hippo-memory 1.71.0 → 2.0.0

package/dist/api/dormant.js

@@ -3,9 +3,11 @@ import { ConflictError, NotFoundError } from '../core/api-errors.js';
 import { stampOriginProject } from '../store/entry-row.js';
 import { updateStatsUnlessBusy } from '../store/index-and-stats.js';
 import { loadDormantMemories, holdsDormantMemory, restoreDormantMemory, forgetDormantMemory, } from '../store/dormant.js';
+import { strengthAblation } from '../core/ablation.js';
 import { createMemory, calculateStrength } from '../core/memory.js';
 import { loadConfig } from '../core/config.js';
-import { canTouchScope, personalScopeOf, touchableScopeSql } from '../store/recall-scope.js';
+import { canTouchScope, personalScopeOf } from '../core/recall-scope.js';
+import { touchableScopeSql } from '../store/rule-sql.js';
 const touchable = (ctx) => touchableScopeSql('', personalScopeOf(ctx.actor));
 /** A tenant's dormant memories (src/store/dormant.ts): what sleep moved out of active memory when `dormant.enabled` is on. Newest first;
  * `opts.query` keeps rows containing every term (case-insensitive). */
@@ -39,7 +41,7 @@ function reviveSnapshot(ctx, dormant, now) {
     };
     if (dormant.reason === 'quality-repair')
         revived.confidence = 'verified';
-    return stampOriginProject(ctx.hippoRoot, { ...revived, strength: calculateStrength(revived, now) });
+    return stampOriginProject(ctx.hippoRoot, { ...revived, strength: calculateStrength(revived, now, { ablation: strengthAblation() }) });
 }
 /** Permanently deletes a dormant memory, the explicit "forget it for good"; throws when the tenant has no dormant memory with that id. */
 export function forgetDormant(ctx, id) {

package/dist/api/drill-down.js

@@ -1,7 +1,8 @@
 // DAG drill-down from a summary to its children.
-import { requireGroup, storeFor } from '../store/index.js';
+import { requireGroup } from '../store/index.js';
+import { storeFor } from '../store/sqlite/store.js';
 import { estimateTokens } from '../util/token-text.js';
-import { passesScopeFilterForRecall, personalScopeOf } from '../store/recall-scope.js';
+import { passesScopeFilterForRecall, personalScopeOf } from '../core/recall-scope.js';
 import { classifyOriginProject } from '../core/project-identity.js';
 const DEFAULT_DRILL_DOWN_LIMIT = 50;
 /** One step down the DAG from a level-2+ summary to its direct children (the way back from `recall(... summarizeOverflow: true)` substitutions). Only

package/dist/api/embeddings.d.ts

@@ -0,0 +1,17 @@
+import type { EmbeddingProvider } from '../embeddings/provider.js';
+import { type Context } from './types.js';
+/** Embed every memory that has no vector yet; resolves to how many it embedded. */
+export declare function embedMissingMemories(ctx: Context, provider?: EmbeddingProvider): Promise<number>;
+/** How many vectors the store holds, live memory or not. */
+export declare function storedVectorCount(ctx: Context): number;
+export interface EmbedCoverage {
+    /** Every memory id in the store. */
+    memoryIds: string[];
+    /** Every id with a stored vector, including orphans whose memory is gone. */
+    vectorIds: string[];
+}
+/** Memory ids against vector ids, for the embed status and backfill lines. */
+export declare function embedCoverage(ctx: Context): EmbedCoverage;
+/** Re-seed every memory's physics particle from its vector; returns how many it reset. */
+export declare function resetPhysicsFromVectors(ctx: Context): number;
+//# sourceMappingURL=embeddings.d.ts.map

package/dist/api/embeddings.js

@@ -0,0 +1,28 @@
+// The vector side of a store for the embed and import verbs: embed what is missing, count coverage, re-seed physics.
+// Vectors and physics rows carry no tenant, so each op covers the whole store and needs the host admin.
+import { embedAll } from '../search/embed-memories.js';
+import { loadAllEntryIds } from '../store/entry-reads.js';
+import { loadEmbeddingIndex, resetStoredParticles, storedVectorSummary } from '../store/vector-index.js';
+import { requireHostAdmin } from './types.js';
+/** Embed every memory that has no vector yet; resolves to how many it embedded. */
+export async function embedMissingMemories(ctx, provider) {
+    requireHostAdmin(ctx, 'Embedding the store');
+    return embedAll(ctx.hippoRoot, undefined, provider);
+}
+/** How many vectors the store holds, live memory or not. */
+export function storedVectorCount(ctx) {
+    requireHostAdmin(ctx, 'Reading the vector index');
+    return storedVectorSummary(ctx.hippoRoot).ids.size;
+}
+/** Memory ids against vector ids, for the embed status and backfill lines. */
+export function embedCoverage(ctx) {
+    requireHostAdmin(ctx, 'Reading the vector index');
+    return { memoryIds: loadAllEntryIds(ctx.hippoRoot), vectorIds: [...storedVectorSummary(ctx.hippoRoot).ids] };
+}
+/** Re-seed every memory's physics particle from its vector; returns how many it reset. */
+export function resetPhysicsFromVectors(ctx) {
+    requireHostAdmin(ctx, 'Resetting physics');
+    const vectors = loadEmbeddingIndex(ctx.hippoRoot);
+    return resetStoredParticles(ctx.hippoRoot, loadAllEntryIds(ctx.hippoRoot), vectors);
+}
+//# sourceMappingURL=embeddings.js.map

package/dist/api/error-reply.d.ts

@@ -0,0 +1,8 @@
+/** The status and client-facing message for one failed request. */
+export interface ApiErrorReply {
+    status: number;
+    message: string;
+}
+/** Maps by class so rewording a message never moves a status; an untyped error is a 500 whose text stays in the server log. */
+export declare function mapApiError<E>(err: E): ApiErrorReply;
+//# sourceMappingURL=error-reply.d.ts.map

package/dist/api/error-reply.js

@@ -0,0 +1,21 @@
+// The one error-to-reply map the HTTP server and the MCP transports share, so a status never depends on which front end caught the error.
+import { ApiError } from '../core/api-errors.js';
+import { BodyTimeoutError, BodyTooLargeError, HttpError, INTERNAL_ERROR_MESSAGE, STORE_NOT_PORTED_MESSAGE } from '../util/http-util.js';
+import { SqliteBlockedError } from '../util/sqlite-blocked.js';
+/** Maps by class so rewording a message never moves a status; an untyped error is a 500 whose text stays in the server log. */
+export function mapApiError(err) {
+    // An add-on can build an HttpError from any number, and writeHead throws on one outside 100-999.
+    if (err instanceof HttpError && !(Number.isInteger(err.status) && err.status >= 100 && err.status <= 999)) {
+        return { status: 500, message: INTERNAL_ERROR_MESSAGE };
+    }
+    if (err instanceof HttpError || err instanceof ApiError)
+        return { status: err.status, message: err.message };
+    if (err instanceof BodyTooLargeError)
+        return { status: 413, message: err.message };
+    if (err instanceof BodyTimeoutError)
+        return { status: 408, message: err.message };
+    if (err instanceof SqliteBlockedError)
+        return { status: 501, message: STORE_NOT_PORTED_MESSAGE };
+    return { status: 500, message: INTERNAL_ERROR_MESSAGE };
+}
+//# sourceMappingURL=error-reply.js.map

package/dist/api/forget.d.ts

@@ -1,11 +1,12 @@
-import type { Context, StoreReply } from './types.js';
+import { type RejectFlowResult } from '../trust/reject-flow.js';
+import { type Context } from './types.js';
 /** Delete a memory by id. Reach is checked inside the delete's write scope, and a
  * row out of reach answers as not found, so a caller learns nothing about it. */
 export interface ForgetResult {
     ok: true;
     id: string;
 }
-export declare function forget<C extends Context>(ctx: C, id: string): StoreReply<C, ForgetResult>;
+export declare function forget(ctx: Context, id: string): Promise<ForgetResult>;
 export interface RejectOpts {
     /** By-id form: reject the CURRENT content of an existing memory. */
     memoryId?: string;
@@ -20,7 +21,10 @@ export interface RejectResult {
 }
 /** Tombstones a value's normalized digest so a matching write is refused everywhere until `unreject`; pass exactly one of `memoryId` or `value`.
  * `memoryId` also removes every live tenant row with that digest (not others' personal rows); `reason` is required. Throws on an unknown id or both/neither. */
-export declare function reject(ctx: Context, opts: RejectOpts): RejectResult;
+export declare function reject(ctx: Context, opts: RejectOpts): Promise<RejectResult>;
+/** `hippo reject` on the host: every row it removed and the rows that kept their other texts. A personal row by id answers with the
+ *  personal refusal rather than reject's not-found, as the operator can see that row. */
+export declare function rejectOnHost(ctx: Context, opts: RejectOpts): RejectFlowResult;
 /** Deletes a tombstone by exact digest or unambiguous prefix, restoring writability (the only v1 escape hatch); throws on blank, no match or several. */
 export declare function unreject(ctx: Context, digestOrPrefix: string): {
     ok: boolean;

package/dist/api/forget.js

@@ -1,27 +1,38 @@
 // Forget a memory, and reject or unreject a value so it cannot be stored again.
 import { BadRequestError, NotFoundError } from '../core/api-errors.js';
 import { rejectValue, unrejectValue } from '../trust/reject-flow.js';
-import { andThen, notPorted, onStore } from './on-store.js';
-import { readEntry } from '../store/entry-reads.js';
-import { canTouchScope, personalScopeOf } from '../store/recall-scope.js';
-export function forget(ctx, id) {
-    return onStore(ctx, (port) => {
-        const entryWrites = port.entryWrites ?? notPorted(port, 'entryWrites');
-        const removal = { tenantId: ctx.tenantId, actor: ctx.actor.subject, ownScope: personalScopeOf(ctx.actor), id };
-        return andThen(entryWrites.forget(removal), () => ({ ok: true, id }));
-    });
+import { requireGroup } from '../store/index.js';
+import { storeFor } from '../store/sqlite/store.js';
+import { requireHostAdmin } from './types.js';
+import { getMemory } from './memories.js';
+import { canTouchScope, personalScopeOf } from '../core/recall-scope.js';
+export async function forget(ctx, id) {
+    const entryWrites = requireGroup(storeFor(ctx), 'entryWrites');
+    await entryWrites.forget({ tenantId: ctx.tenantId, actor: ctx.actor.subject, ownScope: personalScopeOf(ctx.actor), id });
+    return { ok: true, id };
 }
 /** Tombstones a value's normalized digest so a matching write is refused everywhere until `unreject`; pass exactly one of `memoryId` or `value`.
  * `memoryId` also removes every live tenant row with that digest (not others' personal rows); `reason` is required. Throws on an unknown id or both/neither. */
-export function reject(ctx, opts) {
+export async function reject(ctx, opts) {
     if (opts.memoryId !== undefined) {
         // Tenant scope: same not-found-shaped denial as forget/promote; rejectValue tenant-checks too, but pre-checking keeps the error message consistent.
-        const entry = readEntry(ctx.hippoRoot, opts.memoryId);
-        if (entry?.tenantId !== ctx.tenantId || !canTouchScope(ctx.actor, entry.scope)) {
+        const entry = await getMemory(ctx, opts.memoryId);
+        if (entry === null || !canTouchScope(ctx.actor, entry.scope)) {
             throw new NotFoundError(`memory not found: ${opts.memoryId}`);
         }
     }
-    const result = rejectValue({
+    const result = applyReject(ctx, opts);
+    return { digest: result.digest, removedIds: result.removedIds };
+}
+/** `hippo reject` on the host: every row it removed and the rows that kept their other texts. A personal row by id answers with the
+ *  personal refusal rather than reject's not-found, as the operator can see that row. */
+export function rejectOnHost(ctx, opts) {
+    requireHostAdmin(ctx, 'Rejecting with the removal report');
+    return applyReject(ctx, opts);
+}
+function applyReject(ctx, opts) {
+    // SHORTCUT: the tombstone write is hippo.db only, as the port has no rejection group; one when a served store needs reject.
+    return rejectValue({
         hippoRoot: ctx.hippoRoot,
         tenantId: ctx.tenantId,
         actor: ctx.actor.subject,
@@ -30,7 +41,6 @@ export function reject(ctx, opts) {
         value: opts.value,
         ownScope: personalScopeOf(ctx.actor) ?? undefined,
     });
-    return { digest: result.digest, removedIds: result.removedIds };
 }
 /** Deletes a tombstone by exact digest or unambiguous prefix, restoring writability (the only v1 escape hatch); throws on blank, no match or several. */
 export function unreject(ctx, digestOrPrefix) {

package/dist/api/goals.d.ts

@@ -1,5 +1,5 @@
 import { type CompleteGoalOpts, type Goal, type PushGoalOpts } from '../store/goals.js';
-import type { Context } from './types.js';
+import { type Context } from './types.js';
 /** What a new goal carries; its tenant is always the caller's. */
 export type GoalPushOpts = Omit<PushGoalOpts, 'tenantId'>;
 /** Push a goal onto `sessionId`'s stack in the caller's tenant. */

package/dist/api/goals.js

@@ -1,6 +1,6 @@
 // The per-session goal stack that recall boosts: push, list, complete, suspend and resume.
-import { ForbiddenError } from '../core/api-errors.js';
 import { completeGoal, getActiveGoals, getSessionGoals, pushGoal, resumeGoal, suspendGoal, } from '../store/goals.js';
+import { requireHostAdmin } from './types.js';
 /** Push a goal onto `sessionId`'s stack in the caller's tenant. */
 export function goalPush(ctx, opts) {
     return pushGoal(ctx.hippoRoot, { ...opts, tenantId: ctx.tenantId });
@@ -12,22 +12,18 @@ export function goalList(ctx, opts) {
 }
 /** Complete a goal by id; a no-op for an unknown or already completed goal. Host admin only. */
 export function goalComplete(ctx, goalId, opts) {
-    requireHostAdmin(ctx);
+    // Goal ids are not tenant-scoped in the store, so acting on one by id reaches past the caller's tenant.
+    requireHostAdmin(ctx, 'Completing a goal by id');
     completeGoal(ctx.hippoRoot, goalId, opts);
 }
 /** Suspend an active goal by id. Host admin only. */
 export function goalSuspend(ctx, goalId) {
-    requireHostAdmin(ctx);
+    requireHostAdmin(ctx, 'Suspending a goal by id');
     suspendGoal(ctx.hippoRoot, goalId);
 }
 /** Resume a suspended goal by id, suspending the oldest active one past the depth cap. Host admin only. */
 export function goalResume(ctx, goalId) {
-    requireHostAdmin(ctx);
+    requireHostAdmin(ctx, 'Resuming a goal by id');
     resumeGoal(ctx.hippoRoot, goalId);
 }
-// Goal ids are not tenant-scoped in the store, so acting on one by id is a cross-tenant power.
-function requireHostAdmin(ctx) {
-    if (!ctx.actor.hostAdmin)
-        throw new ForbiddenError('Only the host admin can change a goal by id');
-}
 //# sourceMappingURL=goals.js.map

package/dist/api/graph.js

@@ -1,4 +1,5 @@
-import { requireGroup, storeFor } from '../store/index.js';
+import { requireGroup } from '../store/index.js';
+import { storeFor } from '../store/sqlite/store.js';
 /** The entity/relation rows behind GET /v1/graph, as the caller's role, scopes and owner may see them. */
 export async function graphRows(ctx, query) {
     const { role, scopes, owner } = ctx.actor;

package/dist/api/index.d.ts

@@ -1,6 +1,6 @@
 export { ApiError, BadRequestError, ConflictError, ForbiddenError, NotFoundError } from '../core/api-errors.js';
-export { isPrivateScope, passesScopeFilterForRecall } from '../store/recall-scope.js';
-export { passesCliRecallScopeFilter, ScopeForbiddenError } from '../store/recall-scope.js';
+export { isPrivateScope, passesScopeFilterForRecall } from '../core/recall-scope.js';
+export { passesCliRecallScopeFilter, ScopeForbiddenError } from '../core/recall-scope.js';
 export type { TokenSummary, TokenSurface, TokenSurfaceSummary } from '../store/token-ledger.js';
 export type { FailureSummary } from '../store/failure-log.js';
 export { classifyOriginProject } from '../core/project-identity.js';
@@ -13,6 +13,8 @@ export * from './assemble.js';
 export * from './drill-down.js';
 export * from './outcome.js';
 export * from './forget.js';
+export * from './conflicts.js';
+export * from './projects.js';
 export * from './promote.js';
 export * from './auth.js';
 export * from './audit.js';

package/dist/api/index.js

@@ -3,8 +3,8 @@
 // keeps every import path that callers already use.
 export { ApiError, BadRequestError, ConflictError, ForbiddenError, NotFoundError } from '../core/api-errors.js';
 // The recall-side scope predicates live in recall-scope.ts (leaf) so shared.ts can use them without an import cycle.
-export { isPrivateScope, passesScopeFilterForRecall } from '../store/recall-scope.js';
-export { passesCliRecallScopeFilter, ScopeForbiddenError } from '../store/recall-scope.js';
+export { isPrivateScope, passesScopeFilterForRecall } from '../core/recall-scope.js';
+export { passesCliRecallScopeFilter, ScopeForbiddenError } from '../core/recall-scope.js';
 // classifyOriginProject lives in project-identity.ts (leaf) for the same reason.
 export { classifyOriginProject } from '../core/project-identity.js';
 export * from './types.js';
@@ -16,6 +16,8 @@ export * from './assemble.js';
 export * from './drill-down.js';
 export * from './outcome.js';
 export * from './forget.js';
+export * from './conflicts.js';
+export * from './projects.js';
 export * from './promote.js';
 export * from './auth.js';
 export * from './audit.js';

package/dist/api/instruction-detect.js

@@ -3,7 +3,11 @@ const INSTRUCTION_PATTERNS = [
     { name: 'override-instructions', re: /\b(?:ignore|disregard|forget)\b[^.\n]{0,40}\b(?:previous|prior|above)\b[^.\n]{0,40}\binstructions?\b/i },
     { name: 'role-reassignment', re: /\b(?:you are now|act as|pretend to be)\b[^.\n]{0,40}\b(?:an?\s+)?(?:ai|assistant|agent|system)\b/i },
     { name: 'chat-role-markup', re: /<\|im_start\|>|<\|system\|>|\[INST\]|<\/?system>|###\s*system\s*:/i },
-    { name: 'system-prompt-reference', re: /\b(?:(?:override|ignore|bypass|replace|reveal)\b[^.\n]{0,40}\b(?:system prompt|developer message)|(?:system prompt|developer message)\b[^.\n]{0,40}\b(?:override|ignore|bypass|replace|reveal))\b/i },
+    {
+        name: 'system-prompt-reference',
+        re: new RegExp(String.raw `\b(?:(?:override|ignore|bypass|replace|reveal)\b[^.\n]{0,40}\b(?:system prompt|developer message)|` +
+            String.raw `(?:system prompt|developer message)\b[^.\n]{0,40}\b(?:override|ignore|bypass|replace|reveal))\b`, 'i'),
+    },
     // "always"/"never" alone (ordinary PR prose) doesn't flag without an agent-facing target nearby too.
     {
         name: 'standing-order',

package/dist/api/learn.d.ts

@@ -1,3 +1,4 @@
+import { type InvalidationOptions, type InvalidationResult, type InvalidationTarget } from '../learn/invalidation.js';
 import type { Context } from './types.js';
 /** How a surface writes what it learns. */
 export interface LearnProfile {
@@ -27,5 +28,8 @@ export interface LearnResult {
     }>;
 }
 /** Learn from `repoPath`'s last `days` of commits into the caller's tenant. Host admin only. */
-export declare function learn(ctx: Context, opts: LearnOpts): LearnResult;
+export declare function learn(ctx: Context, opts: LearnOpts): Promise<LearnResult>;
+export type { InvalidationOptions, InvalidationResult, InvalidationTarget };
+/** `hippo invalidate`: weakens the caller's tenant's memories that reference `target.from`, or only the one `options.onlyId` names. */
+export declare function invalidateMemories(ctx: Context, target: InvalidationTarget, options: InvalidationOptions): InvalidationResult;
 //# sourceMappingURL=learn.d.ts.map

package/dist/api/learn.js

@@ -2,23 +2,20 @@
 import { ForbiddenError } from '../core/api-errors.js';
 import { fetchGitLog, extractLessons, partitionLessons, isGitRepo } from '../learn/autolearn.js';
 import { loadConfig } from '../core/config.js';
-import { withRequestStoresSync } from '../db/request-stores.js';
-import { embedMemory } from '../store/embeddings/index.js';
-import { extractInvalidationTarget, invalidateMatchingAmong } from '../learn/invalidation.js';
-import { computeSchemaFit, createMemory, Layer } from '../core/memory.js';
+import { runWithRequestStores } from '../db/request-stores.js';
+import { embedMemory } from '../search/embed-memories.js';
+import { extractInvalidationTarget, invalidateMatching, invalidateMatchingAmong, } from '../learn/invalidation.js';
+import { createMemory, Layer, schemaFitFrom, schemaFitSourceOf } from '../core/memory.js';
 import { extractPathTags } from '../search/path-context.js';
-import { canReadScope, personalScopeOf, touchableScopeSql } from '../store/recall-scope.js';
-import { RejectedValueError } from '../store/rejection.js';
+import { canReadScope, personalScopeOf } from '../core/recall-scope.js';
 import { duplicateKey, longestWord, storedTextKeys } from '../util/same-text.js';
-import { loadTextsHoldingWords } from '../store/candidates.js';
-import { loadAllEntries } from '../store/entry-reads.js';
-import { writeEntry } from '../store/entry-writes.js';
-import { updateStats } from '../store/index-and-stats.js';
+import { requireGroup } from '../store/index.js';
+import { storeFor } from '../store/sqlite/store.js';
 // SHORTCUT: two profiles keep each surface's rows as they were; fold MCP onto the CLI profile once it may invalidate.
 export const CLI_LEARN = Object.freeze({ tags: Object.freeze(['error', 'git-learned']), source: 'git-learn', full: true });
 export const MCP_LEARN = Object.freeze({ tags: Object.freeze(['git-learned']), source: 'git', full: false });
 /** Learn from `repoPath`'s last `days` of commits into the caller's tenant. Host admin only. */
-export function learn(ctx, opts) {
+export async function learn(ctx, opts) {
     // It reads the host's own git history, which belongs to the host, not to the caller's tenant.
     if (!ctx.actor.hostAdmin)
         throw new ForbiddenError('hippo_learn requires a host admin');
@@ -34,65 +31,95 @@ export function learn(ctx, opts) {
         return { status: 'no-lessons', ...none };
     // The gate filters the loop input, so a dropped lesson neither stores nor invalidates; docs/decisions git-learn-gate-placement says why.
     const { kept, dropped } = partitionLessons(parsed);
-    return { status: 'scanned', lowInfo: dropped.length, ...writeLessons(ctx, kept, opts, config) };
+    return { status: 'scanned', lowInfo: dropped.length, ...await writeLessons(ctx, kept, opts, config) };
 }
-function writeLessons(ctx, lessons, opts, config) {
-    const { hippoRoot, tenantId } = ctx;
+/** Writes `queued` in one transaction; a refused lesson is dropped from `live` and `keys` and must not abort the rest of the git-log scan. */
+async function landLessons(batch, queued) {
+    if (queued.length === 0)
+        return;
+    const { ctx, writes, live, keys, counts } = batch;
+    const written = new Set(await writes.writeSkippingRejected(queued.map((q) => q.entry), ctx.actor.subject));
+    const landed = [];
+    for (const { entry, key } of queued) {
+        if (written.has(entry.id)) {
+            landed.push(entry);
+            continue;
+        }
+        counts.rejected++;
+        keys.delete(key);
+        const at = live.indexOf(entry);
+        if (at !== -1)
+            live.splice(at, 1);
+    }
+    counts.added += landed.length;
+    if (!batch.full)
+        return;
+    if (landed.length > 0)
+        await writes.bumpRemembered(landed.length);
+    for (const entry of landed)
+        void embedMemory(ctx.hippoRoot, entry, undefined, ctx.store);
+}
+/** The duplicate keys a batch skips: every readable row's with `existing`, else only the rows holding a lesson's longest word. */
+async function knownKeys(ctx, writes, lessons, existing) {
+    return storedTextKeys(existing ?? await writes.textsHoldingWords(ctx.tenantId, lessons.map(longestWord), personalScopeOf(ctx.actor)));
+}
+async function writeLessons(ctx, lessons, opts, config) {
+    const { tenantId } = ctx;
     const { profile } = opts;
+    const store = storeFor(ctx);
+    const writes = requireGroup(store, 'lessonWrites');
     // `hippo init` calls this outside any request, so the batch brings its own scope: every read and write below shares one handle.
-    return withRequestStoresSync(() => {
+    return runWithRequestStores(async () => {
         // One read serves the batch: invalidation matches against `live`, which follows every write below, as a reload per lesson did.
-        const live = profile.full ? loadAllEntries(hippoRoot, tenantId) : [];
-        // Schema fit needs every row; without it, only rows holding a lesson's longest word can be its copy. Learn is host-admin only, so both read what an admin can.
+        const live = profile.full ? await writes.tenantEntries(tenantId) : [];
+        // Schema fit needs every row; without it, only rows holding a lesson's longest word can be its copy. Learn is host-admin only, so
+        // both read what an admin can.
         const existing = profile.full ? live.filter((e) => e.scope == null || canReadScope(ctx.actor, e.scope)) : undefined;
-        const readable = touchableScopeSql('', personalScopeOf(ctx.actor));
-        const keys = storedTextKeys(existing ?? loadTextsHoldingWords(hippoRoot, tenantId, lessons.map(longestWord), undefined, readable));
+        // Each lesson is scored against `existing` as it was before the batch, so its tag counts and texts are read once.
+        const fitSource = existing && schemaFitSourceOf(existing);
+        const batch = {
+            ctx, writes, live, keys: await knownKeys(ctx, writes, lessons, existing), full: profile.full,
+            counts: { added: 0, skipped: 0, rejected: 0, invalidations: [] },
+        };
         const pathTags = profile.full ? extractPathTags(opts.repoPath) : [];
-        const counts = { added: 0, skipped: 0, rejected: 0, invalidations: [] };
+        // Lessons queue and land in one transaction; an invalidation reads the store, so it flushes the queue first.
+        const queue = [];
         for (const lesson of lessons) {
-            if (keys.has(duplicateKey(lesson))) {
-                counts.skipped++;
+            const key = duplicateKey(lesson);
+            if (batch.keys.has(key)) {
+                batch.counts.skipped++;
                 continue;
             }
             const target = profile.full ? extractInvalidationTarget(lesson) : null;
             if (target) {
-                const { invalidated } = invalidateMatchingAmong(hippoRoot, live, target, tenantId);
+                await landLessons(batch, queue.splice(0));
+                const { invalidated } = await invalidateMatchingAmong(store, live, target, tenantId);
                 if (invalidated > 0)
-                    counts.invalidations.push({ from: target.from, count: invalidated });
+                    batch.counts.invalidations.push({ from: target.from, count: invalidated });
             }
             const entry = createMemory(lesson, {
                 layer: Layer.Episodic,
                 tags: [...profile.tags],
                 source: profile.source,
                 confidence: 'observed',
-                schema_fit: existing && computeSchemaFit(lesson, [...profile.tags], existing),
+                schema_fit: fitSource && schemaFitFrom(lesson, [...profile.tags], fitSource),
                 tenantId,
                 baseHalfLifeDays: config.defaultHalfLifeDays,
             });
             for (const tag of pathTags)
                 if (!entry.tags.includes(tag))
                     entry.tags.push(tag);
-            // A refused lesson must not abort the rest of the git-log scan.
-            try {
-                writeEntry(hippoRoot, entry, { actor: ctx.actor.subject });
-            }
-            catch (err) {
-                if (err instanceof RejectedValueError) {
-                    counts.rejected++;
-                    continue;
-                }
-                throw err;
-            }
-            if (profile.full) {
-                updateStats(hippoRoot, { remembered: 1 });
-                live.push(entry);
-            }
-            keys.add(duplicateKey(lesson));
+            queue.push({ entry, key });
             if (profile.full)
-                void embedMemory(hippoRoot, entry);
-            counts.added++;
+                live.push(entry);
+            batch.keys.add(key);
         }
-        return counts;
+        await landLessons(batch, queue.splice(0));
+        return batch.counts;
     });
 }
+/** `hippo invalidate`: weakens the caller's tenant's memories that reference `target.from`, or only the one `options.onlyId` names. */
+export function invalidateMemories(ctx, target, options) {
+    return invalidateMatching(ctx.hippoRoot, target, ctx.tenantId, options);
+}
 //# sourceMappingURL=learn.js.map

package/dist/api/ledger-db.d.ts

@@ -1,4 +1,3 @@
-import { type openHippoDb } from '../db/index.js';
 import { type LedgerTurn } from '../store/ledger-turn.js';
 import type { LastSent, TokenSurface, TokenUse } from '../store/token-ledger.js';
 export interface LedgerRootOpts {
@@ -7,15 +6,12 @@ export interface LedgerRootOpts {
 }
 /** `hippoRoot` when it holds a store, else the global store (the prompt hook fires where no local one exists), else null. */
 export declare function ledgerRoot(hippoRoot: string, opts?: LedgerRootOpts): string | null;
-/** Says why a ledger row did not land, at the level its class earns: busy warns once through
- * noteStoreBusy, absent is debug with no stack, unexpected warns once with the error class and stack. */
-export declare function noteLedgerRowSkipped<E>(error: E): void;
+/** Runs `call` on ledgerRoot's store root. Best-effort: undefined on any failure, because a ledger failure must not break context or recall. */
+export declare function onLedgerRoot<T>(hippoRoot: string, opts: LedgerRootOpts | undefined, call: (root: string) => T): T | undefined;
 /** Books one row in ledgerRoot's store, best-effort. */
 export declare function bookTokenUse(hippoRoot: string, use: TokenUse, opts?: LedgerRootOpts): void;
 /** Books a turn's rows and then its delivery event on one connection of ledgerRoot's store, best-effort. */
 export declare function bookLedgerTurn(hippoRoot: string, turn: LedgerTurn, opts?: LedgerRootOpts): void;
 /** What the session last sent on `surface` in ledgerRoot's store; undefined with no ledger or a failed read. */
 export declare function ledgerLastSent(hippoRoot: string, tenantId: string, sessionId: string | null | undefined, surface: TokenSurface, opts?: LedgerRootOpts): LastSent | null | undefined;
-/** Runs `fn` on a handle of ledgerRoot's store, best-effort as the calls above. */
-export declare function withLedgerDb<T>(hippoRoot: string, fn: (db: ReturnType<typeof openHippoDb>) => T, opts?: LedgerRootOpts): T | undefined;
 //# sourceMappingURL=ledger-db.d.ts.map

package/dist/api/ledger-db.js

@@ -1,9 +1,8 @@
 // The store the token ledger writes to for a caller's root; context, recall and the session hooks share it.
-import { isSqliteBusy, noteStoreBusy } from '../db/index.js';
-import { errorFields, errorMessage, log } from '../util/log.js';
+import { errorMessage, log } from '../util/log.js';
 import { getGlobalRoot } from '../sharing/global-store.js';
-import { lastSentOnSurface, recordLedgerTurn } from '../store/ledger-turn.js';
-import { isInitialized, onHandle } from '../store/open.js';
+import { lastSentOnSurface, noteLedgerRowSkipped, recordLedgerTurn } from '../store/ledger-turn.js';
+import { isInitialized } from '../core/project-identity.js';
 import { sqliteSyncStore } from '../store/sqlite/store.js';
 /** `hippoRoot` when it holds a store, else the global store (the prompt hook fires where no local one exists), else null. */
 export function ledgerRoot(hippoRoot, opts) {
@@ -14,35 +13,8 @@ export function ledgerRoot(hippoRoot, opts) {
     const globalRoot = getGlobalRoot();
     return isInitialized(globalRoot) ? globalRoot : null;
 }
-// SQLite's result codes for a hippo.db it cannot read: a corrupt image, and a file that is no database.
-const SQLITE_CORRUPT = 11;
-const SQLITE_NOTADB = 26;
-/** The one rule for a skipped ledger row. `absent` is a store with no token_ledger table or a hippo.db
- * SQLite cannot read; the command that owns the store reports that, and a hook must stay quiet about it. */
-function ledgerSkipClass(error) {
-    if (isSqliteBusy(error))
-        return 'busy';
-    const code = error instanceof Error && 'errcode' in error ? error.errcode : undefined;
-    if (code === SQLITE_CORRUPT || code === SQLITE_NOTADB)
-        return 'absent';
-    return errorMessage(error).includes('no such table: token_ledger') ? 'absent' : 'unexpected';
-}
-/** Says why a ledger row did not land, at the level its class earns: busy warns once through
- * noteStoreBusy, absent is debug with no stack, unexpected warns once with the error class and stack. */
-export function noteLedgerRowSkipped(error) {
-    const skip = ledgerSkipClass(error);
-    if (skip === 'busy') {
-        noteStoreBusy('token ledger row skipped');
-        return;
-    }
-    const message = `token ledger row skipped: ${errorMessage(error)}`;
-    if (skip === 'absent')
-        log.debug(message);
-    else
-        log.warnThenDebug('token-ledger-row', message, errorFields(error));
-}
 /** Runs `call` on ledgerRoot's store root. Best-effort: undefined on any failure, because a ledger failure must not break context or recall. */
-function onLedgerRoot(hippoRoot, opts, call) {
+export function onLedgerRoot(hippoRoot, opts, call) {
     let root = null;
     try {
         root = ledgerRoot(hippoRoot, opts);
@@ -74,8 +46,4 @@ export function bookLedgerTurn(hippoRoot, turn, opts) {
 export function ledgerLastSent(hippoRoot, tenantId, sessionId, surface, opts) {
     return onLedgerRoot(hippoRoot, opts, (root) => lastSentOnSurface(root, tenantId, sessionId, surface));
 }
-/** Runs `fn` on a handle of ledgerRoot's store, best-effort as the calls above. */
-export function withLedgerDb(hippoRoot, fn, opts) {
-    return onLedgerRoot(hippoRoot, opts, (root) => onHandle(root, fn));
-}
 //# sourceMappingURL=ledger-db.js.map

package/dist/api/memories.d.ts

@@ -1,5 +1,25 @@
 import type { MemoryEntry } from '../core/memory.js';
-import type { Context } from './types.js';
+import { type StrengthTallies } from '../store/candidates.js';
+import { type Context } from './types.js';
 /** The row `id` in the caller's tenant, or null when it is missing or another tenant's. */
 export declare function getMemory(ctx: Context, id: string): Promise<MemoryEntry | null>;
+/** getMemory, but NotFound when the row is another person's personal one, so the reply does not reveal that the id exists. */
+export declare function getTouchableMemory(ctx: Context, id: string): Promise<MemoryEntry | null>;
+export interface MemoryStatus extends StrengthTallies {
+    openConflicts: number;
+}
+/** Tenant-wide counts behind the status verbs: strength tallies at `now` (at risk is under `atRiskBelow`) and open conflicts. */
+export declare function getMemoryStatus(ctx: Context, now: Date, atRiskBelow: number): MemoryStatus;
+/** Which rows a read covers: the caller's tenant, or with `everyTenant` the whole store. */
+export interface TenantReach {
+    everyTenant?: boolean;
+}
+/** Every memory row in reach, oldest first, read `pageSize` rows per query so no single read grows with the store. */
+export declare function listMemories(ctx: Context, reach?: TenantReach, opts?: {
+    pageSize?: number;
+}): MemoryEntry[];
+/** How many memory rows the whole store holds, counted in SQL. */
+export declare function countAllMemories(ctx: Context): number;
+/** The rows in reach among `ids`; a missing id or one out of reach is absent. */
+export declare function listMemoriesByIds(ctx: Context, ids: readonly string[], reach?: TenantReach): MemoryEntry[];
 //# sourceMappingURL=memories.d.ts.map