hippo-memory 1.72.0 → 2.1.0

package/dist/store/recall-trace.d.ts

@@ -1,6 +1,7 @@
-/** Retrieval-trace persistence: the single producer for `recall_traces`, `recall_trace_results` and `recall_trace_outcomes`.
- * One trace row per recall on api.recall, api.getContext and CLI cmdRecall: the (query, shown, outcome) triple the learned components train on.
- * All writes are fail-soft: a failed trace write is logged to stderr and swallowed, never breaking the surrounding call. */
+/** Retrieval-trace persistence: the single producer for `recall_traces`, `recall_trace_results` and
+ * `recall_trace_outcomes`. One trace row per recall on api.recall, api.getContext and CLI cmdRecall: the (query, shown,
+ * outcome) triple the learned components train on. All writes are fail-soft: a failed trace write is logged to stderr
+ * and swallowed, never breaking the surrounding call. */
 import { type DatabaseSyncLike } from '../db/index.js';
 import type { RerankStep } from '../core/search-types.js';
 import { type DeliveryEventInput } from './delivery-recorder.js';
@@ -12,7 +13,7 @@ export interface RecallTraceResultInput {
      *  (or empty) persists `rerank_json` as NULL. */
     rerankSteps?: RerankStep[];
 }
-/** Input to `writeRecallTrace` / `writeRecallTraceAtRoot`. */
+/** Input to `writeRecallTrace`. */
 export interface RecallTraceInput {
     tenantId: string;
     sessionId?: string | null;
@@ -26,12 +27,9 @@ export interface RecallTraceInput {
     /** Results in returned rank order (index 0 = rank 1). */
     results: RecallTraceResultInput[];
 }
-/** Insert a `recall_traces` row and its results rows in ONE transaction on the given connection. Fail-soft: logs to stderr and returns null on failure.
- * api.recall/getContext reach this via `finishRecallAt` on their own handle; CLI cmdRecall uses `writeRecallTraceAtRoot` (its audit handle is closed). */
+/** Insert a `recall_traces` row and its results rows in ONE transaction on the given connection. Fail-soft: logs to
+ * stderr and returns null on failure. api.recall/getContext reach this via `finishRecallAt` on their own handle. */
 export declare function writeRecallTrace(db: DatabaseSyncLike, input: RecallTraceInput): number | null;
-/** Short-lived connection at `root`: writes the trace, closes; returns the id or null (fail-soft). For CLI cmdRecall; api.recall must reuse its open handle.
- * LOCKSTEP: never touches `last_trace_id`, which advances only in the same `saveIndex` write as `last_retrieval_ids`; the caller sets it from the id. */
-export declare function writeRecallTraceAtRoot(root: string, input: RecallTraceInput): number | null;
 /** Input to `recordTraceOutcome`. */
 export interface RecordTraceOutcomeInput {
     traceId: number;
@@ -40,14 +38,17 @@ export interface RecordTraceOutcomeInput {
     /** Ids actually credited by this outcome event (post tenant-filtering). */
     memoryIds: string[];
 }
-/** Record an outcome against a trace; call ONLY with ids from last-retrieval state or an SDK `traceId`, never from api.outcome (stale-trace mislink).
- * Skips (log.warn) unless the trace is in `input.tenantId`; keeps only memoryIds it returned. Own table so `pruneAuditLog` cannot erase training data. */
+/** Record an outcome against a trace; call ONLY with ids from last-retrieval state or an SDK `traceId`, never from
+ * api.outcome (stale-trace mislink). Skips (log.warn) unless the trace is in `input.tenantId`; keeps only memoryIds it
+ * returned. Own table so `pruneAuditLog` cannot erase training data. */
 export declare function recordTraceOutcome(db: DatabaseSyncLike, input: RecordTraceOutcomeInput): void;
-/** Pruned on write, counted back from the event's ts capped at the real clock, so a far-future fake time spares real rows. */
+/** Pruned on write, counted back from the event's ts capped at the real clock, so a far-future fake time spares real
+ * rows. */
 export declare const DELIVERY_LEDGER_RETENTION_DAYS = 90;
 /** Lock wait for the ledger's own connection: a busy store drops the row rather than slow the hook. */
 export declare const DELIVERY_LEDGER_WAIT_MS = 50;
-/** Two prompt-identical events without a host turn id, or two boundary events of one type, this close are one fire twice. */
+/** Two prompt-identical events without a host turn id, or two boundary events of one type, this close are one fire
+ * twice. */
 export declare const DELIVERY_DUPLICATE_WINDOW_MS = 2000;
 /** One stored `delivery_candidates` row. */
 export interface DeliveryCandidateRow {
@@ -105,12 +106,16 @@ export interface DeliveryEventRow {
     failure_id: number | null;
     candidates: DeliveryCandidateRow[];
 }
-/** One event plus its candidates in one write transaction, then prune; fail-soft. The caller must not hold a transaction on `db`. */
+/** One event plus its candidates in one write transaction, then prune; fail-soft. The caller must not hold a
+ * transaction on `db`. */
 export declare function writeDeliveryEvent(db: DatabaseSyncLike, input: DeliveryEventInput): number | null;
-/** Write on the request's handle, or a short-lived one, waiting at most {@link DELIVERY_LEDGER_WAIT_MS} for the lock. Fail-soft. */
+/** Write on the request's handle, or a short-lived one, waiting at most {@link DELIVERY_LEDGER_WAIT_MS} for the lock.
+ * Fail-soft. */
 export declare function writeDeliveryEventAtRoot(root: string, input: DeliveryEventInput): number | null;
-/** On a caller's open handle, which saves a second open and close per turn; the handle's own lock wait comes back after. */
+/** On a caller's open handle, which saves a second open and close per turn; the handle's own lock wait comes back
+ * after. */
 export declare function writeDeliveryEventOnHandle(db: DatabaseSyncLike, input: DeliveryEventInput): number | null;
-/** A session's delivery events in write order, each with its candidate rows; `sessionId` null reads session-less events. */
+/** A session's delivery events in write order, each with its candidate rows; `sessionId` null reads session-less
+ * events. */
 export declare function readDeliveryEvents(db: DatabaseSyncLike, tenantId: string, sessionId: string | null): DeliveryEventRow[];
 //# sourceMappingURL=recall-trace.d.ts.map

package/dist/store/recall-trace.js

@@ -1,14 +1,16 @@
-/** Retrieval-trace persistence: the single producer for `recall_traces`, `recall_trace_results` and `recall_trace_outcomes`.
- * One trace row per recall on api.recall, api.getContext and CLI cmdRecall: the (query, shown, outcome) triple the learned components train on.
- * All writes are fail-soft: a failed trace write is logged to stderr and swallowed, never breaking the surrounding call. */
+/** Retrieval-trace persistence: the single producer for `recall_traces`, `recall_trace_results` and
+ * `recall_trace_outcomes`. One trace row per recall on api.recall, api.getContext and CLI cmdRecall: the (query, shown,
+ * outcome) triple the learned components train on. All writes are fail-soft: a failed trace write is logged to stderr
+ * and swallowed, never breaking the surrounding call. */
 import { openHippoDb, closeHippoDb, withWriteScope } from '../db/index.js';
-import { rethrowIfSqliteBlocked } from '../util/sqlite-blocked.js';
 import { DELIVERY_LEDGER_VERSION, isBoundaryEvent } from './delivery-recorder.js';
 import { errorFields, errorMessage, log } from '../util/log.js';
 import { DAY_MS } from '../util/time.js';
 import { blockHash } from '../util/token-text.js';
-/** Strip a RerankStep to {stage, multiplier, scoreBefore, scoreAfter}: `note` is free-form (the CLI goal-boost step embeds goal tag text) and would leak
- * user content into `rerank_json`; an allowlist, so any future free-form field is dropped too. */
+import { placeholders } from '../util/sql.js';
+/** Strip a RerankStep to {stage, multiplier, scoreBefore, scoreAfter}: `note` is free-form (the CLI goal-boost step
+ * embeds goal tag text) and would leak user content into `rerank_json`; an allowlist, so any future free-form field is
+ * dropped too. */
 function sanitizeRerankSteps(steps) {
     return steps.map((s) => ({
         stage: s.stage,
@@ -17,15 +19,16 @@ function sanitizeRerankSteps(steps) {
         scoreAfter: s.scoreAfter,
     }));
 }
-/** Insert a `recall_traces` row and its results rows in ONE transaction on the given connection. Fail-soft: logs to stderr and returns null on failure.
- * api.recall/getContext reach this via `finishRecallAt` on their own handle; CLI cmdRecall uses `writeRecallTraceAtRoot` (its audit handle is closed). */
+/** Insert a `recall_traces` row and its results rows in ONE transaction on the given connection. Fail-soft: logs to
+ * stderr and returns null on failure. api.recall/getContext reach this via `finishRecallAt` on their own handle. */
 export function writeRecallTrace(db, input) {
     try {
         const queryHash = blockHash(input.query);
         const ts = new Date().toISOString();
         return withWriteScope(db, 'write_recall_trace', () => {
             const insertTrace = db.prepare(`
-        INSERT INTO recall_traces (ts, tenant_id, session_id, pipeline, query_hash, query_length, result_count, explain_mode)
+        INSERT INTO recall_traces (ts, tenant_id, session_id, pipeline, query_hash, query_length, result_count,
+        explain_mode)
         VALUES (?, ?, ?, ?, ?, ?, ?, ?)
       `);
             const traceResult = insertTrace.run(ts, input.tenantId, input.sessionId ?? null, input.pipeline, queryHash, input.query.length, input.results.length, input.explainMode ? 1 : 0);
@@ -45,27 +48,9 @@ export function writeRecallTrace(db, input) {
         return null;
     }
 }
-/** Short-lived connection at `root`: writes the trace, closes; returns the id or null (fail-soft). For CLI cmdRecall; api.recall must reuse its open handle.
- * LOCKSTEP: never touches `last_trace_id`, which advances only in the same `saveIndex` write as `last_retrieval_ids`; the caller sets it from the id. */
-export function writeRecallTraceAtRoot(root, input) {
-    let db;
-    try {
-        db = openHippoDb(root);
-    }
-    catch (error) {
-        rethrowIfSqliteBlocked(error);
-        log.error(`recall trace connection failed: ${errorMessage(error)}`, errorFields(error));
-        return null;
-    }
-    try {
-        return writeRecallTrace(db, input);
-    }
-    finally {
-        closeHippoDb(db);
-    }
-}
-/** Record an outcome against a trace; call ONLY with ids from last-retrieval state or an SDK `traceId`, never from api.outcome (stale-trace mislink).
- * Skips (log.warn) unless the trace is in `input.tenantId`; keeps only memoryIds it returned. Own table so `pruneAuditLog` cannot erase training data. */
+/** Record an outcome against a trace; call ONLY with ids from last-retrieval state or an SDK `traceId`, never from
+ * api.outcome (stale-trace mislink). Skips (log.warn) unless the trace is in `input.tenantId`; keeps only memoryIds it
+ * returned. Own table so `pruneAuditLog` cannot erase training data. */
 export function recordTraceOutcome(db, input) {
     try {
         // SAFETY: row shape matches the single `tenant_id` column named in the
@@ -95,18 +80,52 @@ export function recordTraceOutcome(db, input) {
         log.error(`recall trace outcome write failed: ${errorMessage(error)}`, errorFields(error));
     }
 }
-/** Pruned on write, counted back from the event's ts capped at the real clock, so a far-future fake time spares real rows. */
+/** Pruned on write, counted back from the event's ts capped at the real clock, so a far-future fake time spares real
+ * rows. */
 export const DELIVERY_LEDGER_RETENTION_DAYS = 90;
 /** Lock wait for the ledger's own connection: a busy store drops the row rather than slow the hook. */
 export const DELIVERY_LEDGER_WAIT_MS = 50;
-/** Two prompt-identical events without a host turn id, or two boundary events of one type, this close are one fire twice. */
+/** Two prompt-identical events without a host turn id, or two boundary events of one type, this close are one fire
+ * twice. */
 export const DELIVERY_DUPLICATE_WINDOW_MS = 2000;
 const DELIVERY_EVENT_COLUMNS = [
-    'ts', 'ledger_version', 'tenant_id', 'runtime', 'event_type', 'surface', 'store_hash', 'write_store', 'project_hash',
-    'session_id', 'session_state', 'host_turn_id', 'turn_seq', 'duplicate_of', 'prompt_hash', 'prompt_length', 'query_hash',
-    'recall_trace_id', 'block_state', 'prompt_recall', 'considered_count', 'filtered_count', 'selected_count', 'emitted_count',
-    'rejected_count', 'rejected_unlisted', 'sections_shown', 'sections_dropped', 'budget_tokens', 'selected_tokens',
-    'injected_tokens', 'static_hash', 'recall_hash', 'emitted_hash', 'elapsed_ms', 'tool_use_id', 'failure_id',
+    'ts',
+    'ledger_version',
+    'tenant_id',
+    'runtime',
+    'event_type',
+    'surface',
+    'store_hash',
+    'write_store',
+    'project_hash',
+    'session_id',
+    'session_state',
+    'host_turn_id',
+    'turn_seq',
+    'duplicate_of',
+    'prompt_hash',
+    'prompt_length',
+    'query_hash',
+    'recall_trace_id',
+    'block_state',
+    'prompt_recall',
+    'considered_count',
+    'filtered_count',
+    'selected_count',
+    'emitted_count',
+    'rejected_count',
+    'rejected_unlisted',
+    'sections_shown',
+    'sections_dropped',
+    'budget_tokens',
+    'selected_tokens',
+    'injected_tokens',
+    'static_hash',
+    'recall_hash',
+    'emitted_hash',
+    'elapsed_ms',
+    'tool_use_id',
+    'failure_id',
 ];
 function findDuplicateBoundary(db, input) {
     // SAFETY: rows carry exactly the `id` and `ts` columns selected.
@@ -148,11 +167,14 @@ function findDuplicateTurn(db, input) {
     if (input.promptHash === null)
         return null;
     // SAFETY: rows carry exactly the `id` and `ts` columns selected.
-    const rows = db.prepare(`
+    const rows = db
+        .prepare(`
     SELECT id, ts FROM delivery_events
-    WHERE tenant_id = ? AND session_id = ? AND event_type = ? AND prompt_hash = ? AND host_turn_id IS NULL AND turn_seq IS NOT NULL
+    WHERE tenant_id = ? AND session_id = ? AND event_type = ? AND prompt_hash = ? AND host_turn_id IS NULL AND turn_seq
+    IS NOT NULL
     ORDER BY id
-  `).all(input.tenantId, input.sessionId, input.eventType, input.promptHash);
+  `)
+        .all(input.tenantId, input.sessionId, input.eventType, input.promptHash);
     const at = Date.parse(input.ts);
     // Absolute difference: two hook processes can commit out of ts order.
     return rows.find((r) => Math.abs(Date.parse(r.ts) - at) <= DELIVERY_DUPLICATE_WINDOW_MS)?.id ?? null;
@@ -165,7 +187,59 @@ function nextTurnSeq(db, input) {
   `).get(input.tenantId, input.sessionId, input.eventType);
     return (row.m ?? 0) + 1;
 }
-/** One event plus its candidates in one write transaction, then prune; fail-soft. The caller must not hold a transaction on `db`. */
+function deliveryEventValues(input, turnSeq, duplicateOf) {
+    return [
+        input.ts,
+        DELIVERY_LEDGER_VERSION,
+        input.tenantId,
+        input.runtime,
+        input.eventType,
+        input.surface,
+        input.storeHash,
+        input.writeStore,
+        input.projectHash,
+        input.sessionId,
+        input.sessionState,
+        input.hostTurnId,
+        turnSeq,
+        duplicateOf,
+        input.promptHash,
+        input.promptLength,
+        input.queryHash,
+        input.recallTraceId,
+        input.blockState,
+        input.promptRecall ? 1 : 0,
+        input.consideredCount,
+        input.filteredCount,
+        input.selectedCount,
+        input.emittedCount,
+        input.rejectedCount,
+        input.rejectedUnlisted,
+        input.sectionsShown,
+        input.sectionsDropped,
+        input.budgetTokens,
+        input.selectedTokens,
+        input.injectedTokens,
+        input.staticHash,
+        input.recallHash,
+        input.emittedHash,
+        Math.round(input.elapsedMs),
+        input.toolUseId ?? null,
+        input.failureId ?? null,
+    ];
+}
+function insertDeliveryCandidates(db, eventId, input) {
+    const insertCandidate = db.prepare(`
+    INSERT INTO delivery_candidates (event_id, tenant_id, memory_id, source_store, pool, stage, outcome, reason,
+    cand_rank, score, tokens)
+    VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?)
+  `);
+    for (const c of input.candidates) {
+        insertCandidate.run(eventId, input.tenantId, c.memoryId, c.sourceStore, c.pool, c.stage, c.outcome, c.reason, c.rank, c.score, c.tokens);
+    }
+}
+/** One event plus its candidates in one write transaction, then prune; fail-soft. The caller must not hold a
+ * transaction on `db`. */
 export function writeDeliveryEvent(db, input) {
     try {
         return withWriteScope(db, 'write_delivery_event', () => {
@@ -173,26 +247,12 @@ export function writeDeliveryEvent(db, input) {
             const isTurn = input.sessionId !== null && (input.sessionState === 'payload' || input.sessionState === 'env');
             const duplicateOf = isTurn ? findDuplicateTurn(db, input) : null;
             const turnSeq = isTurn && duplicateOf === null ? nextTurnSeq(db, input) : null;
-            const values = [
-                input.ts, DELIVERY_LEDGER_VERSION, input.tenantId, input.runtime, input.eventType, input.surface, input.storeHash,
-                input.writeStore, input.projectHash, input.sessionId, input.sessionState, input.hostTurnId, turnSeq, duplicateOf,
-                input.promptHash, input.promptLength, input.queryHash, input.recallTraceId, input.blockState, input.promptRecall ? 1 : 0,
-                input.consideredCount, input.filteredCount, input.selectedCount, input.emittedCount, input.rejectedCount,
-                input.rejectedUnlisted, input.sectionsShown, input.sectionsDropped, input.budgetTokens, input.selectedTokens,
-                input.injectedTokens, input.staticHash, input.recallHash, input.emittedHash, Math.round(input.elapsedMs),
-                input.toolUseId ?? null, input.failureId ?? null,
-            ];
+            const values = deliveryEventValues(input, turnSeq, duplicateOf);
             const eventId = Number(db.prepare(`
         INSERT INTO delivery_events (${DELIVERY_EVENT_COLUMNS.join(', ')})
-        VALUES (${DELIVERY_EVENT_COLUMNS.map(() => '?').join(', ')})
+        VALUES (${placeholders(DELIVERY_EVENT_COLUMNS.length)})
       `).run(...values).lastInsertRowid);
-            const insertCandidate = db.prepare(`
-        INSERT INTO delivery_candidates (event_id, tenant_id, memory_id, source_store, pool, stage, outcome, reason, cand_rank, score, tokens)
-        VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?)
-      `);
-            for (const c of input.candidates) {
-                insertCandidate.run(eventId, input.tenantId, c.memoryId, c.sourceStore, c.pool, c.stage, c.outcome, c.reason, c.rank, c.score, c.tokens);
-            }
+            insertDeliveryCandidates(db, eventId, input);
             const pruneFrom = Math.min(Date.parse(input.ts), Date.now());
             const cutoff = new Date(pruneFrom - DELIVERY_LEDGER_RETENTION_DAYS * DAY_MS).toISOString();
             db.prepare(`DELETE FROM delivery_events WHERE ts < ?`).run(cutoff);
@@ -200,18 +260,19 @@ export function writeDeliveryEvent(db, input) {
         });
     }
     catch (error) {
-        log.error(`delivery ledger write failed: ${errorMessage(error)}`);
+        log.error(`delivery ledger write failed: ${errorMessage(error)}`, errorFields(error));
         return null;
     }
 }
-/** Write on the request's handle, or a short-lived one, waiting at most {@link DELIVERY_LEDGER_WAIT_MS} for the lock. Fail-soft. */
+/** Write on the request's handle, or a short-lived one, waiting at most {@link DELIVERY_LEDGER_WAIT_MS} for the lock.
+ * Fail-soft. */
 export function writeDeliveryEventAtRoot(root, input) {
     let db;
     try {
         db = openHippoDb(root);
     }
     catch (error) {
-        log.error(`delivery ledger write failed: ${errorMessage(error)}`);
+        log.error(`delivery ledger write failed: ${errorMessage(error)}`, errorFields(error));
         return null;
     }
     try {
@@ -221,7 +282,8 @@ export function writeDeliveryEventAtRoot(root, input) {
         closeHippoDb(db);
     }
 }
-/** On a caller's open handle, which saves a second open and close per turn; the handle's own lock wait comes back after. */
+/** On a caller's open handle, which saves a second open and close per turn; the handle's own lock wait comes back
+ * after. */
 export function writeDeliveryEventOnHandle(db, input) {
     const prior = Math.trunc(Number(db.prepare('PRAGMA busy_timeout').get().timeout));
     db.exec(`PRAGMA busy_timeout = ${DELIVERY_LEDGER_WAIT_MS}`);
@@ -232,10 +294,12 @@ export function writeDeliveryEventOnHandle(db, input) {
         db.exec(`PRAGMA busy_timeout = ${prior}`);
     }
 }
-/** A session's delivery events in write order, each with its candidate rows; `sessionId` null reads session-less events. */
+/** A session's delivery events in write order, each with its candidate rows; `sessionId` null reads session-less
+ * events. */
 export function readDeliveryEvents(db, tenantId, sessionId) {
     // SAFETY: SELECT * over delivery_events returns exactly the columns DeliveryEventRow names, less `candidates`.
-    const events = db.prepare(`SELECT * FROM delivery_events WHERE tenant_id = ? AND session_id IS ? ORDER BY id`)
+    const events = db
+        .prepare(`SELECT * FROM delivery_events WHERE tenant_id = ? AND session_id IS ? ORDER BY id`)
         .all(tenantId, sessionId);
     const candidates = db.prepare(`
     SELECT * FROM delivery_candidates WHERE event_id = ?

package/dist/store/rejected-values.d.ts

@@ -4,25 +4,29 @@ import { type RejectedValueRow } from './rejection.js';
 type HoldsValue = (text: string) => boolean;
 /** The text, tenant and scope of the memory a rejection names. */
 export type RejectionSource = NonNullable<ReturnType<typeof entryRejectRowAt>>;
-/** One rejection as the store applies it. The three functions are the caller's policy over plain rows; none is handed the handle. */
+/** One rejection as the store applies it. The three functions are the caller's policy over plain rows; none is handed
+ * the handle. */
 export interface Rejection {
     readonly tenantId: string;
     readonly actor: string;
     readonly reason: string;
     /** The memory whose row `textOf` is given; unset when the caller supplies the text itself. */
     readonly memoryId?: string;
-    /** The text to reject. `source` is undefined when `memoryId` is unset or names no row; a throw refuses before any write. */
+    /** The text to reject. `source` is undefined when `memoryId` is unset or names no row; a throw refuses before any
+     * write. */
     readonly textOf: (source: RejectionSource | undefined) => string;
     /** False for a row this caller may not remove. */
     readonly inReach: (scope: string | null | undefined) => boolean;
-    /** What replaces a merged row once the rejected text leaves it: undefined when it holds none, null when nothing else is left. */
+    /** What replaces a merged row once the rejected text leaves it: undefined when it holds none, null when nothing else
+     * is left. */
     readonly successorOf: (row: MemoryEntry, holdsValue: HoldsValue, removedIds: ReadonlySet<string>) => MemoryEntry | null | undefined;
 }
 export interface AppliedRejection {
     digest: string;
     /** The rejected text: the stored row keeps only its digest, so no later read can return it. */
     content: string;
-    /** Every row removed, live or dormant: each whose digest matched, duplicates included, and each sleep-merged row holding the text. */
+    /** Every row removed, live or dormant: each whose digest matched, duplicates included, and each sleep-merged row
+     * holding the text. */
     removedIds: string[];
     /** The removedIds of kind 'raw', archived instead of deleted. */
     removedRawIds: string[];
@@ -30,8 +34,9 @@ export interface AppliedRejection {
     successorIds: string[];
     dormantSuccessorIds: string[];
 }
-/** Applies one rejection on one handle and in one write scope: the rejected-value row, the removal of every row in reach that holds the
- *  text (live or dormant, whole or inside a merged row) and one reject_value audit row. Markdown mirrors follow the commit. */
+/** Applies one rejection on one handle and in one write scope: the rejected-value row, the removal of every row in
+ * reach that holds the text (live or dormant, whole or inside a merged row) and one reject_value audit row. Markdown
+ * mirrors follow the commit. */
 export declare function applyRejection(hippoRoot: string, rejection: Rejection): AppliedRejection;
 export type LiftedRejection = {
     status: 'ok';
@@ -43,13 +48,13 @@ export type LiftedRejection = {
     status: 'ambiguous';
     candidates: RejectedValueRow[];
 };
-/** Deletes the tenant's one rejected value whose digest starts with `digestPrefix` and writes its unreject_value audit row.
- *  No match, or more than one, writes nothing. */
+/** Deletes the tenant's one rejected value whose digest starts with `digestPrefix` and writes its unreject_value audit
+ * row. No match, or more than one, writes nothing. */
 export declare function liftRejection(hippoRoot: string, tenantId: string, digestPrefix: string, actor: string): LiftedRejection;
 /** The tenant's rejected values, newest first. */
 export declare function loadRejectedValues(hippoRoot: string, tenantId: string): RejectedValueRow[];
-/** Whether the write guard would refuse `content` under `entryId`, as a write of that row would find it. Reads on a plain open
- *  and writes nothing, so a dry run counts the values a real run refuses. */
+/** Whether the write guard would refuse `content` under `entryId`, as a write of that row would find it. Reads on a
+ * plain open and writes nothing, so a dry run counts the values a real run refuses. */
 export declare function rejectionGuardRefuses(hippoRoot: string, tenantId: string, entryId: string, content: string): boolean;
 export {};
 //# sourceMappingURL=rejected-values.d.ts.map

package/dist/store/rejected-values.js

@@ -5,7 +5,7 @@ import { heldTexts } from '../util/same-text.js';
 import { audit } from './audit-event.js';
 import { deleteEntryCore } from './delete-and-batch.js';
 import { deleteDormantRow, listDormantSnapshots, purgeDormantByDigest, replaceDormantEntry } from './dormant.js';
-import { entryRejectRowAt, selectAllEntries } from './entry-reads.js';
+import { entryRejectRowAt, selectEntriesByIds, selectTenantTexts } from './entry-reads.js';
 import { stampOriginProject } from './entry-row.js';
 import { writeEntryDbOnly, writeEntryMirrors } from './entry-writes.js';
 import { purgeMirrorBestEffort } from './mirrors.js';
@@ -16,15 +16,20 @@ import { RejectedValueError } from '../core/api-errors.js';
 function removeLiveRows(db, hippoRoot, rejection, holdsValue, removal) {
     const { tenantId, actor, reason } = rejection;
     const { removedIds, removedRawIds, successors } = removal;
-    const merged = [];
-    for (const row of selectAllEntries(db, tenantId)) {
+    // Text columns decide which rows hold the value; only those rows are read whole.
+    const directIds = [];
+    const mergedIds = [];
+    for (const row of selectTenantTexts(db, tenantId)) {
         if (!rejection.inReach(row.scope))
             continue;
-        if (!holdsValue(row.content)) {
-            if (heldTexts(row).some(holdsValue))
-                merged.push(row);
-            continue;
-        }
+        if (holdsValue(row.content))
+            directIds.push(row.id);
+        else if (heldTexts(row).some(holdsValue))
+            mergedIds.push(row.id);
+    }
+    const held = selectEntriesByIds(db, [...directIds, ...mergedIds], tenantId);
+    const merged = mergedIds.flatMap((id) => held.get(id) ?? []);
+    for (const row of directIds.flatMap((id) => held.get(id) ?? [])) {
         if (row.kind === 'raw') {
             // A raw row is append-only: archiving is its one removal path, and its savepoint nests in this write scope.
             archiveRawMemory(db, row.id, { reason, who: actor });
@@ -47,7 +52,8 @@ function removeLiveRows(db, hippoRoot, rejection, holdsValue, removal) {
         successors.push(kept);
     }
 }
-// Dormant copies go in the same write scope, so `hippo dormant restore` cannot bring the text back. They have no mirror to purge.
+// Dormant copies go in the same write scope, so `hippo dormant restore` cannot bring the text back. They have no mirror
+// to purge.
 function removeDormantCopies(db, rejection, digest, holdsValue, removal) {
     const { tenantId } = rejection;
     const { removedIds, dormantSuccessorIds } = removal;
@@ -67,7 +73,8 @@ function removeDormantCopies(db, rejection, digest, holdsValue, removal) {
         dormantSuccessorIds.push(successor.id);
     }
 }
-// After the commit, on the same handle: a purged raw mirror is stamped so the reaper skips it, and one that stays is logged.
+// After the commit, on the same handle: a purged raw mirror is stamped so the reaper skips it, and one that stays is
+// logged.
 function purgeRemovedMirrors(db, hippoRoot, removal) {
     for (const id of removal.removedIds) {
         const isRaw = removal.removedRawIds.includes(id);
@@ -78,8 +85,9 @@ function purgeRemovedMirrors(db, hippoRoot, removal) {
     for (const successor of removal.successors)
         writeEntryMirrors(hippoRoot, successor);
 }
-/** Applies one rejection on one handle and in one write scope: the rejected-value row, the removal of every row in reach that holds the
- *  text (live or dormant, whole or inside a merged row) and one reject_value audit row. Markdown mirrors follow the commit. */
+/** Applies one rejection on one handle and in one write scope: the rejected-value row, the removal of every row in
+ * reach that holds the text (live or dormant, whole or inside a merged row) and one reject_value audit row. Markdown
+ * mirrors follow the commit. */
 export function applyRejection(hippoRoot, rejection) {
     const { tenantId, actor, reason, memoryId } = rejection;
     return onHandle(hippoRoot, (db) => {
@@ -97,21 +105,34 @@ export function applyRejection(hippoRoot, rejection) {
                 sourceMemoryId: memoryId ?? null,
                 normalizedChars: normalizeValueForRejection(content).length,
             });
-            // SHORTCUT: scans every row of the tenant, fine for a human-run command; a digest column on memories if stores grow a hundredfold.
+            // SHORTCUT: scans the tenant's text columns, fine for a human-run command; a digest column needs a schema
+            // migration, held until approved.
             const holdsValue = (text) => rejectionDigest(text) === digest;
             removeLiveRows(db, hippoRoot, rejection, holdsValue, removal);
             removeDormantCopies(db, rejection, digest, holdsValue, removal);
             // Still inside the write scope: a failed audit row is reported and the reject commits without it.
             const { removedIds } = removal;
-            audit(db, 'reject_value', { tenantId, actor, targetId: memoryId, metadata: { digest, removedIds, count: removedIds.length } });
+            audit(db, 'reject_value', {
+                tenantId,
+                actor,
+                targetId: memoryId,
+                metadata: { digest, removedIds, count: removedIds.length },
+            });
         });
         purgeRemovedMirrors(db, hippoRoot, removal);
         const { removedIds, removedRawIds, successors, dormantSuccessorIds } = removal;
-        return { digest, content, removedIds, removedRawIds, successorIds: successors.map((s) => s.id), dormantSuccessorIds };
+        return {
+            digest,
+            content,
+            removedIds,
+            removedRawIds,
+            successorIds: successors.map((s) => s.id),
+            dormantSuccessorIds,
+        };
     }, openStore);
 }
-/** Deletes the tenant's one rejected value whose digest starts with `digestPrefix` and writes its unreject_value audit row.
- *  No match, or more than one, writes nothing. */
+/** Deletes the tenant's one rejected value whose digest starts with `digestPrefix` and writes its unreject_value audit
+ * row. No match, or more than one, writes nothing. */
 export function liftRejection(hippoRoot, tenantId, digestPrefix, actor) {
     return onHandle(hippoRoot, (db) => {
         const matches = listRejectedValues(db, tenantId).filter((r) => r.digest.startsWith(digestPrefix));
@@ -121,7 +142,12 @@ export function liftRejection(hippoRoot, tenantId, digestPrefix, actor) {
         if (matches.length > 1)
             return { status: 'ambiguous', candidates: matches };
         deleteRejectedValue(db, tenantId, target.digest);
-        audit(db, 'unreject_value', { tenantId, actor, targetId: target.sourceMemoryId ?? undefined, metadata: { digest: target.digest, reason: target.reason } });
+        audit(db, 'unreject_value', {
+            tenantId,
+            actor,
+            targetId: target.sourceMemoryId ?? undefined,
+            metadata: { digest: target.digest, reason: target.reason },
+        });
         return { status: 'ok', digest: target.digest, reason: target.reason };
     }, openStore);
 }
@@ -131,8 +157,8 @@ export function loadRejectedValues(hippoRoot, tenantId) {
         return listRejectedValues(db, tenantId);
     }, openStore);
 }
-/** Whether the write guard would refuse `content` under `entryId`, as a write of that row would find it. Reads on a plain open
- *  and writes nothing, so a dry run counts the values a real run refuses. */
+/** Whether the write guard would refuse `content` under `entryId`, as a write of that row would find it. Reads on a
+ * plain open and writes nothing, so a dry run counts the values a real run refuses. */
 export function rejectionGuardRefuses(hippoRoot, tenantId, entryId, content) {
     const db = openHippoDb(hippoRoot);
     try {

package/dist/store/rejection.d.ts

@@ -1,11 +1,9 @@
-/** Rejected-value tombstone: a human can refuse byte-stable re-ingestion of a rejected fact (exact normalized value); paraphrase matching is out of scope.
- * db-agnostic (helpers take a `DatabaseSyncLike`) and imports nothing from the store layer above it, which imports this (the reverse is a cycle). */
+/** Rejected-value tombstone: a human can refuse byte-stable re-ingestion of a rejected fact (exact normalized value);
+ * paraphrase matching is out of scope. db-agnostic (helpers take a `DatabaseSyncLike`) and imports nothing from the
+ * store layer above it, which imports this (the reverse is a cycle). */
+import { normalizeValueForRejection, rejectionDigest } from '../core/rejection-digest.js';
 import type { DatabaseSyncLike } from '../db/index.js';
-/** Normalize content for rejection digests: NFC, lowercase, collapse whitespace runs, trim. No punctuation stripping: over-normalizing causes false
- * refusals, worse than misses. */
-export declare function normalizeValueForRejection(content: string): string;
-/** Full 64-char sha256 hex of the normalized content: a tombstone key needs collision resistance, not the 16-char redaction hash used for query hashing. */
-export declare function rejectionDigest(content: string): string;
+export { normalizeValueForRejection, rejectionDigest };
 export interface RejectedValueRow {
     tenantId: string;
     digest: string;
@@ -15,9 +13,11 @@ export interface RejectedValueRow {
     sourceMemoryId: string | null;
     normalizedChars: number | null;
 }
-/** Look up a tombstone by tenant + digest: one indexed point query, the guard's common-case cost; a miss ends the guard. */
+/** Look up a tombstone by tenant + digest: one indexed point query, the guard's common-case cost; a miss ends the
+ * guard. */
 export declare function findRejectedValue(db: DatabaseSyncLike, tenantId: string, digest: string): RejectedValueRow | null;
-/** Insert (or refresh) a tombstone row; the caller owns the transaction (used by the `reject` verb and `resolveConflict`'s `rejectLoserValue`). */
+/** Insert (or refresh) a tombstone row; the caller owns the transaction (used by the `reject` verb and
+ * `resolveConflict`'s `rejectLoserValue`). */
 export declare function insertRejectedValue(db: DatabaseSyncLike, opts: {
     tenantId: string;
     digest: string;
@@ -31,7 +31,8 @@ export declare function insertRejectedValue(db: DatabaseSyncLike, opts: {
 export declare function deleteRejectedValue(db: DatabaseSyncLike, tenantId: string, digest: string): boolean;
 /** List tombstones for a tenant, newest first: the `rejections` verb. */
 export declare function listRejectedValues(db: DatabaseSyncLike, tenantId: string): RejectedValueRow[];
-/** Write-path guard check: fires when the digest matches a tombstone AND the write introduces that content (a new row, or a same-id UPSERT changing it).
- * Unchanged same-id re-persists (recall boost, decay, star toggle) are exempt. A miss costs ONE indexed point query; only a hit SELECTs the stored row. */
+/** Write-path guard check: fires when the digest matches a tombstone AND the write introduces that content (a new row,
+ * or a same-id UPSERT changing it). Unchanged same-id re-persists (recall boost, decay, star toggle) are exempt. A miss
+ * costs ONE indexed point query; only a hit SELECTs the stored row. */
 export declare function checkRejectionGuard(db: DatabaseSyncLike, tenantId: string, entryId: string, content: string): void;
 //# sourceMappingURL=rejection.d.ts.map