hippo-memory 1.71.0 → 2.0.0

package/dist/api/memories.js

@@ -1,7 +1,57 @@
-import { storeFor } from '../store/index.js';
+import { loadStrengthTallies } from '../store/candidates.js';
+import { countOpenConflicts } from '../store/conflicts.js';
+import { NotFoundError } from '../core/api-errors.js';
+import { canTouchScope } from '../core/recall-scope.js';
+import { storeFor } from '../store/sqlite/store.js';
+import { countAllEntries, loadEntriesByIds, loadEntriesPage } from '../store/entry-reads.js';
+import { requireHostAdmin } from './types.js';
 /** The row `id` in the caller's tenant, or null when it is missing or another tenant's. */
 export async function getMemory(ctx, id) {
     const [entry] = await storeFor(ctx).entriesByIds([id], ctx.tenantId);
     return entry ?? null;
 }
+/** getMemory, but NotFound when the row is another person's personal one, so the reply does not reveal that the id exists. */
+export async function getTouchableMemory(ctx, id) {
+    const entry = await getMemory(ctx, id);
+    if (!canTouchScope(ctx.actor, entry?.scope ?? null))
+        throw new NotFoundError(`Memory not found: ${id}`);
+    return entry;
+}
+/** Tenant-wide counts behind the status verbs: strength tallies at `now` (at risk is under `atRiskBelow`) and open conflicts. */
+export function getMemoryStatus(ctx, now, atRiskBelow) {
+    return {
+        ...loadStrengthTallies(ctx.hippoRoot, ctx.tenantId, now, atRiskBelow),
+        openConflicts: countOpenConflicts(ctx.hippoRoot, ctx.tenantId),
+    };
+}
+function tenantFilter(ctx, reach) {
+    if (!reach.everyTenant)
+        return ctx.tenantId;
+    requireHostAdmin(ctx, 'Reading every tenant');
+    return undefined;
+}
+/** Rows a listing reads per query by default; the verbs still receive every row. */
+const LIST_PAGE_SIZE = 1000;
+/** Every memory row in reach, oldest first, read `pageSize` rows per query so no single read grows with the store. */
+export function listMemories(ctx, reach = {}, opts = {}) {
+    const tenant = tenantFilter(ctx, reach);
+    const limit = Math.max(1, Math.trunc(opts.pageSize ?? LIST_PAGE_SIZE));
+    const all = [];
+    let after;
+    do {
+        const page = loadEntriesPage(ctx.hippoRoot, tenant, { limit, after });
+        all.push(...page.entries);
+        after = page.next ?? undefined;
+    } while (after);
+    return all;
+}
+/** How many memory rows the whole store holds, counted in SQL. */
+export function countAllMemories(ctx) {
+    requireHostAdmin(ctx, 'Reading every tenant');
+    return countAllEntries(ctx.hippoRoot);
+}
+/** The rows in reach among `ids`; a missing id or one out of reach is absent. */
+export function listMemoriesByIds(ctx, ids, reach = {}) {
+    return loadEntriesByIds(ctx.hippoRoot, ids, tenantFilter(ctx, reach));
+}
 //# sourceMappingURL=memories.js.map

package/dist/api/objects.d.ts

@@ -1,5 +1,5 @@
 import type { SavableDescriptor } from '../objects/descriptor.js';
-import type { ObjectByKind, SavableKind } from '../store/object-types.js';
+import type { ObjectByKind, SavableKind } from '../core/object-types.js';
 import type { Objects } from '../store/port.js';
 import type { Context } from './types.js';
 /** The request store's object group; the dispatcher has already answered 501 for a store without it. */

package/dist/api/objects.js

@@ -1,5 +1,6 @@
 import { saveObject } from '../objects/lifecycle.js';
-import { requireGroup, storeFor } from '../store/index.js';
+import { requireGroup } from '../store/index.js';
+import { storeFor } from '../store/sqlite/store.js';
 /** The request store's object group; the dispatcher has already answered 501 for a store without it. */
 export function objectsOf(ctx) {
     return requireGroup(storeFor(ctx), 'objects');

package/dist/api/outcome.d.ts

@@ -1,4 +1,4 @@
-import type { Context, StoreReply } from './types.js';
+import type { Context } from './types.js';
 /** An id outside ctx.tenantId, or in someone else's personal scope, is skipped, so a stale id never fails the call.
  *  `appliedIds` holds only the ids applied: a caller that answers across tenants returns it, never the ids it was sent. */
 export interface OutcomeResult {
@@ -6,14 +6,14 @@ export interface OutcomeResult {
     appliedIds: string[];
 }
 /** `opts.traceId` links the outcome to the recall trace it judges. Only outcomeForLastRecall sends one: explicit ids may follow no recall at all. */
-export declare function outcome<C extends Context>(ctx: C, ids: ReadonlyArray<string>, good: boolean, opts?: {
+export declare function outcome(ctx: Context, ids: ReadonlyArray<string>, good: boolean, opts?: {
     traceId?: number;
-}): StoreReply<C, OutcomeResult>;
-/** The last recall's ids and its trace sit in hippo.db's meta table, which only the CLI and context write, so a store of another kind is refused.
+}): Promise<OutcomeResult>;
+/** The last recall's ids and its trace sit with the store's lastRecall group, which only the CLI and context write; a store without it is refused.
  *  `ids` holds only the ids applied in ctx.tenantId: the index is not tenant-scoped, so the ids read from it are never returned. */
 export interface OutcomeForLastRecallResult {
     applied: number;
     ids: string[];
 }
-export declare function outcomeForLastRecall<C extends Context>(ctx: C, good: boolean): StoreReply<C, OutcomeForLastRecallResult>;
+export declare function outcomeForLastRecall(ctx: Context, good: boolean): Promise<OutcomeForLastRecallResult>;
 //# sourceMappingURL=outcome.d.ts.map

package/dist/api/outcome.js

@@ -1,21 +1,22 @@
 // Outcome feedback on recalled memories.
-import { personalScopeOf } from '../store/recall-scope.js';
-import { andThen, notPorted, onStore } from './on-store.js';
+import { personalScopeOf } from '../core/recall-scope.js';
+import { requireGroup } from '../store/index.js';
+import { storeFor } from '../store/sqlite/store.js';
 /** `opts.traceId` links the outcome to the recall trace it judges. Only outcomeForLastRecall sends one: explicit ids may follow no recall at all. */
-export function outcome(ctx, ids, good, opts) {
-    return onStore(ctx, (port, local) => {
-        const entryWrites = port.entryWrites ?? notPorted(port, 'entryWrites');
-        const write = { tenantId: ctx.tenantId, actor: ctx.actor.subject, ownScope: personalScopeOf(ctx.actor), ids, good };
-        const traceId = opts?.traceId;
-        // The trace link is written on hippo.db's own handle after the commit, so a served store refuses a traceId.
-        const applied = traceId === undefined ? entryWrites.applyOutcome(write) : local.applyOutcome(write, traceId);
-        return andThen(applied, (appliedIds) => ({ applied: appliedIds.length, appliedIds }));
-    });
+export async function outcome(ctx, ids, good, opts) {
+    const store = storeFor(ctx);
+    const entryWrites = requireGroup(store, 'entryWrites');
+    const write = { tenantId: ctx.tenantId, actor: ctx.actor.subject, ownScope: personalScopeOf(ctx.actor), ids, good };
+    const traceId = opts?.traceId;
+    // Recall traces live beside the last recall, so only a store with the lastRecall group can link one.
+    const appliedIds = traceId === undefined
+        ? await entryWrites.applyOutcome(write)
+        : await requireGroup(store, 'lastRecall').applyTracedOutcome(write, traceId);
+    return { applied: appliedIds.length, appliedIds };
 }
-export function outcomeForLastRecall(ctx, good) {
-    return onStore(ctx, (_port, local) => {
-        const ids = local.applyOutcomeToLastRecall({ tenantId: ctx.tenantId, actor: ctx.actor.subject, ownScope: personalScopeOf(ctx.actor) }, good);
-        return { applied: ids.length, ids };
-    });
+export async function outcomeForLastRecall(ctx, good) {
+    const lastRecall = requireGroup(storeFor(ctx), 'lastRecall');
+    const ids = await lastRecall.applyOutcomeToLast({ tenantId: ctx.tenantId, actor: ctx.actor.subject, ownScope: personalScopeOf(ctx.actor) }, good);
+    return { applied: ids.length, ids };
 }
 //# sourceMappingURL=outcome.js.map

package/dist/api/pilot-arm.d.ts

@@ -1,19 +1,9 @@
-import { type DatabaseSyncLike } from '../db/index.js';
 import { type LedgerRootOpts } from './ledger-db.js';
-export type PilotArm = 'hippo' | 'holdout';
+import { type PilotArm } from '../store/pilot-arm.js';
 export interface SessionArmOpts extends LedgerRootOpts {
     /** Only the caller tenant's arm row counts, so a caller holding another tenant's session id cannot claim that session's arm. */
     readonly ownTenantOnly?: boolean;
 }
-/** Deterministic split: the same session and rate always land in the same arm. */
-export declare function hashArm(sessionId: string, rateBp: number): PilotArm;
-/** The session's first stored arm, or null; never writes. Without `tenantId` any tenant's row counts, since on one machine a session has one arm. */
-export declare function readPilotArm(db: DatabaseSyncLike, sessionId: string, tenantId?: string): PilotArm | null;
-/** The stored arm, else the hash arm written once; on any error the hash arm comes back unrecorded. */
-export declare function ensurePilotArm(db: DatabaseSyncLike, tenantId: string, sessionId: string, rateBp: number, opts?: {
-    ownTenantOnly?: boolean;
-    now?: string;
-}): PilotArm;
 /** The session's arm, or null at rate 0, with no session id, or with no store.
  *  `write` books the arm row; a read-only caller (env-only id, sub-agent) follows the stored arm, else the hash. */
 export declare function sessionPilotArm(hippoRoot: string, tenantId: string, sessionId: string | undefined, write: boolean, opts?: SessionArmOpts): PilotArm | null;

package/dist/api/pilot-arm.js

@@ -1,46 +1,8 @@
-// Pilot arm: one token_ledger row per session names its arm, `hippo` or `holdout`, so a pilot can compare them.
-// `items` holds the holdout rate in basis points; readers outside this repo depend on these rows, so their shape is fixed.
-import { createHash } from 'node:crypto';
+// Which pilot arm a session is in: the rate comes from the ledger store's config, the arm row from src/store/pilot-arm.ts.
 import { loadConfig } from '../core/config.js';
-import { HOOK_DB_WAIT_MS, scopedBusyWait, withWriteScope } from '../db/index.js';
-import { ledgerRoot, withLedgerDb } from './ledger-db.js';
-import { errorMessage, log } from '../util/log.js';
-import { firstPilotArmHash } from '../store/token-ledger-rows.js';
-import { recordTokenUse } from '../store/token-ledger.js';
-/** Deterministic split: the same session and rate always land in the same arm. */
-export function hashArm(sessionId, rateBp) {
-    const bucket = parseInt(createHash('sha256').update(sessionId).digest('hex').slice(0, 8), 16) % 10000;
-    return bucket < rateBp ? 'holdout' : 'hippo';
-}
-/** The session's first stored arm, or null; never writes. Without `tenantId` any tenant's row counts, since on one machine a session has one arm. */
-export function readPilotArm(db, sessionId, tenantId) {
-    const row = firstPilotArmHash(db, sessionId, tenantId);
-    return row?.block_hash === 'holdout' || row?.block_hash === 'hippo' ? row.block_hash : null;
-}
-/** The stored arm, else the hash arm written once; on any error the hash arm comes back unrecorded. */
-// The wait is the caller's lock-wait scope (a hook's 1 s, a server request's 250 ms); it holds on a handle opened in that scope.
-export function ensurePilotArm(db, tenantId, sessionId, rateBp, opts = {}) {
-    const hashed = hashArm(sessionId, rateBp);
-    const readTenant = opts.ownTenantOnly ? tenantId : undefined;
-    try {
-        // A stored row is the common case after the first prompt, so it must not take the write lock.
-        const existing = readPilotArm(db, sessionId, readTenant);
-        if (existing !== null)
-            return existing;
-        return withWriteScope(db, 'pilot_arm', () => {
-            const stored = readPilotArm(db, sessionId, readTenant);
-            if (stored === null) {
-                recordTokenUse(db, { tenantId, sessionId, surface: 'pilot', event: 'arm', items: rateBp, tokens: 0, hash: hashed, now: opts.now });
-            }
-            return stored ?? hashed;
-        }, { busyWaitMs: scopedBusyWait() ?? HOOK_DB_WAIT_MS });
-    }
-    catch (err) {
-        // A prompt hook must not fail on pilot bookkeeping; concurrent callers still agree on the hash arm.
-        log.debug(`pilot arm not stored, using the hash arm: ${errorMessage(err)}`);
-        return hashed;
-    }
-}
+import { ledgerRoot, onLedgerRoot } from './ledger-db.js';
+import { pilotArmOnRoot } from '../store/ledger-turn.js';
+import { hashArm } from '../store/pilot-arm.js';
 /** The session's arm, or null at rate 0, with no session id, or with no store.
  *  `write` books the arm row; a read-only caller (env-only id, sub-agent) follows the stored arm, else the hash. */
 export function sessionPilotArm(hippoRoot, tenantId, sessionId, write, opts = {}) {
@@ -53,9 +15,7 @@ export function sessionPilotArm(hippoRoot, tenantId, sessionId, write, opts = {}
     if (rate <= 0)
         return null;
     const { ownTenantOnly } = opts;
-    const arm = withLedgerDb(hippoRoot, (db) => write
-        ? ensurePilotArm(db, tenantId, sessionId, rate, { ownTenantOnly })
-        : readPilotArm(db, sessionId, ownTenantOnly ? tenantId : undefined) ?? hashArm(sessionId, rate), opts);
+    const arm = onLedgerRoot(hippoRoot, opts, (at) => pilotArmOnRoot(at, tenantId, sessionId, rate, { write, ownTenantOnly }));
     return arm ?? hashArm(sessionId, rate);
 }
 //# sourceMappingURL=pilot-arm.js.map

package/dist/api/predictions.d.ts

@@ -1,7 +1,9 @@
-import type { Prediction, PredictionBaserate } from '../store/predictions.js';
+import { type Prediction, type PredictionBaserate, type SavePredictionOpts } from '../store/predictions.js';
 import type { PredictionClose, PredictionSave, Predictions } from '../store/port.js';
 import type { Context } from './types.js';
 export declare function savePrediction(ctx: Context, input: PredictionSave): Promise<Prediction>;
+/** A claim saved with its recall mirror, built under the store root's half-life as the HTTP create route builds it. */
+export declare function recordPrediction(ctx: Context, claim: SavePredictionOpts): Promise<Prediction>;
 export declare function listPredictions(ctx: Context, query: Parameters<Predictions['listPredictions']>[1]): Promise<Prediction[]>;
 export declare function predictionBaserate(ctx: Context, classTag: string): Promise<PredictionBaserate>;
 export declare function predictionById(ctx: Context, id: number): Promise<Prediction | null>;

package/dist/api/predictions.js

@@ -1,8 +1,15 @@
-import { requireGroup, storeFor } from '../store/index.js';
+import { predictionMirror } from '../store/predictions.js';
+import { loadConfig } from '../core/config.js';
+import { requireGroup } from '../store/index.js';
+import { storeFor } from '../store/sqlite/store.js';
 const predictionsOf = (ctx) => requireGroup(storeFor(ctx), 'predictions');
 export async function savePrediction(ctx, input) {
     return predictionsOf(ctx).savePrediction(ctx.tenantId, input, ctx.actor.subject);
 }
+/** A claim saved with its recall mirror, built under the store root's half-life as the HTTP create route builds it. */
+export async function recordPrediction(ctx, claim) {
+    return savePrediction(ctx, { ...claim, mirror: predictionMirror(ctx.tenantId, claim, loadConfig(ctx.hippoRoot).defaultHalfLifeDays) });
+}
 export async function listPredictions(ctx, query) {
     return predictionsOf(ctx).listPredictions(ctx.tenantId, query);
 }

package/dist/api/projects.d.ts

@@ -0,0 +1,21 @@
+import { type MergeResult, type ProjectSummary, type RepairResult } from '../sharing/project-merge.js';
+import type { Context } from './types.js';
+export type { MergeResult, ProjectCollision, ProjectSummary, RepairResult } from '../sharing/project-merge.js';
+export type { ProjectFold } from '../agent-memories/project-folds.js';
+export interface MergeProjectNamesOpts {
+    from: string;
+    into: string;
+    /** Plans in a transaction that rolls back: nothing is written, mirrors and backup included. */
+    dryRun: boolean;
+}
+/** Live rows per project name in the caller's tenant, newest write first. */
+export declare function listProjectNames(ctx: Context): ProjectSummary[];
+/** Folds project `from` into `into`, backed up and audited as `ctx.actor`; throws on user-global, unknown or equal names. */
+export declare function mergeProjectNames(ctx: Context, opts: MergeProjectNamesOpts): MergeResult;
+/** Sets aside stray imports, folds renamed projects and re-tags sleep's user-global merges; a dry run only plans. */
+export declare function repairProjectNames(ctx: Context, opts: {
+    dryRun: boolean;
+}): RepairResult;
+/** The repair sleep runs once per store; null when it already ran. */
+export declare function repairProjectNamesOnce(ctx: Context): RepairResult | null;
+//# sourceMappingURL=projects.d.ts.map

package/dist/api/projects.js

@@ -0,0 +1,24 @@
+// Project names for every front end: list them, fold one into another, and repair old tags; the store opens hippo.db and owns each transaction.
+// SHORTCUT: hippo.db only, since the store port has no project calls; a projects group when a served store needs them.
+import { listProjects, mergeProjects, repairOnceOnSleep, repairProjects, } from '../sharing/project-merge.js';
+import { onProjectTags } from '../store/project-tags.js';
+function onProjects(ctx, fn) {
+    return onProjectTags({ hippoRoot: ctx.hippoRoot, tenantId: ctx.tenantId, actor: ctx.actor.subject }, fn);
+}
+/** Live rows per project name in the caller's tenant, newest write first. */
+export function listProjectNames(ctx) {
+    return onProjects(ctx, listProjects);
+}
+/** Folds project `from` into `into`, backed up and audited as `ctx.actor`; throws on user-global, unknown or equal names. */
+export function mergeProjectNames(ctx, opts) {
+    return onProjects(ctx, (store) => mergeProjects(store, opts));
+}
+/** Sets aside stray imports, folds renamed projects and re-tags sleep's user-global merges; a dry run only plans. */
+export function repairProjectNames(ctx, opts) {
+    return onProjects(ctx, (store) => repairProjects(store, opts));
+}
+/** The repair sleep runs once per store; null when it already ran. */
+export function repairProjectNamesOnce(ctx) {
+    return onProjects(ctx, repairOnceOnSleep);
+}
+//# sourceMappingURL=projects.js.map

package/dist/api/promote.d.ts

@@ -1,6 +1,6 @@
 import type { ConnectorEvent } from '../store/port.js';
 import { type Layer } from '../core/memory.js';
-import type { Context, StoreReply } from './types.js';
+import type { Context } from './types.js';
 /** Copies a local memory into the global store; the inner writeEntry emits 'remember' there, and we add a 'promote' audit event so intent stays distinct.
  * promoteToGlobal reads via `readEntry` with no tenant filter and keeps the entry's existing tenantId on the global side. */
 export interface PromoteResult {
@@ -21,7 +21,7 @@ export interface SupersedeOverrides {
     tags?: string[];
     pinned?: boolean;
 }
-export declare function supersede<C extends Context>(ctx: C, oldId: string, newContent: string, overrides?: SupersedeOverrides): StoreReply<C, SupersedeResult>;
+export declare function supersede(ctx: Context, oldId: string, newContent: string, overrides?: SupersedeOverrides): Promise<SupersedeResult>;
 /** Archive a kind='raw' memory: its metadata moves to raw_archive and the row is
  * deleted. The store writes the one archive_raw audit row, under the caller's subject. */
 export interface ArchiveRawOpts {
@@ -32,5 +32,5 @@ export interface ArchiveRawResult {
     ok: true;
     archivedAt: string;
 }
-export declare function archiveRaw<C extends Context>(ctx: C, id: string, reason: string, opts?: ArchiveRawOpts): StoreReply<C, ArchiveRawResult>;
+export declare function archiveRaw(ctx: Context, id: string, reason: string, opts?: ArchiveRawOpts): Promise<ArchiveRawResult>;
 //# sourceMappingURL=promote.d.ts.map

package/dist/api/promote.js

@@ -4,9 +4,10 @@ import { stampOriginProject } from '../store/entry-row.js';
 import { createSuccessor } from '../core/memory.js';
 import { promoteToGlobal } from '../sharing/global-store.js';
 import { loadConfig } from '../core/config.js';
-import { andThen, notPorted, onStore } from './on-store.js';
+import { requireGroup } from '../store/index.js';
+import { storeFor } from '../store/sqlite/store.js';
 import { memoryReach } from '../store/tenant-lookup.js';
-import { canTouchScope, personalScopeOf } from '../store/recall-scope.js';
+import { canTouchScope, personalScopeOf } from '../core/recall-scope.js';
 export function promote(ctx, id) {
     // promoteToGlobal reads without a tenant filter, so pre-check the row's tenant_id and deny cross-tenant access with archiveRaw's not-found wording
     // (no leak about whether the id exists in another tenant).
@@ -22,23 +23,21 @@ export function promote(ctx, id) {
     });
     return { ok: true, sourceId: id, globalId: globalEntry.id };
 }
-export function supersede(ctx, oldId, newContent, overrides = {}) {
-    return onStore(ctx, (port) => {
-        const entryWrites = port.entryWrites ?? notPorted(port, 'entryWrites');
-        return andThen(port.entriesByIds([oldId], ctx.tenantId), ([old]) => {
-            const newEntry = createSuccessor(assertSupersedable(ctx, oldId, old ?? null), newContent, {
-                tenantId: ctx.tenantId,
-                baseHalfLifeDays: loadConfig(ctx.hippoRoot).defaultHalfLifeDays,
-                layer: overrides.layer,
-                tags: overrides.tags,
-                pinned: overrides.pinned,
-            });
-            // A store writes origin_project as given, so the served folder's fallback is stamped here.
-            const successor = stampOriginProject(ctx.hippoRoot, newEntry);
-            const write = { tenantId: ctx.tenantId, actor: ctx.actor.subject, ownScope: personalScopeOf(ctx.actor), oldId, successor };
-            return andThen(entryWrites.supersede(write), () => ({ ok: true, oldId, newId: successor.id }));
-        });
+export async function supersede(ctx, oldId, newContent, overrides = {}) {
+    const store = storeFor(ctx);
+    const entryWrites = requireGroup(store, 'entryWrites');
+    const [old] = await store.entriesByIds([oldId], ctx.tenantId);
+    const newEntry = createSuccessor(assertSupersedable(ctx, oldId, old ?? null), newContent, {
+        tenantId: ctx.tenantId,
+        baseHalfLifeDays: loadConfig(ctx.hippoRoot).defaultHalfLifeDays,
+        layer: overrides.layer,
+        tags: overrides.tags,
+        pinned: overrides.pinned,
     });
+    // A store writes origin_project as given, so the served folder's fallback is stamped here.
+    const successor = stampOriginProject(ctx.hippoRoot, newEntry);
+    await entryWrites.supersede({ tenantId: ctx.tenantId, actor: ctx.actor.subject, ownScope: personalScopeOf(ctx.actor), oldId, successor });
+    return { ok: true, oldId, newId: successor.id };
 }
 /** The tenant-scoped row to supersede; another tenant's id, or someone else's personal row, reads as not found. */
 function assertSupersedable(ctx, oldId, old) {
@@ -51,15 +50,14 @@ function assertSupersedable(ctx, oldId, old) {
     }
     return old;
 }
-export function archiveRaw(ctx, id, reason, opts = {}) {
-    return onStore(ctx, (port) => {
-        const entryWrites = port.entryWrites ?? notPorted(port, 'entryWrites');
-        const archive = { tenantId: ctx.tenantId, actor: ctx.actor.subject, ownScope: personalScopeOf(ctx.actor), id, reason };
-        const { event } = opts;
-        const archived = event
-            ? (port.connectorWrites ?? notPorted(port, 'connectorWrites')).archiveConnectorEntry({ ...archive, event })
-            : entryWrites.archiveRaw(archive);
-        return andThen(archived, (archivedAt) => ({ ok: true, archivedAt }));
-    });
+export async function archiveRaw(ctx, id, reason, opts = {}) {
+    const store = storeFor(ctx);
+    const entryWrites = requireGroup(store, 'entryWrites');
+    const archive = { tenantId: ctx.tenantId, actor: ctx.actor.subject, ownScope: personalScopeOf(ctx.actor), id, reason };
+    const { event } = opts;
+    const archivedAt = event
+        ? await requireGroup(store, 'connectorWrites').archiveConnectorEntry({ ...archive, event })
+        : await entryWrites.archiveRaw(archive);
+    return { ok: true, archivedAt };
 }
 //# sourceMappingURL=promote.js.map

package/dist/api/prompt-hook.d.ts

@@ -1,9 +1,24 @@
 import { type Context, type ContextResult, type ContextResultEntry } from './index.js';
-import type { DeliveryRecorder } from '../store/delivery-recorder.js';
+import { type DeliveryEventType, type DeliveryFault, type DeliveryRecorder } from '../store/delivery-recorder.js';
+import type { HookRuntime } from '../core/capture-contract.js';
 import { type JsonValue } from '../util/json.js';
 import type { MemoryEntry } from '../core/memory.js';
-import { type PilotArm } from './pilot-arm.js';
+import type { PilotArm } from '../store/pilot-arm.js';
 import type { DeliveryWrite } from '../store/ledger-turn.js';
+/** What a hook's delivery row says about the call it records. */
+export interface DeliveryStart {
+    stdinText: string | undefined;
+    runtime: HookRuntime;
+    eventType?: DeliveryEventType;
+    /** The host's own session id from its environment, used when the payload names none. */
+    envSessionId: string | undefined;
+    /** Passed through to the recorder; only tests set it. */
+    fault?: DeliveryFault;
+}
+/** A delivery recorder for a hook on `ctx.hippoRoot` when the ledger store enables one, else null; never throws. */
+export declare function startDeliveryRecorder(ctx: Context, start: DeliveryStart): DeliveryRecorder | null;
+/** A recorder for `hippo capture-error`, only when the failure log and the ledger are one store, so `failure_id` never points into another. */
+export declare function startToolFailureRecorder(ctx: Context, start: Omit<DeliveryStart, 'eventType'>): DeliveryRecorder | null;
 /** With `write`, stores on the token ledger's connection (same store); without it, opens its own. A second flush is a no-op. */
 export declare function flushDeliveryRecorder(rec: DeliveryRecorder | null, write?: DeliveryWrite): void;
 /** What one render needs once api.getContext has answered. */

package/dist/api/prompt-hook.js

@@ -5,16 +5,57 @@ import { getContext } from './index.js';
 import { BadRequestError } from '../core/api-errors.js';
 import { isSharedStore, loadConfig } from '../core/config.js';
 import { contextBlockLines, contextCost, crossProjectLines, handoffText, sessionTrailText, settleTokens, snapshotText } from './context-render.js';
-import { MAX_ID_LEN } from '../util/http-util.js';
+import { createDeliveryRecorder } from '../store/delivery-recorder.js';
+import { realpathOrResolve } from '../util/real-path.js';
+import { MAX_ID_LEN } from '../util/limits.js';
 import { isJsonString } from '../util/json.js';
-import { bookLedgerTurn, ledgerLastSent, noteLedgerRowSkipped } from './ledger-db.js';
+import { bookLedgerTurn, ledgerLastSent, ledgerRoot } from './ledger-db.js';
+import { noteLedgerRowSkipped } from '../store/ledger-turn.js';
 import { sessionPilotArm } from './pilot-arm.js';
-import { assertCallerProject, MAX_PROJECT_ALIASES } from '../core/project-identity.js';
+import { assertCallerProject, isGlobalStoreRoot, MAX_PROJECT_ALIASES } from '../core/project-identity.js';
 import { writeDeliveryEventAtRoot } from '../store/recall-trace.js';
-import { hookPayloadString, isSubagentPayload, shouldSkipUnchanged, } from '../store/token-ledger.js';
+import { shouldSkipUnchanged } from '../store/token-ledger.js';
+import { hookPayloadString, isSubagentPayload } from '../util/hook-payload.js';
 import { blockHash, estimateTokens } from '../util/token-text.js';
 import { errorMessage, log } from '../util/log.js';
 import { DEFAULT_CONTEXT_BUDGET } from './context.js';
+/** A delivery recorder for a hook on `ctx.hippoRoot` when the ledger store enables one, else null; never throws. */
+export function startDeliveryRecorder(ctx, start) {
+    try {
+        // The same store the token ledger writes to, so its config governs both.
+        const root = ledgerRoot(ctx.hippoRoot);
+        if (root === null || !loadConfig(root).deliveryLedger.enabled)
+            return null;
+        return createDeliveryRecorder({
+            root,
+            storeHash: blockHash(realpathOrResolve(root)),
+            writeStore: isGlobalStoreRoot(root) ? 'global' : 'local',
+            tenantId: ctx.tenantId,
+            stdinText: start.stdinText,
+            envSessionId: start.envSessionId,
+            runtime: start.runtime === 'copilot' ? 'copilot' : undefined,
+            eventType: start.eventType,
+            fault: start.fault,
+        });
+    }
+    catch (error) {
+        log.warn(`delivery ledger skipped: ${errorMessage(error)}`);
+        return null;
+    }
+}
+/** A recorder for `hippo capture-error`, only when the failure log and the ledger are one store, so `failure_id` never points into another. */
+export function startToolFailureRecorder(ctx, start) {
+    try {
+        const root = ledgerRoot(ctx.hippoRoot);
+        if (root === null || realpathOrResolve(root) !== realpathOrResolve(ctx.hippoRoot))
+            return null;
+        return startDeliveryRecorder(ctx, { ...start, eventType: 'tool-failure' });
+    }
+    catch (error) {
+        log.warn(`delivery ledger skipped: ${errorMessage(error)}`);
+        return null;
+    }
+}
 /** With `write`, stores on the token ledger's connection (same store); without it, opens its own. A second flush is a no-op. */
 export function flushDeliveryRecorder(rec, write) {
     if (rec === null)

package/dist/api/quarantine.js

@@ -1,6 +1,7 @@
 // Quarantine review: list, approve and reject held memories.
 import { ConflictError, ForbiddenError, NotFoundError } from '../core/api-errors.js';
-import { requireGroup, storeFor } from '../store/index.js';
+import { requireGroup } from '../store/index.js';
+import { storeFor } from '../store/sqlite/store.js';
 const QUARANTINE_PREVIEW_CHARS = 200;
 /** A tenant's quarantined memories, newest first. Default `status` is 'pending' (the review queue). */
 export async function quarantineList(ctx, opts = {}) {

package/dist/api/recall-cli.d.ts

@@ -19,6 +19,9 @@ export interface CliRecallOrigin {
     readonly isGlobal: (id: string) => boolean;
 }
 export declare function cliRecallOrigin(ctx: Context, setting: CliRecallSetting): CliRecallOrigin;
+/** How many of `query`'s search candidates the scope rule hides from a recall asking for `requested`; the read is
+ *  window-capped, so this is a floor on a large store. */
+export declare function scopeHiddenCount(ctx: Context, query: string, globalRoot: string | undefined, requested: string | undefined): number;
 /** The active snapshot, its session's latest handoff and last five events, each kept only when its scope passes. */
 export declare function loadCliRecallContinuity(ctx: Context, setting: CliRecallSetting, wanted: boolean): ContinuityBlock;
 export interface CliRecallRerankerPick {

package/dist/api/recall-cli.js

@@ -1,17 +1,17 @@
 // What the `hippo recall` verb reads beside its ranking core: the stores it searches, the resume packet and the JSON rows.
 import { confidenceFacets, Layer } from '../core/memory.js';
-import { isGlobalStoreRoot } from '../core/project-identity.js';
+import { isGlobalStoreRoot, isInitialized } from '../core/project-identity.js';
 import { getReranker } from '../rerankers/index.js';
 import { isClefModel } from '../rerankers/clef.js';
 import { JEV_DEFAULT_TOP_K } from '../rerankers/jev.js';
 import { explainMatch } from '../search/explain.js';
 import { fitBudget } from '../search/finalize.js';
 import { getGlobalRoot } from '../sharing/global-store.js';
-import { detectScope } from '../sharing/scope.js';
+import { detectScope } from '../core/active-scope.js';
 import { loadLatestHandoff } from '../store/handoffs.js';
 import { loadIndex } from '../store/index-and-stats.js';
-import { isInitialized } from '../store/open.js';
-import { passesScopeFilterForRecall } from '../store/recall-scope.js';
+import { passesCliRecallScopeFilter, passesScopeFilterForRecall } from '../core/recall-scope.js';
+import { loadSearchEntries } from '../store/search-rows.js';
 import { listSessionEvents, loadActiveTaskSnapshot } from '../store/sessions.js';
 export { DEFAULT_MAX_NEIGHBORS, MAX_HOPS } from '../graph/recall.js';
 /** The active scope merges `--scope` with the detected one, which only boosts. */
@@ -23,6 +23,15 @@ export function cliRecallOrigin(ctx, setting) {
     const globalOn = isInitialized(setting.globalRoot);
     return { globalOn, isGlobal: (id) => setting.primaryIsGlobal || (globalOn && !localIndex.entries[id]) };
 }
+/** How many of `query`'s search candidates the scope rule hides from a recall asking for `requested`; the read is
+ *  window-capped, so this is a floor on a large store. */
+export function scopeHiddenCount(ctx, query, globalRoot, requested) {
+    const probe = [
+        ...loadSearchEntries(ctx.hippoRoot, query, undefined, ctx.tenantId),
+        ...(globalRoot ? loadSearchEntries(globalRoot, query, undefined, ctx.tenantId) : []),
+    ];
+    return probe.filter((e) => !passesCliRecallScopeFilter(e.scope ?? null, requested)).length;
+}
 /** The active snapshot, its session's latest handoff and last five events, each kept only when its scope passes. */
 export function loadCliRecallContinuity(ctx, setting, wanted) {
     if (!wanted || setting.primaryIsGlobal)

package/dist/api/recall-core.js

@@ -5,7 +5,7 @@ import { decidePlanningFallacy, detectPlanningClaim } from '../predictions/plann
 import { rankRecall } from './recall-pipeline.js';
 import { writeRecallTraceAtRoot } from '../store/recall-trace.js';
 import { saveIndex } from '../store/index-and-stats.js';
-import { sqliteStore } from '../store/index.js';
+import { storeFor } from '../store/sqlite/store.js';
 import { estimateTokens } from '../util/token-text.js';
 import { callerOf, recallAuditMetadata, recallAuditRow, strengthenOf } from './recall-record.js';
 import { RECALL_RECORDING, recordShownRecall } from './recall-finish.js';
@@ -16,8 +16,8 @@ export async function retrieveWithCliCore(ctx, opts, core) {
     if (!ctx.actor.hostAdmin)
         throw new ForbiddenError('The CLI ranking core serves the host admin only');
     const globalRoot = core.sources?.globalRoot;
-    // The ranking core reads hippo.db itself, so its writes go to the same file whatever store the context names.
-    const store = sqliteStore(ctx.hippoRoot);
+    // The ranking core reads hippo.db under hippoRoot, yet writes through the caller's store, whose finishRecall skips any id it does not hold.
+    const store = storeFor(ctx);
     const ranking = await rankRecall({ hippoRoot: ctx.hippoRoot, globalRoot, tenantId: ctx.tenantId, note: core.note }, { ...core.rank, query: opts.query, sessionId: opts.sessionId, goalTag: opts.goalTag });
     if (ranking.halted) {
         // The stages that ran earned these rows, so the caller's flag error does not drop them.
@@ -58,7 +58,7 @@ async function recordShown(ctx, store, opts, core, done) {
     const { ranking, shown, planningAudit } = done;
     const ids = shown.results.map((r) => r.entry.id);
     const recallRow = recallAuditRow(callerOf(ctx), 'recall', undefined, recallAuditMetadata(opts.query, ids.length));
-    const second = core.sources?.globalRoot !== undefined && core.sources.globalRoot !== ctx.hippoRoot ? core.sources.globalRoot : undefined;
+    const second = secondStore(ctx, core);
     const heldElsewhere = second !== undefined ? await idsNotHeld(store, ids, ctx.tenantId) : [];
     const audited = await finishOrReport(store, {
         goalLog: ranking.goalRecallLog,
@@ -68,7 +68,7 @@ async function recordShown(ctx, store, opts, core, done) {
     if (audited) {
         // The second store logs that it was searched, and strengthens only the rows the first does not hold.
         if (second !== undefined)
-            await finishOrReport(sqliteStore(second), { goalLog: [], audit: [recallRow], strengthen: strengthenOf(ctx, heldElsewhere) });
+            await finishOrReport(second, { goalLog: [], audit: [recallRow], strengthen: strengthenOf(ctx, heldElsewhere) });
         traceAndMark(ctx, opts, core, shown.results);
     }
     // The caller prints whether or not the record was written, so the ring and the ledger still take this list; `written` holds back the count.
@@ -83,6 +83,11 @@ async function recordShown(ctx, store, opts, core, done) {
         written: audited,
     });
 }
+/** The second store's writes go where the first's do: the store named for its root, else hippo.db under that root. */
+function secondStore(ctx, core) {
+    const root = core.sources?.globalRoot;
+    return root !== undefined && root !== ctx.hippoRoot ? storeFor({ hippoRoot: root, store: core.sources?.globalStore }) : undefined;
+}
 // The caller has ranked and is about to print, so a failed audit write is logged and counted, never thrown.
 async function finishOrReport(store, writes) {
     try {