hippo-memory 1.71.0 → 2.0.0

package/dist/capture/compaction-spool.js

@@ -1,4 +1,5 @@
 // Summaries post-compact could not record because the store was busy, waiting on disk for the next replay.
+import { MINUTE_MS } from '../util/time.js';
 import { randomBytes } from 'crypto';
 import * as fs from 'fs';
 import * as path from 'path';
@@ -7,11 +8,12 @@ import { isSqliteBusy } from '../db/busy.js';
 import { errorMessage } from '../util/log.js';
 const STAMP_DIGITS = 13;
 export const SPOOL_DIR = 'compactions-spool';
-/** Starts the log line of a step that broke with an unexpected error, so the session-start banner counts it; a set-aside file is counted by its `.bad` name instead. */
+/** Starts the log line of a step that broke with an unexpected error, so the session-start banner counts it; a set-aside file is counted
+ * by its `.bad` name instead. */
 export const SPOOL_PROBLEM = 'spool problem: ';
 const LOCK = 'replay.lock';
 /** Long enough that a live replayer has finished with its claim. */
-const STALE_MS = 10 * 60_000;
+const STALE_MS = 10 * MINUTE_MS;
 const MAX_ATTEMPTS = 3;
 const BUSY_RETRIES = 3;
 const BUSY_WAIT_MS = 50;
@@ -27,11 +29,6 @@ const BAD = /^([\w-]+)\.(?:\w+\.)?bad$/;
 const BAD_TMP = /^[\w-]+\.\w+\.bad\.[0-9a-f]{8}\.tmp$/;
 const NEW_STEM = /^(\d{13})-[0-9a-f]{8}$/;
 const LEGACY_STEM_TIME = /-(\d+)$/;
-let fsx = fs;
-/** Test-only seam, so a test can make one fs call fail; null restores the real fs. */
-export function _setSpoolFsForTests(next) {
-    fsx = next ?? fs;
-}
 const stamp = (ms) => String(Math.trunc(ms)).padStart(STAMP_DIGITS, '0');
 const isTime = (value) => typeof value === 'number' && Number.isFinite(value);
 const idle = new Int32Array(new SharedArrayBuffer(4));
@@ -97,10 +94,19 @@ function claimOf(name) {
 function spoolFile(hippoRoot) {
     return path.join(hippoRoot, SPOOL_DIR, `${stamp(Date.now())}-${randomBytes(4).toString('hex')}.a0.json`);
 }
-export function spool(hippoRoot, tenantId, payload, text, at) {
+export function spool(hippoRoot, tenantId, payload, text, at, fsx = fs) {
     const file = spoolFile(hippoRoot);
     fsx.mkdirSync(path.dirname(file), { recursive: true });
-    const body = { tenantId, sessionId: payload.sessionId, trigger: payload.trigger, cwd: payload.cwd, transcriptPath: payload.transcriptPath, at: at.toISOString(), summary: text.summary, items: text.items };
+    const body = {
+        tenantId,
+        sessionId: payload.sessionId,
+        trigger: payload.trigger,
+        cwd: payload.cwd,
+        transcriptPath: payload.transcriptPath,
+        at: at.toISOString(),
+        summary: text.summary,
+        items: text.items,
+    };
     // Renamed into place so a replayer listing `.json` files never reads half a file.
     fsx.writeFileSync(`${file}.tmp`, JSON.stringify(body), { encoding: 'utf8', flag: 'wx' });
     // A rename that stays busy leaves a whole tmp, which a replay promotes once it is STALE_MS old.
@@ -149,7 +155,7 @@ function parseLock(text) {
     return { pid, at: raw.at, token };
 }
 /** The lock's body; its mtime stands in for the time when the body does not parse. */
-function readLock(lock, log) {
+function readLock(fsx, lock, log) {
     let text = '';
     const read = settle(() => { text = fsx.readFileSync(lock, 'utf8'); }, log, 'spool lock not read');
     if (read !== 'done')
@@ -161,7 +167,7 @@ function readLock(lock, log) {
     const stat = settle(() => { mtime = fsx.statSync(lock).mtimeMs; }, log, 'spool lock not read');
     return stat === 'done' ? { pid: null, at: mtime, token: null } : stat;
 }
-function createLock(lock, body, log) {
+function createLock(fsx, lock, body, log) {
     try {
         fsx.writeFileSync(lock, body, { encoding: 'utf8', flag: 'wx' });
         return 'taken';
@@ -177,18 +183,18 @@ function createLock(lock, body, log) {
     }
 }
 /** This run's token and take time once it holds `replay.lock`, else null: another replayer holds it, or it could not be made. */
-function takeLock(dir, log) {
+function takeLock(fsx, dir, log) {
     const lock = path.join(dir, LOCK);
     const token = randomBytes(8).toString('hex');
     const at = Date.now();
     const body = JSON.stringify({ pid: process.pid, at, token });
     for (let tries = 0; tries < 2; tries++) {
-        const made = createLock(lock, body, log);
+        const made = createLock(fsx, lock, body, log);
         if (made === 'taken')
             return { token, at };
         if (made === 'skip')
             break;
-        const held = readLock(lock, log);
+        const held = readLock(fsx, lock, log);
         if (held === 'gone')
             continue;
         if (held === 'busy')
@@ -205,24 +211,24 @@ function takeLock(dir, log) {
     return null;
 }
 /** False, after saying so, once `replay.lock` no longer holds this run's token or cannot be read. */
-function ownsLock(dir, token, log) {
-    const held = readLock(path.join(dir, LOCK), log);
+function ownsLock(fsx, dir, token, log) {
+    const held = readLock(fsx, path.join(dir, LOCK), log);
     if (held !== 'gone' && held !== 'busy' && held.token === token)
         return true;
     log(held === 'busy' ? 'spool lock could not be read, stopping' : 'spool left to another replayer (lock taken over)');
     return false;
 }
 /** Removes `replay.lock` only while it holds this run's token, so a run never deletes a successor's lock. Never throws. */
-function releaseLock(dir, mine, log) {
+function releaseLock(fsx, dir, mine, log) {
     const lock = path.join(dir, LOCK);
-    const held = readLock(lock, log);
+    const held = readLock(fsx, lock, log);
     // A takeover needs a lock over STALE_MS old, so a busy read of one this run took more recently is still this run's.
     const ours = held === 'busy' ? Date.now() - mine.at < STALE_MS : held !== 'gone' && held.token === mine.token;
     if (ours)
         settle(() => fsx.unlinkSync(lock), log, 'spool lock not released');
 }
 /** Claim time sits in the claim's name, so a claim over STALE_MS away from now belongs to a replayer that never finished. True when one was put back. */
-function recoverStaleClaims(dir, names, log) {
+function recoverStaleClaims(fsx, dir, names, log) {
     const now = Date.now();
     // A claim whose unlink stayed busy after its `.bad` landed is a spare copy, not a second failure.
     const setAside = new Set(names.flatMap((name) => BAD.exec(name)?.[1] ?? []));
@@ -245,21 +251,21 @@ function recoverStaleClaims(dir, names, log) {
                 putBackOne = true;
             }
         }
-        else if (moveBad(dir, file, { stem: claim.stem, attempt: claim.attempt, cause: 'interrupted', log })) {
+        else if (moveBad(fsx, dir, file, { stem: claim.stem, attempt: claim.attempt, cause: 'interrupted', log })) {
             log(`spool file ${claim.name} was claimed by a replayer that never finished ${MAX_ATTEMPTS} times, set aside as .bad`);
         }
     }
     return putBackOne;
 }
 /** Returns a claim to the waiting files as `<stem>.a<attempt>.json`; one that stays busy is left for stale recovery. */
-function putBack(dir, claim, stem, attempt, log) {
+function putBack(fsx, dir, claim, stem, attempt, log) {
     const name = path.basename(claim);
     if (settle(() => fsx.renameSync(claim, path.join(dir, `${stem}.a${attempt}.json`)), log, `spool file ${name} not put back`) === 'busy') {
-        log(`spool file ${name} could not be put back; it returns ${STALE_MS / 60_000} minutes after its claim`);
+        log(`spool file ${name} could not be put back; it returns ${STALE_MS / MINUTE_MS} minutes after its claim`);
     }
 }
 /** Writes `<stem>.<cause>.bad` through a random temp file, so the rename replaces any torn `.bad` a crash left. */
-function writeBad(dir, options) {
+function writeBad(fsx, dir, options) {
     const { stem, cause, text, log, what } = options;
     const tmp = path.join(dir, `${stem}.${cause}.bad.${randomBytes(4).toString('hex')}.tmp`);
     const written = settle(() => fsx.writeFileSync(tmp, text, { encoding: 'utf8', flag: 'wx' }), log, what);
@@ -269,21 +275,21 @@ function writeBad(dir, options) {
     return moved === 'done';
 }
 /** Sets a claim aside as `.bad` before the claim goes, so a crash between leaves a whole copy; a busy write puts the claim back. */
-function moveBad(dir, claim, options) {
+function moveBad(fsx, dir, claim, options) {
     const { stem, attempt, cause, log, raw } = options;
     const what = `spool file ${path.basename(claim)} not set aside`;
     let text = raw ?? '';
     if (raw === undefined && settle(() => { text = fsx.readFileSync(claim, 'utf8'); }, log, what) !== 'done')
         return false;
-    if (!writeBad(dir, { stem, cause, text, log, what })) {
-        putBack(dir, claim, stem, attempt, log);
+    if (!writeBad(fsx, dir, { stem, cause, text, log, what })) {
+        putBack(fsx, dir, claim, stem, attempt, log);
         return false;
     }
     settle(() => fsx.unlinkSync(claim), log, what);
     return true;
 }
 /** A tmp over STALE_MS old belongs to a spool that never renamed it: a whole one joins the waiting files, a torn one is set aside. True when one joined. */
-function promoteTmp(dir, names, tenantId, log) {
+function promoteTmp(fsx, dir, names, tenantId, log) {
     const now = Date.now();
     let promoted = false;
     for (const name of names) {
@@ -309,7 +315,7 @@ function promoteTmp(dir, names, tenantId, log) {
                 promoted = true;
             }
         }
-        else if (writeBad(dir, { stem: m[1], cause: 'unreadable', text, log, what })) {
+        else if (writeBad(fsx, dir, { stem: m[1], cause: 'unreadable', text, log, what })) {
             settle(() => fsx.unlinkSync(file), log, what);
             log(`spool file ${name} was never finished, set aside as .bad`);
         }
@@ -317,38 +323,40 @@ function promoteTmp(dir, names, tenantId, log) {
     return promoted;
 }
 /** Removes a claim once the store holds its summary; a claim left behind is imported again, so the log says so. */
-function removeClaim(claim, name, log) {
+function removeClaim(fsx, claim, name, log) {
     const removed = settleCode(() => fsx.unlinkSync(claim), log, `spool file ${name} claim not removed`);
     if (removed.settled === 'busy')
         log(`spool file ${name} saved; its claim could not be removed (${removed.code}); it will be imported again`);
 }
 /** After an importer throw: a busy store stops the run with the count unchanged, any other error counts one try toward .bad. */
-function importFailed(dir, claim, entry, options) {
+function importFailed(fsx, dir, claim, entry, options) {
     const { text, recorded, cause, log } = options;
     const { name } = entry;
     const busy = isSqliteBusy(cause);
     if (recorded) {
         // The record stays `summarised`, so the stalled-record step of a later replay writes its items.
-        log(busy ? `spool file ${name} saved; its memories wait for the next sleep (store busy)` : `spool file ${name} saved; writing its memories failed: ${errorMessage(cause)}`);
+        log(busy
+            ? `spool file ${name} saved; its memories wait for the next sleep (store busy)`
+            : `spool file ${name} saved; writing its memories failed: ${errorMessage(cause)}`);
         return busy ? 'stop' : 'skipped';
     }
     if (busy) {
-        putBack(dir, claim, entry.stem, entry.attempt, log);
+        putBack(fsx, dir, claim, entry.stem, entry.attempt, log);
         log(`spool file ${name} waits for the next run: the store is busy`);
         return 'stop';
     }
     const next = entry.attempt + 1;
     if (next < MAX_ATTEMPTS) {
-        putBack(dir, claim, entry.stem, next, log);
+        putBack(fsx, dir, claim, entry.stem, next, log);
         log(`spool file ${name} failed to import (try ${next} of ${MAX_ATTEMPTS}): ${errorMessage(cause)}`);
     }
-    else if (moveBad(dir, claim, { stem: entry.stem, attempt: entry.attempt, cause: 'failed', log, raw: text })) {
+    else if (moveBad(fsx, dir, claim, { stem: entry.stem, attempt: entry.attempt, cause: 'failed', log, raw: text })) {
         log(`spool file ${name} set aside as .bad after ${MAX_ATTEMPTS} tries: ${errorMessage(cause)}`);
     }
     return 'skipped';
 }
 /** Claims, reads and imports one waiting file; `stop` ends the run because the store is busy. */
-function importFile(dir, entry, tenantId, log, importOne) {
+function importFile(fsx, dir, entry, tenantId, log, importOne) {
     const { name } = entry;
     const claim = path.join(dir, `${entry.stem}.a${entry.attempt}.claim-${stamp(Date.now())}`);
     const taken = settleCode(() => fsx.renameSync(path.join(dir, name), claim), log, `spool file ${name} not claimed`);
@@ -361,13 +369,14 @@ function importFile(dir, entry, tenantId, log, importOne) {
     if (read === 'gone')
         log(`spool file ${name} vanished`);
     if (read === 'busy')
-        putBack(dir, claim, entry.stem, entry.attempt, log);
+        putBack(fsx, dir, claim, entry.stem, entry.attempt, log);
     if (read !== 'done')
         return 'skipped';
     const spooled = parseSpooled(text, tenantId);
     if (spooled === null) {
-        if (moveBad(dir, claim, { stem: entry.stem, attempt: entry.attempt, cause: 'unreadable', log, raw: text }))
+        if (moveBad(fsx, dir, claim, { stem: entry.stem, attempt: entry.attempt, cause: 'unreadable', log, raw: text })) {
             log(`spool file ${name} is not readable, set aside as .bad`);
+        }
         return 'skipped';
     }
     let recorded = false;
@@ -375,7 +384,7 @@ function importFile(dir, entry, tenantId, log, importOne) {
         if (recorded)
             return;
         recorded = true;
-        removeClaim(claim, name, log);
+        removeClaim(fsx, claim, name, log);
     };
     try {
         importOne(spooled, markRecorded);
@@ -383,10 +392,10 @@ function importFile(dir, entry, tenantId, log, importOne) {
         return 'imported';
     }
     catch (err) {
-        return importFailed(dir, claim, entry, { text, recorded, cause: err, log });
+        return importFailed(fsx, dir, claim, entry, { text, recorded, cause: err, log });
     }
 }
-function mtimeOf(file) {
+function mtimeOf(fsx, file) {
     try {
         return fsx.statSync(file).mtimeMs;
     }
@@ -399,7 +408,7 @@ function mtimeOf(file) {
     }
 }
 /** What doctor reports, read only: files a replay should have taken by now, claims and tmp files a dead process left, and `.bad` files. */
-export function spoolCounts(hippoRoot, now, waitingAfterMs) {
+export function spoolCounts(hippoRoot, now, waitingAfterMs, fsx = fs) {
     const counts = { waiting: 0, stale: 0, bad: 0 };
     const dir = path.join(hippoRoot, SPOOL_DIR);
     if (!fsx.existsSync(dir))
@@ -412,12 +421,12 @@ export function spoolCounts(hippoRoot, now, waitingAfterMs) {
         if (name.endsWith('.bad'))
             counts.bad++;
         else if (waiting !== null) {
-            const spooled = NEW_STEM.test(waiting[1]) ? created(waiting[1]) : mtimeOf(file);
+            const spooled = NEW_STEM.test(waiting[1]) ? created(waiting[1]) : mtimeOf(fsx, file);
             if (spooled !== null && at - spooled > waitingAfterMs)
                 counts.waiting++;
         }
         else if (claim !== null || TMP.test(name)) {
-            const since = claim?.claimedAt ?? mtimeOf(file);
+            const since = claim?.claimedAt ?? mtimeOf(fsx, file);
             if (since !== null && Math.abs(at - since) > STALE_MS)
                 counts.stale++;
         }
@@ -425,25 +434,25 @@ export function spoolCounts(hippoRoot, now, waitingAfterMs) {
     return counts;
 }
 /** One replayer at a time holds `replay.lock`, so only one process claims a file even where Windows lets two renames of it both land. */
-export function importSpool(hippoRoot, tenantId, log, deadline, importOne) {
+export function importSpool(hippoRoot, tenantId, log, deadline, importOne, fsx = fs) {
     const dir = path.join(hippoRoot, SPOOL_DIR);
     if (!fsx.existsSync(dir))
         return 0;
-    const mine = takeLock(dir, log);
+    const mine = takeLock(fsx, dir, log);
     if (mine === null)
         return 0;
     try {
-        if (!ownsLock(dir, mine.token, log))
+        if (!ownsLock(fsx, dir, mine.token, log))
             return 0;
         const names = fsx.readdirSync(dir);
-        const promoted = promoteTmp(dir, names, tenantId, log);
-        const recovered = recoverStaleClaims(dir, names, log);
+        const promoted = promoteTmp(fsx, dir, names, tenantId, log);
+        const recovered = recoverStaleClaims(fsx, dir, names, log);
         let finished = 0;
         // Only promotion and recovery add waiting names, so the folder is listed again only after one of them did.
         for (const entry of waitingFiles(promoted || recovered ? fsx.readdirSync(dir) : names)) {
-            if (Date.now() > deadline || !ownsLock(dir, mine.token, log))
+            if (Date.now() > deadline || !ownsLock(fsx, dir, mine.token, log))
                 break;
-            const outcome = importFile(dir, entry, tenantId, log, importOne);
+            const outcome = importFile(fsx, dir, entry, tenantId, log, importOne);
             if (outcome === 'imported')
                 finished++;
             if (outcome === 'stop')
@@ -452,7 +461,7 @@ export function importSpool(hippoRoot, tenantId, log, deadline, importOne) {
         return finished;
     }
     finally {
-        releaseLock(dir, mine, log);
+        releaseLock(fsx, dir, mine, log);
     }
 }
 //# sourceMappingURL=compaction-spool.js.map

package/dist/capture/copilot-transcript.d.ts

@@ -13,6 +13,7 @@ export declare const SESSION_ID_RE: RegExp;
 export declare function copilotTranscriptFor(sessionId: string): string | null;
 /** True for VS Code's own chat log, `<workspaceStorage>/<id>/github.copilot-chat/transcripts/<session id>.jsonl`, in either slash and any case. */
 export declare function isVscodeTranscript(file: string | null): boolean;
-/** The turn one Copilot event-log line carries: the text of a human user.message or of an assistant.message; null for any other line, a sub-agent's included. */
+/** The turn one Copilot event-log line carries: the text of a human user.message or of an assistant.message; null for any other line, a
+ * sub-agent's included. */
 export declare function copilotTurn(line: CopilotEventLine): CopilotTurn | null;
 //# sourceMappingURL=copilot-transcript.d.ts.map

package/dist/capture/copilot-transcript.js

@@ -33,7 +33,8 @@ function isInjectedUserMessage(data) {
     const source = data.source;
     return isStringValue(source) && INJECTED_SOURCE_PREFIXES.some((prefix) => source.startsWith(prefix));
 }
-/** The turn one Copilot event-log line carries: the text of a human user.message or of an assistant.message; null for any other line, a sub-agent's included. */
+/** The turn one Copilot event-log line carries: the text of a human user.message or of an assistant.message; null for any other line, a
+ * sub-agent's included. */
 export function copilotTurn(line) {
     const role = line.type === 'user.message' ? 'user' : line.type === 'assistant.message' ? 'assistant' : null;
     const data = isObjectLike(line.data) ? line.data : null;

package/dist/capture/extract.d.ts

@@ -2,8 +2,11 @@ export interface ExtractedItem {
     content: string;
     category: string;
     tags: string[];
+    /** A person said it, not the agent: capture pins a rule that carries this. */
+    fromUser?: boolean;
 }
-/** Captures complete supported statements, each text parsed alone so a fence or heading in one never reaches the next. */
-export declare function extractFromTexts(texts: readonly string[]): ExtractedItem[];
+/** Captures complete supported statements, each text parsed alone so a fence or heading in one never reaches the next.
+ *  The first `userTexts` texts are a person's own words; on a repeat their copy wins, so it keeps `fromUser`. */
+export declare function extractFromTexts(texts: readonly string[], userTexts?: number): ExtractedItem[];
 export declare function extractFromText(text: string): ExtractedItem[];
 //# sourceMappingURL=extract.d.ts.map

package/dist/capture/extract.js

@@ -158,10 +158,11 @@ function extractOne(text) {
     }
     return items;
 }
-/** Captures complete supported statements, each text parsed alone so a fence or heading in one never reaches the next. */
-export function extractFromTexts(texts) {
+/** Captures complete supported statements, each text parsed alone so a fence or heading in one never reaches the next.
+ *  The first `userTexts` texts are a person's own words; on a repeat their copy wins, so it keeps `fromUser`. */
+export function extractFromTexts(texts, userTexts = 0) {
     const seen = new Set();
-    return texts.flatMap(extractOne).filter((item) => {
+    return texts.flatMap((text, i) => extractOne(text).map((item) => (i < userTexts ? { ...item, fromUser: true } : item))).filter((item) => {
         const key = duplicateKey(item.content);
         if (seen.has(key) || !assessAutomaticMemory(item.content).accepted)
             return false;

package/dist/capture/failure-caller.d.ts

@@ -1,5 +1,5 @@
 import type { Context } from '../api/types.js';
-import { type CaptureErrorOutcome, type RoutineRule } from '../store/failure-log.js';
+import type { CaptureErrorOutcome, RoutineRule } from '../store/failure-log.js';
 import type { CallerProject } from '../api/prompt-hook.js';
 type FailureSkip = Exclude<CaptureErrorOutcome, 'stored' | 'duplicate'>;
 /** failureReport's reading of the payload, read on the caller's machine, plus the id its retries carry. */

package/dist/capture/failure-caller.js

@@ -1,14 +1,21 @@
-// PostToolUseFailure for a caller on another machine: the lesson and its log row carry the caller's owner and project, and a retried request id gets the first answer.
+// PostToolUseFailure for a caller on another machine: the lesson and its log row carry the caller's owner and project, and a retried
+// request id gets the first answer.
 import { BadRequestError } from '../core/api-errors.js';
 import { storeLesson } from './capture-error.js';
-import { recordFailure, requestOutcome, settleFailureOutcome } from '../store/failure-log.js';
+import { recordFailureAt, requestOutcomeAt, settleFailureOutcomeAt } from '../store/failure-log-at.js';
 import { errorMessage, log } from '../util/log.js';
 import { scrubForSharing } from './share-scrub.js';
 import { truncateCodePointSafe } from '../util/transcript-tail.js';
-import { assertRequestId, bindCaller, withCallerDb } from './caller-session.js';
+import { assertRequestId, bindCaller } from './caller-session.js';
 import { FAILURE_TEXT_MAX_CHARS, failureHash } from './failure-reading.js';
 const SKIPS = { 'skipped-interrupt': true, 'skipped-routine': true, 'skipped-invalid': true };
-const ROUTINE_RULES = { declined: true, 'os-permission': true, 'no-match': true, 'search-tool': true, 'quiet-exit': true };
+const ROUTINE_RULES = {
+    declined: true,
+    'os-permission': true,
+    'no-match': true,
+    'search-tool': true,
+    'quiet-exit': true,
+};
 /** The shapes lessonFromFailure gives: text for a lesson or a routine skip, none for an interrupt or an unreadable payload, a rule only on a routine skip. */
 function checkedFailure(req) {
     assertRequestId(req.requestId);
@@ -35,7 +42,7 @@ function checkedFailure(req) {
 export function captureFailureForCaller(ctx, req) {
     const failure = checkedFailure(req);
     const key = bindCaller(ctx, req.sessionId, req.project);
-    const earlier = withCallerDb(ctx, (db) => requestOutcome(db, ctx.tenantId, req.requestId, req.sessionId));
+    const earlier = requestOutcomeAt(ctx.hippoRoot, ctx.tenantId, req.requestId, req.sessionId);
     // A retry after a lost reply gets the first answer and writes nothing; one whose store failed tries the store again.
     if (earlier !== null && earlier !== 'store-failed')
         return { outcome: earlier };
@@ -54,17 +61,15 @@ export function captureFailureForCaller(ctx, req) {
 /** Runs after the outcome in its own try, so a log error never hides the store's error or its outcome. */
 function logOutcome(ctx, req, key, outcome, retried) {
     try {
-        withCallerDb(ctx, (db) => {
-            // The request id allows one row, so a retry rewrites the first try's outcome.
-            if (retried) {
-                settleFailureOutcome(db, ctx.tenantId, req.requestId, outcome);
-                return;
-            }
-            recordFailure(db, {
-                tenantId: ctx.tenantId, sessionId: req.sessionId, tool: req.tool, outcome, rule: req.rule,
-                sigHash: req.text?.trim() ? failureHash(req.text) : null, detailHash: req.detailHash,
-                ownerSubject: key.owner, originProject: req.project.name, requestId: req.requestId,
-            });
+        // The request id allows one row, so a retry rewrites the first try's outcome.
+        if (retried) {
+            settleFailureOutcomeAt(ctx.hippoRoot, ctx.tenantId, req.requestId, outcome);
+            return;
+        }
+        recordFailureAt(ctx.hippoRoot, {
+            tenantId: ctx.tenantId, sessionId: req.sessionId, tool: req.tool, outcome, rule: req.rule,
+            sigHash: req.text?.trim() ? failureHash(req.text) : null, detailHash: req.detailHash,
+            ownerSubject: key.owner, originProject: req.project.name, requestId: req.requestId,
         });
     }
     catch (err) {

package/dist/capture/failure-reading.d.ts

@@ -22,7 +22,8 @@ export declare function payloadString(payload: JsonValue, key: 'session_id' | 't
 export declare function failureSignature(text: string): string;
 /** The hash the failure log stores for a lesson text or a detail; one function so every writer counts repeats alike. */
 export declare function failureHash(text: string): string;
-/** The memory text for a failure payload, or why it is not stored; a routine skip keeps its text for the log. `scrub` runs before the cap, as a mask can be longer than what it hides. Pure. */
+/** The memory text for a failure payload, or why it is not stored; a routine skip keeps its text for the log. `scrub` runs before the
+ * cap, as a mask can be longer than what it hides. Pure. */
 export declare function lessonFromFailure(payload: JsonValue, scrub?: (text: string) => string): FailureReading;
 /** A failure as it may leave the machine: the capped lesson text and the detail's hash, never the untruncated detail. */
 export interface FailureReport {

package/dist/capture/failure-reading.js

@@ -3,7 +3,7 @@ import { redactSecretsStrict } from '../util/secret-detect.js';
 import { scrubForSharing } from './share-scrub.js';
 import { blockHash } from '../util/token-text.js';
 import { truncateCodePointSafe } from '../util/transcript-tail.js';
-import { isJsonObjectLiteral } from '../util/json.js';
+import { isJsonObjectLiteral, isJsonString } from '../util/json.js';
 const COMMAND_HEAD_WORDS = 2;
 /** The longest lesson text a reading gives, so a check of a sent one imports it instead of copying it. */
 export const FAILURE_TEXT_MAX_CHARS = 200;
@@ -19,15 +19,12 @@ const QUIET_EXIT_1 = /^\s*(?:grep|rg|egrep|fgrep|find|test|\[|diff|cmp|git diff|
 // Claude Code's tool names, then the Copilot CLI's and VS Code's; tests/copilot-failure-reading.test.ts cites where each comes from.
 const SEARCH_TOOLS = new Set(['Grep', 'Glob', 'grep', 'glob', 'rg', 'grep_search', 'file_search', 'semantic_search']);
 const SHELL_TOOLS = new Set(['Bash', 'bash', 'powershell', 'run_in_terminal']);
-function isString(v) {
-    return v !== undefined && v !== null && v.constructor === String;
-}
 /** A non-blank string field of the payload, or null. */
 export function payloadString(payload, key) {
     if (!isJsonObjectLiteral(payload))
         return null;
     const value = payload[key];
-    return isString(value) && value.trim() !== '' ? value : null;
+    return isJsonString(value) && value.trim() !== '' ? value : null;
 }
 /** Normalised form used to spot repeats. The failure log keeps only its hash, so changing it breaks repeat counts. */
 export function failureSignature(text) {
@@ -37,7 +34,8 @@ export function failureSignature(text) {
 export function failureHash(text) {
     return blockHash(failureSignature(text));
 }
-/** The memory text for a failure payload, or why it is not stored; a routine skip keeps its text for the log. `scrub` runs before the cap, as a mask can be longer than what it hides. Pure. */
+/** The memory text for a failure payload, or why it is not stored; a routine skip keeps its text for the log. `scrub` runs before the
+ * cap, as a mask can be longer than what it hides. Pure. */
 export function lessonFromFailure(payload, scrub = (text) => text) {
     if (!isJsonObjectLiteral(payload))
         return { skip: 'skipped-invalid', text: null, detail: null };
@@ -45,12 +43,12 @@ export function lessonFromFailure(payload, scrub = (text) => text) {
     const p = payload;
     if (p.is_interrupt === true)
         return { skip: 'skipped-interrupt', text: null, detail: null };
-    if (!isString(p.error) || p.error.trim().length < 12)
+    if (!isJsonString(p.error) || p.error.trim().length < 12)
         return { skip: 'skipped-invalid', text: null, detail: null };
-    const tool = isString(p.tool_name) ? p.tool_name : 'tool';
+    const tool = isJsonString(p.tool_name) ? p.tool_name : 'tool';
     const error = redactSecretsStrict(p.error.replace(/\s+/g, ' ').trim());
     const text = truncateCodePointSafe(scrub(`${tool}: ${error}`), FAILURE_TEXT_MAX_CHARS);
-    const command = isJsonObjectLiteral(p.tool_input) && isString(p.tool_input['command']) ? p.tool_input['command'].replace(LEADING_CD, '') : '';
+    const command = isJsonObjectLiteral(p.tool_input) && isJsonString(p.tool_input['command']) ? p.tool_input['command'].replace(LEADING_CD, '') : '';
     const head = command.trim().split(/\s+/).slice(0, COMMAND_HEAD_WORDS).join(' ');
     const detail = `${tool}${head ? ` ${head}` : ''}: ${error}`;
     const routine = (rule) => ({ skip: 'skipped-routine', rule, text, detail });

package/dist/capture/pre-compact-caller.js

@@ -1,7 +1,8 @@
-import { markSnapshotSaved, PRE_COMPACT_INSTRUCTION, startCompaction } from './compaction-record.js';
+import { PRE_COMPACT_INSTRUCTION } from './compaction-record.js';
+import { markSnapshotSavedAt, startCompactionAt } from '../store/compaction-caller.js';
 import { errorMessage, log } from '../util/log.js';
 import { loadActiveTaskSnapshot, saveActiveTaskSnapshot } from '../store/sessions.js';
-import { assertTrigger, bindCaller, callerInHoldout, checkedWorkingState, withCallerDb } from './caller-session.js';
+import { assertTrigger, bindCaller, callerInHoldout, checkedWorkingState } from './caller-session.js';
 import { mergeWorkingState } from './working-state.js';
 /** A failed step is logged and the instruction still goes out, as the local hook prints it before any store work. */
 function logged(what, fn) {
@@ -20,10 +21,10 @@ export function preCompactForCaller(ctx, req) {
     if (callerInHoldout(ctx, req.sessionId))
         return { stdout: '' };
     const start = { sessionId: req.sessionId, originProject: req.project.name, trigger: req.trigger, cwd: null, transcriptPath: null };
-    const recordId = logged('compaction record not started', () => withCallerDb(ctx, (db) => startCompaction(db, ctx.tenantId, start)));
+    const recordId = logged('compaction record not started', () => startCompactionAt(ctx.hippoRoot, ctx.tenantId, start));
     if (state !== null && saveOwnerSnapshot(ctx, req.sessionId, key, state) && recordId !== null) {
         // Marked under ctx.tenantId, which the environment's tenant may not be.
-        logged('compaction record not marked with its snapshot', () => withCallerDb(ctx, (db) => markSnapshotSaved(db, ctx.tenantId, recordId)));
+        logged('compaction record not marked with its snapshot', () => markSnapshotSavedAt(ctx.hippoRoot, ctx.tenantId, recordId));
     }
     return { stdout: PRE_COMPACT_INSTRUCTION };
 }

package/dist/capture/session-digest.js

@@ -10,9 +10,9 @@ import { USER_SEGMENT } from '../util/home-path.js';
 import { errorMessage } from '../util/log.js';
 import { SESSION_DIGEST_TAG } from '../core/session-digest-row.js';
 import { createMemory, Layer } from '../core/memory.js';
-import { RejectedValueError } from '../store/rejection.js';
+import { RejectedValueError } from '../core/api-errors.js';
 import { maskEmails, redactSecretsStrict } from '../util/secret-detect.js';
-import { isInitialized } from '../store/open.js';
+import { isInitialized } from '../core/project-identity.js';
 import { writeEntry } from '../store/entry-writes.js';
 import { loadLiveContentsBySourceAndTag } from '../store/entry-reads.js';
 import { SNAPSHOT_AMBIENT_MAX_AGE_MS } from '../store/sessions.js';
@@ -336,7 +336,8 @@ const ANCHORS = [
     /(?:^|\s)#\d+\b/,
 ];
 /** Each marker states a cause or a choice, the part of a lesson that transfers. */
-const MARKERS = /\b(?:because|caused by|due to|root cause|the (?:bug|issue|problem) was|fail(?:s|ed) when|so that|otherwise|instead of|rather than|switched to|decided|chose|must|never|always|do not)\b/i;
+const MARKERS = new RegExp('\\b(?:because|caused by|due to|root cause|the (?:bug|issue|problem) was|fail(?:s|ed) when|so that|otherwise|' +
+    'instead of|rather than|switched to|decided|chose|must|never|always|do not)\\b', 'i');
 const FENCE = /^\s*(`{3,}|~{3,})/;
 const STRUCTURE_LINE = /^\s*(?:#{1,6}\s|\||>|([-*_])(?:\s*\1){2,}\s*$)/;
 const PROTECTED = /`[^`\n]+`|\b(?:e\.g|i\.e)\./gi;

package/dist/capture/session-end-caller.js

@@ -11,7 +11,8 @@ function checkedEvidence(evidence) {
     const { gitRef = null, dirtyTree = null, testStatus = null } = evidence;
     // `git rev-parse HEAD` gives 40 hex, or 64 in a SHA-256 repository.
     if (gitRef !== null && !/^(?:[0-9a-f]{40}|[0-9a-f]{64})$/.test(gitRef))
-        throw new BadRequestError('evidence gitRef: 40 or 64 lowercase hex characters or null');
+        throw new BadRequestError('evidence gitRef: 40 or 64 lowercase hex characters or ' +
+            'null');
     if (dirtyTree !== null && dirtyTree !== true && dirtyTree !== false)
         throw new BadRequestError('evidence dirtyTree: true, false or null');
     if (testStatus !== null && !TEST_STATUSES.has(testStatus))
@@ -23,7 +24,7 @@ export function sessionEndHandoffForCaller(ctx, req) {
     const state = checkedWorkingState(req.workingState);
     const evidence = checkedEvidence(req.evidence);
     const key = bindCaller(ctx, req.sessionId, req.project);
-    const handoff = writeSessionEndHandoff(ctx.hippoRoot, ctx.tenantId, req.sessionId, evidence, state, key);
+    const handoff = writeSessionEndHandoff(ctx.hippoRoot, { tenantId: ctx.tenantId, sessionId: req.sessionId, evidence, derived: state, key });
     const snapshotsClosed = closeTaskSnapshotsForSession(ctx.hippoRoot, ctx.tenantId, req.sessionId, 'session-ended', key);
     return { handoffWritten: handoff !== null, snapshotsClosed };
 }