hippo-memory 1.71.0 → 2.0.0

package/dist/sharing/share.js

@@ -4,15 +4,14 @@ import * as fs from 'fs';
 import * as path from 'path';
 import { generateId, COMPACTION_MEMORY_TAG } from '../core/memory.js';
 import { AGENT_MEMORY_SOURCE_PREFIX, AGENT_MEMORY_TAGS } from '../core/agent-memory-tools.js';
-import { writeEntry } from '../store/entry-writes.js';
-import { loadAllEntries, readEntry } from '../store/entry-reads.js';
+import { writeEntriesSkippingRejected, writeEntry } from '../store/entry-writes.js';
+import { loadAllEntries, loadEntryTextKeys, readEntry } from '../store/entry-reads.js';
 import { tallySources } from '../store/candidates.js';
-import { isPersonalScope } from '../store/recall-scope.js';
+import { isPersonalScope } from '../core/recall-scope.js';
 import { fallbackOrigin } from '../core/project-identity.js';
 import { detectSecret } from '../util/secret-detect.js';
 import { isQuarantineScope } from '../trust/quarantine.js';
-import { RejectedValueError } from '../store/rejection.js';
-import { embedMemory, embedAll } from '../store/embeddings/index.js';
+import { embedMemory, embedAll } from '../search/embed-memories.js';
 import { duplicateKey, storedTextKeys } from '../util/same-text.js';
 import { isReusable } from '../core/memory-quality.js';
 import { log } from '../util/log.js';
@@ -45,6 +44,8 @@ export const NO_MERGE_TAGS = new Set([
     COMPACTION_MEMORY_TAG,
     ...AGENT_MEMORY_TAGS,
 ]);
+/** The transfer score a memory needs before sleep or `hippo share --auto` copies it to the global store. */
+export const AUTO_SHARE_MIN_SCORE = 0.6;
 /** Estimate how well a memory would transfer to other projects.
  *  Returns 0..1 where >0.5 = good candidate for sharing. */
 export function transferScore(entry) {
@@ -74,28 +75,34 @@ export function shareMemory(localRoot, id, options = {}) {
     const entry = readEntry(localRoot, id, options.tenantId);
     if (!entry)
         throw new NotFoundError(`Memory not found: ${id}`);
-    assertShareable(entry, id);
-    const score = transferScore(entry);
-    if (score < 0.3 && !options.force)
+    const globalEntry = toGlobalEntry(localRoot, entry, options.force === true);
+    if (!globalEntry)
         return null;
     initGlobal();
     const globalRoot = getGlobalRoot();
+    writeEntry(globalRoot, globalEntry);
+    // Embed here unless the caller opts out: autoShare sets skipEmbed to batch one embedAll(), since embedMemory rewrites the whole index per call.
+    if (!options.skipEmbed) {
+        void embedMemory(globalRoot, globalEntry);
+    }
+    return globalEntry;
+}
+/** The global copy of a local row, or null when its transfer score is too low and `force` is off; throws when the row may not be shared. */
+function toGlobalEntry(localRoot, entry, force) {
+    assertShareable(entry, entry.id);
+    const score = transferScore(entry);
+    if (score < 0.3 && !force)
+        return null;
     // The label keeps the folder name for a user-global row; a NULL row gets `shared::`, which originFromSource reads as no project.
     const fallbackName = path.basename(path.resolve(localRoot, '..'));
     const originName = entry.origin_project ?? fallbackOrigin(localRoot);
     const label = originName === '' ? fallbackName : (originName ?? '');
-    const globalEntry = {
+    return {
         ...entry,
         id: generateId('g'),
         source: `shared:${label}:${new Date().toISOString()}`,
         origin_project: originName,
     };
-    writeEntry(globalRoot, globalEntry);
-    // Embed here unless the caller opts out: autoShare sets skipEmbed to batch one embedAll(), since embedMemory rewrites the whole index per call.
-    if (!options.skipEmbed) {
-        void embedMemory(globalRoot, globalEntry);
-    }
-    return globalEntry;
 }
 function assertShareable(entry, id) {
     // Secret veto: secrets never reach the global store, even with --force; throw loudly, since a silent null reads as "low transfer score" and invites retries.
@@ -174,29 +181,25 @@ function isAutoShareCandidate(entry, globalContentSet, minScore, stats) {
     }
     return true;
 }
-// Rejection containment: shareMemory -> writeEntry can throw RejectedValueError against the GLOBAL store tombstones and abort the autoShare sleep phase.
-// Catch per item like syncGlobalToLocal; writeEntry already audits reject_refusal before rethrowing, so count and continue.
-function shareCandidates(localRoot, candidates, stats) {
+// A row the GLOBAL store's rejection tombstones refuse is audited and skipped, so it cannot abort the autoShare sleep phase.
+// The candidates are rows already held, written in one transaction; the caller embeds once via embedAll() afterwards.
+function shareCandidates(localRoot, globalRoot, candidates, stats) {
     const shared = [];
     let rejectedSkipped = 0;
-    for (const entry of candidates) {
-        try {
-            // skipEmbed: batching invariant, this is a batch producer, so it embeds
-            // once via embedAll() below rather than once per row inside shareMemory.
-            const result = shareMemory(localRoot, entry.id, { force: true, skipEmbed: true });
-            if (result)
-                shared.push(result);
-        }
-        catch (err) {
-            if (err instanceof RejectedValueError) {
-                rejectedSkipped++;
-                if (stats)
-                    stats.rejectedSkipped = (stats.rejectedSkipped ?? 0) + 1;
+    writeEntriesSkippingRejected(globalRoot, (put) => {
+        for (const entry of candidates) {
+            const globalEntry = toGlobalEntry(localRoot, entry, true);
+            if (!globalEntry)
+                continue;
+            if (put(globalEntry)) {
+                shared.push(globalEntry);
                 continue;
             }
-            throw err;
+            rejectedSkipped++;
+            if (stats)
+                stats.rejectedSkipped = (stats.rejectedSkipped ?? 0) + 1;
         }
-    }
+    });
     if (rejectedSkipped > 0) {
         log.warn(`autoShare: skipped ${rejectedSkipped} candidate(s) refused by the global store's rejection tombstone`);
     }
@@ -205,19 +208,17 @@ function shareCandidates(localRoot, candidates, stats) {
 /** Auto-share local memories with high transfer scores, not already global and without a NEVER_AUTO_SHARE_TAGS tag; `options.tenantId` scopes the LOCAL read.
  *  `options.stats` is an opt-in out-param: `secretSkipped` counts shares the secret veto prevented, `rejectedSkipped` rejection refusals (0 under `dryRun`). */
 export function autoShare(localRoot, options = {}) {
-    const { minScore = 0.6, dryRun = false } = options;
+    const { minScore = AUTO_SHARE_MIN_SCORE, dryRun = false } = options;
     const localEntries = loadAllEntries(localRoot, options.tenantId);
     initGlobal();
     const globalRoot = getGlobalRoot();
     // Host-wide read. The global store IS the union across all tenants;
     // per-tenant filtering on the global root would defeat the purpose.
-    const globalEntries = loadAllEntries(globalRoot);
-    // Build set of global content hashes to avoid duplicates
-    const globalContentSet = storedTextKeys(globalEntries);
+    const globalContentSet = storedTextKeys(loadEntryTextKeys(globalRoot));
     const candidates = localEntries.filter((entry) => isAutoShareCandidate(entry, globalContentSet, minScore, options.stats));
     if (dryRun)
         return candidates;
-    const shared = shareCandidates(localRoot, candidates, options.stats);
+    const shared = shareCandidates(localRoot, globalRoot, candidates, options.stats);
     if (shared.length > 0) {
         void embedAll(globalRoot).catch((err) => logEmbedAllFailure('autoShare', err));
     }

package/dist/store/ambient.js

@@ -1,11 +1,11 @@
 import { strengthSql } from './rule-sql.js';
-import { scopeAdmitSql } from './recall-scope.js';
+import { scopeAdmitSql } from './rule-sql.js';
 import { SECRET_TAGS } from '../util/secret-detect.js';
 import { onHandle, openStore } from './open.js';
 import { jsonList } from './candidates.js';
 import { originInSql } from '../core/project-identity.js';
-import { isErrorTagged } from '../core/ambient.js';
-import { DAY_MS } from '../util/time.js';
+import { AMBIENT_FRESH_WINDOW_MS, HIGH_SCHEMA_FIT_ABOVE, isErrorTagged } from '../core/ambient.js';
+import { placeholders } from '../util/sql.js';
 // SHORTCUT: mirrors loadContextCandidates' WHERE (request-path snapshots pin the match); share it once store.ts is split.
 function contextRowsWhere(tenantId, filter) {
     const where = ['tenant_id = ?', `COALESCE(superseded_by, '') = ''`, `COALESCE(kind, '') != 'archived'`];
@@ -30,7 +30,7 @@ function secretTaggedSql() {
     const tags = [...SECRET_TAGS];
     return {
         sql: `((${tags.map(() => 'tags_json LIKE ?').join(' OR ')})
-      AND EXISTS (SELECT 1 FROM json_each(${jsonList('tags_json')}) WHERE lower(value) IN (${tags.map(() => '?').join(', ')})))`,
+      AND EXISTS (SELECT 1 FROM json_each(${jsonList('tags_json')}) WHERE lower(value) IN (${placeholders(tags.length)})))`,
         params: [...tags.map((t) => `%"${t}"%`), ...tags],
     };
 }
@@ -39,7 +39,7 @@ function secretTaggedSql() {
 export function loadAmbientTallies(hippoRoot, tenantId, filter) {
     const { where, params } = contextRowsWhere(tenantId, filter);
     const secret = secretTaggedSql();
-    const sevenDaysAgo = new Date(filter.now.getTime() - 7 * DAY_MS).toISOString();
+    const freshAfter = new Date(filter.now.getTime() - AMBIENT_FRESH_WINDOW_MS).toISOString();
     return onHandle(hippoRoot, (db) => {
         // SAFETY: one aggregate row whose columns are the aliases named below. Tag lists come back as one JSON array of
         // arrays and are counted in JS, which maps items through String() as parseJsonArray does.
@@ -48,7 +48,7 @@ export function loadAmbientTallies(hippoRoot, tenantId, filter) {
       COALESCE(SUM(${strengthSql(filter.now)}), 0) AS strengthSum,
       COALESCE(SUM(julianday(created) > julianday(?)), 0) AS fresh,
       COALESCE(SUM(emotional_valence IN ('negative', 'critical')), 0) AS negative,
-      COALESCE(SUM(COALESCE(schema_fit, 0.5) > 0.7), 0) AS highSchemaFit,
+      COALESCE(SUM(COALESCE(schema_fit, 0.5) > ?), 0) AS highSchemaFit,
       COALESCE(SUM(layer = 'semantic'), 0) AS semantic,
       COALESCE(SUM(layer = 'episodic'), 0) AS episodic,
       COALESCE(SUM(json_array_length(${jsonList('conflicts_with_json')})), 0) AS conflicts,
@@ -57,7 +57,7 @@ export function loadAmbientTallies(hippoRoot, tenantId, filter) {
       '[' || COALESCE(group_concat(${jsonList('tags_json')}, ','), '') || ']' AS tagLists
       FROM memories
       WHERE ${where.join(' AND ')}
-        AND ((${originInSql(filter.currentProject)} AND origin_project != '') OR NOT ${secret.sql})`).get(sevenDaysAgo, ...params, ...filter.currentProject, ...secret.params);
+        AND ((${originInSql(filter.currentProject)} AND origin_project != '') OR NOT ${secret.sql})`).get(freshAfter, HIGH_SCHEMA_FIT_ABOVE, ...params, ...filter.currentProject, ...secret.params);
         const tagCounts = new Map();
         let errors = 0;
         const lists = /* SAFETY: jsonList yields an array per row, joined into one array */ JSON.parse(row.tagLists);

package/dist/store/audit-event.d.ts

@@ -1,6 +1,6 @@
 import { openHippoDb } from '../db/index.js';
 import { type AuditOp } from './audit.js';
-import { RejectedValueError } from './rejection.js';
+import { RejectedValueError } from '../core/api-errors.js';
 import type { JsonValue } from '../util/json.js';
 export interface AuditOptions {
     readonly targetId?: string;

package/dist/store/audit.d.ts

@@ -1,22 +1,6 @@
-import { type MemoryEntry } from '../core/memory.js';
 import { type DatabaseSyncLike } from '../db/index.js';
 import type { JsonObject } from './working-memory.js';
 import { type KeysetPosition } from '../util/keyset.js';
-export type AuditSeverity = 'warning' | 'error';
-export interface AuditIssue {
-    memoryId: string;
-    content: string;
-    severity: AuditSeverity;
-    reason: string;
-}
-export interface AuditResult {
-    total: number;
-    issues: AuditIssue[];
-    clean: number;
-}
-export declare function auditMemory(entry: MemoryEntry, backsObject?: boolean): AuditIssue | null;
-/** `backing`: ids of memories that back an object (store.memoriesBackingObjects). */
-export declare function auditMemories(entries: MemoryEntry[], backing: ReadonlySet<string>): AuditResult;
 export declare const AUDIT_OPS: readonly ["remember", "recall", "promote", "supersede", "forget", "archive_raw", "auth_revoke", "auth_create", "outcome", "consolidate", "audit_prune", "summary_marked_dirty", "summary_marked_clean", "summary_rebuilt", "predict_create", "predict_close", "predict_baserate", "recall_autodebias_hint", "recall_autodebias_hint_no_class_match", "recall_autodebias_hint_tiebreak", "recall_anchor_detected_query_repeat", "recall_anchor_detected_memory_dominance", "recall_anchor_skipped_no_session", "recall_availability_detected", "decision_create", "decision_supersede", "decision_close", "incident_open", "incident_resolve", "incident_close", "process_create", "process_supersede", "process_close", "policy_create", "policy_supersede", "policy_close", "skill_create", "skill_supersede", "skill_close", "project_brief_create", "project_brief_supersede", "project_brief_close", "customer_note_create", "customer_note_supersede", "customer_note_close", "mv_rescue", "reject_value", "reject_refusal", "unreject_value", "conflict_resolve", "half_life_migrate", "dormant_restore", "auth_grant", "auth_ungrant", "quarantine", "quarantine_approve", "quarantine_reject", "agent_memory_restore", "agent_memory_set_aside", "project_merge", "project_repair", "quality_repair"];
 export type AuditOp = (typeof AUDIT_OPS)[number];
 export interface AppendAuditOpts {

package/dist/store/audit.js

@@ -1,60 +1,9 @@
-import { createHash } from 'node:crypto';
-import { canAutoDelete } from '../core/memory.js';
+import { DEFAULT_LIST_LIMIT } from '../util/limits.js';
 import { closeHippoDb, openHippoDb, withWriteScope } from '../db/index.js';
 import { log } from '../util/log.js';
+import { blockHash } from '../util/token-text.js';
 import { keysetAfter } from '../util/keyset.js';
 import { warnDamagedColumn } from '../util/stored-json.js';
-import { automaticDefect, hasNoSpecificity, isFragment, isReleaseCommitNoise, substantiveWordCount, } from '../core/memory-quality.js';
-export function auditMemory(entry, backsObject = false) {
-    const issue = classifyMemory(entry);
-    // Error means "auto-remove"; a pinned, raw, kept-for-good or object-backing row is never auto-removed, so it can only warn.
-    if (issue?.severity === 'error' && (!canAutoDelete(entry) || backsObject)) {
-        const why = entry.pinned ? 'pinned' : entry.kind === 'raw' ? 'raw' : backsObject ? 'backs an object' : 'keep rule';
-        return { ...issue, severity: 'warning', reason: `${issue.reason} (${why}, kept)` };
-    }
-    return issue;
-}
-function classifyMemory(entry) {
-    const content = entry.content.trim();
-    if (content.length < 3) {
-        return { memoryId: entry.id, content, severity: 'error', reason: 'too short (< 3 chars)' };
-    }
-    if (content.length < 10) {
-        return { memoryId: entry.id, content, severity: 'error', reason: 'too short (< 10 chars)' };
-    }
-    if (isReleaseCommitNoise(content)) {
-        return { memoryId: entry.id, content, severity: 'error', reason: 'release/commit noise, not a useful memory' };
-    }
-    if (isFragment(content)) {
-        return { memoryId: entry.id, content, severity: 'warning', reason: 'sentence fragment — lacks context' };
-    }
-    const substantive = substantiveWordCount(content);
-    if (substantive < 2) {
-        return { memoryId: entry.id, content, severity: 'warning', reason: `only ${substantive} substantive word(s) — too vague` };
-    }
-    if (content.length < 40 && hasNoSpecificity(content)) {
-        return { memoryId: entry.id, content, severity: 'warning', reason: 'no specific details (names, paths, numbers, code)' };
-    }
-    const reason = automaticDefect(entry);
-    if (reason !== null) {
-        return { memoryId: entry.id, content, severity: 'warning', reason: `automatic memory defect: ${reason}` };
-    }
-    return null;
-}
-/** `backing`: ids of memories that back an object (store.memoriesBackingObjects). */
-export function auditMemories(entries, backing) {
-    const issues = [];
-    for (const entry of entries) {
-        const issue = auditMemory(entry, backing.has(entry.id));
-        if (issue)
-            issues.push(issue);
-    }
-    return {
-        total: entries.length,
-        issues,
-        clean: entries.length - issues.length,
-    };
-}
 // The one list of audit ops: the AuditOp type, `hippo audit list --op` and GET /v1/audit?op= all read it.
 export const AUDIT_OPS = [
     'remember',
@@ -128,7 +77,7 @@ function bigintSafeReplacer(_key, value) {
 }
 export function auditQueryFields(query) {
     return {
-        query_hash: createHash('sha256').update(query).digest('hex').slice(0, 16),
+        query_hash: blockHash(query),
         query_length: query.length,
     };
 }
@@ -172,7 +121,7 @@ export function queryAuditEvents(db, opts) {
     }
     const after = keysetAfter('ts', 'id', opts.after);
     // One past the route's 10000 cap: GET /v1/audit reads a row ahead to tell whether another page exists.
-    const limit = Math.max(1, Math.min(opts.limit ?? 100, 10001));
+    const limit = Math.max(1, Math.min(opts.limit ?? DEFAULT_LIST_LIMIT, 10001));
     // SAFETY: AUDIT_COLUMNS names exactly the AuditRow columns, in this order.
     const rows = db
         .prepare(`SELECT ${AUDIT_COLUMNS} FROM audit_log WHERE ${where.join(' AND ')}${after.sql} ORDER BY ts DESC, id DESC LIMIT ?`)

package/dist/store/auth.d.ts

@@ -12,13 +12,15 @@ export declare function apiKeyVerifyStats(): ApiKeyVerifyStats;
 export interface CreateApiKeyOpts {
     tenantId: string;
     label?: string;
-    /** 'admin' | 'member'. Defaults to 'admin' (backward-compat for callers that don't specify). */
+    /** 'admin' | 'member'. Defaults to 'member', like the API layer. */
     role?: 'admin' | 'member';
     /** The auth-resolver subject a self-service key belongs to; unset for keys an admin or the CLI mints. */
     ownerSubject?: string;
-    /** ISO time the key stops working; unset means it never expires. */
+    /** ISO time the key stops working; unset means DEFAULT_KEY_TTL_DAYS from now. */
     expiresAt?: string;
 }
+/** Days a key lives when its mint names no expiry, so a key nobody remembers stops working by itself. */
+export declare const DEFAULT_KEY_TTL_DAYS = 90;
 export interface CreateApiKeyResult {
     keyId: string;
     plaintext: string;

package/dist/store/auth.js

@@ -3,6 +3,7 @@ import { promisify } from 'node:util';
 import { closeHippoDb, openHippoDb } from '../db/index.js';
 import { raiseMinBinary } from '../db/meta.js';
 import { keysetAfter } from '../util/keyset.js';
+import { DAY_MS } from '../util/time.js';
 import { EXPIRING_KEYS_MIN_BINARY } from '../util/version.js';
 /** Every minted API key starts with this, so the server can route a bearer token by shape. */
 export const API_KEY_PREFIX = 'hk_';
@@ -48,6 +49,8 @@ function verifyKey(plaintext, stored) {
     return parsed.matches(scryptSync(plaintext, parsed.salt, parsed.keylen));
 }
 const scryptOffLoop = promisify(scrypt);
+/** Days a key lives when its mint names no expiry, so a key nobody remembers stops working by itself. */
+export const DEFAULT_KEY_TTL_DAYS = 90;
 export function mintApiKey() {
     const keyId = `${API_KEY_PREFIX}${randBase32(ID_LEN)}`;
     const plaintext = `${keyId}.${randBase32(SECRET_LEN)}`;
@@ -63,8 +66,8 @@ export function insertApiKey(db, key) {
 export function createApiKey(db, opts) {
     const { keyId, plaintext, keyHash } = mintApiKey();
     insertApiKey(db, {
-        keyId, keyHash, tenantId: opts.tenantId, label: opts.label ?? null, role: opts.role ?? 'admin', createdAt: new Date().toISOString(),
-        ownerSubject: opts.ownerSubject ?? null, expiresAt: opts.expiresAt ?? null,
+        keyId, keyHash, tenantId: opts.tenantId, label: opts.label ?? null, role: opts.role ?? 'member', createdAt: new Date().toISOString(),
+        ownerSubject: opts.ownerSubject ?? null, expiresAt: opts.expiresAt ?? new Date(Date.now() + DEFAULT_KEY_TTL_DAYS * DAY_MS).toISOString(),
     });
     return { keyId, plaintext };
 }
@@ -251,7 +254,8 @@ export function listApiKeyRows(db, opts) {
     const limitSql = opts.limit === undefined ? '' : ' LIMIT ?';
     if (opts.limit !== undefined)
         params.push(opts.limit);
-    const sql = `SELECT id, key_id, tenant_id, label, created_at, revoked_at, role, expires_at, owner_subject FROM api_keys WHERE ${where.join(' AND ')}${after.sql} ORDER BY id DESC${limitSql}`;
+    const sql = `SELECT id, key_id, tenant_id, label, created_at, revoked_at, role, expires_at, owner_subject FROM api_keys ` +
+        `WHERE ${where.join(' AND ')}${after.sql} ORDER BY id DESC${limitSql}`;
     // SAFETY: the SELECT above projects exactly these 9 columns, in this order.
     const rows = db.prepare(sql).all(...params);
     return rows.map(r => ({

package/dist/store/candidates.d.ts

@@ -1,5 +1,5 @@
 import { type MemoryEntry, type ConfidenceLevel, Layer } from '../core/memory.js';
-import { type SqlFragment } from './recall-scope.js';
+import { type SqlFragment } from './rule-sql.js';
 export interface AmbientRecallRequest {
     terms: string[];
     limit: number;
@@ -37,7 +37,8 @@ export declare const EVERY_SCOPE: SqlFragment;
 export declare function loadTextsHoldingWords(hippoRoot: string, tenantId: string | undefined, words: readonly string[], project?: readonly string[], admit?: SqlFragment): HeldText[];
 /** A tenant's `limit` newest rows, oldest first: the tail of loadAllEntries' order, without reading the rows before it. */
 export declare function loadNewestEntries(hippoRoot: string, tenantId: string, limit: number): MemoryEntry[];
-/** computeSchemaFit against every row of a tenant: tag counts come from one aggregate and texts stream one column, so no row is loaded. */
+/** computeSchemaFit against a tenant's newest SCHEMA_FIT_WINDOW_ROWS rows: tag counts come from one aggregate
+ * and texts stream one column, so no row is loaded. */
 export declare function schemaFitInStore(hippoRoot: string, tenantId: string, content: string, tags: readonly string[]): number;
 export interface SourceTally {
     source: string;

package/dist/store/candidates.js

@@ -1,7 +1,7 @@
 import { FALLBACK_HALF_LIFE_DAYS, Layer, calculateStrength, facetsOf, schemaFitFrom } from '../core/memory.js';
 import { strengthSql } from './rule-sql.js';
 import { withReadSnapshot } from '../db/index.js';
-import { scopeAdmitSql } from './recall-scope.js';
+import { rewardFactorSql, scopeAdmitSql } from './rule-sql.js';
 import { MEMORY_SELECT_COLUMNS, rowToEntry, parseJsonArray } from './rows.js';
 import { onHandle, openStore } from './open.js';
 import { originInSql } from '../core/project-identity.js';
@@ -15,32 +15,44 @@ function inOrigins(e, origins) {
     const origin = e.origin_project ?? null;
     return origin === '' ? origins.userGlobal : origin !== null && origins.names.includes(origin);
 }
+// `id DESC` mirrors getContext's comparator, not loadFreshRawMemories'
+// cross-ingest-stable order: that would change what the hook injects.
+const NEWEST = 'ORDER BY created DESC, id DESC';
 // The newest rows `admit` keeps, newest first. The first window stays unfiltered so admit still sees, and the
 // delivery ledger still counts, the other-project rows it refuses; past it, the reads narrow to the caller's origins.
 function loadRecentRows(run, drifted, tenantId, options) {
     const { needed, admit, origins } = options;
     const keep = origins ? (e) => admit(e) && inOrigins(e, origins) : admit;
-    // `id DESC` mirrors getContext's comparator, not loadFreshRawMemories'
-    // cross-ingest-stable order: that would change what the hook injects.
-    const newest = 'ORDER BY created DESC, id DESC';
     const window = Math.max(needed * 4, 32);
     const originSql = origins && (origins.userGlobal ? `(origin_project = '' OR ${originInSql(origins.names)})` : originInSql(origins.names));
-    const ownWhere = originSql ? `${AMBIENT_SCOPED} AND ${originSql}` : AMBIENT_SCOPED;
-    const ownParams = [tenantId, ...(origins?.names ?? [])];
-    if (!drifted) {
-        const windowed = run(`${AMBIENT_SCOPED} ${newest} LIMIT ?`, [tenantId, window]);
-        const kept = windowed.filter(keep);
-        if (kept.length >= needed || windowed.length < window)
+    const own = { where: originSql ? `${AMBIENT_SCOPED} AND ${originSql}` : AMBIENT_SCOPED, params: [tenantId, ...(origins?.names ?? [])] };
+    // Text order is chronological only for standard UTC ISO (memory.ts), so a drifted store is read whole and re-sorted downstream.
+    if (drifted)
+        return run(`${own.where} ${NEWEST}`, [...own.params]).filter(keep);
+    let read = run(`${AMBIENT_SCOPED} ${NEWEST} LIMIT ?`, [tenantId, window]);
+    let kept = read.filter(keep);
+    if (kept.length >= needed || read.length < window)
+        return kept;
+    if (origins) {
+        read = run(`${own.where} ${NEWEST} LIMIT ?`, [...own.params, window]);
+        kept = read.filter(keep);
+        if (kept.length >= needed || read.length < window)
             return kept;
-        if (origins) {
-            const ownWindow = run(`${ownWhere} ${newest} LIMIT ?`, [...ownParams, window]);
-            const ownKept = ownWindow.filter(keep);
-            if (ownKept.length >= needed || ownWindow.length < window)
-                return ownKept;
-        }
     }
-    // Text order is chronological only for standard UTC ISO (memory.ts), and a window of junk can hide older rows.
-    return run(`${ownWhere} ${newest}`, ownParams).filter(keep);
+    return [...kept, ...keptPastWindow(run, own, read, needed - kept.length, keep)];
+}
+// A window of refused rows can hide older ones, so read on in keyset pages, each four times the last, until enough are kept.
+function keptPastWindow(run, own, read, wanted, keep) {
+    const out = [];
+    let last = read[read.length - 1];
+    for (let size = read.length * 4; out.length < wanted; size *= 4) {
+        const page = run(`${own.where} AND created <= ? AND (created < ? OR id < ?) ${NEWEST} LIMIT ?`, [...own.params, last.created, last.created, last.id, size]);
+        out.push(...page.filter(keep));
+        if (page.length < size)
+            break;
+        last = page[page.length - 1];
+    }
+    return out;
 }
 // The pins plus the `recentNeeded` newest rows that pass `admit`, for ambient injection. One connection;
 // `recall` piggybacks the prompt-recall FTS query on it too. `origins` narrows the recent rows past the first window.
@@ -77,10 +89,10 @@ export function loadAmbientCandidates(hippoRoot, tenantId, recentNeeded, admit,
     }, openStore);
 }
 // calculateStrength's decay exponent with its reward factor, pins first: the strongest rows, without scoring each one in JS.
-const DECAY_RANK_SQL = `pinned DESC,
+// A function, not a constant, so the outcome-slow ablation is read per query as strengthSql reads it.
+const decayRankSql = () => `pinned DESC,
   CASE WHEN half_life_days > 0 THEN (julianday(?) - julianday(last_retrieved))
-    / (half_life_days * (1.0 + 0.5 * (COALESCE(outcome_positive, 0) - COALESCE(outcome_negative, 0))
-      / (COALESCE(outcome_positive, 0) + COALESCE(outcome_negative, 0) + 1.0))) END ASC NULLS LAST,
+    / (half_life_days * ${rewardFactorSql()}) END ASC NULLS LAST,
   id ASC`;
 /** Live tenant rows passing `filter`, at most `filter.cap`, in loadAllEntries' order; below the cap, every such row. */
 export function loadContextCandidates(hippoRoot, tenantId, filter) {
@@ -99,11 +111,21 @@ export function loadContextCandidates(hippoRoot, tenantId, filter) {
         where.push(`(origin_project = '' OR ${originInSql(filter.project)})`);
         params.push(...filter.project);
     }
+    const cap = Math.max(0, Math.trunc(filter.cap));
+    const whereSql = where.join(' AND ');
     return onHandle(hippoRoot, (db) => {
-        // SAFETY: the outer SELECT names exactly MEMORY_SELECT_COLUMNS, matching MemoryRow's field set; the rank sort carries ids only.
-        const rows = db.prepare(`SELECT ${MEMORY_SELECT_COLUMNS} FROM memories WHERE id IN (
-        SELECT id FROM memories WHERE ${where.join(' AND ')} ORDER BY ${DECAY_RANK_SQL} LIMIT ?
-      ) ORDER BY created ASC, id ASC`).all(...params, filter.now.toISOString(), Math.max(0, Math.trunc(filter.cap)));
+        // SAFETY: the count row has the one column named.
+        const matched = db.prepare(`SELECT COUNT(*) AS n FROM memories WHERE ${whereSql}`).get(...params).n;
+        // Under the cap every match is returned, so the per-row decay math and the sort are skipped.
+        // SHORTCUT: past the cap the rank still scans the tenant; a stored decay rank column needs a schema migration, held until one is approved.
+        const ranked = matched > cap;
+        const sql = ranked
+            ? `SELECT ${MEMORY_SELECT_COLUMNS} FROM memories WHERE id IN (
+        SELECT id FROM memories WHERE ${whereSql} ORDER BY ${decayRankSql()} LIMIT ?
+      ) ORDER BY created ASC, id ASC`
+            : `SELECT ${MEMORY_SELECT_COLUMNS} FROM memories WHERE ${whereSql} ORDER BY created ASC, id ASC`;
+        // SAFETY: both SELECTs name exactly MEMORY_SELECT_COLUMNS, matching MemoryRow's field set; the rank sort carries ids only.
+        const rows = db.prepare(sql).all(...params, ...(ranked ? [filter.now.toISOString(), cap] : []));
         return rows.map(rowToEntry);
     }, openStore);
 }
@@ -124,7 +146,8 @@ export function loadTextsHoldingWords(hippoRoot, tenantId, words, project, admit
         for (let i = 0; i < unique.length; i += 200) {
             const chunk = unique.slice(i, i + 200);
             // SAFETY: rows' shape matches the three columns named in the SELECT below.
-            const rows = db.prepare(`SELECT content, source, origin_project FROM memories WHERE ${tenantWhere}${originWhere} AND ${admit.sql} AND (${chunk.map(() => 'instr(content, ?) > 0').join(' OR ')})`).all(...tenantParams, ...(project ?? []), ...admit.params, ...chunk);
+            const rows = db.prepare(`SELECT content, source, origin_project FROM memories WHERE ${tenantWhere}${originWhere} AND ${admit.sql} AND (${chunk.map(() => 'instr(content, ?) ' +
+                '> 0').join(' OR ')})`).all(...tenantParams, ...(project ?? []), ...admit.params, ...chunk);
             for (const row of rows)
                 out.push({ content: row.content, source: row.source ?? 'cli', origin_project: row.origin_project });
         }
@@ -143,13 +166,17 @@ function* contentsOf(rows) {
     for (const row of rows)
         yield row.content;
 }
-/** computeSchemaFit against every row of a tenant: tag counts come from one aggregate and texts stream one column, so no row is loaded. */
+/** How many of a tenant's newest rows schemaFitInStore reads; older rows no longer move the fit. */
+const SCHEMA_FIT_WINDOW_ROWS = 2000;
+/** computeSchemaFit against a tenant's newest SCHEMA_FIT_WINDOW_ROWS rows: tag counts come from one aggregate
+ * and texts stream one column, so no row is loaded. */
 export function schemaFitInStore(hippoRoot, tenantId, content, tags) {
+    const newest = 'SELECT tags_json, content FROM memories WHERE tenant_id = ? ORDER BY created DESC, id DESC LIMIT ?';
     return onHandle(hippoRoot, (db) => {
         // One read transaction, so the row count and the texts come from the same snapshot.
         return withReadSnapshot(db, () => {
             // SAFETY: rows' shape matches the two columns named in the SELECT.
-            const groups = db.prepare('SELECT tags_json, COUNT(*) AS n FROM memories WHERE tenant_id = ? GROUP BY tags_json').all(tenantId);
+            const groups = db.prepare(`SELECT tags_json, COUNT(*) AS n FROM (${newest}) GROUP BY tags_json`).all(tenantId, SCHEMA_FIT_WINDOW_ROWS);
             let rows = 0;
             const tagCounts = new Map();
             for (const group of groups) {
@@ -157,9 +184,11 @@ export function schemaFitInStore(hippoRoot, tenantId, content, tags) {
                 for (const tag of parseJsonArray(group.tags_json))
                     tagCounts.set(tag, (tagCounts.get(tag) ?? 0) + group.n);
             }
-            // SHORTCUT: the text walk visits rows until a tenth of the tenant matches; a stored token count per tenant is the upgrade.
+            // SHORTCUT: only the newest SCHEMA_FIT_WINDOW_ROWS rows count, so older tags drop out;
+            // a stored per-tenant tag and token tally is the upgrade.
             // SAFETY: the SELECT names exactly the one column read.
-            const texts = db.prepare('SELECT content FROM memories WHERE tenant_id = ?').iterate(tenantId);
+            const texts = db.prepare(`SELECT content FROM (${newest})`)
+                .iterate(tenantId, SCHEMA_FIT_WINDOW_ROWS);
             return schemaFitFrom(content, tags, { rows, tagCounts, contents: contentsOf(texts) });
         });
     }, openStore);

package/dist/store/capture-write.d.ts

@@ -0,0 +1,17 @@
+import type { MemoryEntry } from '../core/memory.js';
+export type CapturedOutcome = 'captured' | 'skipped' | 'rejected';
+export interface CaptureItem {
+    readonly content: string;
+    /** Built only for an item that is not a repeat of an earlier one, since building can throw. */
+    readonly makeEntry: () => MemoryEntry;
+}
+export interface CaptureWriteOpts {
+    readonly actor?: string;
+    /** No stats, as in a server process. */
+    readonly lean: boolean;
+    /** Called with each captured entry after its write, so the caller can embed it; the store never picks a provider. */
+    readonly onCaptured?: (entry: MemoryEntry) => void;
+}
+/** One outcome per item, in order. `keys` holds the texts already stored and gains each one written, so a repeat inside the batch is skipped. */
+export declare function writeCapturedItems(hippoRoot: string, items: readonly CaptureItem[], keys: Set<string>, opts: CaptureWriteOpts): CapturedOutcome[];
+//# sourceMappingURL=capture-write.d.ts.map

package/dist/store/capture-write.js

@@ -0,0 +1,35 @@
+import { closeHippoDb } from '../db/index.js';
+import { duplicateKey } from '../util/same-text.js';
+import { writeEntryMirrors } from './entry-writes.js';
+import { stampOriginProject } from './entry-row.js';
+import { gatedWrite } from './gated-write.js';
+import { updateStatsOn } from './index-and-stats.js';
+import { openStore } from './open.js';
+/** One outcome per item, in order. `keys` holds the texts already stored and gains each one written, so a repeat inside the batch is skipped. */
+export function writeCapturedItems(hippoRoot, items, keys, opts) {
+    const db = openStore(hippoRoot);
+    try {
+        return items.map((item) => {
+            if (keys.has(duplicateKey(item.content)))
+                return 'skipped';
+            const entry = item.makeEntry();
+            // One rejected item must not abort the rest of this capture's items.
+            const stamped = stampOriginProject(hippoRoot, entry);
+            const outcome = gatedWrite(db, hippoRoot, stamped, { actor: opts.actor });
+            if (outcome === 'skipped:rejected')
+                return 'rejected';
+            if (outcome !== 'written')
+                return 'skipped';
+            writeEntryMirrors(hippoRoot, stamped);
+            if (!opts.lean)
+                updateStatsOn(db, hippoRoot, { remembered: 1 });
+            keys.add(duplicateKey(item.content)); // within-batch dedup
+            opts.onCaptured?.(entry);
+            return 'captured';
+        });
+    }
+    finally {
+        closeHippoDb(db);
+    }
+}
+//# sourceMappingURL=capture-write.js.map

package/dist/store/cards.js

@@ -4,8 +4,9 @@ import { rowToSessionHandoff, isHandoffOutcome } from '../core/handoff.js';
 import { CARD_LEASE_MS, assertCardTransition } from '../core/card.js';
 import { assertTenantId } from './tenant.js';
 import { onHandle, openStore } from './open.js';
-import { chunked } from './entry-reads.js';
+import { chunked } from '../util/chunked.js';
 import { HANDOFF_COLUMNS } from './handoffs.js';
+import { placeholders } from '../util/sql.js';
 const CARD_COLUMNS = 'id, title, status, assignee_runtime, repo, contract, budget, lease_until, heartbeat_at, created_at, updated_at, tenant_id, scope';
 function rowToCard(row) {
     return {
@@ -88,10 +89,10 @@ function transitionCards(db, tenantId, cardIds, options) {
     const now = new Date().toISOString();
     // Lease columns follow status: set on the move to running, cleared on every other move (rule 15).
     const lease = to === 'running' ? [leaseUntilFrom(now), now] : [null, null];
-    const fromPlaceholders = from.map(() => '?').join(', ');
+    const fromPlaceholders = placeholders(from.length);
     const sql = `
     UPDATE cards SET status = ?, updated_at = ?, lease_until = ?, heartbeat_at = ?${extra?.setSql ? `, ${extra.setSql}` : ''}
-    WHERE id IN (${cardIds.map(() => '?').join(', ')}) AND tenant_id = ? AND status IN (${fromPlaceholders})${extra?.whereSql ? ` AND ${extra.whereSql}` : ''}
+    WHERE id IN (${placeholders(cardIds.length)}) AND tenant_id = ? AND status IN (${fromPlaceholders})${extra?.whereSql ? ` AND ${extra.whereSql}` : ''}
   `;
     const params = [to, now, ...lease, ...(extra?.params ?? []), ...cardIds, tenantId, ...from];
     const result = db.prepare(sql).run(...params);
@@ -134,9 +135,9 @@ export function createCard(hippoRoot, tenantId, input) {
 function everyParentDone(db, tenantId, dependsOn) {
     if (dependsOn.length === 0)
         return true;
-    const placeholders = dependsOn.map(() => '?').join(', ');
+    const marks = placeholders(dependsOn.length);
     // SAFETY: rows' shape matches the two columns named in the SELECT below.
-    const rows = db.prepare(`SELECT id, status FROM cards WHERE tenant_id = ? AND id IN (${placeholders})`).all(tenantId, ...dependsOn);
+    const rows = db.prepare(`SELECT id, status FROM cards WHERE tenant_id = ? AND id IN (${marks})`).all(tenantId, ...dependsOn);
     const found = new Map(rows.map((r) => [r.id, r.status]));
     // Pre-check before any write: a typo'd --depends-on can never commit a card row.
     for (const parentId of dependsOn) {