hippo-memory 1.71.0 → 2.0.0

package/dist/store/sqlite/held-connection.d.ts

@@ -0,0 +1,11 @@
+/** What the server calls around its responses to keep its store connection. */
+export interface StoreHolder {
+    hold: () => void;
+    afterResponse: () => void;
+    release: () => Promise<void>;
+    /** Runs one request, inside the fence that keeps hippo.db shut when the store is not it. */
+    runRequest: (run: () => Promise<void>) => Promise<void>;
+}
+/** Holds a connection to the hippo.db under `hippoRoot` once it exists, so serving never creates one. */
+export declare function holdSqliteConnection(hippoRoot: string): StoreHolder;
+//# sourceMappingURL=held-connection.d.ts.map

package/dist/store/sqlite/held-connection.js

@@ -0,0 +1,41 @@
+// A served hippo.db keeps one connection open for the life of the server, beside the worker that checkpoints its WAL.
+import { existsSync } from 'node:fs';
+import { closeHippoDb, getHippoDbPath, openHippoDb, outsideRequestStores, outsideSqliteOffLoop, SERVER_DB_WAIT_MS, } from '../../db/index.js';
+import { startWalCheckpointer } from '../../db/wal-checkpointer.js';
+import { errorMessage, log } from '../../util/log.js';
+/** Holds a connection to the hippo.db under `hippoRoot` once it exists, so serving never creates one. */
+export function holdSqliteConnection(hippoRoot) {
+    // Handlers open and close their own connections; while this one is held, none of those closes is SQLite's last,
+    // which checkpoints and deletes the WAL.
+    let heldDb;
+    let checkpointer;
+    let stopHolding = false;
+    const hold = () => {
+        if (heldDb || stopHolding || !existsSync(getHippoDbPath(hippoRoot)))
+            return;
+        try {
+            // The 'finish' listener can fire inside a request scope (closing this connection with the request) and inside a `loop: 'off'` block (refusing the open).
+            // The server's lock wait: this open runs on the event loop, where SQLite's 5 s default and the 30 s journal-mode retry would stall every request.
+            heldDb = outsideSqliteOffLoop(() => outsideRequestStores(() => openHippoDb(hippoRoot, { busyWaitMs: SERVER_DB_WAIT_MS })));
+            checkpointer = startWalCheckpointer(getHippoDbPath(hippoRoot));
+        }
+        catch (err) {
+            stopHolding = true;
+            log.warn(`serve: could not hold a store connection; requests still work, only slower: ${errorMessage(err)}`);
+        }
+    };
+    const afterResponse = () => {
+        hold();
+        checkpointer?.noteResponse();
+    };
+    const release = async () => {
+        stopHolding = true;
+        // The worker's connection closes first, so the held one is SQLite's last and its close checkpoints and deletes the WAL.
+        await checkpointer?.stop();
+        if (heldDb)
+            closeHippoDb(heldDb);
+        heldDb = undefined;
+    };
+    return { hold, afterResponse, release, runRequest: (run) => run() };
+}
+//# sourceMappingURL=held-connection.js.map

package/dist/store/sqlite/last-recall-group.d.ts

@@ -0,0 +1,13 @@
+import type { LastRecall, RecallWrites, Sync } from '../port.js';
+/** What a finished recall wrote after its audit rows: the trace's id, null when none was asked or its write failed, and the ids strengthened. */
+interface RecallFinish {
+    readonly traceId: number | null;
+    readonly strengthened: ReadonlySet<string>;
+}
+/** sqliteStore's finishRecall, for the synchronous recall that cannot await the port. */
+export declare function finishRecallAt(hippoRoot: string, writes: RecallWrites): RecallFinish;
+export declare function sqliteLastRecall(hippoRoot: string): Sync<LastRecall>;
+/** The group as a served store answers it: the call runs at once and resolves through a Promise, so a throw rejects as another store's would. */
+export declare function servedLastRecall(sync: Sync<LastRecall>): LastRecall;
+export {};
+//# sourceMappingURL=last-recall-group.d.ts.map

package/dist/store/sqlite/last-recall-group.js

@@ -0,0 +1,57 @@
+// hippo.db's LastRecall group: the last recall sits in its meta table, and a traced outcome links on the outcome's own handle.
+import { withWriteScope } from '../../db/index.js';
+import { appendAuditEvent } from '../audit.js';
+import { strengthenRetrieved, strengthenRetrievedInOwnTx } from '../entry-writes.js';
+import { localGoalRecallRows, writeGoalRecallLog } from '../goals.js';
+import { loadLastRecall, saveIndex } from '../index-and-stats.js';
+import { onHandle } from '../open.js';
+import { writeRecallTrace } from '../recall-trace.js';
+import { applyOutcomeAt } from './entry-writes-group.js';
+/** sqliteStore's finishRecall, for the synchronous recall that cannot await the port. */
+export function finishRecallAt(hippoRoot, writes) {
+    return onHandle(hippoRoot, (db) => {
+        const traceAndStrengthen = () => ({
+            traceId: writes.trace ? writeRecallTrace(db, writes.trace) : null,
+            strengthened: writes.strengthen ? strengthenRetrievedInOwnTx(db, writes.strengthen.ids, writes.strengthen.opts) : new Set(),
+        });
+        // Alone, the fail-soft trace and strengthen keep their own scopes so a busy lock loses them, never the read.
+        if (writes.goalLog.length === 0 && writes.audit.length === 0)
+            return traceAndStrengthen();
+        // Inside this scope both run as savepoints, so one recall commits once and a failed trace or strengthen still unwinds alone.
+        return withWriteScope(db, 'finish_recall', () => {
+            writeGoalRecallLog(db, localGoalRecallRows(db, writes.goalLog));
+            for (const event of writes.audit)
+                appendAuditEvent(db, event);
+            return traceAndStrengthen();
+        });
+    });
+}
+export function sqliteLastRecall(hippoRoot) {
+    return {
+        applyTracedOutcome: (outcome, traceId) => applyOutcomeAt(hippoRoot, outcome, traceId),
+        applyOutcomeToLast(target, good) {
+            const { last_retrieval_ids: ids, last_trace_id: trace } = loadLastRecall(hippoRoot);
+            if (ids.length === 0)
+                return [];
+            return applyOutcomeAt(hippoRoot, { ...target, ids, good }, trace === null ? undefined : Number(trace));
+        },
+        finishRecall(writes, globalRoot) {
+            const { ids, opts } = writes.strengthen;
+            const { traceId, strengthened } = finishRecallAt(hippoRoot, writes);
+            if (globalRoot !== undefined)
+                strengthenRetrieved(globalRoot, ids.filter((id) => !strengthened.has(id)), opts);
+            // One write for both keys, so an outcome never pairs these ids with an older trace; a lost trace saves null.
+            saveIndex(hippoRoot, { last_retrieval_ids: [...ids], last_trace_id: traceId === null ? null : String(traceId) });
+            return traceId;
+        },
+    };
+}
+/** The group as a served store answers it: the call runs at once and resolves through a Promise, so a throw rejects as another store's would. */
+export function servedLastRecall(sync) {
+    return {
+        applyTracedOutcome: async (outcome, traceId) => sync.applyTracedOutcome(outcome, traceId),
+        applyOutcomeToLast: async (target, good) => sync.applyOutcomeToLast(target, good),
+        finishRecall: async (writes, globalRoot) => sync.finishRecall(writes, globalRoot),
+    };
+}
+//# sourceMappingURL=last-recall-group.js.map

package/dist/store/sqlite/local.d.ts

@@ -1,21 +1,4 @@
 import { type ScopeGrantChange } from '../key-writes.js';
-import type { EntryTarget, OutcomeWrite, RecallWrites } from '../port.js';
-/** A recall's writes when hippo.db keeps it as its last one: `strengthen.ids` are the ids it returned. */
-type LastRecallWrites = RecallWrites & Required<Pick<RecallWrites, 'strengthen'>>;
-/** The port's writes with a part that needs hippo.db's own handle or its meta table, which no other store has. */
-export interface SqliteLocal {
-    /** entryWrites.applyOutcome, then a link from the recall trace to the ids applied, on the same handle after the commit. */
-    applyOutcome(outcome: OutcomeWrite, traceId: number): string[];
-    /** applyOutcome on the ids of the last recall, which hippo.db's meta table holds with that recall's trace; answers the ids applied. */
-    applyOutcomeToLastRecall(target: EntryTarget, good: boolean): string[];
-    /** finishRecall, then the ids this root lacks strengthened under `globalRoot`, then the ids and their trace saved as the last recall;
-     *  answers the trace id. A store of another kind keeps no last recall, so its stand-in is its own finishRecall, answering null. */
-    finishLastRecall(writes: LastRecallWrites, globalRoot: string | undefined): number | null | Promise<number | null>;
-}
-export declare function sqliteLocal(hippoRoot: string): SqliteLocal;
-/** What a served store answers for each write that needs hippo.db's own handle: a refusal. */
-export declare const REFUSED_ON_A_STORE: Pick<SqliteLocal, 'applyOutcome'>;
 /** Off the port: only the local CLI changes grants, through synchronous published functions a store's Promise cannot answer. */
 export declare function changeScopeGrant(hippoRoot: string, change: ScopeGrantChange): void;
-export {};
 //# sourceMappingURL=local.d.ts.map

package/dist/store/sqlite/local.js

@@ -1,37 +1,6 @@
 // What only hippo.db does: operations no port method covers, so they never run on another store.
-import { strengthenRetrieved } from '../entry-writes.js';
-import { loadLastRecall, saveIndex } from '../index-and-stats.js';
 import { changeScopeGrantAt } from '../key-writes.js';
 import { onHandle } from '../open.js';
-import { applyOutcomeAt } from './entry-writes-group.js';
-import { finishRecallAt } from './store.js';
-export function sqliteLocal(hippoRoot) {
-    return {
-        applyOutcome: (outcome, traceId) => applyOutcomeAt(hippoRoot, outcome, traceId),
-        // The ids and the trace come from one statement, so the outcome is linked to the recall that returned those ids.
-        applyOutcomeToLastRecall(target, good) {
-            const { last_retrieval_ids: ids, last_trace_id: trace } = loadLastRecall(hippoRoot);
-            if (ids.length === 0)
-                return [];
-            return applyOutcomeAt(hippoRoot, { ...target, ids, good }, trace === null ? undefined : Number(trace));
-        },
-        finishLastRecall(writes, globalRoot) {
-            const { ids, opts } = writes.strengthen;
-            const { traceId, strengthened } = finishRecallAt(hippoRoot, writes);
-            if (globalRoot !== undefined)
-                strengthenRetrieved(globalRoot, ids.filter((id) => !strengthened.has(id)), opts);
-            // One write for both keys, so an outcome never pairs these ids with an older trace; a lost trace saves null.
-            saveIndex(hippoRoot, { last_retrieval_ids: [...ids], last_trace_id: traceId === null ? null : String(traceId) });
-            return traceId;
-        },
-    };
-}
-/** What a served store answers for each write that needs hippo.db's own handle: a refusal. */
-export const REFUSED_ON_A_STORE = {
-    applyOutcome() {
-        throw new Error('an outcome links its recall trace on hippo.db only, never through a store');
-    },
-};
 /** Off the port: only the local CLI changes grants, through synchronous published functions a store's Promise cannot answer. */
 export function changeScopeGrant(hippoRoot, change) {
     onHandle(hippoRoot, (db) => changeScopeGrantAt(db, change));

package/dist/store/sqlite/maintenance-groups.d.ts

@@ -0,0 +1,6 @@
+import type { AuditMaintenance, LessonWrites, Sync } from '../port.js';
+export declare function sqliteAuditMaintenance(hippoRoot: string): Sync<AuditMaintenance>;
+export declare function servedAuditMaintenance(sync: Sync<AuditMaintenance>): AuditMaintenance;
+export declare function sqliteLessonWrites(hippoRoot: string): Sync<LessonWrites>;
+export declare function servedLessonWrites(sync: Sync<LessonWrites>): LessonWrites;
+//# sourceMappingURL=maintenance-groups.d.ts.map

package/dist/store/sqlite/maintenance-groups.js

@@ -0,0 +1,60 @@
+// hippo.db's half of the AuditMaintenance and LessonWrites store groups: the quality audit, audit prune and git learn's batch.
+import { pruneAuditRows } from '../audit.js';
+import { loadTextsHoldingWords } from '../candidates.js';
+import { deleteEntriesAutomatically, memoriesBackingObjects } from '../delete-and-batch.js';
+import { loadAllEntries } from '../entry-reads.js';
+import { writeEntriesSkippingRejected, writeEntriesTogether } from '../entry-writes.js';
+import { updateStats } from '../index-and-stats.js';
+import { repairAutomaticMemories, repairQualityOnce } from '../quality-repair.js';
+import { touchableScopeSql } from '../rule-sql.js';
+export function sqliteAuditMaintenance(hippoRoot) {
+    return {
+        tenantEntries: (tenantId) => loadAllEntries(hippoRoot, tenantId),
+        objectBackedIds: () => memoriesBackingObjects(hippoRoot),
+        deleteAutomatically: (removals, actor) => deleteEntriesAutomatically(hippoRoot, removals, actor),
+        pruneAuditRows: (prune) => pruneAuditRows(hippoRoot, prune),
+        repairQuality: (tenantId, apply) => repairAutomaticMemories(hippoRoot, { tenantId, apply }),
+        repairQualityOnce: (tenantId) => repairQualityOnce(hippoRoot, tenantId),
+    };
+}
+export function servedAuditMaintenance(sync) {
+    return {
+        tenantEntries: async (tenantId) => sync.tenantEntries(tenantId),
+        objectBackedIds: async () => sync.objectBackedIds(),
+        deleteAutomatically: async (removals, actor) => sync.deleteAutomatically(removals, actor),
+        pruneAuditRows: async (prune) => sync.pruneAuditRows(prune),
+        repairQuality: async (tenantId, apply) => sync.repairQuality(tenantId, apply),
+        repairQualityOnce: async (tenantId) => sync.repairQualityOnce(tenantId),
+    };
+}
+export function sqliteLessonWrites(hippoRoot) {
+    return {
+        tenantEntries: (tenantId) => loadAllEntries(hippoRoot, tenantId),
+        textsHoldingWords: (tenantId, words, ownScope) => loadTextsHoldingWords(hippoRoot, tenantId, words, undefined, touchableScopeSql('', ownScope)),
+        writeSkippingRejected(entries, actor) {
+            const written = [];
+            writeEntriesSkippingRejected(hippoRoot, (put) => {
+                for (const entry of entries)
+                    if (put(entry))
+                        written.push(entry.id);
+            }, actor);
+            return written;
+        },
+        writeTogether(entries) {
+            writeEntriesTogether(hippoRoot, entries);
+        },
+        bumpRemembered(count) {
+            updateStats(hippoRoot, { remembered: count });
+        },
+    };
+}
+export function servedLessonWrites(sync) {
+    return {
+        tenantEntries: async (tenantId) => sync.tenantEntries(tenantId),
+        textsHoldingWords: async (tenantId, words, ownScope) => sync.textsHoldingWords(tenantId, words, ownScope),
+        writeSkippingRejected: async (entries, actor) => sync.writeSkippingRejected(entries, actor),
+        writeTogether: async (entries) => sync.writeTogether(entries),
+        bumpRemembered: async (count) => sync.bumpRemembered(count),
+    };
+}
+//# sourceMappingURL=maintenance-groups.js.map

package/dist/store/sqlite/object-rows.d.ts

@@ -1,7 +1,7 @@
 import type { AuditOp } from '../audit.js';
 import type { JsonObject } from '../working-memory.js';
 import type { SourceObjectType } from '../graph-rows.js';
-import type { BriefStatus, DecisionStatus, IncidentStatus, NoteStatus, ObjectByKind, ObjectFields, ObjectKind, PolicyStatus, ProcessStatus, SavableKind, SkillStatus } from '../object-types.js';
+import type { BriefStatus, DecisionStatus, IncidentStatus, NoteStatus, ObjectByKind, ObjectFields, ObjectKind, PolicyStatus, ProcessStatus, SavableKind, SkillStatus } from '../../core/object-types.js';
 interface HeadRow {
     id: number;
     memory_id: string | null;

package/dist/store/sqlite/objects-group.d.ts

@@ -1,4 +1,4 @@
-import type { BriefReceipt, Incident, ObjectByKind, ObjectKind, Policy, SavableKind, Skill } from '../object-types.js';
+import type { BriefReceipt, Incident, ObjectByKind, ObjectKind, Policy, SavableKind, Skill } from '../../core/object-types.js';
 import { type IncidentOpen, type IncidentOpenRefusal, type IncidentResolve, type ObjectClose, type ObjectListQuery, type ObjectRefusal, type Objects, type ObjectSave, type PoliciesInForceQuery } from '../port.js';
 /** The group with each answer as its value; spelled out because `Sync<Objects>` would widen each method's kind to every kind. */
 export interface SyncObjects {

package/dist/store/sqlite/objects-group.js

@@ -3,8 +3,9 @@ import { appendAuditEvent } from '../audit.js';
 import { getMeta, withWriteScopeOr } from '../../db/index.js';
 import { escapeLike } from '../../util/escape.js';
 import { keysetAfter } from '../../util/keyset.js';
+import { chunked } from '../../util/chunked.js';
 import { calculateStrength, deriveHalfLife } from '../../core/memory.js';
-import { scopeAdmitSql } from '../recall-scope.js';
+import { scopeAdmitSql } from '../rule-sql.js';
 import { stampOriginProject, upsertEntryRow } from '../entry-row.js';
 import { auditEntryWrite, writeEntryMirrors } from '../entry-writes.js';
 import { markGraphDirty } from '../graph-queue.js';
@@ -13,6 +14,7 @@ import { LEGACY_TYPED_HALF_LIFE, onHandle, openStore, TYPED_HALF_LIFE_META_KEY }
 import { isObjectRefusal, } from '../port.js';
 import { auditingRefusal } from './entry-writes-group.js';
 import { insertSpec, rowSpec } from './object-rows.js';
+import { placeholders } from '../../util/sql.js';
 export function sqliteObjects(hippoRoot) {
     return {
         listObjects: (tenantId, kind, query) => onHandle(hippoRoot, (db) => listRows(db, tenantId, kind, query)),
@@ -80,7 +82,7 @@ function listRows(db, tenantId, kind, query) {
 function closeRow(db, tenantId, kind, id, close) {
     const spec = rowSpec(kind);
     return withWriteScopeOr(db, 'close_object', (rollback) => {
-        const marks = close.from.map(() => '?').join(', ');
+        const marks = placeholders(close.from.length);
         const updated = db.prepare(`UPDATE ${spec.table} SET status = 'closed', closed_at = ? WHERE id = ? AND tenant_id = ? AND status IN (${marks})`).run(close.at, id, tenantId, ...close.from);
         if (updated.changes === 0) {
             const existing = db.prepare(`SELECT status FROM ${spec.table} WHERE id = ? AND tenant_id = ?`)
@@ -126,7 +128,7 @@ function insertRow(db, row) {
     }
     const result = db.prepare(`
     INSERT INTO ${rowSpec(row.kind).table}(${cols.join(', ')}, status, superseded_by, superseded_at, closed_at, created_at)
-    VALUES (${cols.map(() => '?').join(', ')}, 'active', NULL, NULL, NULL, ?)
+    VALUES (${placeholders(cols.length)}, 'active', NULL, NULL, NULL, ?)
   `).run(...values, row.save.at);
     return Number(result.lastInsertRowid ?? 0);
 }
@@ -217,11 +219,17 @@ function saveAt(hippoRoot, tenantId, kind, save) {
 /** The linked ids are checked once the mirror is in and before the INSERT, so a refusal undoes the mirror with it. */
 function openIncidentRow(db, tenantId, memoryId, open) {
     const { incidentText, context, linkedMemoryIds } = open.fields;
-    for (const linkId of linkedMemoryIds) {
-        const held = db.prepare(`SELECT id FROM memories WHERE id = ? AND tenant_id = ?`).get(linkId, tenantId);
-        if (!held)
-            return { refused: 'unlinked', memoryId: linkId };
+    const held = new Set();
+    for (const ids of chunked(linkedMemoryIds)) {
+        const marks = placeholders(ids.length);
+        // SAFETY: rows' shape matches the one column named in the SELECT.
+        const found = db.prepare(`SELECT id FROM memories WHERE tenant_id = ? AND id IN (${marks})`).all(tenantId, ...ids);
+        for (const r of found)
+            held.add(r.id);
     }
+    const missing = linkedMemoryIds.find((linkId) => !held.has(linkId));
+    if (missing !== undefined)
+        return { refused: 'unlinked', memoryId: missing };
     const result = db.prepare(`
     INSERT INTO incidents(
       memory_id, tenant_id, incident_text, context,

package/dist/store/sqlite/store.d.ts

@@ -1,4 +1,4 @@
-import type { HippoStore, RecallWrites, StoreGroups, Sync } from '../port.js';
+import type { HippoStore, StoreGroups, Sync } from '../port.js';
 /** The store a request runs on: the served one, else hippo.db under its root, as the CLI and SDK callers have it. */
 export declare function storeFor(ctx: {
     readonly hippoRoot: string;
@@ -12,12 +12,5 @@ export type SqliteSyncStore = Sync<Omit<HippoStore, AsyncOnly>>;
 export declare function sqliteSyncStore(hippoRoot: string): SqliteSyncStore & Sync<Omit<StoreGroups, AsyncOnly>>;
 /** `sqliteSyncStore` as a served store: each method runs at once and answers through a Promise, so a throw rejects as another store's would. */
 export declare function sqliteStore(hippoRoot: string): HippoStore & StoreGroups;
-/** What a finished recall wrote after its audit rows: the trace's id, null when none was asked or its write failed, and the ids strengthened. */
-interface RecallFinish {
-    readonly traceId: number | null;
-    readonly strengthened: ReadonlySet<string>;
-}
-/** sqliteStore's finishRecall, for the synchronous recall that cannot await the port. */
-export declare function finishRecallAt(hippoRoot: string, writes: RecallWrites): RecallFinish;
 export {};
 //# sourceMappingURL=store.d.ts.map

package/dist/store/sqlite/store.js

@@ -4,17 +4,17 @@ import { listApiKeyRows, readApiKeyRecord } from '../auth.js';
 import { existsSync } from 'node:fs';
 import { appendAuditEvent, listAuditEventsAfter, queryAuditEvents } from '../audit.js';
 import { getHippoDbPath, withWriteScope } from '../../db/index.js';
-import { activeGoalsWithPolicies, localGoalRecallRows, writeGoalRecallLog } from '../goals.js';
+import { activeGoalsWithPolicies } from '../goals.js';
 import { planningFallacyEvidenceAt } from '../planning-fallacy-evidence.js';
-import { writeRecallTrace } from '../recall-trace.js';
 import { recordTokenUse } from '../token-ledger.js';
 import { loadAmbientCandidates, loadContextCandidates } from '../candidates.js';
 import { loadEntriesByIds, loadFreshRawMemories } from '../entry-reads.js';
-import { strengthenRetrievedInOwnTx } from '../entry-writes.js';
 import { servedConnectorEvents, sqliteConnectorEvents } from './connector-events-group.js';
 import { servedConnectorWrites, sqliteConnectorWrites } from './connector-writes-group.js';
 import { sqliteDagReads } from './dag-reads-group.js';
 import { sqliteEntryWrites } from './entry-writes-group.js';
+import { servedAuditMaintenance, servedLessonWrites, sqliteAuditMaintenance, sqliteLessonWrites } from './maintenance-groups.js';
+import { finishRecallAt, servedLastRecall, sqliteLastRecall } from './last-recall-group.js';
 import { servedGraphReads, sqliteGraphReads } from './graph-reads-group.js';
 import { servedObjects, sqliteObjects } from './objects-group.js';
 import { servedPredictions, sqlitePredictions } from './predictions-group.js';
@@ -25,7 +25,7 @@ import { updateStats } from '../index-and-stats.js';
 import { auditHighIdAt, revokeKeyAt } from '../key-audit.js';
 import { createKeyAt, createSelfKeyAt } from '../key-writes.js';
 import { onHandle } from '../open.js';
-import { loadRecallSearchEntries } from '../search-rows.js';
+import { loadRecallEntries } from '../search-rows.js';
 import { listSessionEvents, loadActiveTaskSnapshot } from '../sessions.js';
 import { entriesWithoutVectorAt, loadStoredVectorViews, writeVectorsAt } from '../vector-index.js';
 /** The store a request runs on: the served one, else hippo.db under its root, as the CLI and SDK callers have it. */
@@ -36,6 +36,7 @@ export function storeFor(ctx) {
 export function sqliteSyncStore(hippoRoot) {
     return {
         kind: 'sqlite',
+        localFiles: { hippoRoot },
         ...sqliteBaseReads(hippoRoot),
         ...sqliteRecallWrites(hippoRoot),
         keyAudit: sqliteKeyAudit(hippoRoot),
@@ -53,6 +54,9 @@ export function sqliteSyncStore(hippoRoot) {
         connectorEvents: sqliteConnectorEvents(hippoRoot),
         objects: sqliteObjects(hippoRoot),
         readiness: sqliteReadiness(hippoRoot),
+        lastRecall: sqliteLastRecall(hippoRoot),
+        auditMaintenance: sqliteAuditMaintenance(hippoRoot),
+        lessonWrites: sqliteLessonWrites(hippoRoot),
         close() { },
     };
 }
@@ -62,7 +66,7 @@ function sqliteBaseReads(hippoRoot) {
             return onHandle(hippoRoot, (db) => readApiKeyRecord(db, keyId));
         },
         searchRecallEntries(query, args) {
-            return loadRecallSearchEntries(hippoRoot, query, args.limit, args.tenantId, args.requestedScope, args.explicitScopeMode, args.includeSuperseded, args.originProjects, args.ownScope);
+            return loadRecallEntries(hippoRoot, query, args);
         },
         entriesByIds(ids, tenantId) {
             return loadEntriesByIds(hippoRoot, ids, tenantId);
@@ -141,6 +145,7 @@ export function sqliteStore(hippoRoot) {
     const sync = sqliteSyncStore(hippoRoot);
     return {
         ...servedBaseMethods(sync),
+        localFiles: sync.localFiles,
         vectors: sqliteVectorReads(hippoRoot),
         vectorViews: { storedVectorViews: async (ids) => sync.vectorViews.storedVectorViews(ids) },
         ...servedKeyGroups(sync),
@@ -153,6 +158,9 @@ export function sqliteStore(hippoRoot) {
         connectorEvents: servedConnectorEvents(sync.connectorEvents),
         objects: servedObjects(sqliteObjects(hippoRoot)),
         readiness: { ping: async () => sync.readiness.ping() },
+        lastRecall: servedLastRecall(sync.lastRecall),
+        auditMaintenance: servedAuditMaintenance(sync.auditMaintenance),
+        lessonWrites: servedLessonWrites(sync.lessonWrites),
         close: async () => sync.close(),
     };
 }
@@ -274,21 +282,4 @@ function continuityAt(hippoRoot, tenantId, eventLimit, key) {
         recentSessionEvents: sessionId ? listSessionEvents(hippoRoot, tenantId, { session_id: sessionId, limit: eventLimit }) : [],
     };
 }
-/** sqliteStore's finishRecall, for the synchronous recall that cannot await the port. */
-export function finishRecallAt(hippoRoot, writes) {
-    return onHandle(hippoRoot, (db) => {
-        // With no row to write the scope would only take the write lock.
-        if (writes.goalLog.length > 0 || writes.audit.length > 0) {
-            withWriteScope(db, 'finish_recall', () => {
-                writeGoalRecallLog(db, localGoalRecallRows(db, writes.goalLog));
-                for (const event of writes.audit)
-                    appendAuditEvent(db, event);
-            });
-        }
-        // Each opens its own transaction, so neither can share the scope above.
-        const traceId = writes.trace ? writeRecallTrace(db, writes.trace) : null;
-        const strengthened = writes.strengthen ? strengthenRetrievedInOwnTx(db, writes.strengthen.ids, writes.strengthen.opts) : new Set();
-        return { traceId, strengthened };
-    });
-}
 //# sourceMappingURL=store.js.map

package/dist/store/summaries.d.ts

@@ -2,11 +2,18 @@ import type { MemoryEntry } from '../core/memory.js';
 /** Host-wide loader for L2 topic summaries without an L3 parent, for consolidate phase 1.9 (buildEntityProfiles); SQL-level filter, since in-memory
  * `survivors` lacks L2s created by phase 1.7. Entries carry tenantId so per-cluster writes stay tenant-scoped. */
 export declare function loadAllL2Summaries(hippoRoot: string): MemoryEntry[];
-/** Dirty summaries across all tenants in one query, newest change first (latest_at DESC NULLS LAST, id ASC) so HIPPO_DAG_REBUILD_CAP takes the most
- * recently changed. Each entry carries its own tenantId so the children read and rebuild UPDATE stay tenant-scoped. */
-export declare function loadAllDirtySummaries(hippoRoot: string): MemoryEntry[];
+/** Dirty summaries across all tenants, newest change first (latest_at DESC NULLS LAST, id ASC), at most `limit` (all when omitted)
+ * so HIPPO_DAG_REBUILD_CAP reads only the most recently changed. Each entry carries its tenantId so later writes stay tenant-scoped. */
+export declare function loadAllDirtySummaries(hippoRoot: string, limit?: number): MemoryEntry[];
 /** Live (non-archived) children of a DAG summary, so a rebuild regenerates from the CURRENT child set; tenant-scoped as defence in depth. */
 export declare function loadChildrenOfSummary(hippoRoot: string, summaryId: string, tenantId: string): MemoryEntry[];
+/** loadChildrenOfSummary for many summaries in one IN query per tenant chunk; the map key is `${tenantId}\u0000${summaryId}`, each list in created order. */
+export declare function loadChildrenOfSummaries(hippoRoot: string, summaries: ReadonlyArray<{
+    id: string;
+    tenant_id: string;
+}>): Map<string, MemoryEntry[]>;
+/** Key into the map loadChildrenOfSummaries returns. */
+export declare function childrenKey(tenantId: string, summaryId: string): string;
 /** Patch applied by applyRebuildResult; `bumpRebuildCount` is false for the zero-child case, true for a normal rebuild. */
 export interface RebuildPatch {
     content: string;

package/dist/store/summaries.js

@@ -6,7 +6,9 @@ import { MEMORY_SELECT_COLUMNS, rowToEntry } from './rows.js';
 import { audit } from './audit-event.js';
 import { syncFtsRow } from './entry-row.js';
 import { onHandle, openStore } from './open.js';
+import { chunked } from '../util/chunked.js';
 import { DIGEST_DISPLAY_CHARS } from '../util/token-text.js';
+import { placeholders } from '../util/sql.js';
 // Sleep-cycle rebuild surface: lives here, not in src/consolidate/dag.ts, because it needs module-private MEMORY_SELECT_COLUMNS, MemoryRow, rowToEntry,
 // audit, syncFtsRow and assertTenantId. dag.ts keeps only the thin orchestrator rebuildDirtySummaries().
 /** Host-wide loader for L2 topic summaries without an L3 parent, for consolidate phase 1.9 (buildEntityProfiles); SQL-level filter, since in-memory
@@ -27,9 +29,9 @@ export function loadAllL2Summaries(hippoRoot) {
         return rows.map(rowToEntry);
     }, openStore);
 }
-/** Dirty summaries across all tenants in one query, newest change first (latest_at DESC NULLS LAST, id ASC) so HIPPO_DAG_REBUILD_CAP takes the most
- * recently changed. Each entry carries its own tenantId so the children read and rebuild UPDATE stay tenant-scoped. */
-export function loadAllDirtySummaries(hippoRoot) {
+/** Dirty summaries across all tenants, newest change first (latest_at DESC NULLS LAST, id ASC), at most `limit` (all when omitted)
+ * so HIPPO_DAG_REBUILD_CAP reads only the most recently changed. Each entry carries its tenantId so later writes stay tenant-scoped. */
+export function loadAllDirtySummaries(hippoRoot, limit) {
     return onHandle(hippoRoot, (db) => {
         // SAFETY: this query selects exactly MEMORY_SELECT_COLUMNS, matching
         // MemoryRow's field set.
@@ -39,7 +41,8 @@ export function loadAllDirtySummaries(hippoRoot) {
        WHERE summary_dirty = 1
          AND kind != 'archived'
        ORDER BY latest_at DESC NULLS LAST, id ASC
-    `).all();
+       LIMIT ?
+    `).all(limit ?? -1);
         return rows.map(rowToEntry);
     }, openStore);
 }
@@ -61,10 +64,50 @@ export function loadChildrenOfSummary(hippoRoot, summaryId, tenantId) {
         return rows.map(rowToEntry);
     }, openStore);
 }
+/** loadChildrenOfSummary for many summaries in one IN query per tenant chunk; the map key is `${tenantId}\u0000${summaryId}`, each list in created order. */
+export function loadChildrenOfSummaries(hippoRoot, summaries) {
+    const byTenant = new Map();
+    for (const s of summaries) {
+        assertTenantId('loadChildrenOfSummaries', s.tenant_id);
+        const ids = byTenant.get(s.tenant_id) ?? [];
+        ids.push(s.id);
+        byTenant.set(s.tenant_id, ids);
+    }
+    const out = new Map();
+    onHandle(hippoRoot, (db) => {
+        for (const [tenantId, ids] of byTenant) {
+            for (const slice of chunked(ids)) {
+                // SAFETY: this query selects exactly MEMORY_SELECT_COLUMNS, matching MemoryRow's field set.
+                const rows = db.prepare(`
+          SELECT ${MEMORY_SELECT_COLUMNS}
+            FROM memories
+           WHERE dag_parent_id IN (${placeholders(slice.length)})
+             AND tenant_id = ?
+             AND kind != 'archived'
+             AND superseded_by IS NULL
+           ORDER BY created ASC
+        `).all(...slice, tenantId);
+                for (const entry of rows.map(rowToEntry)) {
+                    const key = childrenKey(tenantId, entry.dag_parent_id ?? '');
+                    const list = out.get(key);
+                    if (list)
+                        list.push(entry);
+                    else
+                        out.set(key, [entry]);
+                }
+            }
+        }
+    }, openStore);
+    return out;
+}
+/** Key into the map loadChildrenOfSummaries returns. */
+export function childrenKey(tenantId, summaryId) {
+    return `${tenantId}\u0000${summaryId}`;
+}
 /** Apply a rebuild result to a dirty summary in one write scope (UPDATE plus syncFtsRow); `AND summary_dirty = 1` makes a concurrent race-loser a no-op.
  * Returns `{ changed, refused }`: `refused` only when a tombstone hit suppressed the content write while the metadata UPDATE still landed. */
 export function applyRebuildResult(hippoRoot, summary, patch) {
-    assertTenantId('applyRebuildResult', summary.tenantId);
+    assertTenantId('applyRebuildResult', summary.tenant_id);
     return onHandle(hippoRoot, (db) => {
         return withWriteScope(db, 'rebuild_summary', () => applyRebuildInSavepoint(db, summary, patch));
     }, openStore);
@@ -98,14 +141,14 @@ function applyRebuildInSavepoint(db, summary, patch) {
     // Check tombstones before choosing the UPDATE: this direct UPDATE bypasses upsertEntryRow's guard, and
     // a deterministic rebuild would otherwise re-assert a rejected value every sleep cycle.
     const tombstone = patch.bumpRebuildCount
-        ? findRejectedValue(db, summary.tenantId, rejectionDigest(patch.content))
+        ? findRejectedValue(db, summary.tenant_id, rejectionDigest(patch.content))
         : null;
     // On a tombstone hit, write no content: take the zero-child metadata-only path (descendant_count/earliest_at/latest_at, summary_dirty cleared, no
     // rebuild_count bump). Clearing dirty is deliberate: leaving it set would make every later sleep re-attempt and re-refuse the same rebuild forever.
     const applyContentWrite = patch.bumpRebuildCount && !tombstone;
     const result = applyContentWrite
-        ? db.prepare(REBUILD_CONTENT_SQL).run(patch.content, patch.descendant_count, patch.earliest_at, patch.latest_at, nowIso, summary.id, summary.tenantId)
-        : db.prepare(REBUILD_METADATA_SQL).run(patch.descendant_count, patch.earliest_at, patch.latest_at, summary.id, summary.tenantId);
+        ? db.prepare(REBUILD_CONTENT_SQL).run(patch.content, patch.descendant_count, patch.earliest_at, patch.latest_at, nowIso, summary.id, summary.tenant_id)
+        : db.prepare(REBUILD_METADATA_SQL).run(patch.descendant_count, patch.earliest_at, patch.latest_at, summary.id, summary.tenant_id);
     // `changed` means THIS call's UPDATE hit a row, so a refusal still settles the cycle (false would retry
     // the doomed rebuild forever); `refused` lets the caller count it as refused rather than rebuilt.
     const changed = (result.changes ?? 0) > 0;
@@ -124,7 +167,7 @@ function auditRefusedRebuild(db, summary, patch, tombstone) {
         targetId: summary.id,
         metadata: { digest: tombstone.digest, reason: tombstone.reason },
         actor: patch.actor,
-        tenantId: summary.tenantId
+        tenantId: summary.tenant_id
     });
     log.warn(`applyRebuildResult: refused rebuild content for ${summary.id} — matches a rejected value ` +
         `(digest ${tombstone.digest.slice(0, DIGEST_DISPLAY_CHARS)}...); metadata updated, content unchanged`);
@@ -138,7 +181,7 @@ function syncRebuiltSummary(db, summary, patch, applyContentWrite, nowIso) {
         descendant_count: patch.descendant_count,
         earliest_at: patch.earliest_at,
         latest_at: patch.latest_at,
-        summary_dirty: 0,
+        summary_dirty: false,
         last_rebuilt_at: applyContentWrite ? nowIso : summary.last_rebuilt_at,
         rebuild_count: applyContentWrite
             ? (summary.rebuild_count ?? 0) + 1
@@ -151,7 +194,7 @@ function syncRebuiltSummary(db, summary, patch, applyContentWrite, nowIso) {
             source: 'E3-rebuild',
             zero_children: patch.zeroChildren,
             descendant_count: patch.descendant_count,
-        }, actor: patch.actor, tenantId: summary.tenantId });
+        }, actor: patch.actor, tenantId: summary.tenant_id });
 }
 /** Clear summary_dirty on a new summary after buildDag's child-link loop (each member's writeEntry marks the parent dirty, so the same cycle would rebuild it).
  * Idempotent (no-op, no audit if not dirty); audit source='buildDag-clean' distinguishes it from the rebuild's. */

package/dist/store/token-ledger-rows.js

@@ -1,3 +1,4 @@
+import { placeholders } from '../util/sql.js';
 export function insertTokenRow(db, row) {
     db.prepare(`INSERT INTO token_ledger (ts, tenant_id, session_id, surface, event, items, tokens, block_hash)
      VALUES (?, ?, ?, ?, ?, ?, ?, ?)`).run(row.ts, row.tenantId, row.sessionId, row.surface, row.event, row.items, row.tokens, row.blockHash);
@@ -34,7 +35,7 @@ export function surfaceTotals(db, tenantId, sinceIso) {
 export function sessionTotals(db, tenantId, sinceIso, rereadSurfaces) {
     // SAFETY: the SELECT names exactly these four aggregate columns.
     return db.prepare(`SELECT COUNT(DISTINCT session_id) AS sessions,
-            COUNT(DISTINCT CASE WHEN event <> 'reset' AND surface IN (${rereadSurfaces.map(() => '?').join(', ')}) THEN session_id END) AS hook_sessions,
+            COUNT(DISTINCT CASE WHEN event <> 'reset' AND surface IN (${placeholders(rereadSurfaces.length)}) THEN session_id END) AS hook_sessions,
             COUNT(DISTINCT CASE WHEN event = 'reread' THEN session_id END) AS reread_sessions,
             SUM(CASE WHEN event = 'inject' THEN tokens ELSE 0 END) AS tokens
      FROM token_ledger
@@ -53,7 +54,7 @@ export function sessionTokenRows(db, tenantId, sinceIso) {
 export function injectedBlocks(db, tenantId, sessionId, surfaces) {
     // SAFETY: the SELECT names exactly these three columns.
     return db.prepare(`SELECT ts, surface, tokens FROM token_ledger
-     WHERE tenant_id = ? AND session_id = ? AND event = 'inject' AND surface IN (${surfaces.map(() => '?').join(', ')})`).all(tenantId, sessionId, ...surfaces);
+     WHERE tenant_id = ? AND session_id = ? AND event = 'inject' AND surface IN (${placeholders(surfaces.length)})`).all(tenantId, sessionId, ...surfaces);
 }
 export function deleteRereadRows(db, tenantId, sessionId) {
     db.prepare(`DELETE FROM token_ledger WHERE tenant_id = ? AND session_id = ? AND event = 'reread'`).run(tenantId, sessionId);