hippo-memory 1.72.0 → 2.0.0

package/dist/api/learn.js

@@ -2,23 +2,20 @@
 import { ForbiddenError } from '../core/api-errors.js';
 import { fetchGitLog, extractLessons, partitionLessons, isGitRepo } from '../learn/autolearn.js';
 import { loadConfig } from '../core/config.js';
-import { withRequestStoresSync } from '../db/request-stores.js';
+import { runWithRequestStores } from '../db/request-stores.js';
 import { embedMemory } from '../search/embed-memories.js';
 import { extractInvalidationTarget, invalidateMatching, invalidateMatchingAmong, } from '../learn/invalidation.js';
 import { createMemory, Layer, schemaFitFrom, schemaFitSourceOf } from '../core/memory.js';
 import { extractPathTags } from '../search/path-context.js';
 import { canReadScope, personalScopeOf } from '../core/recall-scope.js';
-import { touchableScopeSql } from '../store/rule-sql.js';
 import { duplicateKey, longestWord, storedTextKeys } from '../util/same-text.js';
-import { loadTextsHoldingWords } from '../store/candidates.js';
-import { loadAllEntries } from '../store/entry-reads.js';
-import { writeEntriesSkippingRejected } from '../store/entry-writes.js';
-import { updateStats } from '../store/index-and-stats.js';
+import { requireGroup } from '../store/index.js';
+import { storeFor } from '../store/sqlite/store.js';
 // SHORTCUT: two profiles keep each surface's rows as they were; fold MCP onto the CLI profile once it may invalidate.
 export const CLI_LEARN = Object.freeze({ tags: Object.freeze(['error', 'git-learned']), source: 'git-learn', full: true });
 export const MCP_LEARN = Object.freeze({ tags: Object.freeze(['git-learned']), source: 'git', full: false });
 /** Learn from `repoPath`'s last `days` of commits into the caller's tenant. Host admin only. */
-export function learn(ctx, opts) {
+export async function learn(ctx, opts) {
     // It reads the host's own git history, which belongs to the host, not to the caller's tenant.
     if (!ctx.actor.hostAdmin)
         throw new ForbiddenError('hippo_learn requires a host admin');
@@ -34,67 +31,71 @@ export function learn(ctx, opts) {
         return { status: 'no-lessons', ...none };
     // The gate filters the loop input, so a dropped lesson neither stores nor invalidates; docs/decisions git-learn-gate-placement says why.
     const { kept, dropped } = partitionLessons(parsed);
-    return { status: 'scanned', lowInfo: dropped.length, ...writeLessons(ctx, kept, opts, config) };
+    return { status: 'scanned', lowInfo: dropped.length, ...await writeLessons(ctx, kept, opts, config) };
 }
-/** Writes `batch` in one transaction; a refused lesson is dropped from `live` and `keys` and must not abort the rest of the git-log scan. */
-function landLessons(ctx, batch, live, keys, counts, full) {
-    if (batch.length === 0)
+/** Writes `queued` in one transaction; a refused lesson is dropped from `live` and `keys` and must not abort the rest of the git-log scan. */
+async function landLessons(batch, queued) {
+    if (queued.length === 0)
         return;
-    // SHORTCUT: hippo.db only, as the port has no batch write, stats bump or whole-tenant read, so another store kind answers 501 at the
-    // open; port groups for them once a served store must learn.
+    const { ctx, writes, live, keys, counts } = batch;
+    const written = new Set(await writes.writeSkippingRejected(queued.map((q) => q.entry), ctx.actor.subject));
     const landed = [];
-    writeEntriesSkippingRejected(ctx.hippoRoot, (put) => {
-        for (const { entry, key } of batch) {
-            if (put(entry)) {
-                landed.push(entry);
-                continue;
-            }
-            counts.rejected++;
-            keys.delete(key);
-            const at = live.indexOf(entry);
-            if (at !== -1)
-                live.splice(at, 1);
+    for (const { entry, key } of queued) {
+        if (written.has(entry.id)) {
+            landed.push(entry);
+            continue;
         }
-    }, ctx.actor.subject);
+        counts.rejected++;
+        keys.delete(key);
+        const at = live.indexOf(entry);
+        if (at !== -1)
+            live.splice(at, 1);
+    }
     counts.added += landed.length;
-    if (!full)
+    if (!batch.full)
         return;
     if (landed.length > 0)
-        updateStats(ctx.hippoRoot, { remembered: landed.length });
+        await writes.bumpRemembered(landed.length);
     for (const entry of landed)
-        void embedMemory(ctx.hippoRoot, entry);
+        void embedMemory(ctx.hippoRoot, entry, undefined, ctx.store);
+}
+/** The duplicate keys a batch skips: every readable row's with `existing`, else only the rows holding a lesson's longest word. */
+async function knownKeys(ctx, writes, lessons, existing) {
+    return storedTextKeys(existing ?? await writes.textsHoldingWords(ctx.tenantId, lessons.map(longestWord), personalScopeOf(ctx.actor)));
 }
-function writeLessons(ctx, lessons, opts, config) {
-    const { hippoRoot, tenantId } = ctx;
+async function writeLessons(ctx, lessons, opts, config) {
+    const { tenantId } = ctx;
     const { profile } = opts;
+    const store = storeFor(ctx);
+    const writes = requireGroup(store, 'lessonWrites');
     // `hippo init` calls this outside any request, so the batch brings its own scope: every read and write below shares one handle.
-    return withRequestStoresSync(() => {
+    return runWithRequestStores(async () => {
         // One read serves the batch: invalidation matches against `live`, which follows every write below, as a reload per lesson did.
-        const live = profile.full ? loadAllEntries(hippoRoot, tenantId) : [];
+        const live = profile.full ? await writes.tenantEntries(tenantId) : [];
         // Schema fit needs every row; without it, only rows holding a lesson's longest word can be its copy. Learn is host-admin only, so
         // both read what an admin can.
         const existing = profile.full ? live.filter((e) => e.scope == null || canReadScope(ctx.actor, e.scope)) : undefined;
         // Each lesson is scored against `existing` as it was before the batch, so its tag counts and texts are read once.
         const fitSource = existing && schemaFitSourceOf(existing);
-        const readable = touchableScopeSql('', personalScopeOf(ctx.actor));
-        const keys = storedTextKeys(existing ?? loadTextsHoldingWords(hippoRoot, tenantId, lessons.map(longestWord), undefined, readable));
+        const batch = {
+            ctx, writes, live, keys: await knownKeys(ctx, writes, lessons, existing), full: profile.full,
+            counts: { added: 0, skipped: 0, rejected: 0, invalidations: [] },
+        };
         const pathTags = profile.full ? extractPathTags(opts.repoPath) : [];
-        const counts = { added: 0, skipped: 0, rejected: 0, invalidations: [] };
         // Lessons queue and land in one transaction; an invalidation reads the store, so it flushes the queue first.
         const queue = [];
-        const flush = () => landLessons(ctx, queue.splice(0), live, keys, counts, profile.full);
         for (const lesson of lessons) {
             const key = duplicateKey(lesson);
-            if (keys.has(key)) {
-                counts.skipped++;
+            if (batch.keys.has(key)) {
+                batch.counts.skipped++;
                 continue;
             }
             const target = profile.full ? extractInvalidationTarget(lesson) : null;
             if (target) {
-                flush();
-                const { invalidated } = invalidateMatchingAmong(hippoRoot, live, target, tenantId);
+                await landLessons(batch, queue.splice(0));
+                const { invalidated } = await invalidateMatchingAmong(store, live, target, tenantId);
                 if (invalidated > 0)
-                    counts.invalidations.push({ from: target.from, count: invalidated });
+                    batch.counts.invalidations.push({ from: target.from, count: invalidated });
             }
             const entry = createMemory(lesson, {
                 layer: Layer.Episodic,
@@ -111,10 +112,10 @@ function writeLessons(ctx, lessons, opts, config) {
             queue.push({ entry, key });
             if (profile.full)
                 live.push(entry);
-            keys.add(key);
+            batch.keys.add(key);
         }
-        flush();
-        return counts;
+        await landLessons(batch, queue.splice(0));
+        return batch.counts;
     });
 }
 /** `hippo invalidate`: weakens the caller's tenant's memories that reference `target.from`, or only the one `options.onlyId` names. */

package/dist/api/memories.d.ts

@@ -14,8 +14,10 @@ export declare function getMemoryStatus(ctx: Context, now: Date, atRiskBelow: nu
 export interface TenantReach {
     everyTenant?: boolean;
 }
-/** Every memory row in reach, oldest first. */
-export declare function listMemories(ctx: Context, reach?: TenantReach): MemoryEntry[];
+/** Every memory row in reach, oldest first, read `pageSize` rows per query so no single read grows with the store. */
+export declare function listMemories(ctx: Context, reach?: TenantReach, opts?: {
+    pageSize?: number;
+}): MemoryEntry[];
 /** How many memory rows the whole store holds, counted in SQL. */
 export declare function countAllMemories(ctx: Context): number;
 /** The rows in reach among `ids`; a missing id or one out of reach is absent. */

package/dist/api/memories.js

@@ -2,8 +2,8 @@ import { loadStrengthTallies } from '../store/candidates.js';
 import { countOpenConflicts } from '../store/conflicts.js';
 import { NotFoundError } from '../core/api-errors.js';
 import { canTouchScope } from '../core/recall-scope.js';
-import { storeFor } from '../store/index.js';
-import { countAllEntries, loadAllEntries, loadEntriesByIds } from '../store/entry-reads.js';
+import { storeFor } from '../store/sqlite/store.js';
+import { countAllEntries, loadEntriesByIds, loadEntriesPage } from '../store/entry-reads.js';
 import { requireHostAdmin } from './types.js';
 /** The row `id` in the caller's tenant, or null when it is missing or another tenant's. */
 export async function getMemory(ctx, id) {
@@ -30,9 +30,20 @@ function tenantFilter(ctx, reach) {
     requireHostAdmin(ctx, 'Reading every tenant');
     return undefined;
 }
-/** Every memory row in reach, oldest first. */
-export function listMemories(ctx, reach = {}) {
-    return loadAllEntries(ctx.hippoRoot, tenantFilter(ctx, reach));
+/** Rows a listing reads per query by default; the verbs still receive every row. */
+const LIST_PAGE_SIZE = 1000;
+/** Every memory row in reach, oldest first, read `pageSize` rows per query so no single read grows with the store. */
+export function listMemories(ctx, reach = {}, opts = {}) {
+    const tenant = tenantFilter(ctx, reach);
+    const limit = Math.max(1, Math.trunc(opts.pageSize ?? LIST_PAGE_SIZE));
+    const all = [];
+    let after;
+    do {
+        const page = loadEntriesPage(ctx.hippoRoot, tenant, { limit, after });
+        all.push(...page.entries);
+        after = page.next ?? undefined;
+    } while (after);
+    return all;
 }
 /** How many memory rows the whole store holds, counted in SQL. */
 export function countAllMemories(ctx) {

package/dist/api/objects.js

@@ -1,5 +1,6 @@
 import { saveObject } from '../objects/lifecycle.js';
-import { requireGroup, storeFor } from '../store/index.js';
+import { requireGroup } from '../store/index.js';
+import { storeFor } from '../store/sqlite/store.js';
 /** The request store's object group; the dispatcher has already answered 501 for a store without it. */
 export function objectsOf(ctx) {
     return requireGroup(storeFor(ctx), 'objects');

package/dist/api/outcome.d.ts

@@ -1,4 +1,4 @@
-import type { Context, StoreReply } from './types.js';
+import type { Context } from './types.js';
 /** An id outside ctx.tenantId, or in someone else's personal scope, is skipped, so a stale id never fails the call.
  *  `appliedIds` holds only the ids applied: a caller that answers across tenants returns it, never the ids it was sent. */
 export interface OutcomeResult {
@@ -6,14 +6,14 @@ export interface OutcomeResult {
     appliedIds: string[];
 }
 /** `opts.traceId` links the outcome to the recall trace it judges. Only outcomeForLastRecall sends one: explicit ids may follow no recall at all. */
-export declare function outcome<C extends Context>(ctx: C, ids: ReadonlyArray<string>, good: boolean, opts?: {
+export declare function outcome(ctx: Context, ids: ReadonlyArray<string>, good: boolean, opts?: {
     traceId?: number;
-}): StoreReply<C, OutcomeResult>;
-/** The last recall's ids and its trace sit in hippo.db's meta table, which only the CLI and context write, so a store of another kind is refused.
+}): Promise<OutcomeResult>;
+/** The last recall's ids and its trace sit with the store's lastRecall group, which only the CLI and context write; a store without it is refused.
  *  `ids` holds only the ids applied in ctx.tenantId: the index is not tenant-scoped, so the ids read from it are never returned. */
 export interface OutcomeForLastRecallResult {
     applied: number;
     ids: string[];
 }
-export declare function outcomeForLastRecall<C extends Context>(ctx: C, good: boolean): StoreReply<C, OutcomeForLastRecallResult>;
+export declare function outcomeForLastRecall(ctx: Context, good: boolean): Promise<OutcomeForLastRecallResult>;
 //# sourceMappingURL=outcome.d.ts.map

package/dist/api/outcome.js

@@ -1,21 +1,22 @@
 // Outcome feedback on recalled memories.
 import { personalScopeOf } from '../core/recall-scope.js';
-import { andThen, notPorted, onStore } from './on-store.js';
+import { requireGroup } from '../store/index.js';
+import { storeFor } from '../store/sqlite/store.js';
 /** `opts.traceId` links the outcome to the recall trace it judges. Only outcomeForLastRecall sends one: explicit ids may follow no recall at all. */
-export function outcome(ctx, ids, good, opts) {
-    return onStore(ctx, (port, local) => {
-        const entryWrites = port.entryWrites ?? notPorted(port, 'entryWrites');
-        const write = { tenantId: ctx.tenantId, actor: ctx.actor.subject, ownScope: personalScopeOf(ctx.actor), ids, good };
-        const traceId = opts?.traceId;
-        // The trace link is written on hippo.db's own handle after the commit, so a served store refuses a traceId.
-        const applied = traceId === undefined ? entryWrites.applyOutcome(write) : local.applyOutcome(write, traceId);
-        return andThen(applied, (appliedIds) => ({ applied: appliedIds.length, appliedIds }));
-    });
+export async function outcome(ctx, ids, good, opts) {
+    const store = storeFor(ctx);
+    const entryWrites = requireGroup(store, 'entryWrites');
+    const write = { tenantId: ctx.tenantId, actor: ctx.actor.subject, ownScope: personalScopeOf(ctx.actor), ids, good };
+    const traceId = opts?.traceId;
+    // Recall traces live beside the last recall, so only a store with the lastRecall group can link one.
+    const appliedIds = traceId === undefined
+        ? await entryWrites.applyOutcome(write)
+        : await requireGroup(store, 'lastRecall').applyTracedOutcome(write, traceId);
+    return { applied: appliedIds.length, appliedIds };
 }
-export function outcomeForLastRecall(ctx, good) {
-    return onStore(ctx, (_port, local) => {
-        const ids = local.applyOutcomeToLastRecall({ tenantId: ctx.tenantId, actor: ctx.actor.subject, ownScope: personalScopeOf(ctx.actor) }, good);
-        return { applied: ids.length, ids };
-    });
+export async function outcomeForLastRecall(ctx, good) {
+    const lastRecall = requireGroup(storeFor(ctx), 'lastRecall');
+    const ids = await lastRecall.applyOutcomeToLast({ tenantId: ctx.tenantId, actor: ctx.actor.subject, ownScope: personalScopeOf(ctx.actor) }, good);
+    return { applied: ids.length, ids };
 }
 //# sourceMappingURL=outcome.js.map

package/dist/api/predictions.js

@@ -1,6 +1,7 @@
 import { predictionMirror } from '../store/predictions.js';
 import { loadConfig } from '../core/config.js';
-import { requireGroup, storeFor } from '../store/index.js';
+import { requireGroup } from '../store/index.js';
+import { storeFor } from '../store/sqlite/store.js';
 const predictionsOf = (ctx) => requireGroup(storeFor(ctx), 'predictions');
 export async function savePrediction(ctx, input) {
     return predictionsOf(ctx).savePrediction(ctx.tenantId, input, ctx.actor.subject);

package/dist/api/promote.d.ts

@@ -1,6 +1,6 @@
 import type { ConnectorEvent } from '../store/port.js';
 import { type Layer } from '../core/memory.js';
-import type { Context, StoreReply } from './types.js';
+import type { Context } from './types.js';
 /** Copies a local memory into the global store; the inner writeEntry emits 'remember' there, and we add a 'promote' audit event so intent stays distinct.
  * promoteToGlobal reads via `readEntry` with no tenant filter and keeps the entry's existing tenantId on the global side. */
 export interface PromoteResult {
@@ -21,7 +21,7 @@ export interface SupersedeOverrides {
     tags?: string[];
     pinned?: boolean;
 }
-export declare function supersede<C extends Context>(ctx: C, oldId: string, newContent: string, overrides?: SupersedeOverrides): StoreReply<C, SupersedeResult>;
+export declare function supersede(ctx: Context, oldId: string, newContent: string, overrides?: SupersedeOverrides): Promise<SupersedeResult>;
 /** Archive a kind='raw' memory: its metadata moves to raw_archive and the row is
  * deleted. The store writes the one archive_raw audit row, under the caller's subject. */
 export interface ArchiveRawOpts {
@@ -32,5 +32,5 @@ export interface ArchiveRawResult {
     ok: true;
     archivedAt: string;
 }
-export declare function archiveRaw<C extends Context>(ctx: C, id: string, reason: string, opts?: ArchiveRawOpts): StoreReply<C, ArchiveRawResult>;
+export declare function archiveRaw(ctx: Context, id: string, reason: string, opts?: ArchiveRawOpts): Promise<ArchiveRawResult>;
 //# sourceMappingURL=promote.d.ts.map

package/dist/api/promote.js

@@ -4,7 +4,8 @@ import { stampOriginProject } from '../store/entry-row.js';
 import { createSuccessor } from '../core/memory.js';
 import { promoteToGlobal } from '../sharing/global-store.js';
 import { loadConfig } from '../core/config.js';
-import { andThen, notPorted, onStore } from './on-store.js';
+import { requireGroup } from '../store/index.js';
+import { storeFor } from '../store/sqlite/store.js';
 import { memoryReach } from '../store/tenant-lookup.js';
 import { canTouchScope, personalScopeOf } from '../core/recall-scope.js';
 export function promote(ctx, id) {
@@ -22,23 +23,21 @@ export function promote(ctx, id) {
     });
     return { ok: true, sourceId: id, globalId: globalEntry.id };
 }
-export function supersede(ctx, oldId, newContent, overrides = {}) {
-    return onStore(ctx, (port) => {
-        const entryWrites = port.entryWrites ?? notPorted(port, 'entryWrites');
-        return andThen(port.entriesByIds([oldId], ctx.tenantId), ([old]) => {
-            const newEntry = createSuccessor(assertSupersedable(ctx, oldId, old ?? null), newContent, {
-                tenantId: ctx.tenantId,
-                baseHalfLifeDays: loadConfig(ctx.hippoRoot).defaultHalfLifeDays,
-                layer: overrides.layer,
-                tags: overrides.tags,
-                pinned: overrides.pinned,
-            });
-            // A store writes origin_project as given, so the served folder's fallback is stamped here.
-            const successor = stampOriginProject(ctx.hippoRoot, newEntry);
-            const write = { tenantId: ctx.tenantId, actor: ctx.actor.subject, ownScope: personalScopeOf(ctx.actor), oldId, successor };
-            return andThen(entryWrites.supersede(write), () => ({ ok: true, oldId, newId: successor.id }));
-        });
+export async function supersede(ctx, oldId, newContent, overrides = {}) {
+    const store = storeFor(ctx);
+    const entryWrites = requireGroup(store, 'entryWrites');
+    const [old] = await store.entriesByIds([oldId], ctx.tenantId);
+    const newEntry = createSuccessor(assertSupersedable(ctx, oldId, old ?? null), newContent, {
+        tenantId: ctx.tenantId,
+        baseHalfLifeDays: loadConfig(ctx.hippoRoot).defaultHalfLifeDays,
+        layer: overrides.layer,
+        tags: overrides.tags,
+        pinned: overrides.pinned,
     });
+    // A store writes origin_project as given, so the served folder's fallback is stamped here.
+    const successor = stampOriginProject(ctx.hippoRoot, newEntry);
+    await entryWrites.supersede({ tenantId: ctx.tenantId, actor: ctx.actor.subject, ownScope: personalScopeOf(ctx.actor), oldId, successor });
+    return { ok: true, oldId, newId: successor.id };
 }
 /** The tenant-scoped row to supersede; another tenant's id, or someone else's personal row, reads as not found. */
 function assertSupersedable(ctx, oldId, old) {
@@ -51,15 +50,14 @@ function assertSupersedable(ctx, oldId, old) {
     }
     return old;
 }
-export function archiveRaw(ctx, id, reason, opts = {}) {
-    return onStore(ctx, (port) => {
-        const entryWrites = port.entryWrites ?? notPorted(port, 'entryWrites');
-        const archive = { tenantId: ctx.tenantId, actor: ctx.actor.subject, ownScope: personalScopeOf(ctx.actor), id, reason };
-        const { event } = opts;
-        const archived = event
-            ? (port.connectorWrites ?? notPorted(port, 'connectorWrites')).archiveConnectorEntry({ ...archive, event })
-            : entryWrites.archiveRaw(archive);
-        return andThen(archived, (archivedAt) => ({ ok: true, archivedAt }));
-    });
+export async function archiveRaw(ctx, id, reason, opts = {}) {
+    const store = storeFor(ctx);
+    const entryWrites = requireGroup(store, 'entryWrites');
+    const archive = { tenantId: ctx.tenantId, actor: ctx.actor.subject, ownScope: personalScopeOf(ctx.actor), id, reason };
+    const { event } = opts;
+    const archivedAt = event
+        ? await requireGroup(store, 'connectorWrites').archiveConnectorEntry({ ...archive, event })
+        : await entryWrites.archiveRaw(archive);
+    return { ok: true, archivedAt };
 }
 //# sourceMappingURL=promote.js.map

package/dist/api/prompt-hook.d.ts

@@ -1,5 +1,5 @@
 import { type Context, type ContextResult, type ContextResultEntry } from './index.js';
-import { type DeliveryEventType, type DeliveryRecorder } from '../store/delivery-recorder.js';
+import { type DeliveryEventType, type DeliveryFault, type DeliveryRecorder } from '../store/delivery-recorder.js';
 import type { HookRuntime } from '../core/capture-contract.js';
 import { type JsonValue } from '../util/json.js';
 import type { MemoryEntry } from '../core/memory.js';
@@ -12,6 +12,8 @@ export interface DeliveryStart {
     eventType?: DeliveryEventType;
     /** The host's own session id from its environment, used when the payload names none. */
     envSessionId: string | undefined;
+    /** Passed through to the recorder; only tests set it. */
+    fault?: DeliveryFault;
 }
 /** A delivery recorder for a hook on `ctx.hippoRoot` when the ledger store enables one, else null; never throws. */
 export declare function startDeliveryRecorder(ctx: Context, start: DeliveryStart): DeliveryRecorder | null;

package/dist/api/prompt-hook.js

@@ -35,6 +35,7 @@ export function startDeliveryRecorder(ctx, start) {
             envSessionId: start.envSessionId,
             runtime: start.runtime === 'copilot' ? 'copilot' : undefined,
             eventType: start.eventType,
+            fault: start.fault,
         });
     }
     catch (error) {

package/dist/api/quarantine.js

@@ -1,6 +1,7 @@
 // Quarantine review: list, approve and reject held memories.
 import { ConflictError, ForbiddenError, NotFoundError } from '../core/api-errors.js';
-import { requireGroup, storeFor } from '../store/index.js';
+import { requireGroup } from '../store/index.js';
+import { storeFor } from '../store/sqlite/store.js';
 const QUARANTINE_PREVIEW_CHARS = 200;
 /** A tenant's quarantined memories, newest first. Default `status` is 'pending' (the review queue). */
 export async function quarantineList(ctx, opts = {}) {

package/dist/api/recall-core.js

@@ -5,7 +5,7 @@ import { decidePlanningFallacy, detectPlanningClaim } from '../predictions/plann
 import { rankRecall } from './recall-pipeline.js';
 import { writeRecallTraceAtRoot } from '../store/recall-trace.js';
 import { saveIndex } from '../store/index-and-stats.js';
-import { sqliteStore, storeFor } from '../store/index.js';
+import { storeFor } from '../store/sqlite/store.js';
 import { estimateTokens } from '../util/token-text.js';
 import { callerOf, recallAuditMetadata, recallAuditRow, strengthenOf } from './recall-record.js';
 import { RECALL_RECORDING, recordShownRecall } from './recall-finish.js';
@@ -58,7 +58,7 @@ async function recordShown(ctx, store, opts, core, done) {
     const { ranking, shown, planningAudit } = done;
     const ids = shown.results.map((r) => r.entry.id);
     const recallRow = recallAuditRow(callerOf(ctx), 'recall', undefined, recallAuditMetadata(opts.query, ids.length));
-    const second = core.sources?.globalRoot !== undefined && core.sources.globalRoot !== ctx.hippoRoot ? core.sources.globalRoot : undefined;
+    const second = secondStore(ctx, core);
     const heldElsewhere = second !== undefined ? await idsNotHeld(store, ids, ctx.tenantId) : [];
     const audited = await finishOrReport(store, {
         goalLog: ranking.goalRecallLog,
@@ -68,7 +68,7 @@ async function recordShown(ctx, store, opts, core, done) {
     if (audited) {
         // The second store logs that it was searched, and strengthens only the rows the first does not hold.
         if (second !== undefined)
-            await finishOrReport(sqliteStore(second), { goalLog: [], audit: [recallRow], strengthen: strengthenOf(ctx, heldElsewhere) });
+            await finishOrReport(second, { goalLog: [], audit: [recallRow], strengthen: strengthenOf(ctx, heldElsewhere) });
         traceAndMark(ctx, opts, core, shown.results);
     }
     // The caller prints whether or not the record was written, so the ring and the ledger still take this list; `written` holds back the count.
@@ -83,6 +83,11 @@ async function recordShown(ctx, store, opts, core, done) {
         written: audited,
     });
 }
+/** The second store's writes go where the first's do: the store named for its root, else hippo.db under that root. */
+function secondStore(ctx, core) {
+    const root = core.sources?.globalRoot;
+    return root !== undefined && root !== ctx.hippoRoot ? storeFor({ hippoRoot: root, store: core.sources?.globalStore }) : undefined;
+}
 // The caller has ranked and is about to print, so a failed audit write is logged and counted, never thrown.
 async function finishOrReport(store, writes) {
     try {

package/dist/api/recall-pipeline.js

@@ -13,10 +13,10 @@ import { multihopSearch } from '../search/multihop.js';
 import { passesCliRecallScopeFilter } from '../core/recall-scope.js';
 import { currentEntries } from '../search/as-of.js';
 import { STRENGTH_RANK_FLOOR, STRENGTH_RANK_SPAN } from '../search/boosts.js';
-import { hybridSearch } from '../search/hybrid.js';
-import { physicsSearch } from '../search/physics-search.js';
+import { hybridSearch, vectorSourceOf } from '../search/hybrid.js';
+import { searchByEngine } from '../search/engine.js';
 import { rankBothStores } from '../sharing/search-both.js';
-import { loadRecallSearchEntries, recallScopeFilter } from '../store/search-rows.js';
+import { loadRecallEntries, recallScopeFilter } from '../store/search-rows.js';
 import { isJsonNumber } from '../util/json.js';
 import { textOverlap, tokenize as tokenizeQuery } from '../util/tokenize.js';
 /** Ranks memories for a query as `hippo recall` does, through the `limit` slice. Reads stores, embeddings and physics state; writes and prints nothing
@@ -65,10 +65,9 @@ function loadRecallPool(ctx, opts) {
     // An explicit --scope unlocks that envelope scope; the regex-only `<source>:private:*` deny is the JS half below.
     const requested = opts.explicitScope || undefined;
     const loadSuperseded = opts.includeSuperseded || Boolean(opts.asOf);
-    let local = loadRecallSearchEntries(ctx.hippoRoot, opts.query, undefined, ctx.tenantId, requested, 'additive', loadSuperseded);
-    let global = ctx.globalRoot
-        ? loadRecallSearchEntries(ctx.globalRoot, opts.query, undefined, ctx.tenantId, requested, 'additive', loadSuperseded)
-        : [];
+    const load = { tenantId: ctx.tenantId, requestedScope: requested, explicitScopeMode: 'additive', includeSuperseded: loadSuperseded };
+    let local = loadRecallEntries(ctx.hippoRoot, opts.query, load);
+    let global = ctx.globalRoot ? loadRecallEntries(ctx.globalRoot, opts.query, load) : [];
     // SQL-excluded rows are pre-candidate, so the total is taken before the JS filters, which normally drop nothing.
     const total = local.length + global.length;
     const passes = (e) => passesCliRecallScopeFilter(e.scope ?? null, requested);
@@ -109,13 +108,6 @@ async function searchPool(ctx, opts, pool) {
         includeSuperseded: includeSuperseded || Boolean(asOf),
         admit: (e) => passesCliRecallScopeFilter(e.scope ?? null, requested),
     };
-    if (search.usePhysics && !globalRoot) {
-        // Explain leaves minResults and includeSuperseded out to hold its output steady; asOf must reach physics or later rows leak.
-        const temporal = explain ? { asOf } : { minResults, includeSuperseded, asOf };
-        return physicsSearch(query, pool.local, {
-            budget, cost, hippoRoot: ctx.hippoRoot, physicsConfig: search.physicsConfig, scope, explain, vectorCandidates, ...temporal
-        });
-    }
     if (globalRoot) {
         // The pool already holds searchBothHybrid's additive-scope load for each store, so rank it rather than read both stores again.
         return rankBothStores(query, { local: ctx.hippoRoot, global: globalRoot }, { local: pool.local, global: pool.global }, vectorCandidates, {
@@ -123,9 +115,17 @@ async function searchPool(ctx, opts, pool) {
             includeSuperseded, asOf,
         });
     }
-    return hybridSearch(query, pool.local, {
-        budget, cost, hippoRoot: ctx.hippoRoot, explain, mmr, mmrLambda, minResults, scope, includeSuperseded, asOf, vectorCandidates
-    });
+    const physics = search.usePhysics ? search.physicsConfig : null;
+    // Physics takes no MMR; explain drops minResults and includeSuperseded to hold its output steady; asOf must reach physics or later rows leak.
+    const tuning = !physics ? { mmr, mmrLambda, minResults, includeSuperseded, asOf } : explain ? { asOf } : { minResults, includeSuperseded, asOf };
+    return searchByEngine(hippoDbSource(ctx.hippoRoot), query, pool.local, physics, { budget, cost, scope, explain, vectorCandidates, ...tuning });
+}
+/** The CLI core holds no store: it ranks on hippo.db under its root, as its loads above do. */
+function hippoDbSource(hippoRoot) {
+    const source = vectorSourceOf({ hippoRoot });
+    if (!source)
+        throw new Error('The CLI ranking core needs a hippo root to rank on');
+    return source;
 }
 /** Adds memories reached by walking the entity graph out from the lexical seeds. */
 function expandGraph(ctx, opts, graph, state) {

package/dist/api/recall-types.d.ts

@@ -5,6 +5,7 @@ import type { PlanningFallacyHint, PlanningFallacyOutput, PlanningFallacyWatchin
 import type { AnchoringHint, RecallHistorySnapshot } from './recall-history.js';
 import type { AvailabilityHint } from './availability.js';
 import type { AppendAuditOpts } from '../store/audit.js';
+import type { HippoStore } from '../store/port.js';
 import type { CallerProject } from './prompt-hook.js';
 import type { RankRecallOpts, RankRecallResult } from './recall-pipeline.js';
 import type { RecallRecording } from './recall-finish.js';
@@ -60,9 +61,10 @@ export interface RecallOpts {
 }
 interface CliCoreRanking {
     rank: Omit<RankRecallOpts, 'query' | 'sessionId' | 'goalTag'>;
-    /** A second store searched beside `ctx.hippoRoot`. */
+    /** A second store searched beside `ctx.hippoRoot`; its recall rows go to `globalStore`, else hippo.db under `globalRoot`. */
     sources?: {
         globalRoot?: string;
+        globalStore?: HippoStore;
     };
     /** Receives each operator note when ranking reaches it. */
     note?: (line: string) => void;