hippo-memory 1.72.0 → 2.0.0

package/dist/store/search-rows.js

@@ -9,6 +9,7 @@ import { topVectorMatches } from '../db/vector-store.js';
 import { MEMORY_SELECT_COLUMNS, MEMORY_SEARCH_COLUMNS, DEFAULT_SEARCH_CANDIDATE_LIMIT, rowToEntry, } from './rows.js';
 import { onHandle, openStore } from './open.js';
 import { escapeLike } from '../util/escape.js';
+import { placeholders } from '../util/sql.js';
 /** The recall scope rule for a table column prefix (`m.` or none); `passesScopeFilterForRecall` in recall-scope.ts is its JS twin. */
 function recallScopeClause(col, scopeFilter) {
     if (scopeFilter === undefined)
@@ -40,11 +41,6 @@ export function recallScopeFilter(requestedScope, mode, ownScope) {
     return mode === 'additive' ? { mode: 'default-deny-or-exact', value: requestedScope, ownScope } : { mode: 'exact', value: requestedScope };
 }
 const FTS_QUERY_SYNTAX_RE = /fts5: syntax error|unterminated string/i;
-let forceLikePath = false;
-/** Sends term queries down the LIKE path on a build that has FTS. Only tests call it. */
-export function _forceLikePathForTests(on) {
-    forceLikePath = on;
-}
 function loadSearchRows(db, query, limit, tenantId, options = {}) {
     const { scopeFilter, includeSuperseded = true, originProjects } = options;
     const p = searchPredicates(tenantId, scopeFilter, includeSuperseded, originProjects);
@@ -53,8 +49,7 @@ function loadSearchRows(db, query, limit, tenantId, options = {}) {
         // LIMIT here too, so every candidate path honours the caller's cap.
         return selectAllCandidates(db, p, limit);
     }
-    // The test switch is read here, not in `isFtsAvailable`, so writes never skip FTS index sync.
-    if (!forceLikePath && isFtsAvailable(db)) {
+    if (isFtsAvailable(db)) {
         const rows = selectFtsCandidates(db, terms, p, limit);
         if (rows.length > 0)
             return rows;
@@ -152,10 +147,12 @@ export function loadSearchEntries(hippoRoot, query, limit = DEFAULT_SEARCH_CANDI
 }
 /** Recall-mode loader: scope predicate in SQL so `unknown:legacy` cannot leak. Empty `requestedScope` default-denies (admits `ownScope`); else exact match.
  * SQL `NOT LIKE '%:private:%'` runs before the LIMIT so private rows cannot starve admitted ones; `passesScopeFilterForRecall` is the exact post-filter. */
+export function loadRecallEntries(hippoRoot, query, options = {}) {
+    return onHandle(hippoRoot, (db) => loadRecallSearchEntriesFromDb(db, query, options), openStore);
+}
+/** Positional form of `loadRecallEntries`, kept internal because the frozen q3b-ranker-floor benchmark imports it from dist. */
 export function loadRecallSearchEntries(hippoRoot, query, limit = DEFAULT_SEARCH_CANDIDATE_LIMIT, tenantId, requestedScope, explicitScopeMode = 'exact', includeSuperseded = true, originProjects, ownScope) {
-    return onHandle(hippoRoot, (db) => {
-        return loadRecallSearchEntriesFromDb(db, query, { limit, tenantId, requestedScope, explicitScopeMode, includeSuperseded, originProjects, ownScope });
-    }, openStore);
+    return loadRecallEntries(hippoRoot, query, { limit, tenantId, requestedScope, explicitScopeMode, includeSuperseded, originProjects, ownScope });
 }
 // Split out so callers with an already-open db (the prompt-recall path) skip
 // the initStore+open/close cycle per store per call.
@@ -176,7 +173,7 @@ export async function loadVectorCandidateEntries(hippoRoot, queryVector, spec) {
         if (matches.length === 0)
             return [];
         // SAFETY: the SELECT names exactly MEMORY_SELECT_COLUMNS, matching MemoryRow's field set.
-        const rows = db.prepare(`SELECT ${MEMORY_SELECT_COLUMNS} FROM memories WHERE id IN (${matches.map(() => '?').join(', ')})`)
+        const rows = db.prepare(`SELECT ${MEMORY_SELECT_COLUMNS} FROM memories WHERE id IN (${placeholders(matches.length)})`)
             .all(...matches.map((m) => m.id));
         const byId = new Map(rows.map((r) => [r.id, rowToEntry(r)]));
         return matches.flatMap((m) => byId.get(m.id) ?? []);
@@ -197,7 +194,7 @@ export function pickRarestFtsQuery(db, terms, maxTerms = RAREST_TERM_COUNT) {
         return '';
     // SAFETY: rows' shape matches the two columns named in the SELECT.
     const rows = db
-        .prepare(`SELECT term, doc FROM temp.z1_rarest_vocab WHERE term IN (${vocab.map(() => '?').join(', ')})`)
+        .prepare(`SELECT term, doc FROM temp.z1_rarest_vocab WHERE term IN (${placeholders(vocab.length)})`)
         .all(...vocab);
     const counts = new Map(rows.map((r) => [r.term, r.doc]));
     return rarestFtsQuery(terms, (part) => counts.get(part) ?? 0, maxTerms);

package/dist/store/set-aside.js

@@ -7,7 +7,7 @@ export const SYNC_ACTOR = 'agent-memories';
 /** Design 6's set-aside on the caller's transaction: a pinned row only loses the tag, any other goes dormant, restorable. */
 export function setAsideRow(db, tag, row, why) {
     const untagged = { ...row, tags: row.tags.filter((t) => t !== tag) };
-    const audit = (metadata) => appendAuditEvent(db, { tenantId: row.tenantId, actor: SYNC_ACTOR, op: 'agent_memory_set_aside', targetId: row.id, metadata });
+    const audit = (metadata) => appendAuditEvent(db, { tenantId: row.tenant_id, actor: SYNC_ACTOR, op: 'agent_memory_set_aside', targetId: row.id, metadata });
     if (row.pinned) {
         setEntryTagsInTx(db, untagged);
         audit({ why, untagged: true });

package/dist/store/sqlite/connector-writes-group.js

@@ -22,7 +22,9 @@ function loggedMemory(db, event) {
 function writeWithCompanions(db, { entry, actor, event, quarantine }) {
     writeInOwnTenant(db, entry, actor, (handle, memoryId) => {
         if (quarantine)
-            recordQuarantine(handle, { tenantId: entry.tenantId, memoryId, originalScope: quarantine.originalScope, reason: quarantine.reason, actor });
+            recordQuarantine(handle, {
+                tenantId: entry.tenant_id, memoryId, originalScope: quarantine.originalScope, reason: quarantine.reason, actor,
+            });
         if (event && !logEvent(handle, event, memoryId))
             throw new EventAlreadyLogged();
     });

package/dist/store/sqlite/entry-writes-group.d.ts

@@ -2,11 +2,11 @@ import { type DatabaseSyncLike } from '../../db/index.js';
 import { type MemoryEntry } from '../../core/memory.js';
 import { type ArchiveOpts } from '../raw-archive.js';
 import type { EntryWrite, EntryWrites, OutcomeWrite, RawArchive, Sync } from '../port.js';
-import { type WriteEntryOptions } from '../entry-writes.js';
+import { type WriteEntryInternalOptions } from '../entry-writes.js';
 /** Each call on its own handle; mirrors and the forgotten counter follow the commit, so a rolled-back write leaves neither. */
 export declare function sqliteEntryWrites(hippoRoot: string): Sync<EntryWrites>;
 /** A store-side hook writes on the row's handle inside its write scope, so its throw undoes the row. */
-export declare function writeEntryAt(hippoRoot: string, { entry, actor }: EntryWrite, afterWrite?: WriteEntryOptions['afterWrite']): void;
+export declare function writeEntryAt(hippoRoot: string, { entry, actor }: EntryWrite, afterWrite?: WriteEntryInternalOptions['afterWrite']): void;
 /** A trace link follows the commit on the same handle and names only the ids applied, so a rolled-back outcome leaves none. */
 export declare function applyOutcomeAt(hippoRoot: string, outcome: OutcomeWrite, traceId?: number): string[];
 /** Reach is checked inside the archive's write scope. A store-side hook writes on the same handle inside that scope, so its throw undoes the archive. */
@@ -14,5 +14,5 @@ export declare function archiveRawAt(hippoRoot: string, archive: RawArchive, aft
 /** The refusal row lands after `write` has rolled back, in a fresh implicit transaction the aborted one cannot undo. */
 export declare function auditingRefusal<T>(db: DatabaseSyncLike, actor: string, write: () => T): T;
 /** writeEntryAt on the caller's handle, so a sibling group can read on it after the scope has unwound. */
-export declare function writeInOwnTenant(db: DatabaseSyncLike, entry: MemoryEntry, actor: string, afterWrite?: WriteEntryOptions['afterWrite']): void;
+export declare function writeInOwnTenant(db: DatabaseSyncLike, entry: MemoryEntry, actor: string, afterWrite?: WriteEntryInternalOptions['afterWrite']): void;
 //# sourceMappingURL=entry-writes-group.d.ts.map

package/dist/store/sqlite/entry-writes-group.js

@@ -91,7 +91,7 @@ function assertInReach(db, target, id) {
 /** hippo.db's upsert would move the row into the writer's tenant, so a store write refuses an id another tenant holds. */
 function assertIdInTenant(db, entry) {
     const holder = selectMemoryReach(db, entry.id)?.tenantId;
-    if (holder !== undefined && holder !== entry.tenantId)
+    if (holder !== undefined && holder !== entry.tenant_id)
         throw new ConflictError(`Memory ${entry.id} belongs to another tenant`);
 }
 /** The refusal row lands after `write` has rolled back, in a fresh implicit transaction the aborted one cannot undo. */

package/dist/store/sqlite/held-connection.d.ts

@@ -3,6 +3,8 @@ export interface StoreHolder {
     hold: () => void;
     afterResponse: () => void;
     release: () => Promise<void>;
+    /** Runs one request, inside the fence that keeps hippo.db shut when the store is not it. */
+    runRequest: (run: () => Promise<void>) => Promise<void>;
 }
 /** Holds a connection to the hippo.db under `hippoRoot` once it exists, so serving never creates one. */
 export declare function holdSqliteConnection(hippoRoot: string): StoreHolder;

package/dist/store/sqlite/held-connection.js

@@ -36,6 +36,6 @@ export function holdSqliteConnection(hippoRoot) {
             closeHippoDb(heldDb);
         heldDb = undefined;
     };
-    return { hold, afterResponse, release };
+    return { hold, afterResponse, release, runRequest: (run) => run() };
 }
 //# sourceMappingURL=held-connection.js.map

package/dist/store/sqlite/last-recall-group.d.ts

@@ -0,0 +1,13 @@
+import type { LastRecall, RecallWrites, Sync } from '../port.js';
+/** What a finished recall wrote after its audit rows: the trace's id, null when none was asked or its write failed, and the ids strengthened. */
+interface RecallFinish {
+    readonly traceId: number | null;
+    readonly strengthened: ReadonlySet<string>;
+}
+/** sqliteStore's finishRecall, for the synchronous recall that cannot await the port. */
+export declare function finishRecallAt(hippoRoot: string, writes: RecallWrites): RecallFinish;
+export declare function sqliteLastRecall(hippoRoot: string): Sync<LastRecall>;
+/** The group as a served store answers it: the call runs at once and resolves through a Promise, so a throw rejects as another store's would. */
+export declare function servedLastRecall(sync: Sync<LastRecall>): LastRecall;
+export {};
+//# sourceMappingURL=last-recall-group.d.ts.map

package/dist/store/sqlite/last-recall-group.js

@@ -0,0 +1,57 @@
+// hippo.db's LastRecall group: the last recall sits in its meta table, and a traced outcome links on the outcome's own handle.
+import { withWriteScope } from '../../db/index.js';
+import { appendAuditEvent } from '../audit.js';
+import { strengthenRetrieved, strengthenRetrievedInOwnTx } from '../entry-writes.js';
+import { localGoalRecallRows, writeGoalRecallLog } from '../goals.js';
+import { loadLastRecall, saveIndex } from '../index-and-stats.js';
+import { onHandle } from '../open.js';
+import { writeRecallTrace } from '../recall-trace.js';
+import { applyOutcomeAt } from './entry-writes-group.js';
+/** sqliteStore's finishRecall, for the synchronous recall that cannot await the port. */
+export function finishRecallAt(hippoRoot, writes) {
+    return onHandle(hippoRoot, (db) => {
+        const traceAndStrengthen = () => ({
+            traceId: writes.trace ? writeRecallTrace(db, writes.trace) : null,
+            strengthened: writes.strengthen ? strengthenRetrievedInOwnTx(db, writes.strengthen.ids, writes.strengthen.opts) : new Set(),
+        });
+        // Alone, the fail-soft trace and strengthen keep their own scopes so a busy lock loses them, never the read.
+        if (writes.goalLog.length === 0 && writes.audit.length === 0)
+            return traceAndStrengthen();
+        // Inside this scope both run as savepoints, so one recall commits once and a failed trace or strengthen still unwinds alone.
+        return withWriteScope(db, 'finish_recall', () => {
+            writeGoalRecallLog(db, localGoalRecallRows(db, writes.goalLog));
+            for (const event of writes.audit)
+                appendAuditEvent(db, event);
+            return traceAndStrengthen();
+        });
+    });
+}
+export function sqliteLastRecall(hippoRoot) {
+    return {
+        applyTracedOutcome: (outcome, traceId) => applyOutcomeAt(hippoRoot, outcome, traceId),
+        applyOutcomeToLast(target, good) {
+            const { last_retrieval_ids: ids, last_trace_id: trace } = loadLastRecall(hippoRoot);
+            if (ids.length === 0)
+                return [];
+            return applyOutcomeAt(hippoRoot, { ...target, ids, good }, trace === null ? undefined : Number(trace));
+        },
+        finishRecall(writes, globalRoot) {
+            const { ids, opts } = writes.strengthen;
+            const { traceId, strengthened } = finishRecallAt(hippoRoot, writes);
+            if (globalRoot !== undefined)
+                strengthenRetrieved(globalRoot, ids.filter((id) => !strengthened.has(id)), opts);
+            // One write for both keys, so an outcome never pairs these ids with an older trace; a lost trace saves null.
+            saveIndex(hippoRoot, { last_retrieval_ids: [...ids], last_trace_id: traceId === null ? null : String(traceId) });
+            return traceId;
+        },
+    };
+}
+/** The group as a served store answers it: the call runs at once and resolves through a Promise, so a throw rejects as another store's would. */
+export function servedLastRecall(sync) {
+    return {
+        applyTracedOutcome: async (outcome, traceId) => sync.applyTracedOutcome(outcome, traceId),
+        applyOutcomeToLast: async (target, good) => sync.applyOutcomeToLast(target, good),
+        finishRecall: async (writes, globalRoot) => sync.finishRecall(writes, globalRoot),
+    };
+}
+//# sourceMappingURL=last-recall-group.js.map

package/dist/store/sqlite/local.d.ts

@@ -1,21 +1,4 @@
 import { type ScopeGrantChange } from '../key-writes.js';
-import type { EntryTarget, OutcomeWrite, RecallWrites } from '../port.js';
-/** A recall's writes when hippo.db keeps it as its last one: `strengthen.ids` are the ids it returned. */
-type LastRecallWrites = RecallWrites & Required<Pick<RecallWrites, 'strengthen'>>;
-/** The port's writes with a part that needs hippo.db's own handle or its meta table, which no other store has. */
-export interface SqliteLocal {
-    /** entryWrites.applyOutcome, then a link from the recall trace to the ids applied, on the same handle after the commit. */
-    applyOutcome(outcome: OutcomeWrite, traceId: number): string[];
-    /** applyOutcome on the ids of the last recall, which hippo.db's meta table holds with that recall's trace; answers the ids applied. */
-    applyOutcomeToLastRecall(target: EntryTarget, good: boolean): string[];
-    /** finishRecall, then the ids this root lacks strengthened under `globalRoot`, then the ids and their trace saved as the last recall;
-     *  answers the trace id. A store of another kind keeps no last recall, so its stand-in is its own finishRecall, answering null. */
-    finishLastRecall(writes: LastRecallWrites, globalRoot: string | undefined): number | null | Promise<number | null>;
-}
-export declare function sqliteLocal(hippoRoot: string): SqliteLocal;
-/** What a served store answers for each write that needs hippo.db's own handle: a refusal. */
-export declare const REFUSED_ON_A_STORE: Pick<SqliteLocal, 'applyOutcome'>;
 /** Off the port: only the local CLI changes grants, through synchronous published functions a store's Promise cannot answer. */
 export declare function changeScopeGrant(hippoRoot: string, change: ScopeGrantChange): void;
-export {};
 //# sourceMappingURL=local.d.ts.map

package/dist/store/sqlite/local.js

@@ -1,37 +1,6 @@
 // What only hippo.db does: operations no port method covers, so they never run on another store.
-import { strengthenRetrieved } from '../entry-writes.js';
-import { loadLastRecall, saveIndex } from '../index-and-stats.js';
 import { changeScopeGrantAt } from '../key-writes.js';
 import { onHandle } from '../open.js';
-import { applyOutcomeAt } from './entry-writes-group.js';
-import { finishRecallAt } from './store.js';
-export function sqliteLocal(hippoRoot) {
-    return {
-        applyOutcome: (outcome, traceId) => applyOutcomeAt(hippoRoot, outcome, traceId),
-        // The ids and the trace come from one statement, so the outcome is linked to the recall that returned those ids.
-        applyOutcomeToLastRecall(target, good) {
-            const { last_retrieval_ids: ids, last_trace_id: trace } = loadLastRecall(hippoRoot);
-            if (ids.length === 0)
-                return [];
-            return applyOutcomeAt(hippoRoot, { ...target, ids, good }, trace === null ? undefined : Number(trace));
-        },
-        finishLastRecall(writes, globalRoot) {
-            const { ids, opts } = writes.strengthen;
-            const { traceId, strengthened } = finishRecallAt(hippoRoot, writes);
-            if (globalRoot !== undefined)
-                strengthenRetrieved(globalRoot, ids.filter((id) => !strengthened.has(id)), opts);
-            // One write for both keys, so an outcome never pairs these ids with an older trace; a lost trace saves null.
-            saveIndex(hippoRoot, { last_retrieval_ids: [...ids], last_trace_id: traceId === null ? null : String(traceId) });
-            return traceId;
-        },
-    };
-}
-/** What a served store answers for each write that needs hippo.db's own handle: a refusal. */
-export const REFUSED_ON_A_STORE = {
-    applyOutcome() {
-        throw new Error('an outcome links its recall trace on hippo.db only, never through a store');
-    },
-};
 /** Off the port: only the local CLI changes grants, through synchronous published functions a store's Promise cannot answer. */
 export function changeScopeGrant(hippoRoot, change) {
     onHandle(hippoRoot, (db) => changeScopeGrantAt(db, change));

package/dist/store/sqlite/maintenance-groups.d.ts

@@ -0,0 +1,6 @@
+import type { AuditMaintenance, LessonWrites, Sync } from '../port.js';
+export declare function sqliteAuditMaintenance(hippoRoot: string): Sync<AuditMaintenance>;
+export declare function servedAuditMaintenance(sync: Sync<AuditMaintenance>): AuditMaintenance;
+export declare function sqliteLessonWrites(hippoRoot: string): Sync<LessonWrites>;
+export declare function servedLessonWrites(sync: Sync<LessonWrites>): LessonWrites;
+//# sourceMappingURL=maintenance-groups.d.ts.map

package/dist/store/sqlite/maintenance-groups.js

@@ -0,0 +1,60 @@
+// hippo.db's half of the AuditMaintenance and LessonWrites store groups: the quality audit, audit prune and git learn's batch.
+import { pruneAuditRows } from '../audit.js';
+import { loadTextsHoldingWords } from '../candidates.js';
+import { deleteEntriesAutomatically, memoriesBackingObjects } from '../delete-and-batch.js';
+import { loadAllEntries } from '../entry-reads.js';
+import { writeEntriesSkippingRejected, writeEntriesTogether } from '../entry-writes.js';
+import { updateStats } from '../index-and-stats.js';
+import { repairAutomaticMemories, repairQualityOnce } from '../quality-repair.js';
+import { touchableScopeSql } from '../rule-sql.js';
+export function sqliteAuditMaintenance(hippoRoot) {
+    return {
+        tenantEntries: (tenantId) => loadAllEntries(hippoRoot, tenantId),
+        objectBackedIds: () => memoriesBackingObjects(hippoRoot),
+        deleteAutomatically: (removals, actor) => deleteEntriesAutomatically(hippoRoot, removals, actor),
+        pruneAuditRows: (prune) => pruneAuditRows(hippoRoot, prune),
+        repairQuality: (tenantId, apply) => repairAutomaticMemories(hippoRoot, { tenantId, apply }),
+        repairQualityOnce: (tenantId) => repairQualityOnce(hippoRoot, tenantId),
+    };
+}
+export function servedAuditMaintenance(sync) {
+    return {
+        tenantEntries: async (tenantId) => sync.tenantEntries(tenantId),
+        objectBackedIds: async () => sync.objectBackedIds(),
+        deleteAutomatically: async (removals, actor) => sync.deleteAutomatically(removals, actor),
+        pruneAuditRows: async (prune) => sync.pruneAuditRows(prune),
+        repairQuality: async (tenantId, apply) => sync.repairQuality(tenantId, apply),
+        repairQualityOnce: async (tenantId) => sync.repairQualityOnce(tenantId),
+    };
+}
+export function sqliteLessonWrites(hippoRoot) {
+    return {
+        tenantEntries: (tenantId) => loadAllEntries(hippoRoot, tenantId),
+        textsHoldingWords: (tenantId, words, ownScope) => loadTextsHoldingWords(hippoRoot, tenantId, words, undefined, touchableScopeSql('', ownScope)),
+        writeSkippingRejected(entries, actor) {
+            const written = [];
+            writeEntriesSkippingRejected(hippoRoot, (put) => {
+                for (const entry of entries)
+                    if (put(entry))
+                        written.push(entry.id);
+            }, actor);
+            return written;
+        },
+        writeTogether(entries) {
+            writeEntriesTogether(hippoRoot, entries);
+        },
+        bumpRemembered(count) {
+            updateStats(hippoRoot, { remembered: count });
+        },
+    };
+}
+export function servedLessonWrites(sync) {
+    return {
+        tenantEntries: async (tenantId) => sync.tenantEntries(tenantId),
+        textsHoldingWords: async (tenantId, words, ownScope) => sync.textsHoldingWords(tenantId, words, ownScope),
+        writeSkippingRejected: async (entries, actor) => sync.writeSkippingRejected(entries, actor),
+        writeTogether: async (entries) => sync.writeTogether(entries),
+        bumpRemembered: async (count) => sync.bumpRemembered(count),
+    };
+}
+//# sourceMappingURL=maintenance-groups.js.map

package/dist/store/sqlite/objects-group.js

@@ -3,6 +3,7 @@ import { appendAuditEvent } from '../audit.js';
 import { getMeta, withWriteScopeOr } from '../../db/index.js';
 import { escapeLike } from '../../util/escape.js';
 import { keysetAfter } from '../../util/keyset.js';
+import { chunked } from '../../util/chunked.js';
 import { calculateStrength, deriveHalfLife } from '../../core/memory.js';
 import { scopeAdmitSql } from '../rule-sql.js';
 import { stampOriginProject, upsertEntryRow } from '../entry-row.js';
@@ -13,6 +14,7 @@ import { LEGACY_TYPED_HALF_LIFE, onHandle, openStore, TYPED_HALF_LIFE_META_KEY }
 import { isObjectRefusal, } from '../port.js';
 import { auditingRefusal } from './entry-writes-group.js';
 import { insertSpec, rowSpec } from './object-rows.js';
+import { placeholders } from '../../util/sql.js';
 export function sqliteObjects(hippoRoot) {
     return {
         listObjects: (tenantId, kind, query) => onHandle(hippoRoot, (db) => listRows(db, tenantId, kind, query)),
@@ -80,7 +82,7 @@ function listRows(db, tenantId, kind, query) {
 function closeRow(db, tenantId, kind, id, close) {
     const spec = rowSpec(kind);
     return withWriteScopeOr(db, 'close_object', (rollback) => {
-        const marks = close.from.map(() => '?').join(', ');
+        const marks = placeholders(close.from.length);
         const updated = db.prepare(`UPDATE ${spec.table} SET status = 'closed', closed_at = ? WHERE id = ? AND tenant_id = ? AND status IN (${marks})`).run(close.at, id, tenantId, ...close.from);
         if (updated.changes === 0) {
             const existing = db.prepare(`SELECT status FROM ${spec.table} WHERE id = ? AND tenant_id = ?`)
@@ -126,7 +128,7 @@ function insertRow(db, row) {
     }
     const result = db.prepare(`
     INSERT INTO ${rowSpec(row.kind).table}(${cols.join(', ')}, status, superseded_by, superseded_at, closed_at, created_at)
-    VALUES (${cols.map(() => '?').join(', ')}, 'active', NULL, NULL, NULL, ?)
+    VALUES (${placeholders(cols.length)}, 'active', NULL, NULL, NULL, ?)
   `).run(...values, row.save.at);
     return Number(result.lastInsertRowid ?? 0);
 }
@@ -217,11 +219,17 @@ function saveAt(hippoRoot, tenantId, kind, save) {
 /** The linked ids are checked once the mirror is in and before the INSERT, so a refusal undoes the mirror with it. */
 function openIncidentRow(db, tenantId, memoryId, open) {
     const { incidentText, context, linkedMemoryIds } = open.fields;
-    for (const linkId of linkedMemoryIds) {
-        const held = db.prepare(`SELECT id FROM memories WHERE id = ? AND tenant_id = ?`).get(linkId, tenantId);
-        if (!held)
-            return { refused: 'unlinked', memoryId: linkId };
+    const held = new Set();
+    for (const ids of chunked(linkedMemoryIds)) {
+        const marks = placeholders(ids.length);
+        // SAFETY: rows' shape matches the one column named in the SELECT.
+        const found = db.prepare(`SELECT id FROM memories WHERE tenant_id = ? AND id IN (${marks})`).all(tenantId, ...ids);
+        for (const r of found)
+            held.add(r.id);
     }
+    const missing = linkedMemoryIds.find((linkId) => !held.has(linkId));
+    if (missing !== undefined)
+        return { refused: 'unlinked', memoryId: missing };
     const result = db.prepare(`
     INSERT INTO incidents(
       memory_id, tenant_id, incident_text, context,

package/dist/store/sqlite/store.d.ts

@@ -1,4 +1,4 @@
-import type { HippoStore, RecallWrites, StoreGroups, Sync } from '../port.js';
+import type { HippoStore, StoreGroups, Sync } from '../port.js';
 /** The store a request runs on: the served one, else hippo.db under its root, as the CLI and SDK callers have it. */
 export declare function storeFor(ctx: {
     readonly hippoRoot: string;
@@ -12,12 +12,5 @@ export type SqliteSyncStore = Sync<Omit<HippoStore, AsyncOnly>>;
 export declare function sqliteSyncStore(hippoRoot: string): SqliteSyncStore & Sync<Omit<StoreGroups, AsyncOnly>>;
 /** `sqliteSyncStore` as a served store: each method runs at once and answers through a Promise, so a throw rejects as another store's would. */
 export declare function sqliteStore(hippoRoot: string): HippoStore & StoreGroups;
-/** What a finished recall wrote after its audit rows: the trace's id, null when none was asked or its write failed, and the ids strengthened. */
-interface RecallFinish {
-    readonly traceId: number | null;
-    readonly strengthened: ReadonlySet<string>;
-}
-/** sqliteStore's finishRecall, for the synchronous recall that cannot await the port. */
-export declare function finishRecallAt(hippoRoot: string, writes: RecallWrites): RecallFinish;
 export {};
 //# sourceMappingURL=store.d.ts.map

package/dist/store/sqlite/store.js

@@ -4,17 +4,17 @@ import { listApiKeyRows, readApiKeyRecord } from '../auth.js';
 import { existsSync } from 'node:fs';
 import { appendAuditEvent, listAuditEventsAfter, queryAuditEvents } from '../audit.js';
 import { getHippoDbPath, withWriteScope } from '../../db/index.js';
-import { activeGoalsWithPolicies, localGoalRecallRows, writeGoalRecallLog } from '../goals.js';
+import { activeGoalsWithPolicies } from '../goals.js';
 import { planningFallacyEvidenceAt } from '../planning-fallacy-evidence.js';
-import { writeRecallTrace } from '../recall-trace.js';
 import { recordTokenUse } from '../token-ledger.js';
 import { loadAmbientCandidates, loadContextCandidates } from '../candidates.js';
 import { loadEntriesByIds, loadFreshRawMemories } from '../entry-reads.js';
-import { strengthenRetrievedInOwnTx } from '../entry-writes.js';
 import { servedConnectorEvents, sqliteConnectorEvents } from './connector-events-group.js';
 import { servedConnectorWrites, sqliteConnectorWrites } from './connector-writes-group.js';
 import { sqliteDagReads } from './dag-reads-group.js';
 import { sqliteEntryWrites } from './entry-writes-group.js';
+import { servedAuditMaintenance, servedLessonWrites, sqliteAuditMaintenance, sqliteLessonWrites } from './maintenance-groups.js';
+import { finishRecallAt, servedLastRecall, sqliteLastRecall } from './last-recall-group.js';
 import { servedGraphReads, sqliteGraphReads } from './graph-reads-group.js';
 import { servedObjects, sqliteObjects } from './objects-group.js';
 import { servedPredictions, sqlitePredictions } from './predictions-group.js';
@@ -25,7 +25,7 @@ import { updateStats } from '../index-and-stats.js';
 import { auditHighIdAt, revokeKeyAt } from '../key-audit.js';
 import { createKeyAt, createSelfKeyAt } from '../key-writes.js';
 import { onHandle } from '../open.js';
-import { loadRecallSearchEntries } from '../search-rows.js';
+import { loadRecallEntries } from '../search-rows.js';
 import { listSessionEvents, loadActiveTaskSnapshot } from '../sessions.js';
 import { entriesWithoutVectorAt, loadStoredVectorViews, writeVectorsAt } from '../vector-index.js';
 /** The store a request runs on: the served one, else hippo.db under its root, as the CLI and SDK callers have it. */
@@ -36,6 +36,7 @@ export function storeFor(ctx) {
 export function sqliteSyncStore(hippoRoot) {
     return {
         kind: 'sqlite',
+        localFiles: { hippoRoot },
         ...sqliteBaseReads(hippoRoot),
         ...sqliteRecallWrites(hippoRoot),
         keyAudit: sqliteKeyAudit(hippoRoot),
@@ -53,6 +54,9 @@ export function sqliteSyncStore(hippoRoot) {
         connectorEvents: sqliteConnectorEvents(hippoRoot),
         objects: sqliteObjects(hippoRoot),
         readiness: sqliteReadiness(hippoRoot),
+        lastRecall: sqliteLastRecall(hippoRoot),
+        auditMaintenance: sqliteAuditMaintenance(hippoRoot),
+        lessonWrites: sqliteLessonWrites(hippoRoot),
         close() { },
     };
 }
@@ -62,7 +66,7 @@ function sqliteBaseReads(hippoRoot) {
             return onHandle(hippoRoot, (db) => readApiKeyRecord(db, keyId));
         },
         searchRecallEntries(query, args) {
-            return loadRecallSearchEntries(hippoRoot, query, args.limit, args.tenantId, args.requestedScope, args.explicitScopeMode, args.includeSuperseded, args.originProjects, args.ownScope);
+            return loadRecallEntries(hippoRoot, query, args);
         },
         entriesByIds(ids, tenantId) {
             return loadEntriesByIds(hippoRoot, ids, tenantId);
@@ -141,6 +145,7 @@ export function sqliteStore(hippoRoot) {
     const sync = sqliteSyncStore(hippoRoot);
     return {
         ...servedBaseMethods(sync),
+        localFiles: sync.localFiles,
         vectors: sqliteVectorReads(hippoRoot),
         vectorViews: { storedVectorViews: async (ids) => sync.vectorViews.storedVectorViews(ids) },
         ...servedKeyGroups(sync),
@@ -153,6 +158,9 @@ export function sqliteStore(hippoRoot) {
         connectorEvents: servedConnectorEvents(sync.connectorEvents),
         objects: servedObjects(sqliteObjects(hippoRoot)),
         readiness: { ping: async () => sync.readiness.ping() },
+        lastRecall: servedLastRecall(sync.lastRecall),
+        auditMaintenance: servedAuditMaintenance(sync.auditMaintenance),
+        lessonWrites: servedLessonWrites(sync.lessonWrites),
         close: async () => sync.close(),
     };
 }
@@ -274,23 +282,4 @@ function continuityAt(hippoRoot, tenantId, eventLimit, key) {
         recentSessionEvents: sessionId ? listSessionEvents(hippoRoot, tenantId, { session_id: sessionId, limit: eventLimit }) : [],
     };
 }
-/** sqliteStore's finishRecall, for the synchronous recall that cannot await the port. */
-export function finishRecallAt(hippoRoot, writes) {
-    return onHandle(hippoRoot, (db) => {
-        const traceAndStrengthen = () => ({
-            traceId: writes.trace ? writeRecallTrace(db, writes.trace) : null,
-            strengthened: writes.strengthen ? strengthenRetrievedInOwnTx(db, writes.strengthen.ids, writes.strengthen.opts) : new Set(),
-        });
-        // Alone, the fail-soft trace and strengthen keep their own scopes so a busy lock loses them, never the read.
-        if (writes.goalLog.length === 0 && writes.audit.length === 0)
-            return traceAndStrengthen();
-        // Inside this scope both run as savepoints, so one recall commits once and a failed trace or strengthen still unwinds alone.
-        return withWriteScope(db, 'finish_recall', () => {
-            writeGoalRecallLog(db, localGoalRecallRows(db, writes.goalLog));
-            for (const event of writes.audit)
-                appendAuditEvent(db, event);
-            return traceAndStrengthen();
-        });
-    });
-}
 //# sourceMappingURL=store.js.map

package/dist/store/summaries.d.ts

@@ -7,6 +7,13 @@ export declare function loadAllL2Summaries(hippoRoot: string): MemoryEntry[];
 export declare function loadAllDirtySummaries(hippoRoot: string, limit?: number): MemoryEntry[];
 /** Live (non-archived) children of a DAG summary, so a rebuild regenerates from the CURRENT child set; tenant-scoped as defence in depth. */
 export declare function loadChildrenOfSummary(hippoRoot: string, summaryId: string, tenantId: string): MemoryEntry[];
+/** loadChildrenOfSummary for many summaries in one IN query per tenant chunk; the map key is `${tenantId}\u0000${summaryId}`, each list in created order. */
+export declare function loadChildrenOfSummaries(hippoRoot: string, summaries: ReadonlyArray<{
+    id: string;
+    tenant_id: string;
+}>): Map<string, MemoryEntry[]>;
+/** Key into the map loadChildrenOfSummaries returns. */
+export declare function childrenKey(tenantId: string, summaryId: string): string;
 /** Patch applied by applyRebuildResult; `bumpRebuildCount` is false for the zero-child case, true for a normal rebuild. */
 export interface RebuildPatch {
     content: string;

package/dist/store/summaries.js

@@ -6,7 +6,9 @@ import { MEMORY_SELECT_COLUMNS, rowToEntry } from './rows.js';
 import { audit } from './audit-event.js';
 import { syncFtsRow } from './entry-row.js';
 import { onHandle, openStore } from './open.js';
+import { chunked } from '../util/chunked.js';
 import { DIGEST_DISPLAY_CHARS } from '../util/token-text.js';
+import { placeholders } from '../util/sql.js';
 // Sleep-cycle rebuild surface: lives here, not in src/consolidate/dag.ts, because it needs module-private MEMORY_SELECT_COLUMNS, MemoryRow, rowToEntry,
 // audit, syncFtsRow and assertTenantId. dag.ts keeps only the thin orchestrator rebuildDirtySummaries().
 /** Host-wide loader for L2 topic summaries without an L3 parent, for consolidate phase 1.9 (buildEntityProfiles); SQL-level filter, since in-memory
@@ -62,10 +64,50 @@ export function loadChildrenOfSummary(hippoRoot, summaryId, tenantId) {
         return rows.map(rowToEntry);
     }, openStore);
 }
+/** loadChildrenOfSummary for many summaries in one IN query per tenant chunk; the map key is `${tenantId}\u0000${summaryId}`, each list in created order. */
+export function loadChildrenOfSummaries(hippoRoot, summaries) {
+    const byTenant = new Map();
+    for (const s of summaries) {
+        assertTenantId('loadChildrenOfSummaries', s.tenant_id);
+        const ids = byTenant.get(s.tenant_id) ?? [];
+        ids.push(s.id);
+        byTenant.set(s.tenant_id, ids);
+    }
+    const out = new Map();
+    onHandle(hippoRoot, (db) => {
+        for (const [tenantId, ids] of byTenant) {
+            for (const slice of chunked(ids)) {
+                // SAFETY: this query selects exactly MEMORY_SELECT_COLUMNS, matching MemoryRow's field set.
+                const rows = db.prepare(`
+          SELECT ${MEMORY_SELECT_COLUMNS}
+            FROM memories
+           WHERE dag_parent_id IN (${placeholders(slice.length)})
+             AND tenant_id = ?
+             AND kind != 'archived'
+             AND superseded_by IS NULL
+           ORDER BY created ASC
+        `).all(...slice, tenantId);
+                for (const entry of rows.map(rowToEntry)) {
+                    const key = childrenKey(tenantId, entry.dag_parent_id ?? '');
+                    const list = out.get(key);
+                    if (list)
+                        list.push(entry);
+                    else
+                        out.set(key, [entry]);
+                }
+            }
+        }
+    }, openStore);
+    return out;
+}
+/** Key into the map loadChildrenOfSummaries returns. */
+export function childrenKey(tenantId, summaryId) {
+    return `${tenantId}\u0000${summaryId}`;
+}
 /** Apply a rebuild result to a dirty summary in one write scope (UPDATE plus syncFtsRow); `AND summary_dirty = 1` makes a concurrent race-loser a no-op.
  * Returns `{ changed, refused }`: `refused` only when a tombstone hit suppressed the content write while the metadata UPDATE still landed. */
 export function applyRebuildResult(hippoRoot, summary, patch) {
-    assertTenantId('applyRebuildResult', summary.tenantId);
+    assertTenantId('applyRebuildResult', summary.tenant_id);
     return onHandle(hippoRoot, (db) => {
         return withWriteScope(db, 'rebuild_summary', () => applyRebuildInSavepoint(db, summary, patch));
     }, openStore);
@@ -99,14 +141,14 @@ function applyRebuildInSavepoint(db, summary, patch) {
     // Check tombstones before choosing the UPDATE: this direct UPDATE bypasses upsertEntryRow's guard, and
     // a deterministic rebuild would otherwise re-assert a rejected value every sleep cycle.
     const tombstone = patch.bumpRebuildCount
-        ? findRejectedValue(db, summary.tenantId, rejectionDigest(patch.content))
+        ? findRejectedValue(db, summary.tenant_id, rejectionDigest(patch.content))
         : null;
     // On a tombstone hit, write no content: take the zero-child metadata-only path (descendant_count/earliest_at/latest_at, summary_dirty cleared, no
     // rebuild_count bump). Clearing dirty is deliberate: leaving it set would make every later sleep re-attempt and re-refuse the same rebuild forever.
     const applyContentWrite = patch.bumpRebuildCount && !tombstone;
     const result = applyContentWrite
-        ? db.prepare(REBUILD_CONTENT_SQL).run(patch.content, patch.descendant_count, patch.earliest_at, patch.latest_at, nowIso, summary.id, summary.tenantId)
-        : db.prepare(REBUILD_METADATA_SQL).run(patch.descendant_count, patch.earliest_at, patch.latest_at, summary.id, summary.tenantId);
+        ? db.prepare(REBUILD_CONTENT_SQL).run(patch.content, patch.descendant_count, patch.earliest_at, patch.latest_at, nowIso, summary.id, summary.tenant_id)
+        : db.prepare(REBUILD_METADATA_SQL).run(patch.descendant_count, patch.earliest_at, patch.latest_at, summary.id, summary.tenant_id);
     // `changed` means THIS call's UPDATE hit a row, so a refusal still settles the cycle (false would retry
     // the doomed rebuild forever); `refused` lets the caller count it as refused rather than rebuilt.
     const changed = (result.changes ?? 0) > 0;
@@ -125,7 +167,7 @@ function auditRefusedRebuild(db, summary, patch, tombstone) {
         targetId: summary.id,
         metadata: { digest: tombstone.digest, reason: tombstone.reason },
         actor: patch.actor,
-        tenantId: summary.tenantId
+        tenantId: summary.tenant_id
     });
     log.warn(`applyRebuildResult: refused rebuild content for ${summary.id} — matches a rejected value ` +
         `(digest ${tombstone.digest.slice(0, DIGEST_DISPLAY_CHARS)}...); metadata updated, content unchanged`);
@@ -139,7 +181,7 @@ function syncRebuiltSummary(db, summary, patch, applyContentWrite, nowIso) {
         descendant_count: patch.descendant_count,
         earliest_at: patch.earliest_at,
         latest_at: patch.latest_at,
-        summary_dirty: 0,
+        summary_dirty: false,
         last_rebuilt_at: applyContentWrite ? nowIso : summary.last_rebuilt_at,
         rebuild_count: applyContentWrite
             ? (summary.rebuild_count ?? 0) + 1
@@ -152,7 +194,7 @@ function syncRebuiltSummary(db, summary, patch, applyContentWrite, nowIso) {
             source: 'E3-rebuild',
             zero_children: patch.zeroChildren,
             descendant_count: patch.descendant_count,
-        }, actor: patch.actor, tenantId: summary.tenantId });
+        }, actor: patch.actor, tenantId: summary.tenant_id });
 }
 /** Clear summary_dirty on a new summary after buildDag's child-link loop (each member's writeEntry marks the parent dirty, so the same cycle would rebuild it).
  * Idempotent (no-op, no audit if not dirty); audit source='buildDag-clean' distinguishes it from the rebuild's. */