hippo-memory 1.71.0 → 1.72.0

package/dist/sharing/project-merge.js

@@ -1,26 +1,14 @@
 // `hippo projects`: list the project names a store holds, fold one into another, and repair old tags in one reversible pass.
 import * as fs from 'node:fs';
 import * as path from 'node:path';
-import { setAsideRow } from '../agent-memories/apply.js';
 import { transcriptNotesProject } from '../agent-memories/claude-code.js';
 import { containerId, containerPrefix } from '../agent-memories/source.js';
+import { foldEdges, foldedInto } from '../agent-memories/project-folds.js';
 import { AGENT_MEMORY_SOURCE_PREFIX, AGENT_MEMORY_TOOLS, toolSourcePrefix } from '../core/agent-memory-tools.js';
-import { appendAuditEvent, queryAuditEvents } from '../store/audit.js';
 import { isSharedStore } from '../core/config.js';
-import { withTrialScope, withWriteScope } from '../db/index.js';
-import { withBackup } from '../db/backup.js';
-import { getMeta, setMeta } from '../db/meta.js';
-import { insertDormantRow, listDormantSnapshots, replaceDormantEntry } from '../store/dormant.js';
 import { processEnv } from '../util/env.js';
-import { calculateStrength } from '../core/memory.js';
-import { isObjectLike, isStringValue } from '../core/capture-contract.js';
 import { isGlobalStoreRoot, projectNames, resolveProjectIdentity } from '../core/project-identity.js';
 import { duplicateKey } from '../util/same-text.js';
-import { compactionOriginsWithCwd, compactionTranscripts, holdsOrigin, restampCompactionOrigin } from '../store/compactions.js';
-import { removeEntryMirrors } from '../store/mirrors.js';
-import { deleteEntryRowInTx, restampOriginProjectAt, stampOriginProjectsAt, writeEntryMirrors } from '../store/entry-writes.js';
-import { selectAllEntries, selectLiveEntriesBySourcePrefix } from '../store/entry-reads.js';
-const ACTOR = 'cli';
 function isImport(entry) {
     return entry.source.startsWith(AGENT_MEMORY_SOURCE_PREFIX);
 }
@@ -29,8 +17,8 @@ function toolTag(source) {
     return AGENT_MEMORY_TOOLS.find((t) => t.id === id)?.tag ?? null;
 }
 /** Live rows per project name, newest write first, with how many of its imported notes are copies held elsewhere. */
-export function listProjects(db, tenantId) {
-    const live = selectAllEntries(db, tenantId).filter((e) => !e.superseded_by);
+export function listProjects(store) {
+    const live = store.entries().filter((e) => !e.superseded_by);
     const byOrigin = new Map();
     const holders = new Map();
     for (const e of live) {
@@ -51,9 +39,6 @@ export function listProjects(db, tenantId) {
         };
     }).sort((a, b) => b.newest.localeCompare(a.newest));
 }
-function inTransaction(db, dryRun, body) {
-    return dryRun ? withTrialScope(db, 'merge_projects', body) : withWriteScope(db, 'merge_projects', body);
-}
 /** Refuses user-global and unknown: they are not projects, and folding them would leak or hide every row. */
 export function validateMergeNames(from, into) {
     if (from.trim() === '' || into.trim() === '')
@@ -63,23 +48,19 @@ export function validateMergeNames(from, into) {
     return null;
 }
 /** Folds project `from` into `into` for one tenant in one transaction; a dry run rolls back and writes nothing, mirrors included. */
-export function mergeProjects(db, hippoRoot, opts) {
+export function mergeProjects(store, opts) {
     const refusal = validateMergeNames(opts.from, opts.into);
     if (refusal)
         throw new Error(refusal);
-    const { tenantId, from, into, dryRun } = opts;
-    const fold = (backup) => inTransaction(db, dryRun, () => {
-        const folded = foldInTx(db, tenantId, from, into);
-        appendAuditEvent(db, { tenantId, actor: ACTOR, op: 'project_merge', metadata: { from, into, backup, ...folded } });
-        return { from, into, ...folded, backup };
+    const { from, into, dryRun } = opts;
+    return store.rewrite({ dryRun, backupLabel: 'before-merge' }, (tx, backup) => {
+        const folded = foldInTx(tx, from, into);
+        tx.audit('project_merge', { from, into, backup, ...folded });
+        return { result: { from, into, ...folded, backup }, rewrite: folded.restamped, purge: folded.setAside };
     });
-    const result = dryRun ? fold(null) : withBackup(db, hippoRoot, 'before-merge', fold);
-    if (!dryRun)
-        refreshMirrors(db, hippoRoot, tenantId, result.restamped, result.setAside);
-    return result;
 }
-function foldInTx(db, tenantId, from, into) {
-    const all = selectAllEntries(db, tenantId);
+function foldInTx(tx, from, into) {
+    const all = tx.entries();
     const rows = all.filter((e) => e.origin_project === from);
     // The sync renames the rest to `into`'s prefix and keeps their ids; only a note `into` already holds would show twice.
     const held = new Set(all.filter((e) => e.origin_project === into && !e.superseded_by && isImport(e)).map(noteKey));
@@ -88,20 +69,20 @@ function foldInTx(db, tenantId, from, into) {
         const tag = toolTag(row.source);
         if (!isImport(row) || row.superseded_by || row.kind === 'raw' || tag === null || !held.has(noteKey(row)))
             continue;
-        if (setAsideRow(db, tag, { ...row, origin_project: into }, 'project-merge').kind === 'dormant')
+        if (tx.setAside(tag, { ...row, origin_project: into }, 'project-merge').kind === 'dormant')
             setAside.push(row.id);
     }
     const gone = new Set(setAside);
     const restamped = rows.filter((e) => !gone.has(e.id)).map((e) => e.id);
-    restampOriginProjectAt(db, tenantId, from, into);
+    tx.restampOrigin(from, into);
     const dormantRestamped = [];
-    for (const snap of listDormantSnapshots(db, tenantId)) {
+    for (const snap of tx.dormant()) {
         if (snap.entry.origin_project !== from || gone.has(snap.entry.id))
             continue;
-        replaceDormantEntry(db, tenantId, snap.entry.id, { ...snap.entry, origin_project: into });
+        tx.replaceDormant(snap.entry.id, { ...snap.entry, origin_project: into });
         dormantRestamped.push(snap.entry.id);
     }
-    const compactions = restampCompactionOrigin(db, tenantId, from, into);
+    const compactions = tx.restampCompactions(from, into);
     return { setAside, restamped, dormantRestamped, compactions };
 }
 /** Tool, note key and hash of an import, without the container, whose id hashes the project name. */
@@ -110,20 +91,20 @@ function noteKey(entry) {
     return `${rest.split(':')[0]}:${rest.slice(rest.indexOf('/') + 1)}`;
 }
 /** Live imports under a project name whose exact text a user-global import holds: a session folder's notes stamped with the folder it ended in. */
-function importCopies(db, tenantId) {
-    const live = selectAllEntries(db, tenantId).filter((e) => !e.superseded_by && isImport(e));
+function importCopies(store) {
+    const live = store.entries().filter((e) => !e.superseded_by && isImport(e));
     const userGlobal = new Set(live.filter((e) => e.origin_project === '').map((e) => duplicateKey(e.content)));
     return live.filter((e) => e.origin_project && e.kind !== 'raw' && !e.pinned && toolTag(e.source) !== null && userGlobal.has(duplicateKey(e.content)));
 }
 /** Imports to set aside. The global store also checks each Claude session folder a compaction recorded: its
  * notes under any other project are misfiled, edited or not, and a text copy in the right folder is kept. */
-function strayImports(db, hippoRoot, tenantId) {
-    const copies = importCopies(db, tenantId);
+function strayImports(store, hippoRoot) {
+    const copies = importCopies(store);
     if (!isGlobalStoreRoot(hippoRoot))
         return copies;
     const machine = { platform: process.platform, env: processEnv() };
     const { platform } = machine;
-    const sessions = compactionTranscripts(db, tenantId);
+    const sessions = store.compactionTranscripts();
     const owners = new Map();
     for (const { transcript, cwd } of sessions) {
         const project = transcriptNotesProject(transcript, cwd, machine);
@@ -134,9 +115,9 @@ function strayImports(db, hippoRoot, tenantId) {
         owners.set(dir, ids.set(project.name, [...new Set([...(ids.get(project.name) ?? []), ...projectNames(project)])]));
     }
     const tool = toolSourcePrefix('claude-code');
-    const live = selectLiveEntriesBySourcePrefix(db, tenantId, tool).filter((e) => e.kind !== 'raw' && !e.pinned);
+    const live = store.liveEntriesBySourcePrefix(tool).filter((e) => e.kind !== 'raw' && !e.pinned);
     const origins = new Set(live.map((e) => e.origin_project ?? ''));
-    const edges = foldEdges(db, tenantId);
+    const edges = foldEdges(store);
     const right = new Set();
     const wrong = new Set();
     for (const [dir, ids] of owners) {
@@ -154,12 +135,12 @@ function strayImports(db, hippoRoot, tenantId) {
     return [...misfiled, ...copies.filter((e) => !seen.has(e.id) && !right.has(prefix(e)))];
 }
 /** The global store reads each name's recorded session folders, where a compaction's name came from its cwd; a project store folds only its own folder name. */
-function planFolds(db, hippoRoot, tenantId, globalFolds) {
+function planFolds(store, hippoRoot, globalFolds) {
     // A name someone merged into by hand stays: undoing their choice would rest on the resolver alone.
-    const chosen = new Set(queryAuditEvents(db, { tenantId, op: 'project_merge', limit: 10000 }).map((e) => e.metadata.into));
+    const chosen = new Set(store.auditEvents('project_merge').map((e) => e.metadata.into));
     if (!isGlobalStoreRoot(hippoRoot))
-        return { folds: ownLegacyFold(db, hippoRoot, tenantId).filter((f) => !chosen.has(f.from)), collisions: [] };
-    const rows = compactionOriginsWithCwd(db, tenantId);
+        return { folds: ownLegacyFold(store, hippoRoot).filter((f) => !chosen.has(f.from)), collisions: [] };
+    const rows = store.compactionOriginsWithCwd();
     const today = new Map();
     for (const { origin, cwd } of rows) {
         if (fs.existsSync(cwd))
@@ -181,60 +162,29 @@ function planFolds(db, hippoRoot, tenantId, globalFolds) {
     return { folds: globalFolds ? folds.filter((f) => !sources.has(f.into)) : [], collisions };
 }
 /** A project store's rows, dormant snapshots and compaction records written before its id existed carry its folder name. */
-function ownLegacyFold(db, hippoRoot, tenantId) {
+function ownLegacyFold(store, hippoRoot) {
     // A shared store's rows carry their callers' names, so one matching its folder's is a member's project, not a legacy tag.
     if (isSharedStore(hippoRoot))
         return [];
     const { name, legacyName } = resolveProjectIdentity(path.dirname(path.resolve(hippoRoot)));
     if (legacyName === '' || legacyName === name)
         return [];
-    const held = holdsOrigin(db, 'memories', tenantId, legacyName)
-        || holdsOrigin(db, 'compactions', tenantId, legacyName)
-        || listDormantSnapshots(db, tenantId).some((s) => s.entry.origin_project === legacyName);
+    const held = store.holdsOrigin('memories', legacyName)
+        || store.holdsOrigin('compactions', legacyName)
+        || store.dormant().some((s) => s.entry.origin_project === legacyName);
     return held ? [{ from: legacyName, into: name }] : [];
 }
-function foldOf(value) {
-    if (!isObjectLike(value) || Array.isArray(value))
-        return [];
-    const { from, into } = value;
-    return isStringValue(from) && isStringValue(into) ? [{ from, into }] : [];
-}
-function foldEdges(db, tenantId) {
-    return [
-        ...queryAuditEvents(db, { tenantId, op: 'project_merge', limit: 10000 }).flatMap((e) => foldOf(e.metadata)),
-        ...queryAuditEvents(db, { tenantId, op: 'project_repair', limit: 10000 })
-            .flatMap((e) => (Array.isArray(e.metadata.folds) ? e.metadata.folds.flatMap(foldOf) : [])),
-    ];
-}
-function foldedInto(edges, names) {
-    const seen = new Set(names);
-    let grew = true;
-    while (grew) {
-        grew = false;
-        for (const { from, into } of edges) {
-            if (!seen.has(into) || seen.has(from))
-                continue;
-            seen.add(from);
-            grew = true;
-        }
-    }
-    return [...seen].filter((n) => !names.includes(n));
-}
-/** Names folded, directly or through others, into one of `names`; the sync moves imports still filed under them. */
-export function namesFoldedInto(db, tenantId, names) {
-    return foldedInto(foldEdges(db, tenantId), names);
-}
 /** Reads only, so doctor and a dry run take no write lock; merged rows are planned before any fold, so a few may re-tag differently once folds apply. */
-export function planProjectRepair(db, hippoRoot, tenantId, globalFolds = true) {
-    const { folds, collisions } = planFolds(db, hippoRoot, tenantId, globalFolds);
-    return { copies: strayImports(db, hippoRoot, tenantId).map((e) => e.id), folds, collisions, ...planUserGlobalRepair(db, tenantId, folds) };
+export function planProjectRepair(store, hippoRoot, globalFolds = true) {
+    const { folds, collisions } = planFolds(store, hippoRoot, globalFolds);
+    return { copies: strayImports(store, hippoRoot).map((e) => e.id), folds, collisions, ...planUserGlobalRepair(store, folds) };
 }
 /** Parents read with `folds` already applied, so a plan matches what apply does after folding. */
-function planUserGlobalRepair(db, tenantId, folds) {
-    const all = selectAllEntries(db, tenantId);
+function planUserGlobalRepair(store, folds) {
+    const all = store.entries();
     const renamed = new Map(folds.map((f) => [f.from, f.into]));
     const after = (origin) => (origin ? renamed.get(origin) ?? origin : origin ?? null);
-    const origins = new Map(listDormantSnapshots(db, tenantId).map((s) => [s.entry.id, after(s.entry.origin_project)]));
+    const origins = new Map(store.dormant().map((s) => [s.entry.id, after(s.entry.origin_project)]));
     for (const e of all)
         origins.set(e.id, after(e.origin_project));
     const toProject = [];
@@ -258,59 +208,45 @@ function planUserGlobalRepair(db, tenantId, folds) {
 }
 /** Sets aside stray imports, folds the names the resolver now maps elsewhere, then
  * re-tags sleep's user-global merges by their parents; a dry run only plans. */
-export function repairProjects(db, hippoRoot, opts) {
-    const { tenantId, dryRun, globalFolds = true } = opts;
+export function repairProjects(store, opts) {
+    const { dryRun, globalFolds = true } = opts;
+    const { hippoRoot } = store;
     if (dryRun)
-        return { ...planProjectRepair(db, hippoRoot, tenantId, globalFolds), backup: null };
-    const { result, rewrite, purge } = withBackup(db, hippoRoot, 'before-repair', (backup) => inTransaction(db, false, () => {
+        return { ...planProjectRepair(store, hippoRoot, globalFolds), backup: null };
+    return store.rewrite({ dryRun: false, backupLabel: 'before-repair' }, (tx, backup) => {
         const copies = [];
-        for (const row of strayImports(db, hippoRoot, tenantId)) {
+        for (const row of strayImports(tx, hippoRoot)) {
             const tag = toolTag(row.source);
-            if (tag !== null && setAsideRow(db, tag, row, 'project-repair').kind === 'dormant')
+            if (tag !== null && tx.setAside(tag, row, 'project-repair').kind === 'dormant')
                 copies.push(row.id);
         }
-        const { folds, collisions } = planFolds(db, hippoRoot, tenantId, globalFolds);
-        const folded = folds.map((f) => foldInTx(db, tenantId, f.from, f.into));
-        const plan = planUserGlobalRepair(db, tenantId, []);
-        stampOriginProjectsAt(db, tenantId, plan.toProject);
-        const aside = new Set(plan.setAside);
+        const { folds, collisions } = planFolds(tx, hippoRoot, globalFolds);
+        const folded = folds.map((f) => foldInTx(tx, f.from, f.into));
+        const plan = planUserGlobalRepair(tx, []);
+        tx.stampOrigins(plan.toProject);
         const now = new Date();
-        for (const row of selectAllEntries(db, tenantId).filter((e) => aside.has(e.id))) {
-            insertDormantRow(db, { entry: row, strength: calculateStrength(row, now), reason: 'project-repair', dormantAt: now.toISOString() });
-            deleteEntryRowInTx(db, row, ACTOR);
-        }
-        appendAuditEvent(db, { tenantId, actor: ACTOR, op: 'project_repair', metadata: { backup, copies, folds, folded, ...plan } });
+        for (const row of tx.entriesByIds(plan.setAside).values())
+            tx.retire(row, 'project-repair', now);
+        tx.audit('project_repair', { backup, copies, folds, folded, ...plan });
         return {
             result: { copies, folds, collisions, ...plan, backup },
             rewrite: [...plan.toProject.map((r) => r.id), ...folded.flatMap((f) => f.restamped)],
             purge: [...copies, ...plan.setAside, ...folded.flatMap((f) => f.setAside)],
         };
-    }));
-    refreshMirrors(db, hippoRoot, tenantId, rewrite, purge);
-    return result;
+    });
 }
-const AUTO_REPAIR_META_KEY = 'project_repair_auto';
 /** True when a repair would change nothing. */
 function repairIsEmpty(r) {
     return r.copies.length + r.folds.length + r.toProject.length + r.setAside.length === 0;
 }
 /** Sleep runs repair once per store, so an upgrade needs no command. Global-store folds stay
  *  with `hippo projects repair`: their evidence is compaction folders, blind to a same-named repo that never compacted. */
-export function repairOnceOnSleep(db, hippoRoot, tenantId) {
-    if (getMeta(db, AUTO_REPAIR_META_KEY) === '1')
+export function repairOnceOnSleep(store) {
+    if (store.repairedOnce())
         return null;
-    const plan = planProjectRepair(db, hippoRoot, tenantId, false);
-    const result = repairIsEmpty(plan) ? null : repairProjects(db, hippoRoot, { tenantId, dryRun: false, globalFolds: false });
-    setMeta(db, AUTO_REPAIR_META_KEY, '1');
+    const plan = planProjectRepair(store, store.hippoRoot, false);
+    const result = repairIsEmpty(plan) ? null : repairProjects(store, { dryRun: false, globalFolds: false });
+    store.markRepairedOnce();
     return result;
 }
-/** After commit, as the agent memory sync does: a stale mirror would bring the old tag back on the next rebuild. */
-function refreshMirrors(db, hippoRoot, tenantId, rewrite, purge) {
-    const ids = new Set(rewrite);
-    for (const entry of selectAllEntries(db, tenantId))
-        if (ids.has(entry.id))
-            writeEntryMirrors(hippoRoot, entry);
-    for (const id of purge)
-        removeEntryMirrors(hippoRoot, id);
-}
 //# sourceMappingURL=project-merge.js.map

package/dist/sharing/search-both.js

@@ -2,7 +2,7 @@
 import { compareScoresDesc } from '../core/compare.js';
 import * as fs from 'fs';
 import { loadSearchEntries, loadRecallSearchEntries, recallScopeFilter } from '../store/search-rows.js';
-import { passesScopeFilterForRecall, passesCliRecallScopeFilter } from '../store/recall-scope.js';
+import { passesScopeFilterForRecall, passesCliRecallScopeFilter } from '../core/recall-scope.js';
 import { search } from '../search/bm25-search.js';
 import { hybridSearch } from '../search/hybrid.js';
 import { fitBudget } from '../search/finalize.js';

package/dist/sharing/share.d.ts

@@ -4,6 +4,8 @@ export declare const NEVER_AUTO_SHARE_TAGS: ReadonlySet<string>;
 export declare function neverAutoShareTags(sources: readonly MemoryEntry[]): string[];
 /** Tags whose rows sleep keeps as written: never merged, never sent to LLM extraction. Conflict detection keeps its own list. */
 export declare const NO_MERGE_TAGS: ReadonlySet<string>;
+/** The transfer score a memory needs before sleep or `hippo share --auto` copies it to the global store. */
+export declare const AUTO_SHARE_MIN_SCORE = 0.6;
 /** Estimate how well a memory would transfer to other projects.
  *  Returns 0..1 where >0.5 = good candidate for sharing. */
 export declare function transferScore(entry: MemoryEntry): number;

package/dist/sharing/share.js

@@ -4,15 +4,14 @@ import * as fs from 'fs';
 import * as path from 'path';
 import { generateId, COMPACTION_MEMORY_TAG } from '../core/memory.js';
 import { AGENT_MEMORY_SOURCE_PREFIX, AGENT_MEMORY_TAGS } from '../core/agent-memory-tools.js';
-import { writeEntry } from '../store/entry-writes.js';
+import { writeEntriesSkippingRejected, writeEntry } from '../store/entry-writes.js';
 import { loadAllEntries, readEntry } from '../store/entry-reads.js';
 import { tallySources } from '../store/candidates.js';
-import { isPersonalScope } from '../store/recall-scope.js';
+import { isPersonalScope } from '../core/recall-scope.js';
 import { fallbackOrigin } from '../core/project-identity.js';
 import { detectSecret } from '../util/secret-detect.js';
 import { isQuarantineScope } from '../trust/quarantine.js';
-import { RejectedValueError } from '../store/rejection.js';
-import { embedMemory, embedAll } from '../store/embeddings/index.js';
+import { embedMemory, embedAll } from '../search/embed-memories.js';
 import { duplicateKey, storedTextKeys } from '../util/same-text.js';
 import { isReusable } from '../core/memory-quality.js';
 import { log } from '../util/log.js';
@@ -45,6 +44,8 @@ export const NO_MERGE_TAGS = new Set([
     COMPACTION_MEMORY_TAG,
     ...AGENT_MEMORY_TAGS,
 ]);
+/** The transfer score a memory needs before sleep or `hippo share --auto` copies it to the global store. */
+export const AUTO_SHARE_MIN_SCORE = 0.6;
 /** Estimate how well a memory would transfer to other projects.
  *  Returns 0..1 where >0.5 = good candidate for sharing. */
 export function transferScore(entry) {
@@ -74,28 +75,34 @@ export function shareMemory(localRoot, id, options = {}) {
     const entry = readEntry(localRoot, id, options.tenantId);
     if (!entry)
         throw new NotFoundError(`Memory not found: ${id}`);
-    assertShareable(entry, id);
-    const score = transferScore(entry);
-    if (score < 0.3 && !options.force)
+    const globalEntry = toGlobalEntry(localRoot, entry, options.force === true);
+    if (!globalEntry)
         return null;
     initGlobal();
     const globalRoot = getGlobalRoot();
+    writeEntry(globalRoot, globalEntry);
+    // Embed here unless the caller opts out: autoShare sets skipEmbed to batch one embedAll(), since embedMemory rewrites the whole index per call.
+    if (!options.skipEmbed) {
+        void embedMemory(globalRoot, globalEntry);
+    }
+    return globalEntry;
+}
+/** The global copy of a local row, or null when its transfer score is too low and `force` is off; throws when the row may not be shared. */
+function toGlobalEntry(localRoot, entry, force) {
+    assertShareable(entry, entry.id);
+    const score = transferScore(entry);
+    if (score < 0.3 && !force)
+        return null;
     // The label keeps the folder name for a user-global row; a NULL row gets `shared::`, which originFromSource reads as no project.
     const fallbackName = path.basename(path.resolve(localRoot, '..'));
     const originName = entry.origin_project ?? fallbackOrigin(localRoot);
     const label = originName === '' ? fallbackName : (originName ?? '');
-    const globalEntry = {
+    return {
         ...entry,
         id: generateId('g'),
         source: `shared:${label}:${new Date().toISOString()}`,
         origin_project: originName,
     };
-    writeEntry(globalRoot, globalEntry);
-    // Embed here unless the caller opts out: autoShare sets skipEmbed to batch one embedAll(), since embedMemory rewrites the whole index per call.
-    if (!options.skipEmbed) {
-        void embedMemory(globalRoot, globalEntry);
-    }
-    return globalEntry;
 }
 function assertShareable(entry, id) {
     // Secret veto: secrets never reach the global store, even with --force; throw loudly, since a silent null reads as "low transfer score" and invites retries.
@@ -174,29 +181,25 @@ function isAutoShareCandidate(entry, globalContentSet, minScore, stats) {
     }
     return true;
 }
-// Rejection containment: shareMemory -> writeEntry can throw RejectedValueError against the GLOBAL store tombstones and abort the autoShare sleep phase.
-// Catch per item like syncGlobalToLocal; writeEntry already audits reject_refusal before rethrowing, so count and continue.
-function shareCandidates(localRoot, candidates, stats) {
+// A row the GLOBAL store's rejection tombstones refuse is audited and skipped, so it cannot abort the autoShare sleep phase.
+// The candidates are rows already held, written in one transaction; the caller embeds once via embedAll() afterwards.
+function shareCandidates(localRoot, globalRoot, candidates, stats) {
     const shared = [];
     let rejectedSkipped = 0;
-    for (const entry of candidates) {
-        try {
-            // skipEmbed: batching invariant, this is a batch producer, so it embeds
-            // once via embedAll() below rather than once per row inside shareMemory.
-            const result = shareMemory(localRoot, entry.id, { force: true, skipEmbed: true });
-            if (result)
-                shared.push(result);
-        }
-        catch (err) {
-            if (err instanceof RejectedValueError) {
-                rejectedSkipped++;
-                if (stats)
-                    stats.rejectedSkipped = (stats.rejectedSkipped ?? 0) + 1;
+    writeEntriesSkippingRejected(globalRoot, (put) => {
+        for (const entry of candidates) {
+            const globalEntry = toGlobalEntry(localRoot, entry, true);
+            if (!globalEntry)
+                continue;
+            if (put(globalEntry)) {
+                shared.push(globalEntry);
                 continue;
             }
-            throw err;
+            rejectedSkipped++;
+            if (stats)
+                stats.rejectedSkipped = (stats.rejectedSkipped ?? 0) + 1;
         }
-    }
+    });
     if (rejectedSkipped > 0) {
         log.warn(`autoShare: skipped ${rejectedSkipped} candidate(s) refused by the global store's rejection tombstone`);
     }
@@ -205,7 +208,7 @@ function shareCandidates(localRoot, candidates, stats) {
 /** Auto-share local memories with high transfer scores, not already global and without a NEVER_AUTO_SHARE_TAGS tag; `options.tenantId` scopes the LOCAL read.
  *  `options.stats` is an opt-in out-param: `secretSkipped` counts shares the secret veto prevented, `rejectedSkipped` rejection refusals (0 under `dryRun`). */
 export function autoShare(localRoot, options = {}) {
-    const { minScore = 0.6, dryRun = false } = options;
+    const { minScore = AUTO_SHARE_MIN_SCORE, dryRun = false } = options;
     const localEntries = loadAllEntries(localRoot, options.tenantId);
     initGlobal();
     const globalRoot = getGlobalRoot();
@@ -217,7 +220,7 @@ export function autoShare(localRoot, options = {}) {
     const candidates = localEntries.filter((entry) => isAutoShareCandidate(entry, globalContentSet, minScore, options.stats));
     if (dryRun)
         return candidates;
-    const shared = shareCandidates(localRoot, candidates, options.stats);
+    const shared = shareCandidates(localRoot, globalRoot, candidates, options.stats);
     if (shared.length > 0) {
         void embedAll(globalRoot).catch((err) => logEmbedAllFailure('autoShare', err));
     }

package/dist/store/ambient.js

@@ -1,11 +1,10 @@
 import { strengthSql } from './rule-sql.js';
-import { scopeAdmitSql } from './recall-scope.js';
+import { scopeAdmitSql } from './rule-sql.js';
 import { SECRET_TAGS } from '../util/secret-detect.js';
 import { onHandle, openStore } from './open.js';
 import { jsonList } from './candidates.js';
 import { originInSql } from '../core/project-identity.js';
-import { isErrorTagged } from '../core/ambient.js';
-import { DAY_MS } from '../util/time.js';
+import { AMBIENT_FRESH_WINDOW_MS, HIGH_SCHEMA_FIT_ABOVE, isErrorTagged } from '../core/ambient.js';
 // SHORTCUT: mirrors loadContextCandidates' WHERE (request-path snapshots pin the match); share it once store.ts is split.
 function contextRowsWhere(tenantId, filter) {
     const where = ['tenant_id = ?', `COALESCE(superseded_by, '') = ''`, `COALESCE(kind, '') != 'archived'`];
@@ -39,7 +38,7 @@ function secretTaggedSql() {
 export function loadAmbientTallies(hippoRoot, tenantId, filter) {
     const { where, params } = contextRowsWhere(tenantId, filter);
     const secret = secretTaggedSql();
-    const sevenDaysAgo = new Date(filter.now.getTime() - 7 * DAY_MS).toISOString();
+    const freshAfter = new Date(filter.now.getTime() - AMBIENT_FRESH_WINDOW_MS).toISOString();
     return onHandle(hippoRoot, (db) => {
         // SAFETY: one aggregate row whose columns are the aliases named below. Tag lists come back as one JSON array of
         // arrays and are counted in JS, which maps items through String() as parseJsonArray does.
@@ -48,7 +47,7 @@ export function loadAmbientTallies(hippoRoot, tenantId, filter) {
       COALESCE(SUM(${strengthSql(filter.now)}), 0) AS strengthSum,
       COALESCE(SUM(julianday(created) > julianday(?)), 0) AS fresh,
       COALESCE(SUM(emotional_valence IN ('negative', 'critical')), 0) AS negative,
-      COALESCE(SUM(COALESCE(schema_fit, 0.5) > 0.7), 0) AS highSchemaFit,
+      COALESCE(SUM(COALESCE(schema_fit, 0.5) > ?), 0) AS highSchemaFit,
       COALESCE(SUM(layer = 'semantic'), 0) AS semantic,
       COALESCE(SUM(layer = 'episodic'), 0) AS episodic,
       COALESCE(SUM(json_array_length(${jsonList('conflicts_with_json')})), 0) AS conflicts,
@@ -57,7 +56,7 @@ export function loadAmbientTallies(hippoRoot, tenantId, filter) {
       '[' || COALESCE(group_concat(${jsonList('tags_json')}, ','), '') || ']' AS tagLists
       FROM memories
       WHERE ${where.join(' AND ')}
-        AND ((${originInSql(filter.currentProject)} AND origin_project != '') OR NOT ${secret.sql})`).get(sevenDaysAgo, ...params, ...filter.currentProject, ...secret.params);
+        AND ((${originInSql(filter.currentProject)} AND origin_project != '') OR NOT ${secret.sql})`).get(freshAfter, HIGH_SCHEMA_FIT_ABOVE, ...params, ...filter.currentProject, ...secret.params);
         const tagCounts = new Map();
         let errors = 0;
         const lists = /* SAFETY: jsonList yields an array per row, joined into one array */ JSON.parse(row.tagLists);

package/dist/store/audit-event.d.ts

@@ -1,6 +1,6 @@
 import { openHippoDb } from '../db/index.js';
 import { type AuditOp } from './audit.js';
-import { RejectedValueError } from './rejection.js';
+import { RejectedValueError } from '../core/api-errors.js';
 import type { JsonValue } from '../util/json.js';
 export interface AuditOptions {
     readonly targetId?: string;

package/dist/store/audit.d.ts

@@ -1,22 +1,6 @@
-import { type MemoryEntry } from '../core/memory.js';
 import { type DatabaseSyncLike } from '../db/index.js';
 import type { JsonObject } from './working-memory.js';
 import { type KeysetPosition } from '../util/keyset.js';
-export type AuditSeverity = 'warning' | 'error';
-export interface AuditIssue {
-    memoryId: string;
-    content: string;
-    severity: AuditSeverity;
-    reason: string;
-}
-export interface AuditResult {
-    total: number;
-    issues: AuditIssue[];
-    clean: number;
-}
-export declare function auditMemory(entry: MemoryEntry, backsObject?: boolean): AuditIssue | null;
-/** `backing`: ids of memories that back an object (store.memoriesBackingObjects). */
-export declare function auditMemories(entries: MemoryEntry[], backing: ReadonlySet<string>): AuditResult;
 export declare const AUDIT_OPS: readonly ["remember", "recall", "promote", "supersede", "forget", "archive_raw", "auth_revoke", "auth_create", "outcome", "consolidate", "audit_prune", "summary_marked_dirty", "summary_marked_clean", "summary_rebuilt", "predict_create", "predict_close", "predict_baserate", "recall_autodebias_hint", "recall_autodebias_hint_no_class_match", "recall_autodebias_hint_tiebreak", "recall_anchor_detected_query_repeat", "recall_anchor_detected_memory_dominance", "recall_anchor_skipped_no_session", "recall_availability_detected", "decision_create", "decision_supersede", "decision_close", "incident_open", "incident_resolve", "incident_close", "process_create", "process_supersede", "process_close", "policy_create", "policy_supersede", "policy_close", "skill_create", "skill_supersede", "skill_close", "project_brief_create", "project_brief_supersede", "project_brief_close", "customer_note_create", "customer_note_supersede", "customer_note_close", "mv_rescue", "reject_value", "reject_refusal", "unreject_value", "conflict_resolve", "half_life_migrate", "dormant_restore", "auth_grant", "auth_ungrant", "quarantine", "quarantine_approve", "quarantine_reject", "agent_memory_restore", "agent_memory_set_aside", "project_merge", "project_repair", "quality_repair"];
 export type AuditOp = (typeof AUDIT_OPS)[number];
 export interface AppendAuditOpts {

package/dist/store/audit.js

@@ -1,60 +1,9 @@
-import { createHash } from 'node:crypto';
-import { canAutoDelete } from '../core/memory.js';
+import { DEFAULT_LIST_LIMIT } from '../util/limits.js';
 import { closeHippoDb, openHippoDb, withWriteScope } from '../db/index.js';
 import { log } from '../util/log.js';
+import { blockHash } from '../util/token-text.js';
 import { keysetAfter } from '../util/keyset.js';
 import { warnDamagedColumn } from '../util/stored-json.js';
-import { automaticDefect, hasNoSpecificity, isFragment, isReleaseCommitNoise, substantiveWordCount, } from '../core/memory-quality.js';
-export function auditMemory(entry, backsObject = false) {
-    const issue = classifyMemory(entry);
-    // Error means "auto-remove"; a pinned, raw, kept-for-good or object-backing row is never auto-removed, so it can only warn.
-    if (issue?.severity === 'error' && (!canAutoDelete(entry) || backsObject)) {
-        const why = entry.pinned ? 'pinned' : entry.kind === 'raw' ? 'raw' : backsObject ? 'backs an object' : 'keep rule';
-        return { ...issue, severity: 'warning', reason: `${issue.reason} (${why}, kept)` };
-    }
-    return issue;
-}
-function classifyMemory(entry) {
-    const content = entry.content.trim();
-    if (content.length < 3) {
-        return { memoryId: entry.id, content, severity: 'error', reason: 'too short (< 3 chars)' };
-    }
-    if (content.length < 10) {
-        return { memoryId: entry.id, content, severity: 'error', reason: 'too short (< 10 chars)' };
-    }
-    if (isReleaseCommitNoise(content)) {
-        return { memoryId: entry.id, content, severity: 'error', reason: 'release/commit noise, not a useful memory' };
-    }
-    if (isFragment(content)) {
-        return { memoryId: entry.id, content, severity: 'warning', reason: 'sentence fragment — lacks context' };
-    }
-    const substantive = substantiveWordCount(content);
-    if (substantive < 2) {
-        return { memoryId: entry.id, content, severity: 'warning', reason: `only ${substantive} substantive word(s) — too vague` };
-    }
-    if (content.length < 40 && hasNoSpecificity(content)) {
-        return { memoryId: entry.id, content, severity: 'warning', reason: 'no specific details (names, paths, numbers, code)' };
-    }
-    const reason = automaticDefect(entry);
-    if (reason !== null) {
-        return { memoryId: entry.id, content, severity: 'warning', reason: `automatic memory defect: ${reason}` };
-    }
-    return null;
-}
-/** `backing`: ids of memories that back an object (store.memoriesBackingObjects). */
-export function auditMemories(entries, backing) {
-    const issues = [];
-    for (const entry of entries) {
-        const issue = auditMemory(entry, backing.has(entry.id));
-        if (issue)
-            issues.push(issue);
-    }
-    return {
-        total: entries.length,
-        issues,
-        clean: entries.length - issues.length,
-    };
-}
 // The one list of audit ops: the AuditOp type, `hippo audit list --op` and GET /v1/audit?op= all read it.
 export const AUDIT_OPS = [
     'remember',
@@ -128,7 +77,7 @@ function bigintSafeReplacer(_key, value) {
 }
 export function auditQueryFields(query) {
     return {
-        query_hash: createHash('sha256').update(query).digest('hex').slice(0, 16),
+        query_hash: blockHash(query),
         query_length: query.length,
     };
 }
@@ -172,7 +121,7 @@ export function queryAuditEvents(db, opts) {
     }
     const after = keysetAfter('ts', 'id', opts.after);
     // One past the route's 10000 cap: GET /v1/audit reads a row ahead to tell whether another page exists.
-    const limit = Math.max(1, Math.min(opts.limit ?? 100, 10001));
+    const limit = Math.max(1, Math.min(opts.limit ?? DEFAULT_LIST_LIMIT, 10001));
     // SAFETY: AUDIT_COLUMNS names exactly the AuditRow columns, in this order.
     const rows = db
         .prepare(`SELECT ${AUDIT_COLUMNS} FROM audit_log WHERE ${where.join(' AND ')}${after.sql} ORDER BY ts DESC, id DESC LIMIT ?`)