hippo-memory 1.71.0 → 1.72.0

package/dist/api/recall-core.js

@@ -5,7 +5,7 @@ import { decidePlanningFallacy, detectPlanningClaim } from '../predictions/plann
 import { rankRecall } from './recall-pipeline.js';
 import { writeRecallTraceAtRoot } from '../store/recall-trace.js';
 import { saveIndex } from '../store/index-and-stats.js';
-import { sqliteStore } from '../store/index.js';
+import { sqliteStore, storeFor } from '../store/index.js';
 import { estimateTokens } from '../util/token-text.js';
 import { callerOf, recallAuditMetadata, recallAuditRow, strengthenOf } from './recall-record.js';
 import { RECALL_RECORDING, recordShownRecall } from './recall-finish.js';
@@ -16,8 +16,8 @@ export async function retrieveWithCliCore(ctx, opts, core) {
     if (!ctx.actor.hostAdmin)
         throw new ForbiddenError('The CLI ranking core serves the host admin only');
     const globalRoot = core.sources?.globalRoot;
-    // The ranking core reads hippo.db itself, so its writes go to the same file whatever store the context names.
-    const store = sqliteStore(ctx.hippoRoot);
+    // The ranking core reads hippo.db under hippoRoot, yet writes through the caller's store, whose finishRecall skips any id it does not hold.
+    const store = storeFor(ctx);
     const ranking = await rankRecall({ hippoRoot: ctx.hippoRoot, globalRoot, tenantId: ctx.tenantId, note: core.note }, { ...core.rank, query: opts.query, sessionId: opts.sessionId, goalTag: opts.goalTag });
     if (ranking.halted) {
         // The stages that ran earned these rows, so the caller's flag error does not drop them.

package/dist/api/recall-pipeline.js

@@ -3,19 +3,19 @@
 import { evalNow } from '../core/ablation.js';
 import { oneCopyPerMemory } from './context-select.js';
 import { compareEntryIdentity, compareScoresDesc } from '../core/compare.js';
-import { isEmbeddingAvailable } from '../store/embeddings/local.js';
+import { isEmbeddingAvailable } from '../embeddings/local.js';
 import { activeGoalsWithPolicies } from '../store/goals.js';
 import { boostByGoals } from '../search/goal-boost.js';
 import { graphExpandRecall } from '../graph/recall.js';
 import { DEFAULT_GRAPH_STREAM_WEIGHT } from '../graph/stream.js';
 import { Layer } from '../core/memory.js';
 import { multihopSearch } from '../search/multihop.js';
-import { passesCliRecallScopeFilter } from '../store/recall-scope.js';
+import { passesCliRecallScopeFilter } from '../core/recall-scope.js';
 import { currentEntries } from '../search/as-of.js';
 import { STRENGTH_RANK_FLOOR, STRENGTH_RANK_SPAN } from '../search/boosts.js';
 import { hybridSearch } from '../search/hybrid.js';
 import { physicsSearch } from '../search/physics-search.js';
-import { searchBothHybrid } from '../sharing/search-both.js';
+import { rankBothStores } from '../sharing/search-both.js';
 import { loadRecallSearchEntries, recallScopeFilter } from '../store/search-rows.js';
 import { isJsonNumber } from '../util/json.js';
 import { textOverlap, tokenize as tokenizeQuery } from '../util/tokenize.js';
@@ -98,7 +98,7 @@ async function searchPool(ctx, opts, pool) {
         });
     }
     if (search.multihop) {
-        // Unlike searchBothHybrid below, multihop ranks one pooled list, so a shared memory's two copies both compete.
+        // Unlike rankBothStores below, multihop ranks one pooled list, so a shared memory's two copies both compete.
         const allEntries = oneCopyPerMemory(pool.local, pool.global, evalNow()).flat();
         return multihopSearch(query, allEntries, { budget, cost, hippoRoot: ctx.hippoRoot, minResults, includeSuperseded, asOf });
     }
@@ -117,11 +117,10 @@ async function searchPool(ctx, opts, pool) {
         });
     }
     if (globalRoot) {
-        // searchBothHybrid reloads candidates itself, so the scope rule is passed in rather than inherited from the pool.
-        return searchBothHybrid(query, ctx.hippoRoot, globalRoot, {
+        // The pool already holds searchBothHybrid's additive-scope load for each store, so rank it rather than read both stores again.
+        return rankBothStores(query, { local: ctx.hippoRoot, global: globalRoot }, { local: pool.local, global: pool.global }, vectorCandidates, {
             budget, cost, explain, mmr, mmrLambda, localBump: search.localBump, minResults, scope, tenantId: ctx.tenantId,
             includeSuperseded, asOf,
-            recallScope: opts.explicitScope ? { requested: opts.explicitScope, additive: true } : {},
         });
     }
     return hybridSearch(query, pool.local, {

package/dist/api/recall-request.js

@@ -1,6 +1,6 @@
 // The recall and context input rules in one copy, so MCP and HTTP reject the same inputs with the same messages.
 import { BadRequestError } from '../core/api-errors.js';
-import { MAX_ID_LEN } from '../util/http-util.js';
+import { MAX_ID_LEN } from '../util/limits.js';
 import { isJsonString } from '../util/json.js';
 const MAX_RECALL_LIMIT = 1000;
 // recall() owns the shape rule for scorer_window (invalid_scorer_window); this cap bounds remote cost.

package/dist/api/recall.d.ts

@@ -1,8 +1,5 @@
 import type { RecallOpts, RecallResult } from './recall-types.js';
 import { type Context } from './types.js';
-/** Reads hippo.db directly, never `ctx.store`, because it is synchronous (another store would throw `SqliteBlockedError`).
- *  It never writes `last_retrieval_ids` (contract lock: tests/api-recall-no-side-effects.test.ts). */
-export declare function recall(ctx: Context, opts: RecallOpts): RecallResult;
 /** The one recall entry: ranks with the ranker `opts` names, then writes the recall, and records it in full for a surface that sets `recordAs`.
  *  Only the CLI core ranker writes last_retrieval_ids (contract lock). */
 export declare function retrieve(ctx: Context, opts: RecallOpts): Promise<RecallResult>;

package/dist/api/recall.js

@@ -1,4 +1,4 @@
-// Read path: recall (sync) and retrieve (async, adds the vector arm).
+// Read path: retrieve, the one recall entry.
 import { envRequireSessionScopedFreshTail } from '../util/env.js';
 import { DEFAULT_SEARCH_CANDIDATE_LIMIT } from '../store/rows.js';
 import { recallScopeFilter } from '../store/search-rows.js';
@@ -6,7 +6,6 @@ import { estimateTokens } from '../util/token-text.js';
 import { formatHandoffEvidenceLine } from '../core/handoff.js';
 import { boostByGoals } from '../search/goal-boost.js';
 import { storeFor } from '../store/index.js';
-import { sqliteSyncStore } from '../store/sqlite/store.js';
 import { hybridSearch } from '../search/hybrid.js';
 import { physicsSearch } from '../search/physics-search.js';
 import { churnStaleFactor } from '../search/boosts.js';
@@ -17,26 +16,12 @@ import { classifyOriginProject, projectNames } from '../core/project-identity.js
 import { decidePlanningFallacy, detectPlanningClaim } from '../predictions/planning-fallacy.js';
 import { detectAnchoring, hashQueryText, biasHintEnabled } from './recall-history.js';
 import { detectAvailabilityBias } from './availability.js';
-import { passesScopeFilterForRecall, assertScopeRequestAllowed, personalScopeOf } from '../store/recall-scope.js';
+import { passesScopeFilterForRecall, assertScopeRequestAllowed, personalScopeOf } from '../core/recall-scope.js';
 import { ownerOrSubject, RecallContractError } from './types.js';
 import { anchoringRows, availabilityRows, callerOf, recallAuditMetadata, recallAuditRow, strengthenOf } from './recall-record.js';
 import { retrieveWithCliCore } from './recall-core.js';
 import { recallLead, recordShownRecall } from './recall-finish.js';
 const DEFAULT_RECALL_LIMIT = 10;
-/** Reads hippo.db directly, never `ctx.store`, because it is synchronous (another store would throw `SqliteBlockedError`).
- *  It never writes `last_retrieval_ids` (contract lock: tests/api-recall-no-side-effects.test.ts). */
-export function recall(ctx, opts) {
-    // A member key may not unlock a private or quarantined scope by naming it.
-    assertScopeRequestAllowed(ctx.actor, opts.scope);
-    const windowSize = recallWindowSize(opts);
-    const own = personalScopeOf(ctx.actor) ?? undefined;
-    const store = sqliteSyncStore(ctx.hippoRoot);
-    const all = store.searchRecallEntries(opts.query, recallSearchArgs(ctx, opts, windowSize, own));
-    const plan = planRecall(ctx, opts, all, own);
-    const { result, writes } = composeRecall(ctx, opts, { windowSize, all, plan, reads: readRecallSync(store, ctx, opts, plan) });
-    store.finishRecall({ ...writes, audit: [...(opts.leadingAudit ?? []), ...writes.audit] });
-    return result;
-}
 function recallOrigin(opts) {
     return opts.project ? projectNames(opts.project) : undefined;
 }
@@ -198,27 +183,17 @@ function planRecall(ctx, opts, all, own) {
         claim: detectPlanningClaim(opts.query),
     };
 }
-/** The plan's reads on the synchronous store, for the recall that cannot await the port. */
-function readRecallSync(store, ctx, opts, plan) {
-    const { tenantId } = ctx;
-    const freshCount = opts.freshTailCount ?? 0;
-    return {
-        goals: plan.goalBoost ? store.activeGoals({ sessionId: plan.goalBoost.sessionId, tenantId }) : null,
-        parents: plan.overflow.size > 0 ? store.entriesByIds([...plan.overflow.keys()], tenantId) : [],
-        freshRaws: freshCount > 0 ? store.freshRawEntries(freshCount, tenantId, opts.freshTailSessionId, recallOrigin(opts) ?? null) : [],
-        continuity: opts.includeContinuity ? store.continuity(tenantId, CONTINUITY_EVENT_LIMIT, continuityKey(ctx, opts)) : undefined,
-        planning: plan.claim ? store.planningFallacyEvidence(tenantId, plan.claim.classQueryTokens) : null,
-    };
-}
 /** The plan's reads through the store; `goals` already read by the caller skips that read. */
 async function readRecall(store, ctx, opts, plan, goals) {
     const { tenantId } = ctx;
     const freshCount = opts.freshTailCount ?? 0;
+    const parentIds = plan.overflow.size > 0 ? [...plan.overflow.keys()] : null;
+    const continuity = opts.includeContinuity ? { key: continuityKey(ctx, opts) } : null;
     return {
         goals: goals !== undefined ? goals : plan.goalBoost ? await store.activeGoals({ sessionId: plan.goalBoost.sessionId, tenantId }) : null,
-        parents: plan.overflow.size > 0 ? await store.entriesByIds([...plan.overflow.keys()], tenantId) : [],
+        parents: parentIds ? await store.entriesByIds(parentIds, tenantId) : [],
         freshRaws: freshCount > 0 ? await store.freshRawEntries(freshCount, tenantId, opts.freshTailSessionId, recallOrigin(opts) ?? null) : [],
-        continuity: opts.includeContinuity ? await store.continuity(tenantId, CONTINUITY_EVENT_LIMIT, continuityKey(ctx, opts)) : undefined,
+        continuity: continuity ? await store.continuity(tenantId, CONTINUITY_EVENT_LIMIT, continuity.key) : undefined,
         planning: plan.claim ? await store.planningFallacyEvidence(tenantId, plan.claim.classQueryTokens) : null,
     };
 }
@@ -461,19 +436,19 @@ function scopeContinuity(block, opts, own) {
 function continuityTokensOf(c) {
     const filteredSnapshot = c.activeSnapshot;
     const filteredHandoff = c.sessionHandoff;
-    const tokenize = (s) => s ? estimateTokens(s) : 0;
-    return tokenize(filteredSnapshot?.task) +
-        tokenize(filteredSnapshot?.summary) +
-        tokenize(filteredSnapshot?.next_step) +
-        tokenize(filteredHandoff?.summary) +
-        tokenize(filteredHandoff?.nextAction) +
-        (filteredHandoff?.artifacts ?? []).reduce((acc, a) => acc + tokenize(a), 0) +
-        (filteredHandoff?.constraints ?? []).reduce((acc, c) => acc + tokenize(c), 0) +
-        tokenize(filteredHandoff?.evidence ? formatHandoffEvidenceLine(filteredHandoff.evidence) : null) +
-        tokenize(filteredHandoff?.outcome) +
-        tokenize(filteredHandoff?.targetRuntime) +
-        tokenize(filteredHandoff?.cardId) +
-        c.recentSessionEvents.reduce((acc, e) => acc + tokenize(e.content), 0);
+    const tokenCount = (s) => s ? estimateTokens(s) : 0;
+    return tokenCount(filteredSnapshot?.task) +
+        tokenCount(filteredSnapshot?.summary) +
+        tokenCount(filteredSnapshot?.next_step) +
+        tokenCount(filteredHandoff?.summary) +
+        tokenCount(filteredHandoff?.nextAction) +
+        (filteredHandoff?.artifacts ?? []).reduce((acc, a) => acc + tokenCount(a), 0) +
+        (filteredHandoff?.constraints ?? []).reduce((acc, c) => acc + tokenCount(c), 0) +
+        tokenCount(filteredHandoff?.evidence ? formatHandoffEvidenceLine(filteredHandoff.evidence) : null) +
+        tokenCount(filteredHandoff?.outcome) +
+        tokenCount(filteredHandoff?.targetRuntime) +
+        tokenCount(filteredHandoff?.cardId) +
+        c.recentSessionEvents.reduce((acc, e) => acc + tokenCount(e.content), 0);
 }
 // A pure read of the caller's recallHistory snapshot against this top-1. HIPPO_ANCHORING=off skips even the detect
 // call; CLI paths pass no history (cmdRecall computes its own hint), so the hint stays absent there.

package/dist/api/remember-local.js

@@ -4,7 +4,7 @@
 import { loadConfig } from '../core/config.js';
 import { computeSalience } from '../core/salience.js';
 import { loadNewestEntries, schemaFitInStore } from '../store/candidates.js';
-import { embedMemory } from '../store/embeddings/index.js';
+import { embedMemory } from '../search/embed-memories.js';
 import { loadAllEntries, readEntry } from '../store/entry-reads.js';
 import { updateStats } from '../store/index-and-stats.js';
 import { errorMessage } from '../util/log.js';

package/dist/api/remember.d.ts

@@ -23,7 +23,8 @@ export interface RememberOpts {
     owner?: string;
     artifactRef?: string;
     tags?: string[];
-    /** The connector event this write answers. The store logs it in the memory's own transaction; an event logged before stores nothing and answers `duplicate`. */
+    /** The connector event this write answers. The store logs it in the memory's own transaction; an event logged before stores nothing and
+     * answers `duplicate`. */
     event?: ConnectorEvent;
     /** Connector-ingested content an agent doesn't control; gates detectInstruction. CLI/HTTP/MCP never set this. */
     untrusted?: boolean;

package/dist/api/remember.js

@@ -7,7 +7,7 @@ import { loadConfig } from '../core/config.js';
 import { vetSecrets } from '../util/secret-detect.js';
 import { assertCallerProject } from '../core/project-identity.js';
 import { BadRequestError } from '../core/api-errors.js';
-import { assertClientScope, personalScopeOf } from '../store/recall-scope.js';
+import { assertClientScope, personalScopeOf } from '../core/recall-scope.js';
 import { andThen, notPorted, onStore } from './on-store.js';
 /** The scope a write lands in: the caller's own personal scope when asked for, else the client's, which may not be a personal one. */
 function rememberScope(ctx, opts) {
@@ -21,7 +21,8 @@ function rememberScope(ctx, opts) {
         throw new BadRequestError('send personal or scope, not both');
     const own = personalScopeOf(ctx.actor);
     if (own === null) {
-        throw new BadRequestError('personal memories need a key its owner minted, or a sign-in; owner ids over 239 characters or with control characters cannot hold them');
+        throw new BadRequestError('personal memories need a key its owner minted, or a sign-in; owner ids over 239 characters or with control characters cannot ' +
+            'hold them');
     }
     return own;
 }

package/dist/api/session-end.d.ts

@@ -0,0 +1,22 @@
+import type { HandoffEvidence } from '../core/handoff.js';
+import type { TaskSnapshot } from '../store/rows.js';
+import type { Context } from './types.js';
+/** What closing one ended session needs from the host; the two readers run only when the handoff is written. */
+export interface SessionClose {
+    sessionId: string | null;
+    /** A reply's end, not the session's: the handoff is updated in place and the snapshot stays for the next compaction. */
+    turn: boolean;
+    /** The transcript's working state, or null with no readable transcript. */
+    workingState: () => Pick<TaskSnapshot, 'task' | 'summary' | 'next_step'> | null;
+    evidence: () => HandoffEvidence;
+    /** One line to the session-end log. */
+    log: (line: string) => void;
+}
+/** Writes the session's handoff, then closes its snapshot unless `turn`; each step logs its own failure and never throws.
+ *  The handoff goes first, while the snapshot writeSessionEndHandoff reads is still active. */
+export declare function closeEndedSession(ctx: Context, close: SessionClose): void;
+/** Books the ending session's re-reads in each store its ledger rows can land in (`ctx.hippoRoot` and global); returns the log lines. */
+export declare function bookSessionRereads(ctx: Context, transcriptPath: string | undefined, sessionId: string | null): Promise<string[]>;
+/** The block a compaction lost: the fresh task snapshot and its session trail, or null with none or another session's snapshot. */
+export declare function compactResumeBlock(ctx: Context, payloadSessionId: string | null): string | null;
+//# sourceMappingURL=session-end.d.ts.map

package/dist/api/session-end.js

@@ -0,0 +1,101 @@
+// The store writes a session's end makes after sleep and capture (handoff, snapshot close, re-read count), and the
+// compact-resume read; the hook verbs keep stdin, spawning and the log file.
+import * as path from 'path';
+import { isInitialized } from '../core/project-identity.js';
+import { closeTaskSnapshotsForSession, listSessionEvents, loadActiveTaskSnapshot, loadFreshActiveTaskSnapshot } from '../store/sessions.js';
+import { writeSessionEndHandoff } from '../store/handoffs.js';
+import { readApiCalls, recordRereads } from '../store/token-ledger.js';
+import { getGlobalRoot } from '../sharing/global-store.js';
+import { truncateCodePointSafe } from '../util/transcript-tail.js';
+import { errorMessage, log } from '../util/log.js';
+import { COMPACT_RESUME_EVENT_CONTENT_CAP, COMPACT_RESUME_MAX_AGE_MS, compactResumeText } from './context-render.js';
+/** Writes the session's handoff, then closes its snapshot unless `turn`; each step logs its own failure and never throws.
+ *  The handoff goes first, while the snapshot writeSessionEndHandoff reads is still active. */
+export function closeEndedSession(ctx, close) {
+    if (close.sessionId)
+        writeEndHandoff(ctx, close.sessionId, close);
+    if (close.turn) {
+        close.log('skip snapshot close: turn mode');
+        return;
+    }
+    closeSnapshot(ctx, close.sessionId, close.log);
+}
+function writeEndHandoff(ctx, sessionId, close) {
+    try {
+        const ownSnapshot = loadActiveTaskSnapshot(ctx.hippoRoot, ctx.tenantId)?.session_id === sessionId;
+        // A never-compacted session has no snapshot; read even when it has one, as another session's PreCompact can take the slot before the write.
+        const derived = close.workingState();
+        if (!ownSnapshot && !derived) {
+            close.log('skip: no snapshot or transcript for session');
+            return;
+        }
+        const handoff = writeSessionEndHandoff(ctx.hippoRoot, ctx.tenantId, sessionId, close.evidence(), derived, undefined, { inPlace: close.turn });
+        close.log(handoff ? `wrote handoff for session ${sessionId}` : `skip: kept the existing handoff for session ${sessionId}`);
+    }
+    catch (err) {
+        close.log(`handoff write failed: ${errorMessage(err)}`);
+    }
+}
+// If session-end never fires (crash, kill -9), the freshness bound in loadFreshActiveTaskSnapshot is the backstop.
+function closeSnapshot(ctx, sessionId, line) {
+    try {
+        if (sessionId) {
+            const closed = closeTaskSnapshotsForSession(ctx.hippoRoot, ctx.tenantId, sessionId);
+            line(`closed ${closed} active snapshot(s) for session ${sessionId}`);
+        }
+        else {
+            line('skip: no session_id in SessionEnd payload, active snapshot left untouched');
+        }
+    }
+    catch (err) {
+        line(`snapshot close failed: ${errorMessage(err)}`);
+    }
+}
+/** Books the ending session's re-reads in each store its ledger rows can land in (`ctx.hippoRoot` and global); returns the log lines. */
+export async function bookSessionRereads(ctx, transcriptPath, sessionId) {
+    if (!transcriptPath || !sessionId)
+        return [];
+    let read;
+    try {
+        read = await readApiCalls(transcriptPath);
+    }
+    catch (err) {
+        return [`skip re-read count: cannot read the transcript: ${errorMessage(err)}`];
+    }
+    const roots = new Set([ctx.hippoRoot, getGlobalRoot()].filter((root) => isInitialized(root)).map((root) => path.resolve(root)));
+    const lines = [];
+    let tokens = 0;
+    for (const root of roots) {
+        try {
+            tokens += recordRereads(root, ctx.tenantId, sessionId, read.calls);
+        }
+        catch (err) {
+            lines.push(`re-read count failed: ${errorMessage(err)}`);
+        }
+    }
+    const skipped = read.malformed > 0 ? `, ${read.malformed} unparsable transcript lines skipped` : '';
+    lines.push(`re-read ${tokens} tokens over ${read.calls.length} model calls for session ${sessionId}${skipped}`);
+    return lines;
+}
+/** The block a compaction lost: the fresh task snapshot and its session trail, or null with none or another session's snapshot. */
+export function compactResumeBlock(ctx, payloadSessionId) {
+    const snapshot = loadFreshActiveTaskSnapshot(ctx.hippoRoot, ctx.tenantId, { maxAgeMs: COMPACT_RESUME_MAX_AGE_MS });
+    // Concurrent sessions must not cross-restore: only when both ids are present and differ, so a manual run with no payload id still prints.
+    if (!snapshot || (payloadSessionId !== null && snapshot.session_id !== null && payloadSessionId !== snapshot.session_id))
+        return null;
+    // A bad trail row costs the trail, not the snapshot; stderr stays out of the model's context.
+    let events = [];
+    try {
+        if (snapshot.session_id) {
+            events = listSessionEvents(ctx.hippoRoot, ctx.tenantId, { session_id: snapshot.session_id }).map((e) => ({
+                ...e,
+                content: truncateCodePointSafe(e.content, COMPACT_RESUME_EVENT_CONTENT_CAP),
+            }));
+        }
+    }
+    catch (err) {
+        log.warn(`hippo compact-resume: trail skipped: ${errorMessage(err)}`);
+    }
+    return compactResumeText(snapshot, events);
+}
+//# sourceMappingURL=session-end.js.map

package/dist/api/sleep-run.d.ts

@@ -1,5 +1,5 @@
 import { loadAllEntries } from '../store/entry-reads.js';
-import { auditMemories } from '../store/audit.js';
+import { auditMemories } from '../core/memory-audit.js';
 import { autoShare } from '../sharing/share.js';
 import { consolidate } from '../consolidate/sleep.js';
 import { loadConfig } from '../core/config.js';

package/dist/api/sleep-run.js

@@ -1,9 +1,10 @@
 // The sleep pipeline behind `sleep`, with its phase dependencies injectable; kept out of the package root.
 import { loadAllEntries } from '../store/entry-reads.js';
 import { memoriesBackingObjects } from '../store/delete-and-batch.js';
-import { reportAuditWriteFailure, auditMemories } from '../store/audit.js';
+import { reportAuditWriteFailure } from '../store/audit.js';
+import { auditMemories } from '../core/memory-audit.js';
 import { sqliteSyncStore } from '../store/sqlite/store.js';
-import { autoShare } from '../sharing/share.js';
+import { AUTO_SHARE_MIN_SCORE, autoShare } from '../sharing/share.js';
 import { consolidate } from '../consolidate/sleep.js';
 import { failedUnitOf } from '../store/delete-and-batch.js';
 import { loadConfig } from '../core/config.js';
@@ -51,13 +52,15 @@ async function runSleepPhases(ctx, opts, phases, counts) {
     const consolidateResult = await phases.consolidate(ctx.hippoRoot, { dryRun });
     counts.consolidation = consolidateResult.semanticCreated + consolidateResult.merged;
     const result = sleepResultFrom(consolidateResult, dryRun);
+    // One read after consolidation serves dedup, the audit and ambient: dedup reports every row it deletes, so later phases subtract instead of reading again.
+    const loaded = { entries: phases.loadAllEntries(ctx.hippoRoot), backing: memoriesBackingObjects(ctx.hippoRoot) };
     // Phase 2: Dedup (post-consolidate near-duplicate cleanup).
-    const dedupResult = phases.deduplicateStore(ctx.hippoRoot, { dryRun, actor: ctx.actor.subject });
+    const dedupResult = phases.deduplicateStore(ctx.hippoRoot, { dryRun, actor: ctx.actor.subject, loaded });
     counts.dedup = dedupResult.removed;
     if (dedupResult.removed > 0)
         result.deduped = dedupSummary(dedupResult);
     // Phase 3: Quality audit (remove junk, report warnings; a dry run skips rows earlier phases would remove).
-    const audited = runQualityAudit(ctx, phases, { dryRun, consolidateResult, dedupResult, result });
+    const audited = runQualityAudit(ctx, phases, { dryRun, consolidateResult, dedupResult, result, loaded });
     counts.auditDeleted = audited.removed;
     if (dryRun)
         return result;
@@ -115,10 +118,11 @@ function dedupSummary(dedupResult) {
 }
 /** `removed` counts audit errors deleted (or that would be under dryRun); `remaining` is what the audit read, less the rows it deleted. */
 function runQualityAudit(ctx, phases, options) {
-    const { dryRun, consolidateResult, dedupResult, result } = options;
-    const planned = new Set(dryRun ? [...(consolidateResult.removedIds ?? []), ...dedupResult.pairs.map((p) => p.removed)] : []);
-    const allEntries = phases.loadAllEntries(ctx.hippoRoot).filter((e) => !planned.has(e.id));
-    const auditOut = phases.auditMemories(allEntries, memoriesBackingObjects(ctx.hippoRoot));
+    const { dryRun, consolidateResult, dedupResult, result, loaded } = options;
+    // The load followed consolidation, so only a dry run still holds the rows consolidation would remove; dedup's pairs are gone or would be.
+    const planned = new Set([...(dryRun ? consolidateResult.removedIds ?? [] : []), ...dedupResult.pairs.map((p) => p.removed)]);
+    const allEntries = loaded.entries.filter((e) => !planned.has(e.id));
+    const auditOut = phases.auditMemories(allEntries, loaded.backing);
     if (auditOut.issues.length === 0)
         return { removed: 0, remaining: allEntries };
     const errors = auditOut.issues.filter((i) => i.severity === 'error');
@@ -140,7 +144,7 @@ function shareOnSleep(ctx, phases, result) {
         return;
     // Both skip counters are surfaced so the secret veto and the rejection tombstone are observable, not silent.
     const autoShareStats = { secretSkipped: 0, rejectedSkipped: 0 };
-    const shared = phases.autoShare(ctx.hippoRoot, { minScore: 0.6, stats: autoShareStats });
+    const shared = phases.autoShare(ctx.hippoRoot, { minScore: AUTO_SHARE_MIN_SCORE, stats: autoShareStats });
     if (shared.length > 0) {
         result.shared = shared.length;
     }

package/dist/api/status.d.ts

@@ -0,0 +1,24 @@
+import type { PhysicsParticle } from '../core/physics.js';
+import type { LegacyStats } from '../store/rows.js';
+import { type StatusCounts } from '../store/candidates.js';
+import { type StoredVectorSummary } from '../store/vector-index.js';
+import { type CorrectionLatencyReport } from './correction-latency.js';
+import { type ProvenanceCoverage } from './provenance-coverage.js';
+import { type Context } from './types.js';
+export interface StoreStatus {
+    stats: LegacyStats;
+    counts: StatusCounts;
+}
+/** Lifetime stats and row counts for the whole store. Every tenant, so the host admin only. */
+export declare function storeStatus(ctx: Context, now: Date, atRiskBelow: number): StoreStatus;
+/** Ids and dimension of the stored vectors. Every tenant, so the host admin only. */
+export declare function vectorSummary(ctx: Context): StoredVectorSummary;
+/** Whether the stored vectors were built by a different model than `providerId`. Every tenant, so the host admin only. */
+export declare function embeddingReindexNeeded(ctx: Context, providerId: string): boolean;
+/** Every stored physics particle. Every tenant, so the host admin only. */
+export declare function storedParticles(ctx: Context): PhysicsParticle[];
+/** Correction latency over every superseded row in the store. Every tenant, so the host admin only. */
+export declare function correctionLatencyReport(ctx: Context): CorrectionLatencyReport;
+/** Provenance coverage over every kind=raw row in the store. Every tenant, so the host admin only. */
+export declare function provenanceCoverageReport(ctx: Context): ProvenanceCoverage;
+//# sourceMappingURL=status.d.ts.map

package/dist/api/status.js

@@ -0,0 +1,40 @@
+// Store-wide status reads: counts, stats, vector index state and the correction and provenance reports.
+import { loadCorrectionEntries, loadRawEntries } from '../store/report-reads.js';
+import { loadStats } from '../store/index-and-stats.js';
+import { loadStatusCounts } from '../store/candidates.js';
+import { embeddingModelRequiresReindex } from '../store/embeddings/index.js';
+import { loadStoredParticles, storedVectorSummary } from '../store/vector-index.js';
+import { buildCorrectionLatency } from './correction-latency.js';
+import { buildProvenanceCoverage } from './provenance-coverage.js';
+import { requireHostAdmin } from './types.js';
+/** Lifetime stats and row counts for the whole store. Every tenant, so the host admin only. */
+export function storeStatus(ctx, now, atRiskBelow) {
+    requireHostAdmin(ctx, 'Reading every tenant');
+    return { stats: loadStats(ctx.hippoRoot), counts: loadStatusCounts(ctx.hippoRoot, now, atRiskBelow) };
+}
+/** Ids and dimension of the stored vectors. Every tenant, so the host admin only. */
+export function vectorSummary(ctx) {
+    requireHostAdmin(ctx, 'Reading every tenant');
+    return storedVectorSummary(ctx.hippoRoot);
+}
+/** Whether the stored vectors were built by a different model than `providerId`. Every tenant, so the host admin only. */
+export function embeddingReindexNeeded(ctx, providerId) {
+    requireHostAdmin(ctx, 'Reading every tenant');
+    return embeddingModelRequiresReindex(ctx.hippoRoot, providerId);
+}
+/** Every stored physics particle. Every tenant, so the host admin only. */
+export function storedParticles(ctx) {
+    requireHostAdmin(ctx, 'Reading every tenant');
+    return loadStoredParticles(ctx.hippoRoot);
+}
+/** Correction latency over every superseded row in the store. Every tenant, so the host admin only. */
+export function correctionLatencyReport(ctx) {
+    requireHostAdmin(ctx, 'Reading every tenant');
+    return buildCorrectionLatency(loadCorrectionEntries(ctx.hippoRoot));
+}
+/** Provenance coverage over every kind=raw row in the store. Every tenant, so the host admin only. */
+export function provenanceCoverageReport(ctx) {
+    requireHostAdmin(ctx, 'Reading every tenant');
+    return buildProvenanceCoverage(loadRawEntries(ctx.hippoRoot));
+}
+//# sourceMappingURL=status.js.map

package/dist/api/store-init.d.ts

@@ -0,0 +1,4 @@
+import { type Context } from './types.js';
+/** Create the store at `ctx.hippoRoot`, or finish setting up one that exists; a store holds every tenant, so the host admin only. */
+export declare function initMemoryStore(ctx: Context): void;
+//# sourceMappingURL=store-init.d.ts.map

package/dist/api/store-init.js

@@ -0,0 +1,9 @@
+// Creating a store for `hippo init`: the database, its mirror folders and first-run setup.
+import { initStore } from '../store/open.js';
+import { requireHostAdmin } from './types.js';
+/** Create the store at `ctx.hippoRoot`, or finish setting up one that exists; a store holds every tenant, so the host admin only. */
+export function initMemoryStore(ctx) {
+    requireHostAdmin(ctx, 'Creating a store');
+    initStore(ctx.hippoRoot);
+}
+//# sourceMappingURL=store-init.js.map

package/dist/api/tokens.js

@@ -1,5 +1,5 @@
 // Token-use and failure reports.
-import { rethrowIfSqliteBlocked } from '../db/index.js';
+import { rethrowIfSqliteBlocked } from '../util/sqlite-blocked.js';
 import { storeFor } from '../store/index.js';
 import { failureLogSummary, tokenUseSummary } from '../store/usage-reports.js';
 import { errorMessage, log } from '../util/log.js';

package/dist/api/types.d.ts

@@ -32,6 +32,8 @@ export type StoreReply<C extends Context, R> = C extends {
 /** Builds process-local Actor values (admin and host admin) for CLI and CLI-run connector Contexts; Bearer-authed callers build Actor from the api_keys row
  * instead. */
 export declare function adminActor(subject: string): Actor;
+/** Throws unless the caller is the host's operator: `action` reaches past the caller's tenant. */
+export declare function requireHostAdmin(ctx: Context, action: string): void;
 /** The per-person key: an unowned key gets its own bucket by key id rather than sharing one. */
 export declare function ownerOrSubject(actor: Actor): string;
 /** Thrown by `api.recall` on a contract violation; the stable `code` lets callers discriminate without parsing the message.

package/dist/api/types.js

@@ -1,10 +1,15 @@
 // Request context (caller identity and tenant) shared by every API module, plus the recall contract error.
-import { BadRequestError } from '../core/api-errors.js';
+import { BadRequestError, ForbiddenError } from '../core/api-errors.js';
 /** Builds process-local Actor values (admin and host admin) for CLI and CLI-run connector Contexts; Bearer-authed callers build Actor from the api_keys row
  * instead. */
 export function adminActor(subject) {
     return { subject, role: 'admin', hostAdmin: true };
 }
+/** Throws unless the caller is the host's operator: `action` reaches past the caller's tenant. */
+export function requireHostAdmin(ctx, action) {
+    if (!ctx.actor.hostAdmin)
+        throw new ForbiddenError(`${action} requires a host admin`);
+}
 /** The per-person key: an unowned key gets its own bucket by key id rather than sharing one. */
 export function ownerOrSubject(actor) {
     return actor.owner ?? actor.subject;

package/dist/capture/caller-session.d.ts

@@ -1,5 +1,4 @@
 import { type Context } from '../api/types.js';
-import { type DatabaseSyncLike } from '../db/index.js';
 import { type CallerProject } from '../api/prompt-hook.js';
 import type { ContinuityKey } from '../store/sessions.js';
 import { type WorkingState } from './working-state.js';
@@ -11,6 +10,4 @@ export declare function callerInHoldout(ctx: Context, sessionId: string): boolea
 export declare function checkedWorkingState(state: WorkingState | null): WorkingState | null;
 export declare function assertTrigger(trigger: string | null): void;
 export declare function assertRequestId(requestId: string): void;
-/** Opens with the request's own lock wait, so a busy store becomes a 503 rather than a long stall. */
-export declare function withCallerDb<T>(ctx: Context, fn: (db: DatabaseSyncLike) => T): T;
 //# sourceMappingURL=caller-session.d.ts.map

package/dist/capture/caller-session.js

@@ -1,8 +1,7 @@
 // The checks every caller call shares: ids, project, the session's owner and the pilot arm, all from the request, never the server's env or folder.
 import { BadRequestError } from '../core/api-errors.js';
 import { ownerOrSubject } from '../api/types.js';
-import { closeHippoDb, openHippoDb } from '../db/index.js';
-import { MAX_ID_LEN } from '../util/http-util.js';
+import { MAX_ID_LEN } from '../util/limits.js';
 import { sessionPilotArm } from '../api/pilot-arm.js';
 import { assertCallerIds } from '../api/prompt-hook.js';
 import { assertCallerProject, projectNames } from '../core/project-identity.js';
@@ -45,14 +44,4 @@ export function assertRequestId(requestId) {
     if (requestId.length > MAX_ID_LEN)
         throw new BadRequestError(`request id: at most ${MAX_ID_LEN} characters`);
 }
-/** Opens with the request's own lock wait, so a busy store becomes a 503 rather than a long stall. */
-export function withCallerDb(ctx, fn) {
-    const db = openHippoDb(ctx.hippoRoot);
-    try {
-        return fn(db);
-    }
-    finally {
-        closeHippoDb(db);
-    }
-}
 //# sourceMappingURL=caller-session.js.map

package/dist/capture/capture-error.d.ts

@@ -1,7 +1,7 @@
-import { type CaptureErrorOutcome } from '../store/failure-log.js';
+import type { CaptureErrorOutcome } from '../store/failure-log.js';
 import type { JsonValue } from '../util/json.js';
 /** Store a failure as an error memory unless it is routine or a repeat, and log it either way, even when storing throws. */
-export declare function captureToolFailure(hippoRoot: string, tenantId: string, payload: JsonValue): CaptureErrorOutcome;
+export declare function captureToolFailure(hippoRoot: string, tenantId: string, payload: JsonValue, onLogged?: (failureId: number | null) => void): CaptureErrorOutcome;
 /** Who sent a failure from another machine: the audit actor and the project its lesson and repeat check belong to. */
 export interface LessonCaller {
     actor: string;