restampOriginProjectAt, stampOriginProjectsAt, writeEntryMirrors } from './entry-writes.js';
+import { removeEntryMirrors } from './mirrors.js';
+import { onHandle } from './open.js';
+import { setAsideRow } from './set-aside.js';
+const AUDIT_READ_CAP = 10000;
+const TX_LABEL = 'merge_projects';
+const AUTO_REPAIR_META_KEY = 'project_repair_auto';
+/** Reads on a handle the caller opened and closes, for doctor's read-only check and the note sync. */
+export function projectTagReads(db, tenantId) {
+    return {
+        entries: () => selectAllEntries(db, tenantId),
+        liveEntriesBySourcePrefix: (prefix) => selectLiveEntriesBySourcePrefix(db, tenantId, prefix),
+        entriesByIds: (ids) => selectEntriesByIds(db, ids, tenantId),
+        dormant: () => listDormantSnapshots(db, tenantId),
+        auditEvents: (op) => queryAuditEvents(db, { tenantId, op, limit: AUDIT_READ_CAP }),
+        compactionTranscripts: () => compactionTranscripts(db, tenantId),
+        compactionOriginsWithCwd: () => compactionOriginsWithCwd(db, tenantId),
+        holdsOrigin: (table, name) => holdsOrigin(db, table, tenantId, name),
+    };
+}
+function projectTagWrites(db, { tenantId, actor }) {
+    return {
+        ...projectTagReads(db, tenantId),
+        setAside: (tag, row, why) => setAsideRow(db, tag, row, why),
+        restampOrigin: (from, into) => restampOriginProjectAt(db, tenantId, from, into),
+        restampCompactions: (from, into) => restampCompactionOrigin(db, tenantId, from, into),
+        replaceDormant: (id, entry) => replaceDormantEntry(db, tenantId, id, entry),
+        stampOrigins: (rows) => stampOriginProjectsAt(db, tenantId, rows),
+        retire: (row, reason, now) => {
+            insertDormantRow(db, { entry: row, strength: calculateStrength(row, now), reason, dormantAt: now.toISOString() });
+            deleteEntryRowInTx(db, row, actor);
+        },
+        audit: (op, metadata) => appendAuditEvent(db, { tenantId, actor, op, metadata }),
+    };
+}
+function rewriteOn(db, scope, opts, body) {
+    const tx = projectTagWrites(db, scope);
+    if (opts.dryRun)
+        return withTrialScope(db, TX_LABEL, () => body(tx, null)).result;
+    const done = withBackup(db, scope.hippoRoot, opts.backupLabel, (backup) => withWriteScope(db, TX_LABEL, () => body(tx, backup)));
+    // After commit, as the agent memory sync does: a stale mirror would bring the old tag back on the next rebuild.
+    for (const entry of selectEntriesByIds(db, done.rewrite, scope.tenantId).values())
+        writeEntryMirrors(scope.hippoRoot, entry);
+    for (const id of done.purge)
+        removeEntryMirrors(scope.hippoRoot, id);
+    return done.result;
+}
+/** Runs `fn` on hippo.db under `scope.hippoRoot`, opened for this call and closed after. */
+export function onProjectTags(scope, fn) {
+    return onHandle(scope.hippoRoot, (db) => fn({
+        ...projectTagReads(db, scope.tenantId),
+        hippoRoot: scope.hippoRoot,
+        rewrite: (opts, body) => rewriteOn(db, scope, opts, body),
+        repairedOnce: () => getMeta(db, AUTO_REPAIR_META_KEY) === '1',
+        markRepairedOnce: () => setMeta(db, AUTO_REPAIR_META_KEY, '1'),
+    }));
+}
+//# sourceMappingURL=project-tags.js.map

package/dist/{cli → store}/quality-repair.js

@@ -1,22 +1,19 @@
-import fs from 'node:fs';
-import path from 'node:path';
-import { appendAuditEvent } from '../store/audit.js';
+import { appendAuditEvent } from './audit.js';
 import { withBackup } from '../db/backup.js';
 import { withTrialScope, withWriteScope } from '../db/busy.js';
-import { assertSqliteAllowed } from '../db/open.js';
-import { DatabaseSync } from '../db/sqlite.js';
+import { withUnmigratedDb } from '../db/open.js';
 import { getMeta, pragmaUserVersion, setMeta } from '../db/meta.js';
 import { tableColumns } from '../db/tables.js';
 import { assertBinaryCompatible } from '../db/migrate.js';
-import { insertDormantRow, listDormantSnapshots } from '../store/dormant.js';
+import { insertDormantRow, listDormantSnapshots } from './dormant.js';
 import { calculateStrength, canAutoDelete } from '../core/memory.js';
 import { assessAutomaticMemory, BUNDLE_HEADER, isAutomaticEntry, isCertainReason } from '../core/memory-quality.js';
 import { heldTexts } from '../util/same-text.js';
-import { deleteEntryCore, MEMORY_BACKED_TABLES, memoriesBackingObjectsOn } from '../store/delete-and-batch.js';
-import { selectAllEntries, selectPreviewRows } from '../store/entry-reads.js';
-import { ftsRowExists } from '../store/entry-row.js';
-import { MEMORY_SELECT_COLUMNS, parseJsonArray } from '../store/rows.js';
-import { purgeMirrorBestEffort } from '../store/mirrors.js';
+import { deleteEntryCore, MEMORY_BACKED_TABLES, memoriesBackingObjectsOn } from './delete-and-batch.js';
+import { selectAllEntries, selectPreviewRows } from './entry-reads.js';
+import { ftsRowExists } from './entry-row.js';
+import { MEMORY_SELECT_COLUMNS, parseJsonArray } from './rows.js';
+import { purgeMirrorBestEffort } from './mirrors.js';
 const REQUIRED_COLUMNS = {
     memories: MEMORY_SELECT_COLUMNS.split(',').map((s) => s.trim()),
     meta: ['key', 'value'],
@@ -108,7 +105,8 @@ function unsupportedPreview(db, tenantId) {
         return { total: 0, issues: [] };
     const rows = selectPreviewRows(db, columns, tenantId);
     const issues = rows.flatMap((row) => {
-        const provenance = { ...row, source: row.source ?? '', confidence: row.confidence ?? 'observed', dag_level: row.dag_level ?? 0, tags: parseJsonArray(row.tags_json) };
+        const tags = parseJsonArray(row.tags_json, { table: 'memories', id: row.id, column: 'tags_json' });
+        const provenance = { ...row, source: row.source ?? '', confidence: row.confidence ?? 'observed', dag_level: row.dag_level ?? 0, tags };
         if (!isAutomaticEntry(provenance))
             return [];
         const { reason } = assessAutomaticMemory(row.content);
@@ -168,34 +166,20 @@ function repairOn(db, root, opts) {
     const result = withBackup(db, root, 'before-quality-repair', (backup) => applyPlan(db, root, opts.tenantId, backup, opts.doneKey));
     const warnings = [...result.warnings];
     for (const id of result.appliedIds) {
-        if (!purgeMirrorBestEffort(root, id, false, 'quality repair'))
-            warnings.push(`Mirror cleanup failed for ${id}; remove its stale mirror before rebuilding the index.`);
+        if (purgeMirrorBestEffort(root, id, false, 'quality repair'))
+            continue;
+        warnings.push(`Mirror cleanup failed for ${id}; remove its stale mirror before rebuilding the index.`);
     }
     return { ...result, warnings };
 }
-function openForRepair(root, readOnly, fn) {
-    // Opens without openHippoDb to skip migrations, so it takes the same refusal itself.
-    assertSqliteAllowed(root);
-    const file = path.join(root, 'hippo.db');
-    if (!fs.existsSync(file))
-        throw new Error(`No existing Hippo database at ${file}`);
-    const db = new DatabaseSync(file, { readOnly });
-    try {
-        db.exec('PRAGMA busy_timeout = 5000');
-        return fn(db);
-    }
-    finally {
-        db.close();
-    }
-}
 /** Preview by default; apply backs the database up, then moves certain defects to dormant storage, without running migrations. */
 export function repairAutomaticMemories(root, opts) {
-    return openForRepair(root, !opts.apply, (db) => repairOn(db, root, opts));
+    return withUnmigratedDb(root, !opts.apply, (db) => repairOn(db, root, opts));
 }
 const AUTO_REPAIR_META_KEY = 'quality_repair_auto';
 /** Applies the repair once per store, so stores that predate the quality gate are cleaned on upgrade with no command; null once done. */
 export function repairQualityOnce(root, tenantId) {
-    return openForRepair(root, false, (db) => {
+    return withUnmigratedDb(root, false, (db) => {
         if (getMeta(db, AUTO_REPAIR_META_KEY) === '1')
             return null;
         // The apply commits the flag with the moves, so a lock taken between them cannot hide what moved.

package/dist/store/quarantine.js

@@ -1,4 +1,5 @@
 // The memory_quarantine table: the review queue's rows, and the approve and reject writes with their audit rows.
+import { DEFAULT_LIST_LIMIT } from '../util/limits.js';
 import { appendAuditEvent } from './audit.js';
 import { withWriteScopeOr } from '../db/index.js';
 import { keysetAfter } from '../util/keyset.js';
@@ -27,7 +28,7 @@ function getQuarantineRow(db, tenantId, memoryId) {
         .get(tenantId, memoryId);
     return row ? fromDbRow(row) : null;
 }
-function listQuarantineRows(db, tenantId, status = 'pending', limit = 100, afterRow) {
+function listQuarantineRows(db, tenantId, status = 'pending', limit = DEFAULT_LIST_LIMIT, afterRow) {
     // A pending row whose memory was deleted (e.g. Slack message_deleted) is dead; keep its history, drop it from the queue.
     const live = status === 'pending'
         ? ' AND EXISTS (SELECT 1 FROM memories m WHERE m.id = memory_quarantine.memory_id AND m.tenant_id = memory_quarantine.tenant_id)'

package/dist/store/raw-archive.d.ts

@@ -2,25 +2,13 @@ import type { DatabaseSyncLike } from '../db/index.js';
 export interface ArchiveOpts {
     reason: string;
     who: string;
-    /**
-     * Optional hook invoked inside the same SAVEPOINT as the archive INSERT/DELETE,
-     * after the audit row is appended and before RELEASE. Used by the Slack
-     * deletion connector to mark the deletion event seen atomically — a crash
-     * mid-archive must not leave the deletion event untracked. Throwing rolls
-     * back the entire archive (including the audit row).
-     */
+    /** Hook run inside the archive SAVEPOINT after the audit row and before RELEASE (the Slack deletion connector marks the event seen atomically);
+     * throwing rolls back the whole archive, audit row included. */
     afterArchive?: (db: DatabaseSyncLike, archivedMemoryId: string) => void;
 }
 /** Stamps the archived copy of `memoryId` as having its markdown mirror cleaned at `at`. */
 export declare function markMirrorCleaned(db: DatabaseSyncLike, memoryId: string, at: string): void;
-/**
- * The only legitimate path to remove a `kind='raw'` row from `memories`.
- *
- * Snapshots the full row into `raw_archive`, flips `kind` to `'archived'` so the
- * append-only trigger lets the delete through, then deletes the row. All in one
- * write scope, which nests inside an outer transaction (e.g. batchWriteAndDelete).
- *
- * Throws if the row does not exist or is not `kind='raw'`. Returns the archived_at it wrote.
- */
+/** The only way to remove a `kind='raw'` row: snapshots it into `raw_archive`, flips `kind` to 'archived' so the append-only trigger allows the delete,
+ * all in one write scope that nests in an outer transaction. Throws if the row is missing or not raw; returns the archived_at. */
 export declare function archiveRawMemory(db: DatabaseSyncLike, id: string, opts: ArchiveOpts): string;
 //# sourceMappingURL=raw-archive.d.ts.map