hippo-memory 1.71.0 → 1.72.0

package/dist/store/connectors/github.js

@@ -2,31 +2,31 @@
 import { withWriteScope } from '../../db/index.js';
 import { archiveRawMemory } from '../raw-archive.js';
 import { onHandle } from '../open.js';
-export function eventSeenAt(db, idempotencyKey) {
+import { getDlqRow, insertDlqRow, listDlqRows, markDlqRetried } from './dlq.js';
+export function githubEventSeenAt(db, idempotencyKey) {
     const row = db.prepare(`SELECT 1 FROM github_event_log WHERE idempotency_key = ?`).get(idempotencyKey);
     return !!row;
 }
-export function eventMemoryAt(db, idempotencyKey) {
+export function githubEventMemoryAt(db, idempotencyKey) {
     // SAFETY: the SELECT projects exactly the memory_id column of github_event_log.
     const row = db.prepare(`SELECT memory_id FROM github_event_log WHERE idempotency_key = ?`).get(idempotencyKey);
     return row?.memory_id ?? null;
 }
 /** False when the key was already logged, so a caller inside a write scope can roll its own row back. */
-export function logEventAt(db, entry) {
+export function markGitHubEventSeenAt(db, entry) {
     const inserted = db.prepare(`INSERT OR IGNORE INTO github_event_log (idempotency_key, delivery_id, event_name, ingested_at, memory_id) VALUES (?, ?, ?, ?, ?)`).run(entry.idempotencyKey, entry.deliveryId, entry.eventName, new Date().toISOString(), entry.memoryId);
     return Number(inserted.changes ?? 0) !== 0;
 }
-/** The memory an already-seen key points at, or null when the key is new. */
-export function seenEvent(hippoRoot, idempotencyKey) {
-    return onHandle(hippoRoot, (db) => eventSeenAt(db, idempotencyKey) ? { memoryId: eventMemoryAt(db, idempotencyKey) } : null);
+export function githubEventRecord(hippoRoot, idempotencyKey) {
+    return onHandle(hippoRoot, (db) => githubEventSeenAt(db, idempotencyKey) ? { seen: true, memoryId: githubEventMemoryAt(db, idempotencyKey) } : { seen: false });
 }
-export function logEvent(hippoRoot, entry) {
-    onHandle(hippoRoot, (db) => { logEventAt(db, entry); });
+export function markGitHubEventSeen(hippoRoot, entry) {
+    onHandle(hippoRoot, (db) => { markGitHubEventSeenAt(db, entry); });
 }
 /** Archives every active raw row of one tenant's artifact and logs the delete event; a failed archive rolls back the batch and the log row. */
 export function archiveDeletedArtifact(hippoRoot, del) {
     return onHandle(hippoRoot, (db) => {
-        if (eventSeenAt(db, del.idempotencyKey))
+        if (githubEventSeenAt(db, del.idempotencyKey))
             return { duplicate: true, archived: 0 };
         const logged = { idempotencyKey: del.idempotencyKey, deliveryId: del.deliveryId, eventName: del.eventName };
         // SAFETY: the SELECT projects only the `id` column.
@@ -36,29 +36,17 @@ export function archiveDeletedArtifact(hippoRoot, del) {
         const memoryIds = rows.map((r) => r.id);
         if (memoryIds.length === 0) {
             // Still logged, so a retry of the same delete answers 'duplicate'.
-            logEventAt(db, { ...logged, memoryId: null });
+            markGitHubEventSeenAt(db, { ...logged, memoryId: null });
             return { duplicate: false, archived: 0 };
         }
         withWriteScope(db, 'github_delete_all', () => {
             for (const id of memoryIds)
                 archiveRawMemory(db, id, { reason: del.reason, who: del.who });
-            logEventAt(db, { ...logged, memoryId: memoryIds[0] });
+            markGitHubEventSeenAt(db, { ...logged, memoryId: memoryIds[0] });
         });
         return { duplicate: false, archived: memoryIds.length };
     });
 }
-function insertGitHubDlqAt(db, row) {
-    const result = db
-        .prepare(`INSERT INTO github_dlq
-        (tenant_id, raw_payload, error, event_name, delivery_id, signature,
-         installation_id, repo_full_name, received_at, bucket)
-       VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?)`)
-        .run(row.tenantId, row.rawPayload, row.error, row.eventName ?? null, row.deliveryId ?? null, row.signature, row.installationId ?? null, row.repoFullName ?? null, new Date().toISOString(), row.bucket);
-    return Number(result.lastInsertRowid);
-}
-export function insertGitHubDlq(hippoRoot, row) {
-    return onHandle(hippoRoot, (db) => insertGitHubDlqAt(db, row));
-}
 const SELECT_COLUMNS = `id, tenant_id, raw_payload, error, event_name, delivery_id,
             signature, installation_id, repo_full_name, retry_count,
             received_at, retried_at, bucket`;
@@ -79,42 +67,31 @@ function rowToItem(r) {
         bucket: r.bucket == null ? 'parse_error' : String(r.bucket),
     };
 }
-function listGitHubDlqAt(db, tenantId, limit) {
-    // SAFETY: SELECT_COLUMNS projects exactly DlqRawRow's fields.
-    const rows = db
-        .prepare(`SELECT ${SELECT_COLUMNS}
-         FROM github_dlq
-        WHERE tenant_id = ?
-        ORDER BY received_at ASC
-        LIMIT ?`)
-        .all(tenantId, limit);
-    return rows.map(rowToItem);
+export function insertGitHubDlq(hippoRoot, row) {
+    return onHandle(hippoRoot, (db) => insertDlqRow(db, 'github_dlq', [
+        ['tenant_id', row.tenantId],
+        ['raw_payload', row.rawPayload],
+        ['error', row.error],
+        ['event_name', row.eventName ?? null],
+        ['delivery_id', row.deliveryId ?? null],
+        ['signature', row.signature],
+        ['installation_id', row.installationId ?? null],
+        ['repo_full_name', row.repoFullName ?? null],
+        ['bucket', row.bucket],
+    ]));
 }
 export function listGitHubDlq(hippoRoot, tenantId, limit) {
-    return onHandle(hippoRoot, (db) => listGitHubDlqAt(db, tenantId, limit));
-}
-function githubDlqEntryAt(db, id) {
-    // SAFETY: SELECT_COLUMNS projects exactly DlqRawRow's fields.
-    const row = db
-        .prepare(`SELECT ${SELECT_COLUMNS}
-         FROM github_dlq
-        WHERE id = ?`)
-        .get(id);
-    if (!row)
-        return null;
-    return rowToItem(row);
+    return onHandle(hippoRoot, (db) => listDlqRows(db, 'github_dlq', SELECT_COLUMNS, tenantId, limit).map(rowToItem));
 }
 export function githubDlqEntry(hippoRoot, id) {
-    return onHandle(hippoRoot, (db) => githubDlqEntryAt(db, id));
-}
-export function bumpGitHubDlqRetryCount(hippoRoot, id) {
-    onHandle(hippoRoot, (db) => {
-        db.prepare(`UPDATE github_dlq
-          SET retry_count = retry_count + 1,
-              retried_at = ?
-        WHERE id = ?`).run(new Date().toISOString(), id);
+    return onHandle(hippoRoot, (db) => {
+        const row = getDlqRow(db, 'github_dlq', SELECT_COLUMNS, id);
+        return row ? rowToItem(row) : null;
     });
 }
+export function markGitHubDlqRetried(hippoRoot, id) {
+    onHandle(hippoRoot, (db) => markDlqRetried(db, 'github_dlq', id));
+}
 export function githubRouting(hippoRoot, args) {
     return onHandle(hippoRoot, (db) => {
         // SAFETY: the SELECT projects exactly one column, `c`, as a COUNT(*).

package/dist/store/connectors/slack.d.ts

@@ -1,4 +1,5 @@
 import type { DatabaseSyncLike } from '../../db/index.js';
+import type { ConnectorEventRecord } from '../port.js';
 export declare function slackCursorAt(db: DatabaseSyncLike, tenantId: string, channelId: string): string | null;
 export declare function saveSlackCursorAt(db: DatabaseSyncLike, tenantId: string, channelId: string, latestTs: string): void;
 export declare function slackCursor(hippoRoot: string, tenantId: string, channelId: string): string | null;
@@ -7,14 +8,7 @@ export declare function slackEventSeenAt(db: DatabaseSyncLike, eventId: string):
 /** Records the event unless a row already holds its id; false means another writer got there first. */
 export declare function markSlackEventSeenAt(db: DatabaseSyncLike, eventId: string, memoryId: string | null): boolean;
 export declare function slackEventMemoryAt(db: DatabaseSyncLike, eventId: string): string | null;
-/** What the event log holds for one event id; `memoryId` is null for an event seen without a memory. */
-export type SlackEventRecord = {
-    seen: false;
-} | {
-    seen: true;
-    memoryId: string | null;
-};
-export declare function slackEventRecord(hippoRoot: string, eventId: string): SlackEventRecord;
+export declare function slackEventRecord(hippoRoot: string, eventId: string): ConnectorEventRecord;
 export declare function markSlackEventSeen(hippoRoot: string, eventId: string, memoryId: string | null): void;
 /** The raw memory a Slack message became. The tenant filter keeps one tenant's deletion from reaching another's row with the same ref. */
 export declare function rawMemoryIdForArtifactAt(db: DatabaseSyncLike, artifactRef: string, tenantId: string): string | null;
@@ -42,13 +36,10 @@ export interface SlackDlqInsert {
     signature: string | null;
     slackTimestamp?: string | null;
 }
-/** Counts a failed replay and leaves `retried_at` alone, so the row still reads as never drained. */
-export declare function bumpSlackDlqRetryCountAt(db: DatabaseSyncLike, id: number): void;
 export declare function insertSlackDlq(hippoRoot: string, row: SlackDlqInsert): number;
 export declare function listSlackDlq(hippoRoot: string, tenantId: string, limit: number): DlqItem[];
 export declare function slackDlqEntry(hippoRoot: string, id: number): DlqItem | null;
 export declare function markSlackDlqRetried(hippoRoot: string, id: number): void;
-export declare function bumpSlackDlqRetryCount(hippoRoot: string, id: number): void;
 /** The tenant a team maps to, or how many workspaces are registered when it maps to none. */
 export type SlackTeamRoute = {
     tenantId: string;

package/dist/store/connectors/slack.js

@@ -1,6 +1,7 @@
 // Every statement the Slack connector runs on hippo.db: backfill cursors, the event log, the dead-letter queue and workspace routing.
 // `xAt(db, ...)` runs on the caller's handle; the same name without `At` opens hippo.db for that one call.
 import { onHandle } from '../open.js';
+import { getDlqRow, insertDlqRow, listDlqRows, markDlqRetried } from './dlq.js';
 // Backfill cursors
 export function slackCursorAt(db, tenantId, channelId) {
     // SAFETY: the SELECT names the single `latest_ts` column; sqlite returns undefined when no row matches.
@@ -51,6 +52,8 @@ export function rawMemoryIdForArtifactAt(db, artifactRef, tenantId) {
         .get(artifactRef, tenantId);
     return row?.id ?? null;
 }
+const SELECT_COLUMNS = `id, tenant_id, team_id, raw_payload, error, received_at, retried_at,
+              bucket, retry_count, signature, slack_timestamp`;
 function rowToItem(r) {
     return {
         id: Number(r.id),
@@ -66,60 +69,28 @@ function rowToItem(r) {
         slackTimestamp: r.slack_timestamp == null ? null : String(r.slack_timestamp),
     };
 }
-function insertSlackDlqAt(db, row) {
-    const result = db
-        .prepare(`INSERT INTO slack_dlq
-        (tenant_id, team_id, raw_payload, error, received_at, bucket, signature, slack_timestamp)
-       VALUES (?, ?, ?, ?, ?, ?, ?, ?)`)
-        .run(row.tenantId, row.teamId ?? null, row.rawPayload, row.error, new Date().toISOString(), row.bucket, row.signature, row.slackTimestamp ?? null);
-    return Number(result.lastInsertRowid);
-}
-function listSlackDlqAt(db, tenantId, limit) {
-    // SAFETY: row shape matches the columns named in the SELECT below.
-    const rows = db
-        .prepare(`SELECT id, tenant_id, team_id, raw_payload, error, received_at, retried_at,
-              bucket, retry_count, signature, slack_timestamp
-         FROM slack_dlq
-        WHERE tenant_id = ?
-        ORDER BY received_at ASC
-        LIMIT ?`)
-        .all(tenantId, limit);
-    return rows.map(rowToItem);
-}
-function slackDlqEntryAt(db, id) {
-    // SAFETY: row shape matches the columns named in the SELECT below.
-    const row = db
-        .prepare(`SELECT id, tenant_id, team_id, raw_payload, error, received_at, retried_at,
-              bucket, retry_count, signature, slack_timestamp
-         FROM slack_dlq
-        WHERE id = ?`)
-        .get(id);
-    if (!row)
-        return null;
-    return rowToItem(row);
-}
-function markSlackDlqRetriedAt(db, id) {
-    db.prepare(`UPDATE slack_dlq SET retried_at = ?, retry_count = retry_count + 1 WHERE id = ?`)
-        .run(new Date().toISOString(), id);
-}
-/** Counts a failed replay and leaves `retried_at` alone, so the row still reads as never drained. */
-export function bumpSlackDlqRetryCountAt(db, id) {
-    db.prepare(`UPDATE slack_dlq SET retry_count = retry_count + 1 WHERE id = ?`).run(id);
-}
 export function insertSlackDlq(hippoRoot, row) {
-    return onHandle(hippoRoot, (db) => insertSlackDlqAt(db, row));
+    return onHandle(hippoRoot, (db) => insertDlqRow(db, 'slack_dlq', [
+        ['tenant_id', row.tenantId],
+        ['team_id', row.teamId ?? null],
+        ['raw_payload', row.rawPayload],
+        ['error', row.error],
+        ['bucket', row.bucket],
+        ['signature', row.signature],
+        ['slack_timestamp', row.slackTimestamp ?? null],
+    ]));
 }
 export function listSlackDlq(hippoRoot, tenantId, limit) {
-    return onHandle(hippoRoot, (db) => listSlackDlqAt(db, tenantId, limit));
+    return onHandle(hippoRoot, (db) => listDlqRows(db, 'slack_dlq', SELECT_COLUMNS, tenantId, limit).map(rowToItem));
 }
 export function slackDlqEntry(hippoRoot, id) {
-    return onHandle(hippoRoot, (db) => slackDlqEntryAt(db, id));
+    return onHandle(hippoRoot, (db) => {
+        const row = getDlqRow(db, 'slack_dlq', SELECT_COLUMNS, id);
+        return row ? rowToItem(row) : null;
+    });
 }
 export function markSlackDlqRetried(hippoRoot, id) {
-    onHandle(hippoRoot, (db) => markSlackDlqRetriedAt(db, id));
-}
-export function bumpSlackDlqRetryCount(hippoRoot, id) {
-    onHandle(hippoRoot, (db) => bumpSlackDlqRetryCountAt(db, id));
+    onHandle(hippoRoot, (db) => markDlqRetried(db, 'slack_dlq', id));
 }
 export function slackTeamRouteAt(db, teamId) {
     // SAFETY: the SELECT names only `tenant_id`; .get() returns undefined when no row matches.

package/dist/store/dashboard-reads.js

@@ -8,7 +8,8 @@ import { storedVectorIds } from '../db/vector-store.js';
 import { onHandle, openStore } from './open.js';
 import { QUARANTINE_SCOPE_PREFIX } from './quarantine.js';
 import { parseJsonArray } from './rows.js';
-const LIVE_COLUMNS = 'id, created, last_retrieved, retrieval_count, half_life_days, layer, tags_json, emotional_valence, outcome_positive, outcome_negative, pinned, confidence, content, superseded_by, kind, scope, origin_project';
+const LIVE_COLUMNS = 'id, created, last_retrieved, retrieval_count, half_life_days, layer, tags_json, emotional_valence, outcome_positive, ' +
+    'outcome_negative, pinned, confidence, content, superseded_by, kind, scope, origin_project';
 // SQL twins of isQuarantineScope and of the two halves of isLiveMemory; substr compares bytes, as startsWith does, where LIKE would fold case.
 const QUARANTINED = `(scope IS NOT NULL AND substr(scope, 1, ${QUARANTINE_SCOPE_PREFIX.length}) = '${QUARANTINE_SCOPE_PREFIX}')`;
 const SUPERSEDED_BY = `(superseded_by IS NOT NULL AND superseded_by <> '')`;
@@ -44,11 +45,11 @@ export function loadDashboardRows(hippoRoot, tenantId) {
             // SAFETY: the SELECT names exactly LiveRow's columns.
             const live = db.prepare(`SELECT ${LIVE_COLUMNS} FROM memories WHERE tenant_id = ? AND ${LIVE} ORDER BY created ASC, id ASC`).all(tenantId);
             // SAFETY: the SELECT names exactly these two fields, and `why` is one of the three CASE arms or NULL.
-            const counts = db.prepare(`
-        SELECT CASE WHEN ${QUARANTINED} THEN 'quarantined' WHEN ${SUPERSEDED_BY} OR ${KIND} = 'superseded' THEN 'superseded' WHEN ${KIND} = 'archived' THEN 'archived' END AS why,
-               COUNT(*) AS n
-        FROM memories WHERE tenant_id = ? AND NOT (${LIVE}) GROUP BY why
-      `).all(tenantId);
+            const counts = db.prepare(`\n        SELECT CASE WHEN ${QUARANTINED} THEN 'quarantined' ` +
+                `WHEN ${SUPERSEDED_BY} OR ${KIND} = 'superseded' THEN 'superseded' ` +
+                `WHEN ${KIND} = 'archived' THEN 'archived' END AS why,\n` +
+                `               COUNT(*) AS n\n` +
+                `        FROM memories WHERE tenant_id = ? AND NOT (${LIVE}) GROUP BY why\n      `).all(tenantId);
             const excluded = { superseded: 0, archived: 0, quarantined: 0 };
             for (const { why, n } of counts)
                 if (why !== null)

package/dist/store/delete-and-batch.d.ts

@@ -26,6 +26,12 @@ export declare function deleteEntry(hippoRoot: string, id: string, opts?: {
     reason?: string;
     automatic?: boolean;
 }): boolean;
+/** deleteEntry with `automatic` for each removal and its own forget row and reason, all in one transaction after one read of the id set.
+ *  Returns the ids deleted, in `removals` order; a missing, repeated, pinned, raw or object-backing id is left out. */
+export declare function deleteEntriesAutomatically(hippoRoot: string, removals: readonly {
+    id: string;
+    reason: string;
+}[], actor: string): string[];
 /** Each row as the caller loaded it, by id; a `ReadonlyMap` fits. */
 export type LoadedRows = Pick<ReadonlyMap<string, MemoryEntry>, 'get'>;
 /** Writes, deletes and dormant moves in one transaction. With `snapshot`, a write keeps only the fields the caller changed and never resurrects a gone row.

package/dist/store/delete-and-batch.js

@@ -2,7 +2,8 @@ import { DEFAULT_TENANT_ID } from '../util/env.js';
 import { RawAppendOnlyError } from '../core/raw-append-only.js';
 import { AUTO_DELETABLE_SQL } from './rule-sql.js';
 import { closeHippoDb, withWriteScope } from '../db/index.js';
-import { checkRejectionGuard, RejectedValueError } from './rejection.js';
+import { checkRejectionGuard } from './rejection.js';
+import { RejectedValueError } from '../core/api-errors.js';
 import { markSummaryDirtyInTx } from './summary-dirty.js';
 import { insertDormantRow } from './dormant.js';
 import { log } from '../util/log.js';
@@ -12,6 +13,7 @@ import { deleteFtsRow, replaceFtsRows, stampOriginProject, upsertMemoryRow } fro
 import { purgeMirrorBestEffort, mirrorBestEffort, writeMarkdownMirror } from './mirrors.js';
 import { onHandle, openStore } from './open.js';
 import { clock } from '../util/write-budget.js';
+import { chunked } from '../util/chunked.js';
 /** Tables whose rows keep a first-class object's backing memory in `memory_id` (ON DELETE SET NULL); tests/dormant-memories.test.ts pins it to the schema. */
 export const MEMORY_BACKED_TABLES = ['predictions', 'decisions', 'incidents', 'processes', 'policies', 'skills', 'project_briefs', 'customer_notes'];
 /** Deleting a memory that backs an object nulls the object's link, and no restore can repair it, so no automatic pass may. */
@@ -61,8 +63,10 @@ export function deleteEntryCore(db, id, opts) {
     const row = db
         .prepare(`SELECT id, tenant_id, dag_parent_id FROM memories WHERE id = ?`)
         .get(id);
-    if (!row?.id)
-        return null;
+    return row?.id ? deleteTargetRow(db, row, opts) : null;
+}
+function deleteTargetRow(db, row, opts) {
+    const { id } = row;
     const guard = opts?.automatic ? ` AND ${AUTOMATIC_DELETE_SQL}` : '';
     if (deleteMemoryRow(db, `DELETE FROM memories WHERE id = ?${guard}`, id) === 0)
         return null;
@@ -92,6 +96,35 @@ function deleteEntryOn(db, hippoRoot, id, opts) {
     purgeMirrorBestEffort(hippoRoot, id, false, 'deleteEntry');
     return true;
 }
+/** deleteEntry with `automatic` for each removal and its own forget row and reason, all in one transaction after one read of the id set.
+ *  Returns the ids deleted, in `removals` order; a missing, repeated, pinned, raw or object-backing id is left out. */
+export function deleteEntriesAutomatically(hippoRoot, removals, actor) {
+    if (removals.length === 0)
+        return [];
+    const deleted = onHandle(hippoRoot, (db) => withWriteScope(db, 'delete_entries_automatically', () => {
+        const rows = selectDeleteTargets(db, removals.map((removal) => removal.id));
+        return removals
+            .filter(({ id, reason }) => {
+            const row = rows.get(id);
+            return row !== undefined && deleteTargetRow(db, row, { actor, reason, automatic: true }) !== null;
+        })
+            .map((removal) => removal.id);
+    }), openStore);
+    for (const id of deleted)
+        purgeMirrorBestEffort(hippoRoot, id, false, 'deleteEntry');
+    return deleted;
+}
+function selectDeleteTargets(db, ids) {
+    const rows = new Map();
+    for (const chunk of chunked([...new Set(ids)])) {
+        // SAFETY: rows' shape matches the three columns named in the SELECT.
+        const found = db.prepare(`SELECT id, tenant_id, dag_parent_id FROM memories WHERE id IN (${chunk.map(() => '?').join(',')})`)
+            .all(...chunk);
+        for (const row of found)
+            rows.set(row.id, row);
+    }
+    return rows;
+}
 // The child fields a level-2/3 summary is built from (loadChildrenOfSummary, generateDagSummary).
 const SUMMARY_INPUTS = ['content', 'created', 'dag_parent_id', 'kind'];
 function mergeOwnChanges(base, ours, live) {

package/dist/store/delivery-recorder.d.ts

@@ -1,7 +1,7 @@
 import type { MemoryEntry } from '../core/memory.js';
 import { type PromptRecallGate } from '../core/prompt-recall.js';
 export type DeliveryRuntime = 'claude-code' | 'codex' | 'copilot' | 'unknown';
-export type DeliveryEventType = 'prompt-submit' | 'pinned-manual' | 'pre-compact' | 'compact-resume' | 'session-end' | 'context';
+export type DeliveryEventType = 'prompt-submit' | 'pinned-manual' | 'pre-compact' | 'compact-resume' | 'session-end' | 'context' | 'tool-failure';
 /** True for the boundary types: a compaction's two hooks and the end of a session. */
 export declare const isBoundaryEvent: (type: DeliveryEventType) => boolean;
 export type DeliverySurface = 'hook' | 'context';
@@ -12,8 +12,9 @@ export type DeliveryPool = 'pin' | 'recent' | 'prompt-recall' | 'strength' | 'se
 export type DeliveryStage = 'load' | 'eligible' | 'gate' | 'budget' | 'limit' | 'final';
 export type DeliveryOutcome = 'emitted' | 'reused' | 'rejected';
 export type DeliveryRejectReason = 'budget' | 'gate-below-threshold' | 'gate-max-items' | 'duplicate' | 'scope' | 'quality' | 'limit';
-/** Row format version in `delivery_events.ledger_version`: 3 = written by a binary that can write session-end and context rows, so `event_type` has six values. */
-export declare const DELIVERY_LEDGER_VERSION = 3;
+/** Row format version in `delivery_events.ledger_version`: 4 = written by a binary that can write `tool-failure` rows and hashes the
+ * store's resolved root. */
+export declare const DELIVERY_LEDGER_VERSION = 4;
 /** Rejected candidate rows kept per event; the rest only add to `rejected_unlisted`. */
 export declare const DELIVERY_REJECTED_ROW_CAP = 16;
 export interface DeliveryCandidateInput {
@@ -61,6 +62,10 @@ export interface DeliveryEventInput {
     recallHash: string | null;
     emittedHash: string | null;
     elapsedMs: number;
+    /** The host's id for the tool call; set on `tool-failure` rows only. */
+    toolUseId?: string | null;
+    /** The `failure_log` row the failure was logged as; set on `tool-failure` rows only. */
+    failureId?: number | null;
     candidates: readonly DeliveryCandidateInput[];
 }
 export interface DeliveryFacts {
@@ -116,6 +121,8 @@ export interface DeliveryOutcomeInput {
 export interface DeliveryRecorder extends DeliveryObserver {
     readonly root: string;
     delivered(outcome: DeliveryOutcomeInput): void;
+    /** The failure log row id a `tool-failure` event links to; null when the log write threw. */
+    logged(failureId: number | null): void;
     /** Builds the event and hands it to `write` once per call; throws on an injected fault, and writes nothing once broken. */
     flush(write: (input: DeliveryEventInput) => number | null): void;
 }

package/dist/store/delivery-recorder.js

@@ -1,14 +1,15 @@
 import { evalNow } from '../core/ablation.js';
 import { scoreOverlap } from '../core/prompt-recall.js';
-import { hookPayloadSessionId, hookPayloadString, isSubagentPayload } from './token-ledger.js';
+import { hookPayloadSessionId, hookPayloadString, isSubagentPayload } from '../util/hook-payload.js';
 import { blockHash, estimateTokens } from '../util/token-text.js';
 import { errorMessage, log } from '../util/log.js';
 /** True for the boundary types: a compaction's two hooks and the end of a session. */
 export const isBoundaryEvent = (type) => type === 'pre-compact' || type === 'compact-resume' || type === 'session-end';
 /** Only the per-prompt calls keep prompt facts; a boundary or a `hippo context` run is not a prompt. */
 const carriesPrompt = (type) => type === 'prompt-submit' || type === 'pinned-manual';
-/** Row format version in `delivery_events.ledger_version`: 3 = written by a binary that can write session-end and context rows, so `event_type` has six values. */
-export const DELIVERY_LEDGER_VERSION = 3;
+/** Row format version in `delivery_events.ledger_version`: 4 = written by a binary that can write `tool-failure` rows and hashes the
+ * store's resolved root. */
+export const DELIVERY_LEDGER_VERSION = 4;
 /** Rejected candidate rows kept per event; the rest only add to `rejected_unlisted`. */
 export const DELIVERY_REJECTED_ROW_CAP = 16;
 // Deeper stages were closer to being sent, so the row cap keeps them first.
@@ -35,10 +36,13 @@ function readPayload(init) {
     const rawTurnId = hookPayloadString(init.stdinText, 'turn_id');
     const hostTurnId = rawTurnId !== null && rawTurnId.trim() !== '' ? rawTurnId : null;
     const hookEvent = hookPayloadString(init.stdinText, 'hook_event_name');
+    const rawToolUseId = hookPayloadString(init.stdinText, 'tool_use_id')?.trim() ?? '';
+    // Cut as failure_log cuts its payload fields: the payload is not trusted to be short.
+    const toolUseId = rawToolUseId !== '' ? rawToolUseId.slice(0, 128) : null;
     const sessionState = subagent
         ? 'subagent'
         : payloadSession !== null ? 'payload' : envSession !== null ? 'env' : 'missing';
-    return { payloadSession, envSession, prompt, hostTurnId, hookEvent, sessionState };
+    return { payloadSession, envSession, prompt, hostTurnId, hookEvent, toolUseId, sessionState };
 }
 function rejectId(state, id, rejection) {
     const { stage, reason, score, tokens } = rejection;
@@ -136,6 +140,8 @@ function buildEvent(init, payload, state, ts, startedMs) {
         recallHash: outcome.recallHash ?? null,
         emittedHash: emitted !== null ? blockHash(emitted) : null,
         elapsedMs: Math.max(0, Date.now() - startedMs),
+        toolUseId: eventType === 'tool-failure' ? payload.toolUseId : null,
+        failureId: eventType === 'tool-failure' ? state.failureId : null,
         candidates: rows,
     };
 }
@@ -205,7 +211,7 @@ export function createDeliveryRecorder(init) {
     const payload = readPayload(init);
     const state = {
         candidates: new Map(), picked: new Map(), filtered: new Set(), facts: null, shown: 0, dropped: 0,
-        disabledSeen: false, outcome: { state: 'empty' }, queryHash: null, recallTraceId: null, broken: null, flushed: false,
+        disabledSeen: false, outcome: { state: 'empty' }, queryHash: null, recallTraceId: null, failureId: null, broken: null, flushed: false,
     };
     const guard = guardFor(state, fault);
     const { qualityDropped, offer, reject, dropMissing, gated, selected } = candidateMethods(state, guard);
@@ -229,6 +235,7 @@ export function createDeliveryRecorder(init) {
         queried: (query) => guard(() => { state.queryHash = blockHash(query); }),
         traced: (traceId) => guard(() => { state.recallTraceId = traceId; }),
         delivered: (o) => guard(() => { state.outcome = { ...o }; }),
+        logged: (failureId) => guard(() => { state.failureId = failureId; }),
         flush: (write) => {
             if (state.flushed)
                 return;

package/dist/store/descendant-page.js

@@ -1,4 +1,5 @@
-import { chunked, selectEntriesByIds, TENANT_IS } from './entry-reads.js';
+import { selectEntriesByIds, TENANT_IS } from './entry-reads.js';
+import { chunked } from '../util/chunked.js';
 import { MEMORY_SELECT_COLUMNS, rowToEntry } from './rows.js';
 const marks = (ids) => ids.map(() => '?').join(',');
 /** The walk `summaryWithDescendants` documents, with `levels` cut to the first `page.rows` rows and each level's full count in `sizes`. */
@@ -53,7 +54,8 @@ function countedLevel(db, walk, parents, room) {
     const perParent = new Map();
     for (const chunk of chunked([...parents])) {
         // SAFETY: the SELECT names exactly ChildGroup's four fields, and the WHERE keeps dag_parent_id a string.
-        const groups = db.prepare(`SELECT dag_parent_id, scope, origin_project, COUNT(*) AS n FROM memories WHERE dag_parent_id IN (${marks(chunk)}) AND ${TENANT_IS} AND id <> ? GROUP BY dag_parent_id, scope, origin_project`).all(...chunk, walk.tenantId, walk.summary.id);
+        const groups = db.prepare(`SELECT dag_parent_id, scope, origin_project, COUNT(*) AS n FROM memories ` +
+            `WHERE dag_parent_id IN (${marks(chunk)}) AND ${TENANT_IS} AND id <> ? GROUP BY dag_parent_id, scope, origin_project`).all(...chunk, walk.tenantId, walk.summary.id);
         for (const group of groups) {
             if (!walk.page.admit(group))
                 return null;
@@ -85,7 +87,8 @@ function childrenInOrder(db, walk, parents, limit) {
     const byParent = new Map();
     for (const chunk of chunked([...parents])) {
         // SAFETY: selects exactly MEMORY_SELECT_COLUMNS, matching MemoryRow's field set.
-        const rows = db.prepare(`SELECT ${MEMORY_SELECT_COLUMNS} FROM memories WHERE dag_parent_id IN (${marks(chunk)}) AND ${TENANT_IS} AND id <> ? ORDER BY created ASC, id ASC LIMIT ?`).all(...chunk, walk.tenantId, walk.summary.id, limit);
+        const rows = db.prepare(`SELECT ${MEMORY_SELECT_COLUMNS} FROM memories WHERE dag_parent_id IN (${marks(chunk)}) AND ${TENANT_IS} AND id <> ? ` +
+            `ORDER BY created ASC, id ASC LIMIT ?`).all(...chunk, walk.tenantId, walk.summary.id, limit);
         for (const row of rows) {
             const bucket = byParent.get(row.dag_parent_id ?? '');
             if (bucket)

package/dist/store/dormant.d.ts

@@ -3,7 +3,7 @@
  * Not the raw archive (`raw_archive`, `archiveRawMemory`), which keeps metadata only. db-taking helpers leave the handle and transaction to the caller. */
 import { type DatabaseSyncLike } from '../db/index.js';
 import type { MemoryEntry } from '../core/memory.js';
-import type { SqlFragment } from './recall-scope.js';
+import type { SqlFragment } from './rule-sql.js';
 import type { WriteBudget } from '../util/write-budget.js';
 /** Why a memory went dormant: sleep's decay pass, an imported agent memory whose note was deleted, `hippo projects repair`
  * splitting a two-project merge, or `hippo audit repair` setting aside an automatic memory with a certain defect. */

package/dist/store/dormant.js

@@ -3,7 +3,8 @@
  * Not the raw archive (`raw_archive`, `archiveRawMemory`), which keeps metadata only. db-taking helpers leave the handle and transaction to the caller. */
 import { closeHippoDb, openHippoDb, withWriteScope, withWriteScopeOr } from '../db/index.js';
 import { onHandle } from './open.js';
-import { RejectedValueError, rejectionDigest } from './rejection.js';
+import { rejectionDigest } from './rejection.js';
+import { RejectedValueError } from '../core/api-errors.js';
 import { escapeLike } from '../util/escape.js';
 import { warnDamagedColumn } from '../util/stored-json.js';
 import { DAY_MS } from '../util/time.js';
@@ -32,6 +33,7 @@ function parseSnapshot(row) {
         // the id / tenant / content checks below reject a row edited out of shape.
         const entry = JSON.parse(row.entry_json);
         if (entry.id !== row.id || entry.tenantId !== row.tenant_id || entry.content !== row.content) {
+            warnDamagedColumn({ table: 'dormant_memories', id: row.id, column: 'entry_json' }, 'wrong shape');
             return null;
         }
         return entry;

package/dist/store/embeddings/index.d.ts

@@ -1,9 +1,6 @@
-/** Optional embedding-based semantic search for Hippo.
- * Uses @huggingface/transformers (local, no API keys, ~22MB model); falls back silently if not installed. */
-import { MemoryEntry } from '../../core/memory.js';
+/** The stored vector index's identity: which model and text format built it, and when a provider change means a rebuild.
+ * Picking a provider and computing vectors sit in src/search/embed-memories.ts; this module only reads and writes what is stored. */
 import { EMBEDDING_MODEL_META_KEY } from '../../db/vector-store.js';
-import { type EmbeddingProvider } from './provider.js';
-import type { HippoStore } from '../index.js';
 export { EMBEDDING_MODEL_META_KEY };
 /** Bump when `embeddingInputText` changes existing vectors; folded into the stored index identity (`embeddingIndexIdentity`) so it reindexes like a model
  * change. Format 2 = `path:*` tags excluded; format 1 (implicit, no suffix) included them. */
@@ -26,11 +23,4 @@ export declare function resolveIndexedEmbeddingModel(hippoRoot: string, index?:
 export declare function embeddingModelRequiresReindex(hippoRoot: string, model: string, index?: Record<string, number[]>): boolean;
 /** Cosine similarity; handles unnormalized vectors, returns 0 for empty or mismatched vectors. */
 export declare function cosineSimilarity(a: number[], b: number[]): number;
-/** `cosineSimilarity` over any indexable vectors; a Float32 view reads the same doubles as its number[] copy, so the score is the same. */
-export declare function cosineOf(a: ArrayLike<number>, b: ArrayLike<number>): number;
-/** Embed a single memory entry and cache the result in the embedding index; with `store`, through its vectorWrites, never opening hippo.db. */
-export declare function embedMemory(hippoRoot: string, entry: MemoryEntry, model?: string, store?: HippoStore): Promise<void>;
-/** Embeds every entry with no cached vector, prunes vectors of deleted memories, and returns how many it embedded; `provider` defaults to the
- *  configured one. With `store`, every tenant's memories with no vector for the provider's model go through its `vectorWrites`, never hippo.db. */
-export declare function embedAll(hippoRoot: string, model?: string, provider?: EmbeddingProvider, store?: HippoStore): Promise<number>;
 //# sourceMappingURL=index.d.ts.map