hippo-memory 1.71.0 → 1.72.0

package/dist/store/failure-log.js

@@ -5,14 +5,16 @@ import { DAY_MS } from '../util/time.js';
 export const FAILURE_LOG_RETENTION_DAYS = 90;
 /** Longest session id or tool name kept; the hook payload is not trusted to be short. */
 const MAX_FIELD = 128;
-/** Append one failure row and prune rows past {@link FAILURE_LOG_RETENTION_DAYS}. */
+/** Prune rows past {@link FAILURE_LOG_RETENTION_DAYS}, then append one failure row; returns the new row's id. */
 export function recordFailure(db, event) {
     // Normalised, because the window and prune compare timestamps as strings.
     const now = new Date(event.now ?? Date.now()).toISOString();
-    db.prepare(`INSERT INTO failure_log (ts, tenant_id, session_id, tool, outcome, skip_rule, sig_hash, detail_hash, owner_subject, origin_project, request_id)
-     VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?)`).run(now, event.tenantId, event.sessionId?.slice(0, MAX_FIELD) ?? null, event.tool?.slice(0, MAX_FIELD) ?? null, event.outcome, event.rule ?? null, event.sigHash ?? null, event.detailHash ?? null, event.ownerSubject ?? null, event.originProject ?? null, event.requestId ?? null);
+    // Prune first: nothing after the insert can throw, so a returned id always means a committed row.
     const cutoff = new Date(Date.parse(now) - FAILURE_LOG_RETENTION_DAYS * DAY_MS).toISOString();
     db.prepare(`DELETE FROM failure_log WHERE ts < ?`).run(cutoff);
+    const inserted = db.prepare(`INSERT INTO failure_log (ts, tenant_id, session_id, tool, outcome, skip_rule, sig_hash, detail_hash, owner_subject, origin_project, request_id)
+     VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?)`).run(now, event.tenantId, event.sessionId?.slice(0, MAX_FIELD) ?? null, event.tool?.slice(0, MAX_FIELD) ?? null, event.outcome, event.rule ?? null, event.sigHash ?? null, event.detailHash ?? null, event.ownerSubject ?? null, event.originProject ?? null, event.requestId ?? null);
+    return Number(inserted.lastInsertRowid);
 }
 /** The outcome logged for a caller's request id, or null, so a retried send finds the first one; another session's id is a ConflictError. */
 export function requestOutcome(db, tenantId, requestId, sessionId) {

package/dist/{trust → store}/gated-write.d.ts

@@ -1,7 +1,9 @@
 import type { DatabaseSyncLike } from '../db/index.js';
 import type { MemoryEntry } from '../core/memory.js';
 export type GatedWriteResult = 'written' | 'skipped:not-worth-storing' | 'skipped:secret' | 'skipped:rejected';
-/** Runs on the caller's handle so it nests in the caller's transaction (writeEntry would open a second handle and wait on that lock); the caller mirrors after commit with an entry it stamped itself. The rejection audit lands inside that transaction, which is safe because a batch that rolls back stays `summarised` and replay writes the audit again. */
+/** Runs on the caller's handle so it nests in the caller's transaction (writeEntry would open a second handle and wait on that lock); the
+ * caller mirrors after commit with an entry it stamped itself. The rejection audit lands inside that transaction, which is safe because
+ * a batch that rolls back stays `summarised` and replay writes the audit again. */
 export declare function gatedWrite(db: DatabaseSyncLike, hippoRoot: string, entry: MemoryEntry, opts?: {
     actor?: string;
     worthCheck?: boolean;

package/dist/{trust → store}/gated-write.js

@@ -1,11 +1,13 @@
 // The one write path for text no person typed into hippo: capture, compaction items and imported agent memories.
 import { isContentWorthStoring } from '../core/memory-quality.js';
-import { RejectedValueError } from '../store/rejection.js';
+import { RejectedValueError } from '../core/api-errors.js';
 import { detectSecret } from '../util/secret-detect.js';
-import { auditRejectionRefusal } from '../store/audit-event.js';
-import { stampOriginProject } from '../store/entry-row.js';
-import { writeEntryDbOnly } from '../store/entry-writes.js';
-/** Runs on the caller's handle so it nests in the caller's transaction (writeEntry would open a second handle and wait on that lock); the caller mirrors after commit with an entry it stamped itself. The rejection audit lands inside that transaction, which is safe because a batch that rolls back stays `summarised` and replay writes the audit again. */
+import { auditRejectionRefusal } from './audit-event.js';
+import { stampOriginProject } from './entry-row.js';
+import { writeEntryDbOnly } from './entry-writes.js';
+/** Runs on the caller's handle so it nests in the caller's transaction (writeEntry would open a second handle and wait on that lock); the
+ * caller mirrors after commit with an entry it stamped itself. The rejection audit lands inside that transaction, which is safe because
+ * a batch that rolls back stays `summarised` and replay writes the audit again. */
 export function gatedWrite(db, hippoRoot, entry, opts) {
     // Off for imported agent memories: a person wrote those notes, and a one-line preference fails the check.
     if (opts?.worthCheck !== false && !isContentWorthStoring(entry.content))

package/dist/store/goals.js

@@ -146,26 +146,28 @@ function getActiveGoalsWithDb(db, opts) {
 // Per-goal retrieval_policy multipliers compose onto the base goal-tag boost and are hard-capped at MAX_FINAL_MULTIPLIER (3.0x) before scoring.
 function loadGoalPolicies(db, active) {
     const policiesByGoalId = new Map();
+    const policyIds = [...new Set(active.flatMap((g) => (g.retrievalPolicyId ? [g.retrievalPolicyId] : [])))];
+    if (policyIds.length === 0)
+        return policiesByGoalId;
+    // SAFETY: the SELECT projects exactly these seven retrieval_policy columns; MAX_ACTIVE_GOAL_DEPTH bounds the IN list.
+    const rows = db.prepare(`
+    SELECT id, goal_id, policy_type, weight_schema_fit, weight_recency, weight_outcome, error_priority
+    FROM retrieval_policy WHERE id IN (${policyIds.map(() => '?').join(',')})
+  `).all(...policyIds);
+    const byId = new Map(rows.map((row) => [row.id, row]));
     for (const g of active) {
-        if (!g.retrievalPolicyId)
+        const row = g.retrievalPolicyId ? byId.get(g.retrievalPolicyId) : undefined;
+        if (!row)
             continue;
-        // SAFETY: the row comes from the SELECT above, which projects exactly
-        // these seven retrieval_policy columns.
-        const row = db.prepare(`
-      SELECT id, goal_id, policy_type, weight_schema_fit, weight_recency, weight_outcome, error_priority
-      FROM retrieval_policy WHERE id = ?
-    `).get(g.retrievalPolicyId);
-        if (row) {
-            policiesByGoalId.set(g.id, {
-                id: row.id,
-                goalId: row.goal_id,
-                policyType: row.policy_type,
-                weightSchemaFit: row.weight_schema_fit,
-                weightRecency: row.weight_recency,
-                weightOutcome: row.weight_outcome,
-                errorPriority: row.error_priority,
-            });
-        }
+        policiesByGoalId.set(g.id, {
+            id: row.id,
+            goalId: row.goal_id,
+            policyType: row.policy_type,
+            weightSchemaFit: row.weight_schema_fit,
+            weightRecency: row.weight_recency,
+            weightOutcome: row.weight_outcome,
+            errorPriority: row.error_priority,
+        });
     }
     return policiesByGoalId;
 }

package/dist/store/graph-reads.js

@@ -1,9 +1,10 @@
 // The graph reads a view and a traversal share. Each opens hippo.db itself unless the caller hands it the handle its snapshot runs on.
+import { DEFAULT_LIST_LIMIT } from '../util/limits.js';
 import { openHippoDb, closeHippoDb, withReadSnapshot } from '../db/index.js';
 import { onHandle } from './open.js';
 import { assertTenantId } from './tenant.js';
 import { GRAPH_ENTITY_TYPES, rowToEntity, rowToRelation, ENTITY_COLS, RELATION_COLS } from './graph-rows.js';
-const DEFAULT_GRAPH_PAGE_SIZE = 100;
+const DEFAULT_GRAPH_PAGE_SIZE = DEFAULT_LIST_LIMIT;
 const DEFAULT_GRAPH_SCAN_LIMIT = 1000;
 /** Entities with an exact `name`, bounded by `limit` in SQL with a deterministic order, so graph-view focus finds `--entity NAME` directly
  * without materializing every same-name row. */
@@ -207,7 +208,8 @@ export function storedGraphOn(db, tenantId, memoryIds) {
     // SAFETY: the SELECT names exactly the columns of StoredEntity.
     const entities = db.prepare(`SELECT id, entity_type, name, memory_id, source_kind, source_object_type, source_object_id FROM entities WHERE tenant_id = ? ORDER BY id`).all(tenantId);
     // SAFETY: the SELECT names exactly the columns of StoredRelation.
-    const relations = db.prepare(`SELECT id, from_entity_id, to_entity_id, rel_type, memory_id, source_kind, source_object_type, source_object_id FROM relations WHERE tenant_id = ? ORDER BY id`).all(tenantId);
+    const relations = db.prepare(`SELECT id, from_entity_id, to_entity_id, rel_type, memory_id, source_kind, source_object_type, source_object_id ` +
+        `FROM relations WHERE tenant_id = ? ORDER BY id`).all(tenantId);
     return { kinds, entities, relations };
 }
 function memoryKindsOn(db, memoryIds) {

package/dist/store/graph-writes.d.ts

@@ -7,13 +7,13 @@ interface ResolvedGraphSource {
     memoryId: string | null;
 }
 export declare function resolveConsolidatedSource(db: DatabaseSyncLike, tenantId: string, memoryId: string | null, sourceObject: SourceObjectRef | null, label: string): ResolvedGraphSource;
-/** Insert a graph entity extracted from a consolidated memory; throws if the source memory is missing / cross-tenant / raw (the DB trigger is the backstop). */
-export declare function insertEntity(hippoRoot: string, tenantId: string, opts: InsertEntityOpts, txDb?: DatabaseSyncLike): Entity;
-/** Renames an entity or moves its memory provenance in place, keeping id and created_at; null when the row is gone.
+/** Insert a graph entity on the caller's handle; throws if the source memory is missing / cross-tenant / raw (the DB trigger is the backstop). */
+export declare function insertEntityRow(db: DatabaseSyncLike, tenantId: string, opts: InsertEntityOpts): Entity;
+/** Renames an entity or moves its memory provenance in place on the caller's handle, keeping id and created_at; null when the row is gone.
  *  A delete plus an insert would cascade away every relation that points at it. */
-export declare function updateEntity(hippoRoot: string, tenantId: string, id: number, opts: UpdateEntityOpts, txDb?: DatabaseSyncLike): Entity | null;
-/** Insert a graph relation between two same-tenant entities, sourced from a consolidated memory. */
-export declare function insertRelation(hippoRoot: string, tenantId: string, opts: InsertRelationOpts, txDb?: DatabaseSyncLike): Relation;
+export declare function updateEntityRow(db: DatabaseSyncLike, tenantId: string, id: number, opts: UpdateEntityOpts): Entity | null;
+/** Insert a graph relation between two same-tenant entities on the caller's handle, sourced from a consolidated memory. */
+export declare function insertRelationRow(db: DatabaseSyncLike, tenantId: string, opts: InsertRelationOpts): Relation;
 /** The source object still holds the loader's rule (active or superseded); a closed or gone one gets no new graph row. */
 export declare function objectInForce(db: DatabaseSyncLike, tenantId: string, ref: SourceObjectRef): boolean;
 /** The lowest-id entity of this type anchored to the source object, which is the row a rebuild keeps. */

package/dist/store/graph-writes.js

@@ -71,8 +71,8 @@ function assertSourceObjectUsable(db, tenantId, sourceObject, label) {
         }
     }
 }
-/** Insert a graph entity extracted from a consolidated memory; throws if the source memory is missing / cross-tenant / raw (the DB trigger is the backstop). */
-export function insertEntity(hippoRoot, tenantId, opts, txDb) {
+/** Insert a graph entity on the caller's handle; throws if the source memory is missing / cross-tenant / raw (the DB trigger is the backstop). */
+export function insertEntityRow(db, tenantId, opts) {
     assertTenantId('insertEntity', tenantId);
     if (!GRAPH_ENTITY_TYPES.has(opts.entityType)) {
         throw new Error(`insertEntity: entityType must be one of ${Array.from(GRAPH_ENTITY_TYPES).join('|')}; got ${opts.entityType}`);
@@ -81,25 +81,17 @@ export function insertEntity(hippoRoot, tenantId, opts, txDb) {
     const now = new Date().toISOString();
     const memoryId = opts.memoryId ?? null;
     const sourceObject = opts.sourceObject ?? null;
-    const ownDb = txDb ? null : openHippoDb(hippoRoot);
-    const db = txDb ?? ownDb;
-    try {
-        const { sourceKind, memoryId: effectiveMemoryId } = resolveConsolidatedSource(db, tenantId, memoryId, sourceObject, 'insertEntity');
-        const result = db.prepare(`
-      INSERT INTO entities(tenant_id, entity_type, name, memory_id, source_kind, source_object_type, source_object_id, created_at)
-      VALUES (?, ?, ?, ?, ?, ?, ?, ?)
-    `).run(tenantId, opts.entityType, name, effectiveMemoryId, sourceKind, sourceObject?.type ?? null, sourceObject?.id ?? null, now);
-        const id = Number(result.lastInsertRowid ?? 0);
-        // SAFETY: row's shape matches the columns named in ENTITY_COLS above.
-        const row = db.prepare(`SELECT ${ENTITY_COLS} FROM entities WHERE id = ?`).get(id);
-        if (!row)
-            throw new Error('insertEntity: failed to reload inserted entity');
-        return rowToEntity(row);
-    }
-    finally {
-        if (ownDb)
-            closeHippoDb(ownDb);
-    }
+    const { sourceKind, memoryId: effectiveMemoryId } = resolveConsolidatedSource(db, tenantId, memoryId, sourceObject, 'insertEntity');
+    const result = db.prepare(`
+    INSERT INTO entities(tenant_id, entity_type, name, memory_id, source_kind, source_object_type, source_object_id, created_at)
+    VALUES (?, ?, ?, ?, ?, ?, ?, ?)
+  `).run(tenantId, opts.entityType, name, effectiveMemoryId, sourceKind, sourceObject?.type ?? null, sourceObject?.id ?? null, now);
+    const id = Number(result.lastInsertRowid ?? 0);
+    // SAFETY: row's shape matches the columns named in ENTITY_COLS above.
+    const row = db.prepare(`SELECT ${ENTITY_COLS} FROM entities WHERE id = ?`).get(id);
+    if (!row)
+        throw new Error('insertEntity: failed to reload inserted entity');
+    return rowToEntity(row);
 }
 function checkedName(label, raw) {
     const name = (raw ?? '').trim();
@@ -110,33 +102,26 @@ function checkedName(label, raw) {
     }
     return name;
 }
-/** Renames an entity or moves its memory provenance in place, keeping id and created_at; null when the row is gone.
+/** Renames an entity or moves its memory provenance in place on the caller's handle, keeping id and created_at; null when the row is gone.
  *  A delete plus an insert would cascade away every relation that points at it. */
-export function updateEntity(hippoRoot, tenantId, id, opts, txDb) {
+export function updateEntityRow(db, tenantId, id, opts) {
     assertTenantId('updateEntity', tenantId);
     const name = checkedName('updateEntity', opts.name);
-    const db = txDb ?? openHippoDb(hippoRoot);
-    try {
-        // SAFETY: row's shape matches the columns named in ENTITY_COLS above.
-        const row = db.prepare(`SELECT ${ENTITY_COLS} FROM entities WHERE id = ? AND tenant_id = ?`).get(id, tenantId);
-        if (!row)
-            return null;
-        const entity = rowToEntity(row);
-        const sourceObject = entity.sourceObjectType === undefined || entity.sourceObjectId === undefined
-            ? null
-            : { type: entity.sourceObjectType, id: entity.sourceObjectId };
-        const resolved = resolveConsolidatedSource(db, tenantId, opts.memoryId ?? null, sourceObject, 'updateEntity');
-        db.prepare(`UPDATE entities SET name = ?, memory_id = ?, source_kind = ? WHERE id = ? AND tenant_id = ?`)
-            .run(name, resolved.memoryId, resolved.sourceKind, id, tenantId);
-        return { ...entity, name, memoryId: resolved.memoryId, sourceKind: resolved.sourceKind };
-    }
-    finally {
-        if (db !== txDb)
-            closeHippoDb(db);
-    }
+    // SAFETY: row's shape matches the columns named in ENTITY_COLS above.
+    const row = db.prepare(`SELECT ${ENTITY_COLS} FROM entities WHERE id = ? AND tenant_id = ?`).get(id, tenantId);
+    if (!row)
+        return null;
+    const entity = rowToEntity(row);
+    const sourceObject = entity.sourceObjectType === undefined || entity.sourceObjectId === undefined
+        ? null
+        : { type: entity.sourceObjectType, id: entity.sourceObjectId };
+    const resolved = resolveConsolidatedSource(db, tenantId, opts.memoryId ?? null, sourceObject, 'updateEntity');
+    db.prepare(`UPDATE entities SET name = ?, memory_id = ?, source_kind = ? WHERE id = ? AND tenant_id = ?`)
+        .run(name, resolved.memoryId, resolved.sourceKind, id, tenantId);
+    return { ...entity, name, memoryId: resolved.memoryId, sourceKind: resolved.sourceKind };
 }
-/** Insert a graph relation between two same-tenant entities, sourced from a consolidated memory. */
-export function insertRelation(hippoRoot, tenantId, opts, txDb) {
+/** Insert a graph relation between two same-tenant entities on the caller's handle, sourced from a consolidated memory. */
+export function insertRelationRow(db, tenantId, opts) {
     assertTenantId('insertRelation', tenantId);
     if (!GRAPH_RELATION_TYPES.has(opts.relType)) {
         throw new Error(`insertRelation: relType must be one of ${Array.from(GRAPH_RELATION_TYPES).join('|')}; got ${opts.relType}`);
@@ -144,35 +129,27 @@ export function insertRelation(hippoRoot, tenantId, opts, txDb) {
     const now = new Date().toISOString();
     const memoryId = opts.memoryId ?? null;
     const sourceObject = opts.sourceObject ?? null;
-    const ownDb = txDb ? null : openHippoDb(hippoRoot);
-    const db = txDb ?? ownDb;
-    try {
-        for (const [eid, role] of [[opts.fromEntityId, 'from'], [opts.toEntityId, 'to']]) {
-            // SAFETY: ent's shape matches the single `tenant_id` column named in
-            // the SELECT above.
-            const ent = db.prepare(`SELECT tenant_id FROM entities WHERE id = ?`).get(eid);
-            if (!ent)
-                throw new Error(`insertRelation: ${role}_entity ${eid} not found`);
-            if (ent.tenant_id !== tenantId) {
-                throw new Error(`insertRelation: ${role}_entity ${eid} belongs to another tenant (no cross-tenant edges)`);
-            }
+    for (const [eid, role] of [[opts.fromEntityId, 'from'], [opts.toEntityId, 'to']]) {
+        // SAFETY: ent's shape matches the single `tenant_id` column named in
+        // the SELECT above.
+        const ent = db.prepare(`SELECT tenant_id FROM entities WHERE id = ?`).get(eid);
+        if (!ent)
+            throw new Error(`insertRelation: ${role}_entity ${eid} not found`);
+        if (ent.tenant_id !== tenantId) {
+            throw new Error(`insertRelation: ${role}_entity ${eid} belongs to another tenant (no cross-tenant edges)`);
         }
-        const { sourceKind, memoryId: effectiveMemoryId } = resolveConsolidatedSource(db, tenantId, memoryId, sourceObject, 'insertRelation');
-        const result = db.prepare(`
-      INSERT INTO relations(tenant_id, from_entity_id, to_entity_id, rel_type, memory_id, source_kind, source_object_type, source_object_id, created_at)
-      VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?)
-    `).run(tenantId, opts.fromEntityId, opts.toEntityId, opts.relType, effectiveMemoryId, sourceKind, sourceObject?.type ?? null, sourceObject?.id ?? null, now);
-        const id = Number(result.lastInsertRowid ?? 0);
-        // SAFETY: row's shape matches the columns named in RELATION_COLS above.
-        const row = db.prepare(`SELECT ${RELATION_COLS} FROM relations WHERE id = ?`).get(id);
-        if (!row)
-            throw new Error('insertRelation: failed to reload inserted relation');
-        return rowToRelation(row);
-    }
-    finally {
-        if (ownDb)
-            closeHippoDb(ownDb);
     }
+    const { sourceKind, memoryId: effectiveMemoryId } = resolveConsolidatedSource(db, tenantId, memoryId, sourceObject, 'insertRelation');
+    const result = db.prepare(`
+    INSERT INTO relations(tenant_id, from_entity_id, to_entity_id, rel_type, memory_id, source_kind, source_object_type, source_object_id, created_at)
+    VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?)
+  `).run(tenantId, opts.fromEntityId, opts.toEntityId, opts.relType, effectiveMemoryId, sourceKind, sourceObject?.type ?? null, sourceObject?.id ?? null, now);
+    const id = Number(result.lastInsertRowid ?? 0);
+    // SAFETY: row's shape matches the columns named in RELATION_COLS above.
+    const row = db.prepare(`SELECT ${RELATION_COLS} FROM relations WHERE id = ?`).get(id);
+    if (!row)
+        throw new Error('insertRelation: failed to reload inserted relation');
+    return rowToRelation(row);
 }
 /** The source object still holds the loader's rule (active or superseded); a closed or gone one gets no new graph row. */
 export function objectInForce(db, tenantId, ref) {

package/dist/store/handoffs.d.ts

@@ -2,7 +2,7 @@ import { type SessionHandoff, type HandoffOutcome, type HandoffEvidence } from '
 import type { TaskSnapshot } from './rows.js';
 import { type ContinuityKey } from './sessions.js';
 /** Column list shared by every session_handoffs SELECT; cards.ts reuses it for the card handoff lookup. */
-export declare const HANDOFF_COLUMNS = "id, session_id, repo_root, task_id, summary, next_action, artifacts_json, scope, created_at, constraints_json, evidence_json, outcome, target_runtime, card_id";
+export declare const HANDOFF_COLUMNS: string;
 /** Save a session handoff record; returns the persisted handoff. */
 export declare function saveSessionHandoff(hippoRoot: string, tenantId: string, handoff: Omit<SessionHandoff, 'updatedAt'>, key?: ContinuityKey): SessionHandoff;
 interface HandoffFilter {

package/dist/store/handoffs.js

@@ -1,11 +1,12 @@
 import { closeHippoDb } from '../db/index.js';
 import { rowToSessionHandoff, isHandoffOutcome, } from '../core/handoff.js';
-import { scopeAdmitSql } from './recall-scope.js';
+import { scopeAdmitSql } from './rule-sql.js';
 import { assertTenantId } from './tenant.js';
 import { onHandle, openStore } from './open.js';
 import { continuityStamp, continuityWhere, loadActiveTaskSnapshot } from './sessions.js';
 /** Column list shared by every session_handoffs SELECT; cards.ts reuses it for the card handoff lookup. */
-export const HANDOFF_COLUMNS = 'id, session_id, repo_root, task_id, summary, next_action, artifacts_json, scope, created_at, constraints_json, evidence_json, outcome, target_runtime, card_id';
+export const HANDOFF_COLUMNS = 'id, session_id, repo_root, task_id, summary, next_action, artifacts_json, scope, created_at, constraints_json, ' +
+    'evidence_json, outcome, target_runtime, card_id';
 /** Save a session handoff record; returns the persisted handoff. */
 export function saveSessionHandoff(hippoRoot, tenantId, handoff, key) {
     assertTenantId('saveSessionHandoff', tenantId);
@@ -15,10 +16,9 @@ export function saveSessionHandoff(hippoRoot, tenantId, handoff, key) {
     // Scope is stored as given; read-side default-deny in api.recall + cmdRecall
     // continuity excludes slack:private:* and 'unknown:legacy'.
     try {
-        const result = db.prepare(`
-      INSERT INTO session_handoffs(session_id, repo_root, task_id, summary, next_action, artifacts_json, scope, tenant_id, created_at, constraints_json, evidence_json, outcome, target_runtime, card_id, owner_subject, origin_project)
-      VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?)
-    `).run(handoff.sessionId, handoff.repoRoot ?? null, handoff.taskId ?? null, handoff.summary, handoff.nextAction ?? null, JSON.stringify(handoff.artifacts ?? []), handoff.scope ?? null, tenantId, now, JSON.stringify(handoff.constraints ?? []), handoff.evidence ? JSON.stringify(handoff.evidence) : null, handoff.outcome ?? null, handoff.targetRuntime ?? null, handoff.cardId ?? null, stamp?.owner ?? null, stamp?.origin ?? null);
+        const result = db.prepare(`\n      INSERT INTO session_handoffs(session_id, repo_root, task_id, summary, next_action, artifacts_json, scope, tenant_id, created_at, ` +
+            `constraints_json, evidence_json, outcome, target_runtime, card_id, owner_subject, origin_project)\n` +
+            `      VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?)\n    `).run(handoff.sessionId, handoff.repoRoot ?? null, handoff.taskId ?? null, handoff.summary, handoff.nextAction ?? null, JSON.stringify(handoff.artifacts ?? []), handoff.scope ?? null, tenantId, now, JSON.stringify(handoff.constraints ?? []), handoff.evidence ? JSON.stringify(handoff.evidence) : null, handoff.outcome ?? null, handoff.targetRuntime ?? null, handoff.cardId ?? null, stamp?.owner ?? null, stamp?.origin ?? null);
         const id = Number(result.lastInsertRowid ?? 0);
         // SAFETY: row's shape matches HANDOFF_COLUMNS.
         const row = db.prepare(`SELECT ${HANDOFF_COLUMNS} FROM session_handoffs WHERE id = ?`).get(id);

package/dist/store/index-and-stats.js

@@ -1,5 +1,5 @@
 import { withWriteScope, setMeta, isSqliteBusy, pruneConsolidationRuns, getMeta } from '../db/index.js';
-import { RejectedValueError } from './rejection.js';
+import { RejectedValueError } from '../core/api-errors.js';
 import { log } from '../util/log.js';
 import { audit } from './audit-event.js';
 import { stampOriginProjectForImport, upsertEntryRow } from './entry-row.js';
@@ -113,7 +113,7 @@ export function loadStats(hippoRoot) {
 export function appendConsolidationRun(hippoRoot, run) {
     onHandle(hippoRoot, (db) => {
         db.prepare(`INSERT INTO consolidation_runs(timestamp, decayed, merged, removed) VALUES (?, ?, ?, ?)`).run(run.timestamp, run.decayed, run.merged, run.removed);
-        pruneConsolidationRuns(db, 50);
+        pruneConsolidationRuns(db);
         writeStatsMirror(hippoRoot, buildStatsFromDb(db));
     }, openStore);
 }

package/dist/store/key-writes.js

@@ -3,7 +3,7 @@ import { BadRequestError, ConflictError, NotFoundError } from '../core/api-error
 import { appendAuditEvent } from './audit.js';
 import { grantScope, insertApiKey, listLiveOwnedKeyIds, revokeApiKey, ungrantScope } from './auth.js';
 import { withWriteScope } from '../db/index.js';
-import { isRestrictedScope } from './recall-scope.js';
+import { isRestrictedScope } from '../core/recall-scope.js';
 import { selectApiKeyOwner } from './tenant-lookup.js';
 /** The auth_create row a mint writes; the plaintext never reaches it. */
 function createAuditOf({ key, actor, metadata }) {

package/dist/store/ledger-turn.d.ts

@@ -1,5 +1,9 @@
 import type { DeliveryEventInput } from './delivery-recorder.js';
 import { type LastSent, type TokenSurface, type TokenUse } from './token-ledger.js';
+import { type PilotArm } from './pilot-arm.js';
+/** Says why a ledger row did not land, at the level its class earns: busy warns once through
+ * noteStoreBusy, absent is debug with no stack, unexpected warns once with the error class and stack. */
+export declare function noteLedgerRowSkipped<E>(error: E): void;
 /** Stores one delivery event and returns its id, or null when the write failed. */
 export type DeliveryWrite = (input: DeliveryEventInput) => number | null;
 /** The token rows of one turn and the delivery event that follows them. */
@@ -14,4 +18,9 @@ export interface LedgerTurn {
 export declare function recordLedgerTurn(hippoRoot: string, turn: LedgerTurn): void;
 /** What the session last sent on `surface`, or null, as lastSentState reads it. */
 export declare function lastSentOnSurface(hippoRoot: string, tenantId: string, sessionId: string | null | undefined, surface: TokenSurface): LastSent | null;
+/** The session's pilot arm: `write` books it as ensurePilotArm does, else the stored arm or the hash arm. */
+export declare function pilotArmOnRoot(hippoRoot: string, tenantId: string, sessionId: string, rateBp: number, opts: {
+    write: boolean;
+    ownTenantOnly?: boolean;
+}): PilotArm;
 //# sourceMappingURL=ledger-turn.d.ts.map

package/dist/store/ledger-turn.js

@@ -1,6 +1,37 @@
+// One hook or context turn's token-ledger work by store root: each call opens hippo.db, runs on one connection and closes it.
+import { isSqliteBusy, noteStoreBusy } from '../db/index.js';
+import { errorFields, errorMessage, log } from '../util/log.js';
 import { lastSentState, recordTokenUse } from './token-ledger.js';
 import { onHandle } from './open.js';
+import { ensurePilotArm, hashArm, readPilotArm } from './pilot-arm.js';
 import { writeDeliveryEventOnHandle } from './recall-trace.js';
+// SQLite's result codes for a hippo.db it cannot read: a corrupt image, and a file that is no database.
+const SQLITE_CORRUPT = 11;
+const SQLITE_NOTADB = 26;
+/** The one rule for a skipped ledger row. `absent` is a store with no token_ledger table or a hippo.db
+ * SQLite cannot read; the command that owns the store reports that, and a hook must stay quiet about it. */
+function ledgerSkipClass(error) {
+    if (isSqliteBusy(error))
+        return 'busy';
+    const code = error instanceof Error && 'errcode' in error ? error.errcode : undefined;
+    if (code === SQLITE_CORRUPT || code === SQLITE_NOTADB)
+        return 'absent';
+    return errorMessage(error).includes('no such table: token_ledger') ? 'absent' : 'unexpected';
+}
+/** Says why a ledger row did not land, at the level its class earns: busy warns once through
+ * noteStoreBusy, absent is debug with no stack, unexpected warns once with the error class and stack. */
+export function noteLedgerRowSkipped(error) {
+    const skip = ledgerSkipClass(error);
+    if (skip === 'busy') {
+        noteStoreBusy('token ledger row skipped');
+        return;
+    }
+    const message = `token ledger row skipped: ${errorMessage(error)}`;
+    if (skip === 'absent')
+        log.debug(message);
+    else
+        log.warnThenDebug('token-ledger-row', message, errorFields(error));
+}
 /** Books a turn's token rows, then its delivery event, on one connection. */
 export function recordLedgerTurn(hippoRoot, turn) {
     const { onRowError } = turn;
@@ -24,4 +55,11 @@ export function recordLedgerTurn(hippoRoot, turn) {
 export function lastSentOnSurface(hippoRoot, tenantId, sessionId, surface) {
     return onHandle(hippoRoot, (db) => lastSentState(db, tenantId, sessionId, surface));
 }
+/** The session's pilot arm: `write` books it as ensurePilotArm does, else the stored arm or the hash arm. */
+export function pilotArmOnRoot(hippoRoot, tenantId, sessionId, rateBp, opts) {
+    const { ownTenantOnly } = opts;
+    return onHandle(hippoRoot, (db) => opts.write
+        ? ensurePilotArm(db, tenantId, sessionId, rateBp, { ownTenantOnly })
+        : readPilotArm(db, sessionId, ownTenantOnly ? tenantId : undefined) ?? hashArm(sessionId, rateBp));
+}
 //# sourceMappingURL=ledger-turn.js.map

package/dist/store/mirrors.js

@@ -2,12 +2,12 @@ import { DEFAULT_TENANT_ID } from '../util/env.js';
 import * as fs from 'fs';
 import * as path from 'path';
 import { Layer } from '../core/memory.js';
-import { dumpFrontmatter } from './yaml.js';
-import { getMeta } from '../db/index.js';
+import { dumpFrontmatter } from '../util/yaml.js';
+import { getMeta, CONSOLIDATION_RUNS_KEPT } from '../db/index.js';
 import { oncePerStore } from '../db/connect.js';
 import { errorFields, errorMessage, log } from '../util/log.js';
 import { parseJsonArray, INDEX_VERSION, parseLastTraceId, MEMORY_SELECT_COLUMNS, rowToEntry, rowToMemoryConflict, } from './rows.js';
-import { serializeEntry } from './markdown.js';
+import { serializeEntry } from '../core/markdown.js';
 const SCORE_DECIMALS = 3;
 export function layerDir(root, layer) {
     return path.join(root, layer);
@@ -223,8 +223,12 @@ export function readLastRecall(db) {
     };
 }
 export function buildStatsFromDb(db) {
-    // SAFETY: runs' shape matches the four columns named in the SELECT above.
-    const runs = db.prepare(`SELECT timestamp, decayed, merged, removed FROM consolidation_runs ORDER BY timestamp ASC, id ASC`).all();
+    // SAFETY: runs' shape matches the four columns named in the SELECT below.
+    const runs = db.prepare(`
+    SELECT timestamp, decayed, merged, removed FROM (
+      SELECT id, timestamp, decayed, merged, removed FROM consolidation_runs ORDER BY timestamp DESC, id DESC LIMIT ?
+    ) ORDER BY timestamp ASC, id ASC
+  `).all(CONSOLIDATION_RUNS_KEPT);
     return {
         total_remembered: Number(getMeta(db, 'total_remembered', '0')),
         total_recalled: Number(getMeta(db, 'total_recalled', '0')),
@@ -240,7 +244,7 @@ export function buildStatsFromDb(db) {
 /** Write the `index.json` mirror file for an already-derived index. Exported for
  *  `rebuildIndex` (the only index.json writer) and the longmemeval benchmark. */
 export function writeIndexMirror(hippoRoot, index) {
-    mirrorBestEffort('index.json', () => fs.writeFileSync(path.join(hippoRoot, 'index.json'), JSON.stringify(index, null, 2), 'utf8'));
+    mirrorBestEffort('index.json', () => overwriteInPlace(path.join(hippoRoot, 'index.json'), JSON.stringify(index, null, 2)));
 }
 export function writeStatsMirror(hippoRoot, stats) {
     mirrorBestEffort('stats.json', () => overwriteInPlace(path.join(hippoRoot, 'stats.json'), JSON.stringify(stats, null, 2)));

package/dist/store/open.d.ts

@@ -1,9 +1,5 @@
 import { type MemoryEntry } from '../core/memory.js';
 import { type DatabaseSyncLike } from '../db/index.js';
-import { type ResolveProjectIdentityOpts } from '../core/project-identity.js';
-/** Nearest ancestor store like git; the strict join is the fallback so `hippo init` still creates `<cwd>/.hippo`. */
-export declare function getHippoRoot(cwd?: string, opts?: ResolveProjectIdentityOpts): string;
-export declare function isInitialized(hippoRoot: string): boolean;
 export declare function initStore(hippoRoot: string): void;
 /** One open connection with init done on it, for callers who used to pay for `initStore` + a second `openHippoDb`. */
 export declare function openStore(hippoRoot: string, opts?: {