diff --git a/crates/icm-store/src/opensearch.rs b/crates/icm-store/src/opensearch.rs
deleted file mode 100644
index b5517262..00000000
--- a/crates/icm-store/src/opensearch.rs
+++ /dev/null
@@ -1,2012 +0,0 @@
-//! OpenSearch storage backend (issue #301, opt-in via `--features opensearch`).
-//!
-//! A search-native shared store: BM25 full-text and `knn_vector` HNSW
-//! vector search live in one engine, so horizontally-scaled ICM replicas
-//! share one memory store (a node-local SQLite file cannot be shared).
-//!
-//! Design notes:
-//!
-//! - **Blocking REST.** OpenSearch is an HTTP/JSON service, so this talks
-//!   to it with the blocking `ureq` client and `serde_json` bodies. The
-//!   store traits are synchronous, so — like the PostgreSQL backend —
-//!   there is no async runtime and no sync-over-async bridge.
-//! - **Vector search** uses a `knn_vector` field (HNSW, cosine space);
-//!   similarity is reported from the kNN `_score`.
-//! - **Full-text search** uses BM25 `match` queries; the hybrid path
-//!   blends normalized BM25 and vector scores 30/70 to match the SQLite
-//!   and PostgreSQL backends.
-//! - **Connection** from `ICM_OPENSEARCH_URL` (e.g. `http://localhost:9200`),
-//!   with optional basic auth from `ICM_OPENSEARCH_USER` /
-//!   `ICM_OPENSEARCH_PASSWORD`.
-//!
-//! Scope mirrors the PostgreSQL backend: the full [`MemoryStore`] surface
-//! plus the ancillary store/recall/hook tables (hook telemetry, the
-//! extraction queue, code areas, key/value metadata). The heavier
-//! subsystems (memoir graph, transcripts, structured facts, feedback,
-//! pattern mining) return [`IcmError::Unsupported`]; they stay fully
-//! available on the default SQLite backend.
-
-use std::collections::{HashMap, HashSet};
-use std::path::Path;
-use std::time::Duration;
-
-use base64::engine::general_purpose::STANDARD as B64;
-use base64::Engine;
-use chrono::{DateTime, TimeZone, Utc};
-use serde_json::{json, Value};
-
-use icm_core::{
-    Concept, ConceptLink, Embedder, Fact, FactsStats, FactsStore, Feedback, FeedbackStats,
-    FeedbackStore, IcmError, IcmResult, Importance, Label, Memoir, MemoirStats, MemoirStore,
-    Memory, MemorySource, MemoryStore, Message, PatternCluster, Relation, Role, Scope, Session,
-    StoreStats, TopicHealth, TranscriptHit, TranscriptStats, TranscriptStore,
-};
-
-// Shared public row types live in `crate::common` (issue #301) so every
-// backend can be compiled into one binary without colliding definitions.
-pub use crate::common::{CodeArea, HookEvent, HookEventInsert, HookStatsRow, PendingRow};
-
-// ---------------------------------------------------------------------------
-// Index names
-// ---------------------------------------------------------------------------
-
-const IDX_MEMORIES: &str = "icm_memories";
-const IDX_METADATA: &str = "icm_metadata";
-const IDX_HOOKS: &str = "icm_hook_events";
-const IDX_PENDING: &str = "icm_pending_extractions";
-const IDX_CODE_AREAS: &str = "icm_code_areas";
-
-/// Percent-encode a value for safe use as a single path segment in a REST
-/// URL. Document ids are caller-controlled (`icm forget <id>` CLI, MCP
-/// `icm_forget`, etc.) with no format constraint enforced anywhere in the
-/// schema — without this, a crafted id containing `/`, `..`, `?`, or `#`
-/// could redirect which REST endpoint is actually hit instead of just
-/// addressing the intended document (audit finding).
-fn url_encode_path_segment(s: &str) -> String {
-    let mut out = String::with_capacity(s.len());
-    for b in s.bytes() {
-        match b {
-            b'A'..=b'Z' | b'a'..=b'z' | b'0'..=b'9' | b'-' | b'_' | b'.' | b'~' => {
-                out.push(b as char);
-            }
-            _ => out.push_str(&format!("%{b:02X}")),
-        }
-    }
-    out
-}
-
-// ---------------------------------------------------------------------------
-// Pure helpers (self-contained, mirror the other backends)
-// ---------------------------------------------------------------------------
-
-fn source_type(source: &MemorySource) -> &'static str {
-    match source {
-        MemorySource::ClaudeCode { .. } => "claude_code",
-        MemorySource::Conversation { .. } => "conversation",
-        MemorySource::Manual => "manual",
-    }
-}
-
-fn source_data(source: &MemorySource) -> Option<String> {
-    match source {
-        MemorySource::Manual => None,
-        other => serde_json::to_string(other).ok(),
-    }
-}
-
-fn parse_source(source_type_str: &str, source_data_str: Option<String>) -> MemorySource {
-    match source_type_str {
-        "manual" => MemorySource::Manual,
-        _ => source_data_str
-            .and_then(|d| serde_json::from_str(&d).ok())
-            .unwrap_or(MemorySource::Manual),
-    }
-}
-
-fn importance_rank(i: Importance) -> u8 {
-    match i {
-        Importance::Low => 0,
-        Importance::Medium => 1,
-        Importance::High => 2,
-        Importance::Critical => 3,
-    }
-}
-
-fn max_importance(a: Importance, b: Importance) -> Importance {
-    if importance_rank(a) >= importance_rank(b) {
-        a
-    } else {
-        b
-    }
-}
-
-/// SHA-256 over the normalized `(topic, summary)` pair, hex-encoded.
-/// Normalization: trim + lowercase + collapse whitespace, joined by `\0`.
-fn summary_hash(topic: &str, summary: &str) -> String {
-    use sha2::{Digest, Sha256};
-    let topic_n = topic.trim().to_lowercase();
-    let summary_n = summary
-        .split_whitespace()
-        .collect::<Vec<&str>>()
-        .join(" ")
-        .to_lowercase();
-    let mut h = Sha256::new();
-    h.update(topic_n.as_bytes());
-    h.update(b"\0");
-    h.update(summary_n.as_bytes());
-    format!("{:x}", h.finalize())
-}
-
-/// Validate and normalize a memory before storing (mirror of the other
-/// backends): non-empty topic/summary, generate an id if missing, and
-/// stamp timestamps.
-fn validate_and_normalize(mut memory: Memory) -> IcmResult<Memory> {
-    if memory.topic.trim().is_empty() {
-        return Err(IcmError::InvalidInput("topic cannot be empty".into()));
-    }
-    if memory.summary.trim().is_empty() {
-        return Err(IcmError::InvalidInput("summary cannot be empty".into()));
-    }
-    if memory.id.trim().is_empty() {
-        memory.id = ulid::Ulid::new().to_string();
-    }
-    memory.topic = memory.topic.trim().to_string();
-    Ok(memory)
-}
-
-fn parse_dt(s: &str) -> DateTime<Utc> {
-    DateTime::parse_from_rfc3339(s)
-        .map(|d| d.with_timezone(&Utc))
-        .unwrap_or_else(|_| Utc::now())
-}
-
-// ---------------------------------------------------------------------------
-// Store
-// ---------------------------------------------------------------------------
-
-/// OpenSearch-backed store. Cheap to clone-free share via `&self`; every
-/// method is a blocking REST round-trip.
-pub struct OpenSearchStore {
-    agent: ureq::Agent,
-    base: String,
-    auth: Option<String>,
-    embedding_dims: usize,
-    readonly: bool,
-}
-
-impl OpenSearchStore {
-    fn conn_url() -> IcmResult<String> {
-        std::env::var("ICM_OPENSEARCH_URL")
-            .or_else(|_| std::env::var("OPENSEARCH_URL"))
-            .map_err(|_| {
-                IcmError::Config(
-                    "OpenSearch backend: set ICM_OPENSEARCH_URL to the cluster endpoint, \
-                     e.g. http://localhost:9200"
-                        .into(),
-                )
-            })
-    }
-
-    fn auth_header() -> Option<String> {
-        let user = std::env::var("ICM_OPENSEARCH_USER").ok()?;
-        let pass = std::env::var("ICM_OPENSEARCH_PASSWORD").unwrap_or_default();
-        let token = B64.encode(format!("{user}:{pass}"));
-        Some(format!("Basic {token}"))
-    }
-
-    /// Perform a request, returning the parsed JSON body. `expected_404`
-    /// makes a 404 return `Ok(None)` instead of an error (used by `get`).
-    fn request(
-        &self,
-        method: &str,
-        path: &str,
-        body: Option<Value>,
-        allow_404: bool,
-    ) -> IcmResult<Option<Value>> {
-        let url = format!(
-            "{}/{}",
-            self.base.trim_end_matches('/'),
-            path.trim_start_matches('/')
-        );
-        let mut req = self.agent.request(method, &url);
-        if let Some(a) = &self.auth {
-            req = req.set("Authorization", a);
-        }
-        let resp = match body {
-            Some(b) => req.send_json(b),
-            None => req.call(),
-        };
-        match resp {
-            Ok(r) => {
-                let v = r
-                    .into_json::<Value>()
-                    .map_err(|e| IcmError::Database(format!("opensearch decode: {e}")))?;
-                Ok(Some(v))
-            }
-            Err(ureq::Error::Status(404, _)) if allow_404 => Ok(None),
-            Err(ureq::Error::Status(code, r)) => {
-                let txt = r.into_string().unwrap_or_default();
-                Err(IcmError::Database(format!(
-                    "opensearch {method} {path} -> {code}: {txt}"
-                )))
-            }
-            Err(e) => Err(IcmError::Database(format!(
-                "opensearch {method} {path}: {e}"
-            ))),
-        }
-    }
-
-    fn get_json(&self, path: &str) -> IcmResult<Option<Value>> {
-        self.request("GET", path, None, true)
-    }
-
-    fn post(&self, path: &str, body: Value) -> IcmResult<Value> {
-        self.request("POST", path, Some(body), false)
-            .map(|o| o.unwrap_or(Value::Null))
-    }
-
-    /// Open or create a store with the default embedding dimension.
-    pub fn new(_path: &Path) -> IcmResult<Self> {
-        Self::connect(icm_core::DEFAULT_EMBEDDING_DIMS, false)
-    }
-
-    /// Open or create a store with a specific embedding dimension.
-    pub fn with_dims(_path: &Path, embedding_dims: usize) -> IcmResult<Self> {
-        Self::connect(embedding_dims, false)
-    }
-
-    /// Open the store read-only (issue #263). OpenSearch has no read-only
-    /// connection mode, so this just flags the store and makes mutating
-    /// methods error.
-    pub fn open_readonly(_path: &Path) -> IcmResult<Self> {
-        Self::connect(icm_core::DEFAULT_EMBEDDING_DIMS, true)
-    }
-
-    /// In-memory variant is not meaningful for a remote backend; connect
-    /// from the environment instead.
-    pub fn in_memory() -> IcmResult<Self> {
-        Self::connect(icm_core::DEFAULT_EMBEDDING_DIMS, false)
-    }
-
-    /// See [`Self::in_memory`].
-    pub fn in_memory_with_dims(embedding_dims: usize) -> IcmResult<Self> {
-        Self::connect(embedding_dims, false)
-    }
-
-    /// Read the stored embedding dimension without committing to a full
-    /// open. Returns `Ok(None)` when unreachable so callers can fall back.
-    pub fn read_stored_embedding_dims(_path: &Path) -> IcmResult<Option<usize>> {
-        let Ok(url) = Self::conn_url() else {
-            return Ok(None);
-        };
-        let agent = ureq::AgentBuilder::new()
-            .timeout(Duration::from_secs(10))
-            .build();
-        let store = OpenSearchStore {
-            agent,
-            base: url,
-            auth: Self::auth_header(),
-            embedding_dims: icm_core::DEFAULT_EMBEDDING_DIMS,
-            readonly: true,
-        };
-        match store.get_metadata_int("embedding_dims") {
-            Ok(Some(v)) => Ok(Some(v as usize)),
-            _ => Ok(None),
-        }
-    }
-
-    pub fn is_readonly(&self) -> bool {
-        self.readonly
-    }
-
-    /// No-op on this backend (kept for API parity with the SQLite store).
-    pub fn ensure_vec_init() {}
-
-    fn connect(requested_dims: usize, readonly: bool) -> IcmResult<Self> {
-        let url = Self::conn_url()?;
-        let agent = ureq::AgentBuilder::new()
-            .timeout(Duration::from_secs(30))
-            .build();
-        let store = OpenSearchStore {
-            agent,
-            base: url,
-            auth: Self::auth_header(),
-            embedding_dims: requested_dims,
-            readonly,
-        };
-        // Probe connectivity early with a clear error.
-        store
-            .get_json("/")
-            .map_err(|e| IcmError::Database(format!("cannot reach OpenSearch: {e}")))?;
-
-        // An existing database's stored dims are authoritative.
-        let dims = match store.get_metadata_int("embedding_dims")? {
-            Some(d) => d as usize,
-            None => requested_dims,
-        };
-        let mut store = store;
-        store.embedding_dims = dims;
-
-        if !readonly {
-            store.init_indices(dims)?;
-            store.set_metadata_int("embedding_dims", dims as i64)?;
-        }
-        Ok(store)
-    }
-
-    fn index_exists(&self, idx: &str) -> IcmResult<bool> {
-        let url = format!("{}/{}", self.base.trim_end_matches('/'), idx);
-        let mut req = self.agent.request("HEAD", &url);
-        if let Some(a) = &self.auth {
-            req = req.set("Authorization", a);
-        }
-        match req.call() {
-            Ok(_) => Ok(true),
-            Err(ureq::Error::Status(404, _)) => Ok(false),
-            Err(e) => Err(IcmError::Database(format!("opensearch HEAD {idx}: {e}"))),
-        }
-    }
-
-    fn create_index(&self, idx: &str, body: Value) -> IcmResult<()> {
-        if self.index_exists(idx)? {
-            return Ok(());
-        }
-        // A racing replica may create it between the check and here; treat
-        // "resource_already_exists_exception" as success.
-        match self.request("PUT", idx, Some(body), false) {
-            Ok(_) => Ok(()),
-            Err(IcmError::Database(msg)) if msg.contains("resource_already_exists_exception") => {
-                Ok(())
-            }
-            Err(e) => Err(e),
-        }
-    }
-
-    fn init_indices(&self, dims: usize) -> IcmResult<()> {
-        if !(64..=4096).contains(&dims) {
-            return Err(IcmError::Config(format!(
-                "embedding_dims must be between 64 and 4096, got {dims}"
-            )));
-        }
-        self.create_index(
-            IDX_MEMORIES,
-            json!({
-                "settings": { "index": { "knn": true } },
-                "mappings": { "properties": {
-                    "created_at": {"type": "date"},
-                    "updated_at": {"type": "date"},
-                    "last_accessed": {"type": "date"},
-                    "access_count": {"type": "integer"},
-                    "weight": {"type": "float"},
-                    "topic": {"type": "text", "fields": {"keyword": {"type": "keyword", "ignore_above": 1024}}},
-                    "summary": {"type": "text"},
-                    "raw_excerpt": {"type": "text"},
-                    "keywords": {"type": "keyword"},
-                    "importance": {"type": "keyword"},
-                    "source_type": {"type": "keyword"},
-                    "source_data": {"type": "text", "index": false},
-                    "related_ids": {"type": "keyword"},
-                    "summary_hash": {"type": "keyword"},
-                    "embedding": {
-                        "type": "knn_vector",
-                        "dimension": dims,
-                        "method": {"name": "hnsw", "space_type": "cosinesimil", "engine": "lucene"}
-                    }
-                }}
-            }),
-        )?;
-        self.create_index(IDX_METADATA, json!({"mappings": {"properties": {"value": {"type": "double"}, "text_value": {"type": "keyword"}}}}))?;
-        self.create_index(
-            IDX_HOOKS,
-            json!({"mappings": {"properties": {
-                "id": {"type": "long"},
-                "ts": {"type": "date"},
-                "event": {"type": "keyword"},
-                "project": {"type": "keyword"},
-                "session_id": {"type": "keyword"},
-                "tool_name": {"type": "keyword"},
-                "duration_ms": {"type": "long"},
-                "exit_code": {"type": "integer"},
-                "payload_size": {"type": "long"},
-                "note": {"type": "text"}
-            }}}),
-        )?;
-        self.create_index(
-            IDX_PENDING,
-            json!({"mappings": {"properties": {
-                "project": {"type": "keyword"},
-                "tool_name": {"type": "keyword"},
-                "raw_output": {"type": "text", "index": false},
-                "captured_at": {"type": "date"}
-            }}}),
-        )?;
-        self.create_index(
-            IDX_CODE_AREAS,
-            json!({"mappings": {"properties": {
-                "project": {"type": "keyword"},
-                "file_path": {"type": "keyword"},
-                "description": {"type": "text"},
-                "session_id": {"type": "keyword"},
-                "tool_name": {"type": "keyword"},
-                "touch_count": {"type": "long"},
-                "first_touched_at": {"type": "date"},
-                "last_touched_at": {"type": "date"}
-            }}}),
-        )?;
-        Ok(())
-    }
-
-    // --- metadata kv helpers ---
-
-    fn get_metadata_int(&self, key: &str) -> IcmResult<Option<i64>> {
-        let path = format!("{IDX_METADATA}/_doc/{key}");
-        match self.get_json(&path)? {
-            Some(v) => Ok(v
-                .get("_source")
-                .and_then(|s| s.get("value"))
-                .and_then(|n| n.as_f64())
-                .map(|f| f as i64)),
-            None => Ok(None),
-        }
-    }
-
-    fn set_metadata_int(&self, key: &str, value: i64) -> IcmResult<()> {
-        let path = format!("{IDX_METADATA}/_doc/{key}?refresh=true");
-        self.request("PUT", &path, Some(json!({"value": value})), false)?;
-        Ok(())
-    }
-
-    fn check_dims(&self, memory: &Memory) -> IcmResult<()> {
-        if let Some(emb) = memory.embedding.as_ref() {
-            if emb.len() != self.embedding_dims {
-                return Err(IcmError::InvalidInput(format!(
-                    "embedding has {} dimensions, but this store uses {}",
-                    emb.len(),
-                    self.embedding_dims
-                )));
-            }
-        }
-        Ok(())
-    }
-
-    // --- (de)serialization ---
-
-    fn memory_to_source(memory: &Memory) -> Value {
-        let mut doc = json!({
-            "created_at": memory.created_at.to_rfc3339(),
-            "updated_at": memory.updated_at.to_rfc3339(),
-            "last_accessed": memory.last_accessed.to_rfc3339(),
-            "access_count": memory.access_count,
-            "weight": memory.weight,
-            "topic": memory.topic,
-            "summary": memory.summary,
-            "raw_excerpt": memory.raw_excerpt,
-            "keywords": memory.keywords,
-            "importance": memory.importance.to_string(),
-            "source_type": source_type(&memory.source),
-            "source_data": source_data(&memory.source),
-            "related_ids": memory.related_ids,
-            "summary_hash": summary_hash(&memory.topic, &memory.summary),
-        });
-        if let Some(emb) = memory.embedding.as_ref() {
-            doc["embedding"] = json!(emb);
-        }
-        doc
-    }
-
-    fn source_to_memory(id: &str, src: &Value) -> Memory {
-        let get_str = |k: &str| {
-            src.get(k)
-                .and_then(|v| v.as_str())
-                .unwrap_or("")
-                .to_string()
-        };
-        let opt_str = |k: &str| {
-            src.get(k)
-                .and_then(|v| v.as_str())
-                .map(|s| s.to_string())
-                .filter(|s| !s.is_empty())
-        };
-        let arr = |k: &str| {
-            src.get(k)
-                .and_then(|v| v.as_array())
-                .map(|a| {
-                    a.iter()
-                        .filter_map(|x| x.as_str().map(|s| s.to_string()))
-                        .collect::<Vec<String>>()
-                })
-                .unwrap_or_default()
-        };
-        let importance = get_str("importance").parse().unwrap_or(Importance::Medium);
-        let source = parse_source(&get_str("source_type"), opt_str("source_data"));
-        let embedding = src.get("embedding").and_then(|v| v.as_array()).map(|a| {
-            a.iter()
-                .filter_map(|x| x.as_f64().map(|f| f as f32))
-                .collect::<Vec<f32>>()
-        });
-        Memory {
-            id: id.to_string(),
-            created_at: parse_dt(&get_str("created_at")),
-            updated_at: parse_dt(&get_str("updated_at")),
-            last_accessed: parse_dt(&get_str("last_accessed")),
-            access_count: src
-                .get("access_count")
-                .and_then(|v| v.as_u64())
-                .unwrap_or(0) as u32,
-            weight: src.get("weight").and_then(|v| v.as_f64()).unwrap_or(1.0) as f32,
-            topic: get_str("topic"),
-            summary: get_str("summary"),
-            raw_excerpt: opt_str("raw_excerpt"),
-            keywords: arr("keywords"),
-            importance,
-            source,
-            related_ids: arr("related_ids"),
-            embedding,
-            scope: Scope::default(),
-        }
-    }
-
-    /// Map a `_search` response's hits to memories paired with `_score`.
-    fn hits_to_scored(resp: &Value) -> Vec<(Memory, f32)> {
-        resp.get("hits")
-            .and_then(|h| h.get("hits"))
-            .and_then(|h| h.as_array())
-            .map(|hits| {
-                hits.iter()
-                    .filter_map(|h| {
-                        let id = h.get("_id")?.as_str()?;
-                        let src = h.get("_source")?;
-                        let score = h.get("_score").and_then(|s| s.as_f64()).unwrap_or(0.0) as f32;
-                        Some((Self::source_to_memory(id, src), score))
-                    })
-                    .collect()
-            })
-            .unwrap_or_default()
-    }
-
-    fn hits_to_memories(resp: &Value) -> Vec<Memory> {
-        Self::hits_to_scored(resp)
-            .into_iter()
-            .map(|(m, _)| m)
-            .collect()
-    }
-
-    fn refresh_param(&self) -> &'static str {
-        // Force a refresh so writes are immediately visible to subsequent
-        // searches (dedup, counts, the multi-replica path). ICM writes are
-        // low-frequency curated memories, so the cost is acceptable.
-        "refresh=true"
-    }
-
-    fn store_inner(&self, memory: &Memory) -> IcmResult<String> {
-        let hash = summary_hash(&memory.topic, &memory.summary);
-        // Dedup: an existing memory with the same (topic, summary_hash)
-        // wins; merge importance (max) + keywords (union) + raw_excerpt
-        // (prefer new) and return the existing id.
-        //
-        // Audit finding: this used to ALSO filter on `topic.keyword` (an
-        // exact-byte-match `keyword` field, no normalizer) alongside
-        // `summary_hash` — but `summary_hash` already encodes the topic via
-        // Rust's Unicode-correct `to_lowercase()`, so storing topic="Kexa"
-        // then topic="kexa" with the same summary hashed identically but
-        // failed the exact `topic.keyword` filter, silently creating a
-        // second document instead of deduping (broader than the SQLite/
-        // Postgres accented-topic case — this fires on ANY case
-        // difference). `summary_hash` alone is sufficient, matching the
-        // SQLite/Postgres fix.
-        let existing = self.post(
-            &format!("{IDX_MEMORIES}/_search"),
-            json!({
-                "size": 1,
-                "query": {"bool": {"filter": [
-                    {"term": {"summary_hash": hash}}
-                ]}}
-            }),
-        )?;
-        if let Some(hit) = existing
-            .get("hits")
-            .and_then(|h| h.get("hits"))
-            .and_then(|h| h.as_array())
-            .and_then(|a| a.first())
-        {
-            let existing_id = hit
-                .get("_id")
-                .and_then(|v| v.as_str())
-                .unwrap_or("")
-                .to_string();
-            let src = hit.get("_source").cloned().unwrap_or(Value::Null);
-            let existing_importance: Importance = src
-                .get("importance")
-                .and_then(|v| v.as_str())
-                .unwrap_or("medium")
-                .parse()
-                .unwrap_or(Importance::Medium);
-            let merged_importance = max_importance(existing_importance, memory.importance);
-            let mut merged_keywords: Vec<String> = src
-                .get("keywords")
-                .and_then(|v| v.as_array())
-                .map(|a| {
-                    a.iter()
-                        .filter_map(|x| x.as_str().map(String::from))
-                        .collect()
-                })
-                .unwrap_or_default();
-            for kw in &memory.keywords {
-                if !merged_keywords.contains(kw) {
-                    merged_keywords.push(kw.clone());
-                }
-            }
-            let raw = memory.raw_excerpt.clone().or_else(|| {
-                src.get("raw_excerpt")
-                    .and_then(|v| v.as_str())
-                    .map(String::from)
-            });
-            self.request(
-                "POST",
-                &format!(
-                    "{IDX_MEMORIES}/_update/{existing_id}?{}",
-                    self.refresh_param()
-                ),
-                Some(json!({"doc": {
-                    "importance": merged_importance.to_string(),
-                    "keywords": merged_keywords,
-                    "raw_excerpt": raw,
-                    "updated_at": Utc::now().to_rfc3339(),
-                }})),
-                false,
-            )?;
-            return Ok(existing_id);
-        }
-
-        self.request(
-            "PUT",
-            &format!(
-                "{IDX_MEMORIES}/_doc/{}?{}",
-                url_encode_path_segment(&memory.id),
-                self.refresh_param()
-            ),
-            Some(Self::memory_to_source(memory)),
-            false,
-        )?;
-        Ok(memory.id.clone())
-    }
-}
-
-impl MemoryStore for OpenSearchStore {
-    fn store(&self, memory: Memory) -> IcmResult<String> {
-        if self.readonly {
-            return Err(IcmError::ReadOnly("store".into()));
-        }
-        let memory = validate_and_normalize(memory)?;
-        self.check_dims(&memory)?;
-        self.store_inner(&memory)
-    }
-
-    fn get(&self, id: &str) -> IcmResult<Option<Memory>> {
-        let path = format!("{IDX_MEMORIES}/_doc/{}", url_encode_path_segment(id));
-        match self.get_json(&path)? {
-            Some(v) => {
-                if v.get("found").and_then(|f| f.as_bool()).unwrap_or(false) {
-                    let src = v.get("_source").cloned().unwrap_or(Value::Null);
-                    Ok(Some(Self::source_to_memory(id, &src)))
-                } else {
-                    Ok(None)
-                }
-            }
-            None => Ok(None),
-        }
-    }
-
-    fn update(&self, memory: &Memory) -> IcmResult<()> {
-        if self.readonly {
-            return Err(IcmError::ReadOnly("update".into()));
-        }
-        self.check_dims(memory)?;
-        let mut doc = Self::memory_to_source(memory);
-        doc["updated_at"] = json!(Utc::now().to_rfc3339());
-        // Replace the document wholesale (index by id).
-        self.request(
-            "PUT",
-            &format!(
-                "{IDX_MEMORIES}/_doc/{}?{}",
-                url_encode_path_segment(&memory.id),
-                self.refresh_param()
-            ),
-            Some(doc),
-            false,
-        )?;
-        Ok(())
-    }
-
-    fn delete(&self, id: &str) -> IcmResult<()> {
-        if self.readonly {
-            return Err(IcmError::ReadOnly("delete".into()));
-        }
-        self.request(
-            "DELETE",
-            &format!(
-                "{IDX_MEMORIES}/_doc/{}?{}",
-                url_encode_path_segment(id),
-                self.refresh_param()
-            ),
-            None,
-            true,
-        )?;
-
-        // Manual-testing finding (same class as the SQLite/Postgres
-        // backends): a deleted memory otherwise stays as a dangling entry
-        // in every other memory's `related_ids` forever. `related_ids` is
-        // mapped as a `keyword` array field, so a term query finds every
-        // document that references it and a Painless script strips it out
-        // in place. Best-effort: a failure here doesn't roll back the
-        // delete above (OpenSearch has no cross-document transaction to
-        // roll back into) — surfacing an error would make a successful
-        // delete look like it failed, so log and move on.
-        if let Err(e) = self.post(
-            &format!(
-                "{IDX_MEMORIES}/_update_by_query?conflicts=proceed&{}",
-                self.refresh_param()
-            ),
-            json!({
-                "script": {
-                    "source": "ctx._source.related_ids.removeIf(x -> x == params.deleted_id)",
-                    "params": {"deleted_id": id}
-                },
-                "query": {"term": {"related_ids": id}}
-            }),
-        ) {
-            tracing::warn!(error = %e, id, "failed to clean up dangling related_ids after delete");
-        }
-
-        Ok(())
-    }
-
-    fn search_by_keywords(&self, keywords: &[&str], limit: usize) -> IcmResult<Vec<Memory>> {
-        if keywords.is_empty() {
-            return Ok(Vec::new());
-        }
-        // Audit finding: unlike Postgres/SQLite, `limit` was never clamped
-        // here — a caller-supplied limit above OpenSearch's own
-        // `index.max_result_window` (default 10,000) returns a hard 400
-        // error instead of gracefully truncating like the other backends.
-        let limit = limit.min(100);
-        let joined = keywords.join(" ");
-        let resp = self.post(
-            &format!("{IDX_MEMORIES}/_search"),
-            json!({
-                "size": limit,
-                "query": {"bool": {"should": [
-                    {"terms": {"keywords": keywords}},
-                    {"multi_match": {"query": joined, "fields": ["summary", "topic"]}}
-                ], "minimum_should_match": 1}}
-            }),
-        )?;
-        Ok(Self::hits_to_memories(&resp))
-    }
-
-    fn search_fts(&self, query: &str, limit: usize) -> IcmResult<Vec<Memory>> {
-        if query.trim().is_empty() {
-            return Ok(Vec::new());
-        }
-        let limit = limit.min(100);
-        let resp = self.post(
-            &format!("{IDX_MEMORIES}/_search"),
-            json!({
-                "size": limit,
-                "query": {"multi_match": {
-                    "query": query,
-                    "fields": ["summary^2", "topic", "keywords"]
-                }}
-            }),
-        )?;
-        Ok(Self::hits_to_memories(&resp))
-    }
-
-    fn search_by_embedding(
-        &self,
-        embedding: &[f32],
-        limit: usize,
-    ) -> IcmResult<Vec<(Memory, f32)>> {
-        let limit = limit.min(1000);
-        let resp = self.post(
-            &format!("{IDX_MEMORIES}/_search"),
-            json!({
-                "size": limit,
-                "query": {"knn": {"embedding": {"vector": embedding, "k": limit}}}
-            }),
-        )?;
-        Ok(Self::hits_to_scored(&resp))
-    }
-
-    fn search_hybrid(
-        &self,
-        query: &str,
-        embedding: &[f32],
-        limit: usize,
-    ) -> IcmResult<Vec<(Memory, f32)>> {
-        let limit = limit.min(1000);
-        let pool = limit * 4;
-
-        // FTS candidates (BM25).
-        let mut fts_scores: HashMap<String, f32> = HashMap::new();
-        let mut memories: HashMap<String, Memory> = HashMap::new();
-        if !query.trim().is_empty() {
-            let resp = self.post(
-                &format!("{IDX_MEMORIES}/_search"),
-                json!({
-                    "size": pool,
-                    "query": {"multi_match": {"query": query, "fields": ["summary^2", "topic", "keywords"]}}
-                }),
-            )?;
-            for (m, s) in Self::hits_to_scored(&resp) {
-                fts_scores.insert(m.id.clone(), s);
-                memories.insert(m.id.clone(), m);
-            }
-        }
-
-        // Vector candidates.
-        let mut vec_scores: HashMap<String, f32> = HashMap::new();
-        for (m, s) in self.search_by_embedding(embedding, pool)? {
-            vec_scores.insert(m.id.clone(), s);
-            memories.entry(m.id.clone()).or_insert(m);
-        }
-
-        // Min-max normalize each score family to [0, 1] before blending.
-        let norm = |scores: &HashMap<String, f32>| -> HashMap<String, f32> {
-            if scores.is_empty() {
-                return HashMap::new();
-            }
-            let (mut lo, mut hi) = (f32::MAX, f32::MIN);
-            for &v in scores.values() {
-                lo = lo.min(v);
-                hi = hi.max(v);
-            }
-            let span = (hi - lo).max(f32::EPSILON);
-            scores
-                .iter()
-                .map(|(k, v)| (k.clone(), (v - lo) / span))
-                .collect()
-        };
-        let fts_n = norm(&fts_scores);
-        let vec_n = norm(&vec_scores);
-
-        let mut scored: Vec<(String, f32)> = memories
-            .keys()
-            .map(|id| {
-                let f = fts_n.get(id).copied().unwrap_or(0.0);
-                let v = vec_n.get(id).copied().unwrap_or(0.0);
-                (id.clone(), 0.3 * f + 0.7 * v)
-            })
-            .collect();
-        scored.sort_by(|a, b| b.1.partial_cmp(&a.1).unwrap_or(std::cmp::Ordering::Equal));
-        scored.truncate(limit);
-
-        Ok(scored
-            .into_iter()
-            .filter_map(|(id, s)| memories.remove(&id).map(|m| (m, s)))
-            .collect())
-    }
-
-    fn update_access(&self, id: &str) -> IcmResult<()> {
-        if self.readonly {
-            return Ok(());
-        }
-        // Best-effort; a missing doc is not an error for recall bookkeeping.
-        let _ = self.request(
-            "POST",
-            &format!("{IDX_MEMORIES}/_update/{id}"),
-            Some(json!({
-                "script": {
-                    "lang": "painless",
-                    "source": "ctx._source.access_count = (ctx._source.access_count == null ? 1 : ctx._source.access_count + 1); ctx._source.last_accessed = params.now;",
-                    "params": {"now": Utc::now().to_rfc3339()}
-                }
-            })),
-            true,
-        )?;
-        Ok(())
-    }
-
-    fn batch_update_access(&self, ids: &[&str]) -> IcmResult<usize> {
-        if self.readonly || ids.is_empty() {
-            return Ok(0);
-        }
-        let resp = self.post(
-            &format!("{IDX_MEMORIES}/_update_by_query?{}&conflicts=proceed", self.refresh_param()),
-            json!({
-                "query": {"ids": {"values": ids}},
-                "script": {
-                    "lang": "painless",
-                    "source": "ctx._source.access_count = (ctx._source.access_count == null ? 1 : ctx._source.access_count + 1); ctx._source.last_accessed = params.now;",
-                    "params": {"now": Utc::now().to_rfc3339()}
-                }
-            }),
-        )?;
-        Ok(resp.get("updated").and_then(|v| v.as_u64()).unwrap_or(0) as usize)
-    }
-
-    fn apply_decay(&self, decay_factor: f32) -> IcmResult<usize> {
-        if self.readonly {
-            return Err(IcmError::ReadOnly("decay".into()));
-        }
-        let resp = self.post(
-            &format!("{IDX_MEMORIES}/_update_by_query?{}&conflicts=proceed", self.refresh_param()),
-            json!({
-                "query": {"bool": {"must_not": [{"term": {"importance": "critical"}}]}},
-                // Audit finding: for `low` importance with low access count,
-                // the raw multiplier goes negative once decay_factor < 0.5
-                // (still inside the CLI's own validated [0.0, 1.0) range) —
-                // same bug already fixed for SQLite/Postgres. Math.max is
-                // Painless's equivalent clamp.
-                "script": {
-                    "lang": "painless",
-                    "source": "double f = params.factor; String imp = ctx._source.importance; double mult = imp != null && imp.equals('high') ? 0.5 : (imp != null && imp.equals('low') ? 2.0 : 1.0); double ac = ctx._source.access_count == null ? 0 : ctx._source.access_count; if (ac > 5) ac = 5; double m = Math.max(0.0, 1.0 - (1.0 - f) * mult / (1.0 + ac * 0.1)); ctx._source.weight = ctx._source.weight * m;",
-                    "params": {"factor": decay_factor as f64}
-                }
-            }),
-        )?;
-        Ok(resp.get("updated").and_then(|v| v.as_u64()).unwrap_or(0) as usize)
-    }
-
-    fn prune(&self, weight_threshold: f32) -> IcmResult<usize> {
-        if self.readonly {
-            return Err(IcmError::ReadOnly("prune".into()));
-        }
-        let resp = self.post(
-            &format!(
-                "{IDX_MEMORIES}/_delete_by_query?{}&conflicts=proceed",
-                self.refresh_param()
-            ),
-            json!({
-                "query": {"bool": {
-                    "must": [{"range": {"weight": {"lt": weight_threshold as f64}}}],
-                    "must_not": [{"terms": {"importance": ["critical", "high"]}}]
-                }}
-            }),
-        )?;
-        Ok(resp.get("deleted").and_then(|v| v.as_u64()).unwrap_or(0) as usize)
-    }
-
-    fn get_by_topic(&self, topic: &str) -> IcmResult<Vec<Memory>> {
-        let resp = self.post(
-            &format!("{IDX_MEMORIES}/_search"),
-            json!({
-                "size": 500,
-                "query": {"term": {"topic.keyword": topic}},
-                "sort": [{"weight": "desc"}]
-            }),
-        )?;
-        Ok(Self::hits_to_memories(&resp))
-    }
-
-    fn list_all(&self) -> IcmResult<Vec<Memory>> {
-        let resp = self.post(
-            &format!("{IDX_MEMORIES}/_search"),
-            json!({"size": 10000, "query": {"match_all": {}}, "sort": [{"weight": "desc"}]}),
-        )?;
-        Ok(Self::hits_to_memories(&resp))
-    }
-
-    fn list_topics(&self) -> IcmResult<Vec<(String, usize)>> {
-        let resp = self.post(
-            &format!("{IDX_MEMORIES}/_search"),
-            json!({"size": 0, "aggs": {"topics": {"terms": {"field": "topic.keyword", "size": 10000}}}}),
-        )?;
-        let mut out = bucket_counts(&resp, "topics");
-        out.sort_by(|a, b| a.0.cmp(&b.0));
-        Ok(out)
-    }
-
-    fn consolidate_topic(&self, topic: &str, consolidated: Memory) -> IcmResult<()> {
-        if self.readonly {
-            return Err(IcmError::ReadOnly("consolidate".into()));
-        }
-        // Audit findings, both fixed together:
-        // 1. `critical` memories are never deleted — same contract
-        //    apply_decay/prune already honor, and the same fix already
-        //    applied to SQLite/Postgres consolidate_topic. This delete
-        //    query previously wiped critical memories in the topic too.
-        // 2. Still not atomic (no multi-document transaction in
-        //    OpenSearch), but reordered to insert-then-delete: if
-        //    `store_inner` fails (dimension mismatch, network blip,
-        //    cluster unavailable), the originals are left untouched
-        //    instead of being gone with no replacement ever written. The
-        //    failure mode is now "harmless duplication a retry fixes",
-        //    not data loss — the consolidated memory gets a fresh id, so
-        //    it can't collide with any original.
-        let consolidated = validate_and_normalize(consolidated)?;
-        self.check_dims(&consolidated)?;
-        // Manual-testing finding: captured before store_inner/delete below
-        // (the deleted rows are gone afterward), so any *other* memory's
-        // related_ids pointing at them can be cleaned up — same dangling-
-        // reference bug already fixed for the single-id `delete`.
-        let deleted_ids: Vec<String> = self
-            .get_by_topic(topic)?
-            .into_iter()
-            .filter(|m| m.importance != Importance::Critical)
-            .map(|m| m.id)
-            .collect();
-        // `store_inner` returns the id actually used — the caller's fresh
-        // id on a normal insert, or an existing row's id if this exact
-        // (topic, summary_hash) happened to already exist (dedup merge).
-        // Either way it now has the SAME topic as the memories being
-        // consolidated, so it must be excluded from the delete below or it
-        // would delete the very memory it just wrote/merged into.
-        let consolidated_id = self.store_inner(&consolidated)?;
-        self.post(
-            &format!(
-                "{IDX_MEMORIES}/_delete_by_query?{}&conflicts=proceed",
-                self.refresh_param()
-            ),
-            json!({"query": {"bool": {
-                "must": [{"term": {"topic.keyword": topic}}],
-                "must_not": [
-                    {"term": {"importance": "critical"}},
-                    {"ids": {"values": [consolidated_id]}}
-                ]
-            }}}),
-        )?;
-
-        if !deleted_ids.is_empty() {
-            if let Err(e) = self.post(
-                &format!(
-                    "{IDX_MEMORIES}/_update_by_query?conflicts=proceed&{}",
-                    self.refresh_param()
-                ),
-                json!({
-                    "script": {
-                        "source": "ctx._source.related_ids.removeIf(x -> params.deleted_ids.contains(x))",
-                        "params": {"deleted_ids": deleted_ids}
-                    },
-                    "query": {"terms": {"related_ids": deleted_ids}}
-                }),
-            ) {
-                tracing::warn!(topic, error = %e, "consolidate_topic: failed to clean up dangling related_ids");
-            }
-        }
-
-        Ok(())
-    }
-
-    fn count(&self) -> IcmResult<usize> {
-        let resp = self.post(&format!("{IDX_MEMORIES}/_count"), json!({}))?;
-        Ok(resp.get("count").and_then(|v| v.as_u64()).unwrap_or(0) as usize)
-    }
-
-    fn count_by_topic(&self, topic: &str) -> IcmResult<usize> {
-        let resp = self.post(
-            &format!("{IDX_MEMORIES}/_count"),
-            json!({"query": {"term": {"topic.keyword": topic}}}),
-        )?;
-        Ok(resp.get("count").and_then(|v| v.as_u64()).unwrap_or(0) as usize)
-    }
-
-    fn stats(&self) -> IcmResult<StoreStats> {
-        let resp = self.post(
-            &format!("{IDX_MEMORIES}/_search"),
-            json!({
-                "size": 0,
-                "track_total_hits": true,
-                "aggs": {
-                    "avg_w": {"avg": {"field": "weight"}},
-                    "topics": {"cardinality": {"field": "topic.keyword"}},
-                    "oldest": {"min": {"field": "created_at", "format": "date_time"}},
-                    "newest": {"max": {"field": "created_at", "format": "date_time"}}
-                }
-            }),
-        )?;
-        let total = resp
-            .get("hits")
-            .and_then(|h| h.get("total"))
-            .and_then(|t| t.get("value"))
-            .and_then(|v| v.as_u64())
-            .unwrap_or(0) as usize;
-        let aggs = resp.get("aggregations").cloned().unwrap_or(Value::Null);
-        let avg_weight = aggs
-            .get("avg_w")
-            .and_then(|a| a.get("value"))
-            .and_then(|v| v.as_f64())
-            .unwrap_or(0.0) as f32;
-        let total_topics = aggs
-            .get("topics")
-            .and_then(|a| a.get("value"))
-            .and_then(|v| v.as_u64())
-            .unwrap_or(0) as usize;
-        let parse_agg_date = |name: &str| -> Option<DateTime<Utc>> {
-            aggs.get(name)
-                .and_then(|a| a.get("value_as_string"))
-                .and_then(|v| v.as_str())
-                .map(parse_dt)
-        };
-        Ok(StoreStats {
-            total_memories: total,
-            total_topics,
-            avg_weight,
-            oldest_memory: parse_agg_date("oldest"),
-            newest_memory: parse_agg_date("newest"),
-        })
-    }
-
-    fn topic_health(&self, topic: &str) -> IcmResult<TopicHealth> {
-        let resp = self.post(
-            &format!("{IDX_MEMORIES}/_search"),
-            json!({
-                "size": 0,
-                "track_total_hits": true,
-                "query": {"term": {"topic.keyword": topic}},
-                "aggs": {
-                    "avg_w": {"avg": {"field": "weight"}},
-                    "avg_ac": {"avg": {"field": "access_count"}},
-                    "oldest": {"min": {"field": "created_at"}},
-                    "newest": {"max": {"field": "created_at"}},
-                    "last_acc": {"max": {"field": "last_accessed"}},
-                    "stale": {"filter": {"bool": {"must": [
-                        {"range": {"weight": {"lt": 0.5}}},
-                        {"range": {"last_accessed": {"lt": "now-14d"}}}
-                    ]}}}
-                }
-            }),
-        )?;
-        let entry_count = resp
-            .get("hits")
-            .and_then(|h| h.get("total"))
-            .and_then(|t| t.get("value"))
-            .and_then(|v| v.as_u64())
-            .unwrap_or(0) as usize;
-        if entry_count == 0 {
-            return Err(IcmError::NotFound(format!(
-                "no memories in topic '{topic}'"
-            )));
-        }
-        let aggs = resp.get("aggregations").cloned().unwrap_or(Value::Null);
-        let avg_weight = aggs
-            .get("avg_w")
-            .and_then(|a| a.get("value"))
-            .and_then(|v| v.as_f64())
-            .unwrap_or(0.0) as f32;
-        let avg_access_count = aggs
-            .get("avg_ac")
-            .and_then(|a| a.get("value"))
-            .and_then(|v| v.as_f64())
-            .unwrap_or(0.0) as f32;
-        let stale_count = aggs
-            .get("stale")
-            .and_then(|a| a.get("doc_count"))
-            .and_then(|v| v.as_u64())
-            .unwrap_or(0) as usize;
-        Ok(TopicHealth {
-            topic: topic.to_string(),
-            entry_count,
-            avg_weight,
-            avg_access_count,
-            oldest: agg_date(&aggs, "oldest"),
-            newest: agg_date(&aggs, "newest"),
-            last_accessed: agg_date(&aggs, "last_acc"),
-            stale_count,
-            needs_consolidation: entry_count > 5,
-        })
-    }
-}
-
-/// Read a `min`/`max` date aggregation into a `DateTime<Utc>`.
-///
-/// Prefers the ISO `value_as_string` OpenSearch returns and falls back to
-/// the epoch-millis `value`. Returns `None` when the bucket is empty.
-fn agg_date(aggs: &Value, name: &str) -> Option<DateTime<Utc>> {
-    let node = aggs.get(name)?;
-    if let Some(s) = node.get("value_as_string").and_then(|v| v.as_str()) {
-        if let Ok(dt) = DateTime::parse_from_rfc3339(s) {
-            return Some(dt.with_timezone(&Utc));
-        }
-    }
-    let ms = node.get("value").and_then(|v| v.as_f64())?;
-    if ms <= 0.0 {
-        return None;
-    }
-    Utc.timestamp_millis_opt(ms as i64).single()
-}
-
-/// Extract `(key, doc_count)` pairs from a terms aggregation.
-fn bucket_counts(resp: &Value, agg: &str) -> Vec<(String, usize)> {
-    resp.get("aggregations")
-        .and_then(|a| a.get(agg))
-        .and_then(|t| t.get("buckets"))
-        .and_then(|b| b.as_array())
-        .map(|buckets| {
-            buckets
-                .iter()
-                .filter_map(|b| {
-                    let key = b.get("key")?.as_str()?.to_string();
-                    let count = b.get("doc_count")?.as_u64()? as usize;
-                    Some((key, count))
-                })
-                .collect()
-        })
-        .unwrap_or_default()
-}
-
-// ---------------------------------------------------------------------------
-// Inherent methods used by the cli/mcp store/recall/hook path
-// ---------------------------------------------------------------------------
-
-impl OpenSearchStore {
-    pub fn maybe_auto_decay(&self) -> IcmResult<()> {
-        if self.readonly {
-            return Ok(());
-        }
-        // Atomic-ish claim via a scripted upsert on a metadata doc: only the
-        // caller that flips `changed` to true runs the decay.
-        let now_ms = Utc::now().timestamp_millis();
-        let resp = self.post(
-            &format!("{IDX_METADATA}/_update/last_decay_at?{}&_source=true", self.refresh_param()),
-            json!({
-                "scripted_upsert": true,
-                "upsert": {},
-                "script": {
-                    "lang": "painless",
-                    "source": "if (ctx._source.value == null || params.now - ctx._source.value >= 86400000L) { ctx._source.value = params.now; ctx._source.changed = true; } else { ctx._source.changed = false; }",
-                    "params": {"now": now_ms}
-                }
-            }),
-        )?;
-        let changed = resp
-            .get("get")
-            .and_then(|g| g.get("_source"))
-            .and_then(|s| s.get("changed"))
-            .and_then(|c| c.as_bool())
-            .unwrap_or(false);
-        if changed {
-            self.apply_decay(0.95)?;
-        }
-        Ok(())
-    }
-
-    pub fn increment_hook_counter(&self) -> IcmResult<usize> {
-        let resp = self.post(
-            &format!("{IDX_METADATA}/_update/hook_counter?_source=true"),
-            json!({
-                "scripted_upsert": true,
-                "upsert": {},
-                "script": {
-                    "lang": "painless",
-                    "source": "ctx._source.value = (ctx._source.value == null ? 1 : ctx._source.value + 1);"
-                }
-            }),
-        )?;
-        Ok(resp
-            .get("get")
-            .and_then(|g| g.get("_source"))
-            .and_then(|s| s.get("value"))
-            .and_then(|v| v.as_f64())
-            .unwrap_or(0.0) as usize)
-    }
-
-    pub fn reset_hook_counter(&self) -> IcmResult<()> {
-        self.set_metadata_int("hook_counter", 0)
-    }
-
-    pub fn enqueue_pending_extraction(
-        &self,
-        project: &str,
-        tool_name: &str,
-        raw_output: &str,
-    ) -> IcmResult<String> {
-        let id = ulid::Ulid::new().to_string();
-        self.request(
-            "PUT",
-            &format!("{IDX_PENDING}/_doc/{id}?{}", self.refresh_param()),
-            Some(json!({
-                "project": project,
-                "tool_name": tool_name,
-                "raw_output": raw_output,
-                "captured_at": Utc::now().to_rfc3339()
-            })),
-            false,
-        )?;
-        Ok(id)
-    }
-
-    pub fn list_pending_extractions(&self, limit: usize) -> IcmResult<Vec<PendingRow>> {
-        let resp = self.post(
-            &format!("{IDX_PENDING}/_search"),
-            json!({"size": limit, "query": {"match_all": {}}, "sort": [{"captured_at": "asc"}]}),
-        )?;
-        let rows = resp
-            .get("hits")
-            .and_then(|h| h.get("hits"))
-            .and_then(|h| h.as_array())
-            .map(|hits| {
-                hits.iter()
-                    .filter_map(|h| {
-                        let id = h.get("_id")?.as_str()?.to_string();
-                        let s = h.get("_source")?;
-                        Some((
-                            id,
-                            s.get("project")?.as_str()?.to_string(),
-                            s.get("tool_name")?.as_str()?.to_string(),
-                            s.get("raw_output")?.as_str()?.to_string(),
-                            s.get("captured_at")?.as_str()?.to_string(),
-                        ))
-                    })
-                    .collect()
-            })
-            .unwrap_or_default();
-        Ok(rows)
-    }
-
-    pub fn delete_pending_extractions(&self, ids: &[String]) -> IcmResult<usize> {
-        if ids.is_empty() {
-            return Ok(0);
-        }
-        let resp = self.post(
-            &format!(
-                "{IDX_PENDING}/_delete_by_query?{}&conflicts=proceed",
-                self.refresh_param()
-            ),
-            json!({"query": {"ids": {"values": ids}}}),
-        )?;
-        Ok(resp.get("deleted").and_then(|v| v.as_u64()).unwrap_or(0) as usize)
-    }
-
-    pub fn pending_extraction_count(&self) -> IcmResult<usize> {
-        let resp = self.post(&format!("{IDX_PENDING}/_count"), json!({}))?;
-        Ok(resp.get("count").and_then(|v| v.as_u64()).unwrap_or(0) as usize)
-    }
-
-    pub fn upsert_code_area(
-        &self,
-        project: &str,
-        file_path: &str,
-        description: Option<&str>,
-        session_id: Option<&str>,
-        tool_name: Option<&str>,
-    ) -> IcmResult<()> {
-        if self.readonly {
-            return Err(IcmError::ReadOnly("upsert_code_area".into()));
-        }
-        let ts = Utc::now();
-        let now = ts.to_rfc3339();
-        let id = ts.timestamp_millis();
-        // Deterministic id makes the same (project, file_path) a single row.
-        let key = B64.encode(format!("{project}\0{file_path}"));
-        self.request(
-            "POST",
-            &format!("{IDX_CODE_AREAS}/_update/{key}?{}", self.refresh_param()),
-            Some(json!({
-                "scripted_upsert": true,
-                "upsert": {
-                    "id": id,
-                    "project": project,
-                    "file_path": file_path,
-                    "description": description,
-                    "session_id": session_id,
-                    "tool_name": tool_name,
-                    "touch_count": 1,
-                    "first_touched_at": now,
-                    "last_touched_at": now
-                },
-                "script": {
-                    "lang": "painless",
-                    "source": "ctx._source.touch_count = (ctx._source.touch_count == null ? 1 : ctx._source.touch_count + 1); ctx._source.last_touched_at = params.now; if (params.description != null) ctx._source.description = params.description; if (params.session_id != null) ctx._source.session_id = params.session_id; if (params.tool_name != null) ctx._source.tool_name = params.tool_name;",
-                    "params": {"now": now, "description": description, "session_id": session_id, "tool_name": tool_name}
-                }
-            })),
-            false,
-        )?;
-        Ok(())
-    }
-
-    pub fn list_code_areas(
-        &self,
-        project: Option<&str>,
-        in_file: Option<&str>,
-        since: Option<DateTime<Utc>>,
-        limit: usize,
-    ) -> IcmResult<Vec<CodeArea>> {
-        let mut filters: Vec<Value> = Vec::new();
-        if let Some(p) = project {
-            filters.push(json!({"term": {"project": p}}));
-        }
-        if let Some(f) = in_file {
-            filters.push(json!({"wildcard": {"file_path": {"value": format!("*{f}*")}}}));
-        }
-        if let Some(s) = since {
-            filters.push(json!({"range": {"last_touched_at": {"gte": s.to_rfc3339()}}}));
-        }
-        let query = if filters.is_empty() {
-            json!({"match_all": {}})
-        } else {
-            json!({"bool": {"filter": filters}})
-        };
-        let resp = self.post(
-            &format!("{IDX_CODE_AREAS}/_search"),
-            json!({"size": limit, "query": query, "sort": [{"last_touched_at": "desc"}]}),
-        )?;
-        let rows = resp
-            .get("hits")
-            .and_then(|h| h.get("hits"))
-            .and_then(|h| h.as_array())
-            .map(|hits| {
-                hits.iter()
-                    .filter_map(|h| {
-                        let s = h.get("_source")?;
-                        Some(CodeArea {
-                            id: s.get("id").and_then(|v| v.as_i64()).unwrap_or(0),
-                            project: s.get("project")?.as_str()?.to_string(),
-                            file_path: s.get("file_path")?.as_str()?.to_string(),
-                            description: s
-                                .get("description")
-                                .and_then(|v| v.as_str())
-                                .map(String::from),
-                            session_id: s
-                                .get("session_id")
-                                .and_then(|v| v.as_str())
-                                .map(String::from),
-                            tool_name: s
-                                .get("tool_name")
-                                .and_then(|v| v.as_str())
-                                .map(String::from),
-                            touch_count: s.get("touch_count").and_then(|v| v.as_i64()).unwrap_or(1),
-                            first_touched_at: s
-                                .get("first_touched_at")
-                                .and_then(|v| v.as_str())
-                                .and_then(|x| DateTime::parse_from_rfc3339(x).ok())
-                                .map(|d| d.with_timezone(&Utc))
-                                .unwrap_or_else(Utc::now),
-                            last_touched_at: s
-                                .get("last_touched_at")
-                                .and_then(|v| v.as_str())
-                                .and_then(|x| DateTime::parse_from_rfc3339(x).ok())
-                                .map(|d| d.with_timezone(&Utc))
-                                .unwrap_or_else(Utc::now),
-                        })
-                    })
-                    .collect()
-            })
-            .unwrap_or_default();
-        Ok(rows)
-    }
-
-    pub fn code_area_count(&self) -> IcmResult<usize> {
-        let resp = self.post(&format!("{IDX_CODE_AREAS}/_count"), json!({}))?;
-        Ok(resp.get("count").and_then(|v| v.as_u64()).unwrap_or(0) as usize)
-    }
-
-    pub fn record_hook_event(&self, ev: &HookEventInsert) -> IcmResult<i64> {
-        let now = Utc::now();
-        let id = now.timestamp_millis();
-        let doc_id = ulid::Ulid::new().to_string();
-        self.request(
-            "PUT",
-            &format!("{IDX_HOOKS}/_doc/{doc_id}"),
-            Some(json!({
-                "id": id,
-                "ts": now.to_rfc3339(),
-                "event": ev.event,
-                "project": ev.project,
-                "session_id": ev.session_id,
-                "tool_name": ev.tool_name,
-                "duration_ms": ev.duration_ms,
-                "exit_code": ev.exit_code,
-                "payload_size": ev.payload_size,
-                "note": ev.note
-            })),
-            false,
-        )?;
-        Ok(id)
-    }
-
-    pub fn hook_events_recent(
-        &self,
-        limit: usize,
-        event_filter: Option<&str>,
-    ) -> IcmResult<Vec<HookEvent>> {
-        let query = match event_filter {
-            Some(e) => json!({"term": {"event": e}}),
-            None => json!({"match_all": {}}),
-        };
-        let resp = self.post(
-            &format!("{IDX_HOOKS}/_search"),
-            json!({"size": limit, "query": query, "sort": [{"ts": "desc"}]}),
-        )?;
-        let rows = resp
-            .get("hits")
-            .and_then(|h| h.get("hits"))
-            .and_then(|h| h.as_array())
-            .map(|hits| {
-                hits.iter()
-                    .filter_map(|h| {
-                        let s = h.get("_source")?;
-                        Some(HookEvent {
-                            id: s.get("id").and_then(|v| v.as_i64()).unwrap_or(0),
-                            ts: parse_dt(s.get("ts").and_then(|v| v.as_str()).unwrap_or("")),
-                            event: s
-                                .get("event")
-                                .and_then(|v| v.as_str())
-                                .unwrap_or("")
-                                .to_string(),
-                            project: s.get("project").and_then(|v| v.as_str()).map(String::from),
-                            session_id: s
-                                .get("session_id")
-                                .and_then(|v| v.as_str())
-                                .map(String::from),
-                            tool_name: s
-                                .get("tool_name")
-                                .and_then(|v| v.as_str())
-                                .map(String::from),
-                            duration_ms: s.get("duration_ms").and_then(|v| v.as_i64()),
-                            exit_code: s.get("exit_code").and_then(|v| v.as_i64()).unwrap_or(0)
-                                as i32,
-                            payload_size: s.get("payload_size").and_then(|v| v.as_i64()),
-                            note: s.get("note").and_then(|v| v.as_str()).map(String::from),
-                        })
-                    })
-                    .collect()
-            })
-            .unwrap_or_default();
-        Ok(rows)
-    }
-
-    pub fn hook_stats(&self, since_rfc3339: &str) -> IcmResult<Vec<HookStatsRow>> {
-        let resp = self.post(
-            &format!("{IDX_HOOKS}/_search"),
-            json!({
-                "size": 0,
-                "query": {"range": {"ts": {"gte": since_rfc3339}}},
-                "aggs": {"events": {
-                    "terms": {"field": "event", "size": 1000},
-                    "aggs": {
-                        "errs": {"filter": {"bool": {"must_not": [{"term": {"exit_code": 0}}]}}},
-                        "avg_dur": {"avg": {"field": "duration_ms"}},
-                        "pct": {"percentiles": {"field": "duration_ms", "percents": [50, 99]}}
-                    }
-                }}
-            }),
-        )?;
-        let buckets = resp
-            .get("aggregations")
-            .and_then(|a| a.get("events"))
-            .and_then(|e| e.get("buckets"))
-            .and_then(|b| b.as_array())
-            .cloned()
-            .unwrap_or_default();
-        let mut out = Vec::new();
-        for b in &buckets {
-            let pct = b.get("pct").and_then(|p| p.get("values"));
-            let p = |k: &str| {
-                pct.and_then(|v| v.get(k))
-                    .and_then(|v| v.as_f64())
-                    .filter(|f| f.is_finite())
-                    .unwrap_or(0.0) as i64
-            };
-            out.push(HookStatsRow {
-                event: b
-                    .get("key")
-                    .and_then(|v| v.as_str())
-                    .unwrap_or("")
-                    .to_string(),
-                count: b.get("doc_count").and_then(|v| v.as_i64()).unwrap_or(0),
-                error_count: b
-                    .get("errs")
-                    .and_then(|e| e.get("doc_count"))
-                    .and_then(|v| v.as_i64())
-                    .unwrap_or(0),
-                avg_duration_ms: b
-                    .get("avg_dur")
-                    .and_then(|a| a.get("value"))
-                    .and_then(|v| v.as_f64())
-                    .unwrap_or(0.0),
-                p50_duration_ms: p("50.0"),
-                p99_duration_ms: p("99.0"),
-            });
-        }
-        out.sort_by(|a, b| a.event.cmp(&b.event));
-        Ok(out)
-    }
-
-    pub fn prune_hook_events(&self, cutoff_rfc3339: &str) -> IcmResult<usize> {
-        let resp = self.post(
-            &format!(
-                "{IDX_HOOKS}/_delete_by_query?{}&conflicts=proceed",
-                self.refresh_param()
-            ),
-            json!({"query": {"range": {"ts": {"lt": cutoff_rfc3339}}}}),
-        )?;
-        Ok(resp.get("deleted").and_then(|v| v.as_u64()).unwrap_or(0) as usize)
-    }
-
-    pub fn hook_event_count(&self) -> IcmResult<usize> {
-        let resp = self.post(&format!("{IDX_HOOKS}/_count"), json!({}))?;
-        Ok(resp.get("count").and_then(|v| v.as_u64()).unwrap_or(0) as usize)
-    }
-
-    /// Auto-consolidation is not yet implemented on this backend; it is a
-    /// no-op (returns `false`) so the normal store path keeps working.
-    pub fn auto_consolidate(&self, _topic: &str, _threshold: usize) -> IcmResult<bool> {
-        Ok(false)
-    }
-
-    /// See [`Self::auto_consolidate`].
-    pub fn auto_consolidate_with_embedder(
-        &self,
-        _topic: &str,
-        _threshold: usize,
-        _embedder: Option<&dyn Embedder>,
-    ) -> IcmResult<bool> {
-        Ok(false)
-    }
-
-    pub fn get_many(&self, ids: &[&str]) -> IcmResult<HashMap<String, Memory>> {
-        if ids.is_empty() {
-            return Ok(HashMap::new());
-        }
-        let resp = self.post(&format!("{IDX_MEMORIES}/_mget"), json!({"ids": ids}))?;
-        let mut out = HashMap::new();
-        if let Some(docs) = resp.get("docs").and_then(|d| d.as_array()) {
-            for d in docs {
-                if d.get("found").and_then(|f| f.as_bool()).unwrap_or(false) {
-                    if let (Some(id), Some(src)) =
-                        (d.get("_id").and_then(|v| v.as_str()), d.get("_source"))
-                    {
-                        out.insert(id.to_string(), Self::source_to_memory(id, src));
-                    }
-                }
-            }
-        }
-        Ok(out)
-    }
-
-    pub fn get_by_topic_prefix(&self, topic: &str) -> IcmResult<Vec<Memory>> {
-        let resp = self.post(
-            &format!("{IDX_MEMORIES}/_search"),
-            json!({
-                "size": 500,
-                "query": {"prefix": {"topic.keyword": topic}},
-                "sort": [{"weight": "desc"}]
-            }),
-        )?;
-        Ok(Self::hits_to_memories(&resp))
-    }
-
-    pub fn list_topics_with_prefix(&self, prefix: Option<&str>) -> IcmResult<Vec<(String, usize)>> {
-        let mut topics = self.list_topics()?;
-        if let Some(p) = prefix {
-            topics.retain(|(t, _)| t.starts_with(p));
-        }
-        Ok(topics)
-    }
-
-    /// Expand a result set with graph neighbours (related ids), applying a
-    /// hop discount. Pure logic over [`Self::get_many`]; identical to the
-    /// other backends.
-    pub fn expand_with_neighbors(
-        &self,
-        initial: &[(Memory, f32)],
-        max_neighbors: usize,
-        hop_discount: f32,
-        max_total: usize,
-    ) -> IcmResult<Vec<(Memory, f32)>> {
-        if max_neighbors == 0 || initial.is_empty() {
-            let mut out = initial.to_vec();
-            out.truncate(max_total);
-            return Ok(out);
-        }
-        let initial_ids: HashSet<String> = initial.iter().map(|(m, _)| m.id.clone()).collect();
-        let mut candidates: Vec<(String, f32)> = Vec::new();
-        let mut seen: HashSet<String> = HashSet::new();
-        for (m, score) in initial {
-            for rid in &m.related_ids {
-                if !initial_ids.contains(rid) && seen.insert(rid.clone()) {
-                    candidates.push((rid.clone(), *score * hop_discount));
-                    if candidates.len() >= max_neighbors {
-                        break;
-                    }
-                }
-            }
-            if candidates.len() >= max_neighbors {
-                break;
-            }
-        }
-
-        let neighbor_ids: Vec<&str> = candidates.iter().map(|(id, _)| id.as_str()).collect();
-        let fetched = self.get_many(&neighbor_ids)?;
-
-        let mut combined: Vec<(Memory, f32)> = initial.to_vec();
-        for (id, score) in candidates {
-            if let Some(m) = fetched.get(&id) {
-                combined.push((m.clone(), score));
-            }
-        }
-        combined.sort_by(|a, b| b.1.partial_cmp(&a.1).unwrap_or(std::cmp::Ordering::Equal));
-        combined.truncate(max_total);
-        Ok(combined)
-    }
-
-    /// Pattern mining is not implemented on this backend yet.
-    pub fn detect_patterns(
-        &self,
-        _topic: &str,
-        _min_cluster_size: usize,
-    ) -> IcmResult<Vec<PatternCluster>> {
-        Err(IcmError::Unsupported("detect_patterns".into()))
-    }
-
-    /// See [`Self::detect_patterns`].
-    pub fn extract_pattern_as_concept(
-        &self,
-        _cluster: &PatternCluster,
-        _memoir_id: &str,
-    ) -> IcmResult<String> {
-        Err(IcmError::Unsupported("extract_pattern_as_concept".into()))
-    }
-}
-
-// ---------------------------------------------------------------------------
-// Subsystems not yet ported to this backend. They stay fully available on
-// the default SQLite backend; here they fail cleanly with `Unsupported`.
-// ---------------------------------------------------------------------------
-
-fn unsupported<T>(op: &str) -> IcmResult<T> {
-    Err(IcmError::Unsupported(format!(
-        "{op} (use the default SQLite backend)"
-    )))
-}
-
-impl MemoirStore for OpenSearchStore {
-    fn create_memoir(&self, _memoir: Memoir) -> IcmResult<String> {
-        unsupported("memoir.create_memoir")
-    }
-    fn get_memoir(&self, _id: &str) -> IcmResult<Option<Memoir>> {
-        unsupported("memoir.get_memoir")
-    }
-    fn get_memoir_by_name(&self, _name: &str) -> IcmResult<Option<Memoir>> {
-        unsupported("memoir.get_memoir_by_name")
-    }
-    fn update_memoir(&self, _memoir: &Memoir) -> IcmResult<()> {
-        unsupported("memoir.update_memoir")
-    }
-    fn delete_memoir(&self, _id: &str) -> IcmResult<()> {
-        unsupported("memoir.delete_memoir")
-    }
-    fn list_memoirs(&self) -> IcmResult<Vec<Memoir>> {
-        unsupported("memoir.list_memoirs")
-    }
-    fn add_concept(&self, _concept: Concept) -> IcmResult<String> {
-        unsupported("memoir.add_concept")
-    }
-    fn get_concept(&self, _id: &str) -> IcmResult<Option<Concept>> {
-        unsupported("memoir.get_concept")
-    }
-    fn get_concept_by_name(&self, _memoir_id: &str, _name: &str) -> IcmResult<Option<Concept>> {
-        unsupported("memoir.get_concept_by_name")
-    }
-    fn update_concept(&self, _concept: &Concept) -> IcmResult<()> {
-        unsupported("memoir.update_concept")
-    }
-    fn delete_concept(&self, _id: &str) -> IcmResult<()> {
-        unsupported("memoir.delete_concept")
-    }
-    fn list_concepts(&self, _memoir_id: &str) -> IcmResult<Vec<Concept>> {
-        unsupported("memoir.list_concepts")
-    }
-    fn search_concepts_fts(
-        &self,
-        _memoir_id: &str,
-        _query: &str,
-        _limit: usize,
-    ) -> IcmResult<Vec<Concept>> {
-        unsupported("memoir.search_concepts_fts")
-    }
-    fn search_concepts_by_label(
-        &self,
-        _memoir_id: &str,
-        _label: &Label,
-        _limit: usize,
-    ) -> IcmResult<Vec<Concept>> {
-        unsupported("memoir.search_concepts_by_label")
-    }
-    fn search_all_concepts_fts(&self, _query: &str, _limit: usize) -> IcmResult<Vec<Concept>> {
-        unsupported("memoir.search_all_concepts_fts")
-    }
-    fn refine_concept(
-        &self,
-        _id: &str,
-        _new_definition: &str,
-        _new_source_ids: &[String],
-    ) -> IcmResult<()> {
-        unsupported("memoir.refine_concept")
-    }
-    fn add_link(&self, _link: ConceptLink) -> IcmResult<String> {
-        unsupported("memoir.add_link")
-    }
-    fn get_links_from(&self, _concept_id: &str) -> IcmResult<Vec<ConceptLink>> {
-        unsupported("memoir.get_links_from")
-    }
-    fn get_links_to(&self, _concept_id: &str) -> IcmResult<Vec<ConceptLink>> {
-        unsupported("memoir.get_links_to")
-    }
-    fn delete_link(&self, _id: &str) -> IcmResult<()> {
-        unsupported("memoir.delete_link")
-    }
-    fn get_neighbors(
-        &self,
-        _concept_id: &str,
-        _relation: Option<Relation>,
-    ) -> IcmResult<Vec<Concept>> {
-        unsupported("memoir.get_neighbors")
-    }
-    fn get_neighborhood(
-        &self,
-        _concept_id: &str,
-        _depth: usize,
-    ) -> IcmResult<(Vec<Concept>, Vec<ConceptLink>)> {
-        unsupported("memoir.get_neighborhood")
-    }
-    fn get_links_for_memoir(&self, _memoir_id: &str) -> IcmResult<Vec<ConceptLink>> {
-        unsupported("memoir.get_links_for_memoir")
-    }
-    fn memoir_stats(&self, _memoir_id: &str) -> IcmResult<MemoirStats> {
-        unsupported("memoir.memoir_stats")
-    }
-    fn batch_memoir_concept_counts(&self) -> IcmResult<HashMap<String, usize>> {
-        unsupported("memoir.batch_memoir_concept_counts")
-    }
-}
-
-impl FeedbackStore for OpenSearchStore {
-    fn store_feedback(&self, _feedback: Feedback) -> IcmResult<String> {
-        unsupported("feedback.store_feedback")
-    }
-    fn search_feedback(
-        &self,
-        _query: &str,
-        _query_embedding: Option<&[f32]>,
-        _topic: Option<&str>,
-        _limit: usize,
-    ) -> IcmResult<Vec<Feedback>> {
-        unsupported("feedback.search_feedback")
-    }
-    fn list_feedback(&self, _topic: Option<&str>, _limit: usize) -> IcmResult<Vec<Feedback>> {
-        unsupported("feedback.list_feedback")
-    }
-    fn increment_applied(&self, _id: &str) -> IcmResult<()> {
-        unsupported("feedback.increment_applied")
-    }
-    fn delete_feedback(&self, _id: &str) -> IcmResult<()> {
-        unsupported("feedback.delete_feedback")
-    }
-    fn feedback_stats(&self) -> IcmResult<FeedbackStats> {
-        unsupported("feedback.feedback_stats")
-    }
-}
-
-impl FactsStore for OpenSearchStore {
-    fn set_fact(
-        &self,
-        _entity: &str,
-        _key: &str,
-        _value: &str,
-        _source: &str,
-    ) -> IcmResult<String> {
-        unsupported("facts.set_fact")
-    }
-    fn get_fact(&self, _entity: &str, _key: &str) -> IcmResult<Option<Fact>> {
-        unsupported("facts.get_fact")
-    }
-    fn list_facts(&self, _entity: &str, _key_prefix: Option<&str>) -> IcmResult<Vec<Fact>> {
-        unsupported("facts.list_facts")
-    }
-    fn history(&self, _entity: &str, _key: &str) -> IcmResult<Vec<Fact>> {
-        unsupported("facts.history")
-    }
-    fn forget_fact(&self, _entity: &str, _key: &str) -> IcmResult<usize> {
-        unsupported("facts.forget_fact")
-    }
-    fn facts_stats(&self) -> IcmResult<FactsStats> {
-        unsupported("facts.facts_stats")
-    }
-}
-
-impl TranscriptStore for OpenSearchStore {
-    fn create_session(
-        &self,
-        _agent: &str,
-        _project: Option<&str>,
-        _metadata: Option<&str>,
-    ) -> IcmResult<String> {
-        unsupported("transcript.create_session")
-    }
-    fn ensure_session(
-        &self,
-        _id: &str,
-        _agent: &str,
-        _project: Option<&str>,
-        _metadata: Option<&str>,
-    ) -> IcmResult<String> {
-        unsupported("transcript.ensure_session")
-    }
-    fn get_session(&self, _id: &str) -> IcmResult<Option<Session>> {
-        unsupported("transcript.get_session")
-    }
-    fn list_sessions(&self, _project: Option<&str>, _limit: usize) -> IcmResult<Vec<Session>> {
-        unsupported("transcript.list_sessions")
-    }
-    fn record_message(
-        &self,
-        _session_id: &str,
-        _role: Role,
-        _content: &str,
-        _tool_name: Option<&str>,
-        _tokens: Option<i64>,
-        _metadata: Option<&str>,
-    ) -> IcmResult<String> {
-        unsupported("transcript.record_message")
-    }
-    fn list_session_messages(
-        &self,
-        _session_id: &str,
-        _limit: usize,
-        _offset: usize,
-    ) -> IcmResult<Vec<Message>> {
-        unsupported("transcript.list_session_messages")
-    }
-    fn search_transcripts(
-        &self,
-        _query: &str,
-        _session_id: Option<&str>,
-        _project: Option<&str>,
-        _limit: usize,
-    ) -> IcmResult<Vec<TranscriptHit>> {
-        unsupported("transcript.search_transcripts")
-    }
-    fn forget_session(&self, _id: &str) -> IcmResult<()> {
-        unsupported("transcript.forget_session")
-    }
-    fn transcript_stats(&self) -> IcmResult<TranscriptStats> {
-        unsupported("transcript.transcript_stats")
-    }
-}
-
-#[cfg(test)]
-mod tests {
-    use super::*;
-
-    /// Audit regression: a memory id containing reserved URL characters
-    /// (e.g. `/`, `..`, `?`) was interpolated straight into the `_doc/{id}`
-    /// REST path, letting an attacker-controlled id redirect the request to
-    /// a different document/endpoint.
-    #[test]
-    fn test_url_encode_path_segment() {
-        assert_eq!(
-            url_encode_path_segment("abc-DEF_123.~"),
-            "abc-DEF_123.~",
-            "unreserved chars must pass through unchanged"
-        );
-        assert_eq!(url_encode_path_segment("a/b"), "a%2Fb");
-        assert_eq!(url_encode_path_segment("../secret"), "..%2Fsecret");
-        assert_eq!(url_encode_path_segment("id?x=1"), "id%3Fx%3D1");
-        assert_eq!(url_encode_path_segment("id#frag"), "id%23frag");
-        assert_eq!(url_encode_path_segment("a b"), "a%20b");
-    }
-
-    /// Audit regression: `apply_decay`'s Painless script computed a raw
-    /// multiplier that goes negative for low-importance/low-access memories
-    /// at factor<0.5 (still inside the CLI's own validated range). This
-    /// mirrors the exact formula now wrapped in `Math.max(0.0, ...)`.
-    #[test]
-    fn test_apply_decay_formula_would_go_negative_without_clamp() {
-        let factor: f64 = 0.4;
-        let mult: f64 = 2.0; // low importance
-        let access: f64 = 0.0;
-        let raw = 1.0 - (1.0 - factor) * mult / (1.0 + access * 0.1);
-        assert!(
-            raw < 0.0,
-            "expected the pre-clamp formula to go negative, got {raw}"
-        );
-        assert_eq!(
-            raw.max(0.0),
-            0.0,
-            "Math.max(0.0, ...) must clamp this to 0.0"
-        );
-    }
-}
diff --git a/crates/icm-store/src/opensearch/connection.rs b/crates/icm-store/src/opensearch/connection.rs
new file mode 100644
index 00000000..b6320eb0
--- /dev/null
+++ b/crates/icm-store/src/opensearch/connection.rs
@@ -0,0 +1,301 @@
+//! OpenSearch backend -- split out of the former monolithic opensearch.rs.
+//!
+//! Connection setup, constructors, and index/schema migration.
+
+use super::*;
+
+impl OpenSearchStore {
+    pub(crate) fn conn_url() -> IcmResult<String> {
+        std::env::var("ICM_OPENSEARCH_URL")
+            .or_else(|_| std::env::var("OPENSEARCH_URL"))
+            .map_err(|_| {
+                IcmError::Config(
+                    "OpenSearch backend: set ICM_OPENSEARCH_URL to the cluster endpoint, \
+                     e.g. http://localhost:9200"
+                        .into(),
+                )
+            })
+    }
+
+    pub(crate) fn auth_header() -> Option<String> {
+        let user = std::env::var("ICM_OPENSEARCH_USER").ok()?;
+        let pass = std::env::var("ICM_OPENSEARCH_PASSWORD").unwrap_or_default();
+        let token = B64.encode(format!("{user}:{pass}"));
+        Some(format!("Basic {token}"))
+    }
+
+    /// Perform a request, returning the parsed JSON body. `expected_404`
+    /// makes a 404 return `Ok(None)` instead of an error (used by `get`).
+    pub(crate) fn request(
+        &self,
+        method: &str,
+        path: &str,
+        body: Option<Value>,
+        allow_404: bool,
+    ) -> IcmResult<Option<Value>> {
+        let url = format!(
+            "{}/{}",
+            self.base.trim_end_matches('/'),
+            path.trim_start_matches('/')
+        );
+        let mut req = self.agent.request(method, &url);
+        if let Some(a) = &self.auth {
+            req = req.set("Authorization", a);
+        }
+        let resp = match body {
+            Some(b) => req.send_json(b),
+            None => req.call(),
+        };
+        match resp {
+            Ok(r) => {
+                let v = r
+                    .into_json::<Value>()
+                    .map_err(|e| IcmError::Database(format!("opensearch decode: {e}")))?;
+                Ok(Some(v))
+            }
+            Err(ureq::Error::Status(404, _)) if allow_404 => Ok(None),
+            Err(ureq::Error::Status(code, r)) => {
+                let txt = r.into_string().unwrap_or_default();
+                Err(IcmError::Database(format!(
+                    "opensearch {method} {path} -> {code}: {txt}"
+                )))
+            }
+            Err(e) => Err(IcmError::Database(format!(
+                "opensearch {method} {path}: {e}"
+            ))),
+        }
+    }
+
+    pub(crate) fn get_json(&self, path: &str) -> IcmResult<Option<Value>> {
+        self.request("GET", path, None, true)
+    }
+
+    pub(crate) fn post(&self, path: &str, body: Value) -> IcmResult<Value> {
+        self.request("POST", path, Some(body), false)
+            .map(|o| o.unwrap_or(Value::Null))
+    }
+
+    /// Open or create a store with the default embedding dimension.
+    pub fn new(_path: &Path) -> IcmResult<Self> {
+        Self::connect(icm_core::DEFAULT_EMBEDDING_DIMS, false)
+    }
+
+    /// Open or create a store with a specific embedding dimension.
+    pub fn with_dims(_path: &Path, embedding_dims: usize) -> IcmResult<Self> {
+        Self::connect(embedding_dims, false)
+    }
+
+    /// Open the store read-only (issue #263). OpenSearch has no read-only
+    /// connection mode, so this just flags the store and makes mutating
+    /// methods error.
+    pub fn open_readonly(_path: &Path) -> IcmResult<Self> {
+        Self::connect(icm_core::DEFAULT_EMBEDDING_DIMS, true)
+    }
+
+    /// In-memory variant is not meaningful for a remote backend; connect
+    /// from the environment instead.
+    pub fn in_memory() -> IcmResult<Self> {
+        Self::connect(icm_core::DEFAULT_EMBEDDING_DIMS, false)
+    }
+
+    /// See [`Self::in_memory`].
+    pub fn in_memory_with_dims(embedding_dims: usize) -> IcmResult<Self> {
+        Self::connect(embedding_dims, false)
+    }
+
+    /// Read the stored embedding dimension without committing to a full
+    /// open. Returns `Ok(None)` when unreachable so callers can fall back.
+    pub fn read_stored_embedding_dims(_path: &Path) -> IcmResult<Option<usize>> {
+        let Ok(url) = Self::conn_url() else {
+            return Ok(None);
+        };
+        let agent = ureq::AgentBuilder::new()
+            .timeout(Duration::from_secs(10))
+            .build();
+        let store = OpenSearchStore {
+            agent,
+            base: url,
+            auth: Self::auth_header(),
+            embedding_dims: icm_core::DEFAULT_EMBEDDING_DIMS,
+            readonly: true,
+        };
+        match store.get_metadata_int("embedding_dims") {
+            Ok(Some(v)) => Ok(Some(v as usize)),
+            _ => Ok(None),
+        }
+    }
+
+    pub fn is_readonly(&self) -> bool {
+        self.readonly
+    }
+
+    /// No-op on this backend (kept for API parity with the SQLite store).
+    pub fn ensure_vec_init() {}
+
+    pub(crate) fn connect(requested_dims: usize, readonly: bool) -> IcmResult<Self> {
+        let url = Self::conn_url()?;
+        let agent = ureq::AgentBuilder::new()
+            .timeout(Duration::from_secs(30))
+            .build();
+        let store = OpenSearchStore {
+            agent,
+            base: url,
+            auth: Self::auth_header(),
+            embedding_dims: requested_dims,
+            readonly,
+        };
+        // Probe connectivity early with a clear error.
+        store
+            .get_json("/")
+            .map_err(|e| IcmError::Database(format!("cannot reach OpenSearch: {e}")))?;
+
+        // An existing database's stored dims are authoritative.
+        let dims = match store.get_metadata_int("embedding_dims")? {
+            Some(d) => d as usize,
+            None => requested_dims,
+        };
+        let mut store = store;
+        store.embedding_dims = dims;
+
+        if !readonly {
+            store.init_indices(dims)?;
+            store.set_metadata_int("embedding_dims", dims as i64)?;
+        }
+        Ok(store)
+    }
+
+    pub(crate) fn index_exists(&self, idx: &str) -> IcmResult<bool> {
+        let url = format!("{}/{}", self.base.trim_end_matches('/'), idx);
+        let mut req = self.agent.request("HEAD", &url);
+        if let Some(a) = &self.auth {
+            req = req.set("Authorization", a);
+        }
+        match req.call() {
+            Ok(_) => Ok(true),
+            Err(ureq::Error::Status(404, _)) => Ok(false),
+            Err(e) => Err(IcmError::Database(format!("opensearch HEAD {idx}: {e}"))),
+        }
+    }
+
+    pub(crate) fn create_index(&self, idx: &str, body: Value) -> IcmResult<()> {
+        if self.index_exists(idx)? {
+            return Ok(());
+        }
+        // A racing replica may create it between the check and here; treat
+        // "resource_already_exists_exception" as success.
+        match self.request("PUT", idx, Some(body), false) {
+            Ok(_) => Ok(()),
+            Err(IcmError::Database(msg)) if msg.contains("resource_already_exists_exception") => {
+                Ok(())
+            }
+            Err(e) => Err(e),
+        }
+    }
+
+    pub(crate) fn init_indices(&self, dims: usize) -> IcmResult<()> {
+        if !(64..=4096).contains(&dims) {
+            return Err(IcmError::Config(format!(
+                "embedding_dims must be between 64 and 4096, got {dims}"
+            )));
+        }
+        self.create_index(
+            IDX_MEMORIES,
+            json!({
+                "settings": { "index": { "knn": true } },
+                "mappings": { "properties": {
+                    "created_at": {"type": "date"},
+                    "updated_at": {"type": "date"},
+                    "last_accessed": {"type": "date"},
+                    "access_count": {"type": "integer"},
+                    "weight": {"type": "float"},
+                    "topic": {"type": "text", "fields": {"keyword": {"type": "keyword", "ignore_above": 1024}}},
+                    "summary": {"type": "text"},
+                    "raw_excerpt": {"type": "text"},
+                    "keywords": {"type": "keyword"},
+                    "importance": {"type": "keyword"},
+                    "source_type": {"type": "keyword"},
+                    "source_data": {"type": "text", "index": false},
+                    "related_ids": {"type": "keyword"},
+                    "summary_hash": {"type": "keyword"},
+                    "embedding": {
+                        "type": "knn_vector",
+                        "dimension": dims,
+                        "method": {"name": "hnsw", "space_type": "cosinesimil", "engine": "lucene"}
+                    }
+                }}
+            }),
+        )?;
+        self.create_index(IDX_METADATA, json!({"mappings": {"properties": {"value": {"type": "double"}, "text_value": {"type": "keyword"}}}}))?;
+        self.create_index(
+            IDX_HOOKS,
+            json!({"mappings": {"properties": {
+                "id": {"type": "long"},
+                "ts": {"type": "date"},
+                "event": {"type": "keyword"},
+                "project": {"type": "keyword"},
+                "session_id": {"type": "keyword"},
+                "tool_name": {"type": "keyword"},
+                "duration_ms": {"type": "long"},
+                "exit_code": {"type": "integer"},
+                "payload_size": {"type": "long"},
+                "note": {"type": "text"}
+            }}}),
+        )?;
+        self.create_index(
+            IDX_PENDING,
+            json!({"mappings": {"properties": {
+                "project": {"type": "keyword"},
+                "tool_name": {"type": "keyword"},
+                "raw_output": {"type": "text", "index": false},
+                "captured_at": {"type": "date"}
+            }}}),
+        )?;
+        self.create_index(
+            IDX_CODE_AREAS,
+            json!({"mappings": {"properties": {
+                "project": {"type": "keyword"},
+                "file_path": {"type": "keyword"},
+                "description": {"type": "text"},
+                "session_id": {"type": "keyword"},
+                "tool_name": {"type": "keyword"},
+                "touch_count": {"type": "long"},
+                "first_touched_at": {"type": "date"},
+                "last_touched_at": {"type": "date"}
+            }}}),
+        )?;
+        Ok(())
+    }
+
+    // metadata kv helpers
+
+    pub(crate) fn get_metadata_int(&self, key: &str) -> IcmResult<Option<i64>> {
+        let path = format!("{IDX_METADATA}/_doc/{key}");
+        match self.get_json(&path)? {
+            Some(v) => Ok(v
+                .get("_source")
+                .and_then(|s| s.get("value"))
+                .and_then(|n| n.as_f64())
+                .map(|f| f as i64)),
+            None => Ok(None),
+        }
+    }
+
+    pub(crate) fn set_metadata_int(&self, key: &str, value: i64) -> IcmResult<()> {
+        let path = format!("{IDX_METADATA}/_doc/{key}?refresh=true");
+        self.request("PUT", &path, Some(json!({"value": value})), false)?;
+        Ok(())
+    }
+
+    pub(crate) fn check_dims(&self, memory: &Memory) -> IcmResult<()> {
+        if let Some(emb) = memory.embedding.as_ref() {
+            if emb.len() != self.embedding_dims {
+                return Err(IcmError::InvalidInput(format!(
+                    "embedding has {} dimensions, but this store uses {}",
+                    emb.len(),
+                    self.embedding_dims
+                )));
+            }
+        }
+        Ok(())
+    }
+}
diff --git a/crates/icm-store/src/opensearch/facts.rs b/crates/icm-store/src/opensearch/facts.rs
new file mode 100644
index 00000000..ac636535
--- /dev/null
+++ b/crates/icm-store/src/opensearch/facts.rs
@@ -0,0 +1,32 @@
+//! OpenSearch backend -- split out of the former monolithic opensearch.rs.
+//!
+//! Unsupported on this backend (issue #301) -- see mod.rs.
+
+use super::*;
+
+impl FactsStore for OpenSearchStore {
+    fn set_fact(
+        &self,
+        _entity: &str,
+        _key: &str,
+        _value: &str,
+        _source: &str,
+    ) -> IcmResult<String> {
+        unsupported("facts.set_fact")
+    }
+    fn get_fact(&self, _entity: &str, _key: &str) -> IcmResult<Option<Fact>> {
+        unsupported("facts.get_fact")
+    }
+    fn list_facts(&self, _entity: &str, _key_prefix: Option<&str>) -> IcmResult<Vec<Fact>> {
+        unsupported("facts.list_facts")
+    }
+    fn history(&self, _entity: &str, _key: &str) -> IcmResult<Vec<Fact>> {
+        unsupported("facts.history")
+    }
+    fn forget_fact(&self, _entity: &str, _key: &str) -> IcmResult<usize> {
+        unsupported("facts.forget_fact")
+    }
+    fn facts_stats(&self) -> IcmResult<FactsStats> {
+        unsupported("facts.facts_stats")
+    }
+}
diff --git a/crates/icm-store/src/opensearch/feedback.rs b/crates/icm-store/src/opensearch/feedback.rs
new file mode 100644
index 00000000..0583e963
--- /dev/null
+++ b/crates/icm-store/src/opensearch/feedback.rs
@@ -0,0 +1,32 @@
+//! OpenSearch backend -- split out of the former monolithic opensearch.rs.
+//!
+//! Unsupported on this backend (issue #301) -- see mod.rs.
+
+use super::*;
+
+impl FeedbackStore for OpenSearchStore {
+    fn store_feedback(&self, _feedback: Feedback) -> IcmResult<String> {
+        unsupported("feedback.store_feedback")
+    }
+    fn search_feedback(
+        &self,
+        _query: &str,
+        _query_embedding: Option<&[f32]>,
+        _topic: Option<&str>,
+        _limit: usize,
+    ) -> IcmResult<Vec<Feedback>> {
+        unsupported("feedback.search_feedback")
+    }
+    fn list_feedback(&self, _topic: Option<&str>, _limit: usize) -> IcmResult<Vec<Feedback>> {
+        unsupported("feedback.list_feedback")
+    }
+    fn increment_applied(&self, _id: &str) -> IcmResult<()> {
+        unsupported("feedback.increment_applied")
+    }
+    fn delete_feedback(&self, _id: &str) -> IcmResult<()> {
+        unsupported("feedback.delete_feedback")
+    }
+    fn feedback_stats(&self) -> IcmResult<FeedbackStats> {
+        unsupported("feedback.feedback_stats")
+    }
+}
diff --git a/crates/icm-store/src/opensearch/hooks.rs b/crates/icm-store/src/opensearch/hooks.rs
new file mode 100644
index 00000000..be98f55a
--- /dev/null
+++ b/crates/icm-store/src/opensearch/hooks.rs
@@ -0,0 +1,366 @@
+//! OpenSearch backend -- split out of the former monolithic opensearch.rs.
+//!
+//! Hook telemetry, the extraction queue, and code areas.
+
+use super::*;
+
+impl OpenSearchStore {
+    pub fn increment_hook_counter(&self) -> IcmResult<usize> {
+        let resp = self.post(
+            &format!("{IDX_METADATA}/_update/hook_counter?_source=true"),
+            json!({
+                "scripted_upsert": true,
+                "upsert": {},
+                "script": {
+                    "lang": "painless",
+                    "source": "ctx._source.value = (ctx._source.value == null ? 1 : ctx._source.value + 1);"
+                }
+            }),
+        )?;
+        Ok(resp
+            .get("get")
+            .and_then(|g| g.get("_source"))
+            .and_then(|s| s.get("value"))
+            .and_then(|v| v.as_f64())
+            .unwrap_or(0.0) as usize)
+    }
+
+    pub fn reset_hook_counter(&self) -> IcmResult<()> {
+        self.set_metadata_int("hook_counter", 0)
+    }
+
+    pub fn enqueue_pending_extraction(
+        &self,
+        project: &str,
+        tool_name: &str,
+        raw_output: &str,
+    ) -> IcmResult<String> {
+        let id = ulid::Ulid::new().to_string();
+        self.request(
+            "PUT",
+            &format!("{IDX_PENDING}/_doc/{id}?{}", self.refresh_param()),
+            Some(json!({
+                "project": project,
+                "tool_name": tool_name,
+                "raw_output": raw_output,
+                "captured_at": Utc::now().to_rfc3339()
+            })),
+            false,
+        )?;
+        Ok(id)
+    }
+
+    pub fn list_pending_extractions(&self, limit: usize) -> IcmResult<Vec<PendingRow>> {
+        let resp = self.post(
+            &format!("{IDX_PENDING}/_search"),
+            json!({"size": limit, "query": {"match_all": {}}, "sort": [{"captured_at": "asc"}]}),
+        )?;
+        let rows = resp
+            .get("hits")
+            .and_then(|h| h.get("hits"))
+            .and_then(|h| h.as_array())
+            .map(|hits| {
+                hits.iter()
+                    .filter_map(|h| {
+                        let id = h.get("_id")?.as_str()?.to_string();
+                        let s = h.get("_source")?;
+                        Some((
+                            id,
+                            s.get("project")?.as_str()?.to_string(),
+                            s.get("tool_name")?.as_str()?.to_string(),
+                            s.get("raw_output")?.as_str()?.to_string(),
+                            s.get("captured_at")?.as_str()?.to_string(),
+                        ))
+                    })
+                    .collect()
+            })
+            .unwrap_or_default();
+        Ok(rows)
+    }
+
+    pub fn delete_pending_extractions(&self, ids: &[String]) -> IcmResult<usize> {
+        if ids.is_empty() {
+            return Ok(0);
+        }
+        let resp = self.post(
+            &format!(
+                "{IDX_PENDING}/_delete_by_query?{}&conflicts=proceed",
+                self.refresh_param()
+            ),
+            json!({"query": {"ids": {"values": ids}}}),
+        )?;
+        Ok(resp.get("deleted").and_then(|v| v.as_u64()).unwrap_or(0) as usize)
+    }
+
+    pub fn pending_extraction_count(&self) -> IcmResult<usize> {
+        let resp = self.post(&format!("{IDX_PENDING}/_count"), json!({}))?;
+        Ok(resp.get("count").and_then(|v| v.as_u64()).unwrap_or(0) as usize)
+    }
+
+    pub fn upsert_code_area(
+        &self,
+        project: &str,
+        file_path: &str,
+        description: Option<&str>,
+        session_id: Option<&str>,
+        tool_name: Option<&str>,
+    ) -> IcmResult<()> {
+        if self.readonly {
+            return Err(IcmError::ReadOnly("upsert_code_area".into()));
+        }
+        let ts = Utc::now();
+        let now = ts.to_rfc3339();
+        let id = ts.timestamp_millis();
+        // Deterministic id makes the same (project, file_path) a single row.
+        let key = B64.encode(format!("{project}\0{file_path}"));
+        self.request(
+            "POST",
+            &format!("{IDX_CODE_AREAS}/_update/{key}?{}", self.refresh_param()),
+            Some(json!({
+                "scripted_upsert": true,
+                "upsert": {
+                    "id": id,
+                    "project": project,
+                    "file_path": file_path,
+                    "description": description,
+                    "session_id": session_id,
+                    "tool_name": tool_name,
+                    "touch_count": 1,
+                    "first_touched_at": now,
+                    "last_touched_at": now
+                },
+                "script": {
+                    "lang": "painless",
+                    "source": "ctx._source.touch_count = (ctx._source.touch_count == null ? 1 : ctx._source.touch_count + 1); ctx._source.last_touched_at = params.now; if (params.description != null) ctx._source.description = params.description; if (params.session_id != null) ctx._source.session_id = params.session_id; if (params.tool_name != null) ctx._source.tool_name = params.tool_name;",
+                    "params": {"now": now, "description": description, "session_id": session_id, "tool_name": tool_name}
+                }
+            })),
+            false,
+        )?;
+        Ok(())
+    }
+
+    pub fn list_code_areas(
+        &self,
+        project: Option<&str>,
+        in_file: Option<&str>,
+        since: Option<DateTime<Utc>>,
+        limit: usize,
+    ) -> IcmResult<Vec<CodeArea>> {
+        let mut filters: Vec<Value> = Vec::new();
+        if let Some(p) = project {
+            filters.push(json!({"term": {"project": p}}));
+        }
+        if let Some(f) = in_file {
+            filters.push(json!({"wildcard": {"file_path": {"value": format!("*{f}*")}}}));
+        }
+        if let Some(s) = since {
+            filters.push(json!({"range": {"last_touched_at": {"gte": s.to_rfc3339()}}}));
+        }
+        let query = if filters.is_empty() {
+            json!({"match_all": {}})
+        } else {
+            json!({"bool": {"filter": filters}})
+        };
+        let resp = self.post(
+            &format!("{IDX_CODE_AREAS}/_search"),
+            json!({"size": limit, "query": query, "sort": [{"last_touched_at": "desc"}]}),
+        )?;
+        let rows = resp
+            .get("hits")
+            .and_then(|h| h.get("hits"))
+            .and_then(|h| h.as_array())
+            .map(|hits| {
+                hits.iter()
+                    .filter_map(|h| {
+                        let s = h.get("_source")?;
+                        Some(CodeArea {
+                            id: s.get("id").and_then(|v| v.as_i64()).unwrap_or(0),
+                            project: s.get("project")?.as_str()?.to_string(),
+                            file_path: s.get("file_path")?.as_str()?.to_string(),
+                            description: s
+                                .get("description")
+                                .and_then(|v| v.as_str())
+                                .map(String::from),
+                            session_id: s
+                                .get("session_id")
+                                .and_then(|v| v.as_str())
+                                .map(String::from),
+                            tool_name: s
+                                .get("tool_name")
+                                .and_then(|v| v.as_str())
+                                .map(String::from),
+                            touch_count: s.get("touch_count").and_then(|v| v.as_i64()).unwrap_or(1),
+                            first_touched_at: s
+                                .get("first_touched_at")
+                                .and_then(|v| v.as_str())
+                                .and_then(|x| DateTime::parse_from_rfc3339(x).ok())
+                                .map(|d| d.with_timezone(&Utc))
+                                .unwrap_or_else(Utc::now),
+                            last_touched_at: s
+                                .get("last_touched_at")
+                                .and_then(|v| v.as_str())
+                                .and_then(|x| DateTime::parse_from_rfc3339(x).ok())
+                                .map(|d| d.with_timezone(&Utc))
+                                .unwrap_or_else(Utc::now),
+                        })
+                    })
+                    .collect()
+            })
+            .unwrap_or_default();
+        Ok(rows)
+    }
+
+    pub fn code_area_count(&self) -> IcmResult<usize> {
+        let resp = self.post(&format!("{IDX_CODE_AREAS}/_count"), json!({}))?;
+        Ok(resp.get("count").and_then(|v| v.as_u64()).unwrap_or(0) as usize)
+    }
+
+    pub fn record_hook_event(&self, ev: &HookEventInsert) -> IcmResult<i64> {
+        let now = Utc::now();
+        let id = now.timestamp_millis();
+        let doc_id = ulid::Ulid::new().to_string();
+        self.request(
+            "PUT",
+            &format!("{IDX_HOOKS}/_doc/{doc_id}"),
+            Some(json!({
+                "id": id,
+                "ts": now.to_rfc3339(),
+                "event": ev.event,
+                "project": ev.project,
+                "session_id": ev.session_id,
+                "tool_name": ev.tool_name,
+                "duration_ms": ev.duration_ms,
+                "exit_code": ev.exit_code,
+                "payload_size": ev.payload_size,
+                "note": ev.note
+            })),
+            false,
+        )?;
+        Ok(id)
+    }
+
+    pub fn hook_events_recent(
+        &self,
+        limit: usize,
+        event_filter: Option<&str>,
+    ) -> IcmResult<Vec<HookEvent>> {
+        let query = match event_filter {
+            Some(e) => json!({"term": {"event": e}}),
+            None => json!({"match_all": {}}),
+        };
+        let resp = self.post(
+            &format!("{IDX_HOOKS}/_search"),
+            json!({"size": limit, "query": query, "sort": [{"ts": "desc"}]}),
+        )?;
+        let rows = resp
+            .get("hits")
+            .and_then(|h| h.get("hits"))
+            .and_then(|h| h.as_array())
+            .map(|hits| {
+                hits.iter()
+                    .filter_map(|h| {
+                        let s = h.get("_source")?;
+                        Some(HookEvent {
+                            id: s.get("id").and_then(|v| v.as_i64()).unwrap_or(0),
+                            ts: parse_dt(s.get("ts").and_then(|v| v.as_str()).unwrap_or("")),
+                            event: s
+                                .get("event")
+                                .and_then(|v| v.as_str())
+                                .unwrap_or("")
+                                .to_string(),
+                            project: s.get("project").and_then(|v| v.as_str()).map(String::from),
+                            session_id: s
+                                .get("session_id")
+                                .and_then(|v| v.as_str())
+                                .map(String::from),
+                            tool_name: s
+                                .get("tool_name")
+                                .and_then(|v| v.as_str())
+                                .map(String::from),
+                            duration_ms: s.get("duration_ms").and_then(|v| v.as_i64()),
+                            exit_code: s.get("exit_code").and_then(|v| v.as_i64()).unwrap_or(0)
+                                as i32,
+                            payload_size: s.get("payload_size").and_then(|v| v.as_i64()),
+                            note: s.get("note").and_then(|v| v.as_str()).map(String::from),
+                        })
+                    })
+                    .collect()
+            })
+            .unwrap_or_default();
+        Ok(rows)
+    }
+
+    pub fn hook_stats(&self, since_rfc3339: &str) -> IcmResult<Vec<HookStatsRow>> {
+        let resp = self.post(
+            &format!("{IDX_HOOKS}/_search"),
+            json!({
+                "size": 0,
+                "query": {"range": {"ts": {"gte": since_rfc3339}}},
+                "aggs": {"events": {
+                    "terms": {"field": "event", "size": 1000},
+                    "aggs": {
+                        "errs": {"filter": {"bool": {"must_not": [{"term": {"exit_code": 0}}]}}},
+                        "avg_dur": {"avg": {"field": "duration_ms"}},
+                        "pct": {"percentiles": {"field": "duration_ms", "percents": [50, 99]}}
+                    }
+                }}
+            }),
+        )?;
+        let buckets = resp
+            .get("aggregations")
+            .and_then(|a| a.get("events"))
+            .and_then(|e| e.get("buckets"))
+            .and_then(|b| b.as_array())
+            .cloned()
+            .unwrap_or_default();
+        let mut out = Vec::new();
+        for b in &buckets {
+            let pct = b.get("pct").and_then(|p| p.get("values"));
+            let p = |k: &str| {
+                pct.and_then(|v| v.get(k))
+                    .and_then(|v| v.as_f64())
+                    .filter(|f| f.is_finite())
+                    .unwrap_or(0.0) as i64
+            };
+            out.push(HookStatsRow {
+                event: b
+                    .get("key")
+                    .and_then(|v| v.as_str())
+                    .unwrap_or("")
+                    .to_string(),
+                count: b.get("doc_count").and_then(|v| v.as_i64()).unwrap_or(0),
+                error_count: b
+                    .get("errs")
+                    .and_then(|e| e.get("doc_count"))
+                    .and_then(|v| v.as_i64())
+                    .unwrap_or(0),
+                avg_duration_ms: b
+                    .get("avg_dur")
+                    .and_then(|a| a.get("value"))
+                    .and_then(|v| v.as_f64())
+                    .unwrap_or(0.0),
+                p50_duration_ms: p("50.0"),
+                p99_duration_ms: p("99.0"),
+            });
+        }
+        out.sort_by(|a, b| a.event.cmp(&b.event));
+        Ok(out)
+    }
+
+    pub fn prune_hook_events(&self, cutoff_rfc3339: &str) -> IcmResult<usize> {
+        let resp = self.post(
+            &format!(
+                "{IDX_HOOKS}/_delete_by_query?{}&conflicts=proceed",
+                self.refresh_param()
+            ),
+            json!({"query": {"range": {"ts": {"lt": cutoff_rfc3339}}}}),
+        )?;
+        Ok(resp.get("deleted").and_then(|v| v.as_u64()).unwrap_or(0) as usize)
+    }
+
+    pub fn hook_event_count(&self) -> IcmResult<usize> {
+        let resp = self.post(&format!("{IDX_HOOKS}/_count"), json!({}))?;
+        Ok(resp.get("count").and_then(|v| v.as_u64()).unwrap_or(0) as usize)
+    }
+}
diff --git a/crates/icm-store/src/opensearch/maintenance.rs b/crates/icm-store/src/opensearch/maintenance.rs
new file mode 100644
index 00000000..75ecc79e
--- /dev/null
+++ b/crates/icm-store/src/opensearch/maintenance.rs
@@ -0,0 +1,56 @@
+//! OpenSearch backend -- split out of the former monolithic opensearch.rs.
+//!
+//! Decay/auto-consolidate maintenance methods.
+
+use super::*;
+
+// Inherent methods used by the cli/mcp store/recall/hook path
+
+impl OpenSearchStore {
+    pub fn maybe_auto_decay(&self) -> IcmResult<()> {
+        if self.readonly {
+            return Ok(());
+        }
+        // Atomic-ish claim via a scripted upsert on a metadata doc: only the
+        // caller that flips `changed` to true runs the decay.
+        let now_ms = Utc::now().timestamp_millis();
+        let resp = self.post(
+            &format!("{IDX_METADATA}/_update/last_decay_at?{}&_source=true", self.refresh_param()),
+            json!({
+                "scripted_upsert": true,
+                "upsert": {},
+                "script": {
+                    "lang": "painless",
+                    "source": "if (ctx._source.value == null || params.now - ctx._source.value >= 86400000L) { ctx._source.value = params.now; ctx._source.changed = true; } else { ctx._source.changed = false; }",
+                    "params": {"now": now_ms}
+                }
+            }),
+        )?;
+        let changed = resp
+            .get("get")
+            .and_then(|g| g.get("_source"))
+            .and_then(|s| s.get("changed"))
+            .and_then(|c| c.as_bool())
+            .unwrap_or(false);
+        if changed {
+            self.apply_decay(0.95)?;
+        }
+        Ok(())
+    }
+
+    /// Auto-consolidation is not yet implemented on this backend; it is a
+    /// no-op (returns `false`) so the normal store path keeps working.
+    pub fn auto_consolidate(&self, _topic: &str, _threshold: usize) -> IcmResult<bool> {
+        Ok(false)
+    }
+
+    /// See [`Self::auto_consolidate`].
+    pub fn auto_consolidate_with_embedder(
+        &self,
+        _topic: &str,
+        _threshold: usize,
+        _embedder: Option<&dyn Embedder>,
+    ) -> IcmResult<bool> {
+        Ok(false)
+    }
+}
diff --git a/crates/icm-store/src/opensearch/memoir.rs b/crates/icm-store/src/opensearch/memoir.rs
new file mode 100644
index 00000000..809ca5c5
--- /dev/null
+++ b/crates/icm-store/src/opensearch/memoir.rs
@@ -0,0 +1,106 @@
+//! OpenSearch backend -- split out of the former monolithic opensearch.rs.
+//!
+//! Unsupported on this backend (issue #301) -- see mod.rs.
+
+use super::*;
+
+impl MemoirStore for OpenSearchStore {
+    fn create_memoir(&self, _memoir: Memoir) -> IcmResult<String> {
+        unsupported("memoir.create_memoir")
+    }
+    fn get_memoir(&self, _id: &str) -> IcmResult<Option<Memoir>> {
+        unsupported("memoir.get_memoir")
+    }
+    fn get_memoir_by_name(&self, _name: &str) -> IcmResult<Option<Memoir>> {
+        unsupported("memoir.get_memoir_by_name")
+    }
+    fn update_memoir(&self, _memoir: &Memoir) -> IcmResult<()> {
+        unsupported("memoir.update_memoir")
+    }
+    fn delete_memoir(&self, _id: &str) -> IcmResult<()> {
+        unsupported("memoir.delete_memoir")
+    }
+    fn list_memoirs(&self) -> IcmResult<Vec<Memoir>> {
+        unsupported("memoir.list_memoirs")
+    }
+    fn add_concept(&self, _concept: Concept) -> IcmResult<String> {
+        unsupported("memoir.add_concept")
+    }
+    fn get_concept(&self, _id: &str) -> IcmResult<Option<Concept>> {
+        unsupported("memoir.get_concept")
+    }
+    fn get_concept_by_name(&self, _memoir_id: &str, _name: &str) -> IcmResult<Option<Concept>> {
+        unsupported("memoir.get_concept_by_name")
+    }
+    fn update_concept(&self, _concept: &Concept) -> IcmResult<()> {
+        unsupported("memoir.update_concept")
+    }
+    fn delete_concept(&self, _id: &str) -> IcmResult<()> {
+        unsupported("memoir.delete_concept")
+    }
+    fn list_concepts(&self, _memoir_id: &str) -> IcmResult<Vec<Concept>> {
+        unsupported("memoir.list_concepts")
+    }
+    fn search_concepts_fts(
+        &self,
+        _memoir_id: &str,
+        _query: &str,
+        _limit: usize,
+    ) -> IcmResult<Vec<Concept>> {
+        unsupported("memoir.search_concepts_fts")
+    }
+    fn search_concepts_by_label(
+        &self,
+        _memoir_id: &str,
+        _label: &Label,
+        _limit: usize,
+    ) -> IcmResult<Vec<Concept>> {
+        unsupported("memoir.search_concepts_by_label")
+    }
+    fn search_all_concepts_fts(&self, _query: &str, _limit: usize) -> IcmResult<Vec<Concept>> {
+        unsupported("memoir.search_all_concepts_fts")
+    }
+    fn refine_concept(
+        &self,
+        _id: &str,
+        _new_definition: &str,
+        _new_source_ids: &[String],
+    ) -> IcmResult<()> {
+        unsupported("memoir.refine_concept")
+    }
+    fn add_link(&self, _link: ConceptLink) -> IcmResult<String> {
+        unsupported("memoir.add_link")
+    }
+    fn get_links_from(&self, _concept_id: &str) -> IcmResult<Vec<ConceptLink>> {
+        unsupported("memoir.get_links_from")
+    }
+    fn get_links_to(&self, _concept_id: &str) -> IcmResult<Vec<ConceptLink>> {
+        unsupported("memoir.get_links_to")
+    }
+    fn delete_link(&self, _id: &str) -> IcmResult<()> {
+        unsupported("memoir.delete_link")
+    }
+    fn get_neighbors(
+        &self,
+        _concept_id: &str,
+        _relation: Option<Relation>,
+    ) -> IcmResult<Vec<Concept>> {
+        unsupported("memoir.get_neighbors")
+    }
+    fn get_neighborhood(
+        &self,
+        _concept_id: &str,
+        _depth: usize,
+    ) -> IcmResult<(Vec<Concept>, Vec<ConceptLink>)> {
+        unsupported("memoir.get_neighborhood")
+    }
+    fn get_links_for_memoir(&self, _memoir_id: &str) -> IcmResult<Vec<ConceptLink>> {
+        unsupported("memoir.get_links_for_memoir")
+    }
+    fn memoir_stats(&self, _memoir_id: &str) -> IcmResult<MemoirStats> {
+        unsupported("memoir.memoir_stats")
+    }
+    fn batch_memoir_concept_counts(&self) -> IcmResult<HashMap<String, usize>> {
+        unsupported("memoir.batch_memoir_concept_counts")
+    }
+}
diff --git a/crates/icm-store/src/opensearch/memory.rs b/crates/icm-store/src/opensearch/memory.rs
new file mode 100644
index 00000000..e75a6bc1
--- /dev/null
+++ b/crates/icm-store/src/opensearch/memory.rs
@@ -0,0 +1,658 @@
+//! OpenSearch backend -- split out of the former monolithic opensearch.rs.
+
+use super::*;
+
+impl OpenSearchStore {
+    pub(crate) fn refresh_param(&self) -> &'static str {
+        // Force a refresh so writes are immediately visible to subsequent
+        // searches (dedup, counts, the multi-replica path). ICM writes are
+        // low-frequency curated memories, so the cost is acceptable.
+        "refresh=true"
+    }
+
+    pub(crate) fn store_inner(&self, memory: &Memory) -> IcmResult<String> {
+        let hash = summary_hash(&memory.topic, &memory.summary);
+        // Dedup: an existing memory with the same (topic, summary_hash)
+        // wins; merge importance (max) + keywords (union) + raw_excerpt
+        // (prefer new) and return the existing id.
+        //
+        // Audit finding: this used to ALSO filter on `topic.keyword` (an
+        // exact-byte-match `keyword` field, no normalizer) alongside
+        // `summary_hash` — but `summary_hash` already encodes the topic via
+        // Rust's Unicode-correct `to_lowercase()`, so storing topic="Kexa"
+        // then topic="kexa" with the same summary hashed identically but
+        // failed the exact `topic.keyword` filter, silently creating a
+        // second document instead of deduping (broader than the SQLite/
+        // Postgres accented-topic case — this fires on ANY case
+        // difference). `summary_hash` alone is sufficient, matching the
+        // SQLite/Postgres fix.
+        let existing = self.post(
+            &format!("{IDX_MEMORIES}/_search"),
+            json!({
+                "size": 1,
+                "query": {"bool": {"filter": [
+                    {"term": {"summary_hash": hash}}
+                ]}}
+            }),
+        )?;
+        if let Some(hit) = existing
+            .get("hits")
+            .and_then(|h| h.get("hits"))
+            .and_then(|h| h.as_array())
+            .and_then(|a| a.first())
+        {
+            let existing_id = hit
+                .get("_id")
+                .and_then(|v| v.as_str())
+                .unwrap_or("")
+                .to_string();
+            let src = hit.get("_source").cloned().unwrap_or(Value::Null);
+            let existing_importance: Importance = src
+                .get("importance")
+                .and_then(|v| v.as_str())
+                .unwrap_or("medium")
+                .parse()
+                .unwrap_or(Importance::Medium);
+            let merged_importance = max_importance(existing_importance, memory.importance);
+            let mut merged_keywords: Vec<String> = src
+                .get("keywords")
+                .and_then(|v| v.as_array())
+                .map(|a| {
+                    a.iter()
+                        .filter_map(|x| x.as_str().map(String::from))
+                        .collect()
+                })
+                .unwrap_or_default();
+            for kw in &memory.keywords {
+                if !merged_keywords.contains(kw) {
+                    merged_keywords.push(kw.clone());
+                }
+            }
+            let raw = memory.raw_excerpt.clone().or_else(|| {
+                src.get("raw_excerpt")
+                    .and_then(|v| v.as_str())
+                    .map(String::from)
+            });
+            self.request(
+                "POST",
+                &format!(
+                    "{IDX_MEMORIES}/_update/{existing_id}?{}",
+                    self.refresh_param()
+                ),
+                Some(json!({"doc": {
+                    "importance": merged_importance.to_string(),
+                    "keywords": merged_keywords,
+                    "raw_excerpt": raw,
+                    "updated_at": Utc::now().to_rfc3339(),
+                }})),
+                false,
+            )?;
+            return Ok(existing_id);
+        }
+
+        self.request(
+            "PUT",
+            &format!(
+                "{IDX_MEMORIES}/_doc/{}?{}",
+                url_encode_path_segment(&memory.id),
+                self.refresh_param()
+            ),
+            Some(Self::memory_to_source(memory)),
+            false,
+        )?;
+        Ok(memory.id.clone())
+    }
+}
+
+impl MemoryStore for OpenSearchStore {
+    fn store(&self, memory: Memory) -> IcmResult<String> {
+        if self.readonly {
+            return Err(IcmError::ReadOnly("store".into()));
+        }
+        let memory = validate_and_normalize(memory)?;
+        self.check_dims(&memory)?;
+        self.store_inner(&memory)
+    }
+
+    fn get(&self, id: &str) -> IcmResult<Option<Memory>> {
+        let path = format!("{IDX_MEMORIES}/_doc/{}", url_encode_path_segment(id));
+        match self.get_json(&path)? {
+            Some(v) => {
+                if v.get("found").and_then(|f| f.as_bool()).unwrap_or(false) {
+                    let src = v.get("_source").cloned().unwrap_or(Value::Null);
+                    Ok(Some(Self::source_to_memory(id, &src)))
+                } else {
+                    Ok(None)
+                }
+            }
+            None => Ok(None),
+        }
+    }
+
+    fn update(&self, memory: &Memory) -> IcmResult<()> {
+        if self.readonly {
+            return Err(IcmError::ReadOnly("update".into()));
+        }
+        self.check_dims(memory)?;
+        let mut doc = Self::memory_to_source(memory);
+        doc["updated_at"] = json!(Utc::now().to_rfc3339());
+        // Replace the document wholesale (index by id).
+        self.request(
+            "PUT",
+            &format!(
+                "{IDX_MEMORIES}/_doc/{}?{}",
+                url_encode_path_segment(&memory.id),
+                self.refresh_param()
+            ),
+            Some(doc),
+            false,
+        )?;
+        Ok(())
+    }
+
+    fn delete(&self, id: &str) -> IcmResult<()> {
+        if self.readonly {
+            return Err(IcmError::ReadOnly("delete".into()));
+        }
+        self.request(
+            "DELETE",
+            &format!(
+                "{IDX_MEMORIES}/_doc/{}?{}",
+                url_encode_path_segment(id),
+                self.refresh_param()
+            ),
+            None,
+            true,
+        )?;
+
+        // Manual-testing finding (same class as the SQLite/Postgres
+        // backends): a deleted memory otherwise stays as a dangling entry
+        // in every other memory's `related_ids` forever. `related_ids` is
+        // mapped as a `keyword` array field, so a term query finds every
+        // document that references it and a Painless script strips it out
+        // in place. Best-effort: a failure here doesn't roll back the
+        // delete above (OpenSearch has no cross-document transaction to
+        // roll back into) — surfacing an error would make a successful
+        // delete look like it failed, so log and move on.
+        if let Err(e) = self.post(
+            &format!(
+                "{IDX_MEMORIES}/_update_by_query?conflicts=proceed&{}",
+                self.refresh_param()
+            ),
+            json!({
+                "script": {
+                    "source": "ctx._source.related_ids.removeIf(x -> x == params.deleted_id)",
+                    "params": {"deleted_id": id}
+                },
+                "query": {"term": {"related_ids": id}}
+            }),
+        ) {
+            tracing::warn!(error = %e, id, "failed to clean up dangling related_ids after delete");
+        }
+
+        Ok(())
+    }
+
+    fn search_by_keywords(&self, keywords: &[&str], limit: usize) -> IcmResult<Vec<Memory>> {
+        if keywords.is_empty() {
+            return Ok(Vec::new());
+        }
+        // Audit finding: unlike Postgres/SQLite, `limit` was never clamped
+        // here — a caller-supplied limit above OpenSearch's own
+        // `index.max_result_window` (default 10,000) returns a hard 400
+        // error instead of gracefully truncating like the other backends.
+        let limit = limit.min(100);
+        let joined = keywords.join(" ");
+        let resp = self.post(
+            &format!("{IDX_MEMORIES}/_search"),
+            json!({
+                "size": limit,
+                "query": {"bool": {"should": [
+                    {"terms": {"keywords": keywords}},
+                    {"multi_match": {"query": joined, "fields": ["summary", "topic"]}}
+                ], "minimum_should_match": 1}}
+            }),
+        )?;
+        Ok(Self::hits_to_memories(&resp))
+    }
+
+    fn search_fts(&self, query: &str, limit: usize) -> IcmResult<Vec<Memory>> {
+        if query.trim().is_empty() {
+            return Ok(Vec::new());
+        }
+        let limit = limit.min(100);
+        let resp = self.post(
+            &format!("{IDX_MEMORIES}/_search"),
+            json!({
+                "size": limit,
+                "query": {"multi_match": {
+                    "query": query,
+                    "fields": ["summary^2", "topic", "keywords"]
+                }}
+            }),
+        )?;
+        Ok(Self::hits_to_memories(&resp))
+    }
+
+    fn search_by_embedding(
+        &self,
+        embedding: &[f32],
+        limit: usize,
+    ) -> IcmResult<Vec<(Memory, f32)>> {
+        let limit = limit.min(1000);
+        let resp = self.post(
+            &format!("{IDX_MEMORIES}/_search"),
+            json!({
+                "size": limit,
+                "query": {"knn": {"embedding": {"vector": embedding, "k": limit}}}
+            }),
+        )?;
+        Ok(Self::hits_to_scored(&resp))
+    }
+
+    fn search_hybrid(
+        &self,
+        query: &str,
+        embedding: &[f32],
+        limit: usize,
+    ) -> IcmResult<Vec<(Memory, f32)>> {
+        let limit = limit.min(1000);
+        let pool = limit * 4;
+
+        // FTS candidates (BM25).
+        let mut fts_scores: HashMap<String, f32> = HashMap::new();
+        let mut memories: HashMap<String, Memory> = HashMap::new();
+        if !query.trim().is_empty() {
+            let resp = self.post(
+                &format!("{IDX_MEMORIES}/_search"),
+                json!({
+                    "size": pool,
+                    "query": {"multi_match": {"query": query, "fields": ["summary^2", "topic", "keywords"]}}
+                }),
+            )?;
+            for (m, s) in Self::hits_to_scored(&resp) {
+                fts_scores.insert(m.id.clone(), s);
+                memories.insert(m.id.clone(), m);
+            }
+        }
+
+        // Vector candidates.
+        let mut vec_scores: HashMap<String, f32> = HashMap::new();
+        for (m, s) in self.search_by_embedding(embedding, pool)? {
+            vec_scores.insert(m.id.clone(), s);
+            memories.entry(m.id.clone()).or_insert(m);
+        }
+
+        // Min-max normalize each score family to [0, 1] before blending.
+        let norm = |scores: &HashMap<String, f32>| -> HashMap<String, f32> {
+            if scores.is_empty() {
+                return HashMap::new();
+            }
+            let (mut lo, mut hi) = (f32::MAX, f32::MIN);
+            for &v in scores.values() {
+                lo = lo.min(v);
+                hi = hi.max(v);
+            }
+            let span = (hi - lo).max(f32::EPSILON);
+            scores
+                .iter()
+                .map(|(k, v)| (k.clone(), (v - lo) / span))
+                .collect()
+        };
+        let fts_n = norm(&fts_scores);
+        let vec_n = norm(&vec_scores);
+
+        let mut scored: Vec<(String, f32)> = memories
+            .keys()
+            .map(|id| {
+                let f = fts_n.get(id).copied().unwrap_or(0.0);
+                let v = vec_n.get(id).copied().unwrap_or(0.0);
+                (id.clone(), 0.3 * f + 0.7 * v)
+            })
+            .collect();
+        scored.sort_by(|a, b| b.1.partial_cmp(&a.1).unwrap_or(std::cmp::Ordering::Equal));
+        scored.truncate(limit);
+
+        Ok(scored
+            .into_iter()
+            .filter_map(|(id, s)| memories.remove(&id).map(|m| (m, s)))
+            .collect())
+    }
+
+    fn update_access(&self, id: &str) -> IcmResult<()> {
+        if self.readonly {
+            return Ok(());
+        }
+        // Best-effort; a missing doc is not an error for recall bookkeeping.
+        let _ = self.request(
+            "POST",
+            &format!("{IDX_MEMORIES}/_update/{id}"),
+            Some(json!({
+                "script": {
+                    "lang": "painless",
+                    "source": "ctx._source.access_count = (ctx._source.access_count == null ? 1 : ctx._source.access_count + 1); ctx._source.last_accessed = params.now;",
+                    "params": {"now": Utc::now().to_rfc3339()}
+                }
+            })),
+            true,
+        )?;
+        Ok(())
+    }
+
+    fn batch_update_access(&self, ids: &[&str]) -> IcmResult<usize> {
+        if self.readonly || ids.is_empty() {
+            return Ok(0);
+        }
+        let resp = self.post(
+            &format!("{IDX_MEMORIES}/_update_by_query?{}&conflicts=proceed", self.refresh_param()),
+            json!({
+                "query": {"ids": {"values": ids}},
+                "script": {
+                    "lang": "painless",
+                    "source": "ctx._source.access_count = (ctx._source.access_count == null ? 1 : ctx._source.access_count + 1); ctx._source.last_accessed = params.now;",
+                    "params": {"now": Utc::now().to_rfc3339()}
+                }
+            }),
+        )?;
+        Ok(resp.get("updated").and_then(|v| v.as_u64()).unwrap_or(0) as usize)
+    }
+
+    fn apply_decay(&self, decay_factor: f32) -> IcmResult<usize> {
+        if self.readonly {
+            return Err(IcmError::ReadOnly("decay".into()));
+        }
+        let resp = self.post(
+            &format!("{IDX_MEMORIES}/_update_by_query?{}&conflicts=proceed", self.refresh_param()),
+            json!({
+                "query": {"bool": {"must_not": [{"term": {"importance": "critical"}}]}},
+                // Audit finding: for `low` importance with low access count,
+                // the raw multiplier goes negative once decay_factor < 0.5
+                // (still inside the CLI's own validated [0.0, 1.0) range) —
+                // same bug already fixed for SQLite/Postgres. Math.max is
+                // Painless's equivalent clamp.
+                "script": {
+                    "lang": "painless",
+                    "source": "double f = params.factor; String imp = ctx._source.importance; double mult = imp != null && imp.equals('high') ? 0.5 : (imp != null && imp.equals('low') ? 2.0 : 1.0); double ac = ctx._source.access_count == null ? 0 : ctx._source.access_count; if (ac > 5) ac = 5; double m = Math.max(0.0, 1.0 - (1.0 - f) * mult / (1.0 + ac * 0.1)); ctx._source.weight = ctx._source.weight * m;",
+                    "params": {"factor": decay_factor as f64}
+                }
+            }),
+        )?;
+        Ok(resp.get("updated").and_then(|v| v.as_u64()).unwrap_or(0) as usize)
+    }
+
+    fn prune(&self, weight_threshold: f32) -> IcmResult<usize> {
+        if self.readonly {
+            return Err(IcmError::ReadOnly("prune".into()));
+        }
+        let resp = self.post(
+            &format!(
+                "{IDX_MEMORIES}/_delete_by_query?{}&conflicts=proceed",
+                self.refresh_param()
+            ),
+            json!({
+                "query": {"bool": {
+                    "must": [{"range": {"weight": {"lt": weight_threshold as f64}}}],
+                    "must_not": [{"terms": {"importance": ["critical", "high"]}}]
+                }}
+            }),
+        )?;
+        Ok(resp.get("deleted").and_then(|v| v.as_u64()).unwrap_or(0) as usize)
+    }
+
+    fn get_by_topic(&self, topic: &str) -> IcmResult<Vec<Memory>> {
+        let resp = self.post(
+            &format!("{IDX_MEMORIES}/_search"),
+            json!({
+                "size": 500,
+                "query": {"term": {"topic.keyword": topic}},
+                "sort": [{"weight": "desc"}]
+            }),
+        )?;
+        Ok(Self::hits_to_memories(&resp))
+    }
+
+    fn list_all(&self) -> IcmResult<Vec<Memory>> {
+        let resp = self.post(
+            &format!("{IDX_MEMORIES}/_search"),
+            json!({"size": 10000, "query": {"match_all": {}}, "sort": [{"weight": "desc"}]}),
+        )?;
+        Ok(Self::hits_to_memories(&resp))
+    }
+
+    fn list_topics(&self) -> IcmResult<Vec<(String, usize)>> {
+        let resp = self.post(
+            &format!("{IDX_MEMORIES}/_search"),
+            json!({"size": 0, "aggs": {"topics": {"terms": {"field": "topic.keyword", "size": 10000}}}}),
+        )?;
+        let mut out = bucket_counts(&resp, "topics");
+        out.sort_by(|a, b| a.0.cmp(&b.0));
+        Ok(out)
+    }
+
+    fn consolidate_topic(&self, topic: &str, consolidated: Memory) -> IcmResult<()> {
+        if self.readonly {
+            return Err(IcmError::ReadOnly("consolidate".into()));
+        }
+        // Audit findings, both fixed together:
+        // 1. `critical` memories are never deleted — same contract
+        //    apply_decay/prune already honor, and the same fix already
+        //    applied to SQLite/Postgres consolidate_topic. This delete
+        //    query previously wiped critical memories in the topic too.
+        // 2. Still not atomic (no multi-document transaction in
+        //    OpenSearch), but reordered to insert-then-delete: if
+        //    `store_inner` fails (dimension mismatch, network blip,
+        //    cluster unavailable), the originals are left untouched
+        //    instead of being gone with no replacement ever written. The
+        //    failure mode is now "harmless duplication a retry fixes",
+        //    not data loss — the consolidated memory gets a fresh id, so
+        //    it can't collide with any original.
+        let consolidated = validate_and_normalize(consolidated)?;
+        self.check_dims(&consolidated)?;
+        // Manual-testing finding: captured before store_inner/delete below
+        // (the deleted rows are gone afterward), so any *other* memory's
+        // related_ids pointing at them can be cleaned up — same dangling-
+        // reference bug already fixed for the single-id `delete`.
+        let deleted_ids: Vec<String> = self
+            .get_by_topic(topic)?
+            .into_iter()
+            .filter(|m| m.importance != Importance::Critical)
+            .map(|m| m.id)
+            .collect();
+        // `store_inner` returns the id actually used — the caller's fresh
+        // id on a normal insert, or an existing row's id if this exact
+        // (topic, summary_hash) happened to already exist (dedup merge).
+        // Either way it now has the SAME topic as the memories being
+        // consolidated, so it must be excluded from the delete below or it
+        // would delete the very memory it just wrote/merged into.
+        let consolidated_id = self.store_inner(&consolidated)?;
+        self.post(
+            &format!(
+                "{IDX_MEMORIES}/_delete_by_query?{}&conflicts=proceed",
+                self.refresh_param()
+            ),
+            json!({"query": {"bool": {
+                "must": [{"term": {"topic.keyword": topic}}],
+                "must_not": [
+                    {"term": {"importance": "critical"}},
+                    {"ids": {"values": [consolidated_id]}}
+                ]
+            }}}),
+        )?;
+
+        if !deleted_ids.is_empty() {
+            if let Err(e) = self.post(
+                &format!(
+                    "{IDX_MEMORIES}/_update_by_query?conflicts=proceed&{}",
+                    self.refresh_param()
+                ),
+                json!({
+                    "script": {
+                        "source": "ctx._source.related_ids.removeIf(x -> params.deleted_ids.contains(x))",
+                        "params": {"deleted_ids": deleted_ids}
+                    },
+                    "query": {"terms": {"related_ids": deleted_ids}}
+                }),
+            ) {
+                tracing::warn!(topic, error = %e, "consolidate_topic: failed to clean up dangling related_ids");
+            }
+        }
+
+        Ok(())
+    }
+
+    fn count(&self) -> IcmResult<usize> {
+        let resp = self.post(&format!("{IDX_MEMORIES}/_count"), json!({}))?;
+        Ok(resp.get("count").and_then(|v| v.as_u64()).unwrap_or(0) as usize)
+    }
+
+    fn count_by_topic(&self, topic: &str) -> IcmResult<usize> {
+        let resp = self.post(
+            &format!("{IDX_MEMORIES}/_count"),
+            json!({"query": {"term": {"topic.keyword": topic}}}),
+        )?;
+        Ok(resp.get("count").and_then(|v| v.as_u64()).unwrap_or(0) as usize)
+    }
+
+    fn stats(&self) -> IcmResult<StoreStats> {
+        let resp = self.post(
+            &format!("{IDX_MEMORIES}/_search"),
+            json!({
+                "size": 0,
+                "track_total_hits": true,
+                "aggs": {
+                    "avg_w": {"avg": {"field": "weight"}},
+                    "topics": {"cardinality": {"field": "topic.keyword"}},
+                    "oldest": {"min": {"field": "created_at", "format": "date_time"}},
+                    "newest": {"max": {"field": "created_at", "format": "date_time"}}
+                }
+            }),
+        )?;
+        let total = resp
+            .get("hits")
+            .and_then(|h| h.get("total"))
+            .and_then(|t| t.get("value"))
+            .and_then(|v| v.as_u64())
+            .unwrap_or(0) as usize;
+        let aggs = resp.get("aggregations").cloned().unwrap_or(Value::Null);
+        let avg_weight = aggs
+            .get("avg_w")
+            .and_then(|a| a.get("value"))
+            .and_then(|v| v.as_f64())
+            .unwrap_or(0.0) as f32;
+        let total_topics = aggs
+            .get("topics")
+            .and_then(|a| a.get("value"))
+            .and_then(|v| v.as_u64())
+            .unwrap_or(0) as usize;
+        let parse_agg_date = |name: &str| -> Option<DateTime<Utc>> {
+            aggs.get(name)
+                .and_then(|a| a.get("value_as_string"))
+                .and_then(|v| v.as_str())
+                .map(parse_dt)
+        };
+        Ok(StoreStats {
+            total_memories: total,
+            total_topics,
+            avg_weight,
+            oldest_memory: parse_agg_date("oldest"),
+            newest_memory: parse_agg_date("newest"),
+        })
+    }
+
+    fn topic_health(&self, topic: &str) -> IcmResult<TopicHealth> {
+        let resp = self.post(
+            &format!("{IDX_MEMORIES}/_search"),
+            json!({
+                "size": 0,
+                "track_total_hits": true,
+                "query": {"term": {"topic.keyword": topic}},
+                "aggs": {
+                    "avg_w": {"avg": {"field": "weight"}},
+                    "avg_ac": {"avg": {"field": "access_count"}},
+                    "oldest": {"min": {"field": "created_at"}},
+                    "newest": {"max": {"field": "created_at"}},
+                    "last_acc": {"max": {"field": "last_accessed"}},
+                    "stale": {"filter": {"bool": {"must": [
+                        {"range": {"weight": {"lt": 0.5}}},
+                        {"range": {"last_accessed": {"lt": "now-14d"}}}
+                    ]}}}
+                }
+            }),
+        )?;
+        let entry_count = resp
+            .get("hits")
+            .and_then(|h| h.get("total"))
+            .and_then(|t| t.get("value"))
+            .and_then(|v| v.as_u64())
+            .unwrap_or(0) as usize;
+        if entry_count == 0 {
+            return Err(IcmError::NotFound(format!(
+                "no memories in topic '{topic}'"
+            )));
+        }
+        let aggs = resp.get("aggregations").cloned().unwrap_or(Value::Null);
+        let avg_weight = aggs
+            .get("avg_w")
+            .and_then(|a| a.get("value"))
+            .and_then(|v| v.as_f64())
+            .unwrap_or(0.0) as f32;
+        let avg_access_count = aggs
+            .get("avg_ac")
+            .and_then(|a| a.get("value"))
+            .and_then(|v| v.as_f64())
+            .unwrap_or(0.0) as f32;
+        let stale_count = aggs
+            .get("stale")
+            .and_then(|a| a.get("doc_count"))
+            .and_then(|v| v.as_u64())
+            .unwrap_or(0) as usize;
+        Ok(TopicHealth {
+            topic: topic.to_string(),
+            entry_count,
+            avg_weight,
+            avg_access_count,
+            oldest: agg_date(&aggs, "oldest"),
+            newest: agg_date(&aggs, "newest"),
+            last_accessed: agg_date(&aggs, "last_acc"),
+            stale_count,
+            needs_consolidation: entry_count > 5,
+        })
+    }
+}
+
+/// Read a `min`/`max` date aggregation into a `DateTime<Utc>`.
+///
+/// Prefers the ISO `value_as_string` OpenSearch returns and falls back to
+/// the epoch-millis `value`. Returns `None` when the bucket is empty.
+fn agg_date(aggs: &Value, name: &str) -> Option<DateTime<Utc>> {
+    let node = aggs.get(name)?;
+    if let Some(s) = node.get("value_as_string").and_then(|v| v.as_str()) {
+        if let Ok(dt) = DateTime::parse_from_rfc3339(s) {
+            return Some(dt.with_timezone(&Utc));
+        }
+    }
+    let ms = node.get("value").and_then(|v| v.as_f64())?;
+    if ms <= 0.0 {
+        return None;
+    }
+    Utc.timestamp_millis_opt(ms as i64).single()
+}
+
+/// Extract `(key, doc_count)` pairs from a terms aggregation.
+fn bucket_counts(resp: &Value, agg: &str) -> Vec<(String, usize)> {
+    resp.get("aggregations")
+        .and_then(|a| a.get(agg))
+        .and_then(|t| t.get("buckets"))
+        .and_then(|b| b.as_array())
+        .map(|buckets| {
+            buckets
+                .iter()
+                .filter_map(|b| {
+                    let key = b.get("key")?.as_str()?.to_string();
+                    let count = b.get("doc_count")?.as_u64()? as usize;
+                    Some((key, count))
+                })
+                .collect()
+        })
+        .unwrap_or_default()
+}
diff --git a/crates/icm-store/src/opensearch/mod.rs b/crates/icm-store/src/opensearch/mod.rs
new file mode 100644
index 00000000..3d7b4f34
--- /dev/null
+++ b/crates/icm-store/src/opensearch/mod.rs
@@ -0,0 +1,91 @@
+//! OpenSearch storage backend (issue #301, opt-in via `--features opensearch`).
+//!
+//! A search-native shared store: BM25 full-text and `knn_vector` HNSW
+//! vector search live in one engine, so horizontally-scaled ICM replicas
+//! share one memory store (a node-local SQLite file cannot be shared).
+//!
+//! Design notes:
+//!
+//! - **Blocking REST.** OpenSearch is an HTTP/JSON service, so this talks
+//!   to it with the blocking `ureq` client and `serde_json` bodies. The
+//!   store traits are synchronous, so — like the PostgreSQL backend —
+//!   there is no async runtime and no sync-over-async bridge.
+//! - **Vector search** uses a `knn_vector` field (HNSW, cosine space);
+//!   similarity is reported from the kNN `_score`.
+//! - **Full-text search** uses BM25 `match` queries; the hybrid path
+//!   blends normalized BM25 and vector scores 30/70 to match the SQLite
+//!   and PostgreSQL backends.
+//! - **Connection** from `ICM_OPENSEARCH_URL` (e.g. `http://localhost:9200`),
+//!   with optional basic auth from `ICM_OPENSEARCH_USER` /
+//!   `ICM_OPENSEARCH_PASSWORD`.
+//!
+//! Scope mirrors the PostgreSQL backend: the full [`MemoryStore`] surface
+//! plus the ancillary store/recall/hook tables (hook telemetry, the
+//! extraction queue, code areas, key/value metadata). The heavier
+//! subsystems (memoir graph, transcripts, structured facts, feedback,
+//! pattern mining) return [`IcmError::Unsupported`]; they stay fully
+//! available on the default SQLite backend.
+
+use std::collections::{HashMap, HashSet};
+use std::path::Path;
+use std::time::Duration;
+
+use base64::engine::general_purpose::STANDARD as B64;
+use base64::Engine;
+use chrono::{DateTime, TimeZone, Utc};
+use serde_json::{json, Value};
+
+use icm_core::{
+    Concept, ConceptLink, Embedder, Fact, FactsStats, FactsStore, Feedback, FeedbackStats,
+    FeedbackStore, IcmError, IcmResult, Importance, Label, Memoir, MemoirStats, MemoirStore,
+    Memory, MemorySource, MemoryStore, Message, PatternCluster, Relation, Role, Scope, Session,
+    StoreStats, TopicHealth, TranscriptHit, TranscriptStats, TranscriptStore,
+};
+
+// Shared public row types live in `crate::common` (issue #301) so every
+// backend can be compiled into one binary without colliding definitions.
+pub use crate::common::{CodeArea, HookEvent, HookEventInsert, HookStatsRow, PendingRow};
+
+// Index names
+
+const IDX_MEMORIES: &str = "icm_memories";
+const IDX_METADATA: &str = "icm_metadata";
+const IDX_HOOKS: &str = "icm_hook_events";
+const IDX_PENDING: &str = "icm_pending_extractions";
+const IDX_CODE_AREAS: &str = "icm_code_areas";
+
+// Store
+
+/// OpenSearch-backed store. Cheap to clone-free share via `&self`; every
+/// method is a blocking REST round-trip.
+pub struct OpenSearchStore {
+    agent: ureq::Agent,
+    base: String,
+    auth: Option<String>,
+    embedding_dims: usize,
+    readonly: bool,
+}
+
+// Subsystems not yet ported to this backend. They stay fully available on
+// the default SQLite backend; here they fail cleanly with `Unsupported`.
+
+fn unsupported<T>(op: &str) -> IcmResult<T> {
+    Err(IcmError::Unsupported(format!(
+        "{op} (use the default SQLite backend)"
+    )))
+}
+
+mod connection;
+mod facts;
+mod feedback;
+mod hooks;
+mod maintenance;
+mod memoir;
+mod memory;
+mod patterns;
+mod rows;
+#[cfg(test)]
+mod tests;
+mod transcript;
+
+pub(crate) use rows::*;
diff --git a/crates/icm-store/src/opensearch/patterns.rs b/crates/icm-store/src/opensearch/patterns.rs
new file mode 100644
index 00000000..9716ae88
--- /dev/null
+++ b/crates/icm-store/src/opensearch/patterns.rs
@@ -0,0 +1,111 @@
+//! OpenSearch backend -- split out of the former monolithic opensearch.rs.
+//!
+//! Neighbor expansion and pattern-mining helpers.
+
+use super::*;
+
+impl OpenSearchStore {
+    pub fn get_many(&self, ids: &[&str]) -> IcmResult<HashMap<String, Memory>> {
+        if ids.is_empty() {
+            return Ok(HashMap::new());
+        }
+        let resp = self.post(&format!("{IDX_MEMORIES}/_mget"), json!({"ids": ids}))?;
+        let mut out = HashMap::new();
+        if let Some(docs) = resp.get("docs").and_then(|d| d.as_array()) {
+            for d in docs {
+                if d.get("found").and_then(|f| f.as_bool()).unwrap_or(false) {
+                    if let (Some(id), Some(src)) =
+                        (d.get("_id").and_then(|v| v.as_str()), d.get("_source"))
+                    {
+                        out.insert(id.to_string(), Self::source_to_memory(id, src));
+                    }
+                }
+            }
+        }
+        Ok(out)
+    }
+
+    pub fn get_by_topic_prefix(&self, topic: &str) -> IcmResult<Vec<Memory>> {
+        let resp = self.post(
+            &format!("{IDX_MEMORIES}/_search"),
+            json!({
+                "size": 500,
+                "query": {"prefix": {"topic.keyword": topic}},
+                "sort": [{"weight": "desc"}]
+            }),
+        )?;
+        Ok(Self::hits_to_memories(&resp))
+    }
+
+    pub fn list_topics_with_prefix(&self, prefix: Option<&str>) -> IcmResult<Vec<(String, usize)>> {
+        let mut topics = self.list_topics()?;
+        if let Some(p) = prefix {
+            topics.retain(|(t, _)| t.starts_with(p));
+        }
+        Ok(topics)
+    }
+
+    /// Expand a result set with graph neighbours (related ids), applying a
+    /// hop discount. Pure logic over [`Self::get_many`]; identical to the
+    /// other backends.
+    pub fn expand_with_neighbors(
+        &self,
+        initial: &[(Memory, f32)],
+        max_neighbors: usize,
+        hop_discount: f32,
+        max_total: usize,
+    ) -> IcmResult<Vec<(Memory, f32)>> {
+        if max_neighbors == 0 || initial.is_empty() {
+            let mut out = initial.to_vec();
+            out.truncate(max_total);
+            return Ok(out);
+        }
+        let initial_ids: HashSet<String> = initial.iter().map(|(m, _)| m.id.clone()).collect();
+        let mut candidates: Vec<(String, f32)> = Vec::new();
+        let mut seen: HashSet<String> = HashSet::new();
+        for (m, score) in initial {
+            for rid in &m.related_ids {
+                if !initial_ids.contains(rid) && seen.insert(rid.clone()) {
+                    candidates.push((rid.clone(), *score * hop_discount));
+                    if candidates.len() >= max_neighbors {
+                        break;
+                    }
+                }
+            }
+            if candidates.len() >= max_neighbors {
+                break;
+            }
+        }
+
+        let neighbor_ids: Vec<&str> = candidates.iter().map(|(id, _)| id.as_str()).collect();
+        let fetched = self.get_many(&neighbor_ids)?;
+
+        let mut combined: Vec<(Memory, f32)> = initial.to_vec();
+        for (id, score) in candidates {
+            if let Some(m) = fetched.get(&id) {
+                combined.push((m.clone(), score));
+            }
+        }
+        combined.sort_by(|a, b| b.1.partial_cmp(&a.1).unwrap_or(std::cmp::Ordering::Equal));
+        combined.truncate(max_total);
+        Ok(combined)
+    }
+
+    /// Pattern mining is not implemented on this backend yet.
+    pub fn detect_patterns(
+        &self,
+        _topic: &str,
+        _min_cluster_size: usize,
+    ) -> IcmResult<Vec<PatternCluster>> {
+        Err(IcmError::Unsupported("detect_patterns".into()))
+    }
+
+    /// See [`Self::detect_patterns`].
+    pub fn extract_pattern_as_concept(
+        &self,
+        _cluster: &PatternCluster,
+        _memoir_id: &str,
+    ) -> IcmResult<String> {
+        Err(IcmError::Unsupported("extract_pattern_as_concept".into()))
+    }
+}
diff --git a/crates/icm-store/src/opensearch/rows.rs b/crates/icm-store/src/opensearch/rows.rs
new file mode 100644
index 00000000..7e9ab048
--- /dev/null
+++ b/crates/icm-store/src/opensearch/rows.rs
@@ -0,0 +1,212 @@
+//! OpenSearch backend -- split out of the former monolithic opensearch.rs.
+//!
+//! Row/parse helpers and doc<->Memory mapping shared by every trait-impl
+//! submodule here.
+
+use super::*;
+
+/// Percent-encode a value for safe use as a single path segment in a REST
+/// URL. Document ids are caller-controlled (`icm forget <id>` CLI, MCP
+/// `icm_forget`, etc.) with no format constraint enforced anywhere in the
+/// schema — without this, a crafted id containing `/`, `..`, `?`, or `#`
+/// could redirect which REST endpoint is actually hit instead of just
+/// addressing the intended document (audit finding).
+pub(crate) fn url_encode_path_segment(s: &str) -> String {
+    let mut out = String::with_capacity(s.len());
+    for b in s.bytes() {
+        match b {
+            b'A'..=b'Z' | b'a'..=b'z' | b'0'..=b'9' | b'-' | b'_' | b'.' | b'~' => {
+                out.push(b as char);
+            }
+            _ => out.push_str(&format!("%{b:02X}")),
+        }
+    }
+    out
+}
+
+// Pure helpers (self-contained, mirror the other backends)
+
+pub(crate) fn source_type(source: &MemorySource) -> &'static str {
+    match source {
+        MemorySource::ClaudeCode { .. } => "claude_code",
+        MemorySource::Conversation { .. } => "conversation",
+        MemorySource::Manual => "manual",
+    }
+}
+
+pub(crate) fn source_data(source: &MemorySource) -> Option<String> {
+    match source {
+        MemorySource::Manual => None,
+        other => serde_json::to_string(other).ok(),
+    }
+}
+
+pub(crate) fn parse_source(source_type_str: &str, source_data_str: Option<String>) -> MemorySource {
+    match source_type_str {
+        "manual" => MemorySource::Manual,
+        _ => source_data_str
+            .and_then(|d| serde_json::from_str(&d).ok())
+            .unwrap_or(MemorySource::Manual),
+    }
+}
+
+pub(crate) fn importance_rank(i: Importance) -> u8 {
+    match i {
+        Importance::Low => 0,
+        Importance::Medium => 1,
+        Importance::High => 2,
+        Importance::Critical => 3,
+    }
+}
+
+pub(crate) fn max_importance(a: Importance, b: Importance) -> Importance {
+    if importance_rank(a) >= importance_rank(b) {
+        a
+    } else {
+        b
+    }
+}
+
+/// SHA-256 over the normalized `(topic, summary)` pair, hex-encoded.
+/// Normalization: trim + lowercase + collapse whitespace, joined by `\0`.
+pub(crate) fn summary_hash(topic: &str, summary: &str) -> String {
+    use sha2::{Digest, Sha256};
+    let topic_n = topic.trim().to_lowercase();
+    let summary_n = summary
+        .split_whitespace()
+        .collect::<Vec<&str>>()
+        .join(" ")
+        .to_lowercase();
+    let mut h = Sha256::new();
+    h.update(topic_n.as_bytes());
+    h.update(b"\0");
+    h.update(summary_n.as_bytes());
+    format!("{:x}", h.finalize())
+}
+
+/// Validate and normalize a memory before storing (mirror of the other
+/// backends): non-empty topic/summary, generate an id if missing, and
+/// stamp timestamps.
+pub(crate) fn validate_and_normalize(mut memory: Memory) -> IcmResult<Memory> {
+    if memory.topic.trim().is_empty() {
+        return Err(IcmError::InvalidInput("topic cannot be empty".into()));
+    }
+    if memory.summary.trim().is_empty() {
+        return Err(IcmError::InvalidInput("summary cannot be empty".into()));
+    }
+    if memory.id.trim().is_empty() {
+        memory.id = ulid::Ulid::new().to_string();
+    }
+    memory.topic = memory.topic.trim().to_string();
+    Ok(memory)
+}
+
+pub(crate) fn parse_dt(s: &str) -> DateTime<Utc> {
+    DateTime::parse_from_rfc3339(s)
+        .map(|d| d.with_timezone(&Utc))
+        .unwrap_or_else(|_| Utc::now())
+}
+
+impl OpenSearchStore {
+    // (de)serialization
+
+    pub(crate) fn memory_to_source(memory: &Memory) -> Value {
+        let mut doc = json!({
+            "created_at": memory.created_at.to_rfc3339(),
+            "updated_at": memory.updated_at.to_rfc3339(),
+            "last_accessed": memory.last_accessed.to_rfc3339(),
+            "access_count": memory.access_count,
+            "weight": memory.weight,
+            "topic": memory.topic,
+            "summary": memory.summary,
+            "raw_excerpt": memory.raw_excerpt,
+            "keywords": memory.keywords,
+            "importance": memory.importance.to_string(),
+            "source_type": source_type(&memory.source),
+            "source_data": source_data(&memory.source),
+            "related_ids": memory.related_ids,
+            "summary_hash": summary_hash(&memory.topic, &memory.summary),
+        });
+        if let Some(emb) = memory.embedding.as_ref() {
+            doc["embedding"] = json!(emb);
+        }
+        doc
+    }
+
+    pub(crate) fn source_to_memory(id: &str, src: &Value) -> Memory {
+        let get_str = |k: &str| {
+            src.get(k)
+                .and_then(|v| v.as_str())
+                .unwrap_or("")
+                .to_string()
+        };
+        let opt_str = |k: &str| {
+            src.get(k)
+                .and_then(|v| v.as_str())
+                .map(|s| s.to_string())
+                .filter(|s| !s.is_empty())
+        };
+        let arr = |k: &str| {
+            src.get(k)
+                .and_then(|v| v.as_array())
+                .map(|a| {
+                    a.iter()
+                        .filter_map(|x| x.as_str().map(|s| s.to_string()))
+                        .collect::<Vec<String>>()
+                })
+                .unwrap_or_default()
+        };
+        let importance = get_str("importance").parse().unwrap_or(Importance::Medium);
+        let source = parse_source(&get_str("source_type"), opt_str("source_data"));
+        let embedding = src.get("embedding").and_then(|v| v.as_array()).map(|a| {
+            a.iter()
+                .filter_map(|x| x.as_f64().map(|f| f as f32))
+                .collect::<Vec<f32>>()
+        });
+        Memory {
+            id: id.to_string(),
+            created_at: parse_dt(&get_str("created_at")),
+            updated_at: parse_dt(&get_str("updated_at")),
+            last_accessed: parse_dt(&get_str("last_accessed")),
+            access_count: src
+                .get("access_count")
+                .and_then(|v| v.as_u64())
+                .unwrap_or(0) as u32,
+            weight: src.get("weight").and_then(|v| v.as_f64()).unwrap_or(1.0) as f32,
+            topic: get_str("topic"),
+            summary: get_str("summary"),
+            raw_excerpt: opt_str("raw_excerpt"),
+            keywords: arr("keywords"),
+            importance,
+            source,
+            related_ids: arr("related_ids"),
+            embedding,
+            scope: Scope::default(),
+        }
+    }
+
+    /// Map a `_search` response's hits to memories paired with `_score`.
+    pub(crate) fn hits_to_scored(resp: &Value) -> Vec<(Memory, f32)> {
+        resp.get("hits")
+            .and_then(|h| h.get("hits"))
+            .and_then(|h| h.as_array())
+            .map(|hits| {
+                hits.iter()
+                    .filter_map(|h| {
+                        let id = h.get("_id")?.as_str()?;
+                        let src = h.get("_source")?;
+                        let score = h.get("_score").and_then(|s| s.as_f64()).unwrap_or(0.0) as f32;
+                        Some((Self::source_to_memory(id, src), score))
+                    })
+                    .collect()
+            })
+            .unwrap_or_default()
+    }
+
+    pub(crate) fn hits_to_memories(resp: &Value) -> Vec<Memory> {
+        Self::hits_to_scored(resp)
+            .into_iter()
+            .map(|(m, _)| m)
+            .collect()
+    }
+}
diff --git a/crates/icm-store/src/opensearch/tests.rs b/crates/icm-store/src/opensearch/tests.rs
new file mode 100644
index 00000000..2d11539a
--- /dev/null
+++ b/crates/icm-store/src/opensearch/tests.rs
@@ -0,0 +1,42 @@
+//! Test suite for the OpenSearch backend (`opensearch::tests`).
+
+use super::*;
+
+/// Audit regression: a memory id containing reserved URL characters
+/// (e.g. `/`, `..`, `?`) was interpolated straight into the `_doc/{id}`
+/// REST path, letting an attacker-controlled id redirect the request to
+/// a different document/endpoint.
+#[test]
+fn test_url_encode_path_segment() {
+    assert_eq!(
+        url_encode_path_segment("abc-DEF_123.~"),
+        "abc-DEF_123.~",
+        "unreserved chars must pass through unchanged"
+    );
+    assert_eq!(url_encode_path_segment("a/b"), "a%2Fb");
+    assert_eq!(url_encode_path_segment("../secret"), "..%2Fsecret");
+    assert_eq!(url_encode_path_segment("id?x=1"), "id%3Fx%3D1");
+    assert_eq!(url_encode_path_segment("id#frag"), "id%23frag");
+    assert_eq!(url_encode_path_segment("a b"), "a%20b");
+}
+
+/// Audit regression: `apply_decay`'s Painless script computed a raw
+/// multiplier that goes negative for low-importance/low-access memories
+/// at factor<0.5 (still inside the CLI's own validated range). This
+/// mirrors the exact formula now wrapped in `Math.max(0.0, ...)`.
+#[test]
+fn test_apply_decay_formula_would_go_negative_without_clamp() {
+    let factor: f64 = 0.4;
+    let mult: f64 = 2.0; // low importance
+    let access: f64 = 0.0;
+    let raw = 1.0 - (1.0 - factor) * mult / (1.0 + access * 0.1);
+    assert!(
+        raw < 0.0,
+        "expected the pre-clamp formula to go negative, got {raw}"
+    );
+    assert_eq!(
+        raw.max(0.0),
+        0.0,
+        "Math.max(0.0, ...) must clamp this to 0.0"
+    );
+}
diff --git a/crates/icm-store/src/opensearch/transcript.rs b/crates/icm-store/src/opensearch/transcript.rs
new file mode 100644
index 00000000..0b442e19
--- /dev/null
+++ b/crates/icm-store/src/opensearch/transcript.rs
@@ -0,0 +1,65 @@
+//! OpenSearch backend -- split out of the former monolithic opensearch.rs.
+//!
+//! Unsupported on this backend (issue #301) -- see mod.rs.
+
+use super::*;
+
+impl TranscriptStore for OpenSearchStore {
+    fn create_session(
+        &self,
+        _agent: &str,
+        _project: Option<&str>,
+        _metadata: Option<&str>,
+    ) -> IcmResult<String> {
+        unsupported("transcript.create_session")
+    }
+    fn ensure_session(
+        &self,
+        _id: &str,
+        _agent: &str,
+        _project: Option<&str>,
+        _metadata: Option<&str>,
+    ) -> IcmResult<String> {
+        unsupported("transcript.ensure_session")
+    }
+    fn get_session(&self, _id: &str) -> IcmResult<Option<Session>> {
+        unsupported("transcript.get_session")
+    }
+    fn list_sessions(&self, _project: Option<&str>, _limit: usize) -> IcmResult<Vec<Session>> {
+        unsupported("transcript.list_sessions")
+    }
+    fn record_message(
+        &self,
+        _session_id: &str,
+        _role: Role,
+        _content: &str,
+        _tool_name: Option<&str>,
+        _tokens: Option<i64>,
+        _metadata: Option<&str>,
+    ) -> IcmResult<String> {
+        unsupported("transcript.record_message")
+    }
+    fn list_session_messages(
+        &self,
+        _session_id: &str,
+        _limit: usize,
+        _offset: usize,
+    ) -> IcmResult<Vec<Message>> {
+        unsupported("transcript.list_session_messages")
+    }
+    fn search_transcripts(
+        &self,
+        _query: &str,
+        _session_id: Option<&str>,
+        _project: Option<&str>,
+        _limit: usize,
+    ) -> IcmResult<Vec<TranscriptHit>> {
+        unsupported("transcript.search_transcripts")
+    }
+    fn forget_session(&self, _id: &str) -> IcmResult<()> {
+        unsupported("transcript.forget_session")
+    }
+    fn transcript_stats(&self) -> IcmResult<TranscriptStats> {
+        unsupported("transcript.transcript_stats")
+    }
+}
diff --git a/crates/icm-store/src/postgres.rs b/crates/icm-store/src/postgres.rs
deleted file mode 100644
index a937a1e0..00000000
--- a/crates/icm-store/src/postgres.rs
+++ /dev/null
@@ -1,1910 +0,0 @@
-//! PostgreSQL storage backend (issue #301, opt-in via `--features postgres`).
-//!
-//! A node-local SQLite file cannot be shared between several ICM
-//! processes or Kubernetes replicas. This backend runs the same memory
-//! model over a network-accessible PostgreSQL database so every instance
-//! reads and writes one shared store. PostgreSQL serialises concurrent
-//! writers, so N replicas can `icm store` into the same memory safely.
-//!
-//! Design notes:
-//!
-//! - **Blocking client.** The store traits are synchronous
-//!   (`fn store(&self, ...) -> IcmResult<...>`), so we use the blocking
-//!   `postgres` crate. No async runtime, no sync-over-async bridge — the
-//!   client maps one-to-one onto the trait surface.
-//! - **`pgvector` for embeddings.** Memory embeddings live in a
-//!   `vector(N)` column; KNN search uses the `<=>` cosine-distance
-//!   operator. Similarity is reported as `1 - distance` to match the
-//!   SQLite backend.
-//! - **PostgreSQL full-text search** replaces SQLite FTS5: a generated
-//!   `tsvector` column (config `simple`, no stemming, to mirror FTS5's
-//!   unicode61 tokenizer) with a GIN index, queried via
-//!   `websearch_to_tsquery` so arbitrary user input is operator-safe.
-//! - **Connection string** comes from `ICM_POSTGRES_URL` (or
-//!   `DATABASE_URL` as a fallback). The `&Path` arguments that the CLI
-//!   passes for the SQLite file are ignored.
-//!
-//! Scope of this first cut: the full [`MemoryStore`] surface (the core
-//! shared-memory use case behind #301) plus the ancillary tables used by
-//! the normal store/recall/hook path (hook telemetry, the extraction
-//! queue, code areas, the key/value metadata). The heavier subsystems
-//! (memoir graph, transcripts, structured facts, feedback, pattern
-//! mining) return [`IcmError::Unsupported`] on this backend for now;
-//! they remain fully available on the default SQLite backend.
-
-use std::collections::{HashMap, HashSet};
-use std::path::Path;
-use std::sync::{Mutex, MutexGuard};
-
-use chrono::{DateTime, Utc};
-use postgres::types::ToSql;
-use postgres::{Client, GenericClient, NoTls};
-
-use icm_core::{
-    Concept, ConceptLink, Embedder, Fact, FactsStats, FactsStore, Feedback, FeedbackStats,
-    FeedbackStore, IcmError, IcmResult, Importance, Label, Memoir, MemoirStats, MemoirStore,
-    Memory, MemorySource, MemoryStore, Message, PatternCluster, Relation, Role, Session,
-    StoreStats, TopicHealth, TranscriptHit, TranscriptStats, TranscriptStore,
-};
-
-// Shared public row types live in `crate::common` (issue #301) so every
-// backend can be compiled into one binary without colliding definitions.
-pub use crate::common::{CodeArea, HookEvent, HookEventInsert, HookStatsRow, PendingRow};
-
-// ---------------------------------------------------------------------------
-// Helpers (mirrored from the SQLite backend so behaviour matches)
-// ---------------------------------------------------------------------------
-
-fn pg_err(e: postgres::Error) -> IcmError {
-    IcmError::Database(e.to_string())
-}
-
-fn lock_err() -> IcmError {
-    IcmError::Database("postgres client mutex poisoned".into())
-}
-
-fn source_type(source: &MemorySource) -> &'static str {
-    match source {
-        MemorySource::ClaudeCode { .. } => "claude_code",
-        MemorySource::Conversation { .. } => "conversation",
-        MemorySource::Manual => "manual",
-    }
-}
-
-fn source_data(source: &MemorySource) -> Option<String> {
-    match source {
-        MemorySource::Manual => None,
-        other => serde_json::to_string(other).ok(),
-    }
-}
-
-fn parse_source(source_type_str: &str, source_data_str: Option<String>) -> MemorySource {
-    match source_type_str {
-        "manual" => MemorySource::Manual,
-        _ => source_data_str
-            .and_then(|d| serde_json::from_str(&d).ok())
-            .unwrap_or(MemorySource::Manual),
-    }
-}
-
-fn importance_rank(i: Importance) -> u8 {
-    match i {
-        Importance::Critical => 4,
-        Importance::High => 3,
-        Importance::Medium => 2,
-        Importance::Low => 1,
-    }
-}
-
-fn max_importance(a: Importance, b: Importance) -> Importance {
-    if importance_rank(a) >= importance_rank(b) {
-        a
-    } else {
-        b
-    }
-}
-
-/// SHA-256 over the normalized `(topic, summary)` pair, hex-encoded.
-/// Identical normalization to the SQLite backend so dedup hashes match.
-fn summary_hash(topic: &str, summary: &str) -> String {
-    use sha2::{Digest, Sha256};
-    let topic_n = topic.trim().to_lowercase();
-    let summary_n: String = summary
-        .split_whitespace()
-        .collect::<Vec<&str>>()
-        .join(" ")
-        .to_lowercase();
-    let mut h = Sha256::new();
-    h.update(topic_n.as_bytes());
-    h.update(b"\0");
-    h.update(summary_n.as_bytes());
-    format!("{:x}", h.finalize())
-}
-
-const MAX_SUMMARY_BYTES: usize = 64 * 1024;
-const MAX_TOPIC_BYTES: usize = 256;
-
-/// Escape `%`, `_`, and the escape character itself so a value can be
-/// safely wrapped in a LIKE/ILIKE pattern. Pair with `ESCAPE '\'` in the
-/// SQL. Mirrors the SQLite backend's `escape_like_wildcards`.
-fn escape_like_wildcards(s: &str) -> String {
-    s.replace('\\', "\\\\")
-        .replace('%', "\\%")
-        .replace('_', "\\_")
-}
-
-/// Validate and normalize a `Memory` before insertion. Mirrors the
-/// SQLite backend's `validate_and_normalize`.
-fn validate_and_normalize(mut memory: Memory) -> IcmResult<Memory> {
-    memory.topic = memory.topic.trim().to_string();
-
-    if memory.topic.is_empty() {
-        return Err(IcmError::InvalidInput("topic cannot be empty".into()));
-    }
-    if memory.summary.trim().is_empty() {
-        return Err(IcmError::InvalidInput("summary cannot be empty".into()));
-    }
-    if memory.topic.contains('\0') {
-        return Err(IcmError::InvalidInput(
-            "topic must not contain NUL bytes".into(),
-        ));
-    }
-    if memory.summary.contains('\0') {
-        return Err(IcmError::InvalidInput(
-            "summary must not contain NUL bytes".into(),
-        ));
-    }
-    if memory.topic.contains(['\n', '\r', '\t']) {
-        return Err(IcmError::InvalidInput(
-            "topic must not contain newline / CR / tab characters".into(),
-        ));
-    }
-    if memory.topic.len() > MAX_TOPIC_BYTES {
-        return Err(IcmError::InvalidInput(format!(
-            "topic exceeds {MAX_TOPIC_BYTES} bytes"
-        )));
-    }
-    if memory.summary.len() > MAX_SUMMARY_BYTES {
-        return Err(IcmError::InvalidInput(format!(
-            "summary exceeds {MAX_SUMMARY_BYTES} bytes"
-        )));
-    }
-    Ok(memory)
-}
-
-const SELECT_COLS: &str = "id, created_at, updated_at, last_accessed, access_count, weight, \
-                           topic, summary, raw_excerpt, keywords, \
-                           importance, source_type, source_data, related_ids, embedding";
-
-/// Map a `memories` row (selected via [`SELECT_COLS`]) to a [`Memory`].
-fn row_to_memory(row: &postgres::Row) -> Memory {
-    let keywords_json: Option<String> = row.get(9);
-    let keywords: Vec<String> = keywords_json
-        .and_then(|s| serde_json::from_str(&s).ok())
-        .unwrap_or_default();
-
-    let importance_str: String = row.get(10);
-    let importance = importance_str.parse().unwrap_or(Importance::Medium);
-
-    let source_type_str: String = row.get(11);
-    let source_data_str: Option<String> = row.get(12);
-    let source = parse_source(&source_type_str, source_data_str);
-
-    let related_json: Option<String> = row.get(13);
-    let related_ids: Vec<String> = related_json
-        .and_then(|s| serde_json::from_str(&s).ok())
-        .unwrap_or_default();
-
-    let embedding: Option<Vec<f32>> = row
-        .get::<_, Option<pgvector::Vector>>(14)
-        .map(|v| v.as_slice().to_vec());
-
-    let access_count: i32 = row.get(4);
-
-    Memory {
-        id: row.get(0),
-        created_at: row.get(1),
-        updated_at: row.get(2),
-        last_accessed: row.get(3),
-        access_count: access_count.max(0) as u32,
-        weight: row.get(5),
-        topic: row.get(6),
-        summary: row.get(7),
-        raw_excerpt: row.get(8),
-        keywords,
-        importance,
-        source,
-        related_ids,
-        embedding,
-        scope: icm_core::Scope::User,
-    }
-}
-
-/// Insert a memory, or merge metadata into an existing duplicate.
-///
-/// Dedup contract identical to the SQLite backend: a collision on
-/// `summary_hash` alone (which already encodes the topic, Rust-side,
-/// Unicode-correct) is ignored and the existing row's id is returned, after
-/// merging the caller's importance (take max), keywords (union), and
-/// `raw_excerpt` (prefer new) into it.
-fn insert_or_merge_memory<C: GenericClient>(c: &mut C, memory: &Memory) -> IcmResult<String> {
-    let keywords_json = serde_json::to_string(&memory.keywords)?;
-    let related_json = serde_json::to_string(&memory.related_ids)?;
-    let st = source_type(&memory.source);
-    let sd = source_data(&memory.source);
-    let hash = summary_hash(&memory.topic, &memory.summary);
-    let importance = memory.importance.to_string();
-    let access = memory.access_count as i32;
-    let emb: Option<pgvector::Vector> = memory
-        .embedding
-        .as_ref()
-        .map(|e| pgvector::Vector::from(e.clone()));
-
-    let inserted = c
-        .query_opt(
-            "INSERT INTO memories
-             (id, created_at, updated_at, last_accessed, access_count, weight,
-              topic, summary, raw_excerpt, keywords, importance,
-              source_type, source_data, related_ids, summary_hash, embedding)
-             VALUES ($1,$2,$3,$4,$5,$6,$7,$8,$9,$10,$11,$12,$13,$14,$15,$16)
-             ON CONFLICT (summary_hash) WHERE summary_hash IS NOT NULL
-             DO NOTHING
-             RETURNING id",
-            &[
-                &memory.id,
-                &memory.created_at,
-                &memory.updated_at,
-                &memory.last_accessed,
-                &access,
-                &memory.weight,
-                &memory.topic,
-                &memory.summary,
-                &memory.raw_excerpt,
-                &keywords_json,
-                &importance,
-                &st,
-                &sd,
-                &related_json,
-                &hash,
-                &emb,
-            ],
-        )
-        .map_err(pg_err)?;
-
-    if let Some(row) = inserted {
-        return Ok(row.get::<_, String>(0));
-    }
-
-    // Dedup hit: merge metadata into the existing row (mirrors SQLite).
-    let existing = c
-        .query_one(
-            "SELECT id, importance, keywords, raw_excerpt FROM memories
-             WHERE summary_hash = $1",
-            &[&hash],
-        )
-        .map_err(pg_err)?;
-
-    let existing_id: String = existing.get(0);
-    let existing_importance_str: String = existing.get(1);
-    let existing_keywords_json: Option<String> = existing.get(2);
-    let existing_raw: Option<String> = existing.get(3);
-
-    let existing_importance: Importance = existing_importance_str
-        .parse()
-        .unwrap_or(Importance::Medium);
-    let merged_importance = max_importance(existing_importance, memory.importance);
-
-    let existing_keywords: Vec<String> = existing_keywords_json
-        .as_deref()
-        .and_then(|s| serde_json::from_str(s).ok())
-        .unwrap_or_default();
-    let mut merged_keywords = existing_keywords.clone();
-    for kw in &memory.keywords {
-        if !merged_keywords.contains(kw) {
-            merged_keywords.push(kw.clone());
-        }
-    }
-
-    let merged_raw = memory.raw_excerpt.clone().or_else(|| existing_raw.clone());
-
-    let importance_changed = merged_importance != existing_importance;
-    let keywords_changed = merged_keywords != existing_keywords;
-    let raw_changed = merged_raw != existing_raw;
-    if importance_changed || keywords_changed || raw_changed {
-        let merged_keywords_json = serde_json::to_string(&merged_keywords)?;
-        c.execute(
-            "UPDATE memories
-             SET importance = $1, keywords = $2, raw_excerpt = $3, updated_at = $4
-             WHERE id = $5",
-            &[
-                &merged_importance.to_string(),
-                &merged_keywords_json,
-                &merged_raw,
-                &Utc::now(),
-                &existing_id,
-            ],
-        )
-        .map_err(pg_err)?;
-    }
-
-    Ok(existing_id)
-}
-
-// ---------------------------------------------------------------------------
-// PostgresStore
-// ---------------------------------------------------------------------------
-
-/// PostgreSQL-backed store. See the module docs.
-pub struct PostgresStore {
-    client: Mutex<Client>,
-    embedding_dims: usize,
-    readonly: bool,
-}
-
-/// One-shot warning that auto-consolidation silently does nothing on this
-/// backend (see [`PostgresStore::auto_consolidate`]).
-fn warn_auto_consolidate_unsupported() {
-    static WARNED: std::sync::Once = std::sync::Once::new();
-    WARNED.call_once(|| {
-        tracing::warn!(
-            "auto-consolidation is not implemented on the PostgreSQL backend; \
-             topics will keep growing (auto_consolidate_enabled has no effect here)"
-        );
-    });
-}
-
-impl PostgresStore {
-    fn conn(&self) -> IcmResult<MutexGuard<'_, Client>> {
-        self.client.lock().map_err(|_| lock_err())
-    }
-
-    /// Resolve the connection string from the environment.
-    fn conn_string() -> IcmResult<String> {
-        std::env::var("ICM_POSTGRES_URL")
-            .or_else(|_| std::env::var("DATABASE_URL"))
-            .map_err(|_| {
-                IcmError::Config(
-                    "PostgreSQL backend: set ICM_POSTGRES_URL (or DATABASE_URL) to the \
-                     connection string, e.g. postgres://user:pass@host:5432/icm"
-                        .into(),
-                )
-            })
-    }
-
-    /// Connect and run the idempotent schema migration.
-    ///
-    /// The `&Path` the CLI passes for the SQLite file is ignored; the
-    /// connection comes from the environment. `requested_dims` is used
-    /// only when the database is fresh — an existing database's stored
-    /// `embedding_dims` is authoritative so we never try to declare a
-    /// `vector(N)` column that disagrees with the live table.
-    fn connect(requested_dims: usize, readonly: bool) -> IcmResult<Self> {
-        let url = Self::conn_string()?;
-        let mut client = Client::connect(&url, NoTls)
-            .map_err(|e| IcmError::Database(format!("cannot connect to PostgreSQL: {e}")))?;
-
-        let dims = init_schema(&mut client, requested_dims)?;
-
-        Ok(Self {
-            client: Mutex::new(client),
-            embedding_dims: dims,
-            readonly,
-        })
-    }
-
-    /// Reject an embedding whose length disagrees with the column's
-    /// declared dimension, with a clearer message than the raw PostgreSQL
-    /// "expected N dimensions, not M" error.
-    fn check_dims(&self, memory: &Memory) -> IcmResult<()> {
-        if let Some(emb) = memory.embedding.as_ref() {
-            if emb.len() != self.embedding_dims {
-                return Err(IcmError::InvalidInput(format!(
-                    "embedding has {} dimensions, but this store uses {}",
-                    emb.len(),
-                    self.embedding_dims
-                )));
-            }
-        }
-        Ok(())
-    }
-
-    /// Open or create a store with the default embedding dimension.
-    pub fn new(_path: &Path) -> IcmResult<Self> {
-        Self::connect(icm_core::DEFAULT_EMBEDDING_DIMS, false)
-    }
-
-    /// Open or create a store with a specific embedding dimension.
-    pub fn with_dims(_path: &Path, embedding_dims: usize) -> IcmResult<Self> {
-        Self::connect(embedding_dims, false)
-    }
-
-    /// Open the store in read-only mode (issue #263). The connection is
-    /// the same; write methods refuse, read-like side effects are skipped.
-    pub fn open_readonly(_path: &Path) -> IcmResult<Self> {
-        Self::connect(icm_core::DEFAULT_EMBEDDING_DIMS, true)
-    }
-
-    /// PostgreSQL has no in-memory mode; connect to the configured
-    /// database. Provided for API parity with the SQLite backend.
-    pub fn in_memory() -> IcmResult<Self> {
-        Self::connect(icm_core::DEFAULT_EMBEDDING_DIMS, false)
-    }
-
-    /// See [`Self::in_memory`].
-    pub fn in_memory_with_dims(embedding_dims: usize) -> IcmResult<Self> {
-        Self::connect(embedding_dims, false)
-    }
-
-    /// PostgreSQL stores `embedding_dims` in `icm_metadata`, but unlike
-    /// SQLite it never destructively recreates the vector column, so the
-    /// pre-open peek the SQLite backend needs is unnecessary here. Always
-    /// returns `Ok(None)` so callers fall through to the normal open path.
-    pub fn read_stored_embedding_dims(_path: &Path) -> IcmResult<Option<usize>> {
-        Ok(None)
-    }
-
-    #[must_use]
-    pub fn is_readonly(&self) -> bool {
-        self.readonly
-    }
-
-    /// No-op on PostgreSQL (the SQLite backend uses this to load the
-    /// `sqlite-vec` extension; `pgvector` lives server-side).
-    pub fn ensure_vec_init() {}
-
-    /// Apply decay if more than 24 hours since the last run. Mirrors the
-    /// SQLite backend's atomic check-and-claim via `icm_metadata`.
-    pub fn maybe_auto_decay(&self) -> IcmResult<()> {
-        if self.readonly {
-            return Ok(());
-        }
-        let now = Utc::now();
-        let claimed = {
-            let mut c = self.conn()?;
-            c.execute(
-                "INSERT INTO icm_metadata (key, value) VALUES ('last_decay_at', $1)
-                 ON CONFLICT (key) DO UPDATE SET value = $1
-                 WHERE icm_metadata.value IS NULL
-                    OR ($1::timestamptz - icm_metadata.value::timestamptz) >= interval '1 day'",
-                &[&now.to_rfc3339()],
-            )
-            .map_err(pg_err)?
-        };
-        if claimed > 0 {
-            self.apply_decay(0.95)?;
-        }
-        Ok(())
-    }
-
-    /// Atomically increment the hook call counter and return the new value.
-    pub fn increment_hook_counter(&self) -> IcmResult<usize> {
-        let mut c = self.conn()?;
-        let row = c
-            .query_one(
-                "INSERT INTO icm_metadata (key, value) VALUES ('hook_counter', '1')
-                 ON CONFLICT (key) DO UPDATE SET value = ((icm_metadata.value::bigint) + 1)::text
-                 RETURNING value::bigint",
-                &[],
-            )
-            .map_err(pg_err)?;
-        let n: i64 = row.get(0);
-        Ok(n.max(0) as usize)
-    }
-
-    /// Reset the hook call counter to 0.
-    pub fn reset_hook_counter(&self) -> IcmResult<()> {
-        let mut c = self.conn()?;
-        c.execute(
-            "INSERT INTO icm_metadata (key, value) VALUES ('hook_counter', '0')
-             ON CONFLICT (key) DO UPDATE SET value = '0'",
-            &[],
-        )
-        .map_err(pg_err)?;
-        Ok(())
-    }
-
-    // ── Async extraction queue ─────────────────────────────────────────
-
-    /// Enqueue raw tool output for later LLM extraction.
-    pub fn enqueue_pending_extraction(
-        &self,
-        project: &str,
-        tool_name: &str,
-        raw_output: &str,
-    ) -> IcmResult<String> {
-        let id = ulid::Ulid::new().to_string();
-        let mut c = self.conn()?;
-        c.execute(
-            "INSERT INTO pending_extractions (id, project, tool_name, raw_output, captured_at)
-             VALUES ($1, $2, $3, $4, $5)",
-            &[&id, &project, &tool_name, &raw_output, &Utc::now()],
-        )
-        .map_err(pg_err)?;
-        Ok(id)
-    }
-
-    /// Pop up to `limit` oldest pending rows (FIFO by capture time).
-    pub fn list_pending_extractions(&self, limit: usize) -> IcmResult<Vec<PendingRow>> {
-        let mut c = self.conn()?;
-        let rows = c
-            .query(
-                "SELECT id, project, tool_name, raw_output, captured_at
-                 FROM pending_extractions
-                 ORDER BY captured_at ASC
-                 LIMIT $1",
-                &[&(limit as i64)],
-            )
-            .map_err(pg_err)?;
-        Ok(rows
-            .iter()
-            .map(|row| {
-                let captured: DateTime<Utc> = row.get(4);
-                (
-                    row.get(0),
-                    row.get(1),
-                    row.get(2),
-                    row.get(3),
-                    captured.to_rfc3339(),
-                )
-            })
-            .collect())
-    }
-
-    /// Delete pending rows by id. Used after a worker has processed them.
-    pub fn delete_pending_extractions(&self, ids: &[String]) -> IcmResult<usize> {
-        if ids.is_empty() {
-            return Ok(0);
-        }
-        let ids_vec: Vec<String> = ids.to_vec();
-        let mut c = self.conn()?;
-        let n = c
-            .execute(
-                "DELETE FROM pending_extractions WHERE id = ANY($1)",
-                &[&ids_vec],
-            )
-            .map_err(pg_err)?;
-        Ok(n as usize)
-    }
-
-    /// Total rows currently waiting in the queue.
-    pub fn pending_extraction_count(&self) -> IcmResult<usize> {
-        let mut c = self.conn()?;
-        let row = c
-            .query_one("SELECT COUNT(*) FROM pending_extractions", &[])
-            .map_err(pg_err)?;
-        let n: i64 = row.get(0);
-        Ok(n.max(0) as usize)
-    }
-
-    // ── Code areas (issue #196) ────────────────────────────────────────
-
-    /// Insert or refresh a row for `(project, file_path)`.
-    pub fn upsert_code_area(
-        &self,
-        project: &str,
-        file_path: &str,
-        description: Option<&str>,
-        session_id: Option<&str>,
-        tool_name: Option<&str>,
-    ) -> IcmResult<()> {
-        let now = Utc::now();
-        let mut c = self.conn()?;
-        c.execute(
-            "INSERT INTO code_areas
-                (project, file_path, description, session_id, tool_name,
-                 touch_count, first_touched_at, last_touched_at)
-             VALUES ($1, $2, $3, $4, $5, 1, $6, $6)
-             ON CONFLICT (project, file_path) DO UPDATE SET
-                touch_count = code_areas.touch_count + 1,
-                last_touched_at = EXCLUDED.last_touched_at,
-                session_id = COALESCE(EXCLUDED.session_id, code_areas.session_id),
-                tool_name = COALESCE(EXCLUDED.tool_name, code_areas.tool_name),
-                description = COALESCE(EXCLUDED.description, code_areas.description)",
-            &[
-                &project,
-                &file_path,
-                &description,
-                &session_id,
-                &tool_name,
-                &now,
-            ],
-        )
-        .map_err(pg_err)?;
-        Ok(())
-    }
-
-    /// List code areas, optionally filtered, newest-touch first.
-    pub fn list_code_areas(
-        &self,
-        project: Option<&str>,
-        in_file: Option<&str>,
-        since: Option<DateTime<Utc>>,
-        limit: usize,
-    ) -> IcmResult<Vec<CodeArea>> {
-        let mut sql = String::from(
-            "SELECT id, project, file_path, description, session_id, tool_name,
-                    touch_count, first_touched_at, last_touched_at
-             FROM code_areas WHERE TRUE",
-        );
-        let mut owned: Vec<Box<dyn ToSql + Sync>> = Vec::new();
-        if let Some(p) = project {
-            owned.push(Box::new(p.to_string()));
-            sql.push_str(&format!(" AND project = ${}", owned.len()));
-        }
-        if let Some(f) = in_file {
-            owned.push(Box::new(f.to_string()));
-            let exact = owned.len();
-            owned.push(Box::new(format!("%/{f}")));
-            let suffix = owned.len();
-            sql.push_str(&format!(
-                " AND (file_path = ${exact} OR file_path LIKE ${suffix})"
-            ));
-        }
-        if let Some(t) = since {
-            owned.push(Box::new(t));
-            sql.push_str(&format!(" AND last_touched_at >= ${}", owned.len()));
-        }
-        owned.push(Box::new(limit as i64));
-        sql.push_str(&format!(
-            " ORDER BY last_touched_at DESC LIMIT ${}",
-            owned.len()
-        ));
-
-        let params: Vec<&(dyn ToSql + Sync)> = owned.iter().map(|b| b.as_ref()).collect();
-        let mut c = self.conn()?;
-        let rows = c.query(&sql, &params).map_err(pg_err)?;
-        Ok(rows
-            .iter()
-            .map(|row| CodeArea {
-                id: row.get(0),
-                project: row.get(1),
-                file_path: row.get(2),
-                description: row.get(3),
-                session_id: row.get(4),
-                tool_name: row.get(5),
-                touch_count: row.get(6),
-                first_touched_at: row.get(7),
-                last_touched_at: row.get(8),
-            })
-            .collect())
-    }
-
-    /// Total rows in `code_areas`.
-    pub fn code_area_count(&self) -> IcmResult<usize> {
-        let mut c = self.conn()?;
-        let row = c
-            .query_one("SELECT COUNT(*) FROM code_areas", &[])
-            .map_err(pg_err)?;
-        let n: i64 = row.get(0);
-        Ok(n.max(0) as usize)
-    }
-
-    // ── Hook telemetry ─────────────────────────────────────────────────
-
-    /// Append one hook telemetry row, returning its id.
-    pub fn record_hook_event(&self, ev: &HookEventInsert) -> IcmResult<i64> {
-        let mut c = self.conn()?;
-        let row = c
-            .query_one(
-                "INSERT INTO hook_events
-                 (ts, event, project, session_id, tool_name,
-                  duration_ms, exit_code, payload_size, note)
-                 VALUES ($1, $2, $3, $4, $5, $6, $7, $8, $9)
-                 RETURNING id",
-                &[
-                    &Utc::now(),
-                    &ev.event,
-                    &ev.project,
-                    &ev.session_id,
-                    &ev.tool_name,
-                    &ev.duration_ms,
-                    &ev.exit_code,
-                    &ev.payload_size,
-                    &ev.note,
-                ],
-            )
-            .map_err(pg_err)?;
-        Ok(row.get(0))
-    }
-
-    /// Most recent `limit` hook events, newest first; optional event filter.
-    pub fn hook_events_recent(
-        &self,
-        limit: usize,
-        event_filter: Option<&str>,
-    ) -> IcmResult<Vec<HookEvent>> {
-        let mut c = self.conn()?;
-        let rows = match event_filter {
-            Some(ev) => c.query(
-                "SELECT id, ts, event, project, session_id, tool_name,
-                        duration_ms, exit_code, payload_size, note
-                 FROM hook_events WHERE event = $1 ORDER BY id DESC LIMIT $2",
-                &[&ev, &(limit as i64)],
-            ),
-            None => c.query(
-                "SELECT id, ts, event, project, session_id, tool_name,
-                        duration_ms, exit_code, payload_size, note
-                 FROM hook_events ORDER BY id DESC LIMIT $1",
-                &[&(limit as i64)],
-            ),
-        }
-        .map_err(pg_err)?;
-        Ok(rows
-            .iter()
-            .map(|row| HookEvent {
-                id: row.get(0),
-                ts: row.get(1),
-                event: row.get(2),
-                project: row.get(3),
-                session_id: row.get(4),
-                tool_name: row.get(5),
-                duration_ms: row.get(6),
-                exit_code: row.get(7),
-                payload_size: row.get(8),
-                note: row.get(9),
-            })
-            .collect())
-    }
-
-    /// Per-event aggregate stats since `since_rfc3339`.
-    pub fn hook_stats(&self, since_rfc3339: &str) -> IcmResult<Vec<HookStatsRow>> {
-        let since = DateTime::parse_from_rfc3339(since_rfc3339)
-            .map(|d| d.with_timezone(&Utc))
-            .unwrap_or_else(|_| Utc::now() - chrono::Duration::days(7));
-        let mut c = self.conn()?;
-        let rows = c
-            .query(
-                "SELECT event,
-                        COUNT(*)::bigint,
-                        COUNT(*) FILTER (WHERE exit_code <> 0)::bigint,
-                        COALESCE(AVG(duration_ms), 0)::float8,
-                        COALESCE(percentile_cont(0.5) WITHIN GROUP (ORDER BY duration_ms), 0)::float8,
-                        COALESCE(percentile_cont(0.99) WITHIN GROUP (ORDER BY duration_ms), 0)::float8
-                 FROM hook_events WHERE ts >= $1
-                 GROUP BY event ORDER BY event",
-                &[&since],
-            )
-            .map_err(pg_err)?;
-        Ok(rows
-            .iter()
-            .map(|row| {
-                let p50: f64 = row.get(4);
-                let p99: f64 = row.get(5);
-                HookStatsRow {
-                    event: row.get(0),
-                    count: row.get(1),
-                    error_count: row.get(2),
-                    avg_duration_ms: row.get(3),
-                    p50_duration_ms: p50 as i64,
-                    p99_duration_ms: p99 as i64,
-                }
-            })
-            .collect())
-    }
-
-    /// Delete hook events older than `cutoff_rfc3339`.
-    pub fn prune_hook_events(&self, cutoff_rfc3339: &str) -> IcmResult<usize> {
-        let cutoff = DateTime::parse_from_rfc3339(cutoff_rfc3339)
-            .map(|d| d.with_timezone(&Utc))
-            .map_err(|e| IcmError::InvalidInput(format!("invalid cutoff timestamp: {e}")))?;
-        let mut c = self.conn()?;
-        let n = c
-            .execute("DELETE FROM hook_events WHERE ts < $1", &[&cutoff])
-            .map_err(pg_err)?;
-        Ok(n as usize)
-    }
-
-    /// Total rows in `hook_events`.
-    pub fn hook_event_count(&self) -> IcmResult<usize> {
-        let mut c = self.conn()?;
-        let row = c
-            .query_one("SELECT COUNT(*) FROM hook_events", &[])
-            .map_err(pg_err)?;
-        let n: i64 = row.get(0);
-        Ok(n.max(0) as usize)
-    }
-
-    // ── Memory reads used by recall expansion ──────────────────────────
-
-    /// Fetch many memories by id in one round-trip, deduplicated by id.
-    pub fn get_many(&self, ids: &[&str]) -> IcmResult<HashMap<String, Memory>> {
-        if ids.is_empty() {
-            return Ok(HashMap::new());
-        }
-        let id_vec: Vec<String> = ids.iter().map(|s| s.to_string()).collect();
-        let mut c = self.conn()?;
-        let rows = c
-            .query(
-                &format!("SELECT {SELECT_COLS} FROM memories WHERE id = ANY($1)"),
-                &[&id_vec],
-            )
-            .map_err(pg_err)?;
-        let mut map = HashMap::with_capacity(rows.len());
-        for row in &rows {
-            let m = row_to_memory(row);
-            map.insert(m.id.clone(), m);
-        }
-        Ok(map)
-    }
-
-    /// Expand a scored result set with one hop of related memories.
-    /// Backend-agnostic logic mirrored from the SQLite store.
-    pub fn expand_with_neighbors(
-        &self,
-        initial: &[(Memory, f32)],
-        max_neighbors: usize,
-        hop_discount: f32,
-        max_total: usize,
-    ) -> IcmResult<Vec<(Memory, f32)>> {
-        if max_neighbors == 0 || initial.is_empty() {
-            let mut out = initial.to_vec();
-            out.truncate(max_total);
-            return Ok(out);
-        }
-
-        let initial_ids: HashSet<String> = initial.iter().map(|(m, _)| m.id.clone()).collect();
-
-        let mut candidates: Vec<(String, f32)> = Vec::new();
-        let mut seen: HashSet<String> = HashSet::new();
-        'outer: for (mem, score) in initial {
-            for neighbor_id in &mem.related_ids {
-                if candidates.len() >= max_neighbors {
-                    break 'outer;
-                }
-                if initial_ids.contains(neighbor_id) || !seen.insert(neighbor_id.clone()) {
-                    continue;
-                }
-                candidates.push((neighbor_id.clone(), *score));
-            }
-        }
-
-        let mut neighbors: Vec<(Memory, f32)> = Vec::new();
-        if !candidates.is_empty() {
-            let ids: Vec<&str> = candidates.iter().map(|(id, _)| id.as_str()).collect();
-            let fetched = self.get_many(&ids)?;
-            for (id, parent_score) in candidates {
-                if let Some(m) = fetched.get(&id) {
-                    neighbors.push((m.clone(), parent_score * hop_discount));
-                }
-            }
-        }
-
-        let mut combined: Vec<(Memory, f32)> = initial.to_vec();
-        combined.extend(neighbors);
-        combined.sort_by(|a, b| b.1.partial_cmp(&a.1).unwrap_or(std::cmp::Ordering::Equal));
-        combined.truncate(max_total);
-        Ok(combined)
-    }
-
-    /// Memories whose topic starts with `topic` (prefix match).
-    pub fn get_by_topic_prefix(&self, topic: &str) -> IcmResult<Vec<Memory>> {
-        // Audit finding: `topic` (the literal prefix to match) was
-        // interpolated unescaped — a topic containing `%`/`_` turned into
-        // unintended wildcards within what's meant to be a literal prefix.
-        // The trailing `%` is the deliberate "starts with" wildcard and
-        // stays outside the escaped portion.
-        let pattern = format!("{}%", escape_like_wildcards(topic));
-        let mut c = self.conn()?;
-        let rows = c
-            .query(
-                &format!(
-                    "SELECT {SELECT_COLS} FROM memories WHERE topic LIKE $1 ESCAPE '\\' \
-                     ORDER BY weight DESC LIMIT 500"
-                ),
-                &[&pattern],
-            )
-            .map_err(pg_err)?;
-        Ok(rows.iter().map(row_to_memory).collect())
-    }
-
-    /// Distinct topics (optionally prefix-filtered) with their counts.
-    pub fn list_topics_with_prefix(&self, prefix: Option<&str>) -> IcmResult<Vec<(String, usize)>> {
-        let mut c = self.conn()?;
-        let rows = match prefix {
-            Some(p) => {
-                let pattern = format!("{p}%");
-                c.query(
-                    "SELECT topic, COUNT(*)::bigint FROM memories WHERE topic LIKE $1 \
-                     GROUP BY topic ORDER BY topic",
-                    &[&pattern],
-                )
-            }
-            None => c.query(
-                "SELECT topic, COUNT(*)::bigint FROM memories GROUP BY topic ORDER BY topic",
-                &[],
-            ),
-        }
-        .map_err(pg_err)?;
-        Ok(rows
-            .iter()
-            .map(|row| {
-                let n: i64 = row.get(1);
-                (row.get(0), n.max(0) as usize)
-            })
-            .collect())
-    }
-
-    // ── Consolidation / patterns ───────────────────────────────────────
-
-    /// Auto-consolidation is not yet implemented on the PostgreSQL
-    /// backend; the call is a no-op (returns "did not consolidate") so the
-    /// normal store path is unaffected. Unlike the other parity gaps (which
-    /// return `Unsupported`), this one is silent by design — but the user
-    /// deserves to know their `auto_consolidate_enabled = true` does nothing
-    /// here, so warn once per process (audit finding).
-    pub fn auto_consolidate(&self, _topic: &str, _threshold: usize) -> IcmResult<bool> {
-        warn_auto_consolidate_unsupported();
-        Ok(false)
-    }
-
-    /// See [`Self::auto_consolidate`].
-    pub fn auto_consolidate_with_embedder(
-        &self,
-        _topic: &str,
-        _threshold: usize,
-        _embedder: Option<&dyn Embedder>,
-    ) -> IcmResult<bool> {
-        warn_auto_consolidate_unsupported();
-        Ok(false)
-    }
-
-    /// Pattern mining is not yet available on the PostgreSQL backend.
-    pub fn detect_patterns(
-        &self,
-        _topic: &str,
-        _min_cluster_size: usize,
-    ) -> IcmResult<Vec<PatternCluster>> {
-        Err(IcmError::Unsupported(
-            "detect_patterns (use the default SQLite backend)".into(),
-        ))
-    }
-
-    /// Pattern mining is not yet available on the PostgreSQL backend.
-    pub fn extract_pattern_as_concept(
-        &self,
-        _cluster: &PatternCluster,
-        _memoir_id: &str,
-    ) -> IcmResult<String> {
-        Err(IcmError::Unsupported(
-            "extract_pattern_as_concept (use the default SQLite backend)".into(),
-        ))
-    }
-}
-
-/// Idempotent schema creation. Returns the embedding dimension the table
-/// is actually using (the stored value wins over `requested_dims` on an
-/// existing database).
-fn init_schema(client: &mut Client, requested_dims: usize) -> IcmResult<usize> {
-    if !(64..=4096).contains(&requested_dims) {
-        return Err(IcmError::Config(format!(
-            "embedding_dims must be between 64 and 4096, got {requested_dims}"
-        )));
-    }
-
-    client
-        .batch_execute("CREATE EXTENSION IF NOT EXISTS vector")
-        .map_err(|e| {
-            IcmError::Database(format!(
-                "cannot enable the pgvector extension (need it for embeddings): {e}"
-            ))
-        })?;
-
-    client
-        .batch_execute(
-            "CREATE TABLE IF NOT EXISTS icm_metadata (
-                key TEXT PRIMARY KEY,
-                value TEXT
-            )",
-        )
-        .map_err(pg_err)?;
-
-    // The stored dimension is authoritative on an existing database.
-    let stored: Option<i64> = client
-        .query_opt(
-            "SELECT value::bigint FROM icm_metadata WHERE key = 'embedding_dims'",
-            &[],
-        )
-        .map_err(pg_err)?
-        .map(|row| row.get(0));
-    let dims = stored.map(|d| d as usize).unwrap_or(requested_dims);
-
-    // Migration: the unique index used to be `(LOWER(topic), summary_hash)`.
-    // `summary_hash` already encodes the topic via Rust's Unicode-correct
-    // `to_lowercase()`, while Postgres's `LOWER()` behavior depends on the
-    // cluster's locale (ASCII-only under `C`/POSIX, common in minimal
-    // Docker/CI images) — the composite key could let two rows with an
-    // identical `summary_hash` coexist whenever their topic's SQL-LOWER()
-    // forms differed under that locale (audit finding, same class already
-    // fixed for SQLite). `CREATE INDEX IF NOT EXISTS` would silently keep
-    // the old definition on an already-migrated DB (same index name), so
-    // drop it first if it still has the old column list.
-    let old_index_def: Option<String> = client
-        .query_opt(
-            "SELECT indexdef FROM pg_indexes WHERE indexname = 'idx_memories_topic_hash'",
-            &[],
-        )
-        .map_err(pg_err)?
-        .map(|row| row.get(0));
-    if let Some(def) = old_index_def {
-        if def.to_lowercase().contains("lower(topic") {
-            client
-                .batch_execute("DROP INDEX idx_memories_topic_hash;")
-                .map_err(pg_err)?;
-        }
-    }
-
-    client
-        .batch_execute(&format!(
-            "CREATE TABLE IF NOT EXISTS memories (
-                id TEXT PRIMARY KEY,
-                created_at TIMESTAMPTZ NOT NULL,
-                updated_at TIMESTAMPTZ NOT NULL,
-                last_accessed TIMESTAMPTZ NOT NULL,
-                access_count INTEGER NOT NULL DEFAULT 0,
-                weight REAL NOT NULL DEFAULT 1.0,
-                topic TEXT NOT NULL,
-                summary TEXT NOT NULL,
-                raw_excerpt TEXT,
-                keywords TEXT,
-                importance TEXT NOT NULL,
-                source_type TEXT NOT NULL,
-                source_data TEXT,
-                related_ids TEXT,
-                summary_hash TEXT,
-                embedding vector({dims}),
-                fts tsvector GENERATED ALWAYS AS (
-                    to_tsvector('simple',
-                        coalesce(topic, '') || ' ' ||
-                        coalesce(summary, '') || ' ' ||
-                        coalesce(keywords, ''))
-                ) STORED
-            );
-
-            CREATE INDEX IF NOT EXISTS idx_memories_topic ON memories(topic);
-            CREATE INDEX IF NOT EXISTS idx_memories_weight ON memories(weight);
-            CREATE INDEX IF NOT EXISTS idx_memories_created ON memories(created_at);
-            CREATE INDEX IF NOT EXISTS idx_memories_fts ON memories USING GIN (fts);
-            CREATE UNIQUE INDEX IF NOT EXISTS idx_memories_topic_hash
-                ON memories (summary_hash) WHERE summary_hash IS NOT NULL;
-
-            CREATE TABLE IF NOT EXISTS pending_extractions (
-                id TEXT PRIMARY KEY,
-                project TEXT NOT NULL,
-                tool_name TEXT NOT NULL,
-                raw_output TEXT NOT NULL,
-                captured_at TIMESTAMPTZ NOT NULL
-            );
-
-            CREATE TABLE IF NOT EXISTS code_areas (
-                id BIGSERIAL PRIMARY KEY,
-                project TEXT NOT NULL,
-                file_path TEXT NOT NULL,
-                description TEXT,
-                session_id TEXT,
-                tool_name TEXT,
-                touch_count BIGINT NOT NULL DEFAULT 1,
-                first_touched_at TIMESTAMPTZ NOT NULL,
-                last_touched_at TIMESTAMPTZ NOT NULL,
-                UNIQUE (project, file_path)
-            );
-
-            CREATE TABLE IF NOT EXISTS hook_events (
-                id BIGSERIAL PRIMARY KEY,
-                ts TIMESTAMPTZ NOT NULL,
-                event TEXT NOT NULL,
-                project TEXT,
-                session_id TEXT,
-                tool_name TEXT,
-                duration_ms BIGINT,
-                exit_code INTEGER NOT NULL DEFAULT 0,
-                payload_size BIGINT,
-                note TEXT
-            );
-            CREATE INDEX IF NOT EXISTS idx_hook_events_ts ON hook_events(ts);
-            CREATE INDEX IF NOT EXISTS idx_hook_events_event ON hook_events(event);"
-        ))
-        .map_err(pg_err)?;
-
-    // A vector index needs a concrete dimension; create it after the
-    // table exists. HNSW is available in pgvector >= 0.5 (the images we
-    // target ship a newer version).
-    client
-        .batch_execute(
-            "CREATE INDEX IF NOT EXISTS idx_memories_embedding
-                ON memories USING hnsw (embedding vector_cosine_ops)",
-        )
-        .map_err(pg_err)?;
-
-    client
-        .execute(
-            "INSERT INTO icm_metadata (key, value) VALUES ('embedding_dims', $1)
-             ON CONFLICT (key) DO NOTHING",
-            &[&dims.to_string()],
-        )
-        .map_err(pg_err)?;
-
-    Ok(dims)
-}
-
-// ---------------------------------------------------------------------------
-// MemoryStore
-// ---------------------------------------------------------------------------
-
-impl MemoryStore for PostgresStore {
-    fn store(&self, memory: Memory) -> IcmResult<String> {
-        if self.readonly {
-            return Err(IcmError::ReadOnly("store".into()));
-        }
-        let memory = validate_and_normalize(memory)?;
-        self.check_dims(&memory)?;
-        let mut c = self.conn()?;
-        let mut tx = c.transaction().map_err(pg_err)?;
-        let id = insert_or_merge_memory(&mut tx, &memory)?;
-        tx.commit().map_err(pg_err)?;
-        Ok(id)
-    }
-
-    fn get(&self, id: &str) -> IcmResult<Option<Memory>> {
-        let mut c = self.conn()?;
-        let row = c
-            .query_opt(
-                &format!("SELECT {SELECT_COLS} FROM memories WHERE id = $1"),
-                &[&id],
-            )
-            .map_err(pg_err)?;
-        Ok(row.as_ref().map(row_to_memory))
-    }
-
-    fn update(&self, memory: &Memory) -> IcmResult<()> {
-        if self.readonly {
-            return Err(IcmError::ReadOnly("update".into()));
-        }
-        self.check_dims(memory)?;
-        let keywords_json = serde_json::to_string(&memory.keywords)?;
-        let related_json = serde_json::to_string(&memory.related_ids)?;
-        let st = source_type(&memory.source);
-        let sd = source_data(&memory.source);
-        let hash = summary_hash(&memory.topic, &memory.summary);
-        let importance = memory.importance.to_string();
-        let access = memory.access_count as i32;
-        let emb: Option<pgvector::Vector> = memory
-            .embedding
-            .as_ref()
-            .map(|e| pgvector::Vector::from(e.clone()));
-
-        let mut c = self.conn()?;
-        let changed = c
-            .execute(
-                "UPDATE memories SET
-                    updated_at = $2, last_accessed = $3, access_count = $4, weight = $5,
-                    topic = $6, summary = $7, raw_excerpt = $8, keywords = $9,
-                    importance = $10, source_type = $11, source_data = $12, related_ids = $13,
-                    embedding = $14, summary_hash = $15
-                 WHERE id = $1",
-                &[
-                    &memory.id,
-                    &memory.updated_at,
-                    &memory.last_accessed,
-                    &access,
-                    &memory.weight,
-                    &memory.topic,
-                    &memory.summary,
-                    &memory.raw_excerpt,
-                    &keywords_json,
-                    &importance,
-                    &st,
-                    &sd,
-                    &related_json,
-                    &emb,
-                    &hash,
-                ],
-            )
-            .map_err(pg_err)?;
-        if changed == 0 {
-            return Err(IcmError::NotFound(memory.id.clone()));
-        }
-        Ok(())
-    }
-
-    fn delete(&self, id: &str) -> IcmResult<()> {
-        if self.readonly {
-            return Err(IcmError::ReadOnly("delete".into()));
-        }
-        let mut c = self.conn()?;
-        let mut tx = c.transaction().map_err(pg_err)?;
-        let changed = tx
-            .execute("DELETE FROM memories WHERE id = $1", &[&id])
-            .map_err(pg_err)?;
-        if changed == 0 {
-            return Err(IcmError::NotFound(id.to_string()));
-        }
-        // Manual-testing finding (same class as the SQLite backend): a
-        // deleted memory otherwise stays as a dangling entry in every
-        // other memory's `related_ids` forever. Strip it out. `LIKE` is a
-        // cheap prefilter; the JSON-quoted match guards against a ULID
-        // that happens to be a literal substring of another.
-        tx.execute(
-            "UPDATE memories
-                SET related_ids = (
-                    SELECT COALESCE(jsonb_agg(elem), '[]'::jsonb)::text
-                    FROM jsonb_array_elements_text(related_ids::jsonb) AS elem
-                    WHERE elem != $1
-                )
-                WHERE related_ids LIKE '%\"' || $1 || '\"%'",
-            &[&id],
-        )
-        .map_err(pg_err)?;
-        tx.commit().map_err(pg_err)?;
-        Ok(())
-    }
-
-    fn search_by_keywords(&self, keywords: &[&str], limit: usize) -> IcmResult<Vec<Memory>> {
-        if keywords.is_empty() {
-            return Ok(Vec::new());
-        }
-        let keywords = &keywords[..keywords.len().min(50)];
-        let limit = limit.min(100);
-
-        let mut owned: Vec<Box<dyn ToSql + Sync>> = Vec::new();
-        let mut where_parts: Vec<String> = Vec::new();
-        for k in keywords {
-            // Audit finding: a keyword containing `%`/`_` was interpolated
-            // straight into the ILIKE pattern unescaped (same bug already
-            // fixed for SQLite's search_by_keywords). Escape and declare the
-            // escape character explicitly.
-            owned.push(Box::new(format!("%{}%", escape_like_wildcards(k))));
-            let p = owned.len();
-            where_parts.push(format!(
-                "(keywords ILIKE ${p} ESCAPE '\\' OR summary ILIKE ${p} ESCAPE '\\' \
-                 OR topic ILIKE ${p} ESCAPE '\\')"
-            ));
-        }
-        owned.push(Box::new(limit as i64));
-        let sql = format!(
-            "SELECT {SELECT_COLS} FROM memories WHERE {} ORDER BY weight DESC LIMIT ${}",
-            where_parts.join(" OR "),
-            owned.len()
-        );
-        let params: Vec<&(dyn ToSql + Sync)> = owned.iter().map(|b| b.as_ref()).collect();
-        let mut c = self.conn()?;
-        let rows = c.query(&sql, &params).map_err(pg_err)?;
-        Ok(rows.iter().map(row_to_memory).collect())
-    }
-
-    fn search_fts(&self, query: &str, limit: usize) -> IcmResult<Vec<Memory>> {
-        let limit = limit.min(100);
-        if query.trim().is_empty() {
-            return Ok(Vec::new());
-        }
-        let mut c = self.conn()?;
-        let rows = c
-            .query(
-                &format!(
-                    "SELECT {SELECT_COLS} FROM memories \
-                     WHERE fts @@ websearch_to_tsquery('simple', $1) \
-                     ORDER BY weight DESC LIMIT $2"
-                ),
-                &[&query, &(limit as i64)],
-            )
-            .map_err(pg_err)?;
-        Ok(rows.iter().map(row_to_memory).collect())
-    }
-
-    fn search_by_embedding(
-        &self,
-        embedding: &[f32],
-        limit: usize,
-    ) -> IcmResult<Vec<(Memory, f32)>> {
-        // Found while auditing OpenSearch's equivalent (which had no clamp
-        // at all): this function was also missing one, unlike its sibling
-        // search functions in this same file.
-        let limit = limit.min(1000);
-        let qv = pgvector::Vector::from(embedding.to_vec());
-        let mut c = self.conn()?;
-        let rows = c
-            .query(
-                &format!(
-                    "SELECT {SELECT_COLS}, embedding <=> $1 AS distance FROM memories \
-                     WHERE embedding IS NOT NULL ORDER BY embedding <=> $1 LIMIT $2"
-                ),
-                &[&qv, &(limit as i64)],
-            )
-            .map_err(pg_err)?;
-        Ok(rows
-            .iter()
-            .map(|row| {
-                let distance: f64 = row.get(15);
-                (row_to_memory(row), 1.0 - distance as f32)
-            })
-            .collect())
-    }
-
-    fn search_hybrid(
-        &self,
-        query: &str,
-        embedding: &[f32],
-        limit: usize,
-    ) -> IcmResult<Vec<(Memory, f32)>> {
-        let limit = limit.min(1000);
-        let pool_size = limit * 4;
-
-        // 1. FTS candidates (id + rank). Lock released at scope end.
-        let fts_pairs: Vec<(String, f64)> = if query.trim().is_empty() {
-            Vec::new()
-        } else {
-            let mut c = self.conn()?;
-            let rows = c
-                .query(
-                    "SELECT id, ts_rank_cd(fts, websearch_to_tsquery('simple', $1))::float8 AS rank \
-                     FROM memories \
-                     WHERE fts @@ websearch_to_tsquery('simple', $1) \
-                     ORDER BY rank DESC LIMIT $2",
-                    &[&query, &(pool_size as i64)],
-                )
-                .map_err(pg_err)?;
-            rows.iter().map(|r| (r.get(0), r.get(1))).collect()
-        };
-
-        // 2. Vector candidates (full rows + similarity).
-        let vec_results = self.search_by_embedding(embedding, pool_size)?;
-
-        // 3. Assemble memory objects and per-source scores.
-        let mut all_memories: HashMap<String, Memory> = HashMap::new();
-        let mut vec_scores: HashMap<String, f32> = HashMap::new();
-        for (mem, sim) in vec_results {
-            vec_scores.insert(mem.id.clone(), sim);
-            all_memories.insert(mem.id.clone(), mem);
-        }
-
-        // Normalize FTS ranks into 0..1 within the pool (higher is better).
-        let max_rank = fts_pairs.iter().map(|(_, r)| *r).fold(0.0_f64, f64::max);
-        let mut fts_scores: HashMap<String, f32> = HashMap::new();
-        let missing: Vec<String> = fts_pairs
-            .iter()
-            .filter(|(id, _)| !all_memories.contains_key(id))
-            .map(|(id, _)| id.clone())
-            .collect();
-        if !missing.is_empty() {
-            let refs: Vec<&str> = missing.iter().map(|s| s.as_str()).collect();
-            let fetched = self.get_many(&refs)?;
-            for (id, m) in fetched {
-                all_memories.insert(id, m);
-            }
-        }
-        for (id, rank) in fts_pairs {
-            let score = if max_rank > 0.0 {
-                (rank / max_rank) as f32
-            } else {
-                0.0
-            };
-            fts_scores.insert(id, score);
-        }
-
-        // 4. Blend: 30% FTS + 70% vector (matches the SQLite backend).
-        let mut scored: Vec<(String, f32)> = all_memories
-            .keys()
-            .map(|id| {
-                let fts = fts_scores.get(id).copied().unwrap_or(0.0);
-                let vec = vec_scores.get(id).copied().unwrap_or(0.0);
-                (id.clone(), 0.3 * fts + 0.7 * vec)
-            })
-            .collect();
-        scored.sort_by(|a, b| b.1.partial_cmp(&a.1).unwrap_or(std::cmp::Ordering::Equal));
-        scored.truncate(limit);
-
-        Ok(scored
-            .into_iter()
-            .filter_map(|(id, score)| all_memories.remove(&id).map(|m| (m, score)))
-            .collect())
-    }
-
-    fn update_access(&self, id: &str) -> IcmResult<()> {
-        if self.readonly {
-            return Ok(());
-        }
-        let mut c = self.conn()?;
-        let changed = c
-            .execute(
-                "UPDATE memories SET last_accessed = $1, access_count = access_count + 1 \
-                 WHERE id = $2",
-                &[&Utc::now(), &id],
-            )
-            .map_err(pg_err)?;
-        if changed == 0 {
-            return Err(IcmError::NotFound(id.to_string()));
-        }
-        Ok(())
-    }
-
-    fn batch_update_access(&self, ids: &[&str]) -> IcmResult<usize> {
-        if ids.is_empty() || self.readonly {
-            return Ok(0);
-        }
-        let id_vec: Vec<String> = ids.iter().map(|s| s.to_string()).collect();
-        let mut c = self.conn()?;
-        let changed = c
-            .execute(
-                "UPDATE memories SET last_accessed = $1, access_count = access_count + 1 \
-                 WHERE id = ANY($2)",
-                &[&Utc::now(), &id_vec],
-            )
-            .map_err(pg_err)?;
-        Ok(changed as usize)
-    }
-
-    fn apply_decay(&self, decay_factor: f32) -> IcmResult<usize> {
-        if self.readonly {
-            return Err(IcmError::ReadOnly("apply_decay".into()));
-        }
-        // Access-aware decay, capped at 5 accesses (matches SQLite).
-        let mut c = self.conn()?;
-        let changed = c
-            .execute(
-                // `$1::float8` is explicit so PostgreSQL doesn't infer the
-                // parameter as `numeric`/`real` from a neighbouring operand
-                // and reject the `f64` we bind ("error serializing parameter").
-                // Audit finding: for `low` importance with low access count,
-                // the raw multiplier goes negative once decay_factor < 0.5
-                // (still inside the CLI's own validated [0.0, 1.0) range) —
-                // the same bug already fixed for SQLite (GREATEST here is
-                // Postgres's equivalent of SQLite's MAX). See store.rs
-                // apply_decay for the full derivation.
-                "UPDATE memories SET weight = weight * GREATEST(0.0,
-                    1.0 - (1.0 - $1::float8) *
-                    CASE importance
-                        WHEN 'high' THEN 0.5
-                        WHEN 'low' THEN 2.0
-                        ELSE 1.0
-                    END
-                    / (1.0 + LEAST(access_count, 5) * 0.1)
-                )
-                WHERE importance <> 'critical'",
-                &[&(decay_factor as f64)],
-            )
-            .map_err(pg_err)?;
-        Ok(changed as usize)
-    }
-
-    fn prune(&self, weight_threshold: f32) -> IcmResult<usize> {
-        if self.readonly {
-            return Err(IcmError::ReadOnly("prune".into()));
-        }
-        let mut c = self.conn()?;
-        let changed = c
-            .execute(
-                "DELETE FROM memories \
-                 WHERE weight < $1::float8 AND importance NOT IN ('critical', 'high')",
-                &[&(weight_threshold as f64)],
-            )
-            .map_err(pg_err)?;
-        Ok(changed as usize)
-    }
-
-    fn list_all(&self) -> IcmResult<Vec<Memory>> {
-        let mut c = self.conn()?;
-        let rows = c
-            .query(
-                &format!("SELECT {SELECT_COLS} FROM memories ORDER BY weight DESC LIMIT 10000"),
-                &[],
-            )
-            .map_err(pg_err)?;
-        Ok(rows.iter().map(row_to_memory).collect())
-    }
-
-    fn get_by_topic(&self, topic: &str) -> IcmResult<Vec<Memory>> {
-        let mut c = self.conn()?;
-        let rows = c
-            .query(
-                &format!(
-                    "SELECT {SELECT_COLS} FROM memories WHERE topic = $1 \
-                     ORDER BY weight DESC LIMIT 500"
-                ),
-                &[&topic],
-            )
-            .map_err(pg_err)?;
-        Ok(rows.iter().map(row_to_memory).collect())
-    }
-
-    fn list_topics(&self) -> IcmResult<Vec<(String, usize)>> {
-        self.list_topics_with_prefix(None)
-    }
-
-    fn consolidate_topic(&self, topic: &str, consolidated: Memory) -> IcmResult<()> {
-        if self.readonly {
-            return Err(IcmError::ReadOnly("consolidate_topic".into()));
-        }
-        // The consolidated memory goes through the same validation as any
-        // other write — an MCP-provided consolidate summary previously
-        // bypassed every size/NUL check (same gap already closed on SQLite).
-        let consolidated = validate_and_normalize(consolidated)?;
-        let mut c = self.conn()?;
-        let mut tx = c.transaction().map_err(pg_err)?;
-        // Audit finding: `critical` memories are never deleted — same
-        // contract `apply_decay`/`prune` already honor, and the same fix
-        // already applied to SQLite's consolidate_topic. This unconditional
-        // DELETE previously wiped critical memories in a consolidated topic
-        // too.
-        // Manual-testing finding: captured before the delete, since
-        // afterward these rows are gone. Used to clean up any *other*
-        // memory's related_ids that pointed at them — same dangling-
-        // reference bug already fixed for the single-id `delete`.
-        let deleted_ids: Vec<String> = tx
-            .query(
-                "SELECT id FROM memories WHERE topic = $1 AND importance <> 'critical'",
-                &[&topic],
-            )
-            .map_err(pg_err)?
-            .iter()
-            .map(|row| row.get(0))
-            .collect();
-
-        tx.execute(
-            "DELETE FROM memories WHERE topic = $1 AND importance <> 'critical'",
-            &[&topic],
-        )
-        .map_err(pg_err)?;
-
-        if !deleted_ids.is_empty() {
-            tx.execute(
-                "UPDATE memories
-                    SET related_ids = (
-                        SELECT COALESCE(jsonb_agg(elem), '[]'::jsonb)::text
-                        FROM jsonb_array_elements_text(related_ids::jsonb) AS elem
-                        WHERE elem <> ALL($1::text[])
-                    )
-                    WHERE related_ids::jsonb ?| $1::text[]",
-                &[&deleted_ids],
-            )
-            .map_err(pg_err)?;
-        }
-
-        insert_or_merge_memory(&mut tx, &consolidated)?;
-        tx.commit().map_err(pg_err)?;
-        Ok(())
-    }
-
-    fn count(&self) -> IcmResult<usize> {
-        let mut c = self.conn()?;
-        let row = c
-            .query_one("SELECT COUNT(*) FROM memories", &[])
-            .map_err(pg_err)?;
-        let n: i64 = row.get(0);
-        Ok(n.max(0) as usize)
-    }
-
-    fn count_by_topic(&self, topic: &str) -> IcmResult<usize> {
-        let mut c = self.conn()?;
-        let row = c
-            .query_one("SELECT COUNT(*) FROM memories WHERE topic = $1", &[&topic])
-            .map_err(pg_err)?;
-        let n: i64 = row.get(0);
-        Ok(n.max(0) as usize)
-    }
-
-    fn stats(&self) -> IcmResult<StoreStats> {
-        let mut c = self.conn()?;
-        let row = c
-            .query_one(
-                "SELECT COUNT(*)::bigint, COUNT(DISTINCT topic)::bigint, \
-                        COALESCE(AVG(weight), 0.0)::float8, MIN(created_at), MAX(created_at) \
-                 FROM memories",
-                &[],
-            )
-            .map_err(pg_err)?;
-        let total: i64 = row.get(0);
-        let topics: i64 = row.get(1);
-        let avg: f64 = row.get(2);
-        Ok(StoreStats {
-            total_memories: total.max(0) as usize,
-            total_topics: topics.max(0) as usize,
-            avg_weight: avg as f32,
-            oldest_memory: row.get(3),
-            newest_memory: row.get(4),
-        })
-    }
-
-    fn topic_health(&self, topic: &str) -> IcmResult<TopicHealth> {
-        let mut c = self.conn()?;
-        let row = c
-            .query_one(
-                "SELECT COUNT(*)::bigint,
-                        COALESCE(AVG(weight), 0)::float8,
-                        COALESCE(AVG(access_count::float8), 0)::float8,
-                        MIN(created_at), MAX(created_at), MAX(last_accessed),
-                        COALESCE(SUM(CASE WHEN weight < 0.5
-                              AND (now() - last_accessed) > interval '14 days'
-                              THEN 1 ELSE 0 END), 0)::bigint
-                 FROM memories WHERE topic = $1",
-                &[&topic],
-            )
-            .map_err(pg_err)?;
-
-        let entry_count: i64 = row.get(0);
-        if entry_count == 0 {
-            return Err(IcmError::NotFound(format!("topic: {topic}")));
-        }
-        let avg_weight: f64 = row.get(1);
-        let avg_access: f64 = row.get(2);
-        let stale: i64 = row.get(6);
-
-        Ok(TopicHealth {
-            topic: topic.to_string(),
-            entry_count: entry_count.max(0) as usize,
-            avg_weight: avg_weight as f32,
-            avg_access_count: avg_access as f32,
-            oldest: row.get(3),
-            newest: row.get(4),
-            last_accessed: row.get(5),
-            needs_consolidation: entry_count > 5,
-            stale_count: stale.max(0) as usize,
-        })
-    }
-}
-
-// ---------------------------------------------------------------------------
-// Unsupported subsystems on this backend (first cut, issue #301).
-//
-// These return `IcmError::Unsupported` so the binary keeps working for the
-// core shared-memory use case while the heavier subsystems remain on the
-// default SQLite backend. A follow-up can port them.
-// ---------------------------------------------------------------------------
-
-fn unsupported<T>(op: &str) -> IcmResult<T> {
-    Err(IcmError::Unsupported(format!(
-        "{op} (use the default SQLite backend)"
-    )))
-}
-
-impl MemoirStore for PostgresStore {
-    fn create_memoir(&self, _memoir: Memoir) -> IcmResult<String> {
-        unsupported("memoir.create_memoir")
-    }
-    fn get_memoir(&self, _id: &str) -> IcmResult<Option<Memoir>> {
-        unsupported("memoir.get_memoir")
-    }
-    fn get_memoir_by_name(&self, _name: &str) -> IcmResult<Option<Memoir>> {
-        unsupported("memoir.get_memoir_by_name")
-    }
-    fn update_memoir(&self, _memoir: &Memoir) -> IcmResult<()> {
-        unsupported("memoir.update_memoir")
-    }
-    fn delete_memoir(&self, _id: &str) -> IcmResult<()> {
-        unsupported("memoir.delete_memoir")
-    }
-    fn list_memoirs(&self) -> IcmResult<Vec<Memoir>> {
-        unsupported("memoir.list_memoirs")
-    }
-    fn add_concept(&self, _concept: Concept) -> IcmResult<String> {
-        unsupported("memoir.add_concept")
-    }
-    fn get_concept(&self, _id: &str) -> IcmResult<Option<Concept>> {
-        unsupported("memoir.get_concept")
-    }
-    fn get_concept_by_name(&self, _memoir_id: &str, _name: &str) -> IcmResult<Option<Concept>> {
-        unsupported("memoir.get_concept_by_name")
-    }
-    fn update_concept(&self, _concept: &Concept) -> IcmResult<()> {
-        unsupported("memoir.update_concept")
-    }
-    fn delete_concept(&self, _id: &str) -> IcmResult<()> {
-        unsupported("memoir.delete_concept")
-    }
-    fn list_concepts(&self, _memoir_id: &str) -> IcmResult<Vec<Concept>> {
-        unsupported("memoir.list_concepts")
-    }
-    fn search_concepts_fts(
-        &self,
-        _memoir_id: &str,
-        _query: &str,
-        _limit: usize,
-    ) -> IcmResult<Vec<Concept>> {
-        unsupported("memoir.search_concepts_fts")
-    }
-    fn search_concepts_by_label(
-        &self,
-        _memoir_id: &str,
-        _label: &Label,
-        _limit: usize,
-    ) -> IcmResult<Vec<Concept>> {
-        unsupported("memoir.search_concepts_by_label")
-    }
-    fn search_all_concepts_fts(&self, _query: &str, _limit: usize) -> IcmResult<Vec<Concept>> {
-        unsupported("memoir.search_all_concepts_fts")
-    }
-    fn refine_concept(
-        &self,
-        _id: &str,
-        _new_definition: &str,
-        _new_source_ids: &[String],
-    ) -> IcmResult<()> {
-        unsupported("memoir.refine_concept")
-    }
-    fn add_link(&self, _link: ConceptLink) -> IcmResult<String> {
-        unsupported("memoir.add_link")
-    }
-    fn get_links_from(&self, _concept_id: &str) -> IcmResult<Vec<ConceptLink>> {
-        unsupported("memoir.get_links_from")
-    }
-    fn get_links_to(&self, _concept_id: &str) -> IcmResult<Vec<ConceptLink>> {
-        unsupported("memoir.get_links_to")
-    }
-    fn delete_link(&self, _id: &str) -> IcmResult<()> {
-        unsupported("memoir.delete_link")
-    }
-    fn get_neighbors(
-        &self,
-        _concept_id: &str,
-        _relation: Option<Relation>,
-    ) -> IcmResult<Vec<Concept>> {
-        unsupported("memoir.get_neighbors")
-    }
-    fn get_neighborhood(
-        &self,
-        _concept_id: &str,
-        _depth: usize,
-    ) -> IcmResult<(Vec<Concept>, Vec<ConceptLink>)> {
-        unsupported("memoir.get_neighborhood")
-    }
-    fn get_links_for_memoir(&self, _memoir_id: &str) -> IcmResult<Vec<ConceptLink>> {
-        unsupported("memoir.get_links_for_memoir")
-    }
-    fn memoir_stats(&self, _memoir_id: &str) -> IcmResult<MemoirStats> {
-        unsupported("memoir.memoir_stats")
-    }
-    fn batch_memoir_concept_counts(&self) -> IcmResult<HashMap<String, usize>> {
-        unsupported("memoir.batch_memoir_concept_counts")
-    }
-}
-
-impl FeedbackStore for PostgresStore {
-    fn store_feedback(&self, _feedback: Feedback) -> IcmResult<String> {
-        unsupported("feedback.store_feedback")
-    }
-    fn search_feedback(
-        &self,
-        _query: &str,
-        _query_embedding: Option<&[f32]>,
-        _topic: Option<&str>,
-        _limit: usize,
-    ) -> IcmResult<Vec<Feedback>> {
-        unsupported("feedback.search_feedback")
-    }
-    fn list_feedback(&self, _topic: Option<&str>, _limit: usize) -> IcmResult<Vec<Feedback>> {
-        unsupported("feedback.list_feedback")
-    }
-    fn increment_applied(&self, _id: &str) -> IcmResult<()> {
-        unsupported("feedback.increment_applied")
-    }
-    fn delete_feedback(&self, _id: &str) -> IcmResult<()> {
-        unsupported("feedback.delete_feedback")
-    }
-    fn feedback_stats(&self) -> IcmResult<FeedbackStats> {
-        unsupported("feedback.feedback_stats")
-    }
-}
-
-impl FactsStore for PostgresStore {
-    fn set_fact(
-        &self,
-        _entity: &str,
-        _key: &str,
-        _value: &str,
-        _source: &str,
-    ) -> IcmResult<String> {
-        unsupported("facts.set_fact")
-    }
-    fn get_fact(&self, _entity: &str, _key: &str) -> IcmResult<Option<Fact>> {
-        unsupported("facts.get_fact")
-    }
-    fn list_facts(&self, _entity: &str, _key_prefix: Option<&str>) -> IcmResult<Vec<Fact>> {
-        unsupported("facts.list_facts")
-    }
-    fn history(&self, _entity: &str, _key: &str) -> IcmResult<Vec<Fact>> {
-        unsupported("facts.history")
-    }
-    fn forget_fact(&self, _entity: &str, _key: &str) -> IcmResult<usize> {
-        unsupported("facts.forget_fact")
-    }
-    fn facts_stats(&self) -> IcmResult<FactsStats> {
-        unsupported("facts.facts_stats")
-    }
-}
-
-impl TranscriptStore for PostgresStore {
-    fn create_session(
-        &self,
-        _agent: &str,
-        _project: Option<&str>,
-        _metadata: Option<&str>,
-    ) -> IcmResult<String> {
-        unsupported("transcript.create_session")
-    }
-    fn ensure_session(
-        &self,
-        _id: &str,
-        _agent: &str,
-        _project: Option<&str>,
-        _metadata: Option<&str>,
-    ) -> IcmResult<String> {
-        unsupported("transcript.ensure_session")
-    }
-    fn get_session(&self, _id: &str) -> IcmResult<Option<Session>> {
-        unsupported("transcript.get_session")
-    }
-    fn list_sessions(&self, _project: Option<&str>, _limit: usize) -> IcmResult<Vec<Session>> {
-        unsupported("transcript.list_sessions")
-    }
-    fn record_message(
-        &self,
-        _session_id: &str,
-        _role: Role,
-        _content: &str,
-        _tool_name: Option<&str>,
-        _tokens: Option<i64>,
-        _metadata: Option<&str>,
-    ) -> IcmResult<String> {
-        unsupported("transcript.record_message")
-    }
-    fn list_session_messages(
-        &self,
-        _session_id: &str,
-        _limit: usize,
-        _offset: usize,
-    ) -> IcmResult<Vec<Message>> {
-        unsupported("transcript.list_session_messages")
-    }
-    fn search_transcripts(
-        &self,
-        _query: &str,
-        _session_id: Option<&str>,
-        _project: Option<&str>,
-        _limit: usize,
-    ) -> IcmResult<Vec<TranscriptHit>> {
-        unsupported("transcript.search_transcripts")
-    }
-    fn forget_session(&self, _id: &str) -> IcmResult<()> {
-        unsupported("transcript.forget_session")
-    }
-    fn transcript_stats(&self) -> IcmResult<TranscriptStats> {
-        unsupported("transcript.transcript_stats")
-    }
-}
-
-#[cfg(test)]
-mod tests {
-    use super::*;
-
-    /// Audit regression: a keyword containing `%`/`_` was interpolated
-    /// straight into an ILIKE pattern unescaped, turning it into an
-    /// unintended wildcard.
-    #[test]
-    fn test_escape_like_wildcards() {
-        assert_eq!(escape_like_wildcards("100%"), "100\\%");
-        assert_eq!(escape_like_wildcards("snake_case"), "snake\\_case");
-        assert_eq!(escape_like_wildcards("back\\slash"), "back\\\\slash");
-        assert_eq!(escape_like_wildcards("plain"), "plain");
-    }
-
-    /// Audit regression: `apply_decay`'s raw multiplier goes negative for
-    /// `low` importance + low access count at factor < 0.5 (still inside
-    /// the CLI's own validated [0.0, 1.0) range). This reproduces the exact
-    /// arithmetic the SQL `GREATEST(0.0, ...)` clamp now guards, as a plain
-    /// Rust assertion (no live Postgres needed to prove the formula itself
-    /// would go negative without the clamp).
-    #[test]
-    fn test_apply_decay_formula_would_go_negative_without_clamp() {
-        let factor: f64 = 0.4;
-        let mult: f64 = 2.0; // low importance
-        let access: f64 = 0.0;
-        let raw = 1.0 - (1.0 - factor) * mult / (1.0 + access * 0.1);
-        assert!(
-            raw < 0.0,
-            "expected the pre-clamp formula to go negative, got {raw}"
-        );
-        assert_eq!(
-            raw.max(0.0),
-            0.0,
-            "GREATEST(0.0, ...) must clamp this to 0.0"
-        );
-    }
-}
diff --git a/crates/icm-store/src/postgres/connection.rs b/crates/icm-store/src/postgres/connection.rs
new file mode 100644
index 00000000..114598fc
--- /dev/null
+++ b/crates/icm-store/src/postgres/connection.rs
@@ -0,0 +1,260 @@
+//! PostgreSQL backend -- split out of the former monolithic postgres.rs.
+//!
+//! Connection setup, constructors, and schema migration.
+
+use super::*;
+
+impl PostgresStore {
+    pub(crate) fn conn(&self) -> IcmResult<MutexGuard<'_, Client>> {
+        self.client.lock().map_err(|_| lock_err())
+    }
+
+    /// Resolve the connection string from the environment.
+    pub(crate) fn conn_string() -> IcmResult<String> {
+        std::env::var("ICM_POSTGRES_URL")
+            .or_else(|_| std::env::var("DATABASE_URL"))
+            .map_err(|_| {
+                IcmError::Config(
+                    "PostgreSQL backend: set ICM_POSTGRES_URL (or DATABASE_URL) to the \
+                     connection string, e.g. postgres://user:pass@host:5432/icm"
+                        .into(),
+                )
+            })
+    }
+
+    /// Connect and run the idempotent schema migration.
+    ///
+    /// The `&Path` the CLI passes for the SQLite file is ignored; the
+    /// connection comes from the environment. `requested_dims` is used
+    /// only when the database is fresh — an existing database's stored
+    /// `embedding_dims` is authoritative so we never try to declare a
+    /// `vector(N)` column that disagrees with the live table.
+    pub(crate) fn connect(requested_dims: usize, readonly: bool) -> IcmResult<Self> {
+        let url = Self::conn_string()?;
+        let mut client = Client::connect(&url, NoTls)
+            .map_err(|e| IcmError::Database(format!("cannot connect to PostgreSQL: {e}")))?;
+
+        let dims = init_schema(&mut client, requested_dims)?;
+
+        Ok(Self {
+            client: Mutex::new(client),
+            embedding_dims: dims,
+            readonly,
+        })
+    }
+
+    /// Reject an embedding whose length disagrees with the column's
+    /// declared dimension, with a clearer message than the raw PostgreSQL
+    /// "expected N dimensions, not M" error.
+    pub(crate) fn check_dims(&self, memory: &Memory) -> IcmResult<()> {
+        if let Some(emb) = memory.embedding.as_ref() {
+            if emb.len() != self.embedding_dims {
+                return Err(IcmError::InvalidInput(format!(
+                    "embedding has {} dimensions, but this store uses {}",
+                    emb.len(),
+                    self.embedding_dims
+                )));
+            }
+        }
+        Ok(())
+    }
+
+    /// Open or create a store with the default embedding dimension.
+    pub fn new(_path: &Path) -> IcmResult<Self> {
+        Self::connect(icm_core::DEFAULT_EMBEDDING_DIMS, false)
+    }
+
+    /// Open or create a store with a specific embedding dimension.
+    pub fn with_dims(_path: &Path, embedding_dims: usize) -> IcmResult<Self> {
+        Self::connect(embedding_dims, false)
+    }
+
+    /// Open the store in read-only mode (issue #263). The connection is
+    /// the same; write methods refuse, read-like side effects are skipped.
+    pub fn open_readonly(_path: &Path) -> IcmResult<Self> {
+        Self::connect(icm_core::DEFAULT_EMBEDDING_DIMS, true)
+    }
+
+    /// PostgreSQL has no in-memory mode; connect to the configured
+    /// database. Provided for API parity with the SQLite backend.
+    pub fn in_memory() -> IcmResult<Self> {
+        Self::connect(icm_core::DEFAULT_EMBEDDING_DIMS, false)
+    }
+
+    /// See [`Self::in_memory`].
+    pub fn in_memory_with_dims(embedding_dims: usize) -> IcmResult<Self> {
+        Self::connect(embedding_dims, false)
+    }
+
+    /// PostgreSQL stores `embedding_dims` in `icm_metadata`, but unlike
+    /// SQLite it never destructively recreates the vector column, so the
+    /// pre-open peek the SQLite backend needs is unnecessary here. Always
+    /// returns `Ok(None)` so callers fall through to the normal open path.
+    pub fn read_stored_embedding_dims(_path: &Path) -> IcmResult<Option<usize>> {
+        Ok(None)
+    }
+
+    #[must_use]
+    pub fn is_readonly(&self) -> bool {
+        self.readonly
+    }
+
+    /// No-op on PostgreSQL (the SQLite backend uses this to load the
+    /// `sqlite-vec` extension; `pgvector` lives server-side).
+    pub fn ensure_vec_init() {}
+}
+
+/// Idempotent schema creation. Returns the embedding dimension the table
+/// is actually using (the stored value wins over `requested_dims` on an
+/// existing database).
+fn init_schema(client: &mut Client, requested_dims: usize) -> IcmResult<usize> {
+    if !(64..=4096).contains(&requested_dims) {
+        return Err(IcmError::Config(format!(
+            "embedding_dims must be between 64 and 4096, got {requested_dims}"
+        )));
+    }
+
+    client
+        .batch_execute("CREATE EXTENSION IF NOT EXISTS vector")
+        .map_err(|e| {
+            IcmError::Database(format!(
+                "cannot enable the pgvector extension (need it for embeddings): {e}"
+            ))
+        })?;
+
+    client
+        .batch_execute(
+            "CREATE TABLE IF NOT EXISTS icm_metadata (
+                key TEXT PRIMARY KEY,
+                value TEXT
+            )",
+        )
+        .map_err(pg_err)?;
+
+    // The stored dimension is authoritative on an existing database.
+    let stored: Option<i64> = client
+        .query_opt(
+            "SELECT value::bigint FROM icm_metadata WHERE key = 'embedding_dims'",
+            &[],
+        )
+        .map_err(pg_err)?
+        .map(|row| row.get(0));
+    let dims = stored.map(|d| d as usize).unwrap_or(requested_dims);
+
+    // Migration: the unique index used to be `(LOWER(topic), summary_hash)`.
+    // `summary_hash` already encodes the topic via Rust's Unicode-correct
+    // `to_lowercase()`, while Postgres's `LOWER()` behavior depends on the
+    // cluster's locale (ASCII-only under `C`/POSIX, common in minimal
+    // Docker/CI images) — the composite key could let two rows with an
+    // identical `summary_hash` coexist whenever their topic's SQL-LOWER()
+    // forms differed under that locale (audit finding, same class already
+    // fixed for SQLite). `CREATE INDEX IF NOT EXISTS` would silently keep
+    // the old definition on an already-migrated DB (same index name), so
+    // drop it first if it still has the old column list.
+    let old_index_def: Option<String> = client
+        .query_opt(
+            "SELECT indexdef FROM pg_indexes WHERE indexname = 'idx_memories_topic_hash'",
+            &[],
+        )
+        .map_err(pg_err)?
+        .map(|row| row.get(0));
+    if let Some(def) = old_index_def {
+        if def.to_lowercase().contains("lower(topic") {
+            client
+                .batch_execute("DROP INDEX idx_memories_topic_hash;")
+                .map_err(pg_err)?;
+        }
+    }
+
+    client
+        .batch_execute(&format!(
+            "CREATE TABLE IF NOT EXISTS memories (
+                id TEXT PRIMARY KEY,
+                created_at TIMESTAMPTZ NOT NULL,
+                updated_at TIMESTAMPTZ NOT NULL,
+                last_accessed TIMESTAMPTZ NOT NULL,
+                access_count INTEGER NOT NULL DEFAULT 0,
+                weight REAL NOT NULL DEFAULT 1.0,
+                topic TEXT NOT NULL,
+                summary TEXT NOT NULL,
+                raw_excerpt TEXT,
+                keywords TEXT,
+                importance TEXT NOT NULL,
+                source_type TEXT NOT NULL,
+                source_data TEXT,
+                related_ids TEXT,
+                summary_hash TEXT,
+                embedding vector({dims}),
+                fts tsvector GENERATED ALWAYS AS (
+                    to_tsvector('simple',
+                        coalesce(topic, '') || ' ' ||
+                        coalesce(summary, '') || ' ' ||
+                        coalesce(keywords, ''))
+                ) STORED
+            );
+
+            CREATE INDEX IF NOT EXISTS idx_memories_topic ON memories(topic);
+            CREATE INDEX IF NOT EXISTS idx_memories_weight ON memories(weight);
+            CREATE INDEX IF NOT EXISTS idx_memories_created ON memories(created_at);
+            CREATE INDEX IF NOT EXISTS idx_memories_fts ON memories USING GIN (fts);
+            CREATE UNIQUE INDEX IF NOT EXISTS idx_memories_topic_hash
+                ON memories (summary_hash) WHERE summary_hash IS NOT NULL;
+
+            CREATE TABLE IF NOT EXISTS pending_extractions (
+                id TEXT PRIMARY KEY,
+                project TEXT NOT NULL,
+                tool_name TEXT NOT NULL,
+                raw_output TEXT NOT NULL,
+                captured_at TIMESTAMPTZ NOT NULL
+            );
+
+            CREATE TABLE IF NOT EXISTS code_areas (
+                id BIGSERIAL PRIMARY KEY,
+                project TEXT NOT NULL,
+                file_path TEXT NOT NULL,
+                description TEXT,
+                session_id TEXT,
+                tool_name TEXT,
+                touch_count BIGINT NOT NULL DEFAULT 1,
+                first_touched_at TIMESTAMPTZ NOT NULL,
+                last_touched_at TIMESTAMPTZ NOT NULL,
+                UNIQUE (project, file_path)
+            );
+
+            CREATE TABLE IF NOT EXISTS hook_events (
+                id BIGSERIAL PRIMARY KEY,
+                ts TIMESTAMPTZ NOT NULL,
+                event TEXT NOT NULL,
+                project TEXT,
+                session_id TEXT,
+                tool_name TEXT,
+                duration_ms BIGINT,
+                exit_code INTEGER NOT NULL DEFAULT 0,
+                payload_size BIGINT,
+                note TEXT
+            );
+            CREATE INDEX IF NOT EXISTS idx_hook_events_ts ON hook_events(ts);
+            CREATE INDEX IF NOT EXISTS idx_hook_events_event ON hook_events(event);"
+        ))
+        .map_err(pg_err)?;
+
+    // A vector index needs a concrete dimension; create it after the
+    // table exists. HNSW is available in pgvector >= 0.5 (the images we
+    // target ship a newer version).
+    client
+        .batch_execute(
+            "CREATE INDEX IF NOT EXISTS idx_memories_embedding
+                ON memories USING hnsw (embedding vector_cosine_ops)",
+        )
+        .map_err(pg_err)?;
+
+    client
+        .execute(
+            "INSERT INTO icm_metadata (key, value) VALUES ('embedding_dims', $1)
+             ON CONFLICT (key) DO NOTHING",
+            &[&dims.to_string()],
+        )
+        .map_err(pg_err)?;
+
+    Ok(dims)
+}
diff --git a/crates/icm-store/src/postgres/facts.rs b/crates/icm-store/src/postgres/facts.rs
new file mode 100644
index 00000000..a8b8541c
--- /dev/null
+++ b/crates/icm-store/src/postgres/facts.rs
@@ -0,0 +1,32 @@
+//! PostgreSQL backend -- split out of the former monolithic postgres.rs.
+//!
+//! Unsupported on this backend (issue #301) -- see mod.rs.
+
+use super::*;
+
+impl FactsStore for PostgresStore {
+    fn set_fact(
+        &self,
+        _entity: &str,
+        _key: &str,
+        _value: &str,
+        _source: &str,
+    ) -> IcmResult<String> {
+        unsupported("facts.set_fact")
+    }
+    fn get_fact(&self, _entity: &str, _key: &str) -> IcmResult<Option<Fact>> {
+        unsupported("facts.get_fact")
+    }
+    fn list_facts(&self, _entity: &str, _key_prefix: Option<&str>) -> IcmResult<Vec<Fact>> {
+        unsupported("facts.list_facts")
+    }
+    fn history(&self, _entity: &str, _key: &str) -> IcmResult<Vec<Fact>> {
+        unsupported("facts.history")
+    }
+    fn forget_fact(&self, _entity: &str, _key: &str) -> IcmResult<usize> {
+        unsupported("facts.forget_fact")
+    }
+    fn facts_stats(&self) -> IcmResult<FactsStats> {
+        unsupported("facts.facts_stats")
+    }
+}
diff --git a/crates/icm-store/src/postgres/feedback.rs b/crates/icm-store/src/postgres/feedback.rs
new file mode 100644
index 00000000..96a78b44
--- /dev/null
+++ b/crates/icm-store/src/postgres/feedback.rs
@@ -0,0 +1,32 @@
+//! PostgreSQL backend -- split out of the former monolithic postgres.rs.
+//!
+//! Unsupported on this backend (issue #301) -- see mod.rs.
+
+use super::*;
+
+impl FeedbackStore for PostgresStore {
+    fn store_feedback(&self, _feedback: Feedback) -> IcmResult<String> {
+        unsupported("feedback.store_feedback")
+    }
+    fn search_feedback(
+        &self,
+        _query: &str,
+        _query_embedding: Option<&[f32]>,
+        _topic: Option<&str>,
+        _limit: usize,
+    ) -> IcmResult<Vec<Feedback>> {
+        unsupported("feedback.search_feedback")
+    }
+    fn list_feedback(&self, _topic: Option<&str>, _limit: usize) -> IcmResult<Vec<Feedback>> {
+        unsupported("feedback.list_feedback")
+    }
+    fn increment_applied(&self, _id: &str) -> IcmResult<()> {
+        unsupported("feedback.increment_applied")
+    }
+    fn delete_feedback(&self, _id: &str) -> IcmResult<()> {
+        unsupported("feedback.delete_feedback")
+    }
+    fn feedback_stats(&self) -> IcmResult<FeedbackStats> {
+        unsupported("feedback.feedback_stats")
+    }
+}
diff --git a/crates/icm-store/src/postgres/hooks.rs b/crates/icm-store/src/postgres/hooks.rs
new file mode 100644
index 00000000..e16589c6
--- /dev/null
+++ b/crates/icm-store/src/postgres/hooks.rs
@@ -0,0 +1,335 @@
+//! PostgreSQL backend -- split out of the former monolithic postgres.rs.
+//!
+//! Hook telemetry, the extraction queue, and code areas.
+
+use super::*;
+
+impl PostgresStore {
+    /// Atomically increment the hook call counter and return the new value.
+    pub fn increment_hook_counter(&self) -> IcmResult<usize> {
+        let mut c = self.conn()?;
+        let row = c
+            .query_one(
+                "INSERT INTO icm_metadata (key, value) VALUES ('hook_counter', '1')
+                 ON CONFLICT (key) DO UPDATE SET value = ((icm_metadata.value::bigint) + 1)::text
+                 RETURNING value::bigint",
+                &[],
+            )
+            .map_err(pg_err)?;
+        let n: i64 = row.get(0);
+        Ok(n.max(0) as usize)
+    }
+
+    /// Reset the hook call counter to 0.
+    pub fn reset_hook_counter(&self) -> IcmResult<()> {
+        let mut c = self.conn()?;
+        c.execute(
+            "INSERT INTO icm_metadata (key, value) VALUES ('hook_counter', '0')
+             ON CONFLICT (key) DO UPDATE SET value = '0'",
+            &[],
+        )
+        .map_err(pg_err)?;
+        Ok(())
+    }
+
+    // Async extraction queue
+
+    /// Enqueue raw tool output for later LLM extraction.
+    pub fn enqueue_pending_extraction(
+        &self,
+        project: &str,
+        tool_name: &str,
+        raw_output: &str,
+    ) -> IcmResult<String> {
+        let id = ulid::Ulid::new().to_string();
+        let mut c = self.conn()?;
+        c.execute(
+            "INSERT INTO pending_extractions (id, project, tool_name, raw_output, captured_at)
+             VALUES ($1, $2, $3, $4, $5)",
+            &[&id, &project, &tool_name, &raw_output, &Utc::now()],
+        )
+        .map_err(pg_err)?;
+        Ok(id)
+    }
+
+    /// Pop up to `limit` oldest pending rows (FIFO by capture time).
+    pub fn list_pending_extractions(&self, limit: usize) -> IcmResult<Vec<PendingRow>> {
+        let mut c = self.conn()?;
+        let rows = c
+            .query(
+                "SELECT id, project, tool_name, raw_output, captured_at
+                 FROM pending_extractions
+                 ORDER BY captured_at ASC
+                 LIMIT $1",
+                &[&(limit as i64)],
+            )
+            .map_err(pg_err)?;
+        Ok(rows
+            .iter()
+            .map(|row| {
+                let captured: DateTime<Utc> = row.get(4);
+                (
+                    row.get(0),
+                    row.get(1),
+                    row.get(2),
+                    row.get(3),
+                    captured.to_rfc3339(),
+                )
+            })
+            .collect())
+    }
+
+    /// Delete pending rows by id. Used after a worker has processed them.
+    pub fn delete_pending_extractions(&self, ids: &[String]) -> IcmResult<usize> {
+        if ids.is_empty() {
+            return Ok(0);
+        }
+        let ids_vec: Vec<String> = ids.to_vec();
+        let mut c = self.conn()?;
+        let n = c
+            .execute(
+                "DELETE FROM pending_extractions WHERE id = ANY($1)",
+                &[&ids_vec],
+            )
+            .map_err(pg_err)?;
+        Ok(n as usize)
+    }
+
+    /// Total rows currently waiting in the queue.
+    pub fn pending_extraction_count(&self) -> IcmResult<usize> {
+        let mut c = self.conn()?;
+        let row = c
+            .query_one("SELECT COUNT(*) FROM pending_extractions", &[])
+            .map_err(pg_err)?;
+        let n: i64 = row.get(0);
+        Ok(n.max(0) as usize)
+    }
+
+    // Code areas (issue #196)
+
+    /// Insert or refresh a row for `(project, file_path)`.
+    pub fn upsert_code_area(
+        &self,
+        project: &str,
+        file_path: &str,
+        description: Option<&str>,
+        session_id: Option<&str>,
+        tool_name: Option<&str>,
+    ) -> IcmResult<()> {
+        let now = Utc::now();
+        let mut c = self.conn()?;
+        c.execute(
+            "INSERT INTO code_areas
+                (project, file_path, description, session_id, tool_name,
+                 touch_count, first_touched_at, last_touched_at)
+             VALUES ($1, $2, $3, $4, $5, 1, $6, $6)
+             ON CONFLICT (project, file_path) DO UPDATE SET
+                touch_count = code_areas.touch_count + 1,
+                last_touched_at = EXCLUDED.last_touched_at,
+                session_id = COALESCE(EXCLUDED.session_id, code_areas.session_id),
+                tool_name = COALESCE(EXCLUDED.tool_name, code_areas.tool_name),
+                description = COALESCE(EXCLUDED.description, code_areas.description)",
+            &[
+                &project,
+                &file_path,
+                &description,
+                &session_id,
+                &tool_name,
+                &now,
+            ],
+        )
+        .map_err(pg_err)?;
+        Ok(())
+    }
+
+    /// List code areas, optionally filtered, newest-touch first.
+    pub fn list_code_areas(
+        &self,
+        project: Option<&str>,
+        in_file: Option<&str>,
+        since: Option<DateTime<Utc>>,
+        limit: usize,
+    ) -> IcmResult<Vec<CodeArea>> {
+        let mut sql = String::from(
+            "SELECT id, project, file_path, description, session_id, tool_name,
+                    touch_count, first_touched_at, last_touched_at
+             FROM code_areas WHERE TRUE",
+        );
+        let mut owned: Vec<Box<dyn ToSql + Sync>> = Vec::new();
+        if let Some(p) = project {
+            owned.push(Box::new(p.to_string()));
+            sql.push_str(&format!(" AND project = ${}", owned.len()));
+        }
+        if let Some(f) = in_file {
+            owned.push(Box::new(f.to_string()));
+            let exact = owned.len();
+            owned.push(Box::new(format!("%/{f}")));
+            let suffix = owned.len();
+            sql.push_str(&format!(
+                " AND (file_path = ${exact} OR file_path LIKE ${suffix})"
+            ));
+        }
+        if let Some(t) = since {
+            owned.push(Box::new(t));
+            sql.push_str(&format!(" AND last_touched_at >= ${}", owned.len()));
+        }
+        owned.push(Box::new(limit as i64));
+        sql.push_str(&format!(
+            " ORDER BY last_touched_at DESC LIMIT ${}",
+            owned.len()
+        ));
+
+        let params: Vec<&(dyn ToSql + Sync)> = owned.iter().map(|b| b.as_ref()).collect();
+        let mut c = self.conn()?;
+        let rows = c.query(&sql, &params).map_err(pg_err)?;
+        Ok(rows
+            .iter()
+            .map(|row| CodeArea {
+                id: row.get(0),
+                project: row.get(1),
+                file_path: row.get(2),
+                description: row.get(3),
+                session_id: row.get(4),
+                tool_name: row.get(5),
+                touch_count: row.get(6),
+                first_touched_at: row.get(7),
+                last_touched_at: row.get(8),
+            })
+            .collect())
+    }
+
+    /// Total rows in `code_areas`.
+    pub fn code_area_count(&self) -> IcmResult<usize> {
+        let mut c = self.conn()?;
+        let row = c
+            .query_one("SELECT COUNT(*) FROM code_areas", &[])
+            .map_err(pg_err)?;
+        let n: i64 = row.get(0);
+        Ok(n.max(0) as usize)
+    }
+
+    // Hook telemetry
+
+    /// Append one hook telemetry row, returning its id.
+    pub fn record_hook_event(&self, ev: &HookEventInsert) -> IcmResult<i64> {
+        let mut c = self.conn()?;
+        let row = c
+            .query_one(
+                "INSERT INTO hook_events
+                 (ts, event, project, session_id, tool_name,
+                  duration_ms, exit_code, payload_size, note)
+                 VALUES ($1, $2, $3, $4, $5, $6, $7, $8, $9)
+                 RETURNING id",
+                &[
+                    &Utc::now(),
+                    &ev.event,
+                    &ev.project,
+                    &ev.session_id,
+                    &ev.tool_name,
+                    &ev.duration_ms,
+                    &ev.exit_code,
+                    &ev.payload_size,
+                    &ev.note,
+                ],
+            )
+            .map_err(pg_err)?;
+        Ok(row.get(0))
+    }
+
+    /// Most recent `limit` hook events, newest first; optional event filter.
+    pub fn hook_events_recent(
+        &self,
+        limit: usize,
+        event_filter: Option<&str>,
+    ) -> IcmResult<Vec<HookEvent>> {
+        let mut c = self.conn()?;
+        let rows = match event_filter {
+            Some(ev) => c.query(
+                "SELECT id, ts, event, project, session_id, tool_name,
+                        duration_ms, exit_code, payload_size, note
+                 FROM hook_events WHERE event = $1 ORDER BY id DESC LIMIT $2",
+                &[&ev, &(limit as i64)],
+            ),
+            None => c.query(
+                "SELECT id, ts, event, project, session_id, tool_name,
+                        duration_ms, exit_code, payload_size, note
+                 FROM hook_events ORDER BY id DESC LIMIT $1",
+                &[&(limit as i64)],
+            ),
+        }
+        .map_err(pg_err)?;
+        Ok(rows
+            .iter()
+            .map(|row| HookEvent {
+                id: row.get(0),
+                ts: row.get(1),
+                event: row.get(2),
+                project: row.get(3),
+                session_id: row.get(4),
+                tool_name: row.get(5),
+                duration_ms: row.get(6),
+                exit_code: row.get(7),
+                payload_size: row.get(8),
+                note: row.get(9),
+            })
+            .collect())
+    }
+
+    /// Per-event aggregate stats since `since_rfc3339`.
+    pub fn hook_stats(&self, since_rfc3339: &str) -> IcmResult<Vec<HookStatsRow>> {
+        let since = DateTime::parse_from_rfc3339(since_rfc3339)
+            .map(|d| d.with_timezone(&Utc))
+            .unwrap_or_else(|_| Utc::now() - chrono::Duration::days(7));
+        let mut c = self.conn()?;
+        let rows = c
+            .query(
+                "SELECT event,
+                        COUNT(*)::bigint,
+                        COUNT(*) FILTER (WHERE exit_code <> 0)::bigint,
+                        COALESCE(AVG(duration_ms), 0)::float8,
+                        COALESCE(percentile_cont(0.5) WITHIN GROUP (ORDER BY duration_ms), 0)::float8,
+                        COALESCE(percentile_cont(0.99) WITHIN GROUP (ORDER BY duration_ms), 0)::float8
+                 FROM hook_events WHERE ts >= $1
+                 GROUP BY event ORDER BY event",
+                &[&since],
+            )
+            .map_err(pg_err)?;
+        Ok(rows
+            .iter()
+            .map(|row| {
+                let p50: f64 = row.get(4);
+                let p99: f64 = row.get(5);
+                HookStatsRow {
+                    event: row.get(0),
+                    count: row.get(1),
+                    error_count: row.get(2),
+                    avg_duration_ms: row.get(3),
+                    p50_duration_ms: p50 as i64,
+                    p99_duration_ms: p99 as i64,
+                }
+            })
+            .collect())
+    }
+
+    /// Delete hook events older than `cutoff_rfc3339`.
+    pub fn prune_hook_events(&self, cutoff_rfc3339: &str) -> IcmResult<usize> {
+        let cutoff = DateTime::parse_from_rfc3339(cutoff_rfc3339)
+            .map(|d| d.with_timezone(&Utc))
+            .map_err(|e| IcmError::InvalidInput(format!("invalid cutoff timestamp: {e}")))?;
+        let mut c = self.conn()?;
+        let n = c
+            .execute("DELETE FROM hook_events WHERE ts < $1", &[&cutoff])
+            .map_err(pg_err)?;
+        Ok(n as usize)
+    }
+
+    /// Total rows in `hook_events`.
+    pub fn hook_event_count(&self) -> IcmResult<usize> {
+        let mut c = self.conn()?;
+        let row = c
+            .query_one("SELECT COUNT(*) FROM hook_events", &[])
+            .map_err(pg_err)?;
+        let n: i64 = row.get(0);
+        Ok(n.max(0) as usize)
+    }
+}
diff --git a/crates/icm-store/src/postgres/maintenance.rs b/crates/icm-store/src/postgres/maintenance.rs
new file mode 100644
index 00000000..b852f8eb
--- /dev/null
+++ b/crates/icm-store/src/postgres/maintenance.rs
@@ -0,0 +1,31 @@
+//! PostgreSQL backend -- split out of the former monolithic postgres.rs.
+//!
+//! Decay/auto-consolidate maintenance methods.
+
+use super::*;
+
+impl PostgresStore {
+    /// Apply decay if more than 24 hours since the last run. Mirrors the
+    /// SQLite backend's atomic check-and-claim via `icm_metadata`.
+    pub fn maybe_auto_decay(&self) -> IcmResult<()> {
+        if self.readonly {
+            return Ok(());
+        }
+        let now = Utc::now();
+        let claimed = {
+            let mut c = self.conn()?;
+            c.execute(
+                "INSERT INTO icm_metadata (key, value) VALUES ('last_decay_at', $1)
+                 ON CONFLICT (key) DO UPDATE SET value = $1
+                 WHERE icm_metadata.value IS NULL
+                    OR ($1::timestamptz - icm_metadata.value::timestamptz) >= interval '1 day'",
+                &[&now.to_rfc3339()],
+            )
+            .map_err(pg_err)?
+        };
+        if claimed > 0 {
+            self.apply_decay(0.95)?;
+        }
+        Ok(())
+    }
+}
diff --git a/crates/icm-store/src/postgres/memoir.rs b/crates/icm-store/src/postgres/memoir.rs
new file mode 100644
index 00000000..21605921
--- /dev/null
+++ b/crates/icm-store/src/postgres/memoir.rs
@@ -0,0 +1,106 @@
+//! PostgreSQL backend -- split out of the former monolithic postgres.rs.
+//!
+//! Unsupported on this backend (issue #301) -- see mod.rs.
+
+use super::*;
+
+impl MemoirStore for PostgresStore {
+    fn create_memoir(&self, _memoir: Memoir) -> IcmResult<String> {
+        unsupported("memoir.create_memoir")
+    }
+    fn get_memoir(&self, _id: &str) -> IcmResult<Option<Memoir>> {
+        unsupported("memoir.get_memoir")
+    }
+    fn get_memoir_by_name(&self, _name: &str) -> IcmResult<Option<Memoir>> {
+        unsupported("memoir.get_memoir_by_name")
+    }
+    fn update_memoir(&self, _memoir: &Memoir) -> IcmResult<()> {
+        unsupported("memoir.update_memoir")
+    }
+    fn delete_memoir(&self, _id: &str) -> IcmResult<()> {
+        unsupported("memoir.delete_memoir")
+    }
+    fn list_memoirs(&self) -> IcmResult<Vec<Memoir>> {
+        unsupported("memoir.list_memoirs")
+    }
+    fn add_concept(&self, _concept: Concept) -> IcmResult<String> {
+        unsupported("memoir.add_concept")
+    }
+    fn get_concept(&self, _id: &str) -> IcmResult<Option<Concept>> {
+        unsupported("memoir.get_concept")
+    }
+    fn get_concept_by_name(&self, _memoir_id: &str, _name: &str) -> IcmResult<Option<Concept>> {
+        unsupported("memoir.get_concept_by_name")
+    }
+    fn update_concept(&self, _concept: &Concept) -> IcmResult<()> {
+        unsupported("memoir.update_concept")
+    }
+    fn delete_concept(&self, _id: &str) -> IcmResult<()> {
+        unsupported("memoir.delete_concept")
+    }
+    fn list_concepts(&self, _memoir_id: &str) -> IcmResult<Vec<Concept>> {
+        unsupported("memoir.list_concepts")
+    }
+    fn search_concepts_fts(
+        &self,
+        _memoir_id: &str,
+        _query: &str,
+        _limit: usize,
+    ) -> IcmResult<Vec<Concept>> {
+        unsupported("memoir.search_concepts_fts")
+    }
+    fn search_concepts_by_label(
+        &self,
+        _memoir_id: &str,
+        _label: &Label,
+        _limit: usize,
+    ) -> IcmResult<Vec<Concept>> {
+        unsupported("memoir.search_concepts_by_label")
+    }
+    fn search_all_concepts_fts(&self, _query: &str, _limit: usize) -> IcmResult<Vec<Concept>> {
+        unsupported("memoir.search_all_concepts_fts")
+    }
+    fn refine_concept(
+        &self,
+        _id: &str,
+        _new_definition: &str,
+        _new_source_ids: &[String],
+    ) -> IcmResult<()> {
+        unsupported("memoir.refine_concept")
+    }
+    fn add_link(&self, _link: ConceptLink) -> IcmResult<String> {
+        unsupported("memoir.add_link")
+    }
+    fn get_links_from(&self, _concept_id: &str) -> IcmResult<Vec<ConceptLink>> {
+        unsupported("memoir.get_links_from")
+    }
+    fn get_links_to(&self, _concept_id: &str) -> IcmResult<Vec<ConceptLink>> {
+        unsupported("memoir.get_links_to")
+    }
+    fn delete_link(&self, _id: &str) -> IcmResult<()> {
+        unsupported("memoir.delete_link")
+    }
+    fn get_neighbors(
+        &self,
+        _concept_id: &str,
+        _relation: Option<Relation>,
+    ) -> IcmResult<Vec<Concept>> {
+        unsupported("memoir.get_neighbors")
+    }
+    fn get_neighborhood(
+        &self,
+        _concept_id: &str,
+        _depth: usize,
+    ) -> IcmResult<(Vec<Concept>, Vec<ConceptLink>)> {
+        unsupported("memoir.get_neighborhood")
+    }
+    fn get_links_for_memoir(&self, _memoir_id: &str) -> IcmResult<Vec<ConceptLink>> {
+        unsupported("memoir.get_links_for_memoir")
+    }
+    fn memoir_stats(&self, _memoir_id: &str) -> IcmResult<MemoirStats> {
+        unsupported("memoir.memoir_stats")
+    }
+    fn batch_memoir_concept_counts(&self) -> IcmResult<HashMap<String, usize>> {
+        unsupported("memoir.batch_memoir_concept_counts")
+    }
+}
diff --git a/crates/icm-store/src/postgres/memory.rs b/crates/icm-store/src/postgres/memory.rs
new file mode 100644
index 00000000..e397aaf7
--- /dev/null
+++ b/crates/icm-store/src/postgres/memory.rs
@@ -0,0 +1,522 @@
+//! PostgreSQL backend -- split out of the former monolithic postgres.rs.
+
+use super::*;
+
+// MemoryStore
+
+impl MemoryStore for PostgresStore {
+    fn store(&self, memory: Memory) -> IcmResult<String> {
+        if self.readonly {
+            return Err(IcmError::ReadOnly("store".into()));
+        }
+        let memory = validate_and_normalize(memory)?;
+        self.check_dims(&memory)?;
+        let mut c = self.conn()?;
+        let mut tx = c.transaction().map_err(pg_err)?;
+        let id = insert_or_merge_memory(&mut tx, &memory)?;
+        tx.commit().map_err(pg_err)?;
+        Ok(id)
+    }
+
+    fn get(&self, id: &str) -> IcmResult<Option<Memory>> {
+        let mut c = self.conn()?;
+        let row = c
+            .query_opt(
+                &format!("SELECT {SELECT_COLS} FROM memories WHERE id = $1"),
+                &[&id],
+            )
+            .map_err(pg_err)?;
+        Ok(row.as_ref().map(row_to_memory))
+    }
+
+    fn update(&self, memory: &Memory) -> IcmResult<()> {
+        if self.readonly {
+            return Err(IcmError::ReadOnly("update".into()));
+        }
+        self.check_dims(memory)?;
+        let keywords_json = serde_json::to_string(&memory.keywords)?;
+        let related_json = serde_json::to_string(&memory.related_ids)?;
+        let st = source_type(&memory.source);
+        let sd = source_data(&memory.source);
+        let hash = summary_hash(&memory.topic, &memory.summary);
+        let importance = memory.importance.to_string();
+        let access = memory.access_count as i32;
+        let emb: Option<pgvector::Vector> = memory
+            .embedding
+            .as_ref()
+            .map(|e| pgvector::Vector::from(e.clone()));
+
+        let mut c = self.conn()?;
+        let changed = c
+            .execute(
+                "UPDATE memories SET
+                    updated_at = $2, last_accessed = $3, access_count = $4, weight = $5,
+                    topic = $6, summary = $7, raw_excerpt = $8, keywords = $9,
+                    importance = $10, source_type = $11, source_data = $12, related_ids = $13,
+                    embedding = $14, summary_hash = $15
+                 WHERE id = $1",
+                &[
+                    &memory.id,
+                    &memory.updated_at,
+                    &memory.last_accessed,
+                    &access,
+                    &memory.weight,
+                    &memory.topic,
+                    &memory.summary,
+                    &memory.raw_excerpt,
+                    &keywords_json,
+                    &importance,
+                    &st,
+                    &sd,
+                    &related_json,
+                    &emb,
+                    &hash,
+                ],
+            )
+            .map_err(pg_err)?;
+        if changed == 0 {
+            return Err(IcmError::NotFound(memory.id.clone()));
+        }
+        Ok(())
+    }
+
+    fn delete(&self, id: &str) -> IcmResult<()> {
+        if self.readonly {
+            return Err(IcmError::ReadOnly("delete".into()));
+        }
+        let mut c = self.conn()?;
+        let mut tx = c.transaction().map_err(pg_err)?;
+        let changed = tx
+            .execute("DELETE FROM memories WHERE id = $1", &[&id])
+            .map_err(pg_err)?;
+        if changed == 0 {
+            return Err(IcmError::NotFound(id.to_string()));
+        }
+        // Manual-testing finding (same class as the SQLite backend): a
+        // deleted memory otherwise stays as a dangling entry in every
+        // other memory's `related_ids` forever. Strip it out. `LIKE` is a
+        // cheap prefilter; the JSON-quoted match guards against a ULID
+        // that happens to be a literal substring of another.
+        tx.execute(
+            "UPDATE memories
+                SET related_ids = (
+                    SELECT COALESCE(jsonb_agg(elem), '[]'::jsonb)::text
+                    FROM jsonb_array_elements_text(related_ids::jsonb) AS elem
+                    WHERE elem != $1
+                )
+                WHERE related_ids LIKE '%\"' || $1 || '\"%'",
+            &[&id],
+        )
+        .map_err(pg_err)?;
+        tx.commit().map_err(pg_err)?;
+        Ok(())
+    }
+
+    fn search_by_keywords(&self, keywords: &[&str], limit: usize) -> IcmResult<Vec<Memory>> {
+        if keywords.is_empty() {
+            return Ok(Vec::new());
+        }
+        let keywords = &keywords[..keywords.len().min(50)];
+        let limit = limit.min(100);
+
+        let mut owned: Vec<Box<dyn ToSql + Sync>> = Vec::new();
+        let mut where_parts: Vec<String> = Vec::new();
+        for k in keywords {
+            // Audit finding: a keyword containing `%`/`_` was interpolated
+            // straight into the ILIKE pattern unescaped (same bug already
+            // fixed for SQLite's search_by_keywords). Escape and declare the
+            // escape character explicitly.
+            owned.push(Box::new(format!("%{}%", escape_like_wildcards(k))));
+            let p = owned.len();
+            where_parts.push(format!(
+                "(keywords ILIKE ${p} ESCAPE '\\' OR summary ILIKE ${p} ESCAPE '\\' \
+                 OR topic ILIKE ${p} ESCAPE '\\')"
+            ));
+        }
+        owned.push(Box::new(limit as i64));
+        let sql = format!(
+            "SELECT {SELECT_COLS} FROM memories WHERE {} ORDER BY weight DESC LIMIT ${}",
+            where_parts.join(" OR "),
+            owned.len()
+        );
+        let params: Vec<&(dyn ToSql + Sync)> = owned.iter().map(|b| b.as_ref()).collect();
+        let mut c = self.conn()?;
+        let rows = c.query(&sql, &params).map_err(pg_err)?;
+        Ok(rows.iter().map(row_to_memory).collect())
+    }
+
+    fn search_fts(&self, query: &str, limit: usize) -> IcmResult<Vec<Memory>> {
+        let limit = limit.min(100);
+        if query.trim().is_empty() {
+            return Ok(Vec::new());
+        }
+        let mut c = self.conn()?;
+        let rows = c
+            .query(
+                &format!(
+                    "SELECT {SELECT_COLS} FROM memories \
+                     WHERE fts @@ websearch_to_tsquery('simple', $1) \
+                     ORDER BY weight DESC LIMIT $2"
+                ),
+                &[&query, &(limit as i64)],
+            )
+            .map_err(pg_err)?;
+        Ok(rows.iter().map(row_to_memory).collect())
+    }
+
+    fn search_by_embedding(
+        &self,
+        embedding: &[f32],
+        limit: usize,
+    ) -> IcmResult<Vec<(Memory, f32)>> {
+        // Found while auditing OpenSearch's equivalent (which had no clamp
+        // at all): this function was also missing one, unlike its sibling
+        // search functions in this same file.
+        let limit = limit.min(1000);
+        let qv = pgvector::Vector::from(embedding.to_vec());
+        let mut c = self.conn()?;
+        let rows = c
+            .query(
+                &format!(
+                    "SELECT {SELECT_COLS}, embedding <=> $1 AS distance FROM memories \
+                     WHERE embedding IS NOT NULL ORDER BY embedding <=> $1 LIMIT $2"
+                ),
+                &[&qv, &(limit as i64)],
+            )
+            .map_err(pg_err)?;
+        Ok(rows
+            .iter()
+            .map(|row| {
+                let distance: f64 = row.get(15);
+                (row_to_memory(row), 1.0 - distance as f32)
+            })
+            .collect())
+    }
+
+    fn search_hybrid(
+        &self,
+        query: &str,
+        embedding: &[f32],
+        limit: usize,
+    ) -> IcmResult<Vec<(Memory, f32)>> {
+        let limit = limit.min(1000);
+        let pool_size = limit * 4;
+
+        // 1. FTS candidates (id + rank). Lock released at scope end.
+        let fts_pairs: Vec<(String, f64)> = if query.trim().is_empty() {
+            Vec::new()
+        } else {
+            let mut c = self.conn()?;
+            let rows = c
+                .query(
+                    "SELECT id, ts_rank_cd(fts, websearch_to_tsquery('simple', $1))::float8 AS rank \
+                     FROM memories \
+                     WHERE fts @@ websearch_to_tsquery('simple', $1) \
+                     ORDER BY rank DESC LIMIT $2",
+                    &[&query, &(pool_size as i64)],
+                )
+                .map_err(pg_err)?;
+            rows.iter().map(|r| (r.get(0), r.get(1))).collect()
+        };
+
+        // 2. Vector candidates (full rows + similarity).
+        let vec_results = self.search_by_embedding(embedding, pool_size)?;
+
+        // 3. Assemble memory objects and per-source scores.
+        let mut all_memories: HashMap<String, Memory> = HashMap::new();
+        let mut vec_scores: HashMap<String, f32> = HashMap::new();
+        for (mem, sim) in vec_results {
+            vec_scores.insert(mem.id.clone(), sim);
+            all_memories.insert(mem.id.clone(), mem);
+        }
+
+        // Normalize FTS ranks into 0..1 within the pool (higher is better).
+        let max_rank = fts_pairs.iter().map(|(_, r)| *r).fold(0.0_f64, f64::max);
+        let mut fts_scores: HashMap<String, f32> = HashMap::new();
+        let missing: Vec<String> = fts_pairs
+            .iter()
+            .filter(|(id, _)| !all_memories.contains_key(id))
+            .map(|(id, _)| id.clone())
+            .collect();
+        if !missing.is_empty() {
+            let refs: Vec<&str> = missing.iter().map(|s| s.as_str()).collect();
+            let fetched = self.get_many(&refs)?;
+            for (id, m) in fetched {
+                all_memories.insert(id, m);
+            }
+        }
+        for (id, rank) in fts_pairs {
+            let score = if max_rank > 0.0 {
+                (rank / max_rank) as f32
+            } else {
+                0.0
+            };
+            fts_scores.insert(id, score);
+        }
+
+        // 4. Blend: 30% FTS + 70% vector (matches the SQLite backend).
+        let mut scored: Vec<(String, f32)> = all_memories
+            .keys()
+            .map(|id| {
+                let fts = fts_scores.get(id).copied().unwrap_or(0.0);
+                let vec = vec_scores.get(id).copied().unwrap_or(0.0);
+                (id.clone(), 0.3 * fts + 0.7 * vec)
+            })
+            .collect();
+        scored.sort_by(|a, b| b.1.partial_cmp(&a.1).unwrap_or(std::cmp::Ordering::Equal));
+        scored.truncate(limit);
+
+        Ok(scored
+            .into_iter()
+            .filter_map(|(id, score)| all_memories.remove(&id).map(|m| (m, score)))
+            .collect())
+    }
+
+    fn update_access(&self, id: &str) -> IcmResult<()> {
+        if self.readonly {
+            return Ok(());
+        }
+        let mut c = self.conn()?;
+        let changed = c
+            .execute(
+                "UPDATE memories SET last_accessed = $1, access_count = access_count + 1 \
+                 WHERE id = $2",
+                &[&Utc::now(), &id],
+            )
+            .map_err(pg_err)?;
+        if changed == 0 {
+            return Err(IcmError::NotFound(id.to_string()));
+        }
+        Ok(())
+    }
+
+    fn batch_update_access(&self, ids: &[&str]) -> IcmResult<usize> {
+        if ids.is_empty() || self.readonly {
+            return Ok(0);
+        }
+        let id_vec: Vec<String> = ids.iter().map(|s| s.to_string()).collect();
+        let mut c = self.conn()?;
+        let changed = c
+            .execute(
+                "UPDATE memories SET last_accessed = $1, access_count = access_count + 1 \
+                 WHERE id = ANY($2)",
+                &[&Utc::now(), &id_vec],
+            )
+            .map_err(pg_err)?;
+        Ok(changed as usize)
+    }
+
+    fn apply_decay(&self, decay_factor: f32) -> IcmResult<usize> {
+        if self.readonly {
+            return Err(IcmError::ReadOnly("apply_decay".into()));
+        }
+        // Access-aware decay, capped at 5 accesses (matches SQLite).
+        let mut c = self.conn()?;
+        let changed = c
+            .execute(
+                // `$1::float8` is explicit so PostgreSQL doesn't infer the
+                // parameter as `numeric`/`real` from a neighbouring operand
+                // and reject the `f64` we bind ("error serializing parameter").
+                // Audit finding: for `low` importance with low access count,
+                // the raw multiplier goes negative once decay_factor < 0.5
+                // (still inside the CLI's own validated [0.0, 1.0) range) —
+                // the same bug already fixed for SQLite (GREATEST here is
+                // Postgres's equivalent of SQLite's MAX). See store.rs
+                // apply_decay for the full derivation.
+                "UPDATE memories SET weight = weight * GREATEST(0.0,
+                    1.0 - (1.0 - $1::float8) *
+                    CASE importance
+                        WHEN 'high' THEN 0.5
+                        WHEN 'low' THEN 2.0
+                        ELSE 1.0
+                    END
+                    / (1.0 + LEAST(access_count, 5) * 0.1)
+                )
+                WHERE importance <> 'critical'",
+                &[&(decay_factor as f64)],
+            )
+            .map_err(pg_err)?;
+        Ok(changed as usize)
+    }
+
+    fn prune(&self, weight_threshold: f32) -> IcmResult<usize> {
+        if self.readonly {
+            return Err(IcmError::ReadOnly("prune".into()));
+        }
+        let mut c = self.conn()?;
+        let changed = c
+            .execute(
+                "DELETE FROM memories \
+                 WHERE weight < $1::float8 AND importance NOT IN ('critical', 'high')",
+                &[&(weight_threshold as f64)],
+            )
+            .map_err(pg_err)?;
+        Ok(changed as usize)
+    }
+
+    fn list_all(&self) -> IcmResult<Vec<Memory>> {
+        let mut c = self.conn()?;
+        let rows = c
+            .query(
+                &format!("SELECT {SELECT_COLS} FROM memories ORDER BY weight DESC LIMIT 10000"),
+                &[],
+            )
+            .map_err(pg_err)?;
+        Ok(rows.iter().map(row_to_memory).collect())
+    }
+
+    fn get_by_topic(&self, topic: &str) -> IcmResult<Vec<Memory>> {
+        let mut c = self.conn()?;
+        let rows = c
+            .query(
+                &format!(
+                    "SELECT {SELECT_COLS} FROM memories WHERE topic = $1 \
+                     ORDER BY weight DESC LIMIT 500"
+                ),
+                &[&topic],
+            )
+            .map_err(pg_err)?;
+        Ok(rows.iter().map(row_to_memory).collect())
+    }
+
+    fn list_topics(&self) -> IcmResult<Vec<(String, usize)>> {
+        self.list_topics_with_prefix(None)
+    }
+
+    fn consolidate_topic(&self, topic: &str, consolidated: Memory) -> IcmResult<()> {
+        if self.readonly {
+            return Err(IcmError::ReadOnly("consolidate_topic".into()));
+        }
+        // The consolidated memory goes through the same validation as any
+        // other write — an MCP-provided consolidate summary previously
+        // bypassed every size/NUL check (same gap already closed on SQLite).
+        let consolidated = validate_and_normalize(consolidated)?;
+        let mut c = self.conn()?;
+        let mut tx = c.transaction().map_err(pg_err)?;
+        // Audit finding: `critical` memories are never deleted — same
+        // contract `apply_decay`/`prune` already honor, and the same fix
+        // already applied to SQLite's consolidate_topic. This unconditional
+        // DELETE previously wiped critical memories in a consolidated topic
+        // too.
+        // Manual-testing finding: captured before the delete, since
+        // afterward these rows are gone. Used to clean up any *other*
+        // memory's related_ids that pointed at them — same dangling-
+        // reference bug already fixed for the single-id `delete`.
+        let deleted_ids: Vec<String> = tx
+            .query(
+                "SELECT id FROM memories WHERE topic = $1 AND importance <> 'critical'",
+                &[&topic],
+            )
+            .map_err(pg_err)?
+            .iter()
+            .map(|row| row.get(0))
+            .collect();
+
+        tx.execute(
+            "DELETE FROM memories WHERE topic = $1 AND importance <> 'critical'",
+            &[&topic],
+        )
+        .map_err(pg_err)?;
+
+        if !deleted_ids.is_empty() {
+            tx.execute(
+                "UPDATE memories
+                    SET related_ids = (
+                        SELECT COALESCE(jsonb_agg(elem), '[]'::jsonb)::text
+                        FROM jsonb_array_elements_text(related_ids::jsonb) AS elem
+                        WHERE elem <> ALL($1::text[])
+                    )
+                    WHERE related_ids::jsonb ?| $1::text[]",
+                &[&deleted_ids],
+            )
+            .map_err(pg_err)?;
+        }
+
+        insert_or_merge_memory(&mut tx, &consolidated)?;
+        tx.commit().map_err(pg_err)?;
+        Ok(())
+    }
+
+    fn count(&self) -> IcmResult<usize> {
+        let mut c = self.conn()?;
+        let row = c
+            .query_one("SELECT COUNT(*) FROM memories", &[])
+            .map_err(pg_err)?;
+        let n: i64 = row.get(0);
+        Ok(n.max(0) as usize)
+    }
+
+    fn count_by_topic(&self, topic: &str) -> IcmResult<usize> {
+        let mut c = self.conn()?;
+        let row = c
+            .query_one("SELECT COUNT(*) FROM memories WHERE topic = $1", &[&topic])
+            .map_err(pg_err)?;
+        let n: i64 = row.get(0);
+        Ok(n.max(0) as usize)
+    }
+
+    fn stats(&self) -> IcmResult<StoreStats> {
+        let mut c = self.conn()?;
+        let row = c
+            .query_one(
+                "SELECT COUNT(*)::bigint, COUNT(DISTINCT topic)::bigint, \
+                        COALESCE(AVG(weight), 0.0)::float8, MIN(created_at), MAX(created_at) \
+                 FROM memories",
+                &[],
+            )
+            .map_err(pg_err)?;
+        let total: i64 = row.get(0);
+        let topics: i64 = row.get(1);
+        let avg: f64 = row.get(2);
+        Ok(StoreStats {
+            total_memories: total.max(0) as usize,
+            total_topics: topics.max(0) as usize,
+            avg_weight: avg as f32,
+            oldest_memory: row.get(3),
+            newest_memory: row.get(4),
+        })
+    }
+
+    fn topic_health(&self, topic: &str) -> IcmResult<TopicHealth> {
+        let mut c = self.conn()?;
+        let row = c
+            .query_one(
+                "SELECT COUNT(*)::bigint,
+                        COALESCE(AVG(weight), 0)::float8,
+                        COALESCE(AVG(access_count::float8), 0)::float8,
+                        MIN(created_at), MAX(created_at), MAX(last_accessed),
+                        COALESCE(SUM(CASE WHEN weight < 0.5
+                              AND (now() - last_accessed) > interval '14 days'
+                              THEN 1 ELSE 0 END), 0)::bigint
+                 FROM memories WHERE topic = $1",
+                &[&topic],
+            )
+            .map_err(pg_err)?;
+
+        let entry_count: i64 = row.get(0);
+        if entry_count == 0 {
+            return Err(IcmError::NotFound(format!("topic: {topic}")));
+        }
+        let avg_weight: f64 = row.get(1);
+        let avg_access: f64 = row.get(2);
+        let stale: i64 = row.get(6);
+
+        Ok(TopicHealth {
+            topic: topic.to_string(),
+            entry_count: entry_count.max(0) as usize,
+            avg_weight: avg_weight as f32,
+            avg_access_count: avg_access as f32,
+            oldest: row.get(3),
+            newest: row.get(4),
+            last_accessed: row.get(5),
+            needs_consolidation: entry_count > 5,
+            stale_count: stale.max(0) as usize,
+        })
+    }
+}
+
+// Unsupported subsystems on this backend (first cut, issue #301).
+//
+// These return `IcmError::Unsupported` so the binary keeps working for the
+// core shared-memory use case while the heavier subsystems remain on the
+// default SQLite backend. A follow-up can port them.
diff --git a/crates/icm-store/src/postgres/mod.rs b/crates/icm-store/src/postgres/mod.rs
new file mode 100644
index 00000000..b22252bf
--- /dev/null
+++ b/crates/icm-store/src/postgres/mod.rs
@@ -0,0 +1,96 @@
+//! PostgreSQL storage backend (issue #301, opt-in via `--features postgres`).
+//!
+//! A node-local SQLite file cannot be shared between several ICM
+//! processes or Kubernetes replicas. This backend runs the same memory
+//! model over a network-accessible PostgreSQL database so every instance
+//! reads and writes one shared store. PostgreSQL serialises concurrent
+//! writers, so N replicas can `icm store` into the same memory safely.
+//!
+//! Design notes:
+//!
+//! - **Blocking client.** The store traits are synchronous
+//!   (`fn store(&self, ...) -> IcmResult<...>`), so we use the blocking
+//!   `postgres` crate. No async runtime, no sync-over-async bridge — the
+//!   client maps one-to-one onto the trait surface.
+//! - **`pgvector` for embeddings.** Memory embeddings live in a
+//!   `vector(N)` column; KNN search uses the `<=>` cosine-distance
+//!   operator. Similarity is reported as `1 - distance` to match the
+//!   SQLite backend.
+//! - **PostgreSQL full-text search** replaces SQLite FTS5: a generated
+//!   `tsvector` column (config `simple`, no stemming, to mirror FTS5's
+//!   unicode61 tokenizer) with a GIN index, queried via
+//!   `websearch_to_tsquery` so arbitrary user input is operator-safe.
+//! - **Connection string** comes from `ICM_POSTGRES_URL` (or
+//!   `DATABASE_URL` as a fallback). The `&Path` arguments that the CLI
+//!   passes for the SQLite file are ignored.
+//!
+//! Scope of this first cut: the full [`MemoryStore`] surface (the core
+//! shared-memory use case behind #301) plus the ancillary tables used by
+//! the normal store/recall/hook path (hook telemetry, the extraction
+//! queue, code areas, the key/value metadata). The heavier subsystems
+//! (memoir graph, transcripts, structured facts, feedback, pattern
+//! mining) return [`IcmError::Unsupported`] on this backend for now;
+//! they remain fully available on the default SQLite backend.
+
+use std::collections::{HashMap, HashSet};
+use std::path::Path;
+use std::sync::{Mutex, MutexGuard};
+
+use chrono::{DateTime, Utc};
+use postgres::types::ToSql;
+use postgres::{Client, GenericClient, NoTls};
+
+use icm_core::{
+    Concept, ConceptLink, Embedder, Fact, FactsStats, FactsStore, Feedback, FeedbackStats,
+    FeedbackStore, IcmError, IcmResult, Importance, Label, Memoir, MemoirStats, MemoirStore,
+    Memory, MemorySource, MemoryStore, Message, PatternCluster, Relation, Role, Session,
+    StoreStats, TopicHealth, TranscriptHit, TranscriptStats, TranscriptStore,
+};
+
+// Shared public row types live in `crate::common` (issue #301) so every
+// backend can be compiled into one binary without colliding definitions.
+pub use crate::common::{CodeArea, HookEvent, HookEventInsert, HookStatsRow, PendingRow};
+
+// Helpers (mirrored from the SQLite backend so behaviour matches)
+
+// PostgresStore
+
+/// PostgreSQL-backed store. See the module docs.
+pub struct PostgresStore {
+    client: Mutex<Client>,
+    embedding_dims: usize,
+    readonly: bool,
+}
+
+/// One-shot warning that auto-consolidation silently does nothing on this
+/// backend (see [`PostgresStore::auto_consolidate`]).
+fn warn_auto_consolidate_unsupported() {
+    static WARNED: std::sync::Once = std::sync::Once::new();
+    WARNED.call_once(|| {
+        tracing::warn!(
+            "auto-consolidation is not implemented on the PostgreSQL backend; \
+             topics will keep growing (auto_consolidate_enabled has no effect here)"
+        );
+    });
+}
+
+fn unsupported<T>(op: &str) -> IcmResult<T> {
+    Err(IcmError::Unsupported(format!(
+        "{op} (use the default SQLite backend)"
+    )))
+}
+
+mod connection;
+mod facts;
+mod feedback;
+mod hooks;
+mod maintenance;
+mod memoir;
+mod memory;
+mod patterns;
+mod rows;
+#[cfg(test)]
+mod tests;
+mod transcript;
+
+pub(crate) use rows::*;
diff --git a/crates/icm-store/src/postgres/patterns.rs b/crates/icm-store/src/postgres/patterns.rs
new file mode 100644
index 00000000..02b70715
--- /dev/null
+++ b/crates/icm-store/src/postgres/patterns.rs
@@ -0,0 +1,173 @@
+//! PostgreSQL backend -- split out of the former monolithic postgres.rs.
+//!
+//! Neighbor expansion and pattern-mining helpers.
+
+use super::*;
+
+impl PostgresStore {
+    // Memory reads used by recall expansion
+
+    /// Fetch many memories by id in one round-trip, deduplicated by id.
+    pub fn get_many(&self, ids: &[&str]) -> IcmResult<HashMap<String, Memory>> {
+        if ids.is_empty() {
+            return Ok(HashMap::new());
+        }
+        let id_vec: Vec<String> = ids.iter().map(|s| s.to_string()).collect();
+        let mut c = self.conn()?;
+        let rows = c
+            .query(
+                &format!("SELECT {SELECT_COLS} FROM memories WHERE id = ANY($1)"),
+                &[&id_vec],
+            )
+            .map_err(pg_err)?;
+        let mut map = HashMap::with_capacity(rows.len());
+        for row in &rows {
+            let m = row_to_memory(row);
+            map.insert(m.id.clone(), m);
+        }
+        Ok(map)
+    }
+
+    /// Expand a scored result set with one hop of related memories.
+    /// Backend-agnostic logic mirrored from the SQLite store.
+    pub fn expand_with_neighbors(
+        &self,
+        initial: &[(Memory, f32)],
+        max_neighbors: usize,
+        hop_discount: f32,
+        max_total: usize,
+    ) -> IcmResult<Vec<(Memory, f32)>> {
+        if max_neighbors == 0 || initial.is_empty() {
+            let mut out = initial.to_vec();
+            out.truncate(max_total);
+            return Ok(out);
+        }
+
+        let initial_ids: HashSet<String> = initial.iter().map(|(m, _)| m.id.clone()).collect();
+
+        let mut candidates: Vec<(String, f32)> = Vec::new();
+        let mut seen: HashSet<String> = HashSet::new();
+        'outer: for (mem, score) in initial {
+            for neighbor_id in &mem.related_ids {
+                if candidates.len() >= max_neighbors {
+                    break 'outer;
+                }
+                if initial_ids.contains(neighbor_id) || !seen.insert(neighbor_id.clone()) {
+                    continue;
+                }
+                candidates.push((neighbor_id.clone(), *score));
+            }
+        }
+
+        let mut neighbors: Vec<(Memory, f32)> = Vec::new();
+        if !candidates.is_empty() {
+            let ids: Vec<&str> = candidates.iter().map(|(id, _)| id.as_str()).collect();
+            let fetched = self.get_many(&ids)?;
+            for (id, parent_score) in candidates {
+                if let Some(m) = fetched.get(&id) {
+                    neighbors.push((m.clone(), parent_score * hop_discount));
+                }
+            }
+        }
+
+        let mut combined: Vec<(Memory, f32)> = initial.to_vec();
+        combined.extend(neighbors);
+        combined.sort_by(|a, b| b.1.partial_cmp(&a.1).unwrap_or(std::cmp::Ordering::Equal));
+        combined.truncate(max_total);
+        Ok(combined)
+    }
+
+    /// Memories whose topic starts with `topic` (prefix match).
+    pub fn get_by_topic_prefix(&self, topic: &str) -> IcmResult<Vec<Memory>> {
+        // Audit finding: `topic` (the literal prefix to match) was
+        // interpolated unescaped — a topic containing `%`/`_` turned into
+        // unintended wildcards within what's meant to be a literal prefix.
+        // The trailing `%` is the deliberate "starts with" wildcard and
+        // stays outside the escaped portion.
+        let pattern = format!("{}%", escape_like_wildcards(topic));
+        let mut c = self.conn()?;
+        let rows = c
+            .query(
+                &format!(
+                    "SELECT {SELECT_COLS} FROM memories WHERE topic LIKE $1 ESCAPE '\\' \
+                     ORDER BY weight DESC LIMIT 500"
+                ),
+                &[&pattern],
+            )
+            .map_err(pg_err)?;
+        Ok(rows.iter().map(row_to_memory).collect())
+    }
+
+    /// Distinct topics (optionally prefix-filtered) with their counts.
+    pub fn list_topics_with_prefix(&self, prefix: Option<&str>) -> IcmResult<Vec<(String, usize)>> {
+        let mut c = self.conn()?;
+        let rows = match prefix {
+            Some(p) => {
+                let pattern = format!("{p}%");
+                c.query(
+                    "SELECT topic, COUNT(*)::bigint FROM memories WHERE topic LIKE $1 \
+                     GROUP BY topic ORDER BY topic",
+                    &[&pattern],
+                )
+            }
+            None => c.query(
+                "SELECT topic, COUNT(*)::bigint FROM memories GROUP BY topic ORDER BY topic",
+                &[],
+            ),
+        }
+        .map_err(pg_err)?;
+        Ok(rows
+            .iter()
+            .map(|row| {
+                let n: i64 = row.get(1);
+                (row.get(0), n.max(0) as usize)
+            })
+            .collect())
+    }
+
+    // Consolidation / patterns
+
+    /// Auto-consolidation is not yet implemented on the PostgreSQL
+    /// backend; the call is a no-op (returns "did not consolidate") so the
+    /// normal store path is unaffected. Unlike the other parity gaps (which
+    /// return `Unsupported`), this one is silent by design — but the user
+    /// deserves to know their `auto_consolidate_enabled = true` does nothing
+    /// here, so warn once per process (audit finding).
+    pub fn auto_consolidate(&self, _topic: &str, _threshold: usize) -> IcmResult<bool> {
+        warn_auto_consolidate_unsupported();
+        Ok(false)
+    }
+
+    /// See [`Self::auto_consolidate`].
+    pub fn auto_consolidate_with_embedder(
+        &self,
+        _topic: &str,
+        _threshold: usize,
+        _embedder: Option<&dyn Embedder>,
+    ) -> IcmResult<bool> {
+        warn_auto_consolidate_unsupported();
+        Ok(false)
+    }
+
+    /// Pattern mining is not yet available on the PostgreSQL backend.
+    pub fn detect_patterns(
+        &self,
+        _topic: &str,
+        _min_cluster_size: usize,
+    ) -> IcmResult<Vec<PatternCluster>> {
+        Err(IcmError::Unsupported(
+            "detect_patterns (use the default SQLite backend)".into(),
+        ))
+    }
+
+    /// Pattern mining is not yet available on the PostgreSQL backend.
+    pub fn extract_pattern_as_concept(
+        &self,
+        _cluster: &PatternCluster,
+        _memoir_id: &str,
+    ) -> IcmResult<String> {
+        Err(IcmError::Unsupported(
+            "extract_pattern_as_concept (use the default SQLite backend)".into(),
+        ))
+    }
+}
diff --git a/crates/icm-store/src/postgres/rows.rs b/crates/icm-store/src/postgres/rows.rs
new file mode 100644
index 00000000..3c0996fd
--- /dev/null
+++ b/crates/icm-store/src/postgres/rows.rs
@@ -0,0 +1,284 @@
+//! PostgreSQL backend -- split out of the former monolithic postgres.rs.
+//!
+//! Row/parse helpers shared by every trait-impl submodule here.
+
+use super::*;
+
+pub(crate) fn pg_err(e: postgres::Error) -> IcmError {
+    IcmError::Database(e.to_string())
+}
+
+pub(crate) fn lock_err() -> IcmError {
+    IcmError::Database("postgres client mutex poisoned".into())
+}
+
+pub(crate) fn source_type(source: &MemorySource) -> &'static str {
+    match source {
+        MemorySource::ClaudeCode { .. } => "claude_code",
+        MemorySource::Conversation { .. } => "conversation",
+        MemorySource::Manual => "manual",
+    }
+}
+
+pub(crate) fn source_data(source: &MemorySource) -> Option<String> {
+    match source {
+        MemorySource::Manual => None,
+        other => serde_json::to_string(other).ok(),
+    }
+}
+
+pub(crate) fn parse_source(source_type_str: &str, source_data_str: Option<String>) -> MemorySource {
+    match source_type_str {
+        "manual" => MemorySource::Manual,
+        _ => source_data_str
+            .and_then(|d| serde_json::from_str(&d).ok())
+            .unwrap_or(MemorySource::Manual),
+    }
+}
+
+pub(crate) fn importance_rank(i: Importance) -> u8 {
+    match i {
+        Importance::Critical => 4,
+        Importance::High => 3,
+        Importance::Medium => 2,
+        Importance::Low => 1,
+    }
+}
+
+pub(crate) fn max_importance(a: Importance, b: Importance) -> Importance {
+    if importance_rank(a) >= importance_rank(b) {
+        a
+    } else {
+        b
+    }
+}
+
+/// SHA-256 over the normalized `(topic, summary)` pair, hex-encoded.
+/// Identical normalization to the SQLite backend so dedup hashes match.
+pub(crate) fn summary_hash(topic: &str, summary: &str) -> String {
+    use sha2::{Digest, Sha256};
+    let topic_n = topic.trim().to_lowercase();
+    let summary_n: String = summary
+        .split_whitespace()
+        .collect::<Vec<&str>>()
+        .join(" ")
+        .to_lowercase();
+    let mut h = Sha256::new();
+    h.update(topic_n.as_bytes());
+    h.update(b"\0");
+    h.update(summary_n.as_bytes());
+    format!("{:x}", h.finalize())
+}
+
+pub(crate) const MAX_SUMMARY_BYTES: usize = 64 * 1024;
+pub(crate) const MAX_TOPIC_BYTES: usize = 256;
+
+/// Escape `%`, `_`, and the escape character itself so a value can be
+/// safely wrapped in a LIKE/ILIKE pattern. Pair with `ESCAPE '\'` in the
+/// SQL. Mirrors the SQLite backend's `escape_like_wildcards`.
+pub(crate) fn escape_like_wildcards(s: &str) -> String {
+    s.replace('\\', "\\\\")
+        .replace('%', "\\%")
+        .replace('_', "\\_")
+}
+
+/// Validate and normalize a `Memory` before insertion. Mirrors the
+/// SQLite backend's `validate_and_normalize`.
+pub(crate) fn validate_and_normalize(mut memory: Memory) -> IcmResult<Memory> {
+    memory.topic = memory.topic.trim().to_string();
+
+    if memory.topic.is_empty() {
+        return Err(IcmError::InvalidInput("topic cannot be empty".into()));
+    }
+    if memory.summary.trim().is_empty() {
+        return Err(IcmError::InvalidInput("summary cannot be empty".into()));
+    }
+    if memory.topic.contains('\0') {
+        return Err(IcmError::InvalidInput(
+            "topic must not contain NUL bytes".into(),
+        ));
+    }
+    if memory.summary.contains('\0') {
+        return Err(IcmError::InvalidInput(
+            "summary must not contain NUL bytes".into(),
+        ));
+    }
+    if memory.topic.contains(['\n', '\r', '\t']) {
+        return Err(IcmError::InvalidInput(
+            "topic must not contain newline / CR / tab characters".into(),
+        ));
+    }
+    if memory.topic.len() > MAX_TOPIC_BYTES {
+        return Err(IcmError::InvalidInput(format!(
+            "topic exceeds {MAX_TOPIC_BYTES} bytes"
+        )));
+    }
+    if memory.summary.len() > MAX_SUMMARY_BYTES {
+        return Err(IcmError::InvalidInput(format!(
+            "summary exceeds {MAX_SUMMARY_BYTES} bytes"
+        )));
+    }
+    Ok(memory)
+}
+
+pub(crate) const SELECT_COLS: &str =
+    "id, created_at, updated_at, last_accessed, access_count, weight, \
+                           topic, summary, raw_excerpt, keywords, \
+                           importance, source_type, source_data, related_ids, embedding";
+
+/// Map a `memories` row (selected via [`SELECT_COLS`]) to a [`Memory`].
+pub(crate) fn row_to_memory(row: &postgres::Row) -> Memory {
+    let keywords_json: Option<String> = row.get(9);
+    let keywords: Vec<String> = keywords_json
+        .and_then(|s| serde_json::from_str(&s).ok())
+        .unwrap_or_default();
+
+    let importance_str: String = row.get(10);
+    let importance = importance_str.parse().unwrap_or(Importance::Medium);
+
+    let source_type_str: String = row.get(11);
+    let source_data_str: Option<String> = row.get(12);
+    let source = parse_source(&source_type_str, source_data_str);
+
+    let related_json: Option<String> = row.get(13);
+    let related_ids: Vec<String> = related_json
+        .and_then(|s| serde_json::from_str(&s).ok())
+        .unwrap_or_default();
+
+    let embedding: Option<Vec<f32>> = row
+        .get::<_, Option<pgvector::Vector>>(14)
+        .map(|v| v.as_slice().to_vec());
+
+    let access_count: i32 = row.get(4);
+
+    Memory {
+        id: row.get(0),
+        created_at: row.get(1),
+        updated_at: row.get(2),
+        last_accessed: row.get(3),
+        access_count: access_count.max(0) as u32,
+        weight: row.get(5),
+        topic: row.get(6),
+        summary: row.get(7),
+        raw_excerpt: row.get(8),
+        keywords,
+        importance,
+        source,
+        related_ids,
+        embedding,
+        scope: icm_core::Scope::User,
+    }
+}
+
+/// Insert a memory, or merge metadata into an existing duplicate.
+///
+/// Dedup contract identical to the SQLite backend: a collision on
+/// `summary_hash` alone (which already encodes the topic, Rust-side,
+/// Unicode-correct) is ignored and the existing row's id is returned, after
+/// merging the caller's importance (take max), keywords (union), and
+/// `raw_excerpt` (prefer new) into it.
+pub(crate) fn insert_or_merge_memory<C: GenericClient>(
+    c: &mut C,
+    memory: &Memory,
+) -> IcmResult<String> {
+    let keywords_json = serde_json::to_string(&memory.keywords)?;
+    let related_json = serde_json::to_string(&memory.related_ids)?;
+    let st = source_type(&memory.source);
+    let sd = source_data(&memory.source);
+    let hash = summary_hash(&memory.topic, &memory.summary);
+    let importance = memory.importance.to_string();
+    let access = memory.access_count as i32;
+    let emb: Option<pgvector::Vector> = memory
+        .embedding
+        .as_ref()
+        .map(|e| pgvector::Vector::from(e.clone()));
+
+    let inserted = c
+        .query_opt(
+            "INSERT INTO memories
+             (id, created_at, updated_at, last_accessed, access_count, weight,
+              topic, summary, raw_excerpt, keywords, importance,
+              source_type, source_data, related_ids, summary_hash, embedding)
+             VALUES ($1,$2,$3,$4,$5,$6,$7,$8,$9,$10,$11,$12,$13,$14,$15,$16)
+             ON CONFLICT (summary_hash) WHERE summary_hash IS NOT NULL
+             DO NOTHING
+             RETURNING id",
+            &[
+                &memory.id,
+                &memory.created_at,
+                &memory.updated_at,
+                &memory.last_accessed,
+                &access,
+                &memory.weight,
+                &memory.topic,
+                &memory.summary,
+                &memory.raw_excerpt,
+                &keywords_json,
+                &importance,
+                &st,
+                &sd,
+                &related_json,
+                &hash,
+                &emb,
+            ],
+        )
+        .map_err(pg_err)?;
+
+    if let Some(row) = inserted {
+        return Ok(row.get::<_, String>(0));
+    }
+
+    // Dedup hit: merge metadata into the existing row (mirrors SQLite).
+    let existing = c
+        .query_one(
+            "SELECT id, importance, keywords, raw_excerpt FROM memories
+             WHERE summary_hash = $1",
+            &[&hash],
+        )
+        .map_err(pg_err)?;
+
+    let existing_id: String = existing.get(0);
+    let existing_importance_str: String = existing.get(1);
+    let existing_keywords_json: Option<String> = existing.get(2);
+    let existing_raw: Option<String> = existing.get(3);
+
+    let existing_importance: Importance = existing_importance_str
+        .parse()
+        .unwrap_or(Importance::Medium);
+    let merged_importance = max_importance(existing_importance, memory.importance);
+
+    let existing_keywords: Vec<String> = existing_keywords_json
+        .as_deref()
+        .and_then(|s| serde_json::from_str(s).ok())
+        .unwrap_or_default();
+    let mut merged_keywords = existing_keywords.clone();
+    for kw in &memory.keywords {
+        if !merged_keywords.contains(kw) {
+            merged_keywords.push(kw.clone());
+        }
+    }
+
+    let merged_raw = memory.raw_excerpt.clone().or_else(|| existing_raw.clone());
+
+    let importance_changed = merged_importance != existing_importance;
+    let keywords_changed = merged_keywords != existing_keywords;
+    let raw_changed = merged_raw != existing_raw;
+    if importance_changed || keywords_changed || raw_changed {
+        let merged_keywords_json = serde_json::to_string(&merged_keywords)?;
+        c.execute(
+            "UPDATE memories
+             SET importance = $1, keywords = $2, raw_excerpt = $3, updated_at = $4
+             WHERE id = $5",
+            &[
+                &merged_importance.to_string(),
+                &merged_keywords_json,
+                &merged_raw,
+                &Utc::now(),
+                &existing_id,
+            ],
+        )
+        .map_err(pg_err)?;
+    }
+
+    Ok(existing_id)
+}
diff --git a/crates/icm-store/src/postgres/tests.rs b/crates/icm-store/src/postgres/tests.rs
new file mode 100644
index 00000000..80492e9a
--- /dev/null
+++ b/crates/icm-store/src/postgres/tests.rs
@@ -0,0 +1,37 @@
+//! Test suite for the PostgreSQL backend (`postgres::tests`).
+
+use super::*;
+
+/// Audit regression: a keyword containing `%`/`_` was interpolated
+/// straight into an ILIKE pattern unescaped, turning it into an
+/// unintended wildcard.
+#[test]
+fn test_escape_like_wildcards() {
+    assert_eq!(escape_like_wildcards("100%"), "100\\%");
+    assert_eq!(escape_like_wildcards("snake_case"), "snake\\_case");
+    assert_eq!(escape_like_wildcards("back\\slash"), "back\\\\slash");
+    assert_eq!(escape_like_wildcards("plain"), "plain");
+}
+
+/// Audit regression: `apply_decay`'s raw multiplier goes negative for
+/// `low` importance + low access count at factor < 0.5 (still inside
+/// the CLI's own validated [0.0, 1.0) range). This reproduces the exact
+/// arithmetic the SQL `GREATEST(0.0, ...)` clamp now guards, as a plain
+/// Rust assertion (no live Postgres needed to prove the formula itself
+/// would go negative without the clamp).
+#[test]
+fn test_apply_decay_formula_would_go_negative_without_clamp() {
+    let factor: f64 = 0.4;
+    let mult: f64 = 2.0; // low importance
+    let access: f64 = 0.0;
+    let raw = 1.0 - (1.0 - factor) * mult / (1.0 + access * 0.1);
+    assert!(
+        raw < 0.0,
+        "expected the pre-clamp formula to go negative, got {raw}"
+    );
+    assert_eq!(
+        raw.max(0.0),
+        0.0,
+        "GREATEST(0.0, ...) must clamp this to 0.0"
+    );
+}
diff --git a/crates/icm-store/src/postgres/transcript.rs b/crates/icm-store/src/postgres/transcript.rs
new file mode 100644
index 00000000..58ea59f2
--- /dev/null
+++ b/crates/icm-store/src/postgres/transcript.rs
@@ -0,0 +1,65 @@
+//! PostgreSQL backend -- split out of the former monolithic postgres.rs.
+//!
+//! Unsupported on this backend (issue #301) -- see mod.rs.
+
+use super::*;
+
+impl TranscriptStore for PostgresStore {
+    fn create_session(
+        &self,
+        _agent: &str,
+        _project: Option<&str>,
+        _metadata: Option<&str>,
+    ) -> IcmResult<String> {
+        unsupported("transcript.create_session")
+    }
+    fn ensure_session(
+        &self,
+        _id: &str,
+        _agent: &str,
+        _project: Option<&str>,
+        _metadata: Option<&str>,
+    ) -> IcmResult<String> {
+        unsupported("transcript.ensure_session")
+    }
+    fn get_session(&self, _id: &str) -> IcmResult<Option<Session>> {
+        unsupported("transcript.get_session")
+    }
+    fn list_sessions(&self, _project: Option<&str>, _limit: usize) -> IcmResult<Vec<Session>> {
+        unsupported("transcript.list_sessions")
+    }
+    fn record_message(
+        &self,
+        _session_id: &str,
+        _role: Role,
+        _content: &str,
+        _tool_name: Option<&str>,
+        _tokens: Option<i64>,
+        _metadata: Option<&str>,
+    ) -> IcmResult<String> {
+        unsupported("transcript.record_message")
+    }
+    fn list_session_messages(
+        &self,
+        _session_id: &str,
+        _limit: usize,
+        _offset: usize,
+    ) -> IcmResult<Vec<Message>> {
+        unsupported("transcript.list_session_messages")
+    }
+    fn search_transcripts(
+        &self,
+        _query: &str,
+        _session_id: Option<&str>,
+        _project: Option<&str>,
+        _limit: usize,
+    ) -> IcmResult<Vec<TranscriptHit>> {
+        unsupported("transcript.search_transcripts")
+    }
+    fn forget_session(&self, _id: &str) -> IcmResult<()> {
+        unsupported("transcript.forget_session")
+    }
+    fn transcript_stats(&self) -> IcmResult<TranscriptStats> {
+        unsupported("transcript.transcript_stats")
+    }
+}
diff --git a/crates/icm-store/src/store.rs b/crates/icm-store/src/store.rs
deleted file mode 100644
index 2929df56..00000000
--- a/crates/icm-store/src/store.rs
+++ /dev/null
@@ -1,8759 +0,0 @@
-use std::collections::{HashMap, HashSet, VecDeque};
-use std::num::NonZeroUsize;
-use std::path::Path;
-use std::sync::{Mutex, Once};
-
-use chrono::{DateTime, Utc};
-use lru::LruCache;
-use rusqlite::{ffi::sqlite3_auto_extension, params, Connection};
-use sha2::{Digest, Sha256};
-use zerocopy::IntoBytes;
-
-use icm_core::{
-    Concept, ConceptLink, Embedder, Fact, FactsStats, FactsStore, Feedback, FeedbackStats,
-    FeedbackStore, IcmError, IcmResult, Importance, Label, Memoir, MemoirStats, MemoirStore,
-    Memory, MemorySource, MemoryStore, Message, PatternCluster, Relation, Role, Session,
-    StoreStats, TopicHealth, TranscriptHit, TranscriptStats, TranscriptStore,
-};
-
-use crate::schema::init_db_with_dims;
-
-/// Convert rusqlite::Error to IcmError::Database
-pub(crate) fn db_err(e: rusqlite::Error) -> IcmError {
-    IcmError::Database(e.to_string())
-}
-
-/// True when a rusqlite error is a "no such table" (a legacy DB missing an
-/// FTS shadow table we optionally rebuild — issue #313).
-fn is_missing_table(e: &rusqlite::Error) -> bool {
-    e.to_string().contains("no such table")
-}
-
-/// FTS5 shadow tables maintained by ICM, checked/rebuilt during repair (#313).
-const FTS_TABLES: [&str; 4] = [
-    "memories_fts",
-    "concepts_fts",
-    "feedback_fts",
-    "messages_fts",
-];
-
-// Shared public row types live in `crate::common` so all backends can be
-// compiled into one binary without colliding definitions (issue #301).
-pub use crate::common::{CodeArea, HookEvent, HookEventInsert, HookStatsRow, PendingRow};
-
-/// Collect mapped rows into a Vec, converting rusqlite errors.
-fn collect_rows<T>(
-    rows: rusqlite::MappedRows<'_, impl FnMut(&rusqlite::Row<'_>) -> rusqlite::Result<T>>,
-) -> IcmResult<Vec<T>> {
-    rows.collect::<Result<Vec<T>, _>>().map_err(db_err)
-}
-
-static SQLITE_VEC_INIT: Once = Once::new();
-
-fn ensure_sqlite_vec() {
-    SQLITE_VEC_INIT.call_once(|| unsafe {
-        #[allow(clippy::missing_transmute_annotations)]
-        sqlite3_auto_extension(Some(std::mem::transmute(
-            sqlite_vec::sqlite3_vec_init as *const (),
-        )));
-    });
-}
-
-/// URI-encode a filesystem path for a SQLite `file:` URI so a backslash on
-/// Windows or a `?`/`#`/`%` in a pathological filename can't break the parser.
-fn encode_sqlite_uri_path(path: &Path) -> String {
-    path.to_string_lossy()
-        .chars()
-        .map(|c| match c {
-            '?' | '#' | '%' => format!("%{:02X}", c as u32),
-            // Normalize Windows backslashes; SQLite URIs accept "/".
-            '\\' => "/".into(),
-            other => other.to_string(),
-        })
-        .collect()
-}
-
-/// Open `path` strictly read-only. When `immutable` is set, add the
-/// `immutable=1` URI flag — SQLite then assumes the file never changes and
-/// touches no `-shm`/`-wal` sidecars, which is required on a `chmod -w`
-/// parent directory (issue #263) but serves a permanently stale snapshot and
-/// eventually reports spurious `SQLITE_CORRUPT` on a live DB (issue #319).
-/// Plain `mode=ro` (immutable = false) is WAL-aware and sees committed
-/// writes, at the cost of needing a writable directory for the sidecars.
-fn open_readonly_uri(path: &Path, immutable: bool) -> IcmResult<Connection> {
-    let encoded = encode_sqlite_uri_path(path);
-    let uri = if immutable {
-        format!("file:{encoded}?mode=ro&immutable=1")
-    } else {
-        format!("file:{encoded}?mode=ro")
-    };
-    Connection::open_with_flags(
-        uri,
-        rusqlite::OpenFlags::SQLITE_OPEN_READ_ONLY
-            | rusqlite::OpenFlags::SQLITE_OPEN_URI
-            | rusqlite::OpenFlags::SQLITE_OPEN_NO_MUTEX,
-    )
-    .map_err(|e| IcmError::Database(format!("cannot open database read-only: {e}")))
-}
-
-/// Open a long-lived read-only connection (issue #319).
-///
-/// Prefer a normal WAL-aware `mode=ro` connection: it respects locking and
-/// sees writes committed after it opened — the actual deployment model for
-/// `icm --read-only serve`, where hooks keep writing the same DB. Fall back to
-/// `immutable=1` only when the live open can't even read the DB, e.g. a
-/// `chmod -w` sandbox where SQLite can't create the `-shm` sidecar for a
-/// WAL-mode file (issue #263). The read probe is essential: on such a
-/// directory the open may *succeed* yet the first real read fails, so opening
-/// alone is not a sufficient signal.
-fn open_readonly_connection(path: &Path) -> IcmResult<Connection> {
-    if let Ok(conn) = open_readonly_uri(path, false) {
-        // Give a momentarily-locked writer time to release before deciding
-        // the live open is unusable.
-        let _ = conn.execute_batch("PRAGMA busy_timeout=30000;");
-        // Exercise a real table read (touches the WAL/-shm path) — `SELECT 1`
-        // would not.
-        if conn
-            .query_row("SELECT count(*) FROM sqlite_master", [], |_| Ok(()))
-            .is_ok()
-        {
-            return Ok(conn);
-        }
-    }
-    // Live open unusable (e.g. a read-only sandbox dir, #263). Fall back to an
-    // immutable snapshot — but warn, because a long-lived reader on this
-    // connection will NOT see subsequent writes (the #319 staleness tradeoff).
-    tracing::warn!(
-        path = %path.display(),
-        "read-only DB opened immutable (sandbox fallback): writes committed after \
-         this point will not be visible until the connection is reopened"
-    );
-    open_readonly_uri(path, true)
-}
-
-/// In-process LRU cache size for hot memories. Each entry is one
-/// fully-hydrated `Memory` (incl. optional 384×f32 embedding ≈ 1.5KB),
-/// so 256 entries cap RAM at ~400KB worst case. Helps long-running
-/// processes (`icm serve`, TUI) where the same memories are read
-/// repeatedly; zero benefit in one-shot CLI invocations beyond the
-/// single recall flow.
-const MEMORY_CACHE_CAP: usize = 256;
-
-pub struct SqliteStore {
-    conn: Connection,
-    cache: Mutex<LruCache<String, Memory>>,
-    /// `true` when opened through [`Self::open_readonly`]. Read-like
-    /// methods that would otherwise dirty the DB (auto-decay,
-    /// `update_access`) check this and skip silently; mutation methods
-    /// (`store`, `update`, `delete`, etc.) check this and return
-    /// `IcmError::ReadOnly`. Issue #263.
-    readonly: bool,
-}
-
-impl SqliteStore {
-    pub fn new(path: &Path) -> IcmResult<Self> {
-        Self::with_dims(path, icm_core::DEFAULT_EMBEDDING_DIMS)
-    }
-
-    /// Open an existing database in read-only mode (issue #263).
-    ///
-    /// Differences vs [`Self::with_dims`]:
-    /// - The parent directory is NOT created.
-    /// - The connection is opened with `SQLITE_OPEN_READ_ONLY` — SQLite
-    ///   itself refuses any DDL/DML that the application might miss.
-    /// - No `PRAGMA journal_mode=WAL` (WAL requires writable access).
-    /// - No `init_db_with_dims` (schema migration would mutate the DB).
-    ///
-    /// Returns an error if the file is absent (caller may want to fall
-    /// through to writable mode then). Use [`std::path::Path::exists`]
-    /// at the call site if you need a missing-DB fast path.
-    pub fn open_readonly(path: &Path) -> IcmResult<Self> {
-        ensure_sqlite_vec();
-        if !path.exists() {
-            return Err(IcmError::NotFound(format!(
-                "database not found at {}",
-                path.display()
-            )));
-        }
-        let conn = open_readonly_connection(path)?;
-        // foreign_keys is a no-op for reads; busy_timeout is still useful
-        // when another writer holds the file.
-        conn.execute_batch("PRAGMA foreign_keys=ON; PRAGMA busy_timeout=30000;")
-            .map_err(db_err)?;
-        Ok(Self {
-            conn,
-            cache: Mutex::new(new_cache()),
-            readonly: true,
-        })
-    }
-
-    /// Open an existing database for maintenance — integrity check and
-    /// repair (issue #313).
-    ///
-    /// Writable (so `REINDEX` and FTS `'rebuild'` can run) but, unlike
-    /// [`Self::with_dims`], it deliberately does NOT:
-    /// - run `init_db_with_dims` — schema migration would fail on, or mutate,
-    ///   a corrupt DB before it can even be inspected;
-    /// - switch `journal_mode` — a damaged file's on-disk format is left
-    ///   exactly as found so recovery reasons about the real state.
-    ///
-    /// Returns [`IcmError::NotFound`] when the file is absent.
-    pub fn open_maintenance(path: &Path) -> IcmResult<Self> {
-        ensure_sqlite_vec();
-        if !path.exists() {
-            return Err(IcmError::NotFound(format!(
-                "database not found at {}",
-                path.display()
-            )));
-        }
-        let conn = Connection::open(path)
-            .map_err(|e| IcmError::Database(format!("cannot open database: {e}")))?;
-        conn.execute_batch("PRAGMA busy_timeout=30000;")
-            .map_err(db_err)?;
-        Ok(Self {
-            conn,
-            cache: Mutex::new(new_cache()),
-            readonly: false,
-        })
-    }
-
-    /// Check database integrity (issue #313) and return a list of problems.
-    /// A healthy database yields exactly `["ok"]`; a damaged one yields one
-    /// entry per problem.
-    ///
-    /// Two complementary checks run:
-    /// 1. `PRAGMA integrity_check` — structural b-tree / page validation.
-    ///    This is what caught the shadow-table and index damage reported in
-    ///    the incident (`btreeInitPage`, `wrong # of entries in index …`).
-    /// 2. FTS5 `'integrity-check'` per shadow table — validates each FTS
-    ///    index's internal structure, complementing the structural pass for
-    ///    damage confined to the FTS shadow tables.
-    ///
-    /// This never returns `Err`: even a failure to *run* a check (e.g. an FTS
-    /// vtable too damaged to instantiate) is recorded as a problem, so the
-    /// caller — `icm doctor` / `icm repair` — always gets a usable verdict on
-    /// a badly corrupt database instead of a propagated error.
-    pub fn integrity_check(&self) -> IcmResult<Vec<String>> {
-        let mut problems = Vec::new();
-
-        // 1. Structural check. Record a run failure as a problem instead of
-        //    aborting the whole verdict.
-        match self.run_integrity_pragma() {
-            Ok(lines) => problems.extend(lines.into_iter().filter(|l| l != "ok")),
-            Err(e) => problems.push(format!("integrity_check pragma failed: {e}")),
-        }
-
-        // 2. Per-FTS-table consistency.
-        for table in FTS_TABLES {
-            // `rank = 1` makes FTS5 verify the index against the *content*
-            // table, not just its own internal structure. Without it, an
-            // index that is stale or out of step with the base table (e.g.
-            // an interrupted write) is reported as healthy. Requires
-            // SQLite ≥ 3.37 (bundled rusqlite is well past that).
-            let sql = format!("INSERT INTO {table}({table}, rank) VALUES('integrity-check', 1);");
-            match self.conn.execute_batch(&sql) {
-                Ok(()) => {}
-                Err(e) if is_missing_table(&e) => {} // legacy DB without this table
-                Err(e) => problems.push(format!("fts5 {table}: {e}")),
-            }
-        }
-
-        if problems.is_empty() {
-            Ok(vec!["ok".to_string()])
-        } else {
-            Ok(problems)
-        }
-    }
-
-    /// Structural-only integrity check (`PRAGMA integrity_check`), safe on a
-    /// read-only connection (issue #313 follow-up). Unlike
-    /// [`Self::integrity_check`] it does NOT run the FTS5 `'integrity-check'`
-    /// (which is an `INSERT` and needs a writable connection), so it never
-    /// mutates the DB or triggers a WAL checkpoint. Used by the read-only
-    /// inspection paths (`icm doctor`, `icm repair --dry-run`). A healthy DB
-    /// yields `["ok"]`. Never returns `Err`.
-    pub fn integrity_check_structural(&self) -> IcmResult<Vec<String>> {
-        let problems: Vec<String> = match self.run_integrity_pragma() {
-            Ok(lines) => lines.into_iter().filter(|l| l != "ok").collect(),
-            Err(e) => vec![format!("integrity_check pragma failed: {e}")],
-        };
-        if problems.is_empty() {
-            Ok(vec!["ok".to_string()])
-        } else {
-            Ok(problems)
-        }
-    }
-
-    /// Run `PRAGMA integrity_check` and collect its result rows.
-    fn run_integrity_pragma(&self) -> IcmResult<Vec<String>> {
-        let mut stmt = self
-            .conn
-            .prepare("PRAGMA integrity_check")
-            .map_err(db_err)?;
-        let rows = stmt
-            .query_map([], |row| row.get::<_, String>(0))
-            .map_err(db_err)?;
-        let mut out = Vec::new();
-        for r in rows {
-            out.push(r.map_err(db_err)?);
-        }
-        Ok(out)
-    }
-
-    /// Rebuild the FTS5 shadow tables from their content tables and `REINDEX`
-    /// every b-tree index (issue #313). This repairs the most common
-    /// corruption class — damaged indexes / FTS shadow tables with intact
-    /// base tables — without touching row data.
-    ///
-    /// Best-effort by design: a shadow table too damaged for `'rebuild'` to
-    /// even instantiate is skipped rather than aborting the whole repair, and
-    /// `REINDEX` failure is tolerated too. The caller re-runs
-    /// [`Self::integrity_check`] afterwards and reports any damage that
-    /// survived, so nothing is silently claimed fixed. Returns the FTS tables
-    /// that were successfully rebuilt.
-    pub fn rebuild_search_indexes(&self) -> IcmResult<Vec<String>> {
-        let mut rebuilt = Vec::new();
-        for table in FTS_TABLES {
-            let sql = format!("INSERT INTO {table}({table}) VALUES('rebuild');");
-            // A missing (legacy DB) or too-corrupt-to-instantiate shadow table
-            // is skipped rather than aborting; the post-repair integrity check
-            // surfaces any table that could not be restored.
-            if self.conn.execute_batch(&sql).is_ok() {
-                rebuilt.push(table.to_string());
-            }
-        }
-        // May fail on a badly damaged b-tree; the post-repair integrity check
-        // reports whatever REINDEX could not fix.
-        let _ = self.conn.execute_batch("REINDEX;");
-        Ok(rebuilt)
-    }
-
-    /// True when the store was opened read-only (issue #263). Read-like
-    /// methods skip side-effect mutations; write methods return
-    /// `IcmError::ReadOnly`.
-    #[must_use]
-    pub fn is_readonly(&self) -> bool {
-        self.readonly
-    }
-
-    /// Peek `icm_metadata.embedding_dims` without running any schema
-    /// migration. Returns `Ok(None)` when the DB file is absent, the
-    /// metadata table doesn't exist (legacy DB), or the row is missing.
-    ///
-    /// Use this *before* calling [`Self::with_dims`] when running in a
-    /// mode that must not trigger a destructive vector recreate — most
-    /// notably the `--no-embeddings` path (issue #267): if the caller
-    /// has no embedder loaded, `with_dims` would otherwise fall back to
-    /// `DEFAULT_EMBEDDING_DIMS`, mismatch the stored value, and silently
-    /// DROP `vec_memories` while NULL-ing every `memories.embedding`.
-    pub fn read_stored_embedding_dims(path: &Path) -> IcmResult<Option<usize>> {
-        if !path.exists() {
-            return Ok(None);
-        }
-        // Open strictly immutable so this helper survives a `chmod -w`
-        // sandbox (issue #263 interaction). `SQLITE_OPEN_READ_ONLY`
-        // alone is NOT enough — SQLite still tries to create/update
-        // the `-shm` / `-wal` companion files for any WAL-mode DB,
-        // which fails when the parent directory is non-writable.
-        // The `immutable=1` URI flag tells SQLite the file will not
-        // change during the connection's lifetime and stops it from
-        // touching WAL infrastructure entirely. This is a one-shot probe
-        // (not a long-lived connection), so the staleness that #319 fixes
-        // for `open_readonly` does not apply here.
-        let conn = open_readonly_uri(path, true)?;
-        // Probe for the metadata table — legacy DBs predate it.
-        let has_table: bool = conn
-            .query_row(
-                "SELECT COUNT(*) > 0 FROM sqlite_master
-                 WHERE type = 'table' AND name = 'icm_metadata'",
-                [],
-                |row| row.get(0),
-            )
-            .map_err(db_err)?;
-        if !has_table {
-            return Ok(None);
-        }
-        let row: Option<String> = conn
-            .query_row(
-                "SELECT value FROM icm_metadata WHERE key = 'embedding_dims'",
-                [],
-                |row| row.get(0),
-            )
-            .optional()
-            .map_err(db_err)?;
-        Ok(row.and_then(|s| s.parse().ok()))
-    }
-
-    /// Open or create a store with a specific embedding dimension.
-    pub fn with_dims(path: &Path, embedding_dims: usize) -> IcmResult<Self> {
-        ensure_sqlite_vec();
-        if let Some(parent) = path.parent() {
-            std::fs::create_dir_all(parent)
-                .map_err(|e| IcmError::Database(format!("cannot create db directory: {e}")))?;
-        }
-        let conn = Connection::open(path)
-            .map_err(|e| IcmError::Database(format!("cannot open database: {e}")))?;
-        // Schema/PRAGMA setup races with other processes opening the same
-        // brand-new DB simultaneously (found via real concurrent testing:
-        // 10 processes opening one fresh DB, several hung, others errored,
-        // zero succeeded). Both the WAL-mode switch (needs a brief
-        // exclusive lock to convert a fresh file — busy_timeout must be
-        // set first in the same batch, or this statement itself has no
-        // timeout active yet) and init_db_with_dims's schema creation
-        // (BEGIN IMMEDIATE-wrapped in schema.rs, but SQLite's FTS5
-        // virtual-table module can still surface a transient error on the
-        // loser even so) are retried together here: whatever the winner
-        // already committed, a fresh attempt's PRAGMA + existence checks
-        // correctly see and no-op past it. Jittered, not just linear,
-        // backoff: a fixed schedule lets many racing processes retry in
-        // near-lockstep and collide again and again.
-        let mut last_err = None;
-        for attempt in 0..40u32 {
-            if attempt > 0 {
-                let base_ms = (attempt as u64).min(20) * 15;
-                let jitter_ms = std::time::SystemTime::now()
-                    .duration_since(std::time::UNIX_EPOCH)
-                    .map(|d| u64::from(d.subsec_nanos()) % 40)
-                    .unwrap_or(0);
-                std::thread::sleep(std::time::Duration::from_millis(base_ms + jitter_ms));
-            }
-            // A short busy_timeout during this retry loop, not the normal
-            // 30s: 30s is meant to tolerate *ordinary* write contention
-            // during real use (e.g. a hook write racing a consolidate),
-            // but stacked with up to 40 outer attempts here it turns into
-            // a potentially multi-minute worst case under real multi-
-            // process contention (measured: several real `icm` processes
-            // hung well past 60s with the 30s inner timeout) — the outer
-            // jittered loop is what actually provides the robustness here,
-            // so the inner SQLite-level wait only needs to be long enough
-            // to smooth over a single competing transaction, not to be a
-            // retry mechanism in its own right. Restored to 30s below once
-            // the schema is confirmed present.
-            let attempt_result = conn
-                .execute_batch(
-                    "PRAGMA busy_timeout=1000; PRAGMA journal_mode=WAL; PRAGMA foreign_keys=ON;",
-                )
-                .map_err(db_err)
-                .and_then(|()| init_db_with_dims(&conn, embedding_dims));
-            match attempt_result {
-                Ok(()) => {
-                    last_err = None;
-                    break;
-                }
-                Err(e) => {
-                    let msg = e.to_string();
-                    let transient = msg.contains("vtable constructor failed")
-                        || msg.contains("already exists")
-                        || msg.contains("database is locked")
-                        || msg.contains("database is busy");
-                    last_err = Some(e);
-                    if !transient {
-                        break;
-                    }
-                }
-            }
-        }
-        if let Some(e) = last_err {
-            return Err(e);
-        }
-        conn.execute_batch("PRAGMA busy_timeout=30000;")
-            .map_err(db_err)?;
-
-        Ok(Self {
-            conn,
-            cache: Mutex::new(new_cache()),
-            readonly: false,
-        })
-    }
-
-    /// Apply decay if more than 24 hours since last decay.
-    /// Called automatically on recall to avoid manual `icm decay` cron.
-    ///
-    /// No-op when the store is read-only (issue #263): recall must work
-    /// against a DB the process cannot write to, and the bookkeeping
-    /// writes here would otherwise abort the whole read with
-    /// "attempt to write a readonly database".
-    pub fn maybe_auto_decay(&self) -> IcmResult<()> {
-        if self.readonly {
-            return Ok(());
-        }
-        let now = Utc::now();
-        let now_str = now.to_rfc3339();
-
-        // Audit finding: this used to apply a flat 0.95 step whenever >= 1
-        // day had passed, regardless of HOW MANY days had actually passed —
-        // a machine touched once a week decayed at 0.95/week (≈0.993/day)
-        // instead of the documented 0.95/day. Read the previous timestamp
-        // first so the step can be `0.95 ^ elapsed_days` (compounded),
-        // matching the documented per-day rate regardless of gaps between
-        // calls. (The 0.95 base itself stays hardcoded here — wiring the
-        // CLI's configurable `decay_rate` through to this crate is a
-        // separate, out-of-scope change.)
-        let last_decay_at: Option<String> = self
-            .conn
-            .query_row(
-                "SELECT value FROM icm_metadata WHERE key = 'last_decay_at'",
-                [],
-                |row| row.get(0),
-            )
-            .optional()
-            .map_err(db_err)?;
-        let elapsed_days = last_decay_at
-            .as_deref()
-            .and_then(|prev| prev.parse::<DateTime<Utc>>().ok())
-            .map(|prev| (now - prev).num_seconds() as f64 / 86_400.0)
-            .filter(|d| d.is_finite() && *d > 0.0)
-            .unwrap_or(1.0); // first run ever: preserve the historical single-step behavior
-
-        // Atomic check-and-update: only one caller wins the race. (A narrow
-        // window between the read above and this claim could let a losing
-        // racer's `elapsed_days` be computed from a slightly stale
-        // timestamp, but only one claim ever succeeds — a day or two of
-        // imprecision in a decay RATE is harmless, not worth a stricter
-        // compare-and-swap loop.)
-        let changed = self
-            .conn
-            .execute(
-                "INSERT INTO icm_metadata (key, value) VALUES ('last_decay_at', ?1)
-                 ON CONFLICT(key) DO UPDATE SET value = ?1
-                 WHERE value IS NULL OR julianday(?1) - julianday(value) >= 1.0",
-                params![now_str],
-            )
-            .map_err(db_err)?;
-
-        if changed > 0 {
-            let factor = 0.95_f64.powf(elapsed_days) as f32;
-            self.apply_decay(factor)?;
-        }
-
-        Ok(())
-    }
-
-    /// Atomically increment the hook call counter and return the new value.
-    pub fn increment_hook_counter(&self) -> IcmResult<usize> {
-        let count: usize = self
-            .conn
-            .query_row(
-                "INSERT INTO icm_metadata (key, value) VALUES ('hook_counter', '1')
-                 ON CONFLICT(key) DO UPDATE SET value = CAST(CAST(value AS INTEGER) + 1 AS TEXT)
-                 RETURNING CAST(value AS INTEGER)",
-                [],
-                |row| row.get(0),
-            )
-            .map_err(db_err)?;
-        Ok(count)
-    }
-
-    /// Reset the hook call counter to 0.
-    pub fn reset_hook_counter(&self) -> IcmResult<()> {
-        self.conn
-            .execute(
-                "INSERT INTO icm_metadata (key, value) VALUES ('hook_counter', '0')
-                 ON CONFLICT(key) DO UPDATE SET value = '0'",
-                [],
-            )
-            .map_err(db_err)?;
-        Ok(())
-    }
-
-    // ── Async extraction queue ─────────────────────────────────────────
-    //
-    // Row tuple shape: `(id, project, tool_name, raw_output, captured_at)`
-    //
-    // When `[extraction.summarizer].provider` is set to something other
-    // than `"none"`, PostToolUse hooks INSERT raw tool output here in
-    // ~50ms (no embedder load) and a worker (`icm extract-pending` or
-    // the SessionEnd async fork) dequeues batches and runs the LLM CLI.
-
-    /// Enqueue raw tool output for later LLM extraction. Returns the
-    /// generated row id so the caller can correlate logs.
-    pub fn enqueue_pending_extraction(
-        &self,
-        project: &str,
-        tool_name: &str,
-        raw_output: &str,
-    ) -> IcmResult<String> {
-        let id = ulid::Ulid::new().to_string();
-        let now = chrono::Utc::now().to_rfc3339();
-        self.conn
-            .execute(
-                "INSERT INTO pending_extractions (id, project, tool_name, raw_output, captured_at)
-                 VALUES (?1, ?2, ?3, ?4, ?5)",
-                rusqlite::params![id, project, tool_name, raw_output, now],
-            )
-            .map_err(db_err)?;
-        Ok(id)
-    }
-
-    /// Pop up to `limit` oldest pending rows. Caller is expected to call
-    /// `delete_pending_extractions` after successful processing.
-    pub fn list_pending_extractions(&self, limit: usize) -> IcmResult<Vec<PendingRow>> {
-        let mut stmt = self
-            .conn
-            .prepare(
-                "SELECT id, project, tool_name, raw_output, captured_at
-                 FROM pending_extractions
-                 ORDER BY captured_at ASC
-                 LIMIT ?1",
-            )
-            .map_err(db_err)?;
-        let rows = stmt
-            .query_map([limit as i64], |row| {
-                Ok((
-                    row.get::<_, String>(0)?,
-                    row.get::<_, String>(1)?,
-                    row.get::<_, String>(2)?,
-                    row.get::<_, String>(3)?,
-                    row.get::<_, String>(4)?,
-                ))
-            })
-            .map_err(db_err)?
-            .collect::<Result<Vec<_>, _>>()
-            .map_err(db_err)?;
-        Ok(rows)
-    }
-
-    /// Delete pending rows by id. Used after a worker has processed them.
-    pub fn delete_pending_extractions(&self, ids: &[String]) -> IcmResult<usize> {
-        if ids.is_empty() {
-            return Ok(0);
-        }
-        let placeholders = ids.iter().map(|_| "?").collect::<Vec<_>>().join(",");
-        let sql = format!("DELETE FROM pending_extractions WHERE id IN ({placeholders})");
-        let params: Vec<&dyn rusqlite::ToSql> =
-            ids.iter().map(|s| s as &dyn rusqlite::ToSql).collect();
-        let n = self.conn.execute(&sql, params.as_slice()).map_err(db_err)?;
-        Ok(n)
-    }
-
-    /// Total rows currently waiting in the queue. Used by `icm doctor`.
-    pub fn pending_extraction_count(&self) -> IcmResult<usize> {
-        let n: i64 = self
-            .conn
-            .query_row("SELECT COUNT(*) FROM pending_extractions", [], |r| r.get(0))
-            .map_err(db_err)?;
-        Ok(n as usize)
-    }
-
-    // ── Code areas (auto-captured file edits — issue #196) ────────────
-    //
-    // `cmd_hook_post` calls `upsert_code_area` whenever the upstream
-    // tool was Edit / Write / MultiEdit / NotebookEdit. Same project +
-    // file_path => touch_count++ via ON CONFLICT.
-
-    /// Insert or refresh a row for `(project, file_path)`. On conflict
-    /// bumps `touch_count`, updates `last_touched_at`, refreshes
-    /// `session_id` / `tool_name`, and only overwrites `description` if
-    /// the caller passes `Some` (so the most recent meaningful hint
-    /// wins without clobbering an existing one with `None`).
-    pub fn upsert_code_area(
-        &self,
-        project: &str,
-        file_path: &str,
-        description: Option<&str>,
-        session_id: Option<&str>,
-        tool_name: Option<&str>,
-    ) -> IcmResult<()> {
-        let now = chrono::Utc::now().to_rfc3339();
-        self.conn
-            .execute(
-                "INSERT INTO code_areas (project, file_path, description,
-                    session_id, tool_name, touch_count,
-                    first_touched_at, last_touched_at)
-                 VALUES (?1, ?2, ?3, ?4, ?5, 1, ?6, ?6)
-                 ON CONFLICT(project, file_path) DO UPDATE SET
-                    touch_count = touch_count + 1,
-                    last_touched_at = excluded.last_touched_at,
-                    session_id = COALESCE(excluded.session_id, session_id),
-                    tool_name = COALESCE(excluded.tool_name, tool_name),
-                    description = COALESCE(excluded.description, description)",
-                rusqlite::params![project, file_path, description, session_id, tool_name, now],
-            )
-            .map_err(db_err)?;
-        Ok(())
-    }
-
-    /// List code areas, optionally filtered by project / file_path /
-    /// since timestamp. `limit` caps the result count (use `usize::MAX`
-    /// to disable). Ordered by `last_touched_at DESC` so the freshest
-    /// edits come first.
-    pub fn list_code_areas(
-        &self,
-        project: Option<&str>,
-        in_file: Option<&str>,
-        since: Option<DateTime<Utc>>,
-        limit: usize,
-    ) -> IcmResult<Vec<CodeArea>> {
-        let mut sql = String::from(
-            "SELECT id, project, file_path, description, session_id, tool_name,
-                    touch_count, first_touched_at, last_touched_at
-             FROM code_areas
-             WHERE 1=1",
-        );
-        let mut params: Vec<Box<dyn rusqlite::ToSql>> = Vec::new();
-        if let Some(p) = project {
-            sql.push_str(" AND project = ?");
-            params.push(Box::new(p.to_string()));
-        }
-        if let Some(f) = in_file {
-            // Match either an exact file_path or a path that ends with
-            // the provided fragment so users can pass a short suffix.
-            sql.push_str(" AND (file_path = ? OR file_path LIKE ?)");
-            params.push(Box::new(f.to_string()));
-            params.push(Box::new(format!("%/{f}")));
-        }
-        if let Some(t) = since {
-            sql.push_str(" AND last_touched_at >= ?");
-            params.push(Box::new(t.to_rfc3339()));
-        }
-        sql.push_str(" ORDER BY last_touched_at DESC LIMIT ?");
-        params.push(Box::new(limit as i64));
-
-        let mut stmt = self.conn.prepare(&sql).map_err(db_err)?;
-        let param_refs: Vec<&dyn rusqlite::ToSql> = params
-            .iter()
-            .map(|p| p.as_ref() as &dyn rusqlite::ToSql)
-            .collect();
-        let rows = stmt
-            .query_map(param_refs.as_slice(), |row| {
-                let first: String = row.get(7)?;
-                let last: String = row.get(8)?;
-                Ok(CodeArea {
-                    id: row.get(0)?,
-                    project: row.get(1)?,
-                    file_path: row.get(2)?,
-                    description: row.get(3)?,
-                    session_id: row.get(4)?,
-                    tool_name: row.get(5)?,
-                    touch_count: row.get(6)?,
-                    first_touched_at: DateTime::parse_from_rfc3339(&first)
-                        .map(|d| d.with_timezone(&Utc))
-                        .unwrap_or_else(|_| Utc::now()),
-                    last_touched_at: DateTime::parse_from_rfc3339(&last)
-                        .map(|d| d.with_timezone(&Utc))
-                        .unwrap_or_else(|_| Utc::now()),
-                })
-            })
-            .map_err(db_err)?
-            .collect::<Result<Vec<_>, _>>()
-            .map_err(db_err)?;
-        Ok(rows)
-    }
-
-    /// Total rows in `code_areas`. Cheap; used by stats / doctor.
-    pub fn code_area_count(&self) -> IcmResult<usize> {
-        let n: i64 = self
-            .conn
-            .query_row("SELECT COUNT(*) FROM code_areas", [], |r| r.get(0))
-            .map_err(db_err)?;
-        Ok(n as usize)
-    }
-
-    // ── Hook telemetry ─────────────────────────────────────────────────
-    //
-    // Every `icm hook <event>` fire writes one row to `hook_events`. Read
-    // back via `hook_events_recent` / `hook_stats`. Inserts are designed
-    // to be cheap (single statement, no FTS) so they stay well under the
-    // <50ms async-path budget.
-
-    /// Append one hook telemetry row. Errors are swallowed by callers in
-    /// hook paths (logging must never block the user), but tests can
-    /// inspect the `Result`.
-    pub fn record_hook_event(&self, ev: &HookEventInsert) -> IcmResult<i64> {
-        let now = chrono::Utc::now().to_rfc3339();
-        self.conn
-            .execute(
-                "INSERT INTO hook_events
-                 (ts, event, project, session_id, tool_name,
-                  duration_ms, exit_code, payload_size, note)
-                 VALUES (?1, ?2, ?3, ?4, ?5, ?6, ?7, ?8, ?9)",
-                rusqlite::params![
-                    now,
-                    ev.event,
-                    ev.project,
-                    ev.session_id,
-                    ev.tool_name,
-                    ev.duration_ms,
-                    ev.exit_code,
-                    ev.payload_size,
-                    ev.note,
-                ],
-            )
-            .map_err(db_err)?;
-        Ok(self.conn.last_insert_rowid())
-    }
-
-    /// Most recent `limit` hook events, newest first. Optional `event`
-    /// filter (e.g. `Some("end")` to see only SessionEnd hooks).
-    pub fn hook_events_recent(
-        &self,
-        limit: usize,
-        event_filter: Option<&str>,
-    ) -> IcmResult<Vec<HookEvent>> {
-        let limit_i64 = limit as i64;
-        let row_to_event = |row: &rusqlite::Row<'_>| -> rusqlite::Result<HookEvent> {
-            let ts_str: String = row.get(1)?;
-            let ts = chrono::DateTime::parse_from_rfc3339(&ts_str)
-                .map(|t| t.with_timezone(&Utc))
-                .unwrap_or_else(|_| Utc::now());
-            Ok(HookEvent {
-                id: row.get(0)?,
-                ts,
-                event: row.get(2)?,
-                project: row.get(3)?,
-                session_id: row.get(4)?,
-                tool_name: row.get(5)?,
-                duration_ms: row.get(6)?,
-                exit_code: row.get(7)?,
-                payload_size: row.get(8)?,
-                note: row.get(9)?,
-            })
-        };
-        match event_filter {
-            Some(e) => {
-                let mut stmt = self
-                    .conn
-                    .prepare(
-                        "SELECT id, ts, event, project, session_id, tool_name,
-                                duration_ms, exit_code, payload_size, note
-                         FROM hook_events
-                         WHERE event = ?1
-                         ORDER BY id DESC
-                         LIMIT ?2",
-                    )
-                    .map_err(db_err)?;
-                let rows = stmt
-                    .query_map(rusqlite::params![e, limit_i64], row_to_event)
-                    .map_err(db_err)?;
-                collect_rows(rows)
-            }
-            None => {
-                let mut stmt = self
-                    .conn
-                    .prepare(
-                        "SELECT id, ts, event, project, session_id, tool_name,
-                                duration_ms, exit_code, payload_size, note
-                         FROM hook_events
-                         ORDER BY id DESC
-                         LIMIT ?1",
-                    )
-                    .map_err(db_err)?;
-                let rows = stmt
-                    .query_map(rusqlite::params![limit_i64], row_to_event)
-                    .map_err(db_err)?;
-                collect_rows(rows)
-            }
-        }
-    }
-
-    /// Aggregate counts and latency percentiles per event type, over a
-    /// time window starting `since` (RFC3339). Used by `icm hook-stats`.
-    pub fn hook_stats(&self, since_rfc3339: &str) -> IcmResult<Vec<HookStatsRow>> {
-        // Pull each event type and compute percentiles in Rust — SQLite
-        // has no native percentile function and the row count is small
-        // enough (~1k/day worst case) that an in-process sort is fine.
-        let mut stmt = self
-            .conn
-            .prepare(
-                "SELECT event, duration_ms, exit_code
-                 FROM hook_events
-                 WHERE ts >= ?1
-                 ORDER BY event",
-            )
-            .map_err(db_err)?;
-        let rows = stmt
-            .query_map([since_rfc3339], |r| {
-                Ok((
-                    r.get::<_, String>(0)?,
-                    r.get::<_, Option<i64>>(1)?,
-                    r.get::<_, i32>(2)?,
-                ))
-            })
-            .map_err(db_err)?;
-        let mut by_event: std::collections::BTreeMap<String, Vec<(Option<i64>, i32)>> =
-            std::collections::BTreeMap::new();
-        for r in rows {
-            let (ev, dur, exit) = r.map_err(db_err)?;
-            by_event.entry(ev).or_default().push((dur, exit));
-        }
-        let mut out = Vec::with_capacity(by_event.len());
-        for (event, mut items) in by_event {
-            let count = items.len() as i64;
-            let error_count = items.iter().filter(|(_, e)| *e != 0).count() as i64;
-            let mut durations: Vec<i64> = items.iter().filter_map(|(d, _)| *d).collect();
-            durations.sort_unstable();
-            let avg = if durations.is_empty() {
-                0.0
-            } else {
-                durations.iter().sum::<i64>() as f64 / durations.len() as f64
-            };
-            let p = |q: f64| -> i64 {
-                if durations.is_empty() {
-                    0
-                } else {
-                    let idx = ((durations.len() as f64 - 1.0) * q).round() as usize;
-                    durations[idx.min(durations.len() - 1)]
-                }
-            };
-            out.push(HookStatsRow {
-                event,
-                count,
-                error_count,
-                avg_duration_ms: avg,
-                p50_duration_ms: p(0.50),
-                p99_duration_ms: p(0.99),
-            });
-            // Avoid clippy 'unused variable' on items after move
-            let _ = &mut items;
-        }
-        Ok(out)
-    }
-
-    /// Delete hook telemetry rows older than `cutoff_rfc3339`. Used by an
-    /// optional retention pass (`icm hook-log --prune-older-than ...`).
-    pub fn prune_hook_events(&self, cutoff_rfc3339: &str) -> IcmResult<usize> {
-        let n = self
-            .conn
-            .execute(
-                "DELETE FROM hook_events WHERE ts < ?1",
-                rusqlite::params![cutoff_rfc3339],
-            )
-            .map_err(db_err)?;
-        Ok(n)
-    }
-
-    /// Total rows currently in `hook_events`. Used by tests and `icm doctor`.
-    pub fn hook_event_count(&self) -> IcmResult<usize> {
-        let n: i64 = self
-            .conn
-            .query_row("SELECT COUNT(*) FROM hook_events", [], |r| r.get(0))
-            .map_err(db_err)?;
-        Ok(n as usize)
-    }
-
-    pub fn in_memory() -> IcmResult<Self> {
-        Self::in_memory_with_dims(icm_core::DEFAULT_EMBEDDING_DIMS)
-    }
-
-    /// Open an in-memory store with a specific embedding dimension.
-    /// Useful for tests that exercise the dim-migration / dim-drift paths.
-    pub fn in_memory_with_dims(embedding_dims: usize) -> IcmResult<Self> {
-        ensure_sqlite_vec();
-        let conn = Connection::open_in_memory()
-            .map_err(|e| IcmError::Database(format!("cannot open in-memory db: {e}")))?;
-        conn.execute_batch("PRAGMA foreign_keys=ON; PRAGMA busy_timeout=30000;")
-            .map_err(db_err)?;
-        init_db_with_dims(&conn, embedding_dims)?;
-        Ok(Self {
-            conn,
-            cache: Mutex::new(new_cache()),
-            readonly: false,
-        })
-    }
-
-    fn cache_get(&self, id: &str) -> Option<Memory> {
-        self.cache.lock().ok().and_then(|mut c| c.get(id).cloned())
-    }
-
-    fn cache_put(&self, m: &Memory) {
-        if let Ok(mut c) = self.cache.lock() {
-            c.put(m.id.clone(), m.clone());
-        }
-    }
-
-    fn cache_invalidate(&self, id: &str) {
-        if let Ok(mut c) = self.cache.lock() {
-            c.pop(id);
-        }
-    }
-
-    fn cache_invalidate_many(&self, ids: &[&str]) {
-        if let Ok(mut c) = self.cache.lock() {
-            for id in ids {
-                c.pop(*id);
-            }
-        }
-    }
-
-    fn cache_clear(&self) {
-        if let Ok(mut c) = self.cache.lock() {
-            c.clear();
-        }
-    }
-}
-
-fn new_cache() -> LruCache<String, Memory> {
-    let cap = NonZeroUsize::new(MEMORY_CACHE_CAP)
-        .expect("MEMORY_CACHE_CAP must be non-zero — see store.rs");
-    LruCache::new(cap)
-}
-
-// ---------------------------------------------------------------------------
-// Memory helpers
-// ---------------------------------------------------------------------------
-
-fn source_type(source: &MemorySource) -> &'static str {
-    match source {
-        MemorySource::ClaudeCode { .. } => "claude_code",
-        MemorySource::Conversation { .. } => "conversation",
-        MemorySource::Manual => "manual",
-    }
-}
-
-fn source_data(source: &MemorySource) -> Option<String> {
-    match source {
-        MemorySource::Manual => None,
-        other => serde_json::to_string(other).ok(),
-    }
-}
-
-fn parse_source(source_type_str: &str, source_data_str: Option<String>) -> MemorySource {
-    match source_type_str {
-        "manual" => MemorySource::Manual,
-        _ => source_data_str
-            .and_then(|d| serde_json::from_str(&d).ok())
-            .unwrap_or(MemorySource::Manual),
-    }
-}
-
-fn embedding_to_blob(embedding: &[f32]) -> Vec<u8> {
-    embedding.as_bytes().to_vec()
-}
-
-fn blob_to_embedding(blob: &[u8]) -> Vec<f32> {
-    if !blob.len().is_multiple_of(4) {
-        tracing::warn!(
-            blob_size = blob.len(),
-            "embedding blob size not divisible by 4, truncating"
-        );
-    }
-    blob.chunks_exact(4)
-        .map(|c| f32::from_le_bytes([c[0], c[1], c[2], c[3]]))
-        .collect()
-}
-
-fn row_to_memory(row: &rusqlite::Row) -> rusqlite::Result<Memory> {
-    // Column order: id(0), created_at(1), updated_at(2), last_accessed(3),
-    //   access_count(4), weight(5), topic(6), summary(7), raw_excerpt(8),
-    //   keywords(9), importance(10), source_type(11), source_data(12),
-    //   related_ids(13), embedding(14)
-    let keywords_json: String = row.get::<_, Option<String>>(9)?.unwrap_or_default();
-    let keywords: Vec<String> = serde_json::from_str(&keywords_json).unwrap_or_default();
-
-    let importance_str: String = row.get(10)?;
-    let importance = importance_str.parse().unwrap_or(Importance::Medium);
-
-    let source_type_str: String = row.get(11)?;
-    let source_data_str: Option<String> = row.get(12)?;
-    let source = parse_source(&source_type_str, source_data_str);
-
-    let related_json: String = row.get::<_, Option<String>>(13)?.unwrap_or_default();
-    let related_ids: Vec<String> = serde_json::from_str(&related_json).unwrap_or_default();
-
-    let embedding: Option<Vec<f32>> = row
-        .get::<_, Option<Vec<u8>>>(14)?
-        .map(|b| blob_to_embedding(&b));
-
-    let created_at_str: String = row.get(1)?;
-    let updated_at_str: String = row.get::<_, Option<String>>(2)?.unwrap_or_default();
-    let last_accessed_str: String = row.get(3)?;
-
-    let created_at = parse_dt(&created_at_str);
-
-    Ok(Memory {
-        id: row.get(0)?,
-        created_at,
-        updated_at: if updated_at_str.is_empty() {
-            created_at
-        } else {
-            parse_dt(&updated_at_str)
-        },
-        last_accessed: parse_dt(&last_accessed_str),
-        access_count: row.get::<_, u32>(4)?,
-        weight: row.get(5)?,
-        topic: row.get(6)?,
-        summary: row.get(7)?,
-        raw_excerpt: row.get(8)?,
-        keywords,
-        importance,
-        source,
-        related_ids,
-        embedding,
-        scope: icm_core::Scope::User, // default for existing local memories
-    })
-}
-
-const SELECT_COLS: &str = "id, created_at, updated_at, last_accessed, access_count, weight, \
-                           topic, summary, raw_excerpt, keywords, \
-                           importance, source_type, source_data, related_ids, embedding";
-
-/// Sanitize a query string for FTS5 MATCH.
-///
-/// FTS5 treats characters like `-`, `*`, `"`, `:`, `^`, `+`, `~` as operators.
-/// A query like `"sqlite-vec"` makes FTS5 interpret `-` as NOT and `vec` as a
-/// column name, causing "no such column: vec".
-///
-/// Escape `%`, `_`, and the escape character itself so a keyword can be
-/// safely wrapped in a `%...%` LIKE pattern. Pair with `ESCAPE '\'` in the
-/// SQL — without it, a keyword containing `%` matches every row and `_`
-/// matches any single character (audit finding).
-fn escape_like_wildcards(s: &str) -> String {
-    s.replace('\\', "\\\\")
-        .replace('%', "\\%")
-        .replace('_', "\\_")
-}
-
-/// Cap on auxiliary metadata (transcript sessions/messages) - best-effort
-/// truncation, not rejection, matching MAX_MESSAGE_BYTES's rationale.
-const MAX_METADATA_BYTES: usize = 8 * 1024;
-
-/// Truncate `s` to at most `max` bytes without splitting a UTF-8 char.
-fn truncate_at_char_boundary(s: &str, max: usize) -> &str {
-    if s.len() <= max {
-        return s;
-    }
-    let mut cut = max;
-    while !s.is_char_boundary(cut) {
-        cut -= 1;
-    }
-    &s[..cut]
-}
-
-/// This function strips special chars and wraps each token in double quotes.
-fn sanitize_fts_query(query: &str) -> String {
-    // Limit input length to prevent abuse (UTF-8 safe truncation)
-    let query = if query.len() > 10_000 {
-        let mut end = 10_000;
-        while end > 0 && !query.is_char_boundary(end) {
-            end -= 1;
-        }
-        &query[..end]
-    } else {
-        query
-    };
-
-    // Replace FTS5 operator chars with spaces, then quote each resulting token.
-    // FTS5 tokenizer (unicode61) splits on `-` too, so we must keep tokens separate.
-    let cleaned: String = query
-        .chars()
-        .map(|c| {
-            if matches!(
-                c,
-                '-' | '*' | '"' | '(' | ')' | '{' | '}' | ':' | '^' | '+' | '~' | '\\'
-            ) {
-                ' '
-            } else {
-                c
-            }
-        })
-        .collect();
-
-    let tokens: Vec<String> = cleaned
-        .split_whitespace()
-        .filter(|w| !w.is_empty())
-        .take(100) // Limit token count to prevent excessive query complexity
-        .map(|w| {
-            // Strip any remaining quotes from tokens before wrapping in quotes
-            let stripped = w.replace('"', "");
-            format!("\"{stripped}\"")
-        })
-        .collect();
-    tokens.join(" ")
-}
-
-/// Whether `e` is FTS5 rejecting a malformed MATCH query (e.g. "hello AND",
-/// unbalanced parens) rather than a genuine database error. Used by
-/// `search_transcripts` to degrade to "no results" instead of surfacing a
-/// raw sqlite error, without pre-sanitizing the query text away from valid
-/// FTS5 syntax (which callers rely on — see
-/// `test_transcript_search_fts5_boolean_and_phrase`).
-fn is_fts5_syntax_error(e: &rusqlite::Error) -> bool {
-    matches!(
-        e,
-        rusqlite::Error::SqliteFailure(_, Some(msg)) if msg.contains("fts5: syntax error")
-    )
-}
-
-// ---------------------------------------------------------------------------
-// MemoryStore impl
-// ---------------------------------------------------------------------------
-
-/// Maximum byte length of a stored summary. Audit finding: a transcript
-/// containing a 1 MB unbroken text block landed as a single memory whose
-/// summary was the full 1 MB blob. Caps the cost of a single bad write
-/// (memory bloat, embedding compute, FTS5 index growth) to a generous
-/// but bounded 64 KB.
-const MAX_SUMMARY_BYTES: usize = 64 * 1024;
-
-/// Maximum byte length of a stored topic. Topics surface in `icm
-/// topics` listings and as the routing key for project filters; a
-/// thousand-byte topic is always a bug, never legitimate user input.
-const MAX_TOPIC_BYTES: usize = 256;
-
-/// Validate and normalize a `Memory` before insertion. Trims topic
-/// whitespace and rejects inputs that we know corrupt or break the
-/// store:
-///
-/// - Empty or whitespace-only `topic` / `summary` — these would surface
-///   as blank rows in `icm topics` / `icm list` and pollute the FTS5
-///   index without conveying information.
-/// - NUL byte (`\0`) in `topic` or `summary` — libsql binds text via a
-///   NUL-terminated C string, so anything past the first `\0` is
-///   silently dropped. Rather than silently truncate, refuse the
-///   write so the caller knows.
-/// - Newline / CR / tab in `topic` — these break the `icm topics`
-///   tabular layout and could enable display-spoofing of topic names
-///   (e.g. a topic that visually overlaps another in TUI/log output).
-///   Allowed in `summary` since it's free-form prose.
-/// - `topic` longer than `MAX_TOPIC_BYTES` or `summary` longer than
-///   `MAX_SUMMARY_BYTES` — see the constant docs for rationale.
-fn validate_and_normalize(mut memory: Memory) -> IcmResult<Memory> {
-    memory.topic = memory.topic.trim().to_string();
-    validate_fields(&memory.topic, &memory.summary)?;
-    Ok(memory)
-}
-
-/// The borrowed core of [`validate_and_normalize`], shared with `update()`
-/// (audit finding: the update path previously bypassed every size/content
-/// check, so oversized or NUL-carrying payloads could enter the store by
-/// storing small then updating big).
-fn validate_fields(topic: &str, summary: &str) -> IcmResult<()> {
-    if topic.is_empty() {
-        return Err(IcmError::InvalidInput("topic cannot be empty".into()));
-    }
-    if summary.trim().is_empty() {
-        return Err(IcmError::InvalidInput("summary cannot be empty".into()));
-    }
-    if topic.contains('\0') {
-        return Err(IcmError::InvalidInput(
-            "topic must not contain NUL bytes".into(),
-        ));
-    }
-    if summary.contains('\0') {
-        return Err(IcmError::InvalidInput(
-            "summary must not contain NUL bytes".into(),
-        ));
-    }
-    if topic.contains(['\n', '\r', '\t']) {
-        return Err(IcmError::InvalidInput(
-            "topic must not contain newline / CR / tab characters".into(),
-        ));
-    }
-    if topic.len() > MAX_TOPIC_BYTES {
-        return Err(IcmError::InvalidInput(format!(
-            "topic exceeds {} bytes",
-            MAX_TOPIC_BYTES
-        )));
-    }
-    if summary.len() > MAX_SUMMARY_BYTES {
-        return Err(IcmError::InvalidInput(format!(
-            "summary exceeds {} bytes",
-            MAX_SUMMARY_BYTES
-        )));
-    }
-    Ok(())
-}
-
-/// Local total order on `Importance` (Critical > High > Medium > Low).
-/// `Importance` does not implement `Ord` because the project did not
-/// want to imply a globally meaningful ordering across all uses
-/// (e.g. presentation, filtering). For the dedup-merge path we *do*
-/// want to take the maximum so re-storing with a higher priority
-/// upgrades the existing row.
-fn importance_rank(i: Importance) -> u8 {
-    match i {
-        Importance::Critical => 4,
-        Importance::High => 3,
-        Importance::Medium => 2,
-        Importance::Low => 1,
-    }
-}
-
-/// Return the higher-priority importance. Used by the dedup path so
-/// `store(...)` semantics are "re-store with critical upgrades, never
-/// downgrades".
-fn max_importance(a: Importance, b: Importance) -> Importance {
-    if importance_rank(a) >= importance_rank(b) {
-        a
-    } else {
-        b
-    }
-}
-
-/// SHA-256 over the normalized `(topic, summary)` pair, hex-encoded.
-/// Normalization: trim + lowercase + collapse whitespace runs to single
-/// spaces. Topic and summary are joined by `\0` to prevent boundary
-/// ambiguity (e.g. `"a"|"bc"` vs `"ab"|"c"` would otherwise hash the
-/// same). Used by the dedup `INSERT OR IGNORE` path.
-pub(crate) fn summary_hash(topic: &str, summary: &str) -> String {
-    let topic_n = topic.trim().to_lowercase();
-    let summary_n: String = summary
-        .split_whitespace()
-        .collect::<Vec<&str>>()
-        .join(" ")
-        .to_lowercase();
-    let mut h = Sha256::new();
-    h.update(topic_n.as_bytes());
-    h.update(b"\0");
-    h.update(summary_n.as_bytes());
-    format!("{:x}", h.finalize())
-}
-
-impl SqliteStore {
-    /// Insert a memory into the database without transaction management.
-    /// Callers are responsible for wrapping this in a transaction.
-    ///
-    /// Dedup contract: an INSERT that collides with an existing memory on
-    /// `(topic, summary_hash)` is silently ignored, and the **existing**
-    /// row's id is returned. The caller's `memory.id` is forgotten in
-    /// that case. This keeps `store(...)` idempotent: writing the same
-    /// fact 100× ends up with one row, not 100.
-    fn store_inner(&self, memory: &Memory) -> IcmResult<String> {
-        let keywords_json = serde_json::to_string(&memory.keywords)?;
-        let related_json = serde_json::to_string(&memory.related_ids)?;
-        let st = source_type(&memory.source);
-        let sd = source_data(&memory.source);
-        let emb_blob = memory.embedding.as_deref().map(embedding_to_blob);
-        let hash = summary_hash(&memory.topic, &memory.summary);
-
-        let inserted = self
-            .conn
-            .execute(
-                "INSERT OR IGNORE INTO memories (id, created_at, updated_at, last_accessed, access_count, weight,
-                 topic, summary, raw_excerpt, keywords,
-                 importance, source_type, source_data, related_ids, embedding, summary_hash)
-                 VALUES (?1, ?2, ?3, ?4, ?5, ?6, ?7, ?8, ?9, ?10, ?11, ?12, ?13, ?14, ?15, ?16)",
-                params![
-                    memory.id,
-                    memory.created_at.to_rfc3339(),
-                    memory.updated_at.to_rfc3339(),
-                    memory.last_accessed.to_rfc3339(),
-                    memory.access_count,
-                    memory.weight,
-                    memory.topic,
-                    memory.summary,
-                    memory.raw_excerpt,
-                    keywords_json,
-                    memory.importance.to_string(),
-                    st,
-                    sd,
-                    related_json,
-                    emb_blob,
-                    hash,
-                ],
-            )
-            .map_err(db_err)?;
-
-        if inserted == 0 {
-            // Dedup hit: a row with the same (topic, summary_hash)
-            // already exists. Audit #185 H2: the previous behaviour
-            // returned the existing id and silently dropped the
-            // caller's importance / keywords / raw_excerpt. So
-            // running `icm store -t T -c "X" -i medium` then `icm
-            // store -t T -c "X" -i critical` left the importance at
-            // medium without warning the user.
-            //
-            // New behaviour: merge the caller's metadata into the
-            // existing row before returning the id.
-            // - importance: take the max (critical > high > medium >
-            //   low). Re-storing with a *higher* priority upgrades.
-            //   Re-storing with a *lower* priority is a no-op so a
-            //   careless write can't downgrade an already-flagged
-            //   critical memory.
-            // - keywords: union, preserving existing order then
-            //   appending new ones not already present.
-            // - raw_excerpt: prefer the new value if non-None,
-            //   otherwise keep existing.
-            // - updated_at: bumped whenever any field actually changed.
-            let (existing_id, existing_importance_str, existing_keywords_json, existing_raw): (
-                String,
-                String,
-                String,
-                Option<String>,
-            ) = self
-                .conn
-                .query_row(
-                    // Audit finding: `summary_hash` already encodes the topic
-                    // (Rust `to_lowercase()`, full Unicode) as part of the
-                    // hash input — an additional `LOWER(topic) = LOWER(?)`
-                    // comparison here used SQLite's built-in `LOWER()`,
-                    // which is ASCII-only and does not fold e.g. 'É' → 'é'.
-                    // For an all-caps accented topic like "DÉCISIONS" that
-                    // mismatch meant this SELECT could fail to find the row
-                    // the `INSERT OR IGNORE` conflict was already about,
-                    // even though `summary_hash` alone uniquely identifies
-                    // it. `summary_hash` is sufficient on its own.
-                    "SELECT id, importance, keywords, raw_excerpt FROM memories
-                     WHERE summary_hash = ?1",
-                    params![hash],
-                    |row| Ok((row.get(0)?, row.get(1)?, row.get(2)?, row.get(3)?)),
-                )
-                .map_err(db_err)?;
-
-            let existing_importance: Importance = existing_importance_str
-                .parse()
-                .unwrap_or(Importance::Medium);
-            let merged_importance = max_importance(existing_importance, memory.importance);
-
-            let existing_keywords: Vec<String> =
-                serde_json::from_str(&existing_keywords_json).unwrap_or_default();
-            let mut merged_keywords = existing_keywords.clone();
-            for kw in &memory.keywords {
-                if !merged_keywords.contains(kw) {
-                    merged_keywords.push(kw.clone());
-                }
-            }
-
-            let merged_raw = memory.raw_excerpt.clone().or(existing_raw.clone());
-
-            let importance_changed = merged_importance != existing_importance;
-            let keywords_changed = merged_keywords != existing_keywords;
-            let raw_changed = merged_raw != existing_raw;
-            if importance_changed || keywords_changed || raw_changed {
-                let merged_keywords_json = serde_json::to_string(&merged_keywords)?;
-                self.conn
-                    .execute(
-                        "UPDATE memories
-                         SET importance = ?1, keywords = ?2, raw_excerpt = ?3, updated_at = ?4
-                         WHERE id = ?5",
-                        params![
-                            merged_importance.to_string(),
-                            merged_keywords_json,
-                            merged_raw,
-                            Utc::now().to_rfc3339(),
-                            existing_id,
-                        ],
-                    )
-                    .map_err(db_err)?;
-                self.cache_invalidate(&existing_id);
-            }
-
-            tracing::debug!(
-                topic = %memory.topic,
-                existing = %existing_id,
-                attempted = %memory.id,
-                imp_changed = importance_changed,
-                kw_changed = keywords_changed,
-                raw_changed = raw_changed,
-                "store: dedup'd duplicate memory (metadata merged)"
-            );
-            return Ok(existing_id);
-        }
-
-        // Sync to vec_memories for KNN search (only on a fresh insert).
-        if let Some(ref blob) = emb_blob {
-            self.conn
-                .execute(
-                    "INSERT INTO vec_memories (memory_id, embedding) VALUES (?1, ?2)",
-                    params![memory.id, blob],
-                )
-                .map_err(db_err)?;
-        }
-
-        Ok(memory.id.clone())
-    }
-}
-
-impl MemoryStore for SqliteStore {
-    fn store(&self, memory: Memory) -> IcmResult<String> {
-        let memory = validate_and_normalize(memory)?;
-
-        self.conn
-            .execute_batch("BEGIN IMMEDIATE;")
-            .map_err(db_err)?;
-
-        match self.store_inner(&memory) {
-            Ok(id) => {
-                self.conn.execute_batch("COMMIT;").map_err(db_err)?;
-                Ok(id)
-            }
-            Err(e) => {
-                let _ = self.conn.execute_batch("ROLLBACK;");
-                Err(e)
-            }
-        }
-    }
-
-    fn get(&self, id: &str) -> IcmResult<Option<Memory>> {
-        if let Some(m) = self.cache_get(id) {
-            return Ok(Some(m));
-        }
-
-        let mut stmt = self
-            .conn
-            .prepare(&format!("SELECT {SELECT_COLS} FROM memories WHERE id = ?1"))
-            .map_err(db_err)?;
-
-        let result = stmt
-            .query_row(params![id], row_to_memory)
-            .optional()
-            .map_err(db_err)?;
-
-        if let Some(ref m) = result {
-            self.cache_put(m);
-        }
-        Ok(result)
-    }
-
-    fn update(&self, memory: &Memory) -> IcmResult<()> {
-        // Same constraints as `store()` — without this, oversized or
-        // NUL-carrying payloads could bypass validation by storing small
-        // then updating big (audit finding).
-        validate_fields(&memory.topic, &memory.summary)?;
-
-        let keywords_json = serde_json::to_string(&memory.keywords)?;
-        let related_json = serde_json::to_string(&memory.related_ids)?;
-        let st = source_type(&memory.source);
-        let sd = source_data(&memory.source);
-        let emb_blob = memory.embedding.as_deref().map(embedding_to_blob);
-
-        // Recompute summary_hash on update — topic or summary may have
-        // changed, and the partial unique index on (topic, summary_hash)
-        // would otherwise reflect stale state.
-        let hash = summary_hash(&memory.topic, &memory.summary);
-
-        // memories + vec_memories must move together: a failure between the
-        // row update and the vector sync would leave a memory invisible to
-        // (or stale in) vector search (audit finding — same pattern as
-        // `store()` / `consolidate_topic`).
-        self.conn
-            .execute_batch("BEGIN IMMEDIATE;")
-            .map_err(db_err)?;
-
-        let result: IcmResult<()> = (|| {
-            let changed = self
-                .conn
-                .execute(
-                    "UPDATE memories SET
-                     updated_at = ?2, last_accessed = ?3, access_count = ?4, weight = ?5,
-                     topic = ?6, summary = ?7, raw_excerpt = ?8, keywords = ?9,
-                     importance = ?10, source_type = ?11, source_data = ?12, related_ids = ?13,
-                     embedding = ?14, summary_hash = ?15
-                     WHERE id = ?1",
-                    params![
-                        memory.id,
-                        memory.updated_at.to_rfc3339(),
-                        memory.last_accessed.to_rfc3339(),
-                        memory.access_count,
-                        memory.weight,
-                        memory.topic,
-                        memory.summary,
-                        memory.raw_excerpt,
-                        keywords_json,
-                        memory.importance.to_string(),
-                        st,
-                        sd,
-                        related_json,
-                        emb_blob,
-                        hash,
-                    ],
-                )
-                .map_err(db_err)?;
-
-            if changed == 0 {
-                return Err(IcmError::NotFound(memory.id.clone()));
-            }
-
-            // Sync vec_memories: always delete old, re-insert if embedding exists
-            self.conn
-                .execute(
-                    "DELETE FROM vec_memories WHERE memory_id = ?1",
-                    params![memory.id],
-                )
-                .map_err(db_err)?;
-            if let Some(ref blob) = emb_blob {
-                self.conn
-                    .execute(
-                        "INSERT INTO vec_memories (memory_id, embedding) VALUES (?1, ?2)",
-                        params![memory.id, blob],
-                    )
-                    .map_err(db_err)?;
-            }
-            Ok(())
-        })();
-
-        match result {
-            Ok(()) => {
-                self.conn.execute_batch("COMMIT;").map_err(db_err)?;
-                self.cache_invalidate(&memory.id);
-                Ok(())
-            }
-            Err(e) => {
-                let _ = self.conn.execute_batch("ROLLBACK;");
-                Err(e)
-            }
-        }
-    }
-
-    fn delete(&self, id: &str) -> IcmResult<()> {
-        // Both deletes in one transaction so a failure can't strand an
-        // orphaned vector or a memory whose vector is gone (audit finding).
-        self.conn
-            .execute_batch("BEGIN IMMEDIATE;")
-            .map_err(db_err)?;
-
-        let result: IcmResult<()> = (|| {
-            self.conn
-                .execute("DELETE FROM vec_memories WHERE memory_id = ?1", params![id])
-                .map_err(db_err)?;
-
-            let changed = self
-                .conn
-                .execute("DELETE FROM memories WHERE id = ?1", params![id])
-                .map_err(db_err)?;
-
-            if changed == 0 {
-                return Err(IcmError::NotFound(id.to_string()));
-            }
-
-            // Manual-testing finding: deleting a memory left it as a
-            // dangling entry in every other memory's `related_ids`
-            // (auto-link back-references) forever — `expand_with_neighbors`
-            // tolerates the miss silently, but each stale id still spends a
-            // slot out of the caller's `max_neighbors` budget instead of
-            // surfacing a real, live neighbor, and any external consumer of
-            // the JSON export sees a reference to nothing. Strip the
-            // deleted id from every `related_ids` array that mentions it.
-            // The `LIKE` clause is a cheap prefilter (only rows that could
-            // possibly match do the JSON rewrite); it matches the
-            // JSON-quoted form specifically so a ULID that happens to be a
-            // literal substring of another can't cause a false hit.
-            self.conn
-                .execute(
-                    "UPDATE memories
-                        SET related_ids = (
-                            SELECT COALESCE(json_group_array(value), '[]')
-                            FROM json_each(memories.related_ids)
-                            WHERE value != ?1
-                        )
-                        WHERE related_ids LIKE '%\"' || ?1 || '\"%'",
-                    params![id],
-                )
-                .map_err(db_err)?;
-
-            Ok(())
-        })();
-
-        match result {
-            Ok(()) => {
-                self.conn.execute_batch("COMMIT;").map_err(db_err)?;
-                // The related_ids cleanup above can touch an arbitrary
-                // number of other rows, not just `id` — clear the whole
-                // cache rather than tracking which ones, so a cached
-                // neighbor's `related_ids` can't keep serving the
-                // just-deleted id after this returns.
-                self.cache_clear();
-                Ok(())
-            }
-            Err(e) => {
-                let _ = self.conn.execute_batch("ROLLBACK;");
-                Err(e)
-            }
-        }
-    }
-
-    fn search_by_keywords(&self, keywords: &[&str], limit: usize) -> IcmResult<Vec<Memory>> {
-        if keywords.is_empty() {
-            return Ok(Vec::new());
-        }
-
-        // Cap keywords to avoid massive SQL generation
-        let keywords = &keywords[..keywords.len().min(50)];
-        let limit = limit.min(100);
-
-        // Audit finding: a keyword containing `%` or `_` was interpolated
-        // straight into the LIKE pattern unescaped. `%` matches every row
-        // (`"100%"` as a keyword becomes the pattern `%100%%%`, which
-        // degrades to "contains 100" at best and can blow up matching);
-        // `_` matches any single character (`"snake_case"` also matches
-        // "snakeXcase"). Both are plausible keywords coming from an LLM via
-        // MCP. Escape them and declare the escape character explicitly.
-        let where_parts: Vec<String> = (0..keywords.len())
-            .map(|i| {
-                let p = i + 1;
-                format!(
-                    "(keywords LIKE ?{p} ESCAPE '\\' OR summary LIKE ?{p} ESCAPE '\\' \
-                     OR topic LIKE ?{p} ESCAPE '\\')"
-                )
-            })
-            .collect();
-        let where_clause = where_parts.join(" OR ");
-
-        let query = format!(
-            "SELECT {SELECT_COLS} FROM memories WHERE {where_clause} ORDER BY weight DESC LIMIT ?{}",
-            keywords.len() + 1
-        );
-
-        let mut stmt = self.conn.prepare(&query).map_err(db_err)?;
-
-        let mut param_values: Vec<Box<dyn rusqlite::types::ToSql>> = keywords
-            .iter()
-            .map(|k| {
-                Box::new(format!("%{}%", escape_like_wildcards(k)))
-                    as Box<dyn rusqlite::types::ToSql>
-            })
-            .collect();
-        param_values.push(Box::new(limit as i64));
-
-        let params_ref: Vec<&dyn rusqlite::types::ToSql> =
-            param_values.iter().map(|p| p.as_ref()).collect();
-
-        let rows = stmt
-            .query_map(params_ref.as_slice(), row_to_memory)
-            .map_err(db_err)?;
-
-        collect_rows(rows)
-    }
-
-    fn search_fts(&self, query: &str, limit: usize) -> IcmResult<Vec<Memory>> {
-        let limit = limit.min(100);
-        let sanitized = sanitize_fts_query(query);
-        if sanitized.is_empty() {
-            return Ok(Vec::new());
-        }
-
-        let sql = format!(
-            "SELECT {SELECT_COLS} FROM memories
-             WHERE id IN (
-                 SELECT id FROM memories_fts WHERE memories_fts MATCH ?1
-             )
-             ORDER BY weight DESC
-             LIMIT ?2"
-        );
-
-        let mut stmt = self.conn.prepare(&sql).map_err(db_err)?;
-
-        let rows = stmt
-            .query_map(params![sanitized, limit as i64], row_to_memory)
-            .map_err(db_err)?;
-
-        collect_rows(rows)
-    }
-
-    fn search_by_embedding(
-        &self,
-        embedding: &[f32],
-        limit: usize,
-    ) -> IcmResult<Vec<(Memory, f32)>> {
-        let query_blob = embedding_to_blob(embedding);
-
-        // KNN query on vec0 virtual table (requires LIMIT in the query itself)
-        let mut knn_stmt = self
-            .conn
-            .prepare(
-                "SELECT memory_id, distance
-                 FROM vec_memories
-                 WHERE embedding MATCH ?1
-                 ORDER BY distance
-                 LIMIT ?2",
-            )
-            .map_err(db_err)?;
-
-        let knn_rows: Vec<(String, f32)> = knn_stmt
-            .query_map(params![query_blob, limit as i64], |row| {
-                Ok((row.get::<_, String>(0)?, row.get::<_, f32>(1)?))
-            })
-            .map_err(db_err)?
-            .filter_map(|r| r.ok())
-            .collect();
-
-        if knn_rows.is_empty() {
-            return Ok(Vec::new());
-        }
-
-        // Batch fetch all memories in one query
-        let placeholders: Vec<String> = (1..=knn_rows.len()).map(|i| format!("?{i}")).collect();
-        let sql = format!(
-            "SELECT {SELECT_COLS} FROM memories WHERE id IN ({})",
-            placeholders.join(", ")
-        );
-        let mut stmt = self.conn.prepare(&sql).map_err(db_err)?;
-
-        let ids: Vec<&str> = knn_rows.iter().map(|(id, _)| id.as_str()).collect();
-        let params: Vec<&dyn rusqlite::types::ToSql> = ids
-            .iter()
-            .map(|id| id as &dyn rusqlite::types::ToSql)
-            .collect();
-
-        let rows = stmt.query_map(&*params, row_to_memory).map_err(db_err)?;
-
-        let mut memory_map: std::collections::HashMap<String, Memory> = HashMap::new();
-        for row in rows.flatten() {
-            memory_map.insert(row.id.clone(), row);
-        }
-
-        // Reassemble in KNN order with similarity scores
-        let results: Vec<(Memory, f32)> = knn_rows
-            .into_iter()
-            .filter_map(|(id, distance)| memory_map.remove(&id).map(|mem| (mem, 1.0 - distance)))
-            .collect();
-
-        Ok(results)
-    }
-
-    fn search_hybrid(
-        &self,
-        query: &str,
-        embedding: &[f32],
-        limit: usize,
-    ) -> IcmResult<Vec<(Memory, f32)>> {
-        let limit = limit.min(1000);
-        let pool_size = limit * 4;
-        let sanitized = sanitize_fts_query(query);
-
-        // 1. Get FTS results with rank scores
-        let fts_sql =
-            "SELECT m.id, m.created_at, m.updated_at, m.last_accessed, m.access_count, m.weight, \
-                    m.topic, m.summary, m.raw_excerpt, m.keywords, \
-                    m.importance, m.source_type, m.source_data, m.related_ids, m.embedding, \
-                    fts.rank \
-             FROM memories_fts fts \
-             JOIN memories m ON m.id = fts.id \
-             WHERE memories_fts MATCH ?1 \
-             ORDER BY fts.rank \
-             LIMIT ?2";
-
-        let mut fts_scores: HashMap<String, f32> = HashMap::with_capacity(pool_size);
-        let mut all_memories: HashMap<String, Memory> = HashMap::with_capacity(pool_size);
-
-        if !sanitized.is_empty() {
-            if let Ok(mut stmt) = self.conn.prepare(fts_sql) {
-                if let Ok(rows) = stmt.query_map(params![sanitized, pool_size as i64], |row| {
-                    let memory = row_to_memory(row)?;
-                    let rank: f32 = row.get(15)?;
-                    Ok((memory, rank))
-                }) {
-                    for row in rows.flatten() {
-                        let (memory, rank) = row;
-                        // FTS5 bm25 rank is <= 0, MORE negative = MORE
-                        // relevant. `1.0 / (1.0 + |rank|)` inverted this: it
-                        // DECREASES as relevance increases (audit finding,
-                        // proven wrong e.g. rank=-4.83 (strong match) scored
-                        // 0.17 while rank=-0.2 (weak match) scored 0.83).
-                        // `|rank| / (1.0 + |rank|)` keeps the same bounded
-                        // [0,1) shape but is correctly monotonically
-                        // INCREASING in relevance.
-                        let score = rank.abs() / (1.0 + rank.abs());
-                        fts_scores.insert(memory.id.clone(), score);
-                        all_memories.insert(memory.id.clone(), memory);
-                    }
-                }
-            }
-        } // sanitized.is_empty()
-
-        // 2. Get vector results
-        let vec_results = self.search_by_embedding(embedding, pool_size)?;
-        let mut vec_scores: HashMap<String, f32> = HashMap::with_capacity(pool_size);
-        for (memory, similarity) in vec_results {
-            vec_scores.insert(memory.id.clone(), similarity);
-            all_memories.entry(memory.id.clone()).or_insert(memory);
-        }
-
-        // 3. Combine scores: 30% FTS + 70% vector
-        let keys: Vec<String> = all_memories.keys().cloned().collect();
-        let mut scored: Vec<(String, f32)> = Vec::with_capacity(keys.len());
-        for id in keys {
-            let fts_score = fts_scores.get(&id).copied().unwrap_or(0.0);
-            let vec_score = vec_scores.get(&id).copied().unwrap_or(0.0);
-            let combined = 0.3 * fts_score + 0.7 * vec_score;
-            scored.push((id, combined));
-        }
-
-        // Sort by combined score descending
-        scored.sort_by(|a, b| b.1.partial_cmp(&a.1).unwrap_or(std::cmp::Ordering::Equal));
-        scored.truncate(limit);
-
-        let results: Vec<(Memory, f32)> = scored
-            .into_iter()
-            .filter_map(|(id, score)| all_memories.remove(&id).map(|mem| (mem, score)))
-            .collect();
-
-        Ok(results)
-    }
-
-    fn update_access(&self, id: &str) -> IcmResult<()> {
-        // Read-only short-circuit (issue #263): callers of recall expect
-        // this to be best-effort bookkeeping, not a hard precondition.
-        // Skipping silently lets `icm recall` work against a DB the
-        // process cannot write to.
-        if self.readonly {
-            return Ok(());
-        }
-        let now = Utc::now().to_rfc3339();
-        let changed = self
-            .conn
-            .execute(
-                "UPDATE memories SET last_accessed = ?1, access_count = access_count + 1 WHERE id = ?2",
-                params![now, id],
-            )
-            .map_err(db_err)?;
-
-        if changed == 0 {
-            return Err(IcmError::NotFound(id.to_string()));
-        }
-        self.cache_invalidate(id);
-        Ok(())
-    }
-
-    fn batch_update_access(&self, ids: &[&str]) -> IcmResult<usize> {
-        if ids.is_empty() {
-            return Ok(0);
-        }
-        if self.readonly {
-            // Same rationale as `update_access` (issue #263).
-            return Ok(0);
-        }
-        let now = Utc::now().to_rfc3339();
-        let placeholders: Vec<String> = (2..=ids.len() + 1).map(|i| format!("?{i}")).collect();
-        let sql = format!(
-            "UPDATE memories SET last_accessed = ?1, access_count = access_count + 1 WHERE id IN ({})",
-            placeholders.join(", ")
-        );
-        let mut params_vec: Vec<Box<dyn rusqlite::types::ToSql>> =
-            Vec::with_capacity(ids.len() + 1);
-        params_vec.push(Box::new(now));
-        for id in ids {
-            params_vec.push(Box::new(id.to_string()));
-        }
-        let refs: Vec<&dyn rusqlite::types::ToSql> =
-            params_vec.iter().map(|p| p.as_ref()).collect();
-        let changed = self.conn.execute(&sql, refs.as_slice()).map_err(db_err)?;
-        self.cache_invalidate_many(ids);
-        Ok(changed)
-    }
-
-    fn apply_decay(&self, decay_factor: f32) -> IcmResult<usize> {
-        if self.readonly {
-            return Err(IcmError::ReadOnly("apply_decay".into()));
-        }
-        // Access-aware decay: frequently accessed memories decay slower.
-        // decay = base_rate * importance_multiplier / (1 + min(access_count, 5) * 0.1)
-        //
-        // Audit #185 H7: the access-count term used to be uncapped
-        // (`1 + access_count * 0.1`). A memory with `access_count=100`
-        // got a 11x slowdown on its decay, which made it effectively
-        // immune to pruning even at low importance. Anyone (or any
-        // bench loop, or any benign hook-driven recall pattern) that
-        // touched a memory many times pinned it near the top of the
-        // ranking forever — the same gaming class as the M01 issue
-        // the maintainer flagged earlier.
-        //
-        // Cap at 5 accesses → max 1.5x slowdown (33%). That preserves
-        // the original intent ("useful memories decay a bit slower")
-        // without giving any single memory infinite decay immunity.
-        // Critical-importance memories still skip decay entirely.
-        //
-        // Importance multipliers:
-        //   critical: never decays (filtered by WHERE clause)
-        //   high:     0.5x decay (half speed)
-        //   medium:   1.0x decay (normal)
-        //   low:      2.0x decay (double speed)
-        // Audit finding: for `low` importance (2x multiplier) with a
-        // low-access memory, the multiplier `1.0 - (1.0-f)*mult/denom` goes
-        // NEGATIVE once `f < 0.5` — `icm decay --factor 0.4` (accepted by
-        // the CLI's own `[0.0, 1.0)` validation) drove low-importance
-        // weights negative, putting them last in every `ORDER BY weight
-        // DESC` and prunable on the next pass. `MAX(0.0, ...)` clamps the
-        // multiplier at the SQL layer so weight can never go negative
-        // regardless of the caller (CLI, MCP, or any future direct caller
-        // that bypasses the CLI's own boundary check).
-        let changed = self
-            .conn
-            .execute(
-                "UPDATE memories SET weight = weight * MAX(0.0,
-                    1.0 - (1.0 - ?1) *
-                    CASE importance
-                        WHEN 'high' THEN 0.5
-                        WHEN 'low' THEN 2.0
-                        ELSE 1.0
-                    END
-                    / (1.0 + MIN(access_count, 5) * 0.1)
-                )
-                WHERE importance != 'critical'",
-                params![decay_factor],
-            )
-            .map_err(db_err)?;
-
-        // Decay touches every non-critical row's weight; can't selectively
-        // invalidate without re-reading rows, so just nuke the cache.
-        self.cache_clear();
-        Ok(changed)
-    }
-
-    fn prune(&self, weight_threshold: f32) -> IcmResult<usize> {
-        // Never prune critical or high importance memories. Both deletes in
-        // one transaction, and the vec_memories error is propagated instead
-        // of swallowed — a partial prune would leave orphaned vectors that
-        // keep matching KNN search for rows that no longer exist (audit
-        // finding).
-        self.conn
-            .execute_batch("BEGIN IMMEDIATE;")
-            .map_err(db_err)?;
-
-        let result: IcmResult<usize> = (|| {
-            self.conn.execute(
-                "DELETE FROM vec_memories WHERE memory_id IN (
-                    SELECT id FROM memories WHERE weight < ?1 AND importance NOT IN ('critical', 'high')
-                )",
-                params![weight_threshold],
-            )
-            .map_err(db_err)?;
-
-            self.conn
-                .execute(
-                    "DELETE FROM memories WHERE weight < ?1 AND importance NOT IN ('critical', 'high')",
-                    params![weight_threshold],
-                )
-                .map_err(db_err)
-        })();
-
-        match result {
-            Ok(changed) => {
-                self.conn.execute_batch("COMMIT;").map_err(db_err)?;
-                if changed > 0 {
-                    self.cache_clear();
-                }
-                Ok(changed)
-            }
-            Err(e) => {
-                let _ = self.conn.execute_batch("ROLLBACK;");
-                Err(e)
-            }
-        }
-    }
-
-    fn get_by_topic(&self, topic: &str) -> IcmResult<Vec<Memory>> {
-        let mut stmt = self
-            .conn
-            .prepare(&format!(
-                "SELECT {SELECT_COLS} FROM memories WHERE topic = ?1 ORDER BY weight DESC LIMIT 500"
-            ))
-            .map_err(db_err)?;
-
-        let rows = stmt
-            .query_map(params![topic], row_to_memory)
-            .map_err(db_err)?;
-
-        collect_rows(rows)
-    }
-
-    fn list_all(&self) -> IcmResult<Vec<Memory>> {
-        let mut stmt = self
-            .conn
-            .prepare(&format!(
-                "SELECT {SELECT_COLS} FROM memories ORDER BY weight DESC LIMIT 10000"
-            ))
-            .map_err(db_err)?;
-
-        let rows = stmt.query_map([], row_to_memory).map_err(db_err)?;
-        collect_rows(rows)
-    }
-
-    fn list_topics(&self) -> IcmResult<Vec<(String, usize)>> {
-        let mut stmt = self
-            .conn
-            .prepare("SELECT topic, COUNT(*) FROM memories GROUP BY topic ORDER BY topic")
-            .map_err(db_err)?;
-
-        let rows = stmt
-            .query_map([], |row| {
-                Ok((row.get::<_, String>(0)?, row.get::<_, usize>(1)?))
-            })
-            .map_err(db_err)?;
-
-        collect_rows(rows)
-    }
-
-    fn consolidate_topic(&self, topic: &str, consolidated: Memory) -> IcmResult<()> {
-        // The consolidated memory goes through the same validation as any
-        // other write — MCP `icm_memory_consolidate` passes a caller-provided
-        // summary that previously bypassed every size/content check.
-        let consolidated = validate_and_normalize(consolidated)?;
-
-        self.conn
-            .execute_batch("BEGIN IMMEDIATE;")
-            .map_err(db_err)?;
-
-        // Manual-testing finding: captured before the delete below, since
-        // afterward the rows (and thus this query) are gone. Used to clean
-        // up any *other* memory's related_ids that pointed at these —
-        // same dangling-reference bug already fixed for the single-id
-        // `delete`, reachable here too since this is a second, separate
-        // bulk-delete code path.
-        let deleted_ids: Vec<String> = {
-            let mut stmt = self
-                .conn
-                .prepare("SELECT id FROM memories WHERE topic = ?1 AND importance != 'critical'")
-                .map_err(db_err)?;
-            let rows = stmt
-                .query_map(params![topic], |row| row.get::<_, String>(0))
-                .map_err(db_err)?;
-            rows.collect::<rusqlite::Result<Vec<_>>>().map_err(db_err)?
-        };
-
-        // `critical` memories are never deleted — same contract as
-        // `apply_decay` and `prune`. Consolidation replaces the expendable
-        // tail of a topic, not its "never forget" entries (audit finding:
-        // this DELETE previously wiped critical memories too).
-        // Clean vec_memories for entries about to be deleted
-        if let Err(e) = self.conn.execute(
-            "DELETE FROM vec_memories WHERE memory_id IN (
-                SELECT id FROM memories WHERE topic = ?1 AND importance != 'critical'
-            )",
-            params![topic],
-        ) {
-            tracing::warn!(topic, error = %e, "consolidate_topic: rolling back after vec_memories delete failed");
-            let _ = self.conn.execute_batch("ROLLBACK;");
-            return Err(IcmError::Database(e.to_string()));
-        }
-
-        if let Err(e) = self.conn.execute(
-            "DELETE FROM memories WHERE topic = ?1 AND importance != 'critical'",
-            params![topic],
-        ) {
-            tracing::warn!(topic, error = %e, "consolidate_topic: rolling back after memories delete failed");
-            let _ = self.conn.execute_batch("ROLLBACK;");
-            return Err(IcmError::Database(e.to_string()));
-        }
-
-        if !deleted_ids.is_empty() {
-            let ids_json = serde_json::to_string(&deleted_ids).map_err(IcmError::from)?;
-            if let Err(e) = self.conn.execute(
-                "UPDATE memories
-                    SET related_ids = (
-                        SELECT COALESCE(json_group_array(value), '[]')
-                        FROM json_each(memories.related_ids)
-                        WHERE value NOT IN (SELECT value FROM json_each(?1))
-                    )
-                    WHERE EXISTS (
-                        SELECT 1 FROM json_each(memories.related_ids)
-                        WHERE value IN (SELECT value FROM json_each(?1))
-                    )",
-                params![ids_json],
-            ) {
-                tracing::warn!(topic, error = %e, "consolidate_topic: rolling back after related_ids cleanup failed");
-                let _ = self.conn.execute_batch("ROLLBACK;");
-                return Err(IcmError::Database(e.to_string()));
-            }
-        }
-
-        if let Err(e) = self.store_inner(&consolidated) {
-            tracing::warn!(topic, error = %e, "consolidate_topic: rolling back after store failed");
-            let _ = self.conn.execute_batch("ROLLBACK;");
-            return Err(e);
-        }
-
-        // Rebuild FTS index to eliminate any ghost entries from the external
-        // content table.  This guarantees search results stay consistent after
-        // bulk deletes (fixes #44).
-        if let Err(e) = self
-            .conn
-            .execute_batch("INSERT INTO memories_fts(memories_fts) VALUES('rebuild');")
-        {
-            tracing::warn!(topic, error = %e, "consolidate_topic: rolling back after FTS rebuild failed");
-            let _ = self.conn.execute_batch("ROLLBACK;");
-            return Err(IcmError::Database(e.to_string()));
-        }
-
-        self.conn.execute_batch("COMMIT;").map_err(db_err)?;
-        // Bulk delete + re-insert touches arbitrarily many cached entries.
-        self.cache_clear();
-        Ok(())
-    }
-
-    fn count(&self) -> IcmResult<usize> {
-        self.conn
-            .query_row("SELECT COUNT(*) FROM memories", [], |row| {
-                row.get::<_, usize>(0)
-            })
-            .map_err(|e| IcmError::Database(e.to_string()))
-    }
-
-    fn count_by_topic(&self, topic: &str) -> IcmResult<usize> {
-        self.conn
-            .query_row(
-                "SELECT COUNT(*) FROM memories WHERE topic = ?1",
-                params![topic],
-                |row| row.get::<_, usize>(0),
-            )
-            .map_err(|e| IcmError::Database(e.to_string()))
-    }
-
-    fn topic_health(&self, topic: &str) -> IcmResult<TopicHealth> {
-        let row = self
-            .conn
-            .query_row(
-                "SELECT
-                    COUNT(*),
-                    AVG(weight),
-                    AVG(CAST(access_count AS REAL)),
-                    MIN(created_at),
-                    MAX(created_at),
-                    MAX(last_accessed),
-                    SUM(CASE WHEN weight < 0.5
-                         AND julianday('now') - julianday(last_accessed) > 14
-                         THEN 1 ELSE 0 END)
-                 FROM memories WHERE topic = ?1",
-                params![topic],
-                |row| {
-                    Ok((
-                        row.get::<_, usize>(0)?,
-                        row.get::<_, f32>(1)?,
-                        row.get::<_, f32>(2)?,
-                        row.get::<_, Option<String>>(3)?,
-                        row.get::<_, Option<String>>(4)?,
-                        row.get::<_, Option<String>>(5)?,
-                        row.get::<_, usize>(6)?,
-                    ))
-                },
-            )
-            .map_err(db_err)?;
-
-        let (
-            entry_count,
-            avg_weight,
-            avg_access,
-            oldest_str,
-            newest_str,
-            last_accessed_str,
-            stale_count,
-        ) = row;
-
-        if entry_count == 0 {
-            return Err(IcmError::NotFound(format!("topic: {topic}")));
-        }
-
-        let parse_dt = |s: &str| -> Option<DateTime<Utc>> {
-            match DateTime::parse_from_rfc3339(s) {
-                Ok(d) => Some(d.with_timezone(&Utc)),
-                Err(e) => {
-                    tracing::warn!("invalid timestamp '{}': {}", s, e);
-                    None
-                }
-            }
-        };
-
-        Ok(TopicHealth {
-            topic: topic.to_string(),
-            entry_count,
-            avg_weight,
-            avg_access_count: avg_access,
-            oldest: oldest_str.as_deref().and_then(parse_dt),
-            newest: newest_str.as_deref().and_then(parse_dt),
-            last_accessed: last_accessed_str.as_deref().and_then(parse_dt),
-            needs_consolidation: entry_count > 5,
-            stale_count,
-        })
-    }
-
-    fn stats(&self) -> IcmResult<StoreStats> {
-        let (total_memories, total_topics, avg_weight, oldest_str, newest_str): (
-            usize,
-            usize,
-            f32,
-            Option<String>,
-            Option<String>,
-        ) = self
-            .conn
-            .query_row(
-                "SELECT COUNT(*), COUNT(DISTINCT topic), COALESCE(AVG(weight), 0.0), \
-                 MIN(created_at), MAX(created_at) FROM memories",
-                [],
-                |row| {
-                    Ok((
-                        row.get(0)?,
-                        row.get(1)?,
-                        row.get(2)?,
-                        row.get(3)?,
-                        row.get(4)?,
-                    ))
-                },
-            )
-            .map_err(db_err)?;
-
-        let oldest_memory = oldest_str
-            .and_then(|s| DateTime::parse_from_rfc3339(&s).ok())
-            .map(|d| d.with_timezone(&Utc));
-        let newest_memory = newest_str
-            .and_then(|s| DateTime::parse_from_rfc3339(&s).ok())
-            .map(|d| d.with_timezone(&Utc));
-
-        Ok(StoreStats {
-            total_memories,
-            total_topics,
-            avg_weight,
-            oldest_memory,
-            newest_memory,
-        })
-    }
-}
-
-// ---------------------------------------------------------------------------
-// Memoir / Concept helpers
-// ---------------------------------------------------------------------------
-
-fn parse_dt(s: &str) -> DateTime<Utc> {
-    DateTime::parse_from_rfc3339(s)
-        .map(|d| d.with_timezone(&Utc))
-        .unwrap_or_else(|_| Utc::now())
-}
-
-fn row_to_memoir(row: &rusqlite::Row) -> rusqlite::Result<Memoir> {
-    Ok(Memoir {
-        id: row.get(0)?,
-        name: row.get(1)?,
-        description: row.get(2)?,
-        created_at: parse_dt(&row.get::<_, String>(3)?),
-        updated_at: parse_dt(&row.get::<_, String>(4)?),
-        consolidation_threshold: row.get::<_, u32>(5)?,
-    })
-}
-
-const MEMOIR_COLS: &str = "id, name, description, created_at, updated_at, consolidation_threshold";
-
-fn row_to_concept(row: &rusqlite::Row) -> rusqlite::Result<Concept> {
-    let labels_json: String = row.get(4)?;
-    let labels: Vec<Label> = serde_json::from_str(&labels_json).unwrap_or_default();
-
-    let source_ids_json: String = row.get(9)?;
-    let source_memory_ids: Vec<String> = serde_json::from_str(&source_ids_json).unwrap_or_default();
-
-    Ok(Concept {
-        id: row.get(0)?,
-        memoir_id: row.get(1)?,
-        name: row.get(2)?,
-        definition: row.get(3)?,
-        labels,
-        confidence: row.get(5)?,
-        revision: row.get::<_, u32>(6)?,
-        created_at: parse_dt(&row.get::<_, String>(7)?),
-        updated_at: parse_dt(&row.get::<_, String>(8)?),
-        source_memory_ids,
-    })
-}
-
-const CONCEPT_COLS: &str = "id, memoir_id, name, definition, labels, confidence, \
-                            revision, created_at, updated_at, source_memory_ids";
-
-fn row_to_link(row: &rusqlite::Row) -> rusqlite::Result<ConceptLink> {
-    let relation_str: String = row.get(3)?;
-    let relation: Relation = relation_str.parse().unwrap_or(Relation::RelatedTo);
-
-    Ok(ConceptLink {
-        id: row.get(0)?,
-        source_id: row.get(1)?,
-        target_id: row.get(2)?,
-        relation,
-        weight: row.get(4)?,
-        created_at: parse_dt(&row.get::<_, String>(5)?),
-    })
-}
-
-const LINK_COLS: &str = "id, source_id, target_id, relation, weight, created_at";
-
-// ---------------------------------------------------------------------------
-// MemoirStore impl
-// ---------------------------------------------------------------------------
-
-use rusqlite::OptionalExtension;
-
-impl MemoirStore for SqliteStore {
-    // --- Memoir CRUD ---
-
-    fn create_memoir(&self, memoir: Memoir) -> IcmResult<String> {
-        self.conn
-            .execute(
-                "INSERT INTO memoirs (id, name, description, created_at, updated_at, consolidation_threshold)
-                 VALUES (?1, ?2, ?3, ?4, ?5, ?6)",
-                params![
-                    memoir.id,
-                    memoir.name,
-                    memoir.description,
-                    memoir.created_at.to_rfc3339(),
-                    memoir.updated_at.to_rfc3339(),
-                    memoir.consolidation_threshold,
-                ],
-            )
-            .map_err(db_err)?;
-        Ok(memoir.id)
-    }
-
-    fn get_memoir(&self, id: &str) -> IcmResult<Option<Memoir>> {
-        self.conn
-            .prepare(&format!("SELECT {MEMOIR_COLS} FROM memoirs WHERE id = ?1"))
-            .map_err(db_err)?
-            .query_row(params![id], row_to_memoir)
-            .optional()
-            .map_err(|e| IcmError::Database(e.to_string()))
-    }
-
-    fn get_memoir_by_name(&self, name: &str) -> IcmResult<Option<Memoir>> {
-        self.conn
-            .prepare(&format!(
-                "SELECT {MEMOIR_COLS} FROM memoirs WHERE name = ?1"
-            ))
-            .map_err(db_err)?
-            .query_row(params![name], row_to_memoir)
-            .optional()
-            .map_err(|e| IcmError::Database(e.to_string()))
-    }
-
-    fn update_memoir(&self, memoir: &Memoir) -> IcmResult<()> {
-        let changed = self
-            .conn
-            .execute(
-                "UPDATE memoirs SET name = ?2, description = ?3, updated_at = ?4,
-                 consolidation_threshold = ?5 WHERE id = ?1",
-                params![
-                    memoir.id,
-                    memoir.name,
-                    memoir.description,
-                    memoir.updated_at.to_rfc3339(),
-                    memoir.consolidation_threshold,
-                ],
-            )
-            .map_err(db_err)?;
-
-        if changed == 0 {
-            return Err(IcmError::NotFound(memoir.id.clone()));
-        }
-        Ok(())
-    }
-
-    fn delete_memoir(&self, id: &str) -> IcmResult<()> {
-        let changed = self
-            .conn
-            .execute("DELETE FROM memoirs WHERE id = ?1", params![id])
-            .map_err(db_err)?;
-
-        if changed == 0 {
-            return Err(IcmError::NotFound(id.to_string()));
-        }
-        Ok(())
-    }
-
-    fn list_memoirs(&self) -> IcmResult<Vec<Memoir>> {
-        let mut stmt = self
-            .conn
-            .prepare(&format!(
-                "SELECT {MEMOIR_COLS} FROM memoirs ORDER BY name LIMIT 500"
-            ))
-            .map_err(db_err)?;
-
-        let rows = stmt.query_map([], row_to_memoir).map_err(db_err)?;
-
-        collect_rows(rows)
-    }
-
-    // --- Concept CRUD ---
-
-    fn add_concept(&self, concept: Concept) -> IcmResult<String> {
-        let labels_json = serde_json::to_string(&concept.labels)?;
-        let source_ids_json = serde_json::to_string(&concept.source_memory_ids)?;
-
-        self.conn
-            .execute(
-                "INSERT INTO concepts (id, memoir_id, name, definition, labels, confidence,
-                 revision, created_at, updated_at, source_memory_ids)
-                 VALUES (?1, ?2, ?3, ?4, ?5, ?6, ?7, ?8, ?9, ?10)",
-                params![
-                    concept.id,
-                    concept.memoir_id,
-                    concept.name,
-                    concept.definition,
-                    labels_json,
-                    concept.confidence,
-                    concept.revision,
-                    concept.created_at.to_rfc3339(),
-                    concept.updated_at.to_rfc3339(),
-                    source_ids_json,
-                ],
-            )
-            .map_err(db_err)?;
-        Ok(concept.id)
-    }
-
-    fn get_concept(&self, id: &str) -> IcmResult<Option<Concept>> {
-        self.conn
-            .prepare(&format!(
-                "SELECT {CONCEPT_COLS} FROM concepts WHERE id = ?1"
-            ))
-            .map_err(db_err)?
-            .query_row(params![id], row_to_concept)
-            .optional()
-            .map_err(|e| IcmError::Database(e.to_string()))
-    }
-
-    fn get_concept_by_name(&self, memoir_id: &str, name: &str) -> IcmResult<Option<Concept>> {
-        self.conn
-            .prepare(&format!(
-                "SELECT {CONCEPT_COLS} FROM concepts WHERE memoir_id = ?1 AND name = ?2"
-            ))
-            .map_err(db_err)?
-            .query_row(params![memoir_id, name], row_to_concept)
-            .optional()
-            .map_err(|e| IcmError::Database(e.to_string()))
-    }
-
-    fn update_concept(&self, concept: &Concept) -> IcmResult<()> {
-        let labels_json = serde_json::to_string(&concept.labels)?;
-        let source_ids_json = serde_json::to_string(&concept.source_memory_ids)?;
-
-        let changed = self
-            .conn
-            .execute(
-                "UPDATE concepts SET memoir_id = ?2, name = ?3, definition = ?4, labels = ?5,
-                 confidence = ?6, revision = ?7, updated_at = ?8, source_memory_ids = ?9
-                 WHERE id = ?1",
-                params![
-                    concept.id,
-                    concept.memoir_id,
-                    concept.name,
-                    concept.definition,
-                    labels_json,
-                    concept.confidence,
-                    concept.revision,
-                    concept.updated_at.to_rfc3339(),
-                    source_ids_json,
-                ],
-            )
-            .map_err(db_err)?;
-
-        if changed == 0 {
-            return Err(IcmError::NotFound(concept.id.clone()));
-        }
-        Ok(())
-    }
-
-    fn delete_concept(&self, id: &str) -> IcmResult<()> {
-        let changed = self
-            .conn
-            .execute("DELETE FROM concepts WHERE id = ?1", params![id])
-            .map_err(db_err)?;
-
-        if changed == 0 {
-            return Err(IcmError::NotFound(id.to_string()));
-        }
-        Ok(())
-    }
-
-    // --- Concept Search ---
-
-    fn list_concepts(&self, memoir_id: &str) -> IcmResult<Vec<Concept>> {
-        let mut stmt = self
-            .conn
-            .prepare(&format!(
-                "SELECT {CONCEPT_COLS} FROM concepts WHERE memoir_id = ?1 ORDER BY name LIMIT 1000"
-            ))
-            .map_err(db_err)?;
-
-        let rows = stmt
-            .query_map(params![memoir_id], row_to_concept)
-            .map_err(db_err)?;
-
-        collect_rows(rows)
-    }
-
-    fn search_concepts_fts(
-        &self,
-        memoir_id: &str,
-        query: &str,
-        limit: usize,
-    ) -> IcmResult<Vec<Concept>> {
-        let sanitized = sanitize_fts_query(query);
-        if sanitized.is_empty() {
-            return Ok(Vec::new());
-        }
-
-        let sql = format!(
-            "SELECT {CONCEPT_COLS} FROM concepts
-             WHERE memoir_id = ?1
-               AND id IN (SELECT id FROM concepts_fts WHERE concepts_fts MATCH ?2)
-             ORDER BY confidence DESC
-             LIMIT ?3"
-        );
-
-        let mut stmt = self.conn.prepare(&sql).map_err(db_err)?;
-
-        let rows = stmt
-            .query_map(params![memoir_id, sanitized, limit as i64], row_to_concept)
-            .map_err(db_err)?;
-
-        collect_rows(rows)
-    }
-
-    fn search_all_concepts_fts(&self, query: &str, limit: usize) -> IcmResult<Vec<Concept>> {
-        let sanitized = sanitize_fts_query(query);
-        if sanitized.is_empty() {
-            return Ok(Vec::new());
-        }
-
-        let sql = format!(
-            "SELECT {CONCEPT_COLS} FROM concepts
-             WHERE id IN (SELECT id FROM concepts_fts WHERE concepts_fts MATCH ?1)
-             ORDER BY confidence DESC
-             LIMIT ?2"
-        );
-
-        let mut stmt = self.conn.prepare(&sql).map_err(db_err)?;
-
-        let rows = stmt
-            .query_map(params![sanitized, limit as i64], row_to_concept)
-            .map_err(db_err)?;
-
-        collect_rows(rows)
-    }
-
-    fn search_concepts_by_label(
-        &self,
-        memoir_id: &str,
-        label: &Label,
-        limit: usize,
-    ) -> IcmResult<Vec<Concept>> {
-        // Search JSON labels column using LIKE with the serialized label pattern.
-        // namespace/value come from the caller (MCP tool args) and can contain
-        // %/_ ; escape them so they can't turn into unintended wildcards.
-        let pattern = format!(
-            "%\"namespace\":\"{}\"%\"value\":\"{}\"%",
-            escape_like_wildcards(&label.namespace),
-            escape_like_wildcards(&label.value)
-        );
-
-        let sql = format!(
-            "SELECT {CONCEPT_COLS} FROM concepts
-             WHERE memoir_id = ?1 AND labels LIKE ?2 ESCAPE '\\'
-             ORDER BY confidence DESC
-             LIMIT ?3"
-        );
-
-        let mut stmt = self.conn.prepare(&sql).map_err(db_err)?;
-
-        let rows = stmt
-            .query_map(params![memoir_id, pattern, limit as i64], row_to_concept)
-            .map_err(db_err)?;
-
-        collect_rows(rows)
-    }
-
-    // --- Refinement ---
-
-    fn refine_concept(
-        &self,
-        id: &str,
-        new_definition: &str,
-        new_source_ids: &[String],
-    ) -> IcmResult<()> {
-        // Get existing concept to merge source IDs
-        let concept = self
-            .get_concept(id)?
-            .ok_or_else(|| IcmError::NotFound(id.to_string()))?;
-
-        let mut merged_sources = concept.source_memory_ids;
-        for sid in new_source_ids {
-            if !merged_sources.contains(sid) {
-                merged_sources.push(sid.clone());
-            }
-        }
-        let source_ids_json = serde_json::to_string(&merged_sources)?;
-
-        let now = Utc::now().to_rfc3339();
-        let new_confidence = (concept.confidence + 0.1).min(1.0);
-
-        self.conn
-            .execute(
-                "UPDATE concepts SET definition = ?2, revision = revision + 1,
-                 confidence = ?3, updated_at = ?4, source_memory_ids = ?5
-                 WHERE id = ?1",
-                params![id, new_definition, new_confidence, now, source_ids_json],
-            )
-            .map_err(db_err)?;
-
-        Ok(())
-    }
-
-    // --- Graph ---
-
-    fn add_link(&self, link: ConceptLink) -> IcmResult<String> {
-        // Reject self-links: A→A is meaningless and produces a 1-step
-        // cycle. Caller usually catches this earlier but the store is
-        // the authoritative invariant gate.
-        if link.source_id == link.target_id {
-            return Err(IcmError::InvalidInput(format!(
-                "self-link rejected: source and target are the same concept ({})",
-                link.source_id
-            )));
-        }
-        // Cycle detection: BFS from `target` following outgoing edges.
-        // If we can reach `source`, the new edge would close a cycle
-        // (source → target → ... → source). Reject before insert.
-        //
-        // The BFS is bounded by the number of links currently in the
-        // memoir, so worst-case it touches every link once. For typical
-        // memoirs (<10k links) this is sub-millisecond.
-        if self.would_create_cycle(&link.source_id, &link.target_id)? {
-            return Err(IcmError::InvalidInput(format!(
-                "concept link rejected: {} → {} would create a cycle in the graph",
-                link.source_id, link.target_id
-            )));
-        }
-        self.conn
-            .execute(
-                "INSERT INTO concept_links (id, source_id, target_id, relation, weight, created_at)
-                 VALUES (?1, ?2, ?3, ?4, ?5, ?6)",
-                params![
-                    link.id,
-                    link.source_id,
-                    link.target_id,
-                    link.relation.to_string(),
-                    link.weight,
-                    link.created_at.to_rfc3339(),
-                ],
-            )
-            .map_err(db_err)?;
-        Ok(link.id)
-    }
-
-    fn get_links_from(&self, concept_id: &str) -> IcmResult<Vec<ConceptLink>> {
-        let mut stmt = self
-            .conn
-            .prepare(&format!(
-                "SELECT {LINK_COLS} FROM concept_links WHERE source_id = ?1"
-            ))
-            .map_err(db_err)?;
-
-        let rows = stmt
-            .query_map(params![concept_id], row_to_link)
-            .map_err(db_err)?;
-
-        collect_rows(rows)
-    }
-
-    fn get_links_to(&self, concept_id: &str) -> IcmResult<Vec<ConceptLink>> {
-        let mut stmt = self
-            .conn
-            .prepare(&format!(
-                "SELECT {LINK_COLS} FROM concept_links WHERE target_id = ?1"
-            ))
-            .map_err(db_err)?;
-
-        let rows = stmt
-            .query_map(params![concept_id], row_to_link)
-            .map_err(db_err)?;
-
-        collect_rows(rows)
-    }
-
-    fn delete_link(&self, id: &str) -> IcmResult<()> {
-        let changed = self
-            .conn
-            .execute("DELETE FROM concept_links WHERE id = ?1", params![id])
-            .map_err(db_err)?;
-
-        if changed == 0 {
-            return Err(IcmError::NotFound(id.to_string()));
-        }
-        Ok(())
-    }
-
-    fn get_neighbors(
-        &self,
-        concept_id: &str,
-        relation: Option<Relation>,
-    ) -> IcmResult<Vec<Concept>> {
-        let (sql, p_relation);
-
-        let base = format!(
-            "SELECT {CONCEPT_COLS} FROM concepts WHERE id IN (
-                SELECT target_id FROM concept_links WHERE source_id = ?1 {{filter}}
-                UNION
-                SELECT source_id FROM concept_links WHERE target_id = ?1 {{filter}}
-            )"
-        );
-
-        if let Some(ref r) = relation {
-            p_relation = r.to_string();
-            let filtered = base.replace("{filter}", "AND relation = ?2");
-            sql = filtered;
-        } else {
-            p_relation = String::new();
-            sql = base.replace("{filter}", "");
-        };
-
-        let mut stmt = self.conn.prepare(&sql).map_err(db_err)?;
-
-        let rows = if relation.is_some() {
-            stmt.query_map(params![concept_id, p_relation], row_to_concept)
-                .map_err(db_err)?
-        } else {
-            stmt.query_map(params![concept_id], row_to_concept)
-                .map_err(db_err)?
-        };
-
-        collect_rows(rows)
-    }
-
-    fn get_neighborhood(
-        &self,
-        concept_id: &str,
-        depth: usize,
-    ) -> IcmResult<(Vec<Concept>, Vec<ConceptLink>)> {
-        let mut visited: HashSet<String> = HashSet::new();
-        let mut queue: VecDeque<(String, usize)> = VecDeque::new();
-        let mut concepts = Vec::new();
-        let mut links = Vec::new();
-
-        // Seed with the root concept
-        if let Some(root) = self.get_concept(concept_id)? {
-            visited.insert(root.id.clone());
-            queue.push_back((root.id.clone(), 0));
-            concepts.push(root);
-        } else {
-            return Err(IcmError::NotFound(concept_id.to_string()));
-        }
-
-        while let Some((current_id, current_depth)) = queue.pop_front() {
-            if current_depth >= depth {
-                continue;
-            }
-
-            // Outgoing links
-            let outgoing = self.get_links_from(&current_id)?;
-            for link in outgoing {
-                if !visited.contains(&link.target_id) {
-                    if let Some(c) = self.get_concept(&link.target_id)? {
-                        visited.insert(c.id.clone());
-                        queue.push_back((c.id.clone(), current_depth + 1));
-                        concepts.push(c);
-                    }
-                }
-                links.push(link);
-            }
-
-            // Incoming links
-            let incoming = self.get_links_to(&current_id)?;
-            for link in incoming {
-                if !visited.contains(&link.source_id) {
-                    if let Some(c) = self.get_concept(&link.source_id)? {
-                        visited.insert(c.id.clone());
-                        queue.push_back((c.id.clone(), current_depth + 1));
-                        concepts.push(c);
-                    }
-                }
-                links.push(link);
-            }
-        }
-
-        Ok((concepts, links))
-    }
-
-    // --- Stats ---
-
-    fn memoir_stats(&self, memoir_id: &str) -> IcmResult<MemoirStats> {
-        let total_concepts: usize = self
-            .conn
-            .query_row(
-                "SELECT COUNT(*) FROM concepts WHERE memoir_id = ?1",
-                params![memoir_id],
-                |row| row.get(0),
-            )
-            .map_err(db_err)?;
-
-        let total_links: usize = self
-            .conn
-            .query_row(
-                "SELECT COUNT(*) FROM concept_links
-                 WHERE source_id IN (SELECT id FROM concepts WHERE memoir_id = ?1)",
-                params![memoir_id],
-                |row| row.get(0),
-            )
-            .map_err(db_err)?;
-
-        let avg_confidence: f32 = if total_concepts > 0 {
-            self.conn
-                .query_row(
-                    "SELECT AVG(confidence) FROM concepts WHERE memoir_id = ?1",
-                    params![memoir_id],
-                    |row| row.get(0),
-                )
-                .map_err(db_err)?
-        } else {
-            0.0
-        };
-
-        // Count labels via SQL — avoids loading all concepts into memory
-        let mut label_stmt = self
-            .conn
-            .prepare("SELECT labels FROM concepts WHERE memoir_id = ?1 AND labels != '[]'")
-            .map_err(db_err)?;
-        let label_rows = label_stmt
-            .query_map(params![memoir_id], |row| row.get::<_, String>(0))
-            .map_err(db_err)?;
-        let mut label_map: HashMap<String, usize> = HashMap::new();
-        for row in label_rows {
-            let raw = row.map_err(db_err)?;
-            if let Ok(labels) = serde_json::from_str::<Vec<Label>>(&raw) {
-                for l in labels {
-                    *label_map.entry(l.to_string()).or_insert(0) += 1;
-                }
-            }
-        }
-        let mut label_counts: Vec<(String, usize)> = label_map.into_iter().collect();
-        label_counts.sort_by_key(|b| std::cmp::Reverse(b.1));
-
-        Ok(MemoirStats {
-            total_concepts,
-            total_links,
-            avg_confidence,
-            label_counts,
-        })
-    }
-
-    fn get_links_for_memoir(&self, memoir_id: &str) -> IcmResult<Vec<ConceptLink>> {
-        let mut stmt = self
-            .conn
-            .prepare(&format!(
-                "SELECT {LINK_COLS} FROM concept_links
-                 WHERE source_id IN (SELECT id FROM concepts WHERE memoir_id = ?1)
-                 LIMIT 5000"
-            ))
-            .map_err(db_err)?;
-
-        let rows = stmt
-            .query_map(params![memoir_id], row_to_link)
-            .map_err(db_err)?;
-
-        collect_rows(rows)
-    }
-
-    fn batch_memoir_concept_counts(&self) -> IcmResult<HashMap<String, usize>> {
-        let mut stmt = self
-            .conn
-            .prepare("SELECT memoir_id, COUNT(*) FROM concepts GROUP BY memoir_id")
-            .map_err(db_err)?;
-
-        let rows = stmt
-            .query_map([], |row| {
-                Ok((row.get::<_, String>(0)?, row.get::<_, usize>(1)?))
-            })
-            .map_err(db_err)?;
-
-        let mut map = HashMap::new();
-        for row in rows {
-            let (id, count) = row.map_err(db_err)?;
-            map.insert(id, count);
-        }
-        Ok(map)
-    }
-}
-
-// ---------------------------------------------------------------------------
-// Feedback helpers
-// ---------------------------------------------------------------------------
-
-fn row_to_feedback(row: &rusqlite::Row) -> rusqlite::Result<Feedback> {
-    let embedding: Option<Vec<f32>> = row
-        .get::<_, Option<Vec<u8>>>(9)?
-        .map(|b| blob_to_embedding(&b));
-    Ok(Feedback {
-        id: row.get(0)?,
-        topic: row.get(1)?,
-        context: row.get(2)?,
-        predicted: row.get(3)?,
-        corrected: row.get(4)?,
-        reason: row.get(5)?,
-        source: row.get(6)?,
-        created_at: parse_dt(&row.get::<_, String>(7)?),
-        applied_count: row.get(8)?,
-        embedding,
-    })
-}
-
-const FEEDBACK_COLS: &str =
-    "id, topic, context, predicted, corrected, reason, source, created_at, applied_count, embedding";
-/// Same columns, qualified for the `feedback f JOIN feedback_fts fts` query
-/// in `search_feedback` — both tables have an `id` column post-join, so the
-/// unqualified `FEEDBACK_COLS` is ambiguous there (found via real testing:
-/// `search_feedback` errored on every call once the join was introduced).
-const FEEDBACK_COLS_F: &str = "f.id, f.topic, f.context, f.predicted, f.corrected, f.reason, \
-     f.source, f.created_at, f.applied_count, f.embedding";
-
-// ---------------------------------------------------------------------------
-// FeedbackStore impl
-// ---------------------------------------------------------------------------
-
-/// Pure Rust cosine similarity for the feedback semantic fallback (no
-/// vec0 virtual table — feedback volume is expected far lower than
-/// memories, so a brute-force scan over rows with an embedding is simpler
-/// and avoids replicating the vec0/dimension-migration machinery for a
-/// low-cardinality table). A dimension mismatch returns -1.0 (below any
-/// real cosine similarity) rather than silently comparing a truncated
-/// prefix — same reasoning as `extract_semantic.rs`'s `cosine`.
-fn feedback_cosine(a: &[f32], b: &[f32]) -> f32 {
-    if a.len() != b.len() || a.is_empty() {
-        return -1.0;
-    }
-    let (mut dot, mut na, mut nb) = (0.0f32, 0.0f32, 0.0f32);
-    for i in 0..a.len() {
-        dot += a[i] * b[i];
-        na += a[i] * a[i];
-        nb += b[i] * b[i];
-    }
-    if na == 0.0 || nb == 0.0 {
-        return -1.0;
-    }
-    dot / (na.sqrt() * nb.sqrt())
-}
-
-impl FeedbackStore for SqliteStore {
-    fn store_feedback(&self, feedback: Feedback) -> IcmResult<String> {
-        let embedding_blob = feedback.embedding.as_deref().map(embedding_to_blob);
-        self.conn
-            .execute(
-                "INSERT INTO feedback (id, topic, context, predicted, corrected, reason, source, created_at, applied_count, embedding)
-                 VALUES (?1, ?2, ?3, ?4, ?5, ?6, ?7, ?8, ?9, ?10)",
-                params![
-                    feedback.id,
-                    feedback.topic,
-                    feedback.context,
-                    feedback.predicted,
-                    feedback.corrected,
-                    feedback.reason,
-                    feedback.source,
-                    feedback.created_at.to_rfc3339(),
-                    feedback.applied_count,
-                    embedding_blob,
-                ],
-            )
-            .map_err(db_err)?;
-        Ok(feedback.id)
-    }
-
-    fn search_feedback(
-        &self,
-        query: &str,
-        query_embedding: Option<&[f32]>,
-        topic: Option<&str>,
-        limit: usize,
-    ) -> IcmResult<Vec<Feedback>> {
-        let sanitized = sanitize_fts_query(query);
-
-        if sanitized.is_empty() {
-            return self.list_feedback(topic, limit);
-        }
-
-        let pool = limit.saturating_mul(4).max(limit);
-
-        // FTS candidates, ranked (FTS5 bm25: more negative = more relevant).
-        let (fts_sql, fts_params): (String, Vec<Box<dyn rusqlite::types::ToSql>>) =
-            if let Some(t) = topic {
-                (
-                    format!(
-                        "SELECT {FEEDBACK_COLS_F}, fts.rank as rnk FROM feedback f
-                         JOIN feedback_fts fts ON fts.id = f.id
-                         WHERE feedback_fts MATCH ?1 AND f.topic = ?2
-                         ORDER BY fts.rank LIMIT ?3"
-                    ),
-                    vec![
-                        Box::new(sanitized.clone()) as Box<dyn rusqlite::types::ToSql>,
-                        Box::new(t.to_string()),
-                        Box::new(pool as i64),
-                    ],
-                )
-            } else {
-                (
-                    format!(
-                        "SELECT {FEEDBACK_COLS_F}, fts.rank as rnk FROM feedback f
-                         JOIN feedback_fts fts ON fts.id = f.id
-                         WHERE feedback_fts MATCH ?1
-                         ORDER BY fts.rank LIMIT ?2"
-                    ),
-                    vec![
-                        Box::new(sanitized.clone()) as Box<dyn rusqlite::types::ToSql>,
-                        Box::new(pool as i64),
-                    ],
-                )
-            };
-
-        let mut all: HashMap<String, Feedback> = HashMap::new();
-        let mut fts_scores: HashMap<String, f32> = HashMap::new();
-        {
-            let mut stmt = self.conn.prepare(&fts_sql).map_err(db_err)?;
-            let refs: Vec<&dyn rusqlite::types::ToSql> =
-                fts_params.iter().map(|p| p.as_ref()).collect();
-            let col_count = 10; // FEEDBACK_COLS (10) + rnk
-            let rows = stmt
-                .query_map(refs.as_slice(), |row| {
-                    let fb = row_to_feedback(row)?;
-                    let rank: f32 = row.get(col_count)?;
-                    Ok((fb, rank))
-                })
-                .map_err(db_err)?;
-            for row in rows.flatten() {
-                let (fb, rank) = row;
-                // Same monotonic-increasing-in-relevance transform as
-                // memories' search_hybrid (audit finding there: the naive
-                // `1.0 / (1.0 + |rank|)` inverts the relationship).
-                let score = rank.abs() / (1.0 + rank.abs());
-                fts_scores.insert(fb.id.clone(), score);
-                all.insert(fb.id.clone(), fb);
-            }
-        }
-
-        // Semantic candidates: brute-force cosine over rows with an
-        // embedding (see feedback_cosine's doc comment for why no vec0).
-        let mut vec_scores: HashMap<String, f32> = HashMap::new();
-        if let Some(qemb) = query_embedding {
-            let topic_sql = if topic.is_some() {
-                " WHERE topic = ?1"
-            } else {
-                ""
-            };
-            let sql = format!("SELECT {FEEDBACK_COLS} FROM feedback{topic_sql}");
-            let mut stmt = self.conn.prepare(&sql).map_err(db_err)?;
-            let candidates: Vec<Feedback> = if let Some(t) = topic {
-                collect_rows(
-                    stmt.query_map(params![t], row_to_feedback)
-                        .map_err(db_err)?,
-                )?
-            } else {
-                collect_rows(stmt.query_map([], row_to_feedback).map_err(db_err)?)?
-            };
-            for fb in candidates {
-                if let Some(emb) = &fb.embedding {
-                    let sim = feedback_cosine(qemb, emb);
-                    if sim > 0.0 {
-                        vec_scores.insert(fb.id.clone(), sim);
-                        all.entry(fb.id.clone()).or_insert(fb);
-                    }
-                }
-            }
-        }
-
-        let mut scored: Vec<(String, f32)> = all
-            .keys()
-            .map(|id| {
-                let fts = fts_scores.get(id).copied().unwrap_or(0.0);
-                let vec = vec_scores.get(id).copied().unwrap_or(0.0);
-                (id.clone(), 0.3 * fts + 0.7 * vec)
-            })
-            .collect();
-        // Pure-FTS fallback (no query embedding available) must still rank
-        // by relevance, not just whatever HashMap order `all` iterates in.
-        if query_embedding.is_none() {
-            scored = fts_scores.iter().map(|(id, s)| (id.clone(), *s)).collect();
-        }
-        scored.sort_by(|a, b| b.1.partial_cmp(&a.1).unwrap_or(std::cmp::Ordering::Equal));
-        scored.truncate(limit);
-
-        Ok(scored
-            .into_iter()
-            .filter_map(|(id, _)| all.remove(&id))
-            .collect())
-    }
-
-    fn list_feedback(&self, topic: Option<&str>, limit: usize) -> IcmResult<Vec<Feedback>> {
-        let (sql, params_vec): (String, Vec<Box<dyn rusqlite::types::ToSql>>) = if let Some(t) =
-            topic
-        {
-            (
-                    format!(
-                        "SELECT {FEEDBACK_COLS} FROM feedback WHERE topic = ?1 ORDER BY created_at DESC LIMIT ?2"
-                    ),
-                    vec![
-                        Box::new(t.to_string()) as Box<dyn rusqlite::types::ToSql>,
-                        Box::new(limit as i64),
-                    ],
-                )
-        } else {
-            (
-                format!("SELECT {FEEDBACK_COLS} FROM feedback ORDER BY created_at DESC LIMIT ?1"),
-                vec![Box::new(limit as i64) as Box<dyn rusqlite::types::ToSql>],
-            )
-        };
-
-        let mut stmt = self.conn.prepare(&sql).map_err(db_err)?;
-        let refs: Vec<&dyn rusqlite::types::ToSql> =
-            params_vec.iter().map(|p| p.as_ref()).collect();
-        let rows = stmt
-            .query_map(refs.as_slice(), row_to_feedback)
-            .map_err(db_err)?;
-        collect_rows(rows)
-    }
-
-    fn increment_applied(&self, id: &str) -> IcmResult<()> {
-        let changed = self
-            .conn
-            .execute(
-                "UPDATE feedback SET applied_count = applied_count + 1 WHERE id = ?1",
-                params![id],
-            )
-            .map_err(db_err)?;
-
-        if changed == 0 {
-            return Err(IcmError::NotFound(id.to_string()));
-        }
-        Ok(())
-    }
-
-    fn delete_feedback(&self, id: &str) -> IcmResult<()> {
-        let changed = self
-            .conn
-            .execute("DELETE FROM feedback WHERE id = ?1", params![id])
-            .map_err(db_err)?;
-
-        if changed == 0 {
-            return Err(IcmError::NotFound(id.to_string()));
-        }
-        Ok(())
-    }
-
-    fn feedback_stats(&self) -> IcmResult<FeedbackStats> {
-        let total: usize = self
-            .conn
-            .query_row("SELECT COUNT(*) FROM feedback", [], |row| row.get(0))
-            .map_err(db_err)?;
-
-        let mut stmt = self
-            .conn
-            .prepare("SELECT topic, COUNT(*) as cnt FROM feedback GROUP BY topic ORDER BY cnt DESC")
-            .map_err(db_err)?;
-
-        let by_topic: Vec<(String, usize)> = stmt
-            .query_map([], |row| Ok((row.get(0)?, row.get(1)?)))
-            .map_err(db_err)?
-            .filter_map(|r| r.ok())
-            .collect();
-
-        let mut stmt = self
-            .conn
-            .prepare(
-                "SELECT id, applied_count FROM feedback WHERE applied_count > 0 ORDER BY applied_count DESC LIMIT 10",
-            )
-            .map_err(db_err)?;
-
-        let most_applied: Vec<(String, u32)> = stmt
-            .query_map([], |row| Ok((row.get(0)?, row.get(1)?)))
-            .map_err(db_err)?
-            .filter_map(|r| r.ok())
-            .collect();
-
-        Ok(FeedbackStats {
-            total,
-            by_topic,
-            most_applied,
-        })
-    }
-}
-
-// ---------------------------------------------------------------------------
-// Structured facts (issue #273)
-// ---------------------------------------------------------------------------
-
-fn row_to_fact(row: &rusqlite::Row<'_>) -> rusqlite::Result<Fact> {
-    let created_at: String = row.get("created_at")?;
-    let superseded_at: Option<String> = row.get("superseded_at")?;
-    Ok(Fact {
-        id: row.get("id")?,
-        entity: row.get("entity")?,
-        key: row.get("key")?,
-        value: row.get("value")?,
-        source: row.get("source")?,
-        created_at: chrono::DateTime::parse_from_rfc3339(&created_at)
-            .map(|d| d.with_timezone(&chrono::Utc))
-            .unwrap_or_else(|_| chrono::Utc::now()),
-        superseded_at: superseded_at.and_then(|s| {
-            chrono::DateTime::parse_from_rfc3339(&s)
-                .ok()
-                .map(|d| d.with_timezone(&chrono::Utc))
-        }),
-    })
-}
-
-impl SqliteStore {
-    fn set_fact_inner(
-        &self,
-        entity: &str,
-        key: &str,
-        value: &str,
-        source: &str,
-    ) -> IcmResult<String> {
-        let conn = &self.conn;
-        // Active row lookup
-        let existing: Option<(String, String)> = conn
-            .query_row(
-                "SELECT id, value FROM facts
-                 WHERE entity = ?1 AND key = ?2 AND superseded_at IS NULL",
-                params![entity, key],
-                |row| Ok((row.get(0)?, row.get(1)?)),
-            )
-            .optional()
-            .map_err(db_err)?;
-
-        if let Some((id, current_value)) = existing {
-            if current_value == value {
-                // No-op: same value re-asserted.
-                return Ok(id);
-            }
-            let now = chrono::Utc::now().to_rfc3339();
-            conn.execute(
-                "UPDATE facts SET superseded_at = ?1 WHERE id = ?2",
-                params![now, id],
-            )
-            .map_err(db_err)?;
-        }
-
-        let new = Fact::new(
-            entity.to_string(),
-            key.to_string(),
-            value.to_string(),
-            source.to_string(),
-        );
-        conn.execute(
-            "INSERT INTO facts (id, entity, key, value, source, created_at, superseded_at)
-             VALUES (?1, ?2, ?3, ?4, ?5, ?6, NULL)",
-            params![
-                new.id,
-                new.entity,
-                new.key,
-                new.value,
-                new.source,
-                new.created_at.to_rfc3339(),
-            ],
-        )
-        .map_err(db_err)?;
-        Ok(new.id)
-    }
-}
-
-impl FactsStore for SqliteStore {
-    fn set_fact(&self, entity: &str, key: &str, value: &str, source: &str) -> IcmResult<String> {
-        if entity.is_empty() || key.is_empty() {
-            return Err(IcmError::InvalidInput(
-                "entity and key must be non-empty".into(),
-            ));
-        }
-        // SELECT (find active row) -> UPDATE (supersede it) -> INSERT (new
-        // row) was three separate statements with no transaction around
-        // them, unlike every other multi-statement write in this file
-        // (audit finding: 0 BEGIN IMMEDIATE occurrences across
-        // Facts/Feedback/Transcript vs 5 in MemoryStore). A crash or
-        // concurrent writer between the UPDATE and the INSERT could leave
-        // the entity/key with no active fact at all.
-        self.conn
-            .execute_batch("BEGIN IMMEDIATE;")
-            .map_err(db_err)?;
-        match self.set_fact_inner(entity, key, value, source) {
-            Ok(id) => {
-                self.conn.execute_batch("COMMIT;").map_err(db_err)?;
-                Ok(id)
-            }
-            Err(e) => {
-                let _ = self.conn.execute_batch("ROLLBACK;");
-                Err(e)
-            }
-        }
-    }
-
-    fn get_fact(&self, entity: &str, key: &str) -> IcmResult<Option<Fact>> {
-        let conn = &self.conn;
-        let row = conn
-            .query_row(
-                "SELECT id, entity, key, value, source, created_at, superseded_at
-                 FROM facts
-                 WHERE entity = ?1 AND key = ?2 AND superseded_at IS NULL",
-                params![entity, key],
-                row_to_fact,
-            )
-            .map(Some)
-            .or_else(|e| match e {
-                rusqlite::Error::QueryReturnedNoRows => Ok(None),
-                other => Err(db_err(other)),
-            })?;
-        Ok(row)
-    }
-
-    fn list_facts(&self, entity: &str, key_prefix: Option<&str>) -> IcmResult<Vec<Fact>> {
-        let conn = &self.conn;
-        let rows = match key_prefix {
-            Some(prefix) if !prefix.is_empty() => {
-                let mut stmt = conn
-                    .prepare(
-                        "SELECT id, entity, key, value, source, created_at, superseded_at
-                         FROM facts
-                         WHERE entity = ?1 AND key LIKE ?2 AND superseded_at IS NULL
-                         ORDER BY key ASC",
-                    )
-                    .map_err(db_err)?;
-                let pattern = format!("{prefix}%");
-                let rows = stmt
-                    .query_map(params![entity, pattern], row_to_fact)
-                    .map_err(db_err)?;
-                rows.collect::<Result<Vec<_>, _>>().map_err(db_err)?
-            }
-            _ => {
-                let mut stmt = conn
-                    .prepare(
-                        "SELECT id, entity, key, value, source, created_at, superseded_at
-                         FROM facts
-                         WHERE entity = ?1 AND superseded_at IS NULL
-                         ORDER BY key ASC",
-                    )
-                    .map_err(db_err)?;
-                let rows = stmt
-                    .query_map(params![entity], row_to_fact)
-                    .map_err(db_err)?;
-                rows.collect::<Result<Vec<_>, _>>().map_err(db_err)?
-            }
-        };
-        Ok(rows)
-    }
-
-    fn history(&self, entity: &str, key: &str) -> IcmResult<Vec<Fact>> {
-        let conn = &self.conn;
-        let mut stmt = conn
-            .prepare(
-                "SELECT id, entity, key, value, source, created_at, superseded_at
-                 FROM facts
-                 WHERE entity = ?1 AND key = ?2
-                 ORDER BY created_at DESC",
-            )
-            .map_err(db_err)?;
-        let rows = stmt
-            .query_map(params![entity, key], row_to_fact)
-            .map_err(db_err)?;
-        rows.collect::<Result<Vec<_>, _>>().map_err(db_err)
-    }
-
-    fn forget_fact(&self, entity: &str, key: &str) -> IcmResult<usize> {
-        let conn = &self.conn;
-        let n = conn
-            .execute(
-                "DELETE FROM facts WHERE entity = ?1 AND key = ?2",
-                params![entity, key],
-            )
-            .map_err(db_err)?;
-        Ok(n)
-    }
-
-    fn facts_stats(&self) -> IcmResult<FactsStats> {
-        let conn = &self.conn;
-        let active_count: usize = conn
-            .query_row(
-                "SELECT COUNT(*) FROM facts WHERE superseded_at IS NULL",
-                [],
-                |r| r.get::<_, i64>(0).map(|v| v as usize),
-            )
-            .map_err(db_err)?;
-        let total_count: usize = conn
-            .query_row("SELECT COUNT(*) FROM facts", [], |r| {
-                r.get::<_, i64>(0).map(|v| v as usize)
-            })
-            .map_err(db_err)?;
-        let distinct_entities: usize = conn
-            .query_row(
-                "SELECT COUNT(DISTINCT entity) FROM facts WHERE superseded_at IS NULL",
-                [],
-                |r| r.get::<_, i64>(0).map(|v| v as usize),
-            )
-            .map_err(db_err)?;
-
-        let mut stmt = conn
-            .prepare(
-                "SELECT entity, COUNT(*) as n FROM facts
-                 WHERE superseded_at IS NULL
-                 GROUP BY entity
-                 ORDER BY n DESC
-                 LIMIT 10",
-            )
-            .map_err(db_err)?;
-        let rows = stmt
-            .query_map([], |row| {
-                let entity: String = row.get(0)?;
-                let n: i64 = row.get(1)?;
-                Ok((entity, n as usize))
-            })
-            .map_err(db_err)?;
-        let top_entities: Vec<(String, usize)> =
-            rows.collect::<Result<Vec<_>, _>>().map_err(db_err)?;
-
-        Ok(FactsStats {
-            active_count,
-            total_count,
-            distinct_entities,
-            top_entities,
-        })
-    }
-}
-
-// ---------------------------------------------------------------------------
-// Transcripts (verbatim sessions + messages)
-// ---------------------------------------------------------------------------
-
-fn row_to_session(row: &rusqlite::Row<'_>) -> rusqlite::Result<Session> {
-    let started_at: String = row.get("started_at")?;
-    let updated_at: String = row.get("updated_at")?;
-    Ok(Session {
-        id: row.get("id")?,
-        agent: row.get("agent")?,
-        project: row.get("project")?,
-        started_at: parse_ts(&started_at),
-        updated_at: parse_ts(&updated_at),
-        metadata: row.get("metadata")?,
-    })
-}
-
-fn row_to_message(row: &rusqlite::Row<'_>) -> rusqlite::Result<Message> {
-    let role_str: String = row.get("role")?;
-    let ts: String = row.get("ts")?;
-    let role = Role::parse(&role_str).unwrap_or(Role::Tool);
-    Ok(Message {
-        id: row.get("id")?,
-        session_id: row.get("session_id")?,
-        role,
-        content: row.get("content")?,
-        tool_name: row.get("tool_name")?,
-        tokens: row.get("tokens")?,
-        ts: parse_ts(&ts),
-        metadata: row.get("metadata")?,
-    })
-}
-
-fn parse_ts(s: &str) -> DateTime<Utc> {
-    DateTime::parse_from_rfc3339(s)
-        .map(|t| t.with_timezone(&Utc))
-        .unwrap_or_else(|_| Utc::now())
-}
-
-impl TranscriptStore for SqliteStore {
-    fn create_session(
-        &self,
-        agent: &str,
-        project: Option<&str>,
-        metadata: Option<&str>,
-    ) -> IcmResult<String> {
-        let metadata = metadata.map(|s| truncate_at_char_boundary(s, MAX_METADATA_BYTES));
-        let session = Session::new(
-            agent.to_string(),
-            project.map(|s| s.to_string()),
-            metadata.map(|s| s.to_string()),
-        );
-        let conn = &self.conn;
-        conn.execute(
-            "INSERT INTO sessions (id, agent, project, started_at, updated_at, metadata)
-             VALUES (?1, ?2, ?3, ?4, ?5, ?6)",
-            params![
-                session.id,
-                session.agent,
-                session.project,
-                session.started_at.to_rfc3339(),
-                session.updated_at.to_rfc3339(),
-                session.metadata,
-            ],
-        )
-        .map_err(db_err)?;
-        Ok(session.id)
-    }
-
-    fn get_session(&self, id: &str) -> IcmResult<Option<Session>> {
-        let conn = &self.conn;
-        let row = conn
-            .query_row(
-                "SELECT id, agent, project, started_at, updated_at, metadata
-                 FROM sessions WHERE id = ?1",
-                params![id],
-                row_to_session,
-            )
-            .map(Some)
-            .or_else(|e| match e {
-                rusqlite::Error::QueryReturnedNoRows => Ok(None),
-                other => Err(db_err(other)),
-            })?;
-        Ok(row)
-    }
-
-    fn ensure_session(
-        &self,
-        id: &str,
-        agent: &str,
-        project: Option<&str>,
-        metadata: Option<&str>,
-    ) -> IcmResult<String> {
-        let conn = &self.conn;
-        let now = chrono::Utc::now().to_rfc3339();
-        let metadata = metadata.map(|s| truncate_at_char_boundary(s, MAX_METADATA_BYTES));
-        // INSERT OR IGNORE keeps the first row stable across re-fires.
-        // The `id` is the host agent's session id (Claude Code, Codex,
-        // Gemini, etc.) so repeated hook posts route to the same row.
-        conn.execute(
-            "INSERT OR IGNORE INTO sessions (id, agent, project, started_at, updated_at, metadata)
-             VALUES (?1, ?2, ?3, ?4, ?5, ?6)",
-            params![id, agent, project, now, now, metadata.unwrap_or("{}")],
-        )
-        .map_err(db_err)?;
-        Ok(id.to_string())
-    }
-
-    fn list_sessions(&self, project: Option<&str>, limit: usize) -> IcmResult<Vec<Session>> {
-        let conn = &self.conn;
-        match project {
-            Some(p) => {
-                let mut stmt = conn
-                    .prepare(
-                        "SELECT id, agent, project, started_at, updated_at, metadata
-                         FROM sessions WHERE project = ?1
-                         ORDER BY updated_at DESC LIMIT ?2",
-                    )
-                    .map_err(db_err)?;
-                let rows = stmt
-                    .query_map(params![p, limit as i64], row_to_session)
-                    .map_err(db_err)?
-                    .collect::<Result<Vec<_>, _>>()
-                    .map_err(db_err)?;
-                Ok(rows)
-            }
-            None => {
-                let mut stmt = conn
-                    .prepare(
-                        "SELECT id, agent, project, started_at, updated_at, metadata
-                         FROM sessions ORDER BY updated_at DESC LIMIT ?1",
-                    )
-                    .map_err(db_err)?;
-                let rows = stmt
-                    .query_map(params![limit as i64], row_to_session)
-                    .map_err(db_err)?
-                    .collect::<Result<Vec<_>, _>>()
-                    .map_err(db_err)?;
-                Ok(rows)
-            }
-        }
-    }
-
-    fn record_message(
-        &self,
-        session_id: &str,
-        role: Role,
-        content: &str,
-        tool_name: Option<&str>,
-        tokens: Option<i64>,
-        metadata: Option<&str>,
-    ) -> IcmResult<String> {
-        /// Cap on a single transcript message. Unlike memory writes (which
-        /// reject oversized input), transcripts are best-effort logs — a
-        /// multi-MB tool dump is truncated rather than lost entirely. The
-        /// MCP `icm_transcript_record` path previously had no bound at all
-        /// (audit finding).
-        const MAX_MESSAGE_BYTES: usize = 256 * 1024;
-        // metadata/tool_name got no cap at all even after content was capped
-        // in round 2 (audit finding) - same best-effort-truncate rationale,
-        // just smaller since they're auxiliary, not the main payload.
-        const MAX_TOOL_NAME_BYTES: usize = 512;
-
-        let content = truncate_at_char_boundary(content, MAX_MESSAGE_BYTES);
-        let tool_name = tool_name.map(|s| truncate_at_char_boundary(s, MAX_TOOL_NAME_BYTES));
-        let metadata = metadata.map(|s| truncate_at_char_boundary(s, MAX_METADATA_BYTES));
-
-        let msg = Message::new(
-            session_id.to_string(),
-            role,
-            content.to_string(),
-            tool_name.map(|s| s.to_string()),
-            tokens,
-            metadata.map(|s| s.to_string()),
-        );
-        let conn = &self.conn;
-
-        // Ensure the session exists — referential integrity check is friendlier
-        // than raw FK failure.
-        let session_exists: bool = conn
-            .query_row(
-                "SELECT COUNT(*) > 0 FROM sessions WHERE id = ?1",
-                params![session_id],
-                |r| r.get(0),
-            )
-            .map_err(db_err)?;
-        if !session_exists {
-            return Err(IcmError::NotFound(format!(
-                "session {} does not exist",
-                session_id
-            )));
-        }
-
-        conn.execute(
-            "INSERT INTO messages (id, session_id, role, content, tool_name, tokens, ts, metadata)
-             VALUES (?1, ?2, ?3, ?4, ?5, ?6, ?7, ?8)",
-            params![
-                msg.id,
-                msg.session_id,
-                msg.role.as_str(),
-                msg.content,
-                msg.tool_name,
-                msg.tokens,
-                msg.ts.to_rfc3339(),
-                msg.metadata,
-            ],
-        )
-        .map_err(db_err)?;
-        conn.execute(
-            "UPDATE sessions SET updated_at = ?1 WHERE id = ?2",
-            params![msg.ts.to_rfc3339(), session_id],
-        )
-        .map_err(db_err)?;
-        Ok(msg.id)
-    }
-
-    fn list_session_messages(
-        &self,
-        session_id: &str,
-        limit: usize,
-        offset: usize,
-    ) -> IcmResult<Vec<Message>> {
-        let conn = &self.conn;
-        let mut stmt = conn
-            .prepare(
-                "SELECT id, session_id, role, content, tool_name, tokens, ts, metadata
-                 FROM messages WHERE session_id = ?1
-                 ORDER BY ts ASC LIMIT ?2 OFFSET ?3",
-            )
-            .map_err(db_err)?;
-        let rows: Vec<Message> = stmt
-            .query_map(
-                params![session_id, limit as i64, offset as i64],
-                row_to_message,
-            )
-            .map_err(db_err)?
-            .collect::<Result<Vec<_>, _>>()
-            .map_err(db_err)?;
-        Ok(rows)
-    }
-
-    fn search_transcripts(
-        &self,
-        query: &str,
-        session_id: Option<&str>,
-        project: Option<&str>,
-        limit: usize,
-    ) -> IcmResult<Vec<TranscriptHit>> {
-        // Unlike search_feedback, raw query text is bound straight to
-        // `messages_fts MATCH ?1` — intentionally, since callers rely on
-        // real FTS5 syntax here (boolean OR, phrase quoting; see
-        // test_transcript_search_fts5_boolean_and_phrase). Sanitizing like
-        // search_feedback does would silently break that. Malformed syntax
-        // (e.g. "hello AND", "(hello") threw a raw sqlite error instead of
-        // degrading gracefully (audit finding) — that's handled below by
-        // treating an FTS5 syntax error as "no results" rather than
-        // propagating the sqlite internals to the caller.
-        let conn = &self.conn;
-        // Build dynamic WHERE filters. FTS MATCH comes first for index usage.
-        let mut sql = String::from(
-            "SELECT m.id, m.session_id, m.role, m.content, m.tool_name, m.tokens, m.ts, m.metadata,
-                    s.id AS s_id, s.agent AS s_agent, s.project AS s_project,
-                    s.started_at AS s_started_at, s.updated_at AS s_updated_at,
-                    s.metadata AS s_metadata,
-                    bm25(messages_fts) AS score
-             FROM messages_fts
-             JOIN messages m ON m.rowid = messages_fts.rowid
-             JOIN sessions s ON s.id = m.session_id
-             WHERE messages_fts MATCH ?1",
-        );
-        // Param numbering: ?1 = query (always). Session if present is ?2.
-        // Project is ?2 if no session, else ?3.
-        if session_id.is_some() {
-            sql.push_str(" AND m.session_id = ?2");
-        }
-        if project.is_some() {
-            if session_id.is_some() {
-                sql.push_str(" AND s.project = ?3");
-            } else {
-                sql.push_str(" AND s.project = ?2");
-            }
-        }
-        sql.push_str(" ORDER BY score ASC LIMIT ?");
-        sql.push_str(match (session_id.is_some(), project.is_some()) {
-            (true, true) => "4",
-            (true, false) | (false, true) => "3",
-            (false, false) => "2",
-        });
-
-        let mut stmt = conn.prepare(&sql).map_err(db_err)?;
-        let limit_i = limit as i64;
-        // Compute against raw rusqlite errors so a malformed FTS5 query
-        // (syntax error) can be distinguished from a real db failure below,
-        // instead of eagerly converting to IcmError via `?`.
-        let mut compute = || -> rusqlite::Result<Vec<TranscriptHit>> {
-            Ok(match (session_id, project) {
-                (Some(sid), Some(p)) => stmt
-                    .query_map(params![query, sid, p, limit_i], |row| {
-                        let msg = Message {
-                            id: row.get("id")?,
-                            session_id: row.get("session_id")?,
-                            role: Role::parse(&row.get::<_, String>("role")?).unwrap_or(Role::Tool),
-                            content: row.get("content")?,
-                            tool_name: row.get("tool_name")?,
-                            tokens: row.get("tokens")?,
-                            ts: parse_ts(&row.get::<_, String>("ts")?),
-                            metadata: row.get("metadata")?,
-                        };
-                        let sess = Session {
-                            id: row.get("s_id")?,
-                            agent: row.get("s_agent")?,
-                            project: row.get("s_project")?,
-                            started_at: parse_ts(&row.get::<_, String>("s_started_at")?),
-                            updated_at: parse_ts(&row.get::<_, String>("s_updated_at")?),
-                            metadata: row.get("s_metadata")?,
-                        };
-                        let raw_score: f64 = row.get("score")?;
-                        Ok(TranscriptHit {
-                            message: msg,
-                            session: sess,
-                            score: -raw_score, // FTS5 bm25 returns negative for better rank
-                        })
-                    })?
-                    .collect::<Result<Vec<_>, _>>()?,
-                (Some(sid), None) => stmt
-                    .query_map(params![query, sid, limit_i], |row| {
-                        let msg = Message {
-                            id: row.get("id")?,
-                            session_id: row.get("session_id")?,
-                            role: Role::parse(&row.get::<_, String>("role")?).unwrap_or(Role::Tool),
-                            content: row.get("content")?,
-                            tool_name: row.get("tool_name")?,
-                            tokens: row.get("tokens")?,
-                            ts: parse_ts(&row.get::<_, String>("ts")?),
-                            metadata: row.get("metadata")?,
-                        };
-                        let sess = Session {
-                            id: row.get("s_id")?,
-                            agent: row.get("s_agent")?,
-                            project: row.get("s_project")?,
-                            started_at: parse_ts(&row.get::<_, String>("s_started_at")?),
-                            updated_at: parse_ts(&row.get::<_, String>("s_updated_at")?),
-                            metadata: row.get("s_metadata")?,
-                        };
-                        let raw_score: f64 = row.get("score")?;
-                        Ok(TranscriptHit {
-                            message: msg,
-                            session: sess,
-                            score: -raw_score,
-                        })
-                    })?
-                    .collect::<Result<Vec<_>, _>>()?,
-                (None, Some(p)) => stmt
-                    .query_map(params![query, p, limit_i], |row| {
-                        let msg = Message {
-                            id: row.get("id")?,
-                            session_id: row.get("session_id")?,
-                            role: Role::parse(&row.get::<_, String>("role")?).unwrap_or(Role::Tool),
-                            content: row.get("content")?,
-                            tool_name: row.get("tool_name")?,
-                            tokens: row.get("tokens")?,
-                            ts: parse_ts(&row.get::<_, String>("ts")?),
-                            metadata: row.get("metadata")?,
-                        };
-                        let sess = Session {
-                            id: row.get("s_id")?,
-                            agent: row.get("s_agent")?,
-                            project: row.get("s_project")?,
-                            started_at: parse_ts(&row.get::<_, String>("s_started_at")?),
-                            updated_at: parse_ts(&row.get::<_, String>("s_updated_at")?),
-                            metadata: row.get("s_metadata")?,
-                        };
-                        let raw_score: f64 = row.get("score")?;
-                        Ok(TranscriptHit {
-                            message: msg,
-                            session: sess,
-                            score: -raw_score,
-                        })
-                    })?
-                    .collect::<Result<Vec<_>, _>>()?,
-                (None, None) => stmt
-                    .query_map(params![query, limit_i], |row| {
-                        let msg = Message {
-                            id: row.get("id")?,
-                            session_id: row.get("session_id")?,
-                            role: Role::parse(&row.get::<_, String>("role")?).unwrap_or(Role::Tool),
-                            content: row.get("content")?,
-                            tool_name: row.get("tool_name")?,
-                            tokens: row.get("tokens")?,
-                            ts: parse_ts(&row.get::<_, String>("ts")?),
-                            metadata: row.get("metadata")?,
-                        };
-                        let sess = Session {
-                            id: row.get("s_id")?,
-                            agent: row.get("s_agent")?,
-                            project: row.get("s_project")?,
-                            started_at: parse_ts(&row.get::<_, String>("s_started_at")?),
-                            updated_at: parse_ts(&row.get::<_, String>("s_updated_at")?),
-                            metadata: row.get("s_metadata")?,
-                        };
-                        let raw_score: f64 = row.get("score")?;
-                        Ok(TranscriptHit {
-                            message: msg,
-                            session: sess,
-                            score: -raw_score,
-                        })
-                    })?
-                    .collect::<Result<Vec<_>, _>>()?,
-            })
-        };
-        let rows = match compute() {
-            Ok(rows) => rows,
-            Err(e) if is_fts5_syntax_error(&e) => Vec::new(),
-            Err(e) => return Err(db_err(e)),
-        };
-        Ok(rows)
-    }
-
-    fn forget_session(&self, id: &str) -> IcmResult<()> {
-        let conn = &self.conn;
-        // Explicit delete of messages (in case FK cascade isn't enabled on older DBs).
-        conn.execute("DELETE FROM messages WHERE session_id = ?1", params![id])
-            .map_err(db_err)?;
-        conn.execute("DELETE FROM sessions WHERE id = ?1", params![id])
-            .map_err(db_err)?;
-        Ok(())
-    }
-
-    fn transcript_stats(&self) -> IcmResult<TranscriptStats> {
-        let conn = &self.conn;
-
-        let total_sessions: usize = conn
-            .query_row("SELECT COUNT(*) FROM sessions", [], |r| r.get(0))
-            .map_err(db_err)?;
-        let total_messages: usize = conn
-            .query_row("SELECT COUNT(*) FROM messages", [], |r| r.get(0))
-            .map_err(db_err)?;
-        let total_bytes: u64 = conn
-            .query_row(
-                "SELECT COALESCE(SUM(LENGTH(content)), 0) FROM messages",
-                [],
-                |r| r.get::<_, i64>(0),
-            )
-            .map_err(db_err)? as u64;
-
-        let mut stmt_role = conn
-            .prepare("SELECT role, COUNT(*) FROM messages GROUP BY role ORDER BY 2 DESC")
-            .map_err(db_err)?;
-        let by_role: Vec<(String, usize)> = stmt_role
-            .query_map([], |r: &rusqlite::Row<'_>| {
-                Ok((r.get::<_, String>(0)?, r.get::<_, i64>(1)? as usize))
-            })
-            .map_err(db_err)?
-            .collect::<Result<Vec<_>, _>>()
-            .map_err(db_err)?;
-
-        let mut stmt_agent = conn
-            .prepare("SELECT agent, COUNT(*) FROM sessions GROUP BY agent ORDER BY 2 DESC")
-            .map_err(db_err)?;
-        let by_agent: Vec<(String, usize)> = stmt_agent
-            .query_map([], |r: &rusqlite::Row<'_>| {
-                Ok((r.get::<_, String>(0)?, r.get::<_, i64>(1)? as usize))
-            })
-            .map_err(db_err)?
-            .collect::<Result<Vec<_>, _>>()
-            .map_err(db_err)?;
-
-        let mut stmt_top = conn
-            .prepare(
-                "SELECT session_id, COUNT(*) FROM messages
-                 GROUP BY session_id ORDER BY 2 DESC LIMIT 10",
-            )
-            .map_err(db_err)?;
-        let top_sessions: Vec<(String, usize)> = stmt_top
-            .query_map([], |r: &rusqlite::Row<'_>| {
-                Ok((r.get::<_, String>(0)?, r.get::<_, i64>(1)? as usize))
-            })
-            .map_err(db_err)?
-            .collect::<Result<Vec<_>, _>>()
-            .map_err(db_err)?;
-
-        let (oldest, newest): (Option<DateTime<Utc>>, Option<DateTime<Utc>>) = conn
-            .query_row(
-                "SELECT MIN(ts), MAX(ts) FROM messages",
-                [],
-                |r: &rusqlite::Row<'_>| {
-                    let o: Option<String> = r.get(0)?;
-                    let n: Option<String> = r.get(1)?;
-                    Ok((o.as_deref().map(parse_ts), n.as_deref().map(parse_ts)))
-                },
-            )
-            .unwrap_or((None, None));
-
-        Ok(TranscriptStats {
-            total_sessions,
-            total_messages,
-            total_bytes,
-            by_role,
-            by_agent,
-            top_sessions,
-            oldest,
-            newest,
-        })
-    }
-}
-
-// ---------------------------------------------------------------------------
-// Auto-consolidation, prefix queries, and pattern detection
-// ---------------------------------------------------------------------------
-
-impl SqliteStore {
-    /// Would inserting an edge `source → target` close a cycle in the
-    /// concept graph? BFS from `target` along outgoing edges; if we
-    /// reach `source`, the new edge would form a cycle.
-    ///
-    /// Returns `Ok(false)` for the empty-graph case and bounds the
-    /// search to a depth-limit equal to twice the link count to avoid
-    /// pathological loops on already-corrupt graphs.
-    fn would_create_cycle(&self, source: &str, target: &str) -> IcmResult<bool> {
-        if source == target {
-            return Ok(true);
-        }
-        let mut visited: HashSet<String> = HashSet::new();
-        let mut queue: VecDeque<String> = VecDeque::new();
-        queue.push_back(target.to_string());
-        visited.insert(target.to_string());
-        // Soft cap on traversal — guards against malformed pre-existing
-        // cycles (which shouldn't exist, but the user could have edited
-        // the DB by hand).
-        let cap = 10_000;
-        let mut steps = 0;
-        while let Some(current) = queue.pop_front() {
-            steps += 1;
-            if steps > cap {
-                tracing::warn!(
-                    "would_create_cycle: BFS hit {cap}-step cap while checking {source} → {target}"
-                );
-                break;
-            }
-            for next_link in self.get_links_from(&current)? {
-                if next_link.target_id == source {
-                    return Ok(true);
-                }
-                if visited.insert(next_link.target_id.clone()) {
-                    queue.push_back(next_link.target_id);
-                }
-            }
-        }
-        Ok(false)
-    }
-
-    /// Automatically consolidate a topic if it exceeds the threshold.
-    ///
-    /// Keeps the top 3 summaries (by weight), merges all unique keywords,
-    /// and replaces all memories with a single consolidated memory.
-    /// Returns `true` if consolidation was performed.
-    ///
-    /// Backwards-compatible no-embedder variant. Prefer
-    /// [`auto_consolidate_with_embedder`] for new code so the
-    /// consolidated memory keeps a fresh embedding instead of being
-    /// silently un-recallable via vector search.
-    pub fn auto_consolidate(&self, topic: &str, threshold: usize) -> IcmResult<bool> {
-        self.auto_consolidate_with_embedder(topic, threshold, None)
-    }
-
-    /// Same as [`auto_consolidate`] but also embeds the consolidated
-    /// memory when an embedder is available.
-    ///
-    /// Audit finding M2/AC2: the no-embedder variant produced a
-    /// consolidated memory with `embedding = None`, leaving it
-    /// invisible to hybrid / vector search until a manual `icm embed`
-    /// rebuilt it. With this variant the embedder is invoked inline so
-    /// the consolidated memory is recall-ready as soon as the topic is
-    /// rolled up.
-    pub fn auto_consolidate_with_embedder(
-        &self,
-        topic: &str,
-        threshold: usize,
-        embedder: Option<&dyn Embedder>,
-    ) -> IcmResult<bool> {
-        let count = self.count_by_topic(topic)?;
-        if count < threshold {
-            return Ok(false);
-        }
-
-        let mut memories = self.get_by_topic(topic)?;
-        // `critical` memories are exempt from consolidation (consolidate_topic
-        // won't delete them), so they neither count toward the threshold nor
-        // feed the rollup summary — otherwise a topic holding >= threshold
-        // criticals would re-consolidate on every store, churning forever.
-        memories.retain(|m| !matches!(m.importance, Importance::Critical));
-        if memories.is_empty() || memories.len() < threshold {
-            return Ok(false);
-        }
-
-        // Sort by weight DESC (get_by_topic already does this, but be explicit)
-        memories.sort_by(|a, b| {
-            b.weight
-                .partial_cmp(&a.weight)
-                .unwrap_or(std::cmp::Ordering::Equal)
-        });
-
-        // Take the top 3 summaries for the consolidated summary
-        let top_summaries: Vec<&str> = memories
-            .iter()
-            .take(3)
-            .map(|m| m.summary.as_str())
-            .collect();
-        let mut consolidated_summary = top_summaries.join(" | ");
-        // Three max-size summaries joined can exceed MAX_SUMMARY_BYTES, and
-        // consolidate_topic now validates its input — truncate on a char
-        // boundary so the rollup can't fail its own size check.
-        if consolidated_summary.len() > MAX_SUMMARY_BYTES {
-            let mut cut = MAX_SUMMARY_BYTES;
-            while !consolidated_summary.is_char_boundary(cut) {
-                cut -= 1;
-            }
-            consolidated_summary.truncate(cut);
-        }
-
-        // Merge all unique keywords
-        let mut all_keywords: Vec<String> = Vec::new();
-        let mut seen_keywords: HashSet<String> = HashSet::new();
-        for mem in &memories {
-            for kw in &mem.keywords {
-                let lower = kw.to_lowercase();
-                if seen_keywords.insert(lower) {
-                    all_keywords.push(kw.clone());
-                }
-            }
-        }
-
-        let original_count = memories.len();
-
-        // Build the consolidated memory
-        let mut consolidated = Memory::new(topic.into(), consolidated_summary, Importance::High);
-        consolidated.keywords = all_keywords;
-        consolidated.raw_excerpt =
-            Some(format!("auto-consolidated from {original_count} memories"));
-        consolidated.weight = 1.0;
-
-        // Embed the consolidated content if an embedder is available so
-        // hybrid recall picks it up immediately. Errors are logged and
-        // swallowed — a partial consolidation (no embedding) is still
-        // better than blocking the whole rollup on an embedder hiccup.
-        if let Some(emb) = embedder {
-            match emb.embed(&consolidated.embed_text()) {
-                Ok(vec) => consolidated.embedding = Some(vec),
-                Err(e) => {
-                    tracing::warn!(
-                        "auto-consolidate: embedding failed for topic '{topic}': {e}; \
-                         consolidated memory will lack vector representation"
-                    );
-                }
-            }
-        }
-
-        // Replace all memories in the topic with the consolidated one
-        self.consolidate_topic(topic, consolidated)?;
-
-        Ok(true)
-    }
-
-    /// Graph expansion: given a list of `(Memory, score)` results from a
-    /// primary search, follow each memory's `related_ids` one hop and fetch
-    /// the neighbors that are not already in the result set.
-    ///
-    /// Each neighbor is scored as `parent_score * hop_discount` (default
-    /// 0.5) so it ranks below its direct-match parent but above unrelated
-    /// low-score results. Returns the combined, deduped, score-descending
-    /// list capped at `max_total` (pass `usize::MAX` for no cap).
-    ///
-    /// This is the core of the graph-aware recall feature: it lets the
-    /// recall path surface memories that are semantically or causally
-    /// linked to the query's direct matches, even if they don't match the
-    /// query text themselves.
-    pub fn expand_with_neighbors(
-        &self,
-        initial: &[(Memory, f32)],
-        max_neighbors: usize,
-        hop_discount: f32,
-        max_total: usize,
-    ) -> IcmResult<Vec<(Memory, f32)>> {
-        if max_neighbors == 0 || initial.is_empty() {
-            let mut out = initial.to_vec();
-            out.truncate(max_total);
-            return Ok(out);
-        }
-
-        let initial_ids: HashSet<String> = initial.iter().map(|(m, _)| m.id.clone()).collect();
-
-        // Phase 1 — collect candidate neighbour ids in score-priority order
-        // up to max_neighbors. We track parent scores here so we can apply
-        // the hop discount once memories come back from the batched fetch.
-        let mut candidates: Vec<(String, f32)> = Vec::new();
-        let mut seen: HashSet<String> = HashSet::new();
-        'outer: for (mem, score) in initial {
-            for neighbor_id in &mem.related_ids {
-                if candidates.len() >= max_neighbors {
-                    break 'outer;
-                }
-                if initial_ids.contains(neighbor_id) || !seen.insert(neighbor_id.clone()) {
-                    continue;
-                }
-                candidates.push((neighbor_id.clone(), *score));
-            }
-        }
-
-        // Phase 2 — single batched SELECT instead of N round-trips.
-        let mut neighbors: Vec<(Memory, f32)> = Vec::new();
-        if !candidates.is_empty() {
-            let ids: Vec<&str> = candidates.iter().map(|(id, _)| id.as_str()).collect();
-            let fetched = self.get_many(&ids)?;
-            for (id, parent_score) in candidates {
-                if let Some(m) = fetched.get(&id) {
-                    neighbors.push((m.clone(), parent_score * hop_discount));
-                }
-            }
-        }
-
-        // Merge initial + neighbors, then sort descending by score.
-        let mut combined: Vec<(Memory, f32)> = initial.to_vec();
-        combined.extend(neighbors);
-        combined.sort_by(|a, b| b.1.partial_cmp(&a.1).unwrap_or(std::cmp::Ordering::Equal));
-        combined.truncate(max_total);
-        Ok(combined)
-    }
-
-    /// Fetch many memories by id in one round-trip, deduplicated by id.
-    ///
-    /// Cache-aware: cached entries are served from memory, misses are
-    /// batched into a single `IN (?,?,…)` query. Missing ids are
-    /// silently dropped — callers expecting a strict mapping should
-    /// diff their input vs the returned map.
-    pub fn get_many(&self, ids: &[&str]) -> IcmResult<HashMap<String, Memory>> {
-        if ids.is_empty() {
-            return Ok(HashMap::new());
-        }
-
-        // Dedup so the IN clause gets at most one slot per id.
-        let mut unique: Vec<&str> = Vec::with_capacity(ids.len());
-        let mut seen: HashSet<&str> = HashSet::new();
-        for id in ids {
-            if seen.insert(*id) {
-                unique.push(*id);
-            }
-        }
-
-        // Phase 1 — pull cache hits aside, leaving only true misses for SQL.
-        let mut out: HashMap<String, Memory> = HashMap::with_capacity(unique.len());
-        let mut misses: Vec<&str> = Vec::with_capacity(unique.len());
-        if let Ok(mut cache) = self.cache.lock() {
-            for id in &unique {
-                if let Some(m) = cache.get(*id) {
-                    out.insert((*id).to_string(), m.clone());
-                } else {
-                    misses.push(*id);
-                }
-            }
-        } else {
-            misses.extend_from_slice(&unique);
-        }
-
-        if misses.is_empty() {
-            return Ok(out);
-        }
-
-        // Phase 2 — single batched SELECT for the misses.
-        let placeholders: Vec<String> = (1..=misses.len()).map(|i| format!("?{i}")).collect();
-        let sql = format!(
-            "SELECT {SELECT_COLS} FROM memories WHERE id IN ({})",
-            placeholders.join(", ")
-        );
-
-        let mut stmt = self.conn.prepare(&sql).map_err(db_err)?;
-        let params_vec: Vec<&dyn rusqlite::types::ToSql> = misses
-            .iter()
-            .map(|s| s as &dyn rusqlite::types::ToSql)
-            .collect();
-
-        let rows = stmt
-            .query_map(params_vec.as_slice(), row_to_memory)
-            .map_err(db_err)?;
-
-        let mut fetched: Vec<Memory> = Vec::new();
-        for row in rows {
-            fetched.push(row.map_err(db_err)?);
-        }
-
-        if let Ok(mut cache) = self.cache.lock() {
-            for m in &fetched {
-                cache.put(m.id.clone(), m.clone());
-            }
-        }
-        for m in fetched {
-            out.insert(m.id.clone(), m);
-        }
-        Ok(out)
-    }
-
-    /// Get memories by topic prefix (e.g., "wshm" matches "wshm:owner/repo").
-    ///
-    /// If `topic` ends with `*`, uses LIKE matching. Otherwise exact match.
-    pub fn get_by_topic_prefix(&self, topic: &str) -> IcmResult<Vec<Memory>> {
-        if let Some(prefix) = topic.strip_suffix('*') {
-            let pattern = format!("{prefix}%");
-            let mut stmt = self
-                .conn
-                .prepare(&format!(
-                    "SELECT {SELECT_COLS} FROM memories WHERE topic LIKE ?1 ORDER BY weight DESC LIMIT 500"
-                ))
-                .map_err(db_err)?;
-
-            let rows = stmt
-                .query_map(params![pattern], row_to_memory)
-                .map_err(db_err)?;
-
-            collect_rows(rows)
-        } else {
-            self.get_by_topic(topic)
-        }
-    }
-
-    /// List topics, optionally filtered by a prefix.
-    pub fn list_topics_with_prefix(&self, prefix: Option<&str>) -> IcmResult<Vec<(String, usize)>> {
-        match prefix {
-            Some(p) => {
-                let pattern = format!("{p}%");
-                let mut stmt = self
-                    .conn
-                    .prepare(
-                        "SELECT topic, COUNT(*) FROM memories WHERE topic LIKE ?1 GROUP BY topic ORDER BY topic",
-                    )
-                    .map_err(db_err)?;
-
-                let rows = stmt
-                    .query_map(params![pattern], |row| {
-                        Ok((row.get::<_, String>(0)?, row.get::<_, usize>(1)?))
-                    })
-                    .map_err(db_err)?;
-
-                let mut results = Vec::new();
-                for row in rows {
-                    results.push(row.map_err(db_err)?);
-                }
-                Ok(results)
-            }
-            None => self.list_topics(),
-        }
-    }
-
-    /// Detect recurring patterns in a topic by computing Jaccard similarity on keywords.
-    ///
-    /// Groups memories with keyword similarity > 0.5 into clusters,
-    /// and returns clusters of size >= `min_cluster_size`.
-    pub fn detect_patterns(
-        &self,
-        topic: &str,
-        min_cluster_size: usize,
-    ) -> IcmResult<Vec<PatternCluster>> {
-        let memories = self.get_by_topic(topic)?;
-        if memories.len() < min_cluster_size {
-            return Ok(Vec::new());
-        }
-
-        // Build keyword sets for each memory
-        let keyword_sets: Vec<HashSet<String>> = memories
-            .iter()
-            .map(|m| m.keywords.iter().map(|k| k.to_lowercase()).collect())
-            .collect();
-
-        // Union-Find-style clustering via adjacency
-        let n = memories.len();
-        let mut parent: Vec<usize> = (0..n).collect();
-
-        fn find(parent: &mut [usize], i: usize) -> usize {
-            let mut i = i;
-            while parent[i] != i {
-                parent[i] = parent[parent[i]];
-                i = parent[i];
-            }
-            i
-        }
-
-        fn union(parent: &mut [usize], a: usize, b: usize) {
-            let ra = find(parent, a);
-            let rb = find(parent, b);
-            if ra != rb {
-                parent[ra] = rb;
-            }
-        }
-
-        // Compute Jaccard similarity for each pair, union if > 0.5
-        for i in 0..n {
-            for j in (i + 1)..n {
-                if keyword_sets[i].is_empty() && keyword_sets[j].is_empty() {
-                    continue;
-                }
-                let intersection = keyword_sets[i].intersection(&keyword_sets[j]).count();
-                let union_size = keyword_sets[i].union(&keyword_sets[j]).count();
-                if union_size > 0 {
-                    let jaccard = intersection as f32 / union_size as f32;
-                    if jaccard > 0.5 {
-                        union(&mut parent, i, j);
-                    }
-                }
-            }
-        }
-
-        // Group by cluster root
-        let mut clusters: HashMap<usize, Vec<usize>> = HashMap::new();
-        for i in 0..n {
-            let root = find(&mut parent, i);
-            clusters.entry(root).or_default().push(i);
-        }
-
-        // Build PatternCluster for each group meeting the minimum size
-        let mut result: Vec<PatternCluster> = Vec::new();
-        for indices in clusters.values() {
-            if indices.len() < min_cluster_size {
-                continue;
-            }
-
-            // Representative = the highest-weight memory in the cluster
-            let best_idx = match indices.iter().max_by(|&&a, &&b| {
-                memories[a]
-                    .weight
-                    .partial_cmp(&memories[b].weight)
-                    .unwrap_or(std::cmp::Ordering::Equal)
-            }) {
-                Some(&idx) => idx,
-                None => continue, // empty cluster, skip
-            };
-
-            // Collect all unique keywords from the cluster
-            let mut all_kw: Vec<String> = Vec::new();
-            let mut seen: HashSet<String> = HashSet::new();
-            for &idx in indices {
-                for kw in &memories[idx].keywords {
-                    let lower = kw.to_lowercase();
-                    if seen.insert(lower) {
-                        all_kw.push(kw.clone());
-                    }
-                }
-            }
-
-            result.push(PatternCluster {
-                representative_summary: memories[best_idx].summary.clone(),
-                memory_ids: indices.iter().map(|&i| memories[i].id.clone()).collect(),
-                keywords: all_kw,
-                count: indices.len(),
-            });
-        }
-
-        // Sort by cluster size descending
-        result.sort_by_key(|b| std::cmp::Reverse(b.count));
-
-        Ok(result)
-    }
-
-    /// Extract a pattern cluster as a concept in a memoir.
-    ///
-    /// Creates a Concept with:
-    /// - name derived from common keywords
-    /// - definition = combined summary of the cluster
-    /// - source_memory_ids = memory IDs in the cluster
-    /// - confidence = 0.5 + (count * 0.05) capped at 0.9
-    /// - labels = common keywords as labels
-    pub fn extract_pattern_as_concept(
-        &self,
-        cluster: &PatternCluster,
-        memoir_id: &str,
-    ) -> IcmResult<String> {
-        // Derive concept name from top keywords
-        let concept_name = if cluster.keywords.is_empty() {
-            format!("pattern-{}", &cluster.memory_ids[0][..8])
-        } else {
-            cluster
-                .keywords
-                .iter()
-                .take(3)
-                .cloned()
-                .collect::<Vec<_>>()
-                .join("-")
-        };
-
-        // Build definition from cluster representative + count
-        let definition = format!(
-            "{} (pattern detected across {} memories)",
-            cluster.representative_summary, cluster.count
-        );
-
-        let mut concept = Concept::new(memoir_id.into(), concept_name, definition);
-        concept.source_memory_ids = cluster.memory_ids.clone();
-        concept.confidence = (0.5 + cluster.count as f32 * 0.05).min(0.9);
-        concept.labels = cluster
-            .keywords
-            .iter()
-            .take(5)
-            .map(|kw| Label::new("pattern", kw.as_str()))
-            .collect();
-
-        self.add_concept(concept)
-    }
-}
-
-// ---------------------------------------------------------------------------
-// Test helpers (visible to other modules in crate for test use)
-// ---------------------------------------------------------------------------
-
-#[cfg(test)]
-pub(crate) mod test_helpers {
-    use super::ensure_sqlite_vec;
-
-    pub fn ensure_vec_init() {
-        ensure_sqlite_vec();
-    }
-}
-
-// ---------------------------------------------------------------------------
-// Tests
-// ---------------------------------------------------------------------------
-
-#[cfg(test)]
-mod tests {
-    use super::*;
-    use icm_core::Importance;
-
-    fn test_store() -> SqliteStore {
-        SqliteStore::in_memory().unwrap()
-    }
-
-    fn make_memory(topic: &str, summary: &str) -> Memory {
-        Memory::new(topic.into(), summary.into(), Importance::Medium)
-    }
-
-    fn make_memoir(name: &str) -> Memoir {
-        Memoir::new(name.into(), format!("Description for {name}"))
-    }
-
-    fn make_concept(memoir_id: &str, name: &str, definition: &str) -> Concept {
-        Concept::new(memoir_id.into(), name.into(), definition.into())
-    }
-
-    // === Integrity check / repair (issue #313) ===
-
-    #[test]
-    fn integrity_check_ok_on_healthy_db() {
-        let store = test_store();
-        store.store(make_memory("t", "healthy row")).unwrap();
-        assert_eq!(store.integrity_check().unwrap(), vec!["ok".to_string()]);
-    }
-
-    #[test]
-    fn integrity_check_structural_works_on_a_read_only_connection() {
-        // #313 follow-up: `icm doctor` / `repair --dry-run` must inspect a DB
-        // without a writable open. The structural check runs `PRAGMA
-        // integrity_check` only (no FTS INSERT), so it works read-only.
-        let dir = tempfile::tempdir().unwrap();
-        let path = dir.path().join("ro.db");
-        let _ = seed_writable_db(&path);
-
-        let ro = SqliteStore::open_readonly(&path).unwrap();
-        assert!(ro.is_readonly());
-        // Read-only structural check succeeds and reports healthy.
-        assert_eq!(
-            ro.integrity_check_structural().unwrap(),
-            vec!["ok".to_string()]
-        );
-        // The full check issues an FTS `INSERT` a read-only connection can't
-        // run, so it degrades to reporting that as a problem — which is exactly
-        // why the read-only inspection paths use the structural variant.
-        assert_ne!(ro.integrity_check().unwrap(), vec!["ok".to_string()]);
-    }
-
-    #[test]
-    fn rebuild_search_indexes_lists_fts_tables_and_keeps_integrity() {
-        let store = test_store();
-        store.store(make_memory("t", "a row to index")).unwrap();
-        let rebuilt = store.rebuild_search_indexes().unwrap();
-        // memories_fts always exists; the concepts/feedback/messages FTS
-        // tables are created by schema init too.
-        assert!(
-            rebuilt.contains(&"memories_fts".to_string()),
-            "got: {rebuilt:?}"
-        );
-        assert_eq!(store.integrity_check().unwrap(), vec!["ok".to_string()]);
-    }
-
-    #[test]
-    fn rebuild_search_indexes_regenerates_fts_from_content() {
-        // The core repair mechanism (#313): rebuilding must reconstruct the
-        // FTS index from the intact content table. Deterministically wipe the
-        // FTS index (the "index damaged, base table intact" class) and prove
-        // rebuild restores searchability.
-        let store = test_store();
-        store
-            .store(make_memory("t", "singulartoken repairable"))
-            .unwrap();
-
-        let fts_hits = |s: &SqliteStore| -> i64 {
-            s.conn
-                .query_row(
-                    "SELECT COUNT(*) FROM memories_fts WHERE memories_fts MATCH 'singulartoken'",
-                    [],
-                    |r| r.get(0),
-                )
-                .unwrap()
-        };
-        assert_eq!(fts_hits(&store), 1, "token should be indexed after store");
-
-        // Wipe the FTS index while leaving the content row in `memories`.
-        store
-            .conn
-            .execute_batch("INSERT INTO memories_fts(memories_fts) VALUES('delete-all');")
-            .unwrap();
-        assert_eq!(fts_hits(&store), 0, "index wiped → no FTS hit");
-
-        // integrity_check (rank=1 content check) must flag the desync so that
-        // `icm repair` actually triggers on it rather than reporting healthy.
-        assert_ne!(
-            store.integrity_check().unwrap(),
-            vec!["ok".to_string()],
-            "index/content desync must be detected"
-        );
-
-        store.rebuild_search_indexes().unwrap();
-        assert_eq!(fts_hits(&store), 1, "rebuild must regenerate the FTS index");
-        assert_eq!(store.integrity_check().unwrap(), vec!["ok".to_string()]);
-    }
-
-    #[test]
-    fn open_maintenance_errors_on_missing_file() {
-        let dir = tempfile::tempdir().unwrap();
-        let path = dir.path().join("absent.db");
-        match SqliteStore::open_maintenance(&path) {
-            Ok(_) => panic!("open_maintenance on missing file must error"),
-            Err(IcmError::NotFound(_)) => {}
-            Err(other) => panic!("expected NotFound, got {other:?}"),
-        }
-    }
-
-    #[test]
-    fn open_maintenance_opens_existing_db_writable() {
-        let dir = tempfile::tempdir().unwrap();
-        let path = dir.path().join("seeded.db");
-        let _ = seed_writable_db(&path);
-        let store = SqliteStore::open_maintenance(&path).unwrap();
-        assert!(!store.is_readonly());
-        assert_eq!(store.integrity_check().unwrap(), vec!["ok".to_string()]);
-    }
-
-    // === Read-only store (issue #263) ===
-
-    fn seed_writable_db(path: &Path) -> Memory {
-        let store = SqliteStore::new(path).unwrap();
-        let mut m = make_memory("project:icm", "read-only fixture summary");
-        m.embedding = Some(vec![0.1_f32; icm_core::DEFAULT_EMBEDDING_DIMS]);
-        store.store(m.clone()).unwrap();
-        m
-    }
-
-    #[test]
-    fn open_readonly_errors_on_missing_file() {
-        let dir = tempfile::tempdir().unwrap();
-        let path = dir.path().join("absent.db");
-        match SqliteStore::open_readonly(&path) {
-            Ok(_) => panic!("open_readonly on missing file must error"),
-            Err(IcmError::NotFound(msg)) => {
-                assert!(msg.contains("absent.db"), "msg: {msg}")
-            }
-            Err(other) => panic!("expected NotFound, got {other:?}"),
-        }
-    }
-
-    #[test]
-    fn open_readonly_can_read_existing_db() {
-        let dir = tempfile::tempdir().unwrap();
-        let path = dir.path().join("seeded.db");
-        let seeded = seed_writable_db(&path);
-
-        let ro = SqliteStore::open_readonly(&path).unwrap();
-        assert!(ro.is_readonly());
-
-        // Read by id: must return the seeded memory verbatim.
-        let got = ro.get(&seeded.id).unwrap().expect("memory must be present");
-        assert_eq!(got.topic, "project:icm");
-        assert_eq!(got.summary, "read-only fixture summary");
-    }
-
-    #[test]
-    fn read_only_connection_sees_writes_committed_after_open() {
-        // #319: a long-lived `--read-only serve` connection must observe
-        // writes that hooks/CLI commit to the same DB *after* the server
-        // opened. The old `immutable=1` open served a permanently stale
-        // snapshot (and eventually spurious "database disk image is malformed"
-        // on a healthy DB).
-        let dir = tempfile::tempdir().unwrap();
-        let path = dir.path().join("live.db");
-        let _ = seed_writable_db(&path); // 1 memory, WAL mode
-
-        let ro = SqliteStore::open_readonly(&path).unwrap();
-        assert_eq!(ro.count().unwrap(), 1);
-
-        // A separate writer commits a new memory to the same file.
-        {
-            let rw = SqliteStore::new(&path).unwrap();
-            let mut m = make_memory("project:icm", "written after the reader opened");
-            m.embedding = Some(vec![0.2_f32; icm_core::DEFAULT_EMBEDDING_DIMS]);
-            rw.store(m).unwrap();
-        }
-
-        // The already-open read-only connection must now see it.
-        assert_eq!(
-            ro.count().unwrap(),
-            2,
-            "read-only connection must see writes committed after it opened"
-        );
-    }
-
-    #[cfg(unix)]
-    #[test]
-    fn open_readonly_falls_back_to_immutable_on_unwritable_dir() {
-        // #263 must keep working after #319: on a `chmod -w` parent directory
-        // the live `mode=ro` open can't create the `-shm` sidecar for a WAL
-        // DB, so open_readonly must fall back to `immutable=1` and still read.
-        use std::os::unix::fs::PermissionsExt;
-        let dir = tempfile::tempdir().unwrap();
-        let path = dir.path().join("sandboxed.db");
-        let seeded = seed_writable_db(&path);
-        // Keep the DB in WAL mode (that's what forces the -shm requirement)
-        // but fold all rows into the main file and drop the sidecars, so a
-        // fresh read-only open must recreate -shm — which fails in a
-        // read-only dir. (A DELETE-mode DB would open fine via plain mode=ro
-        // and never exercise the fallback.)
-        {
-            let rw = SqliteStore::new(&path).unwrap();
-            rw.conn
-                .execute_batch("PRAGMA wal_checkpoint(TRUNCATE);")
-                .unwrap();
-        }
-        for ext in ["-wal", "-shm"] {
-            let mut side = path.as_os_str().to_os_string();
-            side.push(ext);
-            let _ = std::fs::remove_file(std::path::PathBuf::from(side));
-        }
-
-        let original = std::fs::metadata(dir.path()).unwrap().permissions();
-        std::fs::set_permissions(dir.path(), std::fs::Permissions::from_mode(0o555)).unwrap();
-
-        // Guard: confirm the live `mode=ro` path is genuinely unusable here,
-        // otherwise this test would pass without ever exercising the fallback.
-        let live_reads = match open_readonly_uri(&path, false) {
-            Ok(conn) => conn
-                .query_row("SELECT count(*) FROM sqlite_master", [], |_| Ok(()))
-                .is_ok(),
-            Err(_) => false,
-        };
-        // The public open_readonly must still succeed via the immutable fallback.
-        let opened = SqliteStore::open_readonly(&path);
-
-        // Restore permissions before asserting so tempdir cleanup succeeds.
-        std::fs::set_permissions(dir.path(), original).unwrap();
-
-        assert!(
-            !live_reads,
-            "sandbox setup must make the live mode=ro path unusable, else the fallback isn't tested"
-        );
-        let ro = opened.expect("read-only open must fall back to immutable on a chmod -w dir");
-        let got = ro
-            .get(&seeded.id)
-            .unwrap()
-            .expect("memory must be readable");
-        assert_eq!(got.topic, "project:icm");
-    }
-
-    #[test]
-    fn read_only_recall_path_skips_access_bookkeeping() {
-        let dir = tempfile::tempdir().unwrap();
-        let path = dir.path().join("seeded.db");
-        let seeded = seed_writable_db(&path);
-
-        let ro = SqliteStore::open_readonly(&path).unwrap();
-        // The exact methods recall depends on:
-        ro.maybe_auto_decay().unwrap();
-        ro.update_access(&seeded.id).unwrap();
-        ro.batch_update_access(&[&seeded.id]).unwrap();
-
-        // Re-open writable to confirm nothing actually changed.
-        let rw = SqliteStore::new(&path).unwrap();
-        let after = rw.get(&seeded.id).unwrap().unwrap();
-        assert_eq!(
-            after.access_count, seeded.access_count,
-            "access_count must NOT have been bumped by a read-only call",
-        );
-        assert_eq!(
-            after.last_accessed, seeded.last_accessed,
-            "last_accessed must NOT have been touched by a read-only call",
-        );
-    }
-
-    #[test]
-    fn read_only_apply_decay_returns_readonly_error() {
-        let dir = tempfile::tempdir().unwrap();
-        let path = dir.path().join("seeded.db");
-        seed_writable_db(&path);
-        let ro = SqliteStore::open_readonly(&path).unwrap();
-        let err = ro.apply_decay(0.9).unwrap_err();
-        match err {
-            IcmError::ReadOnly(op) => assert_eq!(op, "apply_decay"),
-            other => panic!("expected ReadOnly, got {other:?}"),
-        }
-    }
-
-    #[test]
-    fn read_only_mutation_attempts_are_rejected_by_sqlite() {
-        // Defense-in-depth: even mutation methods that aren't explicitly
-        // gated must fail because the SQLite connection itself is
-        // opened RO. If this test ever passes, SQLite's RO flag has
-        // been bypassed somewhere.
-        let dir = tempfile::tempdir().unwrap();
-        let path = dir.path().join("seeded.db");
-        seed_writable_db(&path);
-        let ro = SqliteStore::open_readonly(&path).unwrap();
-        let m = make_memory("project:icm", "should not land");
-        let err = ro.store(m).unwrap_err();
-        // SQLite's own "attempt to write a readonly database" wraps into
-        // IcmError::Database — the actual variant doesn't matter, only
-        // that the write was blocked.
-        match err {
-            IcmError::Database(_) | IcmError::ReadOnly(_) => {}
-            other => panic!("expected Database or ReadOnly, got {other:?}"),
-        }
-    }
-
-    // === Embedding dim peek (issue #267) ===
-
-    /// `read_stored_embedding_dims` must NOT trigger schema init: it is
-    /// called from the CLI *before* `with_dims` precisely to avoid the
-    /// destructive recreate path when running in `--no-embeddings`
-    /// against a DB that was populated with a non-default dim.
-    #[test]
-    fn read_stored_dims_returns_none_for_missing_file() {
-        let dir = tempfile::tempdir().unwrap();
-        let path = dir.path().join("does-not-exist.db");
-        assert_eq!(
-            SqliteStore::read_stored_embedding_dims(&path).unwrap(),
-            None
-        );
-    }
-
-    #[test]
-    fn read_stored_dims_returns_none_for_legacy_db_without_metadata() {
-        let dir = tempfile::tempdir().unwrap();
-        let path = dir.path().join("legacy.db");
-        // Plain SQLite file with no icm_metadata table — pretends to be a
-        // pre-metadata legacy DB.
-        let conn = Connection::open(&path).unwrap();
-        conn.execute("CREATE TABLE foo (id TEXT)", []).unwrap();
-        drop(conn);
-        assert_eq!(
-            SqliteStore::read_stored_embedding_dims(&path).unwrap(),
-            None
-        );
-    }
-
-    #[test]
-    fn read_stored_dims_returns_stored_value_for_populated_db() {
-        let dir = tempfile::tempdir().unwrap();
-        let path = dir.path().join("populated.db");
-        // Build a DB at 1024 dims (representative of multilingual-e5-large).
-        let store = SqliteStore::with_dims(&path, 1024).unwrap();
-        drop(store);
-
-        assert_eq!(
-            SqliteStore::read_stored_embedding_dims(&path).unwrap(),
-            Some(1024),
-            "should return the stored dim, not the default 384",
-        );
-    }
-
-    /// Issue #267 regression: opening the store at the *stored* dim
-    /// (the path the CLI now takes when no embedder is loaded) must
-    /// leave `vec_memories` and the `embedding` blobs intact. Before
-    /// the fix the CLI passed `DEFAULT_EMBEDDING_DIMS` instead and the
-    /// `stored != requested` branch of `init_db_with_dims` would
-    /// silently DROP `vec_memories` + NULL out every embedding.
-    #[test]
-    fn opening_at_stored_dims_preserves_vectors() {
-        let dir = tempfile::tempdir().unwrap();
-        let path = dir.path().join("preserve.db");
-
-        // First open: build the DB at 1024 dims and seed a memory with a
-        // matching embedding.
-        {
-            let store = SqliteStore::with_dims(&path, 1024).unwrap();
-            let mut mem = make_memory("topic-1024", "user prefers e5-large");
-            mem.embedding = Some(vec![0.5_f32; 1024]);
-            store.store(mem.clone()).unwrap();
-        }
-
-        // CLI-side resolution: peek the stored dims, then reopen at
-        // exactly that value (the fix path).
-        let stored = SqliteStore::read_stored_embedding_dims(&path)
-            .unwrap()
-            .expect("stored dim must be readable on populated DB");
-        assert_eq!(stored, 1024);
-
-        let store = SqliteStore::with_dims(&path, stored).unwrap();
-        // Vec table still exists with the original dim.
-        let dim_str: String = store
-            .conn
-            .query_row(
-                "SELECT value FROM icm_metadata WHERE key = 'embedding_dims'",
-                [],
-                |row| row.get(0),
-            )
-            .unwrap();
-        assert_eq!(dim_str, "1024");
-
-        // The seeded memory's embedding still has the original 1024
-        // floats — the destructive migration did NOT run.
-        let kept_bytes: Option<i64> = store
-            .conn
-            .query_row(
-                "SELECT length(embedding) FROM memories WHERE topic = 'topic-1024'",
-                [],
-                |row| row.get(0),
-            )
-            .unwrap();
-        assert_eq!(
-            kept_bytes,
-            Some(1024 * 4),
-            "embedding blob must NOT have been NULLed by the open path",
-        );
-    }
-
-    // === MemoryStore tests ===
-
-    #[test]
-    fn test_store_and_get() {
-        let store = test_store();
-        let mem = make_memory("test", "hello world");
-        let id = mem.id.clone();
-
-        store.store(mem).unwrap();
-        let retrieved = store.get(&id).unwrap().unwrap();
-        assert_eq!(retrieved.summary, "hello world");
-        assert_eq!(retrieved.topic, "test");
-    }
-
-    #[test]
-    fn test_get_not_found() {
-        let store = test_store();
-        let result = store.get("nonexistent").unwrap();
-        assert!(result.is_none());
-    }
-
-    #[test]
-    fn test_update() {
-        let store = test_store();
-        let mut mem = make_memory("test", "original");
-        let id = mem.id.clone();
-        store.store(mem.clone()).unwrap();
-
-        mem.summary = "updated".into();
-        store.update(&mem).unwrap();
-
-        let retrieved = store.get(&id).unwrap().unwrap();
-        assert_eq!(retrieved.summary, "updated");
-    }
-
-    #[test]
-    fn test_delete() {
-        let store = test_store();
-        let mem = make_memory("test", "to delete");
-        let id = mem.id.clone();
-        store.store(mem).unwrap();
-
-        store.delete(&id).unwrap();
-        assert!(store.get(&id).unwrap().is_none());
-    }
-
-    #[test]
-    fn test_delete_not_found() {
-        let store = test_store();
-        let result = store.delete("nonexistent");
-        assert!(matches!(result, Err(IcmError::NotFound(_))));
-    }
-
-    /// Manual-testing finding: deleting a memory left it as a dangling
-    /// entry in every other memory's `related_ids` (auto-link
-    /// back-references) forever. `expand_with_neighbors` tolerates the
-    /// miss silently, but each stale id still spends a slot out of the
-    /// caller's `max_neighbors` budget instead of surfacing a real, live
-    /// neighbor, and any external consumer of the JSON export sees a
-    /// reference to nothing.
-    #[test]
-    fn test_delete_cleans_up_dangling_related_ids() {
-        let store = test_store();
-
-        let mut a = make_memory("t", "memory a");
-        let mut b = make_memory("t", "memory b");
-        let mut c = make_memory("t", "memory c");
-        let a_id = store.store(a.clone()).unwrap();
-        let b_id = store.store(b.clone()).unwrap();
-        let c_id = store.store(c.clone()).unwrap();
-
-        a.id = a_id.clone();
-        a.related_ids = vec![b_id.clone(), c_id.clone()];
-        store.update(&a).unwrap();
-        b.id = b_id.clone();
-        b.related_ids = vec![a_id.clone(), c_id.clone()];
-        store.update(&b).unwrap();
-        c.id = c_id.clone();
-        c.related_ids = vec![a_id.clone(), b_id.clone()];
-        store.update(&c).unwrap();
-
-        store.delete(&a_id).unwrap();
-
-        let b_after = store.get(&b_id).unwrap().unwrap();
-        assert_eq!(
-            b_after.related_ids,
-            vec![c_id.clone()],
-            "b's related_ids must no longer reference the deleted a"
-        );
-        let c_after = store.get(&c_id).unwrap().unwrap();
-        assert_eq!(
-            c_after.related_ids,
-            vec![b_id.clone()],
-            "c's related_ids must no longer reference the deleted a"
-        );
-    }
-
-    #[test]
-    fn test_search_fts() {
-        let store = test_store();
-        store
-            .store(make_memory(
-                "rust",
-                "Rust is a systems programming language",
-            ))
-            .unwrap();
-        store
-            .store(make_memory("python", "Python is great for scripting"))
-            .unwrap();
-
-        let results = store.search_fts("rust programming", 10).unwrap();
-        assert_eq!(results.len(), 1);
-        assert_eq!(results[0].topic, "rust");
-    }
-
-    #[test]
-    fn test_search_by_keywords() {
-        let store = test_store();
-        let mut mem = make_memory("test", "database optimization tips");
-        mem.keywords = vec!["database".into(), "optimization".into()];
-        store.store(mem).unwrap();
-
-        let results = store.search_by_keywords(&["database"], 10).unwrap();
-        assert_eq!(results.len(), 1);
-    }
-
-    #[test]
-    fn test_list_topics() {
-        let store = test_store();
-        store.store(make_memory("alpha", "first")).unwrap();
-        store.store(make_memory("alpha", "second")).unwrap();
-        store.store(make_memory("beta", "third")).unwrap();
-
-        let topics = store.list_topics().unwrap();
-        assert_eq!(topics.len(), 2);
-        assert!(topics.contains(&("alpha".into(), 2)));
-        assert!(topics.contains(&("beta".into(), 1)));
-    }
-
-    #[test]
-    fn test_restore_upgrades_importance_on_dedup() {
-        // Audit #185 H2: re-storing the same content with a higher
-        // importance must upgrade the existing row, not silently
-        // drop the new value.
-        let store = test_store();
-        let mut first = make_memory("topic", "long enough summary content for storage");
-        first.importance = Importance::Medium;
-        let id1 = store.store(first).unwrap();
-
-        let mut second = make_memory("topic", "long enough summary content for storage");
-        second.importance = Importance::Critical;
-        let id2 = store.store(second).unwrap();
-        assert_eq!(id1, id2, "dedup must return the same id");
-
-        let merged = store.get(&id1).unwrap().unwrap();
-        assert_eq!(
-            merged.importance,
-            Importance::Critical,
-            "re-store with higher priority must upgrade importance"
-        );
-    }
-
-    #[test]
-    fn test_restore_does_not_downgrade_importance_on_dedup() {
-        // Sanity: a re-store with a lower priority is a no-op so an
-        // accidental write can't downgrade an already-flagged
-        // critical memory.
-        let store = test_store();
-        let mut first = make_memory("topic", "long enough summary content for storage");
-        first.importance = Importance::Critical;
-        let id1 = store.store(first).unwrap();
-
-        let mut second = make_memory("topic", "long enough summary content for storage");
-        second.importance = Importance::Low;
-        store.store(second).unwrap();
-
-        let preserved = store.get(&id1).unwrap().unwrap();
-        assert_eq!(
-            preserved.importance,
-            Importance::Critical,
-            "re-store with lower priority must not downgrade importance"
-        );
-    }
-
-    #[test]
-    fn test_restore_unions_keywords_on_dedup() {
-        let store = test_store();
-        let mut first = make_memory("topic", "long enough summary content for storage");
-        first.keywords = vec!["alpha".into(), "beta".into()];
-        let id1 = store.store(first).unwrap();
-
-        let mut second = make_memory("topic", "long enough summary content for storage");
-        second.keywords = vec!["beta".into(), "gamma".into()];
-        store.store(second).unwrap();
-
-        let merged = store.get(&id1).unwrap().unwrap();
-        assert_eq!(
-            merged.keywords,
-            vec!["alpha".to_string(), "beta".to_string(), "gamma".to_string(),],
-            "keywords must be unioned and deduped, preserving existing order"
-        );
-    }
-
-    #[test]
-    fn test_restore_sets_raw_excerpt_when_previously_none() {
-        let store = test_store();
-        let first = make_memory("topic", "long enough summary content for storage");
-        let id1 = store.store(first).unwrap();
-        assert!(store.get(&id1).unwrap().unwrap().raw_excerpt.is_none());
-
-        let mut second = make_memory("topic", "long enough summary content for storage");
-        second.raw_excerpt = Some("verbatim copy from source".into());
-        store.store(second).unwrap();
-
-        let merged = store.get(&id1).unwrap().unwrap();
-        assert_eq!(
-            merged.raw_excerpt.as_deref(),
-            Some("verbatim copy from source"),
-        );
-    }
-
-    #[test]
-    fn test_restore_keeps_existing_raw_excerpt_when_new_is_none() {
-        let store = test_store();
-        let mut first = make_memory("topic", "long enough summary content for storage");
-        first.raw_excerpt = Some("important verbatim".into());
-        let id1 = store.store(first).unwrap();
-
-        let second = make_memory("topic", "long enough summary content for storage");
-        store.store(second).unwrap();
-
-        let preserved = store.get(&id1).unwrap().unwrap();
-        assert_eq!(
-            preserved.raw_excerpt.as_deref(),
-            Some("important verbatim"),
-            "re-store with None must not erase existing raw_excerpt"
-        );
-    }
-
-    #[test]
-    fn test_restore_unchanged_metadata_is_noop() {
-        let store = test_store();
-        let mut first = make_memory("topic", "long enough summary content for storage");
-        first.importance = Importance::High;
-        first.keywords = vec!["alpha".into()];
-        let id1 = store.store(first.clone()).unwrap();
-        let original = store.get(&id1).unwrap().unwrap();
-
-        std::thread::sleep(std::time::Duration::from_millis(10));
-        store.store(first).unwrap();
-        let after = store.get(&id1).unwrap().unwrap();
-
-        assert_eq!(
-            original.updated_at, after.updated_at,
-            "no-op re-store must not bump updated_at"
-        );
-    }
-
-    #[test]
-    fn test_apply_decay() {
-        let store = test_store();
-        store.store(make_memory("test", "decayable")).unwrap();
-
-        let mut critical = make_memory("test", "critical memory");
-        critical.importance = Importance::Critical;
-        store.store(critical).unwrap();
-
-        let affected = store.apply_decay(0.9).unwrap();
-        assert_eq!(affected, 1); // Only the non-critical one
-    }
-
-    /// Audit regression: `apply_decay` must never drive weight negative.
-    /// Low importance (2x multiplier), zero access count, factor=0.4 (still
-    /// inside the CLI's own `[0.0, 1.0)` validation) makes the raw
-    /// multiplier `1.0 - (1.0-0.4)*2.0 = -0.2` — negative before the
-    /// `MAX(0.0, ...)` clamp.
-    #[test]
-    fn test_apply_decay_never_goes_negative() {
-        let store = test_store();
-        let mut low = make_memory("t", "low importance, never accessed");
-        low.importance = Importance::Low;
-        store.store(low).unwrap();
-
-        store.apply_decay(0.4).unwrap();
-
-        let mem = store.get_by_topic("t").unwrap().into_iter().next().unwrap();
-        assert!(
-            mem.weight >= 0.0,
-            "weight must never go negative, got {}",
-            mem.weight
-        );
-    }
-
-    /// Audit regression: `maybe_auto_decay` used to apply a flat 0.95 step
-    /// whenever >= 1 day had passed, regardless of how many days actually
-    /// elapsed. Simulate a 5-day gap (by backdating `last_decay_at`
-    /// directly) and assert the applied decay compounds to ~0.95^5, not a
-    /// single 0.95 step.
-    #[test]
-    fn test_maybe_auto_decay_scales_with_elapsed_days() {
-        let store = test_store();
-        let mut mem = make_memory("t", "elapsed-days probe");
-        mem.importance = Importance::Medium;
-        store.store(mem).unwrap();
-
-        let five_days_ago = (Utc::now() - chrono::Duration::days(5)).to_rfc3339();
-        store
-            .conn
-            .execute(
-                "INSERT INTO icm_metadata (key, value) VALUES ('last_decay_at', ?1)",
-                params![five_days_ago],
-            )
-            .unwrap();
-
-        store.maybe_auto_decay().unwrap();
-
-        let after = store.get_by_topic("t").unwrap().into_iter().next().unwrap();
-        // Medium importance, access_count=0 -> multiplier = factor directly.
-        let expected_single_step = 0.95_f32;
-        let expected_five_days = 0.95_f32.powi(5);
-        assert!(
-            (after.weight - expected_five_days).abs() < 0.01,
-            "expected weight ~{expected_five_days} (0.95^5) for a 5-day gap, got {}",
-            after.weight
-        );
-        assert!(
-            after.weight < expected_single_step - 0.05,
-            "a 5-day gap must decay more than a single flat 0.95 step \
-             (got {}, single-step would be {expected_single_step})",
-            after.weight
-        );
-    }
-
-    #[test]
-    fn test_apply_decay_caps_access_count_amplification() {
-        // Audit #185 H7: the pre-fix decay formula had an uncapped
-        // `1 + access_count * 0.1` term, which let memories with 100+
-        // accesses become effectively decay-immune. Repro the gaming
-        // and assert the capped formula prevents it.
-        //
-        // After 5 decay rounds at factor=0.8:
-        // - real (access=0): naively 0.95 ^ 5 ≈ 0.77 → with importance
-        //   medium and the capped slowdown, weight should drop to
-        //   roughly 0.5×.
-        // - junk (access=100): pre-fix it stayed near 0.95 (no decay
-        //   amplification immune); post-fix it's capped at 5 accesses
-        //   so it decays at the same rate as a memory with 5 accesses.
-        // The exact ratio depends on the cap; the crucial property is
-        // that after enough decay rounds, junk's weight no longer
-        // exceeds real's weight. We assert that property directly
-        // rather than pinning specific weight numbers.
-        let store = test_store();
-
-        let mut real = make_memory("topic", "real high-importance fact");
-        real.importance = Importance::Medium;
-        let real_id = store.store(real).unwrap();
-
-        let mut junk = make_memory("topic", "junk fact accessed by gaming loop");
-        junk.importance = Importance::Medium;
-        let junk_id = store.store(junk).unwrap();
-
-        // Inflate junk's access_count to 100 (the M01 reproduction).
-        store
-            .conn
-            .execute(
-                "UPDATE memories SET access_count = 100 WHERE id = ?1",
-                params![junk_id],
-            )
-            .unwrap();
-
-        // 5 aggressive decay rounds.
-        for _ in 0..5 {
-            store.apply_decay(0.8).unwrap();
-        }
-
-        let real_after = store.get(&real_id).unwrap().unwrap();
-        let junk_after = store.get(&junk_id).unwrap().unwrap();
-
-        // Pre-fix: junk weight ≈ 0.95, real weight ≈ 0.31 → junk dominates.
-        // Post-fix: with the cap, junk decays meaningfully even at
-        // access=100. We require junk weight < real weight + a small
-        // headroom — the cap must not let a low-relevance, frequently-
-        // accessed memory overtake real same-importance memories.
-        assert!(
-            junk_after.weight < real_after.weight * 1.6,
-            "junk weight {} must not dominate real weight {} after 5 decay rounds (cap is broken)",
-            junk_after.weight,
-            real_after.weight,
-        );
-
-        // Sanity: junk did still decay measurably (cap didn't make it
-        // permanent).
-        assert!(
-            junk_after.weight < 0.97,
-            "junk weight {} barely decayed at all (cap is too aggressive a slowdown)",
-            junk_after.weight,
-        );
-    }
-
-    #[test]
-    fn test_prune() {
-        let store = test_store();
-        let mut low = make_memory("test", "low weight");
-        low.weight = 0.05;
-        store.store(low).unwrap();
-
-        store.store(make_memory("test", "normal weight")).unwrap();
-
-        let pruned = store.prune(0.1).unwrap();
-        assert_eq!(pruned, 1);
-        assert_eq!(store.count().unwrap(), 1);
-    }
-
-    #[test]
-    fn test_stats() {
-        let store = test_store();
-        store.store(make_memory("a", "first")).unwrap();
-        store.store(make_memory("b", "second")).unwrap();
-
-        let stats = store.stats().unwrap();
-        assert_eq!(stats.total_memories, 2);
-        assert_eq!(stats.total_topics, 2);
-        assert!(stats.avg_weight > 0.0);
-        assert!(stats.oldest_memory.is_some());
-        assert!(stats.newest_memory.is_some());
-    }
-
-    #[test]
-    fn test_update_access() {
-        let store = test_store();
-        let mem = make_memory("test", "access test");
-        let id = mem.id.clone();
-        store.store(mem).unwrap();
-
-        store.update_access(&id).unwrap();
-        let retrieved = store.get(&id).unwrap().unwrap();
-        assert_eq!(retrieved.access_count, 1);
-    }
-
-    #[test]
-    fn test_consolidate_topic() {
-        let store = test_store();
-        store.store(make_memory("topic-a", "entry 1")).unwrap();
-        store.store(make_memory("topic-a", "entry 2")).unwrap();
-        store.store(make_memory("topic-b", "other")).unwrap();
-
-        let consolidated = make_memory("topic-a", "consolidated summary");
-        store.consolidate_topic("topic-a", consolidated).unwrap();
-
-        let memories = store.get_by_topic("topic-a").unwrap();
-        assert_eq!(memories.len(), 1);
-        assert_eq!(memories[0].summary, "consolidated summary");
-
-        // topic-b should be untouched
-        assert_eq!(store.get_by_topic("topic-b").unwrap().len(), 1);
-    }
-
-    /// Audit regression: consolidation must honor the "critical = never
-    /// forget" contract that `apply_decay` and `prune` already respect.
-    #[test]
-    fn consolidate_topic_preserves_critical_memories() {
-        let store = test_store();
-        store.store(make_memory("t", "expendable 1")).unwrap();
-        store.store(make_memory("t", "expendable 2")).unwrap();
-        store
-            .store(Memory::new(
-                "t".into(),
-                "never forget this".into(),
-                Importance::Critical,
-            ))
-            .unwrap();
-
-        store
-            .consolidate_topic("t", make_memory("t", "rollup"))
-            .unwrap();
-
-        let after = store.get_by_topic("t").unwrap();
-        let summaries: Vec<&str> = after.iter().map(|m| m.summary.as_str()).collect();
-        assert_eq!(after.len(), 2, "critical + consolidated must both survive");
-        assert!(summaries.contains(&"never forget this"));
-        assert!(summaries.contains(&"rollup"));
-        assert!(!summaries.contains(&"expendable 1"));
-    }
-
-    /// Manual-testing finding: consolidate_topic bulk-deletes the topic's
-    /// non-critical memories and does its own DELETE, entirely separate
-    /// from the single-id `delete()` — so it had the same dangling
-    /// related_ids bug in a second place. An external memory (in a
-    /// different topic) that referenced one of the consolidated-away ids
-    /// must have that reference cleaned up too.
-    #[test]
-    fn consolidate_topic_cleans_up_dangling_related_ids_in_other_memories() {
-        let store = test_store();
-        let a_id = store.store(make_memory("t", "memory a")).unwrap();
-        let b_id = store.store(make_memory("t", "memory b")).unwrap();
-
-        let mut external = make_memory("other-topic", "external memory");
-        external.related_ids = vec![a_id.clone(), b_id.clone()];
-        let external_id = store.store(external).unwrap();
-
-        store
-            .consolidate_topic("t", make_memory("t", "rollup"))
-            .unwrap();
-
-        let external_after = store.get(&external_id).unwrap().unwrap();
-        assert!(
-            external_after.related_ids.is_empty(),
-            "external memory must no longer reference the consolidated-away ids: {:?}",
-            external_after.related_ids
-        );
-    }
-
-    /// Audit regression: critical memories are exempt from consolidation, so
-    /// they must not count toward the auto-consolidate threshold — otherwise
-    /// a topic full of criticals would churn a fresh rollup on every store.
-    #[test]
-    fn auto_consolidate_ignores_critical_for_threshold() {
-        let store = test_store();
-        for i in 0..3 {
-            store
-                .store(Memory::new(
-                    "t".into(),
-                    format!("critical {i}"),
-                    Importance::Critical,
-                ))
-                .unwrap();
-        }
-        store.store(make_memory("t", "one expendable")).unwrap();
-
-        // 4 total but only 1 consolidatable — below threshold 3.
-        assert!(!store.auto_consolidate("t", 3).unwrap());
-        assert_eq!(store.get_by_topic("t").unwrap().len(), 4);
-
-        store.store(make_memory("t", "expendable 2")).unwrap();
-        store.store(make_memory("t", "expendable 3")).unwrap();
-
-        // Now 3 consolidatable — rollup fires, criticals survive.
-        assert!(store.auto_consolidate("t", 3).unwrap());
-        let after = store.get_by_topic("t").unwrap();
-        let criticals = after
-            .iter()
-            .filter(|m| matches!(m.importance, Importance::Critical))
-            .count();
-        assert_eq!(criticals, 3, "all criticals must survive the rollup");
-        assert_eq!(after.len(), 4, "3 criticals + 1 consolidated");
-    }
-
-    /// Audit regression: `update()` previously bypassed all validation, so
-    /// oversized or NUL-carrying payloads could enter via store-small-then-
-    /// update-big.
-    #[test]
-    fn update_rejects_oversized_and_nul_payloads() {
-        let store = test_store();
-        let id = store.store(make_memory("t", "small")).unwrap();
-        let mut m = store.get(&id).unwrap().unwrap();
-
-        m.summary = "x".repeat(MAX_SUMMARY_BYTES + 1);
-        assert!(matches!(store.update(&m), Err(IcmError::InvalidInput(_))));
-
-        m.summary = "has a \0 NUL".into();
-        assert!(matches!(store.update(&m), Err(IcmError::InvalidInput(_))));
-
-        // The stored row is untouched by the rejected updates.
-        assert_eq!(store.get(&id).unwrap().unwrap().summary, "small");
-    }
-
-    /// Audit regression: the MCP consolidate path passes a caller-provided
-    /// summary that previously bypassed every size check.
-    #[test]
-    fn consolidate_topic_validates_consolidated_summary() {
-        let store = test_store();
-        store.store(make_memory("t", "entry")).unwrap();
-
-        let oversized = make_memory("t", &"x".repeat(MAX_SUMMARY_BYTES + 1));
-        assert!(matches!(
-            store.consolidate_topic("t", oversized),
-            Err(IcmError::InvalidInput(_))
-        ));
-        // Originals untouched on rejection.
-        assert_eq!(store.get_by_topic("t").unwrap().len(), 1);
-    }
-
-    /// Audit regression: transcript messages had no size bound at all; they
-    /// are best-effort logs, so oversized content is truncated, not lost.
-    #[test]
-    fn record_message_truncates_oversized_content() {
-        let store = test_store();
-        let sid = store.create_session("test-agent", None, None).unwrap();
-        let big = "é".repeat(200 * 1024); // 400 KB of two-byte chars
-        store
-            .record_message(&sid, Role::User, &big, None, None, None)
-            .unwrap();
-
-        let msgs = store.list_session_messages(&sid, 10, 0).unwrap();
-        assert_eq!(msgs.len(), 1);
-        assert!(msgs[0].content.len() <= 256 * 1024);
-        assert!(!msgs[0].content.is_empty());
-        // Truncation must respect char boundaries (no broken UTF-8).
-        assert!(msgs[0].content.chars().all(|c| c == 'é'));
-    }
-
-    /// Reproduces issue #44: after consolidation, recall should only return the
-    /// consolidated memory — not stale fragments from the originals.
-    #[test]
-    fn test_consolidate_no_stale_fts_results() {
-        let store = test_store();
-
-        // Step 1: store 3 related memories on the same topic
-        store
-            .store(make_memory(
-                "errors-resolved",
-                "fix: null pointer in parser",
-            ))
-            .unwrap();
-        store
-            .store(make_memory(
-                "errors-resolved",
-                "fix: timeout in HTTP client",
-            ))
-            .unwrap();
-        store
-            .store(make_memory(
-                "errors-resolved",
-                "fix: race condition in cache",
-            ))
-            .unwrap();
-
-        // Verify FTS finds them before consolidation
-        let before = store.search_fts("fix", 10).unwrap();
-        assert_eq!(before.len(), 3);
-
-        // Step 2: consolidate
-        let consolidated = make_memory(
-            "errors-resolved",
-            "All errors resolved: parser, HTTP, cache",
-        );
-        store
-            .consolidate_topic("errors-resolved", consolidated)
-            .unwrap();
-
-        // Step 3: recall — should only return the consolidated memory
-        let after = store.search_fts("fix", 10).unwrap();
-        assert!(
-            after.len() <= 1,
-            "expected at most 1 result after consolidation, got {}",
-            after.len()
-        );
-
-        // The consolidated memory should be findable
-        let consolidated_results = store.search_fts("errors resolved parser", 10).unwrap();
-        assert_eq!(consolidated_results.len(), 1);
-        assert!(consolidated_results[0]
-            .summary
-            .contains("All errors resolved"));
-
-        // Verify topic has exactly 1 memory
-        let topic_mems = store.get_by_topic("errors-resolved").unwrap();
-        assert_eq!(topic_mems.len(), 1);
-    }
-
-    // === MemoirStore tests ===
-
-    #[test]
-    fn test_memoir_crud() {
-        let store = test_store();
-        let m = make_memoir("my-project");
-        let id = store.create_memoir(m).unwrap();
-
-        let retrieved = store.get_memoir(&id).unwrap().unwrap();
-        assert_eq!(retrieved.name, "my-project");
-
-        let by_name = store.get_memoir_by_name("my-project").unwrap().unwrap();
-        assert_eq!(by_name.id, id);
-
-        store.delete_memoir(&id).unwrap();
-        assert!(store.get_memoir(&id).unwrap().is_none());
-    }
-
-    #[test]
-    fn test_memoir_unique_name() {
-        let store = test_store();
-        store.create_memoir(make_memoir("dup")).unwrap();
-        let result = store.create_memoir(make_memoir("dup"));
-        assert!(result.is_err());
-    }
-
-    #[test]
-    fn test_list_memoirs() {
-        let store = test_store();
-        store.create_memoir(make_memoir("beta")).unwrap();
-        store.create_memoir(make_memoir("alpha")).unwrap();
-
-        let list = store.list_memoirs().unwrap();
-        assert_eq!(list.len(), 2);
-        assert_eq!(list[0].name, "alpha"); // sorted by name
-        assert_eq!(list[1].name, "beta");
-    }
-
-    #[test]
-    fn test_concept_crud() {
-        let store = test_store();
-        let m_id = store.create_memoir(make_memoir("proj")).unwrap();
-
-        let mut c = make_concept(&m_id, "event-sourcing", "Events stored in SQLite");
-        c.labels = vec![Label::new("domain", "arch"), Label::new("type", "decision")];
-        let c_id = store.add_concept(c).unwrap();
-
-        let retrieved = store.get_concept(&c_id).unwrap().unwrap();
-        assert_eq!(retrieved.name, "event-sourcing");
-        assert_eq!(retrieved.labels.len(), 2);
-
-        let by_name = store
-            .get_concept_by_name(&m_id, "event-sourcing")
-            .unwrap()
-            .unwrap();
-        assert_eq!(by_name.id, c_id);
-
-        store.delete_concept(&c_id).unwrap();
-        assert!(store.get_concept(&c_id).unwrap().is_none());
-    }
-
-    #[test]
-    fn test_concept_unique_within_memoir() {
-        let store = test_store();
-        let m_id = store.create_memoir(make_memoir("proj")).unwrap();
-
-        store
-            .add_concept(make_concept(&m_id, "dup", "first"))
-            .unwrap();
-        let result = store.add_concept(make_concept(&m_id, "dup", "second"));
-        assert!(result.is_err());
-    }
-
-    #[test]
-    fn test_concept_same_name_different_memoirs() {
-        let store = test_store();
-        let m1 = store.create_memoir(make_memoir("proj1")).unwrap();
-        let m2 = store.create_memoir(make_memoir("proj2")).unwrap();
-
-        store
-            .add_concept(make_concept(&m1, "sqlite", "def1"))
-            .unwrap();
-        store
-            .add_concept(make_concept(&m2, "sqlite", "def2"))
-            .unwrap();
-
-        let c1 = store.get_concept_by_name(&m1, "sqlite").unwrap().unwrap();
-        let c2 = store.get_concept_by_name(&m2, "sqlite").unwrap().unwrap();
-        assert_ne!(c1.id, c2.id);
-    }
-
-    #[test]
-    fn test_refine_concept() {
-        let store = test_store();
-        let m_id = store.create_memoir(make_memoir("proj")).unwrap();
-        let c_id = store
-            .add_concept(make_concept(&m_id, "es", "Events v1"))
-            .unwrap();
-
-        let orig = store.get_concept(&c_id).unwrap().unwrap();
-        assert_eq!(orig.revision, 1);
-        let orig_confidence = orig.confidence;
-
-        store
-            .refine_concept(&c_id, "Events v2 with snapshots", &["mem-1".into()])
-            .unwrap();
-
-        let refined = store.get_concept(&c_id).unwrap().unwrap();
-        assert_eq!(refined.revision, 2);
-        assert_eq!(refined.definition, "Events v2 with snapshots");
-        assert!(refined.confidence > orig_confidence);
-        assert!(refined.source_memory_ids.contains(&"mem-1".into()));
-    }
-
-    #[test]
-    fn test_concept_links() {
-        let store = test_store();
-        let m_id = store.create_memoir(make_memoir("proj")).unwrap();
-        let c1_id = store
-            .add_concept(make_concept(&m_id, "event-sourcing", "ES pattern"))
-            .unwrap();
-        let c2_id = store
-            .add_concept(make_concept(&m_id, "sqlite", "SQLite storage"))
-            .unwrap();
-
-        let link = ConceptLink::new(c1_id.clone(), c2_id.clone(), Relation::DependsOn);
-        let link_id = store.add_link(link).unwrap();
-
-        let from = store.get_links_from(&c1_id).unwrap();
-        assert_eq!(from.len(), 1);
-        assert_eq!(from[0].target_id, c2_id);
-        assert_eq!(from[0].relation, Relation::DependsOn);
-
-        let to = store.get_links_to(&c2_id).unwrap();
-        assert_eq!(to.len(), 1);
-        assert_eq!(to[0].source_id, c1_id);
-
-        store.delete_link(&link_id).unwrap();
-        assert!(store.get_links_from(&c1_id).unwrap().is_empty());
-    }
-
-    #[test]
-    fn test_self_link_rejected() {
-        let store = test_store();
-        let m_id = store.create_memoir(make_memoir("proj")).unwrap();
-        let c_id = store
-            .add_concept(make_concept(&m_id, "concept", "def"))
-            .unwrap();
-
-        let link = ConceptLink::new(c_id.clone(), c_id, Relation::RelatedTo);
-        let result = store.add_link(link);
-        assert!(result.is_err());
-    }
-
-    #[test]
-    fn test_transitive_cycle_rejected() {
-        // Audit M11/CYC1: A → B → C → A used to be silently accepted,
-        // corrupting BFS in `get_neighborhood`. Now the third edge
-        // (closing the cycle) is rejected with `InvalidInput`.
-        let store = test_store();
-        let m_id = store.create_memoir(make_memoir("proj")).unwrap();
-        let a = store.add_concept(make_concept(&m_id, "A", "a")).unwrap();
-        let b = store.add_concept(make_concept(&m_id, "B", "b")).unwrap();
-        let c = store.add_concept(make_concept(&m_id, "C", "c")).unwrap();
-
-        // A → B: ok
-        store
-            .add_link(ConceptLink::new(a.clone(), b.clone(), Relation::DependsOn))
-            .unwrap();
-        // B → C: ok
-        store
-            .add_link(ConceptLink::new(b.clone(), c.clone(), Relation::Refines))
-            .unwrap();
-        // C → A: would close the cycle — reject
-        let cycle_attempt = store.add_link(ConceptLink::new(c, a, Relation::RelatedTo));
-        assert!(
-            cycle_attempt.is_err(),
-            "C → A should be rejected as a cycle"
-        );
-        let err_msg = cycle_attempt.unwrap_err().to_string();
-        assert!(
-            err_msg.contains("cycle"),
-            "error message should mention cycle: {err_msg}"
-        );
-    }
-
-    #[test]
-    fn test_dag_links_still_allowed() {
-        // Sanity: rejecting cycles must not break legitimate DAG links.
-        let store = test_store();
-        let m_id = store.create_memoir(make_memoir("proj")).unwrap();
-        let a = store.add_concept(make_concept(&m_id, "A", "a")).unwrap();
-        let b = store.add_concept(make_concept(&m_id, "B", "b")).unwrap();
-        let c = store.add_concept(make_concept(&m_id, "C", "c")).unwrap();
-
-        // A → B, A → C, B → C — three edges in a DAG, all should pass.
-        store
-            .add_link(ConceptLink::new(a.clone(), b.clone(), Relation::DependsOn))
-            .unwrap();
-        store
-            .add_link(ConceptLink::new(a, c.clone(), Relation::DependsOn))
-            .unwrap();
-        store
-            .add_link(ConceptLink::new(b, c, Relation::Refines))
-            .unwrap();
-    }
-
-    #[test]
-    fn test_get_neighbors() {
-        let store = test_store();
-        let m_id = store.create_memoir(make_memoir("proj")).unwrap();
-        let c1 = store
-            .add_concept(make_concept(&m_id, "a", "node a"))
-            .unwrap();
-        let c2 = store
-            .add_concept(make_concept(&m_id, "b", "node b"))
-            .unwrap();
-        let c3 = store
-            .add_concept(make_concept(&m_id, "c", "node c"))
-            .unwrap();
-
-        store
-            .add_link(ConceptLink::new(
-                c1.clone(),
-                c2.clone(),
-                Relation::DependsOn,
-            ))
-            .unwrap();
-        store
-            .add_link(ConceptLink::new(c3.clone(), c1.clone(), Relation::PartOf))
-            .unwrap();
-
-        let neighbors = store.get_neighbors(&c1, None).unwrap();
-        assert_eq!(neighbors.len(), 2);
-
-        let dep_neighbors = store.get_neighbors(&c1, Some(Relation::DependsOn)).unwrap();
-        assert_eq!(dep_neighbors.len(), 1);
-        assert_eq!(dep_neighbors[0].name, "b");
-    }
-
-    #[test]
-    fn test_get_neighborhood_bfs() {
-        let store = test_store();
-        let m_id = store.create_memoir(make_memoir("proj")).unwrap();
-        let c1 = store
-            .add_concept(make_concept(&m_id, "a", "node a"))
-            .unwrap();
-        let c2 = store
-            .add_concept(make_concept(&m_id, "b", "node b"))
-            .unwrap();
-        let c3 = store
-            .add_concept(make_concept(&m_id, "c", "node c"))
-            .unwrap();
-        let c4 = store
-            .add_concept(make_concept(&m_id, "d", "node d"))
-            .unwrap();
-
-        // a -> b -> c -> d
-        store
-            .add_link(ConceptLink::new(
-                c1.clone(),
-                c2.clone(),
-                Relation::DependsOn,
-            ))
-            .unwrap();
-        store
-            .add_link(ConceptLink::new(
-                c2.clone(),
-                c3.clone(),
-                Relation::DependsOn,
-            ))
-            .unwrap();
-        store
-            .add_link(ConceptLink::new(c3, c4, Relation::DependsOn))
-            .unwrap();
-
-        // depth=1 should get a + b
-        let (concepts, links) = store.get_neighborhood(&c1, 1).unwrap();
-        assert_eq!(concepts.len(), 2);
-        assert!(!links.is_empty());
-
-        // depth=2 should get a + b + c
-        let (concepts, _) = store.get_neighborhood(&c1, 2).unwrap();
-        assert_eq!(concepts.len(), 3);
-
-        // depth=3 should get all 4
-        let (concepts, _) = store.get_neighborhood(&c1, 3).unwrap();
-        assert_eq!(concepts.len(), 4);
-    }
-
-    #[test]
-    fn test_cascade_delete_memoir() {
-        let store = test_store();
-        let m_id = store.create_memoir(make_memoir("proj")).unwrap();
-        let c1 = store.add_concept(make_concept(&m_id, "a", "def")).unwrap();
-        let c2 = store.add_concept(make_concept(&m_id, "b", "def")).unwrap();
-        store
-            .add_link(ConceptLink::new(c1, c2, Relation::RelatedTo))
-            .unwrap();
-
-        store.delete_memoir(&m_id).unwrap();
-
-        // Concepts and links should be gone
-        let concepts = store.list_concepts(&m_id).unwrap();
-        assert!(concepts.is_empty());
-    }
-
-    #[test]
-    fn test_memoir_stats() {
-        let store = test_store();
-        let m_id = store.create_memoir(make_memoir("proj")).unwrap();
-
-        let mut c = make_concept(&m_id, "es", "event sourcing");
-        c.labels = vec![Label::new("domain", "arch")];
-        let c1 = store.add_concept(c).unwrap();
-
-        let mut c = make_concept(&m_id, "sqlite", "sqlite storage");
-        c.labels = vec![Label::new("domain", "arch"), Label::new("type", "tech")];
-        let c2 = store.add_concept(c).unwrap();
-
-        store
-            .add_link(ConceptLink::new(c1, c2, Relation::DependsOn))
-            .unwrap();
-
-        let stats = store.memoir_stats(&m_id).unwrap();
-        assert_eq!(stats.total_concepts, 2);
-        assert_eq!(stats.total_links, 1);
-        assert!(stats.avg_confidence > 0.0);
-        assert!(!stats.label_counts.is_empty());
-    }
-
-    #[test]
-    fn test_search_concepts_fts() {
-        let store = test_store();
-        let m_id = store.create_memoir(make_memoir("proj")).unwrap();
-
-        store
-            .add_concept(make_concept(
-                &m_id,
-                "event-sourcing",
-                "Store domain events in append-only log",
-            ))
-            .unwrap();
-        store
-            .add_concept(make_concept(
-                &m_id,
-                "cqrs",
-                "Command Query Responsibility Segregation",
-            ))
-            .unwrap();
-
-        let results = store.search_concepts_fts(&m_id, "events", 10).unwrap();
-        assert_eq!(results.len(), 1);
-        assert_eq!(results[0].name, "event-sourcing");
-    }
-
-    #[test]
-    fn test_search_concepts_by_label() {
-        let store = test_store();
-        let m_id = store.create_memoir(make_memoir("proj")).unwrap();
-
-        let mut c1 = make_concept(&m_id, "es", "event sourcing");
-        c1.labels = vec![Label::new("domain", "arch")];
-        store.add_concept(c1).unwrap();
-
-        let mut c2 = make_concept(&m_id, "sqlite", "storage");
-        c2.labels = vec![Label::new("domain", "tech")];
-        store.add_concept(c2).unwrap();
-
-        let results = store
-            .search_concepts_by_label(&m_id, &Label::new("domain", "arch"), 10)
-            .unwrap();
-        assert_eq!(results.len(), 1);
-        assert_eq!(results[0].name, "es");
-    }
-
-    /// Audit regression: the label pattern built by `search_concepts_by_label`
-    /// interpolated `namespace`/`value` into a LIKE pattern unescaped, so a
-    /// literal `_` in a search value acted as a SQL "any single char"
-    /// wildcard instead of matching only that exact character.
-    #[test]
-    fn test_search_concepts_by_label_escapes_wildcards() {
-        let store = test_store();
-        let m_id = store.create_memoir(make_memoir("proj")).unwrap();
-
-        let mut c1 = make_concept(&m_id, "c1", "def1");
-        c1.labels = vec![Label::new("domain", "test")];
-        store.add_concept(c1).unwrap();
-
-        let mut c2 = make_concept(&m_id, "c2", "def2");
-        c2.labels = vec![Label::new("domain", "text")];
-        store.add_concept(c2).unwrap();
-
-        // "te_t" is not the literal value of either concept, but with an
-        // unescaped `_` it matches both "test" and "text" as a wildcard.
-        let results = store
-            .search_concepts_by_label(&m_id, &Label::new("domain", "te_t"), 10)
-            .unwrap();
-        assert!(
-            results.is_empty(),
-            "unescaped '_' wildcard matched unrelated label values: {results:?}"
-        );
-    }
-
-    // === Vector search tests ===
-
-    #[test]
-    fn test_store_with_embedding() {
-        let store = test_store();
-        let mut mem = make_memory("test", "vector enabled");
-        mem.embedding = Some(vec![0.1; 384]);
-        let id = store.store(mem).unwrap();
-
-        let retrieved = store.get(&id).unwrap().unwrap();
-        assert!(retrieved.embedding.is_some());
-        assert_eq!(retrieved.embedding.as_ref().unwrap().len(), 384);
-    }
-
-    #[test]
-    fn test_store_without_embedding() {
-        let store = test_store();
-        let mem = make_memory("test", "no vector");
-        let id = store.store(mem).unwrap();
-
-        let retrieved = store.get(&id).unwrap().unwrap();
-        assert!(retrieved.embedding.is_none());
-    }
-
-    #[test]
-    fn test_search_by_embedding() {
-        let store = test_store();
-
-        // Store 3 memories with different embeddings
-        let mut m1 = make_memory("rust", "Rust systems programming");
-        m1.embedding = Some(vec![
-            1.0, 0.0, 0.0, 0.0, 0.0, 0.0, 0.0, 0.0, 0.0, 0.0, 0.0, 0.0, 0.0, 0.0, 0.0, 0.0, 0.0,
-            0.0, 0.0, 0.0, 0.0, 0.0, 0.0, 0.0, 0.0, 0.0, 0.0, 0.0, 0.0, 0.0, 0.0, 0.0, 0.0, 0.0,
-            0.0, 0.0, 0.0, 0.0, 0.0, 0.0, 0.0, 0.0, 0.0, 0.0, 0.0, 0.0, 0.0, 0.0, 0.0, 0.0, 0.0,
-            0.0, 0.0, 0.0, 0.0, 0.0, 0.0, 0.0, 0.0, 0.0, 0.0, 0.0, 0.0, 0.0, 0.0, 0.0, 0.0, 0.0,
-            0.0, 0.0, 0.0, 0.0, 0.0, 0.0, 0.0, 0.0, 0.0, 0.0, 0.0, 0.0, 0.0, 0.0, 0.0, 0.0, 0.0,
-            0.0, 0.0, 0.0, 0.0, 0.0, 0.0, 0.0, 0.0, 0.0, 0.0, 0.0, 0.0, 0.0, 0.0, 0.0, 0.0, 0.0,
-            0.0, 0.0, 0.0, 0.0, 0.0, 0.0, 0.0, 0.0, 0.0, 0.0, 0.0, 0.0, 0.0, 0.0, 0.0, 0.0, 0.0,
-            0.0, 0.0, 0.0, 0.0, 0.0, 0.0, 0.0, 0.0, 0.0, 0.0, 0.0, 0.0, 0.0, 0.0, 0.0, 0.0, 0.0,
-            0.0, 0.0, 0.0, 0.0, 0.0, 0.0, 0.0, 0.0, 0.0, 0.0, 0.0, 0.0, 0.0, 0.0, 0.0, 0.0, 0.0,
-            0.0, 0.0, 0.0, 0.0, 0.0, 0.0, 0.0, 0.0, 0.0, 0.0, 0.0, 0.0, 0.0, 0.0, 0.0, 0.0, 0.0,
-            0.0, 0.0, 0.0, 0.0, 0.0, 0.0, 0.0, 0.0, 0.0, 0.0, 0.0, 0.0, 0.0, 0.0, 0.0, 0.0, 0.0,
-            0.0, 0.0, 0.0, 0.0, 0.0, 0.0, 0.0, 0.0, 0.0, 0.0, 0.0, 0.0, 0.0, 0.0, 0.0, 0.0, 0.0,
-            0.0, 0.0, 0.0, 0.0, 0.0, 0.0, 0.0, 0.0, 0.0, 0.0, 0.0, 0.0, 0.0, 0.0, 0.0, 0.0, 0.0,
-            0.0, 0.0, 0.0, 0.0, 0.0, 0.0, 0.0, 0.0, 0.0, 0.0, 0.0, 0.0, 0.0, 0.0, 0.0, 0.0, 0.0,
-            0.0, 0.0, 0.0, 0.0, 0.0, 0.0, 0.0, 0.0, 0.0, 0.0, 0.0, 0.0, 0.0, 0.0, 0.0, 0.0, 0.0,
-            0.0, 0.0, 0.0, 0.0, 0.0, 0.0, 0.0, 0.0, 0.0, 0.0, 0.0, 0.0, 0.0, 0.0, 0.0, 0.0, 0.0,
-            0.0, 0.0, 0.0, 0.0, 0.0, 0.0, 0.0, 0.0, 0.0, 0.0, 0.0, 0.0, 0.0, 0.0, 0.0, 0.0, 0.0,
-            0.0, 0.0, 0.0, 0.0, 0.0, 0.0, 0.0, 0.0, 0.0, 0.0, 0.0, 0.0, 0.0, 0.0, 0.0, 0.0, 0.0,
-            0.0, 0.0, 0.0, 0.0, 0.0, 0.0, 0.0, 0.0, 0.0, 0.0, 0.0, 0.0, 0.0, 0.0, 0.0, 0.0, 0.0,
-            0.0, 0.0, 0.0, 0.0, 0.0, 0.0, 0.0, 0.0, 0.0, 0.0, 0.0, 0.0, 0.0, 0.0, 0.0, 0.0, 0.0,
-            0.0, 0.0, 0.0, 0.0, 0.0, 0.0, 0.0, 0.0, 0.0, 0.0, 0.0, 0.0, 0.0, 0.0, 0.0, 0.0, 0.0,
-            0.0, 0.0, 0.0, 0.0, 0.0, 0.0, 0.0, 0.0, 0.0, 0.0, 0.0, 0.0, 0.0, 0.0, 0.0, 0.0, 0.0,
-            0.0, 0.0, 0.0, 0.0, 0.0, 0.0, 0.0, 0.0, 0.0, 0.0,
-        ]);
-        store.store(m1).unwrap();
-
-        let mut m2 = make_memory("python", "Python scripting");
-        // Very different embedding
-        let mut emb2 = vec![0.0; 384];
-        emb2[1] = 1.0;
-        m2.embedding = Some(emb2);
-        store.store(m2).unwrap();
-
-        // Store one without embedding
-        store.store(make_memory("go", "Go programming")).unwrap();
-
-        // Search with a query vector close to m1
-        let mut query = vec![0.0; 384];
-        query[0] = 0.9;
-        let results = store.search_by_embedding(&query, 5).unwrap();
-
-        assert!(!results.is_empty());
-        // First result should be closest to query
-        assert_eq!(results[0].0.topic, "rust");
-    }
-
-    #[test]
-    fn test_delete_cleans_vec_table() {
-        let store = test_store();
-        let mut mem = make_memory("test", "to delete with vec");
-        mem.embedding = Some(vec![0.5; 384]);
-        let id = store.store(mem).unwrap();
-
-        store.delete(&id).unwrap();
-
-        // Verify vec_memories is also cleaned
-        let query = vec![0.5; 384];
-        let results = store.search_by_embedding(&query, 10).unwrap();
-        assert!(results.is_empty());
-    }
-
-    #[test]
-    fn test_search_hybrid() {
-        let store = test_store();
-
-        // Store memory with both text and embedding
-        let mut mem = make_memory("rust", "Rust is great for systems programming");
-        mem.embedding = Some(vec![0.8; 384]);
-        store.store(mem).unwrap();
-
-        let mut mem2 = make_memory("python", "Python is great for scripting");
-        let mut emb2 = vec![0.0; 384];
-        emb2[1] = 1.0;
-        mem2.embedding = Some(emb2);
-        store.store(mem2).unwrap();
-
-        // Hybrid search with both text match and close embedding
-        let query_emb = vec![0.7; 384]; // close to m1's embedding
-        let results = store
-            .search_hybrid("rust programming", &query_emb, 5)
-            .unwrap();
-
-        assert!(!results.is_empty());
-        // Rust should rank first (matches both FTS and vector)
-        assert_eq!(results[0].0.topic, "rust");
-        // Score should be > 0
-        assert!(results[0].1 > 0.0);
-    }
-
-    /// Audit regression: `1.0 / (1.0 + rank.abs())` inverted FTS relevance —
-    /// a stronger bm25 match (more negative rank) scored LOWER than a weak
-    /// one. Neither memory has an embedding, which isolates the FTS
-    /// component of the hybrid score (vector side is 0.0 for both).
-    #[test]
-    fn test_search_hybrid_ranks_strong_fts_match_above_weak_one() {
-        let store = test_store();
-
-        // Strong match: the query term repeated, short document — bm25
-        // favors high term frequency in a short field.
-        store
-            .store(make_memory(
-                "t",
-                "database database database database database",
-            ))
-            .unwrap();
-        // Weak match: the query term appears once, diluted by many other
-        // unrelated terms — bm25 penalizes this relative to the strong doc.
-        store
-            .store(make_memory(
-                "t",
-                "we briefly touched on a database as one topic among many \
-                 entirely unrelated software engineering concerns discussed today",
-            ))
-            .unwrap();
-
-        let no_embedding = vec![0.0; 384];
-        let results = store.search_hybrid("database", &no_embedding, 5).unwrap();
-        assert_eq!(results.len(), 2);
-        let strong = results
-            .iter()
-            .find(|(m, _)| m.summary.starts_with("database database"))
-            .expect("strong match must be present");
-        let weak = results
-            .iter()
-            .find(|(m, _)| m.summary.starts_with("we briefly"))
-            .expect("weak match must be present");
-        assert!(
-            strong.1 > weak.1,
-            "strong FTS match ({}) must outscore weak match ({})",
-            strong.1,
-            weak.1
-        );
-    }
-
-    /// Audit regression: `find_similar_memory` used to compare
-    /// `DEDUP_SIMILARITY_THRESHOLD` (0.85) against the hybrid
-    /// `0.3*fts + 0.7*cosine` score. A memory found ONLY via the vector
-    /// side (no shared keywords, so fts=0) could score at most
-    /// `0.3*0 + 0.7*1.0 = 0.70` even for a byte-identical embedding —
-    /// always below 0.85, so semantic-only duplicates were never caught.
-    /// Switching to pure `search_by_embedding` (cosine) fixes this: an
-    /// identical embedding now scores ~1.0, comfortably above threshold,
-    /// regardless of keyword overlap.
-    #[test]
-    fn test_find_similar_memory_detects_purely_semantic_duplicate() {
-        let store = test_store();
-        let embedding = vec![0.42; 384];
-
-        let mut original = make_memory("t", "the quick brown fox jumps over the lazy dog");
-        original.embedding = Some(embedding.clone());
-        store.store(original).unwrap();
-
-        // Shares literally no keywords with the stored summary — the FTS
-        // component of the old hybrid comparison would be exactly 0.0.
-        let found = icm_core::find_similar_memory(
-            &store,
-            "a fast animal leaping above a sleepy canine",
-            &embedding,
-            "t",
-            icm_core::DEDUP_SIMILARITY_THRESHOLD,
-        )
-        .unwrap();
-        assert!(
-            found.is_some(),
-            "an identical embedding must be detected as a duplicate even with zero keyword overlap"
-        );
-        assert!(found.unwrap().1 > 0.99);
-    }
-
-    #[test]
-    fn test_sanitize_fts_query() {
-        // Normal words get quoted
-        assert_eq!(sanitize_fts_query("hello world"), "\"hello\" \"world\"");
-
-        // Special chars become spaces, splitting into separate tokens
-        assert_eq!(sanitize_fts_query("sqlite-vec"), "\"sqlite\" \"vec\"");
-        assert_eq!(sanitize_fts_query("foo*bar"), "\"foo\" \"bar\"");
-        assert_eq!(sanitize_fts_query("col:value"), "\"col\" \"value\"");
-
-        // Empty/whitespace returns empty
-        assert_eq!(sanitize_fts_query(""), "");
-        assert_eq!(sanitize_fts_query("  "), "");
-        assert_eq!(sanitize_fts_query("---"), "");
-
-        // Mixed content
-        assert_eq!(
-            sanitize_fts_query("no-such column:vec"),
-            "\"no\" \"such\" \"column\" \"vec\""
-        );
-    }
-
-    #[test]
-    fn test_search_fts_special_chars() {
-        let store = test_store();
-        store
-            .store(make_memory(
-                "tools",
-                "sqlite-vec is a vector search extension",
-            ))
-            .unwrap();
-
-        // This query used to crash with "no such column: vec"
-        let results = store.search_fts("sqlite-vec", 10).unwrap();
-        assert_eq!(results.len(), 1);
-        assert_eq!(results[0].topic, "tools");
-
-        // Pure special chars should return empty, not error
-        let results = store.search_fts("---", 10).unwrap();
-        assert!(results.is_empty());
-    }
-
-    #[test]
-    fn test_search_concepts_fts_special_chars() {
-        let store = test_store();
-        let m_id = store.create_memoir(make_memoir("proj")).unwrap();
-
-        store
-            .add_concept(make_concept(
-                &m_id,
-                "sqlite-vec",
-                "Vector search extension for SQLite",
-            ))
-            .unwrap();
-
-        // Should not crash with special chars in query
-        let results = store.search_concepts_fts(&m_id, "sqlite-vec", 10).unwrap();
-        assert_eq!(results.len(), 1);
-        assert_eq!(results[0].name, "sqlite-vec");
-
-        // Pure special chars should return empty
-        let results = store.search_concepts_fts(&m_id, "***", 10).unwrap();
-        assert!(results.is_empty());
-    }
-
-    #[test]
-    fn test_sql_injection_in_topic() {
-        let store = test_store();
-        let mem = make_memory("'; DROP TABLE memories; --", "should be safe");
-        store.store(mem.clone()).unwrap();
-
-        let retrieved = store.get(&mem.id).unwrap().unwrap();
-        assert_eq!(retrieved.topic, "'; DROP TABLE memories; --");
-        assert_eq!(store.count().unwrap(), 1);
-        let topics = store.list_topics().unwrap();
-        assert_eq!(topics.len(), 1);
-    }
-
-    #[test]
-    fn test_sql_injection_in_summary() {
-        let store = test_store();
-        let mem = make_memory("test", "value'); DELETE FROM memories WHERE ('1'='1");
-        store.store(mem).unwrap();
-        assert_eq!(store.count().unwrap(), 1);
-    }
-
-    #[test]
-    fn test_sql_injection_in_fts_query() {
-        let store = test_store();
-        store
-            .store(make_memory("test", "normal content here"))
-            .unwrap();
-
-        // FTS5 injection attempts
-        let results = store.search_fts("') OR 1=1 --", 10).unwrap();
-        assert!(results.is_empty() || results.len() <= 1);
-
-        let results = store.search_fts("NEAR(a b)", 10).unwrap();
-        let _ = results;
-    }
-
-    #[test]
-    fn test_sql_injection_in_keywords() {
-        let store = test_store();
-        let mut mem = make_memory("test", "keyword injection");
-        mem.keywords = vec!["normal".into(), "'; DROP TABLE memories; --".into()];
-        store.store(mem).unwrap();
-        assert_eq!(store.count().unwrap(), 1);
-
-        let results = store
-            .search_by_keywords(&["'; DROP TABLE memories; --"], 10)
-            .unwrap();
-        let _ = results;
-    }
-
-    #[test]
-    fn test_null_bytes_in_summary_rejected() {
-        // Audit finding: libsql binds text via NUL-terminated C strings,
-        // so anything past the first `\0` was silently dropped — a
-        // memory written as `"before\0after"` came back as `"before"`.
-        // We now reject the write so callers know their data isn't
-        // round-tripping intact.
-        let store = test_store();
-        let mem = make_memory("test", "before\0after");
-        let err = store.store(mem).unwrap_err();
-        assert!(
-            matches!(err, IcmError::InvalidInput(ref m) if m.contains("NUL")),
-            "expected InvalidInput(NUL...) got {err:?}"
-        );
-    }
-
-    #[test]
-    fn test_null_bytes_in_topic_rejected() {
-        let store = test_store();
-        let mem = make_memory("topic\0fake", "real summary content");
-        let err = store.store(mem).unwrap_err();
-        assert!(
-            matches!(err, IcmError::InvalidInput(ref m) if m.contains("NUL")),
-            "expected InvalidInput(NUL...) got {err:?}"
-        );
-    }
-
-    #[test]
-    fn test_unicode_topic_with_trailing_null_rejected() {
-        // The previous permissive behaviour stored the topic
-        // `\u{1F600}\u{1F4A9}\u{0000}` and round-tripped only the
-        // pre-NUL prefix. Now we reject so callers don't think they
-        // stored what they passed.
-        let store = test_store();
-        let unicode_topic = "\u{1F600}\u{1F4A9}\u{0000}";
-        let mem = make_memory(unicode_topic, "emoji topic content here");
-        let err = store.store(mem).unwrap_err();
-        assert!(
-            matches!(err, IcmError::InvalidInput(ref m) if m.contains("NUL")),
-            "expected NUL rejection on emoji+NUL topic, got {err:?}"
-        );
-    }
-
-    #[test]
-    fn test_unicode_emoji_topic_without_null_accepted() {
-        // Sanity: legitimate emoji topics should still work.
-        let store = test_store();
-        let mem = make_memory("\u{1F525}-decisions", "real content here please");
-        let id = store.store(mem.clone()).unwrap();
-        let retrieved = store.get(&id).unwrap().unwrap();
-        assert!(retrieved.topic.starts_with('\u{1F525}'));
-    }
-
-    #[test]
-    fn test_summary_within_cap_accepted() {
-        let store = test_store();
-        let summary = "a".repeat(60_000);
-        let mem = make_memory("test", &summary);
-        store.store(mem.clone()).unwrap();
-        let retrieved = store.get(&mem.id).unwrap().unwrap();
-        assert_eq!(retrieved.summary.len(), 60_000);
-    }
-
-    #[test]
-    fn test_summary_exceeding_cap_rejected() {
-        // Audit finding: a 1 MB single text block landed verbatim as a
-        // single memory's summary, blowing up DB size and embedding
-        // compute. Cap at 64 KB.
-        let store = test_store();
-        let long_summary = "a".repeat(100_000);
-        let mem = make_memory("test", &long_summary);
-        let err = store.store(mem).unwrap_err();
-        assert!(
-            matches!(err, IcmError::InvalidInput(ref m) if m.contains("summary exceeds")),
-            "expected summary-size rejection got {err:?}"
-        );
-    }
-
-    #[test]
-    fn test_empty_topic_rejected() {
-        let store = test_store();
-        let mem = make_memory("", "real summary content here");
-        let err = store.store(mem).unwrap_err();
-        assert!(
-            matches!(err, IcmError::InvalidInput(ref m) if m.contains("topic cannot be empty")),
-            "expected empty-topic rejection got {err:?}"
-        );
-    }
-
-    #[test]
-    fn test_whitespace_only_topic_rejected() {
-        let store = test_store();
-        let mem = make_memory("   \t  ", "real summary content here");
-        let err = store.store(mem).unwrap_err();
-        assert!(
-            matches!(err, IcmError::InvalidInput(ref m) if m.contains("topic cannot be empty")),
-            "expected empty-after-trim rejection got {err:?}"
-        );
-    }
-
-    #[test]
-    fn test_empty_summary_rejected() {
-        let store = test_store();
-        let mem = make_memory("topic", "");
-        let err = store.store(mem).unwrap_err();
-        assert!(
-            matches!(err, IcmError::InvalidInput(ref m) if m.contains("summary cannot be empty")),
-            "expected empty-summary rejection got {err:?}"
-        );
-    }
-
-    #[test]
-    fn test_topic_with_newline_rejected() {
-        let store = test_store();
-        let mem = make_memory("topic\nfake-topic", "real summary content here");
-        let err = store.store(mem).unwrap_err();
-        assert!(
-            matches!(err, IcmError::InvalidInput(ref m) if m.contains("newline")),
-            "expected newline rejection got {err:?}"
-        );
-    }
-
-    #[test]
-    fn test_topic_trailing_whitespace_trimmed_on_store() {
-        // Two topics that visually look identical (`"trail "` vs
-        // `"trail"`) should land in the same bucket. We trim on the
-        // way in.
-        let store = test_store();
-        let id1 = store
-            .store(make_memory("  trail  ", "summary one content"))
-            .unwrap();
-        let mem1 = store.get(&id1).unwrap().unwrap();
-        assert_eq!(mem1.topic, "trail", "topic should be trimmed");
-    }
-
-    #[test]
-    fn test_bulk_insert_100() {
-        let store = test_store();
-        for i in 0..100 {
-            store
-                .store(make_memory("bulk", &format!("memory number {i}")))
-                .unwrap();
-        }
-        assert_eq!(store.count().unwrap(), 100);
-        let by_topic = store.get_by_topic("bulk").unwrap();
-        assert_eq!(by_topic.len(), 100);
-    }
-
-    #[test]
-    fn test_fts_search_many_entries() {
-        let store = test_store();
-        for i in 0..50 {
-            store
-                .store(make_memory(
-                    "lang",
-                    &format!("programming language number {i}"),
-                ))
-                .unwrap();
-        }
-        store
-            .store(make_memory(
-                "unique",
-                "Rust is a memory-safe systems language",
-            ))
-            .unwrap();
-
-        let results = store.search_fts("memory-safe systems", 10).unwrap();
-        assert!(!results.is_empty());
-        assert_eq!(results[0].topic, "unique");
-    }
-
-    #[test]
-    fn test_decay_bulk() {
-        let store = test_store();
-        for i in 0..50 {
-            let mut mem = make_memory("decay", &format!("entry {i}"));
-            if i % 5 == 0 {
-                mem.importance = Importance::Critical;
-            }
-            store.store(mem).unwrap();
-        }
-        // 10 critical, 40 non-critical
-        let affected = store.apply_decay(0.9).unwrap();
-        assert_eq!(affected, 40);
-    }
-
-    #[test]
-    fn test_prune_leaves_important() {
-        let store = test_store();
-        for i in 0..20 {
-            let mut mem = make_memory("prune", &format!("entry {i}"));
-            mem.weight = if i < 10 { 0.01 } else { 0.5 };
-            store.store(mem).unwrap();
-        }
-        let pruned = store.prune(0.1).unwrap();
-        assert_eq!(pruned, 10);
-        assert_eq!(store.count().unwrap(), 10);
-    }
-
-    #[test]
-    fn test_many_topics_listing() {
-        let store = test_store();
-        for i in 0..30 {
-            store
-                .store(make_memory(&format!("topic-{i}"), &format!("content {i}")))
-                .unwrap();
-        }
-        let topics = store.list_topics().unwrap();
-        assert_eq!(topics.len(), 30);
-    }
-
-    #[test]
-    fn test_consolidate_large_topic() {
-        let store = test_store();
-        for i in 0..25 {
-            store
-                .store(make_memory("big-topic", &format!("detail {i}")))
-                .unwrap();
-        }
-        let consolidated = make_memory("big-topic", "consolidated summary of 25 entries");
-        store.consolidate_topic("big-topic", consolidated).unwrap();
-        let remaining = store.get_by_topic("big-topic").unwrap();
-        assert_eq!(remaining.len(), 1);
-        assert!(remaining[0].summary.contains("consolidated"));
-    }
-
-    #[test]
-    fn test_get_by_topic_returns_sorted_by_weight() {
-        let store = test_store();
-        let mut low = make_memory("ux", "low weight");
-        low.weight = 0.3;
-        store.store(low).unwrap();
-
-        let mut high = make_memory("ux", "high weight");
-        high.weight = 0.9;
-        store.store(high).unwrap();
-
-        let results = store.get_by_topic("ux").unwrap();
-        assert_eq!(results.len(), 2);
-        assert!(results[0].weight >= results[1].weight);
-    }
-
-    #[test]
-    fn test_update_access_increments_correctly() {
-        let store = test_store();
-        let mem = make_memory("ux", "access counter");
-        let id = mem.id.clone();
-        store.store(mem).unwrap();
-
-        for _ in 0..5 {
-            store.update_access(&id).unwrap();
-        }
-        let retrieved = store.get(&id).unwrap().unwrap();
-        assert_eq!(retrieved.access_count, 5);
-    }
-
-    #[test]
-    fn test_stats_on_empty_store() {
-        let store = test_store();
-        let stats = store.stats().unwrap();
-        assert_eq!(stats.total_memories, 0);
-        assert_eq!(stats.total_topics, 0);
-        assert_eq!(stats.avg_weight, 0.0);
-        assert!(stats.oldest_memory.is_none());
-        assert!(stats.newest_memory.is_none());
-    }
-
-    #[test]
-    fn test_double_delete_returns_not_found() {
-        let store = test_store();
-        let mem = make_memory("ux", "delete twice");
-        let id = mem.id.clone();
-        store.store(mem).unwrap();
-
-        store.delete(&id).unwrap();
-        let result = store.delete(&id);
-        assert!(matches!(result, Err(IcmError::NotFound(_))));
-    }
-
-    #[test]
-    fn test_update_syncs_embedding() {
-        let store = test_store();
-        let mut mem = make_memory("test", "before update");
-        let id = mem.id.clone();
-        store.store(mem.clone()).unwrap();
-
-        // Initially no embedding
-        assert!(store.get(&id).unwrap().unwrap().embedding.is_none());
-
-        // Update with embedding
-        mem.embedding = Some(vec![0.3; 384]);
-        store.update(&mem).unwrap();
-
-        let retrieved = store.get(&id).unwrap().unwrap();
-        assert!(retrieved.embedding.is_some());
-
-        // Should be findable via vector search
-        let results = store.search_by_embedding(&vec![0.3; 384], 5).unwrap();
-        assert_eq!(results.len(), 1);
-        assert_eq!(results[0].0.id, id);
-    }
-
-    #[test]
-    fn perf_store_1000() {
-        let store = test_store();
-        let start = std::time::Instant::now();
-        for i in 0..1000 {
-            store
-                .store(make_memory("perf", &format!("memory number {i}")))
-                .unwrap();
-        }
-        let elapsed = start.elapsed();
-        assert!(
-            elapsed.as_millis() < 2000,
-            "1000 stores took {}ms (max 2000ms)",
-            elapsed.as_millis()
-        );
-    }
-
-    #[test]
-    fn perf_store_with_embeddings_1000() {
-        let store = test_store();
-        let start = std::time::Instant::now();
-        for i in 0..1000 {
-            let mut mem = make_memory("perf", &format!("embedded memory {i}"));
-            mem.embedding = Some(vec![0.1; 384]);
-            store.store(mem).unwrap();
-        }
-        let elapsed = start.elapsed();
-        assert!(
-            elapsed.as_millis() < 3000,
-            "1000 stores+embedding took {}ms (max 3000ms)",
-            elapsed.as_millis()
-        );
-    }
-
-    #[test]
-    fn perf_fts_search_100() {
-        let store = test_store();
-        for i in 0..500 {
-            store
-                .store(make_memory(
-                    "lang",
-                    &format!("programming language {i} with features"),
-                ))
-                .unwrap();
-        }
-        let start = std::time::Instant::now();
-        for _ in 0..100 {
-            store
-                .search_fts("programming language features", 10)
-                .unwrap();
-        }
-        let elapsed = start.elapsed();
-        assert!(
-            elapsed.as_millis() < 1000,
-            "100 FTS searches took {}ms (max 1000ms)",
-            elapsed.as_millis()
-        );
-    }
-
-    #[test]
-    fn perf_vector_search_100() {
-        let store = test_store();
-        for i in 0..500 {
-            let mut mem = make_memory("vec", &format!("vector memory {i}"));
-            let mut emb = vec![0.0; 384];
-            emb[i % 384] = 1.0;
-            mem.embedding = Some(emb);
-            store.store(mem).unwrap();
-        }
-        let query = vec![0.5; 384];
-        let start = std::time::Instant::now();
-        for _ in 0..100 {
-            store.search_by_embedding(&query, 10).unwrap();
-        }
-        let elapsed = start.elapsed();
-        assert!(
-            elapsed.as_millis() < 5000,
-            "100 vector searches took {}ms (max 5000ms)",
-            elapsed.as_millis()
-        );
-    }
-
-    #[test]
-    fn perf_hybrid_search_100() {
-        let store = test_store();
-        for i in 0..500 {
-            let mut mem = make_memory("hybrid", &format!("hybrid searchable memory {i}"));
-            mem.embedding = Some(vec![0.1; 384]);
-            store.store(mem).unwrap();
-        }
-        let query_emb = vec![0.1; 384];
-        let start = std::time::Instant::now();
-        for _ in 0..100 {
-            store
-                .search_hybrid("hybrid searchable", &query_emb, 10)
-                .unwrap();
-        }
-        let elapsed = start.elapsed();
-        assert!(
-            elapsed.as_millis() < 10000,
-            "100 hybrid searches took {}ms (max 10000ms)",
-            elapsed.as_millis()
-        );
-    }
-
-    #[test]
-    fn perf_decay_1000() {
-        let store = test_store();
-        for i in 0..1000 {
-            store
-                .store(make_memory("decay", &format!("decayable {i}")))
-                .unwrap();
-        }
-        let start = std::time::Instant::now();
-        store.apply_decay(0.95).unwrap();
-        let elapsed = start.elapsed();
-        assert!(
-            elapsed.as_millis() < 500,
-            "decay on 1000 memories took {}ms (max 500ms)",
-            elapsed.as_millis()
-        );
-    }
-
-    #[test]
-    fn perf_get_by_id_1000() {
-        let store = test_store();
-        let mut ids = Vec::new();
-        for i in 0..1000 {
-            let mem = make_memory("get", &format!("lookup {i}"));
-            let id = mem.id.clone();
-            store.store(mem).unwrap();
-            ids.push(id);
-        }
-        let start = std::time::Instant::now();
-        for id in &ids {
-            store.get(id).unwrap();
-        }
-        let elapsed = start.elapsed();
-        assert!(
-            elapsed.as_millis() < 1000,
-            "1000 gets took {}ms (max 1000ms)",
-            elapsed.as_millis()
-        );
-    }
-
-    /// Measure cache-hot vs cache-cold `get()` cost.
-    ///
-    /// Run with `cargo test -p icm-store -- --ignored --nocapture
-    /// bench_cache_hit_vs_miss`. Informational only — no assertion.
-    #[test]
-    #[ignore]
-    fn bench_cache_hit_vs_miss() {
-        let store = test_store();
-        let mut ids: Vec<String> = Vec::new();
-        for i in 0..50 {
-            let mem = make_memory("bench", &format!("memory {i}"));
-            ids.push(mem.id.clone());
-            store.store(mem).unwrap();
-        }
-
-        // Cold: clear cache, read each id once. Mix of cache-fill + DB hit.
-        store.cache_clear();
-        let cold = std::time::Instant::now();
-        for id in &ids {
-            store.get(id).unwrap();
-        }
-        let cold_elapsed = cold.elapsed();
-
-        // Warm: cache already populated by the cold pass; 1000 iterations
-        // of the same id set are all cache hits.
-        let warm = std::time::Instant::now();
-        for _ in 0..1000 {
-            for id in &ids {
-                store.get(id).unwrap();
-            }
-        }
-        let warm_elapsed = warm.elapsed();
-        let warm_per_get_ns = warm_elapsed.as_nanos() / (1000 * ids.len() as u128);
-        let cold_per_get_ns = cold_elapsed.as_nanos() / ids.len() as u128;
-
-        eprintln!("=== bench_cache_hit_vs_miss ===");
-        eprintln!("  cold (50 fills,   first read each): {cold_per_get_ns} ns/get");
-        eprintln!("  warm (50000 hits, all cache reads): {warm_per_get_ns} ns/get");
-        if warm_per_get_ns > 0 {
-            eprintln!(
-                "  speedup on hot reads: {:.1}x",
-                cold_per_get_ns as f64 / warm_per_get_ns as f64
-            );
-        }
-    }
-
-    /// Measure batched `get_many` vs per-id `get` round-trips.
-    ///
-    /// Run with `cargo test -p icm-store -- --ignored --nocapture
-    /// bench_get_many_vs_n_plus_one`. Informational only.
-    #[test]
-    #[ignore]
-    fn bench_get_many_vs_n_plus_one() {
-        let store = test_store();
-        let mut ids: Vec<String> = Vec::new();
-        for i in 0..50 {
-            let mem = make_memory("bench", &format!("entry {i}"));
-            ids.push(mem.id.clone());
-            store.store(mem).unwrap();
-        }
-        let id_refs: Vec<&str> = ids.iter().map(|s| s.as_str()).collect();
-
-        // Cold batched fetch.
-        store.cache_clear();
-        let t = std::time::Instant::now();
-        let got = store.get_many(&id_refs).unwrap();
-        let batch_elapsed = t.elapsed();
-        assert_eq!(got.len(), 50);
-
-        // Cold N+1 fetch.
-        store.cache_clear();
-        let t = std::time::Instant::now();
-        for id in &id_refs {
-            store.get(id).unwrap();
-        }
-        let n_plus_one_elapsed = t.elapsed();
-
-        eprintln!("=== bench_get_many_vs_n_plus_one (50 ids) ===");
-        eprintln!("  batched get_many: {} µs", batch_elapsed.as_micros());
-        eprintln!("  N+1 individual:   {} µs", n_plus_one_elapsed.as_micros());
-        if batch_elapsed.as_micros() > 0 {
-            eprintln!(
-                "  speedup: {:.1}x",
-                n_plus_one_elapsed.as_micros() as f64 / batch_elapsed.as_micros() as f64
-            );
-        }
-    }
-
-    // === Additional performance tests ===
-
-    #[test]
-    fn perf_search_fts_latency_with_1000_entries() {
-        let store = test_store();
-        for i in 0..1000 {
-            store
-                .store(make_memory(
-                    &format!("topic-{}", i % 50),
-                    &format!("detailed description about system component {i} with features and architecture"),
-                ))
-                .unwrap();
-        }
-        let start = std::time::Instant::now();
-        for _ in 0..50 {
-            let results = store
-                .search_fts("system component architecture", 10)
-                .unwrap();
-            assert!(!results.is_empty());
-        }
-        let elapsed = start.elapsed();
-        assert!(
-            elapsed.as_millis() < 2000,
-            "50 FTS searches over 1000 entries took {}ms (max 2000ms)",
-            elapsed.as_millis()
-        );
-    }
-
-    #[test]
-    fn perf_sequential_store_operations_rapid() {
-        let store = test_store();
-        let start = std::time::Instant::now();
-        // Simulate concurrent-like rapid sequential operations mixing stores, gets, searches
-        for i in 0..500 {
-            let mem = make_memory("rapid", &format!("rapid entry {i}"));
-            let id = mem.id.clone();
-            store.store(mem).unwrap();
-            // Interleave reads
-            if i % 5 == 0 {
-                store.get(&id).unwrap();
-            }
-            // Interleave searches
-            if i % 20 == 0 {
-                store.search_fts("rapid entry", 5).unwrap();
-            }
-        }
-        let elapsed = start.elapsed();
-        assert!(
-            elapsed.as_millis() < 3000,
-            "500 mixed store/get/search ops took {}ms (max 3000ms)",
-            elapsed.as_millis()
-        );
-        assert_eq!(store.count().unwrap(), 500);
-    }
-
-    #[test]
-    fn perf_memoir_creation_and_concept_linking() {
-        let store = test_store();
-        let start = std::time::Instant::now();
-
-        // Create 10 memoirs, each with 10 concepts and links between them
-        for m in 0..10 {
-            let m_id = store
-                .create_memoir(make_memoir(&format!("perf-memoir-{m}")))
-                .unwrap();
-            let mut concept_ids = Vec::new();
-            for c in 0..10 {
-                let c_id = store
-                    .add_concept(make_concept(
-                        &m_id,
-                        &format!("concept-{m}-{c}"),
-                        &format!("Definition for concept {c} in memoir {m}"),
-                    ))
-                    .unwrap();
-                concept_ids.push(c_id);
-            }
-            // Link each concept to the next one (chain)
-            for w in concept_ids.windows(2) {
-                store
-                    .add_link(ConceptLink::new(
-                        w[0].clone(),
-                        w[1].clone(),
-                        Relation::DependsOn,
-                    ))
-                    .unwrap();
-            }
-        }
-        let elapsed = start.elapsed();
-        assert!(
-            elapsed.as_millis() < 3000,
-            "10 memoirs x 10 concepts + links took {}ms (max 3000ms)",
-            elapsed.as_millis()
-        );
-
-        // Verify structure
-        let memoirs = store.list_memoirs().unwrap();
-        assert_eq!(memoirs.len(), 10);
-    }
-
-    #[test]
-    fn perf_neighborhood_bfs_large_graph() {
-        let store = test_store();
-        let m_id = store.create_memoir(make_memoir("large-graph")).unwrap();
-
-        // Create a large graph: 50 concepts in a chain
-        let mut concept_ids = Vec::new();
-        for i in 0..50 {
-            let c_id = store
-                .add_concept(make_concept(
-                    &m_id,
-                    &format!("node-{i}"),
-                    &format!("Graph node number {i}"),
-                ))
-                .unwrap();
-            concept_ids.push(c_id);
-        }
-        // Chain: 0->1->2->...->49
-        for w in concept_ids.windows(2) {
-            store
-                .add_link(ConceptLink::new(
-                    w[0].clone(),
-                    w[1].clone(),
-                    Relation::DependsOn,
-                ))
-                .unwrap();
-        }
-        // Add some cross-links for complexity
-        for i in (0..50).step_by(5) {
-            if i + 10 < 50 {
-                store
-                    .add_link(ConceptLink::new(
-                        concept_ids[i].clone(),
-                        concept_ids[i + 10].clone(),
-                        Relation::RelatedTo,
-                    ))
-                    .unwrap();
-            }
-        }
-
-        let start = std::time::Instant::now();
-        // BFS traversal at various depths
-        for depth in 1..=5 {
-            let (concepts, links) = store.get_neighborhood(&concept_ids[0], depth).unwrap();
-            assert!(!concepts.is_empty());
-            assert!(!links.is_empty());
-        }
-        let elapsed = start.elapsed();
-        assert!(
-            elapsed.as_millis() < 2000,
-            "BFS traversals (depth 1-5) on 50-node graph took {}ms (max 2000ms)",
-            elapsed.as_millis()
-        );
-    }
-
-    #[test]
-    fn perf_embedding_storage_batch() {
-        let store = test_store();
-        let start = std::time::Instant::now();
-        for i in 0..500 {
-            let mut mem = make_memory("embed-perf", &format!("embedding batch entry {i}"));
-            let mut emb = vec![0.0f32; 384];
-            // Vary embeddings so they're not all identical
-            emb[i % 384] = 1.0;
-            emb[(i * 7) % 384] = 0.5;
-            mem.embedding = Some(emb);
-            store.store(mem).unwrap();
-        }
-        let elapsed = start.elapsed();
-        assert!(
-            elapsed.as_millis() < 3000,
-            "500 stores with embeddings took {}ms (max 3000ms)",
-            elapsed.as_millis()
-        );
-
-        // Now search
-        let query = vec![0.5f32; 384];
-        let search_start = std::time::Instant::now();
-        for _ in 0..50 {
-            let results = store.search_by_embedding(&query, 10).unwrap();
-            assert!(!results.is_empty());
-        }
-        let search_elapsed = search_start.elapsed();
-        assert!(
-            search_elapsed.as_millis() < 3000,
-            "50 vector searches over 500 entries took {}ms (max 3000ms)",
-            search_elapsed.as_millis()
-        );
-    }
-
-    #[test]
-    fn perf_keyword_search_with_many_entries() {
-        let store = test_store();
-        for i in 0..1000 {
-            let mut mem = make_memory(
-                &format!("kw-topic-{}", i % 20),
-                &format!("keyword searchable entry number {i}"),
-            );
-            mem.keywords = vec![
-                format!("keyword-{}", i % 10),
-                format!("category-{}", i % 5),
-                "common".into(),
-            ];
-            store.store(mem).unwrap();
-        }
-
-        let start = std::time::Instant::now();
-        for i in 0..50 {
-            let results = store
-                .search_by_keywords(&[&format!("keyword-{}", i % 10)], 10)
-                .unwrap();
-            assert!(!results.is_empty());
-        }
-        let elapsed = start.elapsed();
-        assert!(
-            elapsed.as_millis() < 2000,
-            "50 keyword searches over 1000 entries took {}ms (max 2000ms)",
-            elapsed.as_millis()
-        );
-    }
-
-    #[test]
-    fn perf_consolidate_large_topic_timing() {
-        let store = test_store();
-        for i in 0..100 {
-            store
-                .store(make_memory(
-                    "consolidate-perf",
-                    &format!("detail entry {i} with various information"),
-                ))
-                .unwrap();
-        }
-        let start = std::time::Instant::now();
-        let consolidated = make_memory("consolidate-perf", "All 100 entries consolidated");
-        store
-            .consolidate_topic("consolidate-perf", consolidated)
-            .unwrap();
-        let elapsed = start.elapsed();
-        assert!(
-            elapsed.as_millis() < 1000,
-            "Consolidating 100 entries took {}ms (max 1000ms)",
-            elapsed.as_millis()
-        );
-        assert_eq!(store.get_by_topic("consolidate-perf").unwrap().len(), 1);
-    }
-
-    #[test]
-    fn perf_list_topics_many() {
-        let store = test_store();
-        // Create 200 distinct topics
-        for i in 0..200 {
-            store
-                .store(make_memory(
-                    &format!("distinct-topic-{i}"),
-                    &format!("content for topic {i}"),
-                ))
-                .unwrap();
-        }
-        let start = std::time::Instant::now();
-        for _ in 0..50 {
-            let topics = store.list_topics().unwrap();
-            assert_eq!(topics.len(), 200);
-        }
-        let elapsed = start.elapsed();
-        assert!(
-            elapsed.as_millis() < 1000,
-            "50 list_topics calls over 200 topics took {}ms (max 1000ms)",
-            elapsed.as_millis()
-        );
-    }
-
-    // === FeedbackStore tests ===
-
-    fn make_feedback(topic: &str, context: &str, predicted: &str, corrected: &str) -> Feedback {
-        Feedback::new(
-            topic.into(),
-            context.into(),
-            predicted.into(),
-            corrected.into(),
-            None,
-            "test".into(),
-        )
-    }
-
-    #[test]
-    fn test_feedback_store_and_list() {
-        let store = test_store();
-        let fb = make_feedback("triage", "issue about crashes", "low", "high");
-        let id = fb.id.clone();
-        store.store_feedback(fb).unwrap();
-
-        let results = store.list_feedback(None, 10).unwrap();
-        assert_eq!(results.len(), 1);
-        assert_eq!(results[0].id, id);
-        assert_eq!(results[0].topic, "triage");
-        assert_eq!(results[0].predicted, "low");
-        assert_eq!(results[0].corrected, "high");
-    }
-
-    #[test]
-    fn test_feedback_list_by_topic() {
-        let store = test_store();
-        store
-            .store_feedback(make_feedback("triage", "ctx1", "a", "b"))
-            .unwrap();
-        store
-            .store_feedback(make_feedback("pr-review", "ctx2", "c", "d"))
-            .unwrap();
-
-        let triage = store.list_feedback(Some("triage"), 10).unwrap();
-        assert_eq!(triage.len(), 1);
-        assert_eq!(triage[0].topic, "triage");
-
-        let all = store.list_feedback(None, 10).unwrap();
-        assert_eq!(all.len(), 2);
-    }
-
-    #[test]
-    fn test_feedback_search() {
-        let store = test_store();
-        store
-            .store_feedback(make_feedback(
-                "triage",
-                "user reports memory leak",
-                "low priority",
-                "high priority",
-            ))
-            .unwrap();
-        store
-            .store_feedback(make_feedback(
-                "triage",
-                "build failure on CI",
-                "feature",
-                "bug",
-            ))
-            .unwrap();
-
-        let results = store
-            .search_feedback("memory leak", None, None, 10)
-            .unwrap();
-        assert_eq!(results.len(), 1);
-        assert!(results[0].context.contains("memory leak"));
-    }
-
-    #[test]
-    fn test_feedback_search_with_topic_filter() {
-        let store = test_store();
-        store
-            .store_feedback(make_feedback("triage", "memory issue", "low", "high"))
-            .unwrap();
-        store
-            .store_feedback(make_feedback("pr-review", "memory usage", "ok", "bad"))
-            .unwrap();
-
-        let results = store
-            .search_feedback("memory", None, Some("triage"), 10)
-            .unwrap();
-        assert_eq!(results.len(), 1);
-        assert_eq!(results[0].topic, "triage");
-    }
-
-    /// Manual-testing finding: `feedback search` had no semantic fallback
-    /// at all — pure FTS5 with implicit AND, so a query missing even one
-    /// exact token (no stemming: "formatting" != "format") returned
-    /// nothing, even with an obviously relevant entry stored. Proves the
-    /// fix: the exact real-world query that failed now succeeds once an
-    /// embedding is attached and a query embedding is supplied.
-    #[test]
-    fn feedback_search_falls_back_to_semantic_similarity_on_partial_fts_miss() {
-        let store = SqliteStore::in_memory_with_dims(64).unwrap();
-
-        let mut fb = make_feedback(
-            "code-style",
-            "user asked to format a date",
-            "used strftime with %Y-%m-%d",
-            "should use format_local helper for timezone consistency",
-        );
-        fb.embedding = Some(vec![0.5_f32; 64]);
-        store.store_feedback(fb).unwrap();
-
-        // FTS-only (no query embedding) must reproduce the original bug:
-        // "formatting" has no exact-token match anywhere in the entry.
-        let fts_only = store
-            .search_feedback("date formatting", None, None, 10)
-            .unwrap();
-        assert!(
-            fts_only.is_empty(),
-            "sanity check: FTS-only must still miss this partial-token query"
-        );
-
-        // With a query embedding, semantic similarity must find it even
-        // though the FTS side still misses.
-        let query_embedding = vec![0.5_f32; 64];
-        let hybrid = store
-            .search_feedback("date formatting", Some(&query_embedding), None, 10)
-            .unwrap();
-        assert_eq!(
-            hybrid.len(),
-            1,
-            "semantic fallback must surface the entry FTS alone misses"
-        );
-    }
-
-    #[test]
-    fn test_feedback_increment_applied() {
-        let store = test_store();
-        let fb = make_feedback("triage", "ctx", "a", "b");
-        let id = fb.id.clone();
-        store.store_feedback(fb).unwrap();
-
-        store.increment_applied(&id).unwrap();
-        store.increment_applied(&id).unwrap();
-
-        let results = store.list_feedback(None, 10).unwrap();
-        assert_eq!(results[0].applied_count, 2);
-    }
-
-    #[test]
-    fn test_feedback_increment_applied_not_found() {
-        let store = test_store();
-        let result = store.increment_applied("nonexistent");
-        assert!(result.is_err());
-    }
-
-    #[test]
-    fn test_feedback_delete() {
-        let store = test_store();
-        let fb = make_feedback("triage", "ctx", "a", "b");
-        let id = fb.id.clone();
-        store.store_feedback(fb).unwrap();
-
-        store.delete_feedback(&id).unwrap();
-        let results = store.list_feedback(None, 10).unwrap();
-        assert!(results.is_empty());
-    }
-
-    #[test]
-    fn test_feedback_delete_not_found() {
-        let store = test_store();
-        let result = store.delete_feedback("nonexistent");
-        assert!(result.is_err());
-    }
-
-    #[test]
-    fn test_feedback_stats() {
-        let store = test_store();
-        store
-            .store_feedback(make_feedback("triage", "ctx1", "a", "b"))
-            .unwrap();
-        store
-            .store_feedback(make_feedback("triage", "ctx2", "c", "d"))
-            .unwrap();
-        store
-            .store_feedback(make_feedback("pr-review", "ctx3", "e", "f"))
-            .unwrap();
-
-        let fb = make_feedback("triage", "ctx4", "g", "h");
-        let id = fb.id.clone();
-        store.store_feedback(fb).unwrap();
-        store.increment_applied(&id).unwrap();
-
-        let stats = store.feedback_stats().unwrap();
-        assert_eq!(stats.total, 4);
-        assert_eq!(stats.by_topic.len(), 2);
-        assert_eq!(stats.by_topic[0].0, "triage");
-        assert_eq!(stats.by_topic[0].1, 3);
-        assert_eq!(stats.most_applied.len(), 1);
-        assert_eq!(stats.most_applied[0].1, 1);
-    }
-
-    // === sanitize_fts_query tests ===
-
-    #[test]
-    fn test_sanitize_fts_empty() {
-        assert_eq!(sanitize_fts_query(""), "");
-        assert_eq!(sanitize_fts_query("   "), "");
-    }
-
-    #[test]
-    fn test_sanitize_fts_special_chars() {
-        // All FTS5 operators should be stripped
-        assert_eq!(sanitize_fts_query("hello-world"), "\"hello\" \"world\"");
-        assert_eq!(sanitize_fts_query("foo*bar"), "\"foo\" \"bar\"");
-        assert_eq!(sanitize_fts_query("a:b"), "\"a\" \"b\"");
-        assert_eq!(sanitize_fts_query("(test)"), "\"test\"");
-        assert_eq!(sanitize_fts_query("x^y+z~w"), "\"x\" \"y\" \"z\" \"w\"");
-    }
-
-    #[test]
-    fn test_sanitize_fts_quotes_stripped() {
-        // Embedded quotes must be removed before wrapping in quotes
-        assert_eq!(sanitize_fts_query("say \"hello\""), "\"say\" \"hello\"");
-    }
-
-    #[test]
-    fn test_sanitize_fts_unicode() {
-        assert_eq!(sanitize_fts_query("café résumé"), "\"café\" \"résumé\"");
-        assert_eq!(sanitize_fts_query("日本語テスト"), "\"日本語テスト\"");
-    }
-
-    #[test]
-    fn test_sanitize_fts_long_input_truncated() {
-        let long = "a ".repeat(6000); // 12000 chars
-        let result = sanitize_fts_query(&long);
-        // Input is truncated to 10_000 chars, then tokens are capped at 100
-        let token_count = result.split_whitespace().count();
-        assert!(token_count <= 100);
-    }
-
-    #[test]
-    fn test_sanitize_fts_many_tokens_capped() {
-        // 200 tokens should be capped to 100
-        let many_tokens: String = (0..200)
-            .map(|i| format!("word{i}"))
-            .collect::<Vec<_>>()
-            .join(" ");
-        let result = sanitize_fts_query(&many_tokens);
-        let token_count = result.split_whitespace().count();
-        assert_eq!(token_count, 100);
-    }
-
-    // === search limit cap tests ===
-
-    #[test]
-    fn test_search_fts_limit_capped() {
-        let store = test_store();
-        // Store a memory so search has something to find
-        store.store(make_memory("test", "hello world")).unwrap();
-
-        // Even with a huge limit, it should not error (capped internally)
-        let results = store.search_fts("hello", 999_999).unwrap();
-        assert!(results.len() <= 100);
-    }
-
-    #[test]
-    fn test_search_by_keywords_limit_capped() {
-        let store = test_store();
-        let mut mem = make_memory("test", "keyword search test");
-        mem.keywords = vec!["findme".into()];
-        store.store(mem).unwrap();
-
-        let results = store.search_by_keywords(&["findme"], 999_999).unwrap();
-        assert!(results.len() <= 100);
-    }
-
-    // === Additional MemoryStore coverage ===
-
-    #[test]
-    fn test_search_fts_empty_query() {
-        let store = test_store();
-        store.store(make_memory("topic", "hello world")).unwrap();
-        let results = store.search_fts("", 10).unwrap();
-        assert!(results.is_empty());
-    }
-
-    #[test]
-    fn test_search_by_keywords_empty() {
-        let store = test_store();
-        let results = store.search_by_keywords(&[], 10).unwrap();
-        assert!(results.is_empty());
-    }
-
-    /// Audit regression: an unescaped `%` keyword degenerates into a
-    /// match-everything LIKE pattern instead of matching literal `%`.
-    #[test]
-    fn test_search_by_keywords_escapes_percent_wildcard() {
-        let store = test_store();
-        // Contains the literal substring "100%" — the only row that should
-        // match a properly-escaped '100%' keyword.
-        store
-            .store(make_memory("t", "revenue grew by 100% year over year"))
-            .unwrap();
-        // Decoy: contains "100" but NOT the literal "100%". An unescaped
-        // '%' in the keyword makes the LIKE pattern `%100%%`, which SQLite
-        // collapses to `%100%` ("contains 100 anywhere") — this row would
-        // wrongly match under that bug, since it's the difference between
-        // "contains the substring 100%" and "contains 100".
-        store
-            .store(make_memory("t", "the report has exactly 100 lines total"))
-            .unwrap();
-
-        let results = store.search_by_keywords(&["100%"], 10).unwrap();
-        assert_eq!(
-            results.len(),
-            1,
-            "a literal '100%' keyword must match only rows containing that exact \
-             substring, not any row containing '100', got {} hits",
-            results.len()
-        );
-        assert!(results[0].summary.contains("100%"));
-    }
-
-    /// Audit regression: an unescaped `_` keyword matches any single
-    /// character in that position, so "snake_case" would also match
-    /// "snakeXcase" for any X.
-    #[test]
-    fn test_search_by_keywords_escapes_underscore_wildcard() {
-        let store = test_store();
-        store
-            .store(make_memory("t", "uses snake_case naming"))
-            .unwrap();
-        store
-            .store(make_memory(
-                "t",
-                "uses snakeXcase naming (not the real word)",
-            ))
-            .unwrap();
-
-        let results = store.search_by_keywords(&["snake_case"], 10).unwrap();
-        assert_eq!(
-            results.len(),
-            1,
-            "'_' in a keyword must be literal, not a single-char wildcard, got {} hits",
-            results.len()
-        );
-        assert!(results[0].summary.contains("snake_case"));
-    }
-
-    #[test]
-    fn test_update_nonexistent_memory() {
-        let store = test_store();
-        let mut mem = make_memory("t", "s");
-        mem.id = "nonexistent-id".to_string();
-        let result = store.update(&mem);
-        assert!(result.is_err());
-    }
-
-    #[test]
-    fn test_delete_nonexistent_memory() {
-        let store = test_store();
-        let result = store.delete("nonexistent-id");
-        assert!(result.is_err());
-    }
-
-    #[test]
-    fn test_batch_update_access() {
-        let store = test_store();
-        let id1 = store.store(make_memory("t", "one")).unwrap();
-        let id2 = store.store(make_memory("t", "two")).unwrap();
-        store.batch_update_access(&[&id1, &id2]).unwrap();
-        let m1 = store.get(&id1).unwrap().unwrap();
-        let m2 = store.get(&id2).unwrap().unwrap();
-        assert_eq!(m1.access_count, 1);
-        assert_eq!(m2.access_count, 1);
-    }
-
-    #[test]
-    fn test_auto_consolidate_below_threshold() {
-        let store = test_store();
-        store.store(make_memory("t", "one")).unwrap();
-        store.store(make_memory("t", "two")).unwrap();
-        // Threshold is 10, so no consolidation
-        let result = store.auto_consolidate("t", 10).unwrap();
-        assert!(!result);
-        assert_eq!(store.count_by_topic("t").unwrap(), 2);
-    }
-
-    #[test]
-    fn test_auto_consolidate_above_threshold() {
-        let store = test_store();
-        for i in 0..12 {
-            store
-                .store(make_memory("bulk", &format!("entry {i}")))
-                .unwrap();
-        }
-        let result = store.auto_consolidate("bulk", 10).unwrap();
-        assert!(result);
-        assert_eq!(store.count_by_topic("bulk").unwrap(), 1);
-    }
-
-    #[test]
-    fn test_auto_consolidate_with_embedder_attaches_embedding() {
-        // Audit M2/AC2: the embedder-aware variant must produce a
-        // consolidated memory that is recall-ready (embedding != None).
-        struct StubEmbedder;
-        impl icm_core::Embedder for StubEmbedder {
-            fn embed(&self, _text: &str) -> IcmResult<Vec<f32>> {
-                Ok(vec![0.42; icm_core::DEFAULT_EMBEDDING_DIMS])
-            }
-            fn embed_batch(&self, texts: &[&str]) -> IcmResult<Vec<Vec<f32>>> {
-                Ok(texts
-                    .iter()
-                    .map(|_| vec![0.42; icm_core::DEFAULT_EMBEDDING_DIMS])
-                    .collect())
-            }
-            fn dimensions(&self) -> usize {
-                icm_core::DEFAULT_EMBEDDING_DIMS
-            }
-        }
-        let store = test_store();
-        for i in 0..11 {
-            store
-                .store(make_memory("rolled", &format!("fact {i}")))
-                .unwrap();
-        }
-        let stub = StubEmbedder;
-        let did = store
-            .auto_consolidate_with_embedder("rolled", 10, Some(&stub))
-            .unwrap();
-        assert!(did);
-        let consolidated = store.get_by_topic("rolled").unwrap();
-        assert_eq!(consolidated.len(), 1);
-        let embedding = consolidated[0]
-            .embedding
-            .as_ref()
-            .expect("consolidated memory must have an embedding");
-        assert_eq!(embedding.len(), icm_core::DEFAULT_EMBEDDING_DIMS);
-        assert!((embedding[0] - 0.42).abs() < 1e-6);
-    }
-
-    #[test]
-    fn test_apply_decay_with_aggressive_factor() {
-        let store = test_store();
-        store.store(make_memory("t", "decayable")).unwrap();
-        let affected = store.apply_decay(0.5).unwrap();
-        assert!(affected > 0);
-        let mems = store.get_by_topic("t").unwrap();
-        assert!(mems[0].weight < 1.0);
-    }
-
-    #[test]
-    fn test_prune_low_weight() {
-        let store = test_store();
-        store.store(make_memory("t", "will be pruned")).unwrap();
-        // Apply aggressive decay
-        store.apply_decay(0.01).unwrap();
-        let pruned = store.prune(0.5).unwrap();
-        assert!(pruned > 0);
-        assert_eq!(store.count().unwrap(), 0);
-    }
-
-    #[test]
-    fn test_list_topics_multiple() {
-        let store = test_store();
-        store.store(make_memory("alpha", "a")).unwrap();
-        store.store(make_memory("beta", "b")).unwrap();
-        store.store(make_memory("alpha", "c")).unwrap();
-        let topics = store.list_topics().unwrap();
-        assert_eq!(topics.len(), 2);
-    }
-
-    #[test]
-    fn test_stats_multi_topic() {
-        let store = test_store();
-        store.store(make_memory("t1", "one")).unwrap();
-        store.store(make_memory("t2", "two")).unwrap();
-        let stats = store.stats().unwrap();
-        assert_eq!(stats.total_memories, 2);
-        assert_eq!(stats.total_topics, 2);
-    }
-
-    #[test]
-    fn test_get_by_topic_prefix() {
-        let store = test_store();
-        store
-            .store(make_memory("project:web", "web stuff"))
-            .unwrap();
-        store
-            .store(make_memory("project:api", "api stuff"))
-            .unwrap();
-        store.store(make_memory("other", "unrelated")).unwrap();
-        let results = store.get_by_topic_prefix("project:*").unwrap();
-        assert_eq!(results.len(), 2);
-    }
-
-    // ── expand_with_neighbors ────────────────────────────────────────────
-
-    #[test]
-    fn test_expand_with_neighbors_brings_hop_1() {
-        let store = test_store();
-        // Create 3 memories. m1 is a direct query hit; m2 and m3 are
-        // related to m1 via related_ids; m3 is unrelated.
-        let mut m1 = make_memory("decisions", "primary hit");
-        let mut m2 = make_memory("decisions", "related neighbor");
-        let m3 = make_memory("unrelated", "far away");
-
-        // Set up the edges before storing.
-        m1.related_ids.push(m2.id.clone());
-        m2.related_ids.push(m1.id.clone());
-
-        let id1 = store.store(m1.clone()).unwrap();
-        let _id2 = store.store(m2.clone()).unwrap();
-        let _id3 = store.store(m3.clone()).unwrap();
-
-        let m1_full = store.get(&id1).unwrap().unwrap();
-        let initial = vec![(m1_full, 0.9_f32)];
-
-        let expanded = store.expand_with_neighbors(&initial, 5, 0.5, 10).unwrap();
-
-        assert_eq!(expanded.len(), 2, "primary + 1 neighbor");
-        assert!(expanded.iter().any(|(m, _)| m.id == m1.id));
-        assert!(
-            expanded.iter().any(|(m, _)| m.id == m2.id),
-            "neighbor should be pulled in"
-        );
-        assert!(
-            expanded.iter().all(|(m, _)| m.id != m3.id),
-            "unrelated memory must not be pulled in: {expanded:?}"
-        );
-    }
-
-    #[test]
-    fn test_expand_with_neighbors_dedupes_initial() {
-        let store = test_store();
-        let mut m1 = make_memory("t", "hit 1");
-        let mut m2 = make_memory("t", "hit 2");
-        m1.related_ids.push(m2.id.clone());
-        m2.related_ids.push(m1.id.clone());
-
-        let id1 = store.store(m1.clone()).unwrap();
-        let id2 = store.store(m2.clone()).unwrap();
-
-        // Both already in the initial set — no neighbor to add.
-        let m1_full = store.get(&id1).unwrap().unwrap();
-        let m2_full = store.get(&id2).unwrap().unwrap();
-        let initial = vec![(m1_full, 0.9_f32), (m2_full, 0.85_f32)];
-
-        let expanded = store.expand_with_neighbors(&initial, 5, 0.5, 10).unwrap();
-        assert_eq!(expanded.len(), 2, "no duplicates when both already present");
-    }
-
-    #[test]
-    fn test_expand_with_neighbors_respects_max_neighbors() {
-        let store = test_store();
-        // m1 has 5 neighbors. Cap max_neighbors at 2.
-        let mut m1 = make_memory("t", "hub");
-        let n1 = make_memory("t", "neighbor 1");
-        let n2 = make_memory("t", "neighbor 2");
-        let n3 = make_memory("t", "neighbor 3");
-        let n4 = make_memory("t", "neighbor 4");
-        let n5 = make_memory("t", "neighbor 5");
-        m1.related_ids.extend([
-            n1.id.clone(),
-            n2.id.clone(),
-            n3.id.clone(),
-            n4.id.clone(),
-            n5.id.clone(),
-        ]);
-
-        let id1 = store.store(m1.clone()).unwrap();
-        for n in [&n1, &n2, &n3, &n4, &n5] {
-            store.store(n.clone()).unwrap();
-        }
-
-        let m1_full = store.get(&id1).unwrap().unwrap();
-        let initial = vec![(m1_full, 0.9_f32)];
-
-        let expanded = store.expand_with_neighbors(&initial, 2, 0.5, 10).unwrap();
-        // 1 primary + 2 neighbors = 3.
-        assert_eq!(expanded.len(), 3);
-    }
-
-    #[test]
-    fn test_expand_with_neighbors_applies_discount() {
-        let store = test_store();
-        let mut m1 = make_memory("t", "primary");
-        let m2 = make_memory("t", "neighbor");
-        m1.related_ids.push(m2.id.clone());
-
-        let id1 = store.store(m1.clone()).unwrap();
-        store.store(m2.clone()).unwrap();
-
-        let m1_full = store.get(&id1).unwrap().unwrap();
-        let initial = vec![(m1_full, 0.9_f32)];
-
-        let expanded = store.expand_with_neighbors(&initial, 5, 0.5, 10).unwrap();
-
-        // Find neighbor score: should be 0.9 * 0.5 = 0.45
-        let neighbor_score = expanded
-            .iter()
-            .find(|(m, _)| m.id == m2.id)
-            .map(|(_, s)| *s)
-            .unwrap();
-        assert!(
-            (neighbor_score - 0.45).abs() < 1e-5,
-            "neighbor discount wrong: {neighbor_score}"
-        );
-    }
-
-    #[test]
-    fn test_expand_with_neighbors_respects_max_total() {
-        let store = test_store();
-        // 3 primaries + 3 neighbors, but max_total=4 caps output.
-        let mut m1 = make_memory("t", "p1");
-        let mut m2 = make_memory("t", "p2");
-        let mut m3 = make_memory("t", "p3");
-        let n1 = make_memory("t", "n1");
-        let n2 = make_memory("t", "n2");
-        let n3 = make_memory("t", "n3");
-        m1.related_ids.push(n1.id.clone());
-        m2.related_ids.push(n2.id.clone());
-        m3.related_ids.push(n3.id.clone());
-
-        let id1 = store.store(m1.clone()).unwrap();
-        let id2 = store.store(m2.clone()).unwrap();
-        let id3 = store.store(m3.clone()).unwrap();
-        store.store(n1).unwrap();
-        store.store(n2).unwrap();
-        store.store(n3).unwrap();
-
-        let initial = vec![
-            (store.get(&id1).unwrap().unwrap(), 0.9),
-            (store.get(&id2).unwrap().unwrap(), 0.85),
-            (store.get(&id3).unwrap().unwrap(), 0.8),
-        ];
-
-        let expanded = store.expand_with_neighbors(&initial, 5, 0.5, 4).unwrap();
-        assert_eq!(expanded.len(), 4, "must respect max_total cap");
-        // Top scorer remains first.
-        assert!((expanded[0].1 - 0.9).abs() < 1e-5);
-    }
-
-    #[test]
-    fn test_expand_with_neighbors_empty_initial_passthrough() {
-        let store = test_store();
-        let expanded = store.expand_with_neighbors(&[], 5, 0.5, 10).unwrap();
-        assert!(expanded.is_empty());
-    }
-
-    #[test]
-    fn test_expand_with_neighbors_zero_neighbors_disables() {
-        let store = test_store();
-        let mut m1 = make_memory("t", "primary");
-        let m2 = make_memory("t", "would-be neighbor");
-        m1.related_ids.push(m2.id.clone());
-
-        let id1 = store.store(m1.clone()).unwrap();
-        store.store(m2).unwrap();
-
-        let initial = vec![(store.get(&id1).unwrap().unwrap(), 0.9)];
-        let expanded = store.expand_with_neighbors(&initial, 0, 0.5, 10).unwrap();
-        assert_eq!(expanded.len(), 1, "max_neighbors=0 disables expansion");
-    }
-
-    #[test]
-    fn test_expand_with_neighbors_skips_missing_targets() {
-        let store = test_store();
-        // m1 points to a ghost id that no longer exists (e.g., deleted).
-        let mut m1 = make_memory("t", "has ghost link");
-        m1.related_ids.push("01GHOSTID".into());
-        let id1 = store.store(m1.clone()).unwrap();
-
-        let initial = vec![(store.get(&id1).unwrap().unwrap(), 0.9)];
-        let expanded = store.expand_with_neighbors(&initial, 5, 0.5, 10).unwrap();
-        assert_eq!(expanded.len(), 1, "ghost link must be silently skipped");
-    }
-
-    // ── get_many (batched fetch) ─────────────────────────────────────────
-
-    #[test]
-    fn test_get_many_returns_requested_ids() {
-        let store = test_store();
-        let m1 = make_memory("t", "first");
-        let m2 = make_memory("t", "second");
-        let m3 = make_memory("t", "third");
-        let id1 = store.store(m1.clone()).unwrap();
-        let id2 = store.store(m2.clone()).unwrap();
-        store.store(m3).unwrap();
-
-        let got = store.get_many(&[id1.as_str(), id2.as_str()]).unwrap();
-        assert_eq!(got.len(), 2);
-        assert!(got.contains_key(&id1));
-        assert!(got.contains_key(&id2));
-    }
-
-    #[test]
-    fn test_get_many_empty_input_returns_empty() {
-        let store = test_store();
-        let got = store.get_many(&[]).unwrap();
-        assert!(got.is_empty());
-    }
-
-    #[test]
-    fn test_get_many_missing_ids_silently_dropped() {
-        let store = test_store();
-        let m1 = make_memory("t", "real");
-        let id1 = store.store(m1).unwrap();
-
-        let got = store.get_many(&[id1.as_str(), "01NONEXISTENT"]).unwrap();
-        assert_eq!(got.len(), 1);
-        assert!(got.contains_key(&id1));
-    }
-
-    #[test]
-    fn test_get_many_dedupes_input() {
-        let store = test_store();
-        let m1 = make_memory("t", "only");
-        let id1 = store.store(m1).unwrap();
-
-        // Same id three times — must not blow up the IN clause.
-        let got = store
-            .get_many(&[id1.as_str(), id1.as_str(), id1.as_str()])
-            .unwrap();
-        assert_eq!(got.len(), 1);
-    }
-
-    // ── LRU cache invalidation ────────────────────────────────────────────
-
-    #[test]
-    fn test_cache_serves_after_first_get() {
-        let store = test_store();
-        let m = make_memory("t", "original");
-        let id = store.store(m).unwrap();
-
-        // Warm the cache.
-        let first = store.get(&id).unwrap().unwrap();
-        assert_eq!(first.summary, "original");
-
-        // Mutate the row out-of-band so a stale cache hit would show.
-        store
-            .conn
-            .execute(
-                "UPDATE memories SET summary = 'mutated' WHERE id = ?1",
-                params![id],
-            )
-            .unwrap();
-
-        // Cache is unaware of the raw SQL write, so we should still
-        // see "original" — that's the proof the cache is serving reads.
-        let cached = store.get(&id).unwrap().unwrap();
-        assert_eq!(cached.summary, "original", "cache must serve hot reads");
-    }
-
-    #[test]
-    fn test_update_invalidates_cache() {
-        let store = test_store();
-        let m = make_memory("t", "v1");
-        let id = store.store(m).unwrap();
-
-        // Warm cache.
-        let _ = store.get(&id).unwrap();
-
-        // Proper update through the trait flushes the cache entry.
-        let mut updated = store.get(&id).unwrap().unwrap();
-        updated.summary = "v2".into();
-        store.update(&updated).unwrap();
-
-        let after = store.get(&id).unwrap().unwrap();
-        assert_eq!(after.summary, "v2");
-    }
-
-    #[test]
-    fn test_delete_invalidates_cache() {
-        let store = test_store();
-        let m = make_memory("t", "doomed");
-        let id = store.store(m).unwrap();
-
-        // Warm the cache, then delete.
-        let _ = store.get(&id).unwrap();
-        store.delete(&id).unwrap();
-
-        let after = store.get(&id).unwrap();
-        assert!(after.is_none(), "deleted memory must not survive in cache");
-    }
-
-    #[test]
-    fn test_apply_decay_clears_cache() {
-        let store = test_store();
-        let m1 = make_memory("t", "a");
-        let m2 = make_memory("t", "b");
-        let id1 = store.store(m1).unwrap();
-        let id2 = store.store(m2).unwrap();
-
-        // Warm cache for both.
-        let before1 = store.get(&id1).unwrap().unwrap().weight;
-        let _ = store.get(&id2).unwrap();
-
-        store.apply_decay(0.5).unwrap();
-
-        // After decay, cache must have been wiped, so the next read
-        // returns the decayed weight from disk.
-        let after1 = store.get(&id1).unwrap().unwrap().weight;
-        assert!(
-            after1 < before1,
-            "post-decay weight should reflect DB, not stale cache (before={before1}, after={after1})"
-        );
-    }
-
-    #[test]
-    fn test_get_many_uses_cache_for_warm_ids() {
-        let store = test_store();
-        let m = make_memory("t", "warm");
-        let id = store.store(m).unwrap();
-
-        // Warm the cache via single get.
-        let _ = store.get(&id).unwrap();
-
-        // Out-of-band mutate — cached value should still be served by
-        // get_many for this id.
-        store
-            .conn
-            .execute(
-                "UPDATE memories SET summary = 'mutated' WHERE id = ?1",
-                params![id],
-            )
-            .unwrap();
-
-        let got = store.get_many(&[id.as_str()]).unwrap();
-        assert_eq!(got.get(&id).unwrap().summary, "warm");
-    }
-
-    // ── content-hash dedup ───────────────────────────────────────────────
-
-    #[test]
-    fn test_dedup_same_topic_summary_collapses() {
-        let store = test_store();
-        let m1 = make_memory("dedup", "Use Turso for cloud sync");
-        let m2 = make_memory("dedup", "Use Turso for cloud sync"); // identical content
-        let id1 = store.store(m1).unwrap();
-        let id2 = store.store(m2).unwrap();
-        // Both calls return the SAME id (the first row's). Second store
-        // is a no-op at the DB level, but the contract still returns an
-        // id pointing at a real row.
-        assert_eq!(id1, id2, "dedup must return the existing row's id");
-        assert_eq!(store.count().unwrap(), 1, "only one row in memories");
-    }
-
-    #[test]
-    fn test_dedup_normalizes_whitespace_and_case() {
-        let store = test_store();
-        let m1 = make_memory("DEDUP", "Use   Turso   for cloud sync");
-        let m2 = make_memory("dedup", "use turso for cloud sync");
-        let id1 = store.store(m1).unwrap();
-        let id2 = store.store(m2).unwrap();
-        assert_eq!(id1, id2);
-        assert_eq!(store.count().unwrap(), 1);
-    }
-
-    /// Audit regression: SQLite's built-in `LOWER()` is ASCII-only and does
-    /// not fold 'É' → 'é', while `summary_hash` uses Rust's Unicode-correct
-    /// `to_lowercase()`. Two topics that differ only in the case of an
-    /// accented letter must still dedup — this used to fail because the
-    /// (now-removed) `LOWER(topic)` index column and SELECT comparison
-    /// disagreed with the hash's own case-folding.
-    #[test]
-    fn test_dedup_normalizes_accented_case() {
-        let store = test_store();
-        let m1 = make_memory("Décisions", "on utilise Turso pour la synchro");
-        let m2 = make_memory("DÉCISIONS", "on utilise Turso pour la synchro");
-        let id1 = store.store(m1).unwrap();
-        let id2 = store.store(m2).unwrap();
-        assert_eq!(
-            id1, id2,
-            "accented topics differing only in case must dedup to the same row"
-        );
-        assert_eq!(store.count().unwrap(), 1);
-    }
-
-    #[test]
-    fn test_dedup_different_topic_keeps_both() {
-        let store = test_store();
-        let m1 = make_memory("topic-a", "shared body");
-        let m2 = make_memory("topic-b", "shared body");
-        let id1 = store.store(m1).unwrap();
-        let id2 = store.store(m2).unwrap();
-        assert_ne!(id1, id2, "different topic = different row");
-        assert_eq!(store.count().unwrap(), 2);
-    }
-
-    #[test]
-    fn test_store_is_atomic() {
-        let store = test_store();
-        let mut mem = make_memory("atomic", "test atomicity");
-        mem.embedding = Some(vec![0.1; 384]);
-        let id = mem.id.clone();
-
-        store.store(mem).unwrap();
-
-        // Verify main table has the row
-        let retrieved = store.get(&id).unwrap().unwrap();
-        assert_eq!(retrieved.summary, "test atomicity");
-
-        // Verify vec_memories also has the row
-        let vec_count: i64 = store
-            .conn
-            .query_row(
-                "SELECT count(*) FROM vec_memories WHERE memory_id = ?1",
-                params![id],
-                |row| row.get(0),
-            )
-            .unwrap();
-        assert_eq!(vec_count, 1);
-    }
-
-    #[test]
-    fn test_busy_timeout_pragma() {
-        // Audit #185 M: 6/20 parallel hook handlers timed out at the
-        // previous 5s busy_timeout. Bumping to 30s covers realistic
-        // burst-write contention (large transcript extraction triggers
-        // many writes on PreCompact/SessionEnd) without hiding genuine
-        // lock issues — anyone holding a write lock for >30s has a
-        // real bug worth surfacing.
-        let store = test_store();
-        let timeout: i64 = store
-            .conn
-            .query_row("PRAGMA busy_timeout", [], |row| row.get(0))
-            .unwrap();
-        assert_eq!(timeout, 30000);
-    }
-
-    #[test]
-    fn test_fts_sanitize_utf8_safe() {
-        // Build a string with multibyte chars near the 10k boundary.
-        // Each emoji is 4 bytes. Fill up to just past 10_000 bytes.
-        let base = "a".repeat(9_998);
-        // Add a 4-byte emoji that straddles the 10_000 boundary
-        let input = format!("{base}\u{1F600}\u{1F600}"); // 9998 + 4 + 4 = 10006 bytes
-        assert!(input.len() > 10_000);
-
-        // This should not panic (the old code could split a UTF-8 char)
-        let result = sanitize_fts_query(&input);
-        // The result should be valid UTF-8 (it's a String, so it is by construction)
-        assert!(!result.is_empty());
-        // The truncated input should not contain partial emoji
-        // (9998 + 4 = 10002 > 10000, so the emoji at 9998 is excluded; end = 9998)
-        // Result should just be the 'a' tokens
-    }
-
-    #[test]
-    fn test_forget_topic() {
-        let store = test_store();
-
-        // Create 3 memories in topic "ephemeral"
-        for i in 0..3 {
-            let m = make_memory("ephemeral", &format!("item {i}"));
-            store.store(m).unwrap();
-        }
-
-        // Verify they exist
-        let before = store.get_by_topic("ephemeral").unwrap();
-        assert_eq!(before.len(), 3);
-
-        // Delete all memories in the topic
-        for m in &before {
-            store.delete(&m.id).unwrap();
-        }
-
-        // Verify 0 remain
-        let after = store.get_by_topic("ephemeral").unwrap();
-        assert!(after.is_empty());
-    }
-
-    // === TranscriptStore tests ===
-
-    #[test]
-    fn test_transcript_create_session_and_record() {
-        let store = test_store();
-        let sid = store
-            .create_session("claude-code", Some("proj"), None)
-            .unwrap();
-        assert!(!sid.is_empty());
-
-        let mid = store
-            .record_message(&sid, Role::User, "hello world", None, None, None)
-            .unwrap();
-        assert!(!mid.is_empty());
-
-        let msgs = store.list_session_messages(&sid, 10, 0).unwrap();
-        assert_eq!(msgs.len(), 1);
-        assert_eq!(msgs[0].content, "hello world");
-        assert_eq!(msgs[0].role, Role::User);
-    }
-
-    /// Issue #272 perf invariant: FTS5 search across a few thousand
-    /// archived messages must stay sub-second. The bench keeps the
-    /// budget loose so CI noise doesn't flake; the goal is a regression
-    /// bell, not microbenchmarking.
-    #[test]
-    fn perf_session_archive_search_2k_messages() {
-        let store = test_store();
-        let sid = store
-            .ensure_session("perf-sess", "claude-code", Some("icm"), None)
-            .unwrap();
-        for i in 0..2_000 {
-            // Sprinkle the keyword into ~1% of messages so search
-            // returns something but doesn't degenerate to a full scan.
-            let body = if i % 100 == 0 {
-                format!("turbofish needle hit {i}")
-            } else {
-                format!("filler payload number {i}")
-            };
-            store
-                .record_message(&sid, Role::User, &body, None, None, None)
-                .unwrap();
-        }
-        let start = std::time::Instant::now();
-        let hits = store
-            .search_transcripts("turbofish", None, None, 50)
-            .unwrap();
-        let elapsed = start.elapsed();
-        assert!(
-            hits.len() >= 10,
-            "expected at least 10 hits, got {}",
-            hits.len()
-        );
-        assert!(
-            elapsed.as_millis() < 1500,
-            "search across 2k archived messages took {}ms (budget 1500ms)",
-            elapsed.as_millis(),
-        );
-    }
-
-    // === FactsStore tests (issue #273) ===
-
-    #[test]
-    fn test_facts_set_and_get_roundtrip() {
-        let store = test_store();
-        let id = store
-            .set_fact("project:icm", "gcp.project", "rtk-ai-labs-01", "cli")
-            .unwrap();
-        assert!(!id.is_empty());
-
-        let f = store
-            .get_fact("project:icm", "gcp.project")
-            .unwrap()
-            .expect("active fact must exist");
-        assert_eq!(f.value, "rtk-ai-labs-01");
-        assert_eq!(f.source, "cli");
-        assert!(f.is_active());
-    }
-
-    #[test]
-    fn test_facts_set_same_value_is_noop() {
-        let store = test_store();
-        let id1 = store.set_fact("e", "k", "v", "src").unwrap();
-        let id2 = store.set_fact("e", "k", "v", "src2").unwrap();
-        assert_eq!(id1, id2, "same value re-asserted must NOT create a new row");
-        let history = store.history("e", "k").unwrap();
-        assert_eq!(history.len(), 1);
-        // Source is NOT updated by the no-op (intentional: avoids
-        // creating noise just because the same fact was re-asserted
-        // from a different surface).
-        assert_eq!(history[0].source, "src");
-    }
-
-    #[test]
-    fn test_facts_supersede_keeps_history() {
-        let store = test_store();
-        let id1 = store
-            .set_fact("project:icm", "version", "0.10.51", "release-please")
-            .unwrap();
-        let id2 = store
-            .set_fact("project:icm", "version", "0.10.52", "release-please")
-            .unwrap();
-        assert_ne!(id1, id2);
-
-        let active = store
-            .get_fact("project:icm", "version")
-            .unwrap()
-            .expect("active fact must exist after supersession");
-        assert_eq!(active.value, "0.10.52");
-        assert!(active.is_active());
-
-        let history = store.history("project:icm", "version").unwrap();
-        assert_eq!(history.len(), 2);
-        // History returned newest-first.
-        assert_eq!(history[0].value, "0.10.52");
-        assert!(history[0].is_active());
-        assert_eq!(history[1].value, "0.10.51");
-        assert!(!history[1].is_active(), "older row must be superseded");
-    }
-
-    #[test]
-    fn test_facts_list_by_entity_alpha_sorted() {
-        let store = test_store();
-        store
-            .set_fact("host:db", "owner", "ops-team", "cli")
-            .unwrap();
-        store
-            .set_fact("host:db", "deploy.region", "europe-west1", "cli")
-            .unwrap();
-        store.set_fact("host:db", "cpu.cores", "16", "cli").unwrap();
-        store
-            .set_fact("host:web", "owner", "ui-team", "cli")
-            .unwrap();
-
-        let all = store.list_facts("host:db", None).unwrap();
-        let keys: Vec<&str> = all.iter().map(|f| f.key.as_str()).collect();
-        assert_eq!(keys, vec!["cpu.cores", "deploy.region", "owner"]);
-        // Other entity NOT included.
-        assert!(all.iter().all(|f| f.entity == "host:db"));
-    }
-
-    #[test]
-    fn test_facts_list_prefix_filter() {
-        let store = test_store();
-        store
-            .set_fact("svc:api", "deploy.region", "europe-west1", "cli")
-            .unwrap();
-        store
-            .set_fact("svc:api", "deploy.replicas", "3", "cli")
-            .unwrap();
-        store
-            .set_fact("svc:api", "owner", "platform-team", "cli")
-            .unwrap();
-
-        let deploys = store.list_facts("svc:api", Some("deploy.")).unwrap();
-        assert_eq!(deploys.len(), 2);
-        assert!(deploys.iter().all(|f| f.key.starts_with("deploy.")));
-    }
-
-    #[test]
-    fn test_facts_forget_drops_history_too() {
-        let store = test_store();
-        store.set_fact("e", "k", "v1", "cli").unwrap();
-        store.set_fact("e", "k", "v2", "cli").unwrap();
-        let n = store.forget_fact("e", "k").unwrap();
-        assert_eq!(n, 2, "must delete both active and superseded rows");
-        assert!(store.get_fact("e", "k").unwrap().is_none());
-        assert!(store.history("e", "k").unwrap().is_empty());
-    }
-
-    #[test]
-    fn test_facts_stats_breakdown() {
-        let store = test_store();
-        store.set_fact("e1", "a", "1", "cli").unwrap();
-        store.set_fact("e1", "b", "2", "cli").unwrap();
-        store.set_fact("e2", "a", "3", "cli").unwrap();
-        // Supersede e1.a — history grows, active stays the same.
-        store.set_fact("e1", "a", "1-bis", "cli").unwrap();
-
-        let stats = store.facts_stats().unwrap();
-        assert_eq!(stats.active_count, 3, "3 active slots");
-        assert_eq!(stats.total_count, 4, "4 rows including superseded");
-        assert_eq!(stats.distinct_entities, 2);
-        let top: Vec<&str> = stats.top_entities.iter().map(|(e, _)| e.as_str()).collect();
-        assert!(top.contains(&"e1") && top.contains(&"e2"));
-    }
-
-    #[test]
-    fn test_facts_rejects_empty_entity_or_key() {
-        let store = test_store();
-        assert!(store.set_fact("", "k", "v", "cli").is_err());
-        assert!(store.set_fact("e", "", "v", "cli").is_err());
-    }
-
-    /// Issue #273 perf invariant: primary-key lookup must stay
-    /// sub-millisecond even at 10k facts. Loose budget so CI runners
-    /// don't flake.
-    #[test]
-    fn perf_facts_get_at_10k_under_5ms() {
-        let store = test_store();
-        for i in 0..10_000 {
-            let entity = format!("entity:{}", i % 100);
-            let key = format!("key.{i}");
-            store
-                .set_fact(&entity, &key, &format!("val-{i}"), "bench")
-                .unwrap();
-        }
-        let start = std::time::Instant::now();
-        for _ in 0..1_000 {
-            let _ = store.get_fact("entity:42", "key.42").unwrap();
-        }
-        let elapsed = start.elapsed();
-        let per_lookup_us = elapsed.as_micros() / 1_000;
-        // 5ms / lookup in debug mode — generous; release is well
-        // under 1ms.
-        assert!(
-            per_lookup_us < 5_000,
-            "facts.get averaged {per_lookup_us}us / lookup over 1k iters (budget 5000us)",
-        );
-    }
-
-    /// Issue #272: `ensure_session` must be idempotent so repeated
-    /// hook fires keyed by the same external `session_id` land under
-    /// one row, not N.
-    #[test]
-    fn test_ensure_session_is_idempotent() {
-        let store = test_store();
-        let external_id = "claude-sess-abc-123";
-        let id1 = store
-            .ensure_session(external_id, "claude-code", Some("icm"), None)
-            .unwrap();
-        assert_eq!(id1, external_id);
-
-        // Re-call with the same id — must NOT create a new row.
-        let id2 = store
-            .ensure_session(external_id, "claude-code", Some("icm"), None)
-            .unwrap();
-        assert_eq!(id2, external_id);
-
-        let sessions = store.list_sessions(Some("icm"), 10).unwrap();
-        assert_eq!(
-            sessions.len(),
-            1,
-            "ensure_session must be idempotent, got: {sessions:?}",
-        );
-        assert_eq!(sessions[0].id, external_id);
-
-        // Recording into the same id works.
-        store
-            .record_message(external_id, Role::User, "first turn", None, None, None)
-            .unwrap();
-        store
-            .record_message(
-                external_id,
-                Role::Tool,
-                "tool out",
-                Some("bash"),
-                None,
-                None,
-            )
-            .unwrap();
-        let msgs = store.list_session_messages(external_id, 10, 0).unwrap();
-        assert_eq!(msgs.len(), 2);
-    }
-
-    #[test]
-    fn test_transcript_record_into_missing_session_fails() {
-        let store = test_store();
-        let err = store
-            .record_message("nonexistent", Role::User, "hi", None, None, None)
-            .unwrap_err();
-        assert!(err.to_string().to_lowercase().contains("session"));
-    }
-
-    #[test]
-    fn test_transcript_search_fts5_boolean_and_phrase() {
-        let store = test_store();
-        let sid = store
-            .create_session("cli", Some("db-debate"), None)
-            .unwrap();
-        store
-            .record_message(
-                &sid,
-                Role::Assistant,
-                "Postgres 16 supports JSONB and BRIN indexes natively.",
-                None,
-                None,
-                None,
-            )
-            .unwrap();
-        store
-            .record_message(
-                &sid,
-                Role::Assistant,
-                "MySQL lacks BRIN; its JSON type is stored differently.",
-                None,
-                None,
-                None,
-            )
-            .unwrap();
-        store
-            .record_message(&sid, Role::User, "Et SQLite ?", None, None, None)
-            .unwrap();
-
-        // Boolean OR
-        let hits = store
-            .search_transcripts("postgres OR mysql", None, None, 10)
-            .unwrap();
-        assert_eq!(hits.len(), 2);
-
-        // Exact phrase
-        let phrase_hits = store
-            .search_transcripts("\"BRIN indexes\"", None, None, 10)
-            .unwrap();
-        assert_eq!(phrase_hits.len(), 1);
-        assert!(phrase_hits[0].message.content.contains("Postgres"));
-    }
-
-    /// Audit regression: `search_transcripts` bound the raw query straight
-    /// to `messages_fts MATCH ?1` with no handling for malformed FTS5
-    /// syntax. A trailing boolean operator or an unbalanced paren threw a
-    /// raw sqlite error instead of degrading gracefully to "no results" —
-    /// while still preserving valid FTS5 syntax (see the OR/phrase test
-    /// above), which a blanket `sanitize_fts_query` call would have broken.
-    #[test]
-    fn test_transcript_search_malformed_fts5_query_degrades_gracefully() {
-        let store = test_store();
-        let sid = store.create_session("cli", None, None).unwrap();
-        store
-            .record_message(&sid, Role::User, "hello world", None, None, None)
-            .unwrap();
-
-        for bad_query in ["hello AND", "(hello", "hello OR OR"] {
-            let result = store.search_transcripts(bad_query, None, None, 10);
-            assert!(
-                result.is_ok(),
-                "malformed FTS5 query {bad_query:?} must not error: {result:?}"
-            );
-            assert!(result.unwrap().is_empty());
-        }
-    }
-
-    #[test]
-    fn test_transcript_search_scoped_by_session_and_project() {
-        let store = test_store();
-        let s1 = store.create_session("cli", Some("alpha"), None).unwrap();
-        let s2 = store.create_session("cli", Some("beta"), None).unwrap();
-        store
-            .record_message(&s1, Role::User, "alpha wants postgres", None, None, None)
-            .unwrap();
-        store
-            .record_message(&s2, Role::User, "beta wants postgres", None, None, None)
-            .unwrap();
-
-        // Global search returns both
-        let all = store
-            .search_transcripts("postgres", None, None, 10)
-            .unwrap();
-        assert_eq!(all.len(), 2);
-
-        // Session filter
-        let only_s1 = store
-            .search_transcripts("postgres", Some(&s1), None, 10)
-            .unwrap();
-        assert_eq!(only_s1.len(), 1);
-        assert_eq!(only_s1[0].message.session_id, s1);
-
-        // Project filter
-        let only_beta = store
-            .search_transcripts("postgres", None, Some("beta"), 10)
-            .unwrap();
-        assert_eq!(only_beta.len(), 1);
-        assert_eq!(only_beta[0].session.project.as_deref(), Some("beta"));
-    }
-
-    #[test]
-    fn test_transcript_stats_breakdown() {
-        let store = test_store();
-        let s = store.create_session("claude-code", None, None).unwrap();
-        store
-            .record_message(&s, Role::User, "q", None, None, None)
-            .unwrap();
-        store
-            .record_message(&s, Role::Assistant, "a", None, None, None)
-            .unwrap();
-        store
-            .record_message(&s, Role::Tool, "{}", Some("Bash"), Some(10), None)
-            .unwrap();
-
-        let stats = store.transcript_stats().unwrap();
-        assert_eq!(stats.total_sessions, 1);
-        assert_eq!(stats.total_messages, 3);
-        assert!(stats.total_bytes > 0);
-        assert_eq!(stats.by_role.len(), 3);
-        assert!(stats.by_agent.iter().any(|(a, _)| a == "claude-code"));
-        assert_eq!(stats.top_sessions.len(), 1);
-        assert_eq!(stats.top_sessions[0].1, 3);
-    }
-
-    #[test]
-    fn test_transcript_forget_cascade_deletes_messages() {
-        let store = test_store();
-        let s = store.create_session("cli", None, None).unwrap();
-        for i in 0..5 {
-            store
-                .record_message(&s, Role::User, &format!("msg {i}"), None, None, None)
-                .unwrap();
-        }
-
-        store.forget_session(&s).unwrap();
-
-        assert!(store.get_session(&s).unwrap().is_none());
-        let msgs = store.list_session_messages(&s, 100, 0).unwrap();
-        assert!(msgs.is_empty());
-    }
-
-    #[test]
-    fn test_transcript_list_sessions_sorted_by_updated() {
-        let store = test_store();
-        let a = store.create_session("cli", Some("p"), None).unwrap();
-        let b = store.create_session("cli", Some("p"), None).unwrap();
-        // Bump `a` by recording a message (updates its updated_at)
-        store
-            .record_message(&a, Role::User, "bump", None, None, None)
-            .unwrap();
-
-        let list = store.list_sessions(Some("p"), 10).unwrap();
-        assert_eq!(list.len(), 2);
-        assert_eq!(list[0].id, a); // most recently updated first
-        assert_eq!(list[1].id, b);
-    }
-
-    #[test]
-    fn test_transcript_messages_chronological() {
-        let store = test_store();
-        let s = store.create_session("cli", None, None).unwrap();
-        let ids: Vec<_> = (0..3)
-            .map(|i| {
-                store
-                    .record_message(&s, Role::User, &format!("{i}"), None, None, None)
-                    .unwrap()
-            })
-            .collect();
-
-        let msgs = store.list_session_messages(&s, 10, 0).unwrap();
-        let got: Vec<_> = msgs.iter().map(|m| m.id.clone()).collect();
-        assert_eq!(got, ids);
-    }
-
-    // ── Hook telemetry ─────────────────────────────────────────────────
-
-    fn insert(event: &str, duration_ms: i64, exit_code: i32) -> HookEventInsert {
-        HookEventInsert {
-            event: event.into(),
-            project: None,
-            session_id: None,
-            tool_name: None,
-            duration_ms: Some(duration_ms),
-            exit_code,
-            payload_size: None,
-            note: None,
-        }
-    }
-
-    #[test]
-    fn test_record_hook_event_persists() {
-        let store = test_store();
-        let id = store.record_hook_event(&insert("post", 12, 0)).unwrap();
-        assert!(id > 0);
-        assert_eq!(store.hook_event_count().unwrap(), 1);
-    }
-
-    #[test]
-    fn test_hook_events_recent_orders_newest_first_and_filters() {
-        let store = test_store();
-        store.record_hook_event(&insert("post", 10, 0)).unwrap();
-        store.record_hook_event(&insert("end", 9, 0)).unwrap();
-        store.record_hook_event(&insert("post", 20, 1)).unwrap();
-
-        let all = store.hook_events_recent(10, None).unwrap();
-        assert_eq!(all.len(), 3);
-        // Newest first: third insert wins position 0.
-        assert_eq!(all[0].event, "post");
-        assert_eq!(all[0].exit_code, 1);
-
-        let posts = store.hook_events_recent(10, Some("post")).unwrap();
-        assert_eq!(posts.len(), 2);
-        assert!(posts.iter().all(|r| r.event == "post"));
-
-        let ends = store.hook_events_recent(10, Some("end")).unwrap();
-        assert_eq!(ends.len(), 1);
-        assert_eq!(ends[0].duration_ms, Some(9));
-    }
-
-    #[test]
-    fn test_hook_stats_buckets_by_event_and_computes_percentiles() {
-        let store = test_store();
-        // post: durations [10, 20, 30] — p50=20, p99=30
-        store.record_hook_event(&insert("post", 10, 0)).unwrap();
-        store.record_hook_event(&insert("post", 20, 0)).unwrap();
-        store.record_hook_event(&insert("post", 30, 1)).unwrap();
-        // end: single 9ms success
-        store.record_hook_event(&insert("end", 9, 0)).unwrap();
-
-        // Use a wide window so all rows fall inside.
-        let cutoff = (chrono::Utc::now() - chrono::Duration::hours(1)).to_rfc3339();
-        let stats = store.hook_stats(&cutoff).unwrap();
-        let by_event: std::collections::HashMap<_, _> =
-            stats.into_iter().map(|r| (r.event.clone(), r)).collect();
-
-        let post = &by_event["post"];
-        assert_eq!(post.count, 3);
-        assert_eq!(post.error_count, 1);
-        assert_eq!(post.p50_duration_ms, 20);
-        assert_eq!(post.p99_duration_ms, 30);
-
-        let end = &by_event["end"];
-        assert_eq!(end.count, 1);
-        assert_eq!(end.error_count, 0);
-        assert_eq!(end.p50_duration_ms, 9);
-    }
-
-    #[test]
-    fn test_prune_hook_events_drops_old_rows_only() {
-        let store = test_store();
-        store.record_hook_event(&insert("post", 10, 0)).unwrap();
-        // Cutoff in the future → wipes everything.
-        let future = (chrono::Utc::now() + chrono::Duration::hours(1)).to_rfc3339();
-        let n = store.prune_hook_events(&future).unwrap();
-        assert_eq!(n, 1);
-        assert_eq!(store.hook_event_count().unwrap(), 0);
-
-        // Re-insert, then prune with a past cutoff → keeps row.
-        store.record_hook_event(&insert("post", 10, 0)).unwrap();
-        let past = (chrono::Utc::now() - chrono::Duration::hours(1)).to_rfc3339();
-        let n = store.prune_hook_events(&past).unwrap();
-        assert_eq!(n, 0);
-        assert_eq!(store.hook_event_count().unwrap(), 1);
-    }
-
-    // ── code_areas (issue #196) ────────────────────────────────────────
-
-    #[test]
-    fn test_upsert_code_area_inserts_then_increments_touch_count() {
-        let store = test_store();
-        store
-            .upsert_code_area("proj", "src/foo.rs", None, Some("s1"), Some("Edit"))
-            .unwrap();
-        let after_first = store.list_code_areas(None, None, None, 10).unwrap();
-        assert_eq!(after_first.len(), 1);
-        assert_eq!(after_first[0].touch_count, 1);
-        assert_eq!(after_first[0].project, "proj");
-        assert_eq!(after_first[0].file_path, "src/foo.rs");
-
-        // Same path again — touch_count++ and last_touched_at updates.
-        let first_touched_at = after_first[0].first_touched_at;
-        store
-            .upsert_code_area("proj", "src/foo.rs", None, Some("s2"), Some("Write"))
-            .unwrap();
-        let after_second = store.list_code_areas(None, None, None, 10).unwrap();
-        assert_eq!(after_second.len(), 1, "no duplicate row on re-touch");
-        assert_eq!(after_second[0].touch_count, 2);
-        // first_touched_at is preserved across re-touches.
-        assert_eq!(after_second[0].first_touched_at, first_touched_at);
-        // session_id / tool_name are refreshed to the latest.
-        assert_eq!(after_second[0].session_id.as_deref(), Some("s2"));
-        assert_eq!(after_second[0].tool_name.as_deref(), Some("Write"));
-    }
-
-    #[test]
-    fn test_upsert_code_area_preserves_existing_description_when_passed_none() {
-        let store = test_store();
-        store
-            .upsert_code_area("proj", "f.rs", Some("initial note"), None, None)
-            .unwrap();
-        store
-            .upsert_code_area("proj", "f.rs", None, None, None)
-            .unwrap();
-        let rows = store.list_code_areas(None, None, None, 10).unwrap();
-        assert_eq!(rows.len(), 1);
-        assert_eq!(rows[0].description.as_deref(), Some("initial note"));
-    }
-
-    #[test]
-    fn test_upsert_code_area_overwrites_description_when_passed_some() {
-        let store = test_store();
-        store
-            .upsert_code_area("proj", "f.rs", Some("v1"), None, None)
-            .unwrap();
-        store
-            .upsert_code_area("proj", "f.rs", Some("v2"), None, None)
-            .unwrap();
-        let rows = store.list_code_areas(None, None, None, 10).unwrap();
-        assert_eq!(rows[0].description.as_deref(), Some("v2"));
-    }
-
-    #[test]
-    fn test_list_code_areas_filters_by_project_and_path_suffix() {
-        let store = test_store();
-        store
-            .upsert_code_area("alpha", "src/a.rs", None, None, None)
-            .unwrap();
-        store
-            .upsert_code_area("alpha", "src/b.rs", None, None, None)
-            .unwrap();
-        store
-            .upsert_code_area("beta", "src/a.rs", None, None, None)
-            .unwrap();
-
-        let only_alpha = store
-            .list_code_areas(Some("alpha"), None, None, 10)
-            .unwrap();
-        assert_eq!(only_alpha.len(), 2);
-
-        // Suffix match catches both alpha/src/a.rs and beta/src/a.rs.
-        let any_a = store
-            .list_code_areas(None, Some("src/a.rs"), None, 10)
-            .unwrap();
-        assert_eq!(any_a.len(), 2);
-        for r in &any_a {
-            assert!(r.file_path.ends_with("src/a.rs"));
-        }
-
-        // Project + path combine.
-        let alpha_a = store
-            .list_code_areas(Some("alpha"), Some("src/a.rs"), None, 10)
-            .unwrap();
-        assert_eq!(alpha_a.len(), 1);
-        assert_eq!(alpha_a[0].project, "alpha");
-    }
-
-    #[test]
-    fn test_list_code_areas_filters_by_since_timestamp() {
-        let store = test_store();
-        store
-            .upsert_code_area("p", "old.rs", None, None, None)
-            .unwrap();
-        // Cutoff one hour ahead skips everything we just inserted.
-        let cutoff = chrono::Utc::now() + chrono::Duration::hours(1);
-        let after = store.list_code_areas(None, None, Some(cutoff), 10).unwrap();
-        assert!(after.is_empty());
-        // Cutoff one hour behind keeps the row.
-        let past = chrono::Utc::now() - chrono::Duration::hours(1);
-        let after = store.list_code_areas(None, None, Some(past), 10).unwrap();
-        assert_eq!(after.len(), 1);
-    }
-
-    #[test]
-    fn test_list_code_areas_orders_by_last_touched_desc() {
-        let store = test_store();
-        store
-            .upsert_code_area("p", "first.rs", None, None, None)
-            .unwrap();
-        // Sleep so the second insert lands at a strictly later second.
-        std::thread::sleep(std::time::Duration::from_millis(1100));
-        store
-            .upsert_code_area("p", "second.rs", None, None, None)
-            .unwrap();
-        let rows = store.list_code_areas(None, None, None, 10).unwrap();
-        assert_eq!(rows.len(), 2);
-        assert_eq!(rows[0].file_path, "second.rs");
-        assert_eq!(rows[1].file_path, "first.rs");
-    }
-
-    #[test]
-    fn test_code_area_count_matches_unique_paths() {
-        let store = test_store();
-        assert_eq!(store.code_area_count().unwrap(), 0);
-        store
-            .upsert_code_area("p", "f.rs", None, None, None)
-            .unwrap();
-        store
-            .upsert_code_area("p", "f.rs", None, None, None)
-            .unwrap(); // re-touch
-        store
-            .upsert_code_area("p", "g.rs", None, None, None)
-            .unwrap();
-        assert_eq!(store.code_area_count().unwrap(), 2);
-    }
-}
diff --git a/crates/icm-store/src/store/cache.rs b/crates/icm-store/src/store/cache.rs
new file mode 100644
index 00000000..481085fb
--- /dev/null
+++ b/crates/icm-store/src/store/cache.rs
@@ -0,0 +1,53 @@
+//! SQLite backend — split out of the former monolithic `store.rs`.
+//!
+//! `SqliteStore` and the shared row/parse helpers live in `super`
+//! (`store/mod.rs`); each submodule here holds one trait impl (or a
+//! coherent group of inherent methods) on that type.
+
+use super::*;
+
+/// In-process LRU cache size for hot memories. Each entry is one
+/// fully-hydrated `Memory` (incl. optional 384×f32 embedding ≈ 1.5KB),
+/// so 256 entries cap RAM at ~400KB worst case. Helps long-running
+/// processes (`icm serve`, TUI) where the same memories are read
+/// repeatedly; zero benefit in one-shot CLI invocations beyond the
+/// single recall flow.
+pub(crate) const MEMORY_CACHE_CAP: usize = 256;
+
+impl SqliteStore {
+    pub(super) fn cache_get(&self, id: &str) -> Option<Memory> {
+        self.cache.lock().ok().and_then(|mut c| c.get(id).cloned())
+    }
+
+    pub(super) fn cache_put(&self, m: &Memory) {
+        if let Ok(mut c) = self.cache.lock() {
+            c.put(m.id.clone(), m.clone());
+        }
+    }
+
+    pub(super) fn cache_invalidate(&self, id: &str) {
+        if let Ok(mut c) = self.cache.lock() {
+            c.pop(id);
+        }
+    }
+
+    pub(super) fn cache_invalidate_many(&self, ids: &[&str]) {
+        if let Ok(mut c) = self.cache.lock() {
+            for id in ids {
+                c.pop(*id);
+            }
+        }
+    }
+
+    pub(super) fn cache_clear(&self) {
+        if let Ok(mut c) = self.cache.lock() {
+            c.clear();
+        }
+    }
+}
+
+pub(crate) fn new_cache() -> LruCache<String, Memory> {
+    let cap = NonZeroUsize::new(MEMORY_CACHE_CAP)
+        .expect("MEMORY_CACHE_CAP must be non-zero — see store.rs");
+    LruCache::new(cap)
+}
diff --git a/crates/icm-store/src/store/connection.rs b/crates/icm-store/src/store/connection.rs
new file mode 100644
index 00000000..27f96a43
--- /dev/null
+++ b/crates/icm-store/src/store/connection.rs
@@ -0,0 +1,119 @@
+//! SQLite backend — split out of the former monolithic `store.rs`.
+//!
+//! `SqliteStore` and the shared row/parse helpers live in `super`
+//! (`store/mod.rs`); each submodule here holds one trait impl (or a
+//! coherent group of inherent methods) on that type.
+
+use super::*;
+/// Convert rusqlite::Error to IcmError::Database
+pub(crate) fn db_err(e: rusqlite::Error) -> IcmError {
+    IcmError::Database(e.to_string())
+}
+
+/// True when a rusqlite error is a "no such table" (a legacy DB missing an
+/// FTS shadow table we optionally rebuild — issue #313).
+pub(crate) fn is_missing_table(e: &rusqlite::Error) -> bool {
+    e.to_string().contains("no such table")
+}
+
+/// FTS5 shadow tables maintained by ICM, checked/rebuilt during repair (#313).
+pub(crate) const FTS_TABLES: [&str; 4] = [
+    "memories_fts",
+    "concepts_fts",
+    "feedback_fts",
+    "messages_fts",
+];
+
+// Shared public row types live in `crate::common` so all backends can be
+// compiled into one binary without colliding definitions (issue #301).
+// They are re-exported from the parent `store` module (see `mod.rs`).
+
+/// Collect mapped rows into a Vec, converting rusqlite errors.
+pub(crate) fn collect_rows<T>(
+    rows: rusqlite::MappedRows<'_, impl FnMut(&rusqlite::Row<'_>) -> rusqlite::Result<T>>,
+) -> IcmResult<Vec<T>> {
+    rows.collect::<Result<Vec<T>, _>>().map_err(db_err)
+}
+
+pub(crate) static SQLITE_VEC_INIT: Once = Once::new();
+
+pub(crate) fn ensure_sqlite_vec() {
+    SQLITE_VEC_INIT.call_once(|| unsafe {
+        #[allow(clippy::missing_transmute_annotations)]
+        sqlite3_auto_extension(Some(std::mem::transmute(
+            sqlite_vec::sqlite3_vec_init as *const (),
+        )));
+    });
+}
+
+/// URI-encode a filesystem path for a SQLite `file:` URI so a backslash on
+/// Windows or a `?`/`#`/`%` in a pathological filename can't break the parser.
+pub(crate) fn encode_sqlite_uri_path(path: &Path) -> String {
+    path.to_string_lossy()
+        .chars()
+        .map(|c| match c {
+            '?' | '#' | '%' => format!("%{:02X}", c as u32),
+            // Normalize Windows backslashes; SQLite URIs accept "/".
+            '\\' => "/".into(),
+            other => other.to_string(),
+        })
+        .collect()
+}
+
+/// Open `path` strictly read-only. When `immutable` is set, add the
+/// `immutable=1` URI flag — SQLite then assumes the file never changes and
+/// touches no `-shm`/`-wal` sidecars, which is required on a `chmod -w`
+/// parent directory (issue #263) but serves a permanently stale snapshot and
+/// eventually reports spurious `SQLITE_CORRUPT` on a live DB (issue #319).
+/// Plain `mode=ro` (immutable = false) is WAL-aware and sees committed
+/// writes, at the cost of needing a writable directory for the sidecars.
+pub(crate) fn open_readonly_uri(path: &Path, immutable: bool) -> IcmResult<Connection> {
+    let encoded = encode_sqlite_uri_path(path);
+    let uri = if immutable {
+        format!("file:{encoded}?mode=ro&immutable=1")
+    } else {
+        format!("file:{encoded}?mode=ro")
+    };
+    Connection::open_with_flags(
+        uri,
+        rusqlite::OpenFlags::SQLITE_OPEN_READ_ONLY
+            | rusqlite::OpenFlags::SQLITE_OPEN_URI
+            | rusqlite::OpenFlags::SQLITE_OPEN_NO_MUTEX,
+    )
+    .map_err(|e| IcmError::Database(format!("cannot open database read-only: {e}")))
+}
+
+/// Open a long-lived read-only connection (issue #319).
+///
+/// Prefer a normal WAL-aware `mode=ro` connection: it respects locking and
+/// sees writes committed after it opened — the actual deployment model for
+/// `icm --read-only serve`, where hooks keep writing the same DB. Fall back to
+/// `immutable=1` only when the live open can't even read the DB, e.g. a
+/// `chmod -w` sandbox where SQLite can't create the `-shm` sidecar for a
+/// WAL-mode file (issue #263). The read probe is essential: on such a
+/// directory the open may *succeed* yet the first real read fails, so opening
+/// alone is not a sufficient signal.
+pub(crate) fn open_readonly_connection(path: &Path) -> IcmResult<Connection> {
+    if let Ok(conn) = open_readonly_uri(path, false) {
+        // Give a momentarily-locked writer time to release before deciding
+        // the live open is unusable.
+        let _ = conn.execute_batch("PRAGMA busy_timeout=30000;");
+        // Exercise a real table read (touches the WAL/-shm path) — `SELECT 1`
+        // would not.
+        if conn
+            .query_row("SELECT count(*) FROM sqlite_master", [], |_| Ok(()))
+            .is_ok()
+        {
+            return Ok(conn);
+        }
+    }
+    // Live open unusable (e.g. a read-only sandbox dir, #263). Fall back to an
+    // immutable snapshot — but warn, because a long-lived reader on this
+    // connection will NOT see subsequent writes (the #319 staleness tradeoff).
+    tracing::warn!(
+        path = %path.display(),
+        "read-only DB opened immutable (sandbox fallback): writes committed after \
+         this point will not be visible until the connection is reopened"
+    );
+    open_readonly_uri(path, true)
+}
diff --git a/crates/icm-store/src/store/facts.rs b/crates/icm-store/src/store/facts.rs
new file mode 100644
index 00000000..7d4d9c0c
--- /dev/null
+++ b/crates/icm-store/src/store/facts.rs
@@ -0,0 +1,244 @@
+//! SQLite backend — split out of the former monolithic `store.rs`.
+//!
+//! `SqliteStore` and the shared row/parse helpers live in `super`
+//! (`store/mod.rs`); each submodule here holds one trait impl (or a
+//! coherent group of inherent methods) on that type.
+
+use super::*;
+use rusqlite::OptionalExtension;
+
+fn row_to_fact(row: &rusqlite::Row<'_>) -> rusqlite::Result<Fact> {
+    let created_at: String = row.get("created_at")?;
+    let superseded_at: Option<String> = row.get("superseded_at")?;
+    Ok(Fact {
+        id: row.get("id")?,
+        entity: row.get("entity")?,
+        key: row.get("key")?,
+        value: row.get("value")?,
+        source: row.get("source")?,
+        created_at: chrono::DateTime::parse_from_rfc3339(&created_at)
+            .map(|d| d.with_timezone(&chrono::Utc))
+            .unwrap_or_else(|_| chrono::Utc::now()),
+        superseded_at: superseded_at.and_then(|s| {
+            chrono::DateTime::parse_from_rfc3339(&s)
+                .ok()
+                .map(|d| d.with_timezone(&chrono::Utc))
+        }),
+    })
+}
+
+impl SqliteStore {
+    fn set_fact_inner(
+        &self,
+        entity: &str,
+        key: &str,
+        value: &str,
+        source: &str,
+    ) -> IcmResult<String> {
+        let conn = &self.conn;
+        // Active row lookup
+        let existing: Option<(String, String)> = conn
+            .query_row(
+                "SELECT id, value FROM facts
+                 WHERE entity = ?1 AND key = ?2 AND superseded_at IS NULL",
+                params![entity, key],
+                |row| Ok((row.get(0)?, row.get(1)?)),
+            )
+            .optional()
+            .map_err(db_err)?;
+
+        if let Some((id, current_value)) = existing {
+            if current_value == value {
+                // No-op: same value re-asserted.
+                return Ok(id);
+            }
+            let now = chrono::Utc::now().to_rfc3339();
+            conn.execute(
+                "UPDATE facts SET superseded_at = ?1 WHERE id = ?2",
+                params![now, id],
+            )
+            .map_err(db_err)?;
+        }
+
+        let new = Fact::new(
+            entity.to_string(),
+            key.to_string(),
+            value.to_string(),
+            source.to_string(),
+        );
+        conn.execute(
+            "INSERT INTO facts (id, entity, key, value, source, created_at, superseded_at)
+             VALUES (?1, ?2, ?3, ?4, ?5, ?6, NULL)",
+            params![
+                new.id,
+                new.entity,
+                new.key,
+                new.value,
+                new.source,
+                new.created_at.to_rfc3339(),
+            ],
+        )
+        .map_err(db_err)?;
+        Ok(new.id)
+    }
+}
+
+impl FactsStore for SqliteStore {
+    fn set_fact(&self, entity: &str, key: &str, value: &str, source: &str) -> IcmResult<String> {
+        if entity.is_empty() || key.is_empty() {
+            return Err(IcmError::InvalidInput(
+                "entity and key must be non-empty".into(),
+            ));
+        }
+        // SELECT (find active row) -> UPDATE (supersede it) -> INSERT (new
+        // row) was three separate statements with no transaction around
+        // them, unlike every other multi-statement write in this file
+        // (audit finding: 0 BEGIN IMMEDIATE occurrences across
+        // Facts/Feedback/Transcript vs 5 in MemoryStore). A crash or
+        // concurrent writer between the UPDATE and the INSERT could leave
+        // the entity/key with no active fact at all.
+        self.conn
+            .execute_batch("BEGIN IMMEDIATE;")
+            .map_err(db_err)?;
+        match self.set_fact_inner(entity, key, value, source) {
+            Ok(id) => {
+                self.conn.execute_batch("COMMIT;").map_err(db_err)?;
+                Ok(id)
+            }
+            Err(e) => {
+                let _ = self.conn.execute_batch("ROLLBACK;");
+                Err(e)
+            }
+        }
+    }
+
+    fn get_fact(&self, entity: &str, key: &str) -> IcmResult<Option<Fact>> {
+        let conn = &self.conn;
+        let row = conn
+            .query_row(
+                "SELECT id, entity, key, value, source, created_at, superseded_at
+                 FROM facts
+                 WHERE entity = ?1 AND key = ?2 AND superseded_at IS NULL",
+                params![entity, key],
+                row_to_fact,
+            )
+            .map(Some)
+            .or_else(|e| match e {
+                rusqlite::Error::QueryReturnedNoRows => Ok(None),
+                other => Err(db_err(other)),
+            })?;
+        Ok(row)
+    }
+
+    fn list_facts(&self, entity: &str, key_prefix: Option<&str>) -> IcmResult<Vec<Fact>> {
+        let conn = &self.conn;
+        let rows = match key_prefix {
+            Some(prefix) if !prefix.is_empty() => {
+                let mut stmt = conn
+                    .prepare(
+                        "SELECT id, entity, key, value, source, created_at, superseded_at
+                         FROM facts
+                         WHERE entity = ?1 AND key LIKE ?2 AND superseded_at IS NULL
+                         ORDER BY key ASC",
+                    )
+                    .map_err(db_err)?;
+                let pattern = format!("{prefix}%");
+                let rows = stmt
+                    .query_map(params![entity, pattern], row_to_fact)
+                    .map_err(db_err)?;
+                rows.collect::<Result<Vec<_>, _>>().map_err(db_err)?
+            }
+            _ => {
+                let mut stmt = conn
+                    .prepare(
+                        "SELECT id, entity, key, value, source, created_at, superseded_at
+                         FROM facts
+                         WHERE entity = ?1 AND superseded_at IS NULL
+                         ORDER BY key ASC",
+                    )
+                    .map_err(db_err)?;
+                let rows = stmt
+                    .query_map(params![entity], row_to_fact)
+                    .map_err(db_err)?;
+                rows.collect::<Result<Vec<_>, _>>().map_err(db_err)?
+            }
+        };
+        Ok(rows)
+    }
+
+    fn history(&self, entity: &str, key: &str) -> IcmResult<Vec<Fact>> {
+        let conn = &self.conn;
+        let mut stmt = conn
+            .prepare(
+                "SELECT id, entity, key, value, source, created_at, superseded_at
+                 FROM facts
+                 WHERE entity = ?1 AND key = ?2
+                 ORDER BY created_at DESC",
+            )
+            .map_err(db_err)?;
+        let rows = stmt
+            .query_map(params![entity, key], row_to_fact)
+            .map_err(db_err)?;
+        rows.collect::<Result<Vec<_>, _>>().map_err(db_err)
+    }
+
+    fn forget_fact(&self, entity: &str, key: &str) -> IcmResult<usize> {
+        let conn = &self.conn;
+        let n = conn
+            .execute(
+                "DELETE FROM facts WHERE entity = ?1 AND key = ?2",
+                params![entity, key],
+            )
+            .map_err(db_err)?;
+        Ok(n)
+    }
+
+    fn facts_stats(&self) -> IcmResult<FactsStats> {
+        let conn = &self.conn;
+        let active_count: usize = conn
+            .query_row(
+                "SELECT COUNT(*) FROM facts WHERE superseded_at IS NULL",
+                [],
+                |r| r.get::<_, i64>(0).map(|v| v as usize),
+            )
+            .map_err(db_err)?;
+        let total_count: usize = conn
+            .query_row("SELECT COUNT(*) FROM facts", [], |r| {
+                r.get::<_, i64>(0).map(|v| v as usize)
+            })
+            .map_err(db_err)?;
+        let distinct_entities: usize = conn
+            .query_row(
+                "SELECT COUNT(DISTINCT entity) FROM facts WHERE superseded_at IS NULL",
+                [],
+                |r| r.get::<_, i64>(0).map(|v| v as usize),
+            )
+            .map_err(db_err)?;
+
+        let mut stmt = conn
+            .prepare(
+                "SELECT entity, COUNT(*) as n FROM facts
+                 WHERE superseded_at IS NULL
+                 GROUP BY entity
+                 ORDER BY n DESC
+                 LIMIT 10",
+            )
+            .map_err(db_err)?;
+        let rows = stmt
+            .query_map([], |row| {
+                let entity: String = row.get(0)?;
+                let n: i64 = row.get(1)?;
+                Ok((entity, n as usize))
+            })
+            .map_err(db_err)?;
+        let top_entities: Vec<(String, usize)> =
+            rows.collect::<Result<Vec<_>, _>>().map_err(db_err)?;
+
+        Ok(FactsStats {
+            active_count,
+            total_count,
+            distinct_entities,
+            top_entities,
+        })
+    }
+}
diff --git a/crates/icm-store/src/store/feedback.rs b/crates/icm-store/src/store/feedback.rs
new file mode 100644
index 00000000..4912420a
--- /dev/null
+++ b/crates/icm-store/src/store/feedback.rs
@@ -0,0 +1,300 @@
+//! SQLite backend — split out of the former monolithic `store.rs`.
+//!
+//! `SqliteStore` and the shared row/parse helpers live in `super`
+//! (`store/mod.rs`); each submodule here holds one trait impl (or a
+//! coherent group of inherent methods) on that type.
+
+use super::*;
+
+fn row_to_feedback(row: &rusqlite::Row) -> rusqlite::Result<Feedback> {
+    let embedding: Option<Vec<f32>> = row
+        .get::<_, Option<Vec<u8>>>(9)?
+        .map(|b| blob_to_embedding(&b));
+    Ok(Feedback {
+        id: row.get(0)?,
+        topic: row.get(1)?,
+        context: row.get(2)?,
+        predicted: row.get(3)?,
+        corrected: row.get(4)?,
+        reason: row.get(5)?,
+        source: row.get(6)?,
+        created_at: parse_dt(&row.get::<_, String>(7)?),
+        applied_count: row.get(8)?,
+        embedding,
+    })
+}
+
+const FEEDBACK_COLS: &str =
+    "id, topic, context, predicted, corrected, reason, source, created_at, applied_count, embedding";
+/// Same columns, qualified for the `feedback f JOIN feedback_fts fts` query
+/// in `search_feedback` — both tables have an `id` column post-join, so the
+/// unqualified `FEEDBACK_COLS` is ambiguous there (found via real testing:
+/// `search_feedback` errored on every call once the join was introduced).
+const FEEDBACK_COLS_F: &str = "f.id, f.topic, f.context, f.predicted, f.corrected, f.reason, \
+     f.source, f.created_at, f.applied_count, f.embedding";
+
+// FeedbackStore impl
+
+/// Pure Rust cosine similarity for the feedback semantic fallback (no
+/// vec0 virtual table — feedback volume is expected far lower than
+/// memories, so a brute-force scan over rows with an embedding is simpler
+/// and avoids replicating the vec0/dimension-migration machinery for a
+/// low-cardinality table). A dimension mismatch returns -1.0 (below any
+/// real cosine similarity) rather than silently comparing a truncated
+/// prefix — same reasoning as `extract_semantic.rs`'s `cosine`.
+fn feedback_cosine(a: &[f32], b: &[f32]) -> f32 {
+    if a.len() != b.len() || a.is_empty() {
+        return -1.0;
+    }
+    let (mut dot, mut na, mut nb) = (0.0f32, 0.0f32, 0.0f32);
+    for i in 0..a.len() {
+        dot += a[i] * b[i];
+        na += a[i] * a[i];
+        nb += b[i] * b[i];
+    }
+    if na == 0.0 || nb == 0.0 {
+        return -1.0;
+    }
+    dot / (na.sqrt() * nb.sqrt())
+}
+
+impl FeedbackStore for SqliteStore {
+    fn store_feedback(&self, feedback: Feedback) -> IcmResult<String> {
+        let embedding_blob = feedback.embedding.as_deref().map(embedding_to_blob);
+        self.conn
+            .execute(
+                "INSERT INTO feedback (id, topic, context, predicted, corrected, reason, source, created_at, applied_count, embedding)
+                 VALUES (?1, ?2, ?3, ?4, ?5, ?6, ?7, ?8, ?9, ?10)",
+                params![
+                    feedback.id,
+                    feedback.topic,
+                    feedback.context,
+                    feedback.predicted,
+                    feedback.corrected,
+                    feedback.reason,
+                    feedback.source,
+                    feedback.created_at.to_rfc3339(),
+                    feedback.applied_count,
+                    embedding_blob,
+                ],
+            )
+            .map_err(db_err)?;
+        Ok(feedback.id)
+    }
+
+    fn search_feedback(
+        &self,
+        query: &str,
+        query_embedding: Option<&[f32]>,
+        topic: Option<&str>,
+        limit: usize,
+    ) -> IcmResult<Vec<Feedback>> {
+        let sanitized = sanitize_fts_query(query);
+
+        if sanitized.is_empty() {
+            return self.list_feedback(topic, limit);
+        }
+
+        let pool = limit.saturating_mul(4).max(limit);
+
+        // FTS candidates, ranked (FTS5 bm25: more negative = more relevant).
+        let (fts_sql, fts_params): (String, Vec<Box<dyn rusqlite::types::ToSql>>) =
+            if let Some(t) = topic {
+                (
+                    format!(
+                        "SELECT {FEEDBACK_COLS_F}, fts.rank as rnk FROM feedback f
+                         JOIN feedback_fts fts ON fts.id = f.id
+                         WHERE feedback_fts MATCH ?1 AND f.topic = ?2
+                         ORDER BY fts.rank LIMIT ?3"
+                    ),
+                    vec![
+                        Box::new(sanitized.clone()) as Box<dyn rusqlite::types::ToSql>,
+                        Box::new(t.to_string()),
+                        Box::new(pool as i64),
+                    ],
+                )
+            } else {
+                (
+                    format!(
+                        "SELECT {FEEDBACK_COLS_F}, fts.rank as rnk FROM feedback f
+                         JOIN feedback_fts fts ON fts.id = f.id
+                         WHERE feedback_fts MATCH ?1
+                         ORDER BY fts.rank LIMIT ?2"
+                    ),
+                    vec![
+                        Box::new(sanitized.clone()) as Box<dyn rusqlite::types::ToSql>,
+                        Box::new(pool as i64),
+                    ],
+                )
+            };
+
+        let mut all: HashMap<String, Feedback> = HashMap::new();
+        let mut fts_scores: HashMap<String, f32> = HashMap::new();
+        {
+            let mut stmt = self.conn.prepare(&fts_sql).map_err(db_err)?;
+            let refs: Vec<&dyn rusqlite::types::ToSql> =
+                fts_params.iter().map(|p| p.as_ref()).collect();
+            let col_count = 10; // FEEDBACK_COLS (10) + rnk
+            let rows = stmt
+                .query_map(refs.as_slice(), |row| {
+                    let fb = row_to_feedback(row)?;
+                    let rank: f32 = row.get(col_count)?;
+                    Ok((fb, rank))
+                })
+                .map_err(db_err)?;
+            for row in rows.flatten() {
+                let (fb, rank) = row;
+                // Same monotonic-increasing-in-relevance transform as
+                // memories' search_hybrid (audit finding there: the naive
+                // `1.0 / (1.0 + |rank|)` inverts the relationship).
+                let score = rank.abs() / (1.0 + rank.abs());
+                fts_scores.insert(fb.id.clone(), score);
+                all.insert(fb.id.clone(), fb);
+            }
+        }
+
+        // Semantic candidates: brute-force cosine over rows with an
+        // embedding (see feedback_cosine's doc comment for why no vec0).
+        let mut vec_scores: HashMap<String, f32> = HashMap::new();
+        if let Some(qemb) = query_embedding {
+            let topic_sql = if topic.is_some() {
+                " WHERE topic = ?1"
+            } else {
+                ""
+            };
+            let sql = format!("SELECT {FEEDBACK_COLS} FROM feedback{topic_sql}");
+            let mut stmt = self.conn.prepare(&sql).map_err(db_err)?;
+            let candidates: Vec<Feedback> = if let Some(t) = topic {
+                collect_rows(
+                    stmt.query_map(params![t], row_to_feedback)
+                        .map_err(db_err)?,
+                )?
+            } else {
+                collect_rows(stmt.query_map([], row_to_feedback).map_err(db_err)?)?
+            };
+            for fb in candidates {
+                if let Some(emb) = &fb.embedding {
+                    let sim = feedback_cosine(qemb, emb);
+                    if sim > 0.0 {
+                        vec_scores.insert(fb.id.clone(), sim);
+                        all.entry(fb.id.clone()).or_insert(fb);
+                    }
+                }
+            }
+        }
+
+        let mut scored: Vec<(String, f32)> = all
+            .keys()
+            .map(|id| {
+                let fts = fts_scores.get(id).copied().unwrap_or(0.0);
+                let vec = vec_scores.get(id).copied().unwrap_or(0.0);
+                (id.clone(), 0.3 * fts + 0.7 * vec)
+            })
+            .collect();
+        // Pure-FTS fallback (no query embedding available) must still rank
+        // by relevance, not just whatever HashMap order `all` iterates in.
+        if query_embedding.is_none() {
+            scored = fts_scores.iter().map(|(id, s)| (id.clone(), *s)).collect();
+        }
+        scored.sort_by(|a, b| b.1.partial_cmp(&a.1).unwrap_or(std::cmp::Ordering::Equal));
+        scored.truncate(limit);
+
+        Ok(scored
+            .into_iter()
+            .filter_map(|(id, _)| all.remove(&id))
+            .collect())
+    }
+
+    fn list_feedback(&self, topic: Option<&str>, limit: usize) -> IcmResult<Vec<Feedback>> {
+        let (sql, params_vec): (String, Vec<Box<dyn rusqlite::types::ToSql>>) = if let Some(t) =
+            topic
+        {
+            (
+                    format!(
+                        "SELECT {FEEDBACK_COLS} FROM feedback WHERE topic = ?1 ORDER BY created_at DESC LIMIT ?2"
+                    ),
+                    vec![
+                        Box::new(t.to_string()) as Box<dyn rusqlite::types::ToSql>,
+                        Box::new(limit as i64),
+                    ],
+                )
+        } else {
+            (
+                format!("SELECT {FEEDBACK_COLS} FROM feedback ORDER BY created_at DESC LIMIT ?1"),
+                vec![Box::new(limit as i64) as Box<dyn rusqlite::types::ToSql>],
+            )
+        };
+
+        let mut stmt = self.conn.prepare(&sql).map_err(db_err)?;
+        let refs: Vec<&dyn rusqlite::types::ToSql> =
+            params_vec.iter().map(|p| p.as_ref()).collect();
+        let rows = stmt
+            .query_map(refs.as_slice(), row_to_feedback)
+            .map_err(db_err)?;
+        collect_rows(rows)
+    }
+
+    fn increment_applied(&self, id: &str) -> IcmResult<()> {
+        let changed = self
+            .conn
+            .execute(
+                "UPDATE feedback SET applied_count = applied_count + 1 WHERE id = ?1",
+                params![id],
+            )
+            .map_err(db_err)?;
+
+        if changed == 0 {
+            return Err(IcmError::NotFound(id.to_string()));
+        }
+        Ok(())
+    }
+
+    fn delete_feedback(&self, id: &str) -> IcmResult<()> {
+        let changed = self
+            .conn
+            .execute("DELETE FROM feedback WHERE id = ?1", params![id])
+            .map_err(db_err)?;
+
+        if changed == 0 {
+            return Err(IcmError::NotFound(id.to_string()));
+        }
+        Ok(())
+    }
+
+    fn feedback_stats(&self) -> IcmResult<FeedbackStats> {
+        let total: usize = self
+            .conn
+            .query_row("SELECT COUNT(*) FROM feedback", [], |row| row.get(0))
+            .map_err(db_err)?;
+
+        let mut stmt = self
+            .conn
+            .prepare("SELECT topic, COUNT(*) as cnt FROM feedback GROUP BY topic ORDER BY cnt DESC")
+            .map_err(db_err)?;
+
+        let by_topic: Vec<(String, usize)> = stmt
+            .query_map([], |row| Ok((row.get(0)?, row.get(1)?)))
+            .map_err(db_err)?
+            .filter_map(|r| r.ok())
+            .collect();
+
+        let mut stmt = self
+            .conn
+            .prepare(
+                "SELECT id, applied_count FROM feedback WHERE applied_count > 0 ORDER BY applied_count DESC LIMIT 10",
+            )
+            .map_err(db_err)?;
+
+        let most_applied: Vec<(String, u32)> = stmt
+            .query_map([], |row| Ok((row.get(0)?, row.get(1)?)))
+            .map_err(db_err)?
+            .filter_map(|r| r.ok())
+            .collect();
+
+        Ok(FeedbackStats {
+            total,
+            by_topic,
+            most_applied,
+        })
+    }
+}
diff --git a/crates/icm-store/src/store/hooks.rs b/crates/icm-store/src/store/hooks.rs
new file mode 100644
index 00000000..8cef3c74
--- /dev/null
+++ b/crates/icm-store/src/store/hooks.rs
@@ -0,0 +1,397 @@
+//! SQLite backend — split out of the former monolithic `store.rs`.
+//!
+//! `SqliteStore` and the shared row/parse helpers live in `super`
+//! (`store/mod.rs`); each submodule here holds one trait impl (or a
+//! coherent group of inherent methods) on that type.
+
+use super::*;
+impl SqliteStore {
+    /// Atomically increment the hook call counter and return the new value.
+    pub fn increment_hook_counter(&self) -> IcmResult<usize> {
+        let count: usize = self
+            .conn
+            .query_row(
+                "INSERT INTO icm_metadata (key, value) VALUES ('hook_counter', '1')
+                 ON CONFLICT(key) DO UPDATE SET value = CAST(CAST(value AS INTEGER) + 1 AS TEXT)
+                 RETURNING CAST(value AS INTEGER)",
+                [],
+                |row| row.get(0),
+            )
+            .map_err(db_err)?;
+        Ok(count)
+    }
+
+    /// Reset the hook call counter to 0.
+    pub fn reset_hook_counter(&self) -> IcmResult<()> {
+        self.conn
+            .execute(
+                "INSERT INTO icm_metadata (key, value) VALUES ('hook_counter', '0')
+                 ON CONFLICT(key) DO UPDATE SET value = '0'",
+                [],
+            )
+            .map_err(db_err)?;
+        Ok(())
+    }
+
+    // Async extraction queue
+    //
+    // Row tuple shape: `(id, project, tool_name, raw_output, captured_at)`
+    //
+    // When `[extraction.summarizer].provider` is set to something other
+    // than `"none"`, PostToolUse hooks INSERT raw tool output here in
+    // ~50ms (no embedder load) and a worker (`icm extract-pending` or
+    // the SessionEnd async fork) dequeues batches and runs the LLM CLI.
+
+    /// Enqueue raw tool output for later LLM extraction. Returns the
+    /// generated row id so the caller can correlate logs.
+    pub fn enqueue_pending_extraction(
+        &self,
+        project: &str,
+        tool_name: &str,
+        raw_output: &str,
+    ) -> IcmResult<String> {
+        let id = ulid::Ulid::new().to_string();
+        let now = chrono::Utc::now().to_rfc3339();
+        self.conn
+            .execute(
+                "INSERT INTO pending_extractions (id, project, tool_name, raw_output, captured_at)
+                 VALUES (?1, ?2, ?3, ?4, ?5)",
+                rusqlite::params![id, project, tool_name, raw_output, now],
+            )
+            .map_err(db_err)?;
+        Ok(id)
+    }
+
+    /// Pop up to `limit` oldest pending rows. Caller is expected to call
+    /// `delete_pending_extractions` after successful processing.
+    pub fn list_pending_extractions(&self, limit: usize) -> IcmResult<Vec<PendingRow>> {
+        let mut stmt = self
+            .conn
+            .prepare(
+                "SELECT id, project, tool_name, raw_output, captured_at
+                 FROM pending_extractions
+                 ORDER BY captured_at ASC
+                 LIMIT ?1",
+            )
+            .map_err(db_err)?;
+        let rows = stmt
+            .query_map([limit as i64], |row| {
+                Ok((
+                    row.get::<_, String>(0)?,
+                    row.get::<_, String>(1)?,
+                    row.get::<_, String>(2)?,
+                    row.get::<_, String>(3)?,
+                    row.get::<_, String>(4)?,
+                ))
+            })
+            .map_err(db_err)?
+            .collect::<Result<Vec<_>, _>>()
+            .map_err(db_err)?;
+        Ok(rows)
+    }
+
+    /// Delete pending rows by id. Used after a worker has processed them.
+    pub fn delete_pending_extractions(&self, ids: &[String]) -> IcmResult<usize> {
+        if ids.is_empty() {
+            return Ok(0);
+        }
+        let placeholders = ids.iter().map(|_| "?").collect::<Vec<_>>().join(",");
+        let sql = format!("DELETE FROM pending_extractions WHERE id IN ({placeholders})");
+        let params: Vec<&dyn rusqlite::ToSql> =
+            ids.iter().map(|s| s as &dyn rusqlite::ToSql).collect();
+        let n = self.conn.execute(&sql, params.as_slice()).map_err(db_err)?;
+        Ok(n)
+    }
+
+    /// Total rows currently waiting in the queue. Used by `icm doctor`.
+    pub fn pending_extraction_count(&self) -> IcmResult<usize> {
+        let n: i64 = self
+            .conn
+            .query_row("SELECT COUNT(*) FROM pending_extractions", [], |r| r.get(0))
+            .map_err(db_err)?;
+        Ok(n as usize)
+    }
+
+    // Code areas (auto-captured file edits — issue #196)
+    //
+    // `cmd_hook_post` calls `upsert_code_area` whenever the upstream
+    // tool was Edit / Write / MultiEdit / NotebookEdit. Same project +
+    // file_path => touch_count++ via ON CONFLICT.
+
+    /// Insert or refresh a row for `(project, file_path)`. On conflict
+    /// bumps `touch_count`, updates `last_touched_at`, refreshes
+    /// `session_id` / `tool_name`, and only overwrites `description` if
+    /// the caller passes `Some` (so the most recent meaningful hint
+    /// wins without clobbering an existing one with `None`).
+    pub fn upsert_code_area(
+        &self,
+        project: &str,
+        file_path: &str,
+        description: Option<&str>,
+        session_id: Option<&str>,
+        tool_name: Option<&str>,
+    ) -> IcmResult<()> {
+        let now = chrono::Utc::now().to_rfc3339();
+        self.conn
+            .execute(
+                "INSERT INTO code_areas (project, file_path, description,
+                    session_id, tool_name, touch_count,
+                    first_touched_at, last_touched_at)
+                 VALUES (?1, ?2, ?3, ?4, ?5, 1, ?6, ?6)
+                 ON CONFLICT(project, file_path) DO UPDATE SET
+                    touch_count = touch_count + 1,
+                    last_touched_at = excluded.last_touched_at,
+                    session_id = COALESCE(excluded.session_id, session_id),
+                    tool_name = COALESCE(excluded.tool_name, tool_name),
+                    description = COALESCE(excluded.description, description)",
+                rusqlite::params![project, file_path, description, session_id, tool_name, now],
+            )
+            .map_err(db_err)?;
+        Ok(())
+    }
+
+    /// List code areas, optionally filtered by project / file_path /
+    /// since timestamp. `limit` caps the result count (use `usize::MAX`
+    /// to disable). Ordered by `last_touched_at DESC` so the freshest
+    /// edits come first.
+    pub fn list_code_areas(
+        &self,
+        project: Option<&str>,
+        in_file: Option<&str>,
+        since: Option<DateTime<Utc>>,
+        limit: usize,
+    ) -> IcmResult<Vec<CodeArea>> {
+        let mut sql = String::from(
+            "SELECT id, project, file_path, description, session_id, tool_name,
+                    touch_count, first_touched_at, last_touched_at
+             FROM code_areas
+             WHERE 1=1",
+        );
+        let mut params: Vec<Box<dyn rusqlite::ToSql>> = Vec::new();
+        if let Some(p) = project {
+            sql.push_str(" AND project = ?");
+            params.push(Box::new(p.to_string()));
+        }
+        if let Some(f) = in_file {
+            // Match either an exact file_path or a path that ends with
+            // the provided fragment so users can pass a short suffix.
+            sql.push_str(" AND (file_path = ? OR file_path LIKE ?)");
+            params.push(Box::new(f.to_string()));
+            params.push(Box::new(format!("%/{f}")));
+        }
+        if let Some(t) = since {
+            sql.push_str(" AND last_touched_at >= ?");
+            params.push(Box::new(t.to_rfc3339()));
+        }
+        sql.push_str(" ORDER BY last_touched_at DESC LIMIT ?");
+        params.push(Box::new(limit as i64));
+
+        let mut stmt = self.conn.prepare(&sql).map_err(db_err)?;
+        let param_refs: Vec<&dyn rusqlite::ToSql> = params
+            .iter()
+            .map(|p| p.as_ref() as &dyn rusqlite::ToSql)
+            .collect();
+        let rows = stmt
+            .query_map(param_refs.as_slice(), |row| {
+                let first: String = row.get(7)?;
+                let last: String = row.get(8)?;
+                Ok(CodeArea {
+                    id: row.get(0)?,
+                    project: row.get(1)?,
+                    file_path: row.get(2)?,
+                    description: row.get(3)?,
+                    session_id: row.get(4)?,
+                    tool_name: row.get(5)?,
+                    touch_count: row.get(6)?,
+                    first_touched_at: DateTime::parse_from_rfc3339(&first)
+                        .map(|d| d.with_timezone(&Utc))
+                        .unwrap_or_else(|_| Utc::now()),
+                    last_touched_at: DateTime::parse_from_rfc3339(&last)
+                        .map(|d| d.with_timezone(&Utc))
+                        .unwrap_or_else(|_| Utc::now()),
+                })
+            })
+            .map_err(db_err)?
+            .collect::<Result<Vec<_>, _>>()
+            .map_err(db_err)?;
+        Ok(rows)
+    }
+
+    /// Total rows in `code_areas`. Cheap; used by stats / doctor.
+    pub fn code_area_count(&self) -> IcmResult<usize> {
+        let n: i64 = self
+            .conn
+            .query_row("SELECT COUNT(*) FROM code_areas", [], |r| r.get(0))
+            .map_err(db_err)?;
+        Ok(n as usize)
+    }
+
+    // Hook telemetry
+    //
+    // Every `icm hook <event>` fire writes one row to `hook_events`. Read
+    // back via `hook_events_recent` / `hook_stats`. Inserts are designed
+    // to be cheap (single statement, no FTS) so they stay well under the
+    // <50ms async-path budget.
+
+    /// Append one hook telemetry row. Errors are swallowed by callers in
+    /// hook paths (logging must never block the user), but tests can
+    /// inspect the `Result`.
+    pub fn record_hook_event(&self, ev: &HookEventInsert) -> IcmResult<i64> {
+        let now = chrono::Utc::now().to_rfc3339();
+        self.conn
+            .execute(
+                "INSERT INTO hook_events
+                 (ts, event, project, session_id, tool_name,
+                  duration_ms, exit_code, payload_size, note)
+                 VALUES (?1, ?2, ?3, ?4, ?5, ?6, ?7, ?8, ?9)",
+                rusqlite::params![
+                    now,
+                    ev.event,
+                    ev.project,
+                    ev.session_id,
+                    ev.tool_name,
+                    ev.duration_ms,
+                    ev.exit_code,
+                    ev.payload_size,
+                    ev.note,
+                ],
+            )
+            .map_err(db_err)?;
+        Ok(self.conn.last_insert_rowid())
+    }
+
+    /// Most recent `limit` hook events, newest first. Optional `event`
+    /// filter (e.g. `Some("end")` to see only SessionEnd hooks).
+    pub fn hook_events_recent(
+        &self,
+        limit: usize,
+        event_filter: Option<&str>,
+    ) -> IcmResult<Vec<HookEvent>> {
+        let limit_i64 = limit as i64;
+        let row_to_event = |row: &rusqlite::Row<'_>| -> rusqlite::Result<HookEvent> {
+            let ts_str: String = row.get(1)?;
+            let ts = chrono::DateTime::parse_from_rfc3339(&ts_str)
+                .map(|t| t.with_timezone(&Utc))
+                .unwrap_or_else(|_| Utc::now());
+            Ok(HookEvent {
+                id: row.get(0)?,
+                ts,
+                event: row.get(2)?,
+                project: row.get(3)?,
+                session_id: row.get(4)?,
+                tool_name: row.get(5)?,
+                duration_ms: row.get(6)?,
+                exit_code: row.get(7)?,
+                payload_size: row.get(8)?,
+                note: row.get(9)?,
+            })
+        };
+        match event_filter {
+            Some(e) => {
+                let mut stmt = self
+                    .conn
+                    .prepare(
+                        "SELECT id, ts, event, project, session_id, tool_name,
+                                duration_ms, exit_code, payload_size, note
+                         FROM hook_events
+                         WHERE event = ?1
+                         ORDER BY id DESC
+                         LIMIT ?2",
+                    )
+                    .map_err(db_err)?;
+                let rows = stmt
+                    .query_map(rusqlite::params![e, limit_i64], row_to_event)
+                    .map_err(db_err)?;
+                collect_rows(rows)
+            }
+            None => {
+                let mut stmt = self
+                    .conn
+                    .prepare(
+                        "SELECT id, ts, event, project, session_id, tool_name,
+                                duration_ms, exit_code, payload_size, note
+                         FROM hook_events
+                         ORDER BY id DESC
+                         LIMIT ?1",
+                    )
+                    .map_err(db_err)?;
+                let rows = stmt
+                    .query_map(rusqlite::params![limit_i64], row_to_event)
+                    .map_err(db_err)?;
+                collect_rows(rows)
+            }
+        }
+    }
+
+    /// Aggregate counts and latency percentiles per event type, over a
+    /// time window starting `since` (RFC3339). Used by `icm hook-stats`.
+    pub fn hook_stats(&self, since_rfc3339: &str) -> IcmResult<Vec<HookStatsRow>> {
+        // Pull each event type and compute percentiles in Rust — SQLite
+        // has no native percentile function and the row count is small
+        // enough (~1k/day worst case) that an in-process sort is fine.
+        let mut stmt = self
+            .conn
+            .prepare(
+                "SELECT event, duration_ms, exit_code
+                 FROM hook_events
+                 WHERE ts >= ?1
+                 ORDER BY event",
+            )
+            .map_err(db_err)?;
+        let rows = stmt
+            .query_map([since_rfc3339], |r| {
+                Ok((
+                    r.get::<_, String>(0)?,
+                    r.get::<_, Option<i64>>(1)?,
+                    r.get::<_, i32>(2)?,
+                ))
+            })
+            .map_err(db_err)?;
+        let mut by_event: std::collections::BTreeMap<String, Vec<(Option<i64>, i32)>> =
+            std::collections::BTreeMap::new();
+        for r in rows {
+            let (ev, dur, exit) = r.map_err(db_err)?;
+            by_event.entry(ev).or_default().push((dur, exit));
+        }
+        let mut out = Vec::with_capacity(by_event.len());
+        for (event, mut items) in by_event {
+            let count = items.len() as i64;
+            let error_count = items.iter().filter(|(_, e)| *e != 0).count() as i64;
+            let mut durations: Vec<i64> = items.iter().filter_map(|(d, _)| *d).collect();
+            durations.sort_unstable();
+            let avg = if durations.is_empty() {
+                0.0
+            } else {
+                durations.iter().sum::<i64>() as f64 / durations.len() as f64
+            };
+            let p = |q: f64| -> i64 {
+                if durations.is_empty() {
+                    0
+                } else {
+                    let idx = ((durations.len() as f64 - 1.0) * q).round() as usize;
+                    durations[idx.min(durations.len() - 1)]
+                }
+            };
+            out.push(HookStatsRow {
+                event,
+                count,
+                error_count,
+                avg_duration_ms: avg,
+                p50_duration_ms: p(0.50),
+                p99_duration_ms: p(0.99),
+            });
+            // Avoid clippy 'unused variable' on items after move
+            let _ = &mut items;
+        }
+        Ok(out)
+    }
+
+    /// Total rows currently in `hook_events`. Used by tests and `icm doctor`.
+    pub fn hook_event_count(&self) -> IcmResult<usize> {
+        let n: i64 = self
+            .conn
+            .query_row("SELECT COUNT(*) FROM hook_events", [], |r| r.get(0))
+            .map_err(db_err)?;
+        Ok(n as usize)
+    }
+}
diff --git a/crates/icm-store/src/store/maintenance.rs b/crates/icm-store/src/store/maintenance.rs
new file mode 100644
index 00000000..a4c62f18
--- /dev/null
+++ b/crates/icm-store/src/store/maintenance.rs
@@ -0,0 +1,309 @@
+//! SQLite backend — split out of the former monolithic `store.rs`.
+//!
+//! `SqliteStore` and the shared row/parse helpers live in `super`
+//! (`store/mod.rs`); each submodule here holds one trait impl (or a
+//! coherent group of inherent methods) on that type.
+
+use super::*;
+use rusqlite::OptionalExtension;
+
+impl SqliteStore {
+    /// Check database integrity (issue #313) and return a list of problems.
+    /// A healthy database yields exactly `["ok"]`; a damaged one yields one
+    /// entry per problem.
+    ///
+    /// Two complementary checks run:
+    /// 1. `PRAGMA integrity_check` — structural b-tree / page validation.
+    ///    This is what caught the shadow-table and index damage reported in
+    ///    the incident (`btreeInitPage`, `wrong # of entries in index …`).
+    /// 2. FTS5 `'integrity-check'` per shadow table — validates each FTS
+    ///    index's internal structure, complementing the structural pass for
+    ///    damage confined to the FTS shadow tables.
+    ///
+    /// This never returns `Err`: even a failure to *run* a check (e.g. an FTS
+    /// vtable too damaged to instantiate) is recorded as a problem, so the
+    /// caller — `icm doctor` / `icm repair` — always gets a usable verdict on
+    /// a badly corrupt database instead of a propagated error.
+    pub fn integrity_check(&self) -> IcmResult<Vec<String>> {
+        let mut problems = Vec::new();
+
+        // 1. Structural check. Record a run failure as a problem instead of
+        //    aborting the whole verdict.
+        match self.run_integrity_pragma() {
+            Ok(lines) => problems.extend(lines.into_iter().filter(|l| l != "ok")),
+            Err(e) => problems.push(format!("integrity_check pragma failed: {e}")),
+        }
+
+        // 2. Per-FTS-table consistency.
+        for table in FTS_TABLES {
+            // `rank = 1` makes FTS5 verify the index against the *content*
+            // table, not just its own internal structure. Without it, an
+            // index that is stale or out of step with the base table (e.g.
+            // an interrupted write) is reported as healthy. Requires
+            // SQLite ≥ 3.37 (bundled rusqlite is well past that).
+            let sql = format!("INSERT INTO {table}({table}, rank) VALUES('integrity-check', 1);");
+            match self.conn.execute_batch(&sql) {
+                Ok(()) => {}
+                Err(e) if is_missing_table(&e) => {} // legacy DB without this table
+                Err(e) => problems.push(format!("fts5 {table}: {e}")),
+            }
+        }
+
+        if problems.is_empty() {
+            Ok(vec!["ok".to_string()])
+        } else {
+            Ok(problems)
+        }
+    }
+
+    /// Structural-only integrity check (`PRAGMA integrity_check`), safe on a
+    /// read-only connection (issue #313 follow-up). Unlike
+    /// [`Self::integrity_check`] it does NOT run the FTS5 `'integrity-check'`
+    /// (which is an `INSERT` and needs a writable connection), so it never
+    /// mutates the DB or triggers a WAL checkpoint. Used by the read-only
+    /// inspection paths (`icm doctor`, `icm repair --dry-run`). A healthy DB
+    /// yields `["ok"]`. Never returns `Err`.
+    pub fn integrity_check_structural(&self) -> IcmResult<Vec<String>> {
+        let problems: Vec<String> = match self.run_integrity_pragma() {
+            Ok(lines) => lines.into_iter().filter(|l| l != "ok").collect(),
+            Err(e) => vec![format!("integrity_check pragma failed: {e}")],
+        };
+        if problems.is_empty() {
+            Ok(vec!["ok".to_string()])
+        } else {
+            Ok(problems)
+        }
+    }
+
+    /// Run `PRAGMA integrity_check` and collect its result rows.
+    fn run_integrity_pragma(&self) -> IcmResult<Vec<String>> {
+        let mut stmt = self
+            .conn
+            .prepare("PRAGMA integrity_check")
+            .map_err(db_err)?;
+        let rows = stmt
+            .query_map([], |row| row.get::<_, String>(0))
+            .map_err(db_err)?;
+        let mut out = Vec::new();
+        for r in rows {
+            out.push(r.map_err(db_err)?);
+        }
+        Ok(out)
+    }
+
+    /// Rebuild the FTS5 shadow tables from their content tables and `REINDEX`
+    /// every b-tree index (issue #313). This repairs the most common
+    /// corruption class — damaged indexes / FTS shadow tables with intact
+    /// base tables — without touching row data.
+    ///
+    /// Best-effort by design: a shadow table too damaged for `'rebuild'` to
+    /// even instantiate is skipped rather than aborting the whole repair, and
+    /// `REINDEX` failure is tolerated too. The caller re-runs
+    /// [`Self::integrity_check`] afterwards and reports any damage that
+    /// survived, so nothing is silently claimed fixed. Returns the FTS tables
+    /// that were successfully rebuilt.
+    pub fn rebuild_search_indexes(&self) -> IcmResult<Vec<String>> {
+        let mut rebuilt = Vec::new();
+        for table in FTS_TABLES {
+            let sql = format!("INSERT INTO {table}({table}) VALUES('rebuild');");
+            // A missing (legacy DB) or too-corrupt-to-instantiate shadow table
+            // is skipped rather than aborting; the post-repair integrity check
+            // surfaces any table that could not be restored.
+            if self.conn.execute_batch(&sql).is_ok() {
+                rebuilt.push(table.to_string());
+            }
+        }
+        // May fail on a badly damaged b-tree; the post-repair integrity check
+        // reports whatever REINDEX could not fix.
+        let _ = self.conn.execute_batch("REINDEX;");
+        Ok(rebuilt)
+    }
+
+    /// Apply decay if more than 24 hours since last decay.
+    /// Called automatically on recall to avoid manual `icm decay` cron.
+    ///
+    /// No-op when the store is read-only (issue #263): recall must work
+    /// against a DB the process cannot write to, and the bookkeeping
+    /// writes here would otherwise abort the whole read with
+    /// "attempt to write a readonly database".
+    pub fn maybe_auto_decay(&self) -> IcmResult<()> {
+        if self.readonly {
+            return Ok(());
+        }
+        let now = Utc::now();
+        let now_str = now.to_rfc3339();
+
+        // Audit finding: this used to apply a flat 0.95 step whenever >= 1
+        // day had passed, regardless of HOW MANY days had actually passed —
+        // a machine touched once a week decayed at 0.95/week (≈0.993/day)
+        // instead of the documented 0.95/day. Read the previous timestamp
+        // first so the step can be `0.95 ^ elapsed_days` (compounded),
+        // matching the documented per-day rate regardless of gaps between
+        // calls. (The 0.95 base itself stays hardcoded here — wiring the
+        // CLI's configurable `decay_rate` through to this crate is a
+        // separate, out-of-scope change.)
+        let last_decay_at: Option<String> = self
+            .conn
+            .query_row(
+                "SELECT value FROM icm_metadata WHERE key = 'last_decay_at'",
+                [],
+                |row| row.get(0),
+            )
+            .optional()
+            .map_err(db_err)?;
+        let elapsed_days = last_decay_at
+            .as_deref()
+            .and_then(|prev| prev.parse::<DateTime<Utc>>().ok())
+            .map(|prev| (now - prev).num_seconds() as f64 / 86_400.0)
+            .filter(|d| d.is_finite() && *d > 0.0)
+            .unwrap_or(1.0); // first run ever: preserve the historical single-step behavior
+
+        // Atomic check-and-update: only one caller wins the race. (A narrow
+        // window between the read above and this claim could let a losing
+        // racer's `elapsed_days` be computed from a slightly stale
+        // timestamp, but only one claim ever succeeds — a day or two of
+        // imprecision in a decay RATE is harmless, not worth a stricter
+        // compare-and-swap loop.)
+        let changed = self
+            .conn
+            .execute(
+                "INSERT INTO icm_metadata (key, value) VALUES ('last_decay_at', ?1)
+                 ON CONFLICT(key) DO UPDATE SET value = ?1
+                 WHERE value IS NULL OR julianday(?1) - julianday(value) >= 1.0",
+                params![now_str],
+            )
+            .map_err(db_err)?;
+
+        if changed > 0 {
+            let factor = 0.95_f64.powf(elapsed_days) as f32;
+            self.apply_decay(factor)?;
+        }
+
+        Ok(())
+    }
+
+    /// Delete hook telemetry rows older than `cutoff_rfc3339`. Used by an
+    /// optional retention pass (`icm hook-log --prune-older-than ...`).
+    pub fn prune_hook_events(&self, cutoff_rfc3339: &str) -> IcmResult<usize> {
+        let n = self
+            .conn
+            .execute(
+                "DELETE FROM hook_events WHERE ts < ?1",
+                rusqlite::params![cutoff_rfc3339],
+            )
+            .map_err(db_err)?;
+        Ok(n)
+    }
+
+    /// Automatically consolidate a topic if it exceeds the threshold.
+    ///
+    /// Keeps the top 3 summaries (by weight), merges all unique keywords,
+    /// and replaces all memories with a single consolidated memory.
+    /// Returns `true` if consolidation was performed.
+    ///
+    /// Backwards-compatible no-embedder variant. Prefer
+    /// [`auto_consolidate_with_embedder`] for new code so the
+    /// consolidated memory keeps a fresh embedding instead of being
+    /// silently un-recallable via vector search.
+    pub fn auto_consolidate(&self, topic: &str, threshold: usize) -> IcmResult<bool> {
+        self.auto_consolidate_with_embedder(topic, threshold, None)
+    }
+
+    /// Same as [`auto_consolidate`] but also embeds the consolidated
+    /// memory when an embedder is available.
+    ///
+    /// Audit finding M2/AC2: the no-embedder variant produced a
+    /// consolidated memory with `embedding = None`, leaving it
+    /// invisible to hybrid / vector search until a manual `icm embed`
+    /// rebuilt it. With this variant the embedder is invoked inline so
+    /// the consolidated memory is recall-ready as soon as the topic is
+    /// rolled up.
+    pub fn auto_consolidate_with_embedder(
+        &self,
+        topic: &str,
+        threshold: usize,
+        embedder: Option<&dyn Embedder>,
+    ) -> IcmResult<bool> {
+        let count = self.count_by_topic(topic)?;
+        if count < threshold {
+            return Ok(false);
+        }
+
+        let mut memories = self.get_by_topic(topic)?;
+        // `critical` memories are exempt from consolidation (consolidate_topic
+        // won't delete them), so they neither count toward the threshold nor
+        // feed the rollup summary — otherwise a topic holding >= threshold
+        // criticals would re-consolidate on every store, churning forever.
+        memories.retain(|m| !matches!(m.importance, Importance::Critical));
+        if memories.is_empty() || memories.len() < threshold {
+            return Ok(false);
+        }
+
+        // Sort by weight DESC (get_by_topic already does this, but be explicit)
+        memories.sort_by(|a, b| {
+            b.weight
+                .partial_cmp(&a.weight)
+                .unwrap_or(std::cmp::Ordering::Equal)
+        });
+
+        // Take the top 3 summaries for the consolidated summary
+        let top_summaries: Vec<&str> = memories
+            .iter()
+            .take(3)
+            .map(|m| m.summary.as_str())
+            .collect();
+        let mut consolidated_summary = top_summaries.join(" | ");
+        // Three max-size summaries joined can exceed MAX_SUMMARY_BYTES, and
+        // consolidate_topic now validates its input — truncate on a char
+        // boundary so the rollup can't fail its own size check.
+        if consolidated_summary.len() > MAX_SUMMARY_BYTES {
+            let mut cut = MAX_SUMMARY_BYTES;
+            while !consolidated_summary.is_char_boundary(cut) {
+                cut -= 1;
+            }
+            consolidated_summary.truncate(cut);
+        }
+
+        // Merge all unique keywords
+        let mut all_keywords: Vec<String> = Vec::new();
+        let mut seen_keywords: HashSet<String> = HashSet::new();
+        for mem in &memories {
+            for kw in &mem.keywords {
+                let lower = kw.to_lowercase();
+                if seen_keywords.insert(lower) {
+                    all_keywords.push(kw.clone());
+                }
+            }
+        }
+
+        let original_count = memories.len();
+
+        // Build the consolidated memory
+        let mut consolidated = Memory::new(topic.into(), consolidated_summary, Importance::High);
+        consolidated.keywords = all_keywords;
+        consolidated.raw_excerpt =
+            Some(format!("auto-consolidated from {original_count} memories"));
+        consolidated.weight = 1.0;
+
+        // Embed the consolidated content if an embedder is available so
+        // hybrid recall picks it up immediately. Errors are logged and
+        // swallowed — a partial consolidation (no embedding) is still
+        // better than blocking the whole rollup on an embedder hiccup.
+        if let Some(emb) = embedder {
+            match emb.embed(&consolidated.embed_text()) {
+                Ok(vec) => consolidated.embedding = Some(vec),
+                Err(e) => {
+                    tracing::warn!(
+                        "auto-consolidate: embedding failed for topic '{topic}': {e}; \
+                         consolidated memory will lack vector representation"
+                    );
+                }
+            }
+        }
+
+        // Replace all memories in the topic with the consolidated one
+        self.consolidate_topic(topic, consolidated)?;
+
+        Ok(true)
+    }
+}
diff --git a/crates/icm-store/src/store/memoir.rs b/crates/icm-store/src/store/memoir.rs
new file mode 100644
index 00000000..f2017a9c
--- /dev/null
+++ b/crates/icm-store/src/store/memoir.rs
@@ -0,0 +1,652 @@
+//! SQLite backend — split out of the former monolithic `store.rs`.
+//!
+//! `SqliteStore` and the shared row/parse helpers live in `super`
+//! (`store/mod.rs`); each submodule here holds one trait impl (or a
+//! coherent group of inherent methods) on that type.
+
+use super::*;
+use rusqlite::OptionalExtension;
+
+fn row_to_memoir(row: &rusqlite::Row) -> rusqlite::Result<Memoir> {
+    Ok(Memoir {
+        id: row.get(0)?,
+        name: row.get(1)?,
+        description: row.get(2)?,
+        created_at: parse_dt(&row.get::<_, String>(3)?),
+        updated_at: parse_dt(&row.get::<_, String>(4)?),
+        consolidation_threshold: row.get::<_, u32>(5)?,
+    })
+}
+
+const MEMOIR_COLS: &str = "id, name, description, created_at, updated_at, consolidation_threshold";
+
+fn row_to_concept(row: &rusqlite::Row) -> rusqlite::Result<Concept> {
+    let labels_json: String = row.get(4)?;
+    let labels: Vec<Label> = serde_json::from_str(&labels_json).unwrap_or_default();
+
+    let source_ids_json: String = row.get(9)?;
+    let source_memory_ids: Vec<String> = serde_json::from_str(&source_ids_json).unwrap_or_default();
+
+    Ok(Concept {
+        id: row.get(0)?,
+        memoir_id: row.get(1)?,
+        name: row.get(2)?,
+        definition: row.get(3)?,
+        labels,
+        confidence: row.get(5)?,
+        revision: row.get::<_, u32>(6)?,
+        created_at: parse_dt(&row.get::<_, String>(7)?),
+        updated_at: parse_dt(&row.get::<_, String>(8)?),
+        source_memory_ids,
+    })
+}
+
+const CONCEPT_COLS: &str = "id, memoir_id, name, definition, labels, confidence, \
+                            revision, created_at, updated_at, source_memory_ids";
+
+fn row_to_link(row: &rusqlite::Row) -> rusqlite::Result<ConceptLink> {
+    let relation_str: String = row.get(3)?;
+    let relation: Relation = relation_str.parse().unwrap_or(Relation::RelatedTo);
+
+    Ok(ConceptLink {
+        id: row.get(0)?,
+        source_id: row.get(1)?,
+        target_id: row.get(2)?,
+        relation,
+        weight: row.get(4)?,
+        created_at: parse_dt(&row.get::<_, String>(5)?),
+    })
+}
+
+const LINK_COLS: &str = "id, source_id, target_id, relation, weight, created_at";
+
+// MemoirStore impl
+
+impl MemoirStore for SqliteStore {
+    // Memoir CRUD
+
+    fn create_memoir(&self, memoir: Memoir) -> IcmResult<String> {
+        self.conn
+            .execute(
+                "INSERT INTO memoirs (id, name, description, created_at, updated_at, consolidation_threshold)
+                 VALUES (?1, ?2, ?3, ?4, ?5, ?6)",
+                params![
+                    memoir.id,
+                    memoir.name,
+                    memoir.description,
+                    memoir.created_at.to_rfc3339(),
+                    memoir.updated_at.to_rfc3339(),
+                    memoir.consolidation_threshold,
+                ],
+            )
+            .map_err(db_err)?;
+        Ok(memoir.id)
+    }
+
+    fn get_memoir(&self, id: &str) -> IcmResult<Option<Memoir>> {
+        self.conn
+            .prepare(&format!("SELECT {MEMOIR_COLS} FROM memoirs WHERE id = ?1"))
+            .map_err(db_err)?
+            .query_row(params![id], row_to_memoir)
+            .optional()
+            .map_err(|e| IcmError::Database(e.to_string()))
+    }
+
+    fn get_memoir_by_name(&self, name: &str) -> IcmResult<Option<Memoir>> {
+        self.conn
+            .prepare(&format!(
+                "SELECT {MEMOIR_COLS} FROM memoirs WHERE name = ?1"
+            ))
+            .map_err(db_err)?
+            .query_row(params![name], row_to_memoir)
+            .optional()
+            .map_err(|e| IcmError::Database(e.to_string()))
+    }
+
+    fn update_memoir(&self, memoir: &Memoir) -> IcmResult<()> {
+        let changed = self
+            .conn
+            .execute(
+                "UPDATE memoirs SET name = ?2, description = ?3, updated_at = ?4,
+                 consolidation_threshold = ?5 WHERE id = ?1",
+                params![
+                    memoir.id,
+                    memoir.name,
+                    memoir.description,
+                    memoir.updated_at.to_rfc3339(),
+                    memoir.consolidation_threshold,
+                ],
+            )
+            .map_err(db_err)?;
+
+        if changed == 0 {
+            return Err(IcmError::NotFound(memoir.id.clone()));
+        }
+        Ok(())
+    }
+
+    fn delete_memoir(&self, id: &str) -> IcmResult<()> {
+        let changed = self
+            .conn
+            .execute("DELETE FROM memoirs WHERE id = ?1", params![id])
+            .map_err(db_err)?;
+
+        if changed == 0 {
+            return Err(IcmError::NotFound(id.to_string()));
+        }
+        Ok(())
+    }
+
+    fn list_memoirs(&self) -> IcmResult<Vec<Memoir>> {
+        let mut stmt = self
+            .conn
+            .prepare(&format!(
+                "SELECT {MEMOIR_COLS} FROM memoirs ORDER BY name LIMIT 500"
+            ))
+            .map_err(db_err)?;
+
+        let rows = stmt.query_map([], row_to_memoir).map_err(db_err)?;
+
+        collect_rows(rows)
+    }
+
+    // Concept CRUD
+
+    fn add_concept(&self, concept: Concept) -> IcmResult<String> {
+        let labels_json = serde_json::to_string(&concept.labels)?;
+        let source_ids_json = serde_json::to_string(&concept.source_memory_ids)?;
+
+        self.conn
+            .execute(
+                "INSERT INTO concepts (id, memoir_id, name, definition, labels, confidence,
+                 revision, created_at, updated_at, source_memory_ids)
+                 VALUES (?1, ?2, ?3, ?4, ?5, ?6, ?7, ?8, ?9, ?10)",
+                params![
+                    concept.id,
+                    concept.memoir_id,
+                    concept.name,
+                    concept.definition,
+                    labels_json,
+                    concept.confidence,
+                    concept.revision,
+                    concept.created_at.to_rfc3339(),
+                    concept.updated_at.to_rfc3339(),
+                    source_ids_json,
+                ],
+            )
+            .map_err(db_err)?;
+        Ok(concept.id)
+    }
+
+    fn get_concept(&self, id: &str) -> IcmResult<Option<Concept>> {
+        self.conn
+            .prepare(&format!(
+                "SELECT {CONCEPT_COLS} FROM concepts WHERE id = ?1"
+            ))
+            .map_err(db_err)?
+            .query_row(params![id], row_to_concept)
+            .optional()
+            .map_err(|e| IcmError::Database(e.to_string()))
+    }
+
+    fn get_concept_by_name(&self, memoir_id: &str, name: &str) -> IcmResult<Option<Concept>> {
+        self.conn
+            .prepare(&format!(
+                "SELECT {CONCEPT_COLS} FROM concepts WHERE memoir_id = ?1 AND name = ?2"
+            ))
+            .map_err(db_err)?
+            .query_row(params![memoir_id, name], row_to_concept)
+            .optional()
+            .map_err(|e| IcmError::Database(e.to_string()))
+    }
+
+    fn update_concept(&self, concept: &Concept) -> IcmResult<()> {
+        let labels_json = serde_json::to_string(&concept.labels)?;
+        let source_ids_json = serde_json::to_string(&concept.source_memory_ids)?;
+
+        let changed = self
+            .conn
+            .execute(
+                "UPDATE concepts SET memoir_id = ?2, name = ?3, definition = ?4, labels = ?5,
+                 confidence = ?6, revision = ?7, updated_at = ?8, source_memory_ids = ?9
+                 WHERE id = ?1",
+                params![
+                    concept.id,
+                    concept.memoir_id,
+                    concept.name,
+                    concept.definition,
+                    labels_json,
+                    concept.confidence,
+                    concept.revision,
+                    concept.updated_at.to_rfc3339(),
+                    source_ids_json,
+                ],
+            )
+            .map_err(db_err)?;
+
+        if changed == 0 {
+            return Err(IcmError::NotFound(concept.id.clone()));
+        }
+        Ok(())
+    }
+
+    fn delete_concept(&self, id: &str) -> IcmResult<()> {
+        let changed = self
+            .conn
+            .execute("DELETE FROM concepts WHERE id = ?1", params![id])
+            .map_err(db_err)?;
+
+        if changed == 0 {
+            return Err(IcmError::NotFound(id.to_string()));
+        }
+        Ok(())
+    }
+
+    // Concept Search
+
+    fn list_concepts(&self, memoir_id: &str) -> IcmResult<Vec<Concept>> {
+        let mut stmt = self
+            .conn
+            .prepare(&format!(
+                "SELECT {CONCEPT_COLS} FROM concepts WHERE memoir_id = ?1 ORDER BY name LIMIT 1000"
+            ))
+            .map_err(db_err)?;
+
+        let rows = stmt
+            .query_map(params![memoir_id], row_to_concept)
+            .map_err(db_err)?;
+
+        collect_rows(rows)
+    }
+
+    fn search_concepts_fts(
+        &self,
+        memoir_id: &str,
+        query: &str,
+        limit: usize,
+    ) -> IcmResult<Vec<Concept>> {
+        let sanitized = sanitize_fts_query(query);
+        if sanitized.is_empty() {
+            return Ok(Vec::new());
+        }
+
+        let sql = format!(
+            "SELECT {CONCEPT_COLS} FROM concepts
+             WHERE memoir_id = ?1
+               AND id IN (SELECT id FROM concepts_fts WHERE concepts_fts MATCH ?2)
+             ORDER BY confidence DESC
+             LIMIT ?3"
+        );
+
+        let mut stmt = self.conn.prepare(&sql).map_err(db_err)?;
+
+        let rows = stmt
+            .query_map(params![memoir_id, sanitized, limit as i64], row_to_concept)
+            .map_err(db_err)?;
+
+        collect_rows(rows)
+    }
+
+    fn search_all_concepts_fts(&self, query: &str, limit: usize) -> IcmResult<Vec<Concept>> {
+        let sanitized = sanitize_fts_query(query);
+        if sanitized.is_empty() {
+            return Ok(Vec::new());
+        }
+
+        let sql = format!(
+            "SELECT {CONCEPT_COLS} FROM concepts
+             WHERE id IN (SELECT id FROM concepts_fts WHERE concepts_fts MATCH ?1)
+             ORDER BY confidence DESC
+             LIMIT ?2"
+        );
+
+        let mut stmt = self.conn.prepare(&sql).map_err(db_err)?;
+
+        let rows = stmt
+            .query_map(params![sanitized, limit as i64], row_to_concept)
+            .map_err(db_err)?;
+
+        collect_rows(rows)
+    }
+
+    fn search_concepts_by_label(
+        &self,
+        memoir_id: &str,
+        label: &Label,
+        limit: usize,
+    ) -> IcmResult<Vec<Concept>> {
+        // Search JSON labels column using LIKE with the serialized label pattern.
+        // namespace/value come from the caller (MCP tool args) and can contain
+        // %/_ ; escape them so they can't turn into unintended wildcards.
+        let pattern = format!(
+            "%\"namespace\":\"{}\"%\"value\":\"{}\"%",
+            escape_like_wildcards(&label.namespace),
+            escape_like_wildcards(&label.value)
+        );
+
+        let sql = format!(
+            "SELECT {CONCEPT_COLS} FROM concepts
+             WHERE memoir_id = ?1 AND labels LIKE ?2 ESCAPE '\\'
+             ORDER BY confidence DESC
+             LIMIT ?3"
+        );
+
+        let mut stmt = self.conn.prepare(&sql).map_err(db_err)?;
+
+        let rows = stmt
+            .query_map(params![memoir_id, pattern, limit as i64], row_to_concept)
+            .map_err(db_err)?;
+
+        collect_rows(rows)
+    }
+
+    // Refinement
+
+    fn refine_concept(
+        &self,
+        id: &str,
+        new_definition: &str,
+        new_source_ids: &[String],
+    ) -> IcmResult<()> {
+        // Get existing concept to merge source IDs
+        let concept = self
+            .get_concept(id)?
+            .ok_or_else(|| IcmError::NotFound(id.to_string()))?;
+
+        let mut merged_sources = concept.source_memory_ids;
+        for sid in new_source_ids {
+            if !merged_sources.contains(sid) {
+                merged_sources.push(sid.clone());
+            }
+        }
+        let source_ids_json = serde_json::to_string(&merged_sources)?;
+
+        let now = Utc::now().to_rfc3339();
+        let new_confidence = (concept.confidence + 0.1).min(1.0);
+
+        self.conn
+            .execute(
+                "UPDATE concepts SET definition = ?2, revision = revision + 1,
+                 confidence = ?3, updated_at = ?4, source_memory_ids = ?5
+                 WHERE id = ?1",
+                params![id, new_definition, new_confidence, now, source_ids_json],
+            )
+            .map_err(db_err)?;
+
+        Ok(())
+    }
+
+    // Graph
+
+    fn add_link(&self, link: ConceptLink) -> IcmResult<String> {
+        // Reject self-links: A→A is meaningless and produces a 1-step
+        // cycle. Caller usually catches this earlier but the store is
+        // the authoritative invariant gate.
+        if link.source_id == link.target_id {
+            return Err(IcmError::InvalidInput(format!(
+                "self-link rejected: source and target are the same concept ({})",
+                link.source_id
+            )));
+        }
+        // Cycle detection: BFS from `target` following outgoing edges.
+        // If we can reach `source`, the new edge would close a cycle
+        // (source → target → ... → source). Reject before insert.
+        //
+        // The BFS is bounded by the number of links currently in the
+        // memoir, so worst-case it touches every link once. For typical
+        // memoirs (<10k links) this is sub-millisecond.
+        if self.would_create_cycle(&link.source_id, &link.target_id)? {
+            return Err(IcmError::InvalidInput(format!(
+                "concept link rejected: {} → {} would create a cycle in the graph",
+                link.source_id, link.target_id
+            )));
+        }
+        self.conn
+            .execute(
+                "INSERT INTO concept_links (id, source_id, target_id, relation, weight, created_at)
+                 VALUES (?1, ?2, ?3, ?4, ?5, ?6)",
+                params![
+                    link.id,
+                    link.source_id,
+                    link.target_id,
+                    link.relation.to_string(),
+                    link.weight,
+                    link.created_at.to_rfc3339(),
+                ],
+            )
+            .map_err(db_err)?;
+        Ok(link.id)
+    }
+
+    fn get_links_from(&self, concept_id: &str) -> IcmResult<Vec<ConceptLink>> {
+        let mut stmt = self
+            .conn
+            .prepare(&format!(
+                "SELECT {LINK_COLS} FROM concept_links WHERE source_id = ?1"
+            ))
+            .map_err(db_err)?;
+
+        let rows = stmt
+            .query_map(params![concept_id], row_to_link)
+            .map_err(db_err)?;
+
+        collect_rows(rows)
+    }
+
+    fn get_links_to(&self, concept_id: &str) -> IcmResult<Vec<ConceptLink>> {
+        let mut stmt = self
+            .conn
+            .prepare(&format!(
+                "SELECT {LINK_COLS} FROM concept_links WHERE target_id = ?1"
+            ))
+            .map_err(db_err)?;
+
+        let rows = stmt
+            .query_map(params![concept_id], row_to_link)
+            .map_err(db_err)?;
+
+        collect_rows(rows)
+    }
+
+    fn delete_link(&self, id: &str) -> IcmResult<()> {
+        let changed = self
+            .conn
+            .execute("DELETE FROM concept_links WHERE id = ?1", params![id])
+            .map_err(db_err)?;
+
+        if changed == 0 {
+            return Err(IcmError::NotFound(id.to_string()));
+        }
+        Ok(())
+    }
+
+    fn get_neighbors(
+        &self,
+        concept_id: &str,
+        relation: Option<Relation>,
+    ) -> IcmResult<Vec<Concept>> {
+        let (sql, p_relation);
+
+        let base = format!(
+            "SELECT {CONCEPT_COLS} FROM concepts WHERE id IN (
+                SELECT target_id FROM concept_links WHERE source_id = ?1 {{filter}}
+                UNION
+                SELECT source_id FROM concept_links WHERE target_id = ?1 {{filter}}
+            )"
+        );
+
+        if let Some(ref r) = relation {
+            p_relation = r.to_string();
+            let filtered = base.replace("{filter}", "AND relation = ?2");
+            sql = filtered;
+        } else {
+            p_relation = String::new();
+            sql = base.replace("{filter}", "");
+        };
+
+        let mut stmt = self.conn.prepare(&sql).map_err(db_err)?;
+
+        let rows = if relation.is_some() {
+            stmt.query_map(params![concept_id, p_relation], row_to_concept)
+                .map_err(db_err)?
+        } else {
+            stmt.query_map(params![concept_id], row_to_concept)
+                .map_err(db_err)?
+        };
+
+        collect_rows(rows)
+    }
+
+    fn get_neighborhood(
+        &self,
+        concept_id: &str,
+        depth: usize,
+    ) -> IcmResult<(Vec<Concept>, Vec<ConceptLink>)> {
+        let mut visited: HashSet<String> = HashSet::new();
+        let mut queue: VecDeque<(String, usize)> = VecDeque::new();
+        let mut concepts = Vec::new();
+        let mut links = Vec::new();
+
+        // Seed with the root concept
+        if let Some(root) = self.get_concept(concept_id)? {
+            visited.insert(root.id.clone());
+            queue.push_back((root.id.clone(), 0));
+            concepts.push(root);
+        } else {
+            return Err(IcmError::NotFound(concept_id.to_string()));
+        }
+
+        while let Some((current_id, current_depth)) = queue.pop_front() {
+            if current_depth >= depth {
+                continue;
+            }
+
+            // Outgoing links
+            let outgoing = self.get_links_from(&current_id)?;
+            for link in outgoing {
+                if !visited.contains(&link.target_id) {
+                    if let Some(c) = self.get_concept(&link.target_id)? {
+                        visited.insert(c.id.clone());
+                        queue.push_back((c.id.clone(), current_depth + 1));
+                        concepts.push(c);
+                    }
+                }
+                links.push(link);
+            }
+
+            // Incoming links
+            let incoming = self.get_links_to(&current_id)?;
+            for link in incoming {
+                if !visited.contains(&link.source_id) {
+                    if let Some(c) = self.get_concept(&link.source_id)? {
+                        visited.insert(c.id.clone());
+                        queue.push_back((c.id.clone(), current_depth + 1));
+                        concepts.push(c);
+                    }
+                }
+                links.push(link);
+            }
+        }
+
+        Ok((concepts, links))
+    }
+
+    // Stats
+
+    fn memoir_stats(&self, memoir_id: &str) -> IcmResult<MemoirStats> {
+        let total_concepts: usize = self
+            .conn
+            .query_row(
+                "SELECT COUNT(*) FROM concepts WHERE memoir_id = ?1",
+                params![memoir_id],
+                |row| row.get(0),
+            )
+            .map_err(db_err)?;
+
+        let total_links: usize = self
+            .conn
+            .query_row(
+                "SELECT COUNT(*) FROM concept_links
+                 WHERE source_id IN (SELECT id FROM concepts WHERE memoir_id = ?1)",
+                params![memoir_id],
+                |row| row.get(0),
+            )
+            .map_err(db_err)?;
+
+        let avg_confidence: f32 = if total_concepts > 0 {
+            self.conn
+                .query_row(
+                    "SELECT AVG(confidence) FROM concepts WHERE memoir_id = ?1",
+                    params![memoir_id],
+                    |row| row.get(0),
+                )
+                .map_err(db_err)?
+        } else {
+            0.0
+        };
+
+        // Count labels via SQL — avoids loading all concepts into memory
+        let mut label_stmt = self
+            .conn
+            .prepare("SELECT labels FROM concepts WHERE memoir_id = ?1 AND labels != '[]'")
+            .map_err(db_err)?;
+        let label_rows = label_stmt
+            .query_map(params![memoir_id], |row| row.get::<_, String>(0))
+            .map_err(db_err)?;
+        let mut label_map: HashMap<String, usize> = HashMap::new();
+        for row in label_rows {
+            let raw = row.map_err(db_err)?;
+            if let Ok(labels) = serde_json::from_str::<Vec<Label>>(&raw) {
+                for l in labels {
+                    *label_map.entry(l.to_string()).or_insert(0) += 1;
+                }
+            }
+        }
+        let mut label_counts: Vec<(String, usize)> = label_map.into_iter().collect();
+        label_counts.sort_by_key(|b| std::cmp::Reverse(b.1));
+
+        Ok(MemoirStats {
+            total_concepts,
+            total_links,
+            avg_confidence,
+            label_counts,
+        })
+    }
+
+    fn get_links_for_memoir(&self, memoir_id: &str) -> IcmResult<Vec<ConceptLink>> {
+        let mut stmt = self
+            .conn
+            .prepare(&format!(
+                "SELECT {LINK_COLS} FROM concept_links
+                 WHERE source_id IN (SELECT id FROM concepts WHERE memoir_id = ?1)
+                 LIMIT 5000"
+            ))
+            .map_err(db_err)?;
+
+        let rows = stmt
+            .query_map(params![memoir_id], row_to_link)
+            .map_err(db_err)?;
+
+        collect_rows(rows)
+    }
+
+    fn batch_memoir_concept_counts(&self) -> IcmResult<HashMap<String, usize>> {
+        let mut stmt = self
+            .conn
+            .prepare("SELECT memoir_id, COUNT(*) FROM concepts GROUP BY memoir_id")
+            .map_err(db_err)?;
+
+        let rows = stmt
+            .query_map([], |row| {
+                Ok((row.get::<_, String>(0)?, row.get::<_, usize>(1)?))
+            })
+            .map_err(db_err)?;
+
+        let mut map = HashMap::new();
+        for row in rows {
+            let (id, count) = row.map_err(db_err)?;
+            map.insert(id, count);
+        }
+        Ok(map)
+    }
+}
diff --git a/crates/icm-store/src/store/memory.rs b/crates/icm-store/src/store/memory.rs
new file mode 100644
index 00000000..fdf728bf
--- /dev/null
+++ b/crates/icm-store/src/store/memory.rs
@@ -0,0 +1,842 @@
+//! SQLite backend — split out of the former monolithic `store.rs`.
+//!
+//! `SqliteStore` and the shared row/parse helpers live in `super`
+//! (`store/mod.rs`); each submodule here holds one trait impl (or a
+//! coherent group of inherent methods) on that type.
+
+use super::*;
+use rusqlite::OptionalExtension;
+
+impl MemoryStore for SqliteStore {
+    fn store(&self, memory: Memory) -> IcmResult<String> {
+        let memory = validate_and_normalize(memory)?;
+
+        self.conn
+            .execute_batch("BEGIN IMMEDIATE;")
+            .map_err(db_err)?;
+
+        match self.store_inner(&memory) {
+            Ok(id) => {
+                self.conn.execute_batch("COMMIT;").map_err(db_err)?;
+                Ok(id)
+            }
+            Err(e) => {
+                let _ = self.conn.execute_batch("ROLLBACK;");
+                Err(e)
+            }
+        }
+    }
+
+    fn get(&self, id: &str) -> IcmResult<Option<Memory>> {
+        if let Some(m) = self.cache_get(id) {
+            return Ok(Some(m));
+        }
+
+        let mut stmt = self
+            .conn
+            .prepare(&format!("SELECT {SELECT_COLS} FROM memories WHERE id = ?1"))
+            .map_err(db_err)?;
+
+        let result = stmt
+            .query_row(params![id], row_to_memory)
+            .optional()
+            .map_err(db_err)?;
+
+        if let Some(ref m) = result {
+            self.cache_put(m);
+        }
+        Ok(result)
+    }
+
+    fn update(&self, memory: &Memory) -> IcmResult<()> {
+        // Same constraints as `store()` — without this, oversized or
+        // NUL-carrying payloads could bypass validation by storing small
+        // then updating big (audit finding).
+        validate_fields(&memory.topic, &memory.summary)?;
+
+        let keywords_json = serde_json::to_string(&memory.keywords)?;
+        let related_json = serde_json::to_string(&memory.related_ids)?;
+        let st = source_type(&memory.source);
+        let sd = source_data(&memory.source);
+        let emb_blob = memory.embedding.as_deref().map(embedding_to_blob);
+
+        // Recompute summary_hash on update — topic or summary may have
+        // changed, and the partial unique index on (topic, summary_hash)
+        // would otherwise reflect stale state.
+        let hash = summary_hash(&memory.topic, &memory.summary);
+
+        // memories + vec_memories must move together: a failure between the
+        // row update and the vector sync would leave a memory invisible to
+        // (or stale in) vector search (audit finding — same pattern as
+        // `store()` / `consolidate_topic`).
+        self.conn
+            .execute_batch("BEGIN IMMEDIATE;")
+            .map_err(db_err)?;
+
+        let result: IcmResult<()> = (|| {
+            let changed = self
+                .conn
+                .execute(
+                    "UPDATE memories SET
+                     updated_at = ?2, last_accessed = ?3, access_count = ?4, weight = ?5,
+                     topic = ?6, summary = ?7, raw_excerpt = ?8, keywords = ?9,
+                     importance = ?10, source_type = ?11, source_data = ?12, related_ids = ?13,
+                     embedding = ?14, summary_hash = ?15
+                     WHERE id = ?1",
+                    params![
+                        memory.id,
+                        memory.updated_at.to_rfc3339(),
+                        memory.last_accessed.to_rfc3339(),
+                        memory.access_count,
+                        memory.weight,
+                        memory.topic,
+                        memory.summary,
+                        memory.raw_excerpt,
+                        keywords_json,
+                        memory.importance.to_string(),
+                        st,
+                        sd,
+                        related_json,
+                        emb_blob,
+                        hash,
+                    ],
+                )
+                .map_err(db_err)?;
+
+            if changed == 0 {
+                return Err(IcmError::NotFound(memory.id.clone()));
+            }
+
+            // Sync vec_memories: always delete old, re-insert if embedding exists
+            self.conn
+                .execute(
+                    "DELETE FROM vec_memories WHERE memory_id = ?1",
+                    params![memory.id],
+                )
+                .map_err(db_err)?;
+            if let Some(ref blob) = emb_blob {
+                self.conn
+                    .execute(
+                        "INSERT INTO vec_memories (memory_id, embedding) VALUES (?1, ?2)",
+                        params![memory.id, blob],
+                    )
+                    .map_err(db_err)?;
+            }
+            Ok(())
+        })();
+
+        match result {
+            Ok(()) => {
+                self.conn.execute_batch("COMMIT;").map_err(db_err)?;
+                self.cache_invalidate(&memory.id);
+                Ok(())
+            }
+            Err(e) => {
+                let _ = self.conn.execute_batch("ROLLBACK;");
+                Err(e)
+            }
+        }
+    }
+
+    fn delete(&self, id: &str) -> IcmResult<()> {
+        // Both deletes in one transaction so a failure can't strand an
+        // orphaned vector or a memory whose vector is gone (audit finding).
+        self.conn
+            .execute_batch("BEGIN IMMEDIATE;")
+            .map_err(db_err)?;
+
+        let result: IcmResult<()> = (|| {
+            self.conn
+                .execute("DELETE FROM vec_memories WHERE memory_id = ?1", params![id])
+                .map_err(db_err)?;
+
+            let changed = self
+                .conn
+                .execute("DELETE FROM memories WHERE id = ?1", params![id])
+                .map_err(db_err)?;
+
+            if changed == 0 {
+                return Err(IcmError::NotFound(id.to_string()));
+            }
+
+            // Manual-testing finding: deleting a memory left it as a
+            // dangling entry in every other memory's `related_ids`
+            // (auto-link back-references) forever — `expand_with_neighbors`
+            // tolerates the miss silently, but each stale id still spends a
+            // slot out of the caller's `max_neighbors` budget instead of
+            // surfacing a real, live neighbor, and any external consumer of
+            // the JSON export sees a reference to nothing. Strip the
+            // deleted id from every `related_ids` array that mentions it.
+            // The `LIKE` clause is a cheap prefilter (only rows that could
+            // possibly match do the JSON rewrite); it matches the
+            // JSON-quoted form specifically so a ULID that happens to be a
+            // literal substring of another can't cause a false hit.
+            self.conn
+                .execute(
+                    "UPDATE memories
+                        SET related_ids = (
+                            SELECT COALESCE(json_group_array(value), '[]')
+                            FROM json_each(memories.related_ids)
+                            WHERE value != ?1
+                        )
+                        WHERE related_ids LIKE '%\"' || ?1 || '\"%'",
+                    params![id],
+                )
+                .map_err(db_err)?;
+
+            Ok(())
+        })();
+
+        match result {
+            Ok(()) => {
+                self.conn.execute_batch("COMMIT;").map_err(db_err)?;
+                // The related_ids cleanup above can touch an arbitrary
+                // number of other rows, not just `id` — clear the whole
+                // cache rather than tracking which ones, so a cached
+                // neighbor's `related_ids` can't keep serving the
+                // just-deleted id after this returns.
+                self.cache_clear();
+                Ok(())
+            }
+            Err(e) => {
+                let _ = self.conn.execute_batch("ROLLBACK;");
+                Err(e)
+            }
+        }
+    }
+
+    fn search_by_keywords(&self, keywords: &[&str], limit: usize) -> IcmResult<Vec<Memory>> {
+        if keywords.is_empty() {
+            return Ok(Vec::new());
+        }
+
+        // Cap keywords to avoid massive SQL generation
+        let keywords = &keywords[..keywords.len().min(50)];
+        let limit = limit.min(100);
+
+        // Audit finding: a keyword containing `%` or `_` was interpolated
+        // straight into the LIKE pattern unescaped. `%` matches every row
+        // (`"100%"` as a keyword becomes the pattern `%100%%%`, which
+        // degrades to "contains 100" at best and can blow up matching);
+        // `_` matches any single character (`"snake_case"` also matches
+        // "snakeXcase"). Both are plausible keywords coming from an LLM via
+        // MCP. Escape them and declare the escape character explicitly.
+        let where_parts: Vec<String> = (0..keywords.len())
+            .map(|i| {
+                let p = i + 1;
+                format!(
+                    "(keywords LIKE ?{p} ESCAPE '\\' OR summary LIKE ?{p} ESCAPE '\\' \
+                     OR topic LIKE ?{p} ESCAPE '\\')"
+                )
+            })
+            .collect();
+        let where_clause = where_parts.join(" OR ");
+
+        let query = format!(
+            "SELECT {SELECT_COLS} FROM memories WHERE {where_clause} ORDER BY weight DESC LIMIT ?{}",
+            keywords.len() + 1
+        );
+
+        let mut stmt = self.conn.prepare(&query).map_err(db_err)?;
+
+        let mut param_values: Vec<Box<dyn rusqlite::types::ToSql>> = keywords
+            .iter()
+            .map(|k| {
+                Box::new(format!("%{}%", escape_like_wildcards(k)))
+                    as Box<dyn rusqlite::types::ToSql>
+            })
+            .collect();
+        param_values.push(Box::new(limit as i64));
+
+        let params_ref: Vec<&dyn rusqlite::types::ToSql> =
+            param_values.iter().map(|p| p.as_ref()).collect();
+
+        let rows = stmt
+            .query_map(params_ref.as_slice(), row_to_memory)
+            .map_err(db_err)?;
+
+        collect_rows(rows)
+    }
+
+    fn search_fts(&self, query: &str, limit: usize) -> IcmResult<Vec<Memory>> {
+        let limit = limit.min(100);
+        let sanitized = sanitize_fts_query(query);
+        if sanitized.is_empty() {
+            return Ok(Vec::new());
+        }
+
+        let sql = format!(
+            "SELECT {SELECT_COLS} FROM memories
+             WHERE id IN (
+                 SELECT id FROM memories_fts WHERE memories_fts MATCH ?1
+             )
+             ORDER BY weight DESC
+             LIMIT ?2"
+        );
+
+        let mut stmt = self.conn.prepare(&sql).map_err(db_err)?;
+
+        let rows = stmt
+            .query_map(params![sanitized, limit as i64], row_to_memory)
+            .map_err(db_err)?;
+
+        collect_rows(rows)
+    }
+
+    fn search_by_embedding(
+        &self,
+        embedding: &[f32],
+        limit: usize,
+    ) -> IcmResult<Vec<(Memory, f32)>> {
+        let query_blob = embedding_to_blob(embedding);
+
+        // KNN query on vec0 virtual table (requires LIMIT in the query itself)
+        let mut knn_stmt = self
+            .conn
+            .prepare(
+                "SELECT memory_id, distance
+                 FROM vec_memories
+                 WHERE embedding MATCH ?1
+                 ORDER BY distance
+                 LIMIT ?2",
+            )
+            .map_err(db_err)?;
+
+        let knn_rows: Vec<(String, f32)> = knn_stmt
+            .query_map(params![query_blob, limit as i64], |row| {
+                Ok((row.get::<_, String>(0)?, row.get::<_, f32>(1)?))
+            })
+            .map_err(db_err)?
+            .filter_map(|r| r.ok())
+            .collect();
+
+        if knn_rows.is_empty() {
+            return Ok(Vec::new());
+        }
+
+        // Batch fetch all memories in one query
+        let placeholders: Vec<String> = (1..=knn_rows.len()).map(|i| format!("?{i}")).collect();
+        let sql = format!(
+            "SELECT {SELECT_COLS} FROM memories WHERE id IN ({})",
+            placeholders.join(", ")
+        );
+        let mut stmt = self.conn.prepare(&sql).map_err(db_err)?;
+
+        let ids: Vec<&str> = knn_rows.iter().map(|(id, _)| id.as_str()).collect();
+        let params: Vec<&dyn rusqlite::types::ToSql> = ids
+            .iter()
+            .map(|id| id as &dyn rusqlite::types::ToSql)
+            .collect();
+
+        let rows = stmt.query_map(&*params, row_to_memory).map_err(db_err)?;
+
+        let mut memory_map: std::collections::HashMap<String, Memory> = HashMap::new();
+        for row in rows.flatten() {
+            memory_map.insert(row.id.clone(), row);
+        }
+
+        // Reassemble in KNN order with similarity scores
+        let results: Vec<(Memory, f32)> = knn_rows
+            .into_iter()
+            .filter_map(|(id, distance)| memory_map.remove(&id).map(|mem| (mem, 1.0 - distance)))
+            .collect();
+
+        Ok(results)
+    }
+
+    fn search_hybrid(
+        &self,
+        query: &str,
+        embedding: &[f32],
+        limit: usize,
+    ) -> IcmResult<Vec<(Memory, f32)>> {
+        let limit = limit.min(1000);
+        let pool_size = limit * 4;
+        let sanitized = sanitize_fts_query(query);
+
+        // 1. Get FTS results with rank scores
+        let fts_sql =
+            "SELECT m.id, m.created_at, m.updated_at, m.last_accessed, m.access_count, m.weight, \
+                    m.topic, m.summary, m.raw_excerpt, m.keywords, \
+                    m.importance, m.source_type, m.source_data, m.related_ids, m.embedding, \
+                    fts.rank \
+             FROM memories_fts fts \
+             JOIN memories m ON m.id = fts.id \
+             WHERE memories_fts MATCH ?1 \
+             ORDER BY fts.rank \
+             LIMIT ?2";
+
+        let mut fts_scores: HashMap<String, f32> = HashMap::with_capacity(pool_size);
+        let mut all_memories: HashMap<String, Memory> = HashMap::with_capacity(pool_size);
+
+        if !sanitized.is_empty() {
+            if let Ok(mut stmt) = self.conn.prepare(fts_sql) {
+                if let Ok(rows) = stmt.query_map(params![sanitized, pool_size as i64], |row| {
+                    let memory = row_to_memory(row)?;
+                    let rank: f32 = row.get(15)?;
+                    Ok((memory, rank))
+                }) {
+                    for row in rows.flatten() {
+                        let (memory, rank) = row;
+                        // FTS5 bm25 rank is <= 0, MORE negative = MORE
+                        // relevant. `1.0 / (1.0 + |rank|)` inverted this: it
+                        // DECREASES as relevance increases (audit finding,
+                        // proven wrong e.g. rank=-4.83 (strong match) scored
+                        // 0.17 while rank=-0.2 (weak match) scored 0.83).
+                        // `|rank| / (1.0 + |rank|)` keeps the same bounded
+                        // [0,1) shape but is correctly monotonically
+                        // INCREASING in relevance.
+                        let score = rank.abs() / (1.0 + rank.abs());
+                        fts_scores.insert(memory.id.clone(), score);
+                        all_memories.insert(memory.id.clone(), memory);
+                    }
+                }
+            }
+        } // sanitized.is_empty()
+
+        // 2. Get vector results
+        let vec_results = self.search_by_embedding(embedding, pool_size)?;
+        let mut vec_scores: HashMap<String, f32> = HashMap::with_capacity(pool_size);
+        for (memory, similarity) in vec_results {
+            vec_scores.insert(memory.id.clone(), similarity);
+            all_memories.entry(memory.id.clone()).or_insert(memory);
+        }
+
+        // 3. Combine scores: 30% FTS + 70% vector
+        let keys: Vec<String> = all_memories.keys().cloned().collect();
+        let mut scored: Vec<(String, f32)> = Vec::with_capacity(keys.len());
+        for id in keys {
+            let fts_score = fts_scores.get(&id).copied().unwrap_or(0.0);
+            let vec_score = vec_scores.get(&id).copied().unwrap_or(0.0);
+            let combined = 0.3 * fts_score + 0.7 * vec_score;
+            scored.push((id, combined));
+        }
+
+        // Sort by combined score descending
+        scored.sort_by(|a, b| b.1.partial_cmp(&a.1).unwrap_or(std::cmp::Ordering::Equal));
+        scored.truncate(limit);
+
+        let results: Vec<(Memory, f32)> = scored
+            .into_iter()
+            .filter_map(|(id, score)| all_memories.remove(&id).map(|mem| (mem, score)))
+            .collect();
+
+        Ok(results)
+    }
+
+    fn update_access(&self, id: &str) -> IcmResult<()> {
+        // Read-only short-circuit (issue #263): callers of recall expect
+        // this to be best-effort bookkeeping, not a hard precondition.
+        // Skipping silently lets `icm recall` work against a DB the
+        // process cannot write to.
+        if self.readonly {
+            return Ok(());
+        }
+        let now = Utc::now().to_rfc3339();
+        let changed = self
+            .conn
+            .execute(
+                "UPDATE memories SET last_accessed = ?1, access_count = access_count + 1 WHERE id = ?2",
+                params![now, id],
+            )
+            .map_err(db_err)?;
+
+        if changed == 0 {
+            return Err(IcmError::NotFound(id.to_string()));
+        }
+        self.cache_invalidate(id);
+        Ok(())
+    }
+
+    fn batch_update_access(&self, ids: &[&str]) -> IcmResult<usize> {
+        if ids.is_empty() {
+            return Ok(0);
+        }
+        if self.readonly {
+            // Same rationale as `update_access` (issue #263).
+            return Ok(0);
+        }
+        let now = Utc::now().to_rfc3339();
+        let placeholders: Vec<String> = (2..=ids.len() + 1).map(|i| format!("?{i}")).collect();
+        let sql = format!(
+            "UPDATE memories SET last_accessed = ?1, access_count = access_count + 1 WHERE id IN ({})",
+            placeholders.join(", ")
+        );
+        let mut params_vec: Vec<Box<dyn rusqlite::types::ToSql>> =
+            Vec::with_capacity(ids.len() + 1);
+        params_vec.push(Box::new(now));
+        for id in ids {
+            params_vec.push(Box::new(id.to_string()));
+        }
+        let refs: Vec<&dyn rusqlite::types::ToSql> =
+            params_vec.iter().map(|p| p.as_ref()).collect();
+        let changed = self.conn.execute(&sql, refs.as_slice()).map_err(db_err)?;
+        self.cache_invalidate_many(ids);
+        Ok(changed)
+    }
+
+    fn apply_decay(&self, decay_factor: f32) -> IcmResult<usize> {
+        if self.readonly {
+            return Err(IcmError::ReadOnly("apply_decay".into()));
+        }
+        // Access-aware decay: frequently accessed memories decay slower.
+        // decay = base_rate * importance_multiplier / (1 + min(access_count, 5) * 0.1)
+        //
+        // Audit #185 H7: the access-count term used to be uncapped
+        // (`1 + access_count * 0.1`). A memory with `access_count=100`
+        // got a 11x slowdown on its decay, which made it effectively
+        // immune to pruning even at low importance. Anyone (or any
+        // bench loop, or any benign hook-driven recall pattern) that
+        // touched a memory many times pinned it near the top of the
+        // ranking forever — the same gaming class as the M01 issue
+        // the maintainer flagged earlier.
+        //
+        // Cap at 5 accesses → max 1.5x slowdown (33%). That preserves
+        // the original intent ("useful memories decay a bit slower")
+        // without giving any single memory infinite decay immunity.
+        // Critical-importance memories still skip decay entirely.
+        //
+        // Importance multipliers:
+        //   critical: never decays (filtered by WHERE clause)
+        //   high:     0.5x decay (half speed)
+        //   medium:   1.0x decay (normal)
+        //   low:      2.0x decay (double speed)
+        // Audit finding: for `low` importance (2x multiplier) with a
+        // low-access memory, the multiplier `1.0 - (1.0-f)*mult/denom` goes
+        // NEGATIVE once `f < 0.5` — `icm decay --factor 0.4` (accepted by
+        // the CLI's own `[0.0, 1.0)` validation) drove low-importance
+        // weights negative, putting them last in every `ORDER BY weight
+        // DESC` and prunable on the next pass. `MAX(0.0, ...)` clamps the
+        // multiplier at the SQL layer so weight can never go negative
+        // regardless of the caller (CLI, MCP, or any future direct caller
+        // that bypasses the CLI's own boundary check).
+        let changed = self
+            .conn
+            .execute(
+                "UPDATE memories SET weight = weight * MAX(0.0,
+                    1.0 - (1.0 - ?1) *
+                    CASE importance
+                        WHEN 'high' THEN 0.5
+                        WHEN 'low' THEN 2.0
+                        ELSE 1.0
+                    END
+                    / (1.0 + MIN(access_count, 5) * 0.1)
+                )
+                WHERE importance != 'critical'",
+                params![decay_factor],
+            )
+            .map_err(db_err)?;
+
+        // Decay touches every non-critical row's weight; can't selectively
+        // invalidate without re-reading rows, so just nuke the cache.
+        self.cache_clear();
+        Ok(changed)
+    }
+
+    fn prune(&self, weight_threshold: f32) -> IcmResult<usize> {
+        // Never prune critical or high importance memories. Both deletes in
+        // one transaction, and the vec_memories error is propagated instead
+        // of swallowed — a partial prune would leave orphaned vectors that
+        // keep matching KNN search for rows that no longer exist (audit
+        // finding).
+        self.conn
+            .execute_batch("BEGIN IMMEDIATE;")
+            .map_err(db_err)?;
+
+        let result: IcmResult<usize> = (|| {
+            self.conn.execute(
+                "DELETE FROM vec_memories WHERE memory_id IN (
+                    SELECT id FROM memories WHERE weight < ?1 AND importance NOT IN ('critical', 'high')
+                )",
+                params![weight_threshold],
+            )
+            .map_err(db_err)?;
+
+            self.conn
+                .execute(
+                    "DELETE FROM memories WHERE weight < ?1 AND importance NOT IN ('critical', 'high')",
+                    params![weight_threshold],
+                )
+                .map_err(db_err)
+        })();
+
+        match result {
+            Ok(changed) => {
+                self.conn.execute_batch("COMMIT;").map_err(db_err)?;
+                if changed > 0 {
+                    self.cache_clear();
+                }
+                Ok(changed)
+            }
+            Err(e) => {
+                let _ = self.conn.execute_batch("ROLLBACK;");
+                Err(e)
+            }
+        }
+    }
+
+    fn get_by_topic(&self, topic: &str) -> IcmResult<Vec<Memory>> {
+        let mut stmt = self
+            .conn
+            .prepare(&format!(
+                "SELECT {SELECT_COLS} FROM memories WHERE topic = ?1 ORDER BY weight DESC LIMIT 500"
+            ))
+            .map_err(db_err)?;
+
+        let rows = stmt
+            .query_map(params![topic], row_to_memory)
+            .map_err(db_err)?;
+
+        collect_rows(rows)
+    }
+
+    fn list_all(&self) -> IcmResult<Vec<Memory>> {
+        let mut stmt = self
+            .conn
+            .prepare(&format!(
+                "SELECT {SELECT_COLS} FROM memories ORDER BY weight DESC LIMIT 10000"
+            ))
+            .map_err(db_err)?;
+
+        let rows = stmt.query_map([], row_to_memory).map_err(db_err)?;
+        collect_rows(rows)
+    }
+
+    fn list_topics(&self) -> IcmResult<Vec<(String, usize)>> {
+        let mut stmt = self
+            .conn
+            .prepare("SELECT topic, COUNT(*) FROM memories GROUP BY topic ORDER BY topic")
+            .map_err(db_err)?;
+
+        let rows = stmt
+            .query_map([], |row| {
+                Ok((row.get::<_, String>(0)?, row.get::<_, usize>(1)?))
+            })
+            .map_err(db_err)?;
+
+        collect_rows(rows)
+    }
+
+    fn consolidate_topic(&self, topic: &str, consolidated: Memory) -> IcmResult<()> {
+        // The consolidated memory goes through the same validation as any
+        // other write — MCP `icm_memory_consolidate` passes a caller-provided
+        // summary that previously bypassed every size/content check.
+        let consolidated = validate_and_normalize(consolidated)?;
+
+        self.conn
+            .execute_batch("BEGIN IMMEDIATE;")
+            .map_err(db_err)?;
+
+        // Manual-testing finding: captured before the delete below, since
+        // afterward the rows (and thus this query) are gone. Used to clean
+        // up any *other* memory's related_ids that pointed at these —
+        // same dangling-reference bug already fixed for the single-id
+        // `delete`, reachable here too since this is a second, separate
+        // bulk-delete code path.
+        let deleted_ids: Vec<String> = {
+            let mut stmt = self
+                .conn
+                .prepare("SELECT id FROM memories WHERE topic = ?1 AND importance != 'critical'")
+                .map_err(db_err)?;
+            let rows = stmt
+                .query_map(params![topic], |row| row.get::<_, String>(0))
+                .map_err(db_err)?;
+            rows.collect::<rusqlite::Result<Vec<_>>>().map_err(db_err)?
+        };
+
+        // `critical` memories are never deleted — same contract as
+        // `apply_decay` and `prune`. Consolidation replaces the expendable
+        // tail of a topic, not its "never forget" entries (audit finding:
+        // this DELETE previously wiped critical memories too).
+        // Clean vec_memories for entries about to be deleted
+        if let Err(e) = self.conn.execute(
+            "DELETE FROM vec_memories WHERE memory_id IN (
+                SELECT id FROM memories WHERE topic = ?1 AND importance != 'critical'
+            )",
+            params![topic],
+        ) {
+            tracing::warn!(topic, error = %e, "consolidate_topic: rolling back after vec_memories delete failed");
+            let _ = self.conn.execute_batch("ROLLBACK;");
+            return Err(IcmError::Database(e.to_string()));
+        }
+
+        if let Err(e) = self.conn.execute(
+            "DELETE FROM memories WHERE topic = ?1 AND importance != 'critical'",
+            params![topic],
+        ) {
+            tracing::warn!(topic, error = %e, "consolidate_topic: rolling back after memories delete failed");
+            let _ = self.conn.execute_batch("ROLLBACK;");
+            return Err(IcmError::Database(e.to_string()));
+        }
+
+        if !deleted_ids.is_empty() {
+            let ids_json = serde_json::to_string(&deleted_ids).map_err(IcmError::from)?;
+            if let Err(e) = self.conn.execute(
+                "UPDATE memories
+                    SET related_ids = (
+                        SELECT COALESCE(json_group_array(value), '[]')
+                        FROM json_each(memories.related_ids)
+                        WHERE value NOT IN (SELECT value FROM json_each(?1))
+                    )
+                    WHERE EXISTS (
+                        SELECT 1 FROM json_each(memories.related_ids)
+                        WHERE value IN (SELECT value FROM json_each(?1))
+                    )",
+                params![ids_json],
+            ) {
+                tracing::warn!(topic, error = %e, "consolidate_topic: rolling back after related_ids cleanup failed");
+                let _ = self.conn.execute_batch("ROLLBACK;");
+                return Err(IcmError::Database(e.to_string()));
+            }
+        }
+
+        if let Err(e) = self.store_inner(&consolidated) {
+            tracing::warn!(topic, error = %e, "consolidate_topic: rolling back after store failed");
+            let _ = self.conn.execute_batch("ROLLBACK;");
+            return Err(e);
+        }
+
+        // Rebuild FTS index to eliminate any ghost entries from the external
+        // content table.  This guarantees search results stay consistent after
+        // bulk deletes (fixes #44).
+        if let Err(e) = self
+            .conn
+            .execute_batch("INSERT INTO memories_fts(memories_fts) VALUES('rebuild');")
+        {
+            tracing::warn!(topic, error = %e, "consolidate_topic: rolling back after FTS rebuild failed");
+            let _ = self.conn.execute_batch("ROLLBACK;");
+            return Err(IcmError::Database(e.to_string()));
+        }
+
+        self.conn.execute_batch("COMMIT;").map_err(db_err)?;
+        // Bulk delete + re-insert touches arbitrarily many cached entries.
+        self.cache_clear();
+        Ok(())
+    }
+
+    fn count(&self) -> IcmResult<usize> {
+        self.conn
+            .query_row("SELECT COUNT(*) FROM memories", [], |row| {
+                row.get::<_, usize>(0)
+            })
+            .map_err(|e| IcmError::Database(e.to_string()))
+    }
+
+    fn count_by_topic(&self, topic: &str) -> IcmResult<usize> {
+        self.conn
+            .query_row(
+                "SELECT COUNT(*) FROM memories WHERE topic = ?1",
+                params![topic],
+                |row| row.get::<_, usize>(0),
+            )
+            .map_err(|e| IcmError::Database(e.to_string()))
+    }
+
+    fn topic_health(&self, topic: &str) -> IcmResult<TopicHealth> {
+        let row = self
+            .conn
+            .query_row(
+                "SELECT
+                    COUNT(*),
+                    AVG(weight),
+                    AVG(CAST(access_count AS REAL)),
+                    MIN(created_at),
+                    MAX(created_at),
+                    MAX(last_accessed),
+                    SUM(CASE WHEN weight < 0.5
+                         AND julianday('now') - julianday(last_accessed) > 14
+                         THEN 1 ELSE 0 END)
+                 FROM memories WHERE topic = ?1",
+                params![topic],
+                |row| {
+                    Ok((
+                        row.get::<_, usize>(0)?,
+                        row.get::<_, f32>(1)?,
+                        row.get::<_, f32>(2)?,
+                        row.get::<_, Option<String>>(3)?,
+                        row.get::<_, Option<String>>(4)?,
+                        row.get::<_, Option<String>>(5)?,
+                        row.get::<_, usize>(6)?,
+                    ))
+                },
+            )
+            .map_err(db_err)?;
+
+        let (
+            entry_count,
+            avg_weight,
+            avg_access,
+            oldest_str,
+            newest_str,
+            last_accessed_str,
+            stale_count,
+        ) = row;
+
+        if entry_count == 0 {
+            return Err(IcmError::NotFound(format!("topic: {topic}")));
+        }
+
+        let parse_dt = |s: &str| -> Option<DateTime<Utc>> {
+            match DateTime::parse_from_rfc3339(s) {
+                Ok(d) => Some(d.with_timezone(&Utc)),
+                Err(e) => {
+                    tracing::warn!("invalid timestamp '{}': {}", s, e);
+                    None
+                }
+            }
+        };
+
+        Ok(TopicHealth {
+            topic: topic.to_string(),
+            entry_count,
+            avg_weight,
+            avg_access_count: avg_access,
+            oldest: oldest_str.as_deref().and_then(parse_dt),
+            newest: newest_str.as_deref().and_then(parse_dt),
+            last_accessed: last_accessed_str.as_deref().and_then(parse_dt),
+            needs_consolidation: entry_count > 5,
+            stale_count,
+        })
+    }
+
+    fn stats(&self) -> IcmResult<StoreStats> {
+        let (total_memories, total_topics, avg_weight, oldest_str, newest_str): (
+            usize,
+            usize,
+            f32,
+            Option<String>,
+            Option<String>,
+        ) = self
+            .conn
+            .query_row(
+                "SELECT COUNT(*), COUNT(DISTINCT topic), COALESCE(AVG(weight), 0.0), \
+                 MIN(created_at), MAX(created_at) FROM memories",
+                [],
+                |row| {
+                    Ok((
+                        row.get(0)?,
+                        row.get(1)?,
+                        row.get(2)?,
+                        row.get(3)?,
+                        row.get(4)?,
+                    ))
+                },
+            )
+            .map_err(db_err)?;
+
+        let oldest_memory = oldest_str
+            .and_then(|s| DateTime::parse_from_rfc3339(&s).ok())
+            .map(|d| d.with_timezone(&Utc));
+        let newest_memory = newest_str
+            .and_then(|s| DateTime::parse_from_rfc3339(&s).ok())
+            .map(|d| d.with_timezone(&Utc));
+
+        Ok(StoreStats {
+            total_memories,
+            total_topics,
+            avg_weight,
+            oldest_memory,
+            newest_memory,
+        })
+    }
+}
diff --git a/crates/icm-store/src/store/mod.rs b/crates/icm-store/src/store/mod.rs
new file mode 100644
index 00000000..a201f3e0
--- /dev/null
+++ b/crates/icm-store/src/store/mod.rs
@@ -0,0 +1,442 @@
+use std::collections::{HashMap, HashSet, VecDeque};
+use std::num::NonZeroUsize;
+use std::path::Path;
+use std::sync::{Mutex, Once};
+
+use chrono::{DateTime, Utc};
+use lru::LruCache;
+use rusqlite::{ffi::sqlite3_auto_extension, params, Connection, OptionalExtension};
+use sha2::{Digest, Sha256};
+use zerocopy::IntoBytes;
+
+use icm_core::{
+    Concept, ConceptLink, Embedder, Fact, FactsStats, FactsStore, Feedback, FeedbackStats,
+    FeedbackStore, IcmError, IcmResult, Importance, Label, Memoir, MemoirStats, MemoirStore,
+    Memory, MemorySource, MemoryStore, Message, PatternCluster, Relation, Role, Session,
+    StoreStats, TopicHealth, TranscriptHit, TranscriptStats, TranscriptStore,
+};
+
+pub use crate::common::{CodeArea, HookEvent, HookEventInsert, HookStatsRow, PendingRow};
+use crate::schema::init_db_with_dims;
+pub struct SqliteStore {
+    conn: Connection,
+    cache: Mutex<LruCache<String, Memory>>,
+    /// `true` when opened through [`Self::open_readonly`]. Read-like
+    /// methods that would otherwise dirty the DB (auto-decay,
+    /// `update_access`) check this and skip silently; mutation methods
+    /// (`store`, `update`, `delete`, etc.) check this and return
+    /// `IcmError::ReadOnly`. Issue #263.
+    readonly: bool,
+}
+impl SqliteStore {
+    pub fn new(path: &Path) -> IcmResult<Self> {
+        Self::with_dims(path, icm_core::DEFAULT_EMBEDDING_DIMS)
+    }
+
+    /// Open an existing database in read-only mode (issue #263).
+    ///
+    /// Differences vs [`Self::with_dims`]:
+    /// - The parent directory is NOT created.
+    /// - The connection is opened with `SQLITE_OPEN_READ_ONLY` — SQLite
+    ///   itself refuses any DDL/DML that the application might miss.
+    /// - No `PRAGMA journal_mode=WAL` (WAL requires writable access).
+    /// - No `init_db_with_dims` (schema migration would mutate the DB).
+    ///
+    /// Returns an error if the file is absent (caller may want to fall
+    /// through to writable mode then). Use [`std::path::Path::exists`]
+    /// at the call site if you need a missing-DB fast path.
+    pub fn open_readonly(path: &Path) -> IcmResult<Self> {
+        ensure_sqlite_vec();
+        if !path.exists() {
+            return Err(IcmError::NotFound(format!(
+                "database not found at {}",
+                path.display()
+            )));
+        }
+        let conn = open_readonly_connection(path)?;
+        // foreign_keys is a no-op for reads; busy_timeout is still useful
+        // when another writer holds the file.
+        conn.execute_batch("PRAGMA foreign_keys=ON; PRAGMA busy_timeout=30000;")
+            .map_err(db_err)?;
+        Ok(Self {
+            conn,
+            cache: Mutex::new(new_cache()),
+            readonly: true,
+        })
+    }
+
+    /// Open an existing database for maintenance — integrity check and
+    /// repair (issue #313).
+    ///
+    /// Writable (so `REINDEX` and FTS `'rebuild'` can run) but, unlike
+    /// [`Self::with_dims`], it deliberately does NOT:
+    /// - run `init_db_with_dims` — schema migration would fail on, or mutate,
+    ///   a corrupt DB before it can even be inspected;
+    /// - switch `journal_mode` — a damaged file's on-disk format is left
+    ///   exactly as found so recovery reasons about the real state.
+    ///
+    /// Returns [`IcmError::NotFound`] when the file is absent.
+    pub fn open_maintenance(path: &Path) -> IcmResult<Self> {
+        ensure_sqlite_vec();
+        if !path.exists() {
+            return Err(IcmError::NotFound(format!(
+                "database not found at {}",
+                path.display()
+            )));
+        }
+        let conn = Connection::open(path)
+            .map_err(|e| IcmError::Database(format!("cannot open database: {e}")))?;
+        conn.execute_batch("PRAGMA busy_timeout=30000;")
+            .map_err(db_err)?;
+        Ok(Self {
+            conn,
+            cache: Mutex::new(new_cache()),
+            readonly: false,
+        })
+    }
+
+    /// True when the store was opened read-only (issue #263). Read-like
+    /// methods skip side-effect mutations; write methods return
+    /// `IcmError::ReadOnly`.
+    #[must_use]
+    pub fn is_readonly(&self) -> bool {
+        self.readonly
+    }
+
+    /// Peek `icm_metadata.embedding_dims` without running any schema
+    /// migration. Returns `Ok(None)` when the DB file is absent, the
+    /// metadata table doesn't exist (legacy DB), or the row is missing.
+    ///
+    /// Use this *before* calling [`Self::with_dims`] when running in a
+    /// mode that must not trigger a destructive vector recreate — most
+    /// notably the `--no-embeddings` path (issue #267): if the caller
+    /// has no embedder loaded, `with_dims` would otherwise fall back to
+    /// `DEFAULT_EMBEDDING_DIMS`, mismatch the stored value, and silently
+    /// DROP `vec_memories` while NULL-ing every `memories.embedding`.
+    pub fn read_stored_embedding_dims(path: &Path) -> IcmResult<Option<usize>> {
+        if !path.exists() {
+            return Ok(None);
+        }
+        // Open strictly immutable so this helper survives a `chmod -w`
+        // sandbox (issue #263 interaction). `SQLITE_OPEN_READ_ONLY`
+        // alone is NOT enough — SQLite still tries to create/update
+        // the `-shm` / `-wal` companion files for any WAL-mode DB,
+        // which fails when the parent directory is non-writable.
+        // The `immutable=1` URI flag tells SQLite the file will not
+        // change during the connection's lifetime and stops it from
+        // touching WAL infrastructure entirely. This is a one-shot probe
+        // (not a long-lived connection), so the staleness that #319 fixes
+        // for `open_readonly` does not apply here.
+        let conn = open_readonly_uri(path, true)?;
+        // Probe for the metadata table — legacy DBs predate it.
+        let has_table: bool = conn
+            .query_row(
+                "SELECT COUNT(*) > 0 FROM sqlite_master
+                 WHERE type = 'table' AND name = 'icm_metadata'",
+                [],
+                |row| row.get(0),
+            )
+            .map_err(db_err)?;
+        if !has_table {
+            return Ok(None);
+        }
+        let row: Option<String> = conn
+            .query_row(
+                "SELECT value FROM icm_metadata WHERE key = 'embedding_dims'",
+                [],
+                |row| row.get(0),
+            )
+            .optional()
+            .map_err(db_err)?;
+        Ok(row.and_then(|s| s.parse().ok()))
+    }
+
+    /// Open or create a store with a specific embedding dimension.
+    pub fn with_dims(path: &Path, embedding_dims: usize) -> IcmResult<Self> {
+        ensure_sqlite_vec();
+        if let Some(parent) = path.parent() {
+            std::fs::create_dir_all(parent)
+                .map_err(|e| IcmError::Database(format!("cannot create db directory: {e}")))?;
+        }
+        let conn = Connection::open(path)
+            .map_err(|e| IcmError::Database(format!("cannot open database: {e}")))?;
+        // Schema/PRAGMA setup races with other processes opening the same
+        // brand-new DB simultaneously (found via real concurrent testing:
+        // 10 processes opening one fresh DB, several hung, others errored,
+        // zero succeeded). Both the WAL-mode switch (needs a brief
+        // exclusive lock to convert a fresh file — busy_timeout must be
+        // set first in the same batch, or this statement itself has no
+        // timeout active yet) and init_db_with_dims's schema creation
+        // (BEGIN IMMEDIATE-wrapped in schema.rs, but SQLite's FTS5
+        // virtual-table module can still surface a transient error on the
+        // loser even so) are retried together here: whatever the winner
+        // already committed, a fresh attempt's PRAGMA + existence checks
+        // correctly see and no-op past it. Jittered, not just linear,
+        // backoff: a fixed schedule lets many racing processes retry in
+        // near-lockstep and collide again and again.
+        let mut last_err = None;
+        for attempt in 0..40u32 {
+            if attempt > 0 {
+                let base_ms = (attempt as u64).min(20) * 15;
+                let jitter_ms = std::time::SystemTime::now()
+                    .duration_since(std::time::UNIX_EPOCH)
+                    .map(|d| u64::from(d.subsec_nanos()) % 40)
+                    .unwrap_or(0);
+                std::thread::sleep(std::time::Duration::from_millis(base_ms + jitter_ms));
+            }
+            // A short busy_timeout during this retry loop, not the normal
+            // 30s: 30s is meant to tolerate *ordinary* write contention
+            // during real use (e.g. a hook write racing a consolidate),
+            // but stacked with up to 40 outer attempts here it turns into
+            // a potentially multi-minute worst case under real multi-
+            // process contention (measured: several real `icm` processes
+            // hung well past 60s with the 30s inner timeout) — the outer
+            // jittered loop is what actually provides the robustness here,
+            // so the inner SQLite-level wait only needs to be long enough
+            // to smooth over a single competing transaction, not to be a
+            // retry mechanism in its own right. Restored to 30s below once
+            // the schema is confirmed present.
+            let attempt_result = conn
+                .execute_batch(
+                    "PRAGMA busy_timeout=1000; PRAGMA journal_mode=WAL; PRAGMA foreign_keys=ON;",
+                )
+                .map_err(db_err)
+                .and_then(|()| init_db_with_dims(&conn, embedding_dims));
+            match attempt_result {
+                Ok(()) => {
+                    last_err = None;
+                    break;
+                }
+                Err(e) => {
+                    let msg = e.to_string();
+                    let transient = msg.contains("vtable constructor failed")
+                        || msg.contains("already exists")
+                        || msg.contains("database is locked")
+                        || msg.contains("database is busy");
+                    last_err = Some(e);
+                    if !transient {
+                        break;
+                    }
+                }
+            }
+        }
+        if let Some(e) = last_err {
+            return Err(e);
+        }
+        conn.execute_batch("PRAGMA busy_timeout=30000;")
+            .map_err(db_err)?;
+
+        Ok(Self {
+            conn,
+            cache: Mutex::new(new_cache()),
+            readonly: false,
+        })
+    }
+
+    pub fn in_memory() -> IcmResult<Self> {
+        Self::in_memory_with_dims(icm_core::DEFAULT_EMBEDDING_DIMS)
+    }
+
+    /// Open an in-memory store with a specific embedding dimension.
+    /// Useful for tests that exercise the dim-migration / dim-drift paths.
+    pub fn in_memory_with_dims(embedding_dims: usize) -> IcmResult<Self> {
+        ensure_sqlite_vec();
+        let conn = Connection::open_in_memory()
+            .map_err(|e| IcmError::Database(format!("cannot open in-memory db: {e}")))?;
+        conn.execute_batch("PRAGMA foreign_keys=ON; PRAGMA busy_timeout=30000;")
+            .map_err(db_err)?;
+        init_db_with_dims(&conn, embedding_dims)?;
+        Ok(Self {
+            conn,
+            cache: Mutex::new(new_cache()),
+            readonly: false,
+        })
+    }
+}
+
+impl SqliteStore {
+    /// Insert a memory into the database without transaction management.
+    /// Callers are responsible for wrapping this in a transaction.
+    ///
+    /// Dedup contract: an INSERT that collides with an existing memory on
+    /// `(topic, summary_hash)` is silently ignored, and the **existing**
+    /// row's id is returned. The caller's `memory.id` is forgotten in
+    /// that case. This keeps `store(...)` idempotent: writing the same
+    /// fact 100× ends up with one row, not 100.
+    fn store_inner(&self, memory: &Memory) -> IcmResult<String> {
+        let keywords_json = serde_json::to_string(&memory.keywords)?;
+        let related_json = serde_json::to_string(&memory.related_ids)?;
+        let st = source_type(&memory.source);
+        let sd = source_data(&memory.source);
+        let emb_blob = memory.embedding.as_deref().map(embedding_to_blob);
+        let hash = summary_hash(&memory.topic, &memory.summary);
+
+        let inserted = self
+            .conn
+            .execute(
+                "INSERT OR IGNORE INTO memories (id, created_at, updated_at, last_accessed, access_count, weight,
+                 topic, summary, raw_excerpt, keywords,
+                 importance, source_type, source_data, related_ids, embedding, summary_hash)
+                 VALUES (?1, ?2, ?3, ?4, ?5, ?6, ?7, ?8, ?9, ?10, ?11, ?12, ?13, ?14, ?15, ?16)",
+                params![
+                    memory.id,
+                    memory.created_at.to_rfc3339(),
+                    memory.updated_at.to_rfc3339(),
+                    memory.last_accessed.to_rfc3339(),
+                    memory.access_count,
+                    memory.weight,
+                    memory.topic,
+                    memory.summary,
+                    memory.raw_excerpt,
+                    keywords_json,
+                    memory.importance.to_string(),
+                    st,
+                    sd,
+                    related_json,
+                    emb_blob,
+                    hash,
+                ],
+            )
+            .map_err(db_err)?;
+
+        if inserted == 0 {
+            // Dedup hit: a row with the same (topic, summary_hash)
+            // already exists. Audit #185 H2: the previous behaviour
+            // returned the existing id and silently dropped the
+            // caller's importance / keywords / raw_excerpt. So
+            // running `icm store -t T -c "X" -i medium` then `icm
+            // store -t T -c "X" -i critical` left the importance at
+            // medium without warning the user.
+            //
+            // New behaviour: merge the caller's metadata into the
+            // existing row before returning the id.
+            // - importance: take the max (critical > high > medium >
+            //   low). Re-storing with a *higher* priority upgrades.
+            //   Re-storing with a *lower* priority is a no-op so a
+            //   careless write can't downgrade an already-flagged
+            //   critical memory.
+            // - keywords: union, preserving existing order then
+            //   appending new ones not already present.
+            // - raw_excerpt: prefer the new value if non-None,
+            //   otherwise keep existing.
+            // - updated_at: bumped whenever any field actually changed.
+            let (existing_id, existing_importance_str, existing_keywords_json, existing_raw): (
+                String,
+                String,
+                String,
+                Option<String>,
+            ) = self
+                .conn
+                .query_row(
+                    // Audit finding: `summary_hash` already encodes the topic
+                    // (Rust `to_lowercase()`, full Unicode) as part of the
+                    // hash input — an additional `LOWER(topic) = LOWER(?)`
+                    // comparison here used SQLite's built-in `LOWER()`,
+                    // which is ASCII-only and does not fold e.g. 'É' → 'é'.
+                    // For an all-caps accented topic like "DÉCISIONS" that
+                    // mismatch meant this SELECT could fail to find the row
+                    // the `INSERT OR IGNORE` conflict was already about,
+                    // even though `summary_hash` alone uniquely identifies
+                    // it. `summary_hash` is sufficient on its own.
+                    "SELECT id, importance, keywords, raw_excerpt FROM memories
+                     WHERE summary_hash = ?1",
+                    params![hash],
+                    |row| Ok((row.get(0)?, row.get(1)?, row.get(2)?, row.get(3)?)),
+                )
+                .map_err(db_err)?;
+
+            let existing_importance: Importance = existing_importance_str
+                .parse()
+                .unwrap_or(Importance::Medium);
+            let merged_importance = max_importance(existing_importance, memory.importance);
+
+            let existing_keywords: Vec<String> =
+                serde_json::from_str(&existing_keywords_json).unwrap_or_default();
+            let mut merged_keywords = existing_keywords.clone();
+            for kw in &memory.keywords {
+                if !merged_keywords.contains(kw) {
+                    merged_keywords.push(kw.clone());
+                }
+            }
+
+            let merged_raw = memory.raw_excerpt.clone().or(existing_raw.clone());
+
+            let importance_changed = merged_importance != existing_importance;
+            let keywords_changed = merged_keywords != existing_keywords;
+            let raw_changed = merged_raw != existing_raw;
+            if importance_changed || keywords_changed || raw_changed {
+                let merged_keywords_json = serde_json::to_string(&merged_keywords)?;
+                self.conn
+                    .execute(
+                        "UPDATE memories
+                         SET importance = ?1, keywords = ?2, raw_excerpt = ?3, updated_at = ?4
+                         WHERE id = ?5",
+                        params![
+                            merged_importance.to_string(),
+                            merged_keywords_json,
+                            merged_raw,
+                            Utc::now().to_rfc3339(),
+                            existing_id,
+                        ],
+                    )
+                    .map_err(db_err)?;
+                self.cache_invalidate(&existing_id);
+            }
+
+            tracing::debug!(
+                topic = %memory.topic,
+                existing = %existing_id,
+                attempted = %memory.id,
+                imp_changed = importance_changed,
+                kw_changed = keywords_changed,
+                raw_changed = raw_changed,
+                "store: dedup'd duplicate memory (metadata merged)"
+            );
+            return Ok(existing_id);
+        }
+
+        // Sync to vec_memories for KNN search (only on a fresh insert).
+        if let Some(ref blob) = emb_blob {
+            self.conn
+                .execute(
+                    "INSERT INTO vec_memories (memory_id, embedding) VALUES (?1, ?2)",
+                    params![memory.id, blob],
+                )
+                .map_err(db_err)?;
+        }
+
+        Ok(memory.id.clone())
+    }
+}
+// Test helpers (visible to other modules in crate for test use)
+
+#[cfg(test)]
+pub(crate) mod test_helpers {
+    use super::ensure_sqlite_vec;
+
+    pub fn ensure_vec_init() {
+        ensure_sqlite_vec();
+    }
+}
+
+// Submodules (formerly monolithic `store.rs`, split for reviewability).
+mod cache;
+mod connection;
+mod hooks;
+mod rows;
+
+// Shared helpers live in submodules; re-export so `use super::*` in
+// sibling impl modules and the tests see them at `store::` paths.
+pub(crate) use cache::*;
+pub(crate) use connection::*;
+pub(crate) use rows::*;
+
+mod facts;
+mod feedback;
+mod maintenance;
+mod memoir;
+mod memory;
+mod patterns;
+#[cfg(test)]
+mod tests;
+mod transcript;
diff --git a/crates/icm-store/src/store/patterns.rs b/crates/icm-store/src/store/patterns.rs
new file mode 100644
index 00000000..918b6f58
--- /dev/null
+++ b/crates/icm-store/src/store/patterns.rs
@@ -0,0 +1,391 @@
+//! SQLite backend — split out of the former monolithic `store.rs`.
+//!
+//! `SqliteStore` and the shared row/parse helpers live in `super`
+//! (`store/mod.rs`); each submodule here holds one trait impl (or a
+//! coherent group of inherent methods) on that type.
+
+use super::*;
+
+impl SqliteStore {
+    /// Would inserting an edge `source → target` close a cycle in the
+    /// concept graph? BFS from `target` along outgoing edges; if we
+    /// reach `source`, the new edge would form a cycle.
+    ///
+    /// Returns `Ok(false)` for the empty-graph case and bounds the
+    /// search to a depth-limit equal to twice the link count to avoid
+    /// pathological loops on already-corrupt graphs.
+    pub(super) fn would_create_cycle(&self, source: &str, target: &str) -> IcmResult<bool> {
+        if source == target {
+            return Ok(true);
+        }
+        let mut visited: HashSet<String> = HashSet::new();
+        let mut queue: VecDeque<String> = VecDeque::new();
+        queue.push_back(target.to_string());
+        visited.insert(target.to_string());
+        // Soft cap on traversal — guards against malformed pre-existing
+        // cycles (which shouldn't exist, but the user could have edited
+        // the DB by hand).
+        let cap = 10_000;
+        let mut steps = 0;
+        while let Some(current) = queue.pop_front() {
+            steps += 1;
+            if steps > cap {
+                tracing::warn!(
+                    "would_create_cycle: BFS hit {cap}-step cap while checking {source} → {target}"
+                );
+                break;
+            }
+            for next_link in self.get_links_from(&current)? {
+                if next_link.target_id == source {
+                    return Ok(true);
+                }
+                if visited.insert(next_link.target_id.clone()) {
+                    queue.push_back(next_link.target_id);
+                }
+            }
+        }
+        Ok(false)
+    }
+
+    /// Graph expansion: given a list of `(Memory, score)` results from a
+    /// primary search, follow each memory's `related_ids` one hop and fetch
+    /// the neighbors that are not already in the result set.
+    ///
+    /// Each neighbor is scored as `parent_score * hop_discount` (default
+    /// 0.5) so it ranks below its direct-match parent but above unrelated
+    /// low-score results. Returns the combined, deduped, score-descending
+    /// list capped at `max_total` (pass `usize::MAX` for no cap).
+    ///
+    /// This is the core of the graph-aware recall feature: it lets the
+    /// recall path surface memories that are semantically or causally
+    /// linked to the query's direct matches, even if they don't match the
+    /// query text themselves.
+    pub fn expand_with_neighbors(
+        &self,
+        initial: &[(Memory, f32)],
+        max_neighbors: usize,
+        hop_discount: f32,
+        max_total: usize,
+    ) -> IcmResult<Vec<(Memory, f32)>> {
+        if max_neighbors == 0 || initial.is_empty() {
+            let mut out = initial.to_vec();
+            out.truncate(max_total);
+            return Ok(out);
+        }
+
+        let initial_ids: HashSet<String> = initial.iter().map(|(m, _)| m.id.clone()).collect();
+
+        // Phase 1 — collect candidate neighbour ids in score-priority order
+        // up to max_neighbors. We track parent scores here so we can apply
+        // the hop discount once memories come back from the batched fetch.
+        let mut candidates: Vec<(String, f32)> = Vec::new();
+        let mut seen: HashSet<String> = HashSet::new();
+        'outer: for (mem, score) in initial {
+            for neighbor_id in &mem.related_ids {
+                if candidates.len() >= max_neighbors {
+                    break 'outer;
+                }
+                if initial_ids.contains(neighbor_id) || !seen.insert(neighbor_id.clone()) {
+                    continue;
+                }
+                candidates.push((neighbor_id.clone(), *score));
+            }
+        }
+
+        // Phase 2 — single batched SELECT instead of N round-trips.
+        let mut neighbors: Vec<(Memory, f32)> = Vec::new();
+        if !candidates.is_empty() {
+            let ids: Vec<&str> = candidates.iter().map(|(id, _)| id.as_str()).collect();
+            let fetched = self.get_many(&ids)?;
+            for (id, parent_score) in candidates {
+                if let Some(m) = fetched.get(&id) {
+                    neighbors.push((m.clone(), parent_score * hop_discount));
+                }
+            }
+        }
+
+        // Merge initial + neighbors, then sort descending by score.
+        let mut combined: Vec<(Memory, f32)> = initial.to_vec();
+        combined.extend(neighbors);
+        combined.sort_by(|a, b| b.1.partial_cmp(&a.1).unwrap_or(std::cmp::Ordering::Equal));
+        combined.truncate(max_total);
+        Ok(combined)
+    }
+
+    /// Fetch many memories by id in one round-trip, deduplicated by id.
+    ///
+    /// Cache-aware: cached entries are served from memory, misses are
+    /// batched into a single `IN (?,?,…)` query. Missing ids are
+    /// silently dropped — callers expecting a strict mapping should
+    /// diff their input vs the returned map.
+    pub fn get_many(&self, ids: &[&str]) -> IcmResult<HashMap<String, Memory>> {
+        if ids.is_empty() {
+            return Ok(HashMap::new());
+        }
+
+        // Dedup so the IN clause gets at most one slot per id.
+        let mut unique: Vec<&str> = Vec::with_capacity(ids.len());
+        let mut seen: HashSet<&str> = HashSet::new();
+        for id in ids {
+            if seen.insert(*id) {
+                unique.push(*id);
+            }
+        }
+
+        // Phase 1 — pull cache hits aside, leaving only true misses for SQL.
+        let mut out: HashMap<String, Memory> = HashMap::with_capacity(unique.len());
+        let mut misses: Vec<&str> = Vec::with_capacity(unique.len());
+        if let Ok(mut cache) = self.cache.lock() {
+            for id in &unique {
+                if let Some(m) = cache.get(*id) {
+                    out.insert((*id).to_string(), m.clone());
+                } else {
+                    misses.push(*id);
+                }
+            }
+        } else {
+            misses.extend_from_slice(&unique);
+        }
+
+        if misses.is_empty() {
+            return Ok(out);
+        }
+
+        // Phase 2 — single batched SELECT for the misses.
+        let placeholders: Vec<String> = (1..=misses.len()).map(|i| format!("?{i}")).collect();
+        let sql = format!(
+            "SELECT {SELECT_COLS} FROM memories WHERE id IN ({})",
+            placeholders.join(", ")
+        );
+
+        let mut stmt = self.conn.prepare(&sql).map_err(db_err)?;
+        let params_vec: Vec<&dyn rusqlite::types::ToSql> = misses
+            .iter()
+            .map(|s| s as &dyn rusqlite::types::ToSql)
+            .collect();
+
+        let rows = stmt
+            .query_map(params_vec.as_slice(), row_to_memory)
+            .map_err(db_err)?;
+
+        let mut fetched: Vec<Memory> = Vec::new();
+        for row in rows {
+            fetched.push(row.map_err(db_err)?);
+        }
+
+        if let Ok(mut cache) = self.cache.lock() {
+            for m in &fetched {
+                cache.put(m.id.clone(), m.clone());
+            }
+        }
+        for m in fetched {
+            out.insert(m.id.clone(), m);
+        }
+        Ok(out)
+    }
+
+    /// Get memories by topic prefix (e.g., "wshm" matches "wshm:owner/repo").
+    ///
+    /// If `topic` ends with `*`, uses LIKE matching. Otherwise exact match.
+    pub fn get_by_topic_prefix(&self, topic: &str) -> IcmResult<Vec<Memory>> {
+        if let Some(prefix) = topic.strip_suffix('*') {
+            let pattern = format!("{prefix}%");
+            let mut stmt = self
+                .conn
+                .prepare(&format!(
+                    "SELECT {SELECT_COLS} FROM memories WHERE topic LIKE ?1 ORDER BY weight DESC LIMIT 500"
+                ))
+                .map_err(db_err)?;
+
+            let rows = stmt
+                .query_map(params![pattern], row_to_memory)
+                .map_err(db_err)?;
+
+            collect_rows(rows)
+        } else {
+            self.get_by_topic(topic)
+        }
+    }
+
+    /// List topics, optionally filtered by a prefix.
+    pub fn list_topics_with_prefix(&self, prefix: Option<&str>) -> IcmResult<Vec<(String, usize)>> {
+        match prefix {
+            Some(p) => {
+                let pattern = format!("{p}%");
+                let mut stmt = self
+                    .conn
+                    .prepare(
+                        "SELECT topic, COUNT(*) FROM memories WHERE topic LIKE ?1 GROUP BY topic ORDER BY topic",
+                    )
+                    .map_err(db_err)?;
+
+                let rows = stmt
+                    .query_map(params![pattern], |row| {
+                        Ok((row.get::<_, String>(0)?, row.get::<_, usize>(1)?))
+                    })
+                    .map_err(db_err)?;
+
+                let mut results = Vec::new();
+                for row in rows {
+                    results.push(row.map_err(db_err)?);
+                }
+                Ok(results)
+            }
+            None => self.list_topics(),
+        }
+    }
+
+    /// Detect recurring patterns in a topic by computing Jaccard similarity on keywords.
+    ///
+    /// Groups memories with keyword similarity > 0.5 into clusters,
+    /// and returns clusters of size >= `min_cluster_size`.
+    pub fn detect_patterns(
+        &self,
+        topic: &str,
+        min_cluster_size: usize,
+    ) -> IcmResult<Vec<PatternCluster>> {
+        let memories = self.get_by_topic(topic)?;
+        if memories.len() < min_cluster_size {
+            return Ok(Vec::new());
+        }
+
+        // Build keyword sets for each memory
+        let keyword_sets: Vec<HashSet<String>> = memories
+            .iter()
+            .map(|m| m.keywords.iter().map(|k| k.to_lowercase()).collect())
+            .collect();
+
+        // Union-Find-style clustering via adjacency
+        let n = memories.len();
+        let mut parent: Vec<usize> = (0..n).collect();
+
+        fn find(parent: &mut [usize], i: usize) -> usize {
+            let mut i = i;
+            while parent[i] != i {
+                parent[i] = parent[parent[i]];
+                i = parent[i];
+            }
+            i
+        }
+
+        fn union(parent: &mut [usize], a: usize, b: usize) {
+            let ra = find(parent, a);
+            let rb = find(parent, b);
+            if ra != rb {
+                parent[ra] = rb;
+            }
+        }
+
+        // Compute Jaccard similarity for each pair, union if > 0.5
+        for i in 0..n {
+            for j in (i + 1)..n {
+                if keyword_sets[i].is_empty() && keyword_sets[j].is_empty() {
+                    continue;
+                }
+                let intersection = keyword_sets[i].intersection(&keyword_sets[j]).count();
+                let union_size = keyword_sets[i].union(&keyword_sets[j]).count();
+                if union_size > 0 {
+                    let jaccard = intersection as f32 / union_size as f32;
+                    if jaccard > 0.5 {
+                        union(&mut parent, i, j);
+                    }
+                }
+            }
+        }
+
+        // Group by cluster root
+        let mut clusters: HashMap<usize, Vec<usize>> = HashMap::new();
+        for i in 0..n {
+            let root = find(&mut parent, i);
+            clusters.entry(root).or_default().push(i);
+        }
+
+        // Build PatternCluster for each group meeting the minimum size
+        let mut result: Vec<PatternCluster> = Vec::new();
+        for indices in clusters.values() {
+            if indices.len() < min_cluster_size {
+                continue;
+            }
+
+            // Representative = the highest-weight memory in the cluster
+            let best_idx = match indices.iter().max_by(|&&a, &&b| {
+                memories[a]
+                    .weight
+                    .partial_cmp(&memories[b].weight)
+                    .unwrap_or(std::cmp::Ordering::Equal)
+            }) {
+                Some(&idx) => idx,
+                None => continue, // empty cluster, skip
+            };
+
+            // Collect all unique keywords from the cluster
+            let mut all_kw: Vec<String> = Vec::new();
+            let mut seen: HashSet<String> = HashSet::new();
+            for &idx in indices {
+                for kw in &memories[idx].keywords {
+                    let lower = kw.to_lowercase();
+                    if seen.insert(lower) {
+                        all_kw.push(kw.clone());
+                    }
+                }
+            }
+
+            result.push(PatternCluster {
+                representative_summary: memories[best_idx].summary.clone(),
+                memory_ids: indices.iter().map(|&i| memories[i].id.clone()).collect(),
+                keywords: all_kw,
+                count: indices.len(),
+            });
+        }
+
+        // Sort by cluster size descending
+        result.sort_by_key(|b| std::cmp::Reverse(b.count));
+
+        Ok(result)
+    }
+
+    /// Extract a pattern cluster as a concept in a memoir.
+    ///
+    /// Creates a Concept with:
+    /// - name derived from common keywords
+    /// - definition = combined summary of the cluster
+    /// - source_memory_ids = memory IDs in the cluster
+    /// - confidence = 0.5 + (count * 0.05) capped at 0.9
+    /// - labels = common keywords as labels
+    pub fn extract_pattern_as_concept(
+        &self,
+        cluster: &PatternCluster,
+        memoir_id: &str,
+    ) -> IcmResult<String> {
+        // Derive concept name from top keywords
+        let concept_name = if cluster.keywords.is_empty() {
+            format!("pattern-{}", &cluster.memory_ids[0][..8])
+        } else {
+            cluster
+                .keywords
+                .iter()
+                .take(3)
+                .cloned()
+                .collect::<Vec<_>>()
+                .join("-")
+        };
+
+        // Build definition from cluster representative + count
+        let definition = format!(
+            "{} (pattern detected across {} memories)",
+            cluster.representative_summary, cluster.count
+        );
+
+        let mut concept = Concept::new(memoir_id.into(), concept_name, definition);
+        concept.source_memory_ids = cluster.memory_ids.clone();
+        concept.confidence = (0.5 + cluster.count as f32 * 0.05).min(0.9);
+        concept.labels = cluster
+            .keywords
+            .iter()
+            .take(5)
+            .map(|kw| Label::new("pattern", kw.as_str()))
+            .collect();
+
+        self.add_concept(concept)
+    }
+}
diff --git a/crates/icm-store/src/store/rows.rs b/crates/icm-store/src/store/rows.rs
new file mode 100644
index 00000000..037c7044
--- /dev/null
+++ b/crates/icm-store/src/store/rows.rs
@@ -0,0 +1,320 @@
+//! SQLite backend — split out of the former monolithic `store.rs`.
+//!
+//! `SqliteStore` and the shared row/parse helpers live in `super`
+//! (`store/mod.rs`); each submodule here holds one trait impl (or a
+//! coherent group of inherent methods) on that type.
+
+use super::*;
+// Memory helpers
+
+pub(crate) fn source_type(source: &MemorySource) -> &'static str {
+    match source {
+        MemorySource::ClaudeCode { .. } => "claude_code",
+        MemorySource::Conversation { .. } => "conversation",
+        MemorySource::Manual => "manual",
+    }
+}
+
+pub(crate) fn source_data(source: &MemorySource) -> Option<String> {
+    match source {
+        MemorySource::Manual => None,
+        other => serde_json::to_string(other).ok(),
+    }
+}
+
+pub(crate) fn parse_source(source_type_str: &str, source_data_str: Option<String>) -> MemorySource {
+    match source_type_str {
+        "manual" => MemorySource::Manual,
+        _ => source_data_str
+            .and_then(|d| serde_json::from_str(&d).ok())
+            .unwrap_or(MemorySource::Manual),
+    }
+}
+
+pub(crate) fn embedding_to_blob(embedding: &[f32]) -> Vec<u8> {
+    embedding.as_bytes().to_vec()
+}
+
+pub(crate) fn blob_to_embedding(blob: &[u8]) -> Vec<f32> {
+    if !blob.len().is_multiple_of(4) {
+        tracing::warn!(
+            blob_size = blob.len(),
+            "embedding blob size not divisible by 4, truncating"
+        );
+    }
+    blob.chunks_exact(4)
+        .map(|c| f32::from_le_bytes([c[0], c[1], c[2], c[3]]))
+        .collect()
+}
+
+pub(crate) fn row_to_memory(row: &rusqlite::Row) -> rusqlite::Result<Memory> {
+    // Column order: id(0), created_at(1), updated_at(2), last_accessed(3),
+    //   access_count(4), weight(5), topic(6), summary(7), raw_excerpt(8),
+    //   keywords(9), importance(10), source_type(11), source_data(12),
+    //   related_ids(13), embedding(14)
+    let keywords_json: String = row.get::<_, Option<String>>(9)?.unwrap_or_default();
+    let keywords: Vec<String> = serde_json::from_str(&keywords_json).unwrap_or_default();
+
+    let importance_str: String = row.get(10)?;
+    let importance = importance_str.parse().unwrap_or(Importance::Medium);
+
+    let source_type_str: String = row.get(11)?;
+    let source_data_str: Option<String> = row.get(12)?;
+    let source = parse_source(&source_type_str, source_data_str);
+
+    let related_json: String = row.get::<_, Option<String>>(13)?.unwrap_or_default();
+    let related_ids: Vec<String> = serde_json::from_str(&related_json).unwrap_or_default();
+
+    let embedding: Option<Vec<f32>> = row
+        .get::<_, Option<Vec<u8>>>(14)?
+        .map(|b| blob_to_embedding(&b));
+
+    let created_at_str: String = row.get(1)?;
+    let updated_at_str: String = row.get::<_, Option<String>>(2)?.unwrap_or_default();
+    let last_accessed_str: String = row.get(3)?;
+
+    let created_at = parse_dt(&created_at_str);
+
+    Ok(Memory {
+        id: row.get(0)?,
+        created_at,
+        updated_at: if updated_at_str.is_empty() {
+            created_at
+        } else {
+            parse_dt(&updated_at_str)
+        },
+        last_accessed: parse_dt(&last_accessed_str),
+        access_count: row.get::<_, u32>(4)?,
+        weight: row.get(5)?,
+        topic: row.get(6)?,
+        summary: row.get(7)?,
+        raw_excerpt: row.get(8)?,
+        keywords,
+        importance,
+        source,
+        related_ids,
+        embedding,
+        scope: icm_core::Scope::User, // default for existing local memories
+    })
+}
+
+pub(crate) const SELECT_COLS: &str =
+    "id, created_at, updated_at, last_accessed, access_count, weight, \
+                           topic, summary, raw_excerpt, keywords, \
+                           importance, source_type, source_data, related_ids, embedding";
+
+/// Sanitize a query string for FTS5 MATCH.
+///
+/// FTS5 treats characters like `-`, `*`, `"`, `:`, `^`, `+`, `~` as operators.
+/// A query like `"sqlite-vec"` makes FTS5 interpret `-` as NOT and `vec` as a
+/// column name, causing "no such column: vec".
+///
+/// Escape `%`, `_`, and the escape character itself so a keyword can be
+/// safely wrapped in a `%...%` LIKE pattern. Pair with `ESCAPE '\'` in the
+/// SQL — without it, a keyword containing `%` matches every row and `_`
+/// matches any single character (audit finding).
+pub(crate) fn escape_like_wildcards(s: &str) -> String {
+    s.replace('\\', "\\\\")
+        .replace('%', "\\%")
+        .replace('_', "\\_")
+}
+
+/// Cap on auxiliary metadata (transcript sessions/messages) - best-effort
+/// truncation, not rejection, matching MAX_MESSAGE_BYTES's rationale.
+pub(crate) const MAX_METADATA_BYTES: usize = 8 * 1024;
+
+/// Truncate `s` to at most `max` bytes without splitting a UTF-8 char.
+pub(crate) fn truncate_at_char_boundary(s: &str, max: usize) -> &str {
+    if s.len() <= max {
+        return s;
+    }
+    let mut cut = max;
+    while !s.is_char_boundary(cut) {
+        cut -= 1;
+    }
+    &s[..cut]
+}
+
+/// This function strips special chars and wraps each token in double quotes.
+pub(crate) fn sanitize_fts_query(query: &str) -> String {
+    // Limit input length to prevent abuse (UTF-8 safe truncation)
+    let query = if query.len() > 10_000 {
+        let mut end = 10_000;
+        while end > 0 && !query.is_char_boundary(end) {
+            end -= 1;
+        }
+        &query[..end]
+    } else {
+        query
+    };
+
+    // Replace FTS5 operator chars with spaces, then quote each resulting token.
+    // FTS5 tokenizer (unicode61) splits on `-` too, so we must keep tokens separate.
+    let cleaned: String = query
+        .chars()
+        .map(|c| {
+            if matches!(
+                c,
+                '-' | '*' | '"' | '(' | ')' | '{' | '}' | ':' | '^' | '+' | '~' | '\\'
+            ) {
+                ' '
+            } else {
+                c
+            }
+        })
+        .collect();
+
+    let tokens: Vec<String> = cleaned
+        .split_whitespace()
+        .filter(|w| !w.is_empty())
+        .take(100) // Limit token count to prevent excessive query complexity
+        .map(|w| {
+            // Strip any remaining quotes from tokens before wrapping in quotes
+            let stripped = w.replace('"', "");
+            format!("\"{stripped}\"")
+        })
+        .collect();
+    tokens.join(" ")
+}
+
+/// Whether `e` is FTS5 rejecting a malformed MATCH query (e.g. "hello AND",
+/// unbalanced parens) rather than a genuine database error. Used by
+/// `search_transcripts` to degrade to "no results" instead of surfacing a
+/// raw sqlite error, without pre-sanitizing the query text away from valid
+/// FTS5 syntax (which callers rely on — see
+/// `test_transcript_search_fts5_boolean_and_phrase`).
+pub(crate) fn is_fts5_syntax_error(e: &rusqlite::Error) -> bool {
+    matches!(
+        e,
+        rusqlite::Error::SqliteFailure(_, Some(msg)) if msg.contains("fts5: syntax error")
+    )
+}
+
+// MemoryStore impl
+
+/// Maximum byte length of a stored summary. Audit finding: a transcript
+/// containing a 1 MB unbroken text block landed as a single memory whose
+/// summary was the full 1 MB blob. Caps the cost of a single bad write
+/// (memory bloat, embedding compute, FTS5 index growth) to a generous
+/// but bounded 64 KB.
+pub(crate) const MAX_SUMMARY_BYTES: usize = 64 * 1024;
+
+/// Maximum byte length of a stored topic. Topics surface in `icm
+/// topics` listings and as the routing key for project filters; a
+/// thousand-byte topic is always a bug, never legitimate user input.
+pub(crate) const MAX_TOPIC_BYTES: usize = 256;
+
+/// Validate and normalize a `Memory` before insertion. Trims topic
+/// whitespace and rejects inputs that we know corrupt or break the
+/// store:
+///
+/// - Empty or whitespace-only `topic` / `summary` — these would surface
+///   as blank rows in `icm topics` / `icm list` and pollute the FTS5
+///   index without conveying information.
+/// - NUL byte (`\0`) in `topic` or `summary` — libsql binds text via a
+///   NUL-terminated C string, so anything past the first `\0` is
+///   silently dropped. Rather than silently truncate, refuse the
+///   write so the caller knows.
+/// - Newline / CR / tab in `topic` — these break the `icm topics`
+///   tabular layout and could enable display-spoofing of topic names
+///   (e.g. a topic that visually overlaps another in TUI/log output).
+///   Allowed in `summary` since it's free-form prose.
+/// - `topic` longer than `MAX_TOPIC_BYTES` or `summary` longer than
+///   `MAX_SUMMARY_BYTES` — see the constant docs for rationale.
+pub(crate) fn validate_and_normalize(mut memory: Memory) -> IcmResult<Memory> {
+    memory.topic = memory.topic.trim().to_string();
+    validate_fields(&memory.topic, &memory.summary)?;
+    Ok(memory)
+}
+
+/// The borrowed core of [`validate_and_normalize`], shared with `update()`
+/// (audit finding: the update path previously bypassed every size/content
+/// check, so oversized or NUL-carrying payloads could enter the store by
+/// storing small then updating big).
+pub(crate) fn validate_fields(topic: &str, summary: &str) -> IcmResult<()> {
+    if topic.is_empty() {
+        return Err(IcmError::InvalidInput("topic cannot be empty".into()));
+    }
+    if summary.trim().is_empty() {
+        return Err(IcmError::InvalidInput("summary cannot be empty".into()));
+    }
+    if topic.contains('\0') {
+        return Err(IcmError::InvalidInput(
+            "topic must not contain NUL bytes".into(),
+        ));
+    }
+    if summary.contains('\0') {
+        return Err(IcmError::InvalidInput(
+            "summary must not contain NUL bytes".into(),
+        ));
+    }
+    if topic.contains(['\n', '\r', '\t']) {
+        return Err(IcmError::InvalidInput(
+            "topic must not contain newline / CR / tab characters".into(),
+        ));
+    }
+    if topic.len() > MAX_TOPIC_BYTES {
+        return Err(IcmError::InvalidInput(format!(
+            "topic exceeds {} bytes",
+            MAX_TOPIC_BYTES
+        )));
+    }
+    if summary.len() > MAX_SUMMARY_BYTES {
+        return Err(IcmError::InvalidInput(format!(
+            "summary exceeds {} bytes",
+            MAX_SUMMARY_BYTES
+        )));
+    }
+    Ok(())
+}
+
+/// Local total order on `Importance` (Critical > High > Medium > Low).
+/// `Importance` does not implement `Ord` because the project did not
+/// want to imply a globally meaningful ordering across all uses
+/// (e.g. presentation, filtering). For the dedup-merge path we *do*
+/// want to take the maximum so re-storing with a higher priority
+/// upgrades the existing row.
+pub(crate) fn importance_rank(i: Importance) -> u8 {
+    match i {
+        Importance::Critical => 4,
+        Importance::High => 3,
+        Importance::Medium => 2,
+        Importance::Low => 1,
+    }
+}
+
+/// Return the higher-priority importance. Used by the dedup path so
+/// `store(...)` semantics are "re-store with critical upgrades, never
+/// downgrades".
+pub(crate) fn max_importance(a: Importance, b: Importance) -> Importance {
+    if importance_rank(a) >= importance_rank(b) {
+        a
+    } else {
+        b
+    }
+}
+
+/// SHA-256 over the normalized `(topic, summary)` pair, hex-encoded.
+/// Normalization: trim + lowercase + collapse whitespace runs to single
+/// spaces. Topic and summary are joined by `\0` to prevent boundary
+/// ambiguity (e.g. `"a"|"bc"` vs `"ab"|"c"` would otherwise hash the
+/// same). Used by the dedup `INSERT OR IGNORE` path.
+pub(crate) fn summary_hash(topic: &str, summary: &str) -> String {
+    let topic_n = topic.trim().to_lowercase();
+    let summary_n: String = summary
+        .split_whitespace()
+        .collect::<Vec<&str>>()
+        .join(" ")
+        .to_lowercase();
+    let mut h = Sha256::new();
+    h.update(topic_n.as_bytes());
+    h.update(b"\0");
+    h.update(summary_n.as_bytes());
+    format!("{:x}", h.finalize())
+}
+
+pub(crate) fn parse_dt(s: &str) -> DateTime<Utc> {
+    DateTime::parse_from_rfc3339(s)
+        .map(|d| d.with_timezone(&Utc))
+        .unwrap_or_else(|_| Utc::now())
+}
diff --git a/crates/icm-store/src/store/tests/consolidate.rs b/crates/icm-store/src/store/tests/consolidate.rs
new file mode 100644
index 00000000..dac6e794
--- /dev/null
+++ b/crates/icm-store/src/store/tests/consolidate.rs
@@ -0,0 +1,124 @@
+//! Per-domain tests for the SQLite backend (`store::tests`).
+
+use super::*;
+
+#[test]
+fn test_auto_consolidate_below_threshold() {
+    let store = test_store();
+    store.store(make_memory("t", "one")).unwrap();
+    store.store(make_memory("t", "two")).unwrap();
+    // Threshold is 10, so no consolidation
+    let result = store.auto_consolidate("t", 10).unwrap();
+    assert!(!result);
+    assert_eq!(store.count_by_topic("t").unwrap(), 2);
+}
+
+#[test]
+fn test_auto_consolidate_above_threshold() {
+    let store = test_store();
+    for i in 0..12 {
+        store
+            .store(make_memory("bulk", &format!("entry {i}")))
+            .unwrap();
+    }
+    let result = store.auto_consolidate("bulk", 10).unwrap();
+    assert!(result);
+    assert_eq!(store.count_by_topic("bulk").unwrap(), 1);
+}
+
+#[test]
+fn test_auto_consolidate_with_embedder_attaches_embedding() {
+    // Audit M2/AC2: the embedder-aware variant must produce a
+    // consolidated memory that is recall-ready (embedding != None).
+    struct StubEmbedder;
+    impl icm_core::Embedder for StubEmbedder {
+        fn embed(&self, _text: &str) -> IcmResult<Vec<f32>> {
+            Ok(vec![0.42; icm_core::DEFAULT_EMBEDDING_DIMS])
+        }
+        fn embed_batch(&self, texts: &[&str]) -> IcmResult<Vec<Vec<f32>>> {
+            Ok(texts
+                .iter()
+                .map(|_| vec![0.42; icm_core::DEFAULT_EMBEDDING_DIMS])
+                .collect())
+        }
+        fn dimensions(&self) -> usize {
+            icm_core::DEFAULT_EMBEDDING_DIMS
+        }
+    }
+    let store = test_store();
+    for i in 0..11 {
+        store
+            .store(make_memory("rolled", &format!("fact {i}")))
+            .unwrap();
+    }
+    let stub = StubEmbedder;
+    let did = store
+        .auto_consolidate_with_embedder("rolled", 10, Some(&stub))
+        .unwrap();
+    assert!(did);
+    let consolidated = store.get_by_topic("rolled").unwrap();
+    assert_eq!(consolidated.len(), 1);
+    let embedding = consolidated[0]
+        .embedding
+        .as_ref()
+        .expect("consolidated memory must have an embedding");
+    assert_eq!(embedding.len(), icm_core::DEFAULT_EMBEDDING_DIMS);
+    assert!((embedding[0] - 0.42).abs() < 1e-6);
+}
+
+#[test]
+fn test_apply_decay_with_aggressive_factor() {
+    let store = test_store();
+    store.store(make_memory("t", "decayable")).unwrap();
+    let affected = store.apply_decay(0.5).unwrap();
+    assert!(affected > 0);
+    let mems = store.get_by_topic("t").unwrap();
+    assert!(mems[0].weight < 1.0);
+}
+
+#[test]
+fn test_prune_low_weight() {
+    let store = test_store();
+    store.store(make_memory("t", "will be pruned")).unwrap();
+    // Apply aggressive decay
+    store.apply_decay(0.01).unwrap();
+    let pruned = store.prune(0.5).unwrap();
+    assert!(pruned > 0);
+    assert_eq!(store.count().unwrap(), 0);
+}
+
+#[test]
+fn test_list_topics_multiple() {
+    let store = test_store();
+    store.store(make_memory("alpha", "a")).unwrap();
+    store.store(make_memory("beta", "b")).unwrap();
+    store.store(make_memory("alpha", "c")).unwrap();
+    let topics = store.list_topics().unwrap();
+    assert_eq!(topics.len(), 2);
+}
+
+#[test]
+fn test_stats_multi_topic() {
+    let store = test_store();
+    store.store(make_memory("t1", "one")).unwrap();
+    store.store(make_memory("t2", "two")).unwrap();
+    let stats = store.stats().unwrap();
+    assert_eq!(stats.total_memories, 2);
+    assert_eq!(stats.total_topics, 2);
+}
+
+#[test]
+fn test_get_by_topic_prefix() {
+    let store = test_store();
+    store
+        .store(make_memory("project:web", "web stuff"))
+        .unwrap();
+    store
+        .store(make_memory("project:api", "api stuff"))
+        .unwrap();
+    store.store(make_memory("other", "unrelated")).unwrap();
+    let results = store.get_by_topic_prefix("project:*").unwrap();
+    assert_eq!(results.len(), 2);
+}
+
+// expand_with_neighbors
diff --git a/crates/icm-store/src/store/tests/embeddings.rs b/crates/icm-store/src/store/tests/embeddings.rs
new file mode 100644
index 00000000..7594e6cf
--- /dev/null
+++ b/crates/icm-store/src/store/tests/embeddings.rs
@@ -0,0 +1,200 @@
+//! Per-domain tests for the SQLite backend (`store::tests`).
+
+use super::*;
+
+#[test]
+fn test_store_with_embedding() {
+    let store = test_store();
+    let mut mem = make_memory("test", "vector enabled");
+    mem.embedding = Some(vec![0.1; 384]);
+    let id = store.store(mem).unwrap();
+
+    let retrieved = store.get(&id).unwrap().unwrap();
+    assert!(retrieved.embedding.is_some());
+    assert_eq!(retrieved.embedding.as_ref().unwrap().len(), 384);
+}
+
+#[test]
+fn test_store_without_embedding() {
+    let store = test_store();
+    let mem = make_memory("test", "no vector");
+    let id = store.store(mem).unwrap();
+
+    let retrieved = store.get(&id).unwrap().unwrap();
+    assert!(retrieved.embedding.is_none());
+}
+
+#[test]
+fn test_search_by_embedding() {
+    let store = test_store();
+
+    // Store 3 memories with different embeddings
+    let mut m1 = make_memory("rust", "Rust systems programming");
+    m1.embedding = Some(vec![
+        1.0, 0.0, 0.0, 0.0, 0.0, 0.0, 0.0, 0.0, 0.0, 0.0, 0.0, 0.0, 0.0, 0.0, 0.0, 0.0, 0.0, 0.0,
+        0.0, 0.0, 0.0, 0.0, 0.0, 0.0, 0.0, 0.0, 0.0, 0.0, 0.0, 0.0, 0.0, 0.0, 0.0, 0.0, 0.0, 0.0,
+        0.0, 0.0, 0.0, 0.0, 0.0, 0.0, 0.0, 0.0, 0.0, 0.0, 0.0, 0.0, 0.0, 0.0, 0.0, 0.0, 0.0, 0.0,
+        0.0, 0.0, 0.0, 0.0, 0.0, 0.0, 0.0, 0.0, 0.0, 0.0, 0.0, 0.0, 0.0, 0.0, 0.0, 0.0, 0.0, 0.0,
+        0.0, 0.0, 0.0, 0.0, 0.0, 0.0, 0.0, 0.0, 0.0, 0.0, 0.0, 0.0, 0.0, 0.0, 0.0, 0.0, 0.0, 0.0,
+        0.0, 0.0, 0.0, 0.0, 0.0, 0.0, 0.0, 0.0, 0.0, 0.0, 0.0, 0.0, 0.0, 0.0, 0.0, 0.0, 0.0, 0.0,
+        0.0, 0.0, 0.0, 0.0, 0.0, 0.0, 0.0, 0.0, 0.0, 0.0, 0.0, 0.0, 0.0, 0.0, 0.0, 0.0, 0.0, 0.0,
+        0.0, 0.0, 0.0, 0.0, 0.0, 0.0, 0.0, 0.0, 0.0, 0.0, 0.0, 0.0, 0.0, 0.0, 0.0, 0.0, 0.0, 0.0,
+        0.0, 0.0, 0.0, 0.0, 0.0, 0.0, 0.0, 0.0, 0.0, 0.0, 0.0, 0.0, 0.0, 0.0, 0.0, 0.0, 0.0, 0.0,
+        0.0, 0.0, 0.0, 0.0, 0.0, 0.0, 0.0, 0.0, 0.0, 0.0, 0.0, 0.0, 0.0, 0.0, 0.0, 0.0, 0.0, 0.0,
+        0.0, 0.0, 0.0, 0.0, 0.0, 0.0, 0.0, 0.0, 0.0, 0.0, 0.0, 0.0, 0.0, 0.0, 0.0, 0.0, 0.0, 0.0,
+        0.0, 0.0, 0.0, 0.0, 0.0, 0.0, 0.0, 0.0, 0.0, 0.0, 0.0, 0.0, 0.0, 0.0, 0.0, 0.0, 0.0, 0.0,
+        0.0, 0.0, 0.0, 0.0, 0.0, 0.0, 0.0, 0.0, 0.0, 0.0, 0.0, 0.0, 0.0, 0.0, 0.0, 0.0, 0.0, 0.0,
+        0.0, 0.0, 0.0, 0.0, 0.0, 0.0, 0.0, 0.0, 0.0, 0.0, 0.0, 0.0, 0.0, 0.0, 0.0, 0.0, 0.0, 0.0,
+        0.0, 0.0, 0.0, 0.0, 0.0, 0.0, 0.0, 0.0, 0.0, 0.0, 0.0, 0.0, 0.0, 0.0, 0.0, 0.0, 0.0, 0.0,
+        0.0, 0.0, 0.0, 0.0, 0.0, 0.0, 0.0, 0.0, 0.0, 0.0, 0.0, 0.0, 0.0, 0.0, 0.0, 0.0, 0.0, 0.0,
+        0.0, 0.0, 0.0, 0.0, 0.0, 0.0, 0.0, 0.0, 0.0, 0.0, 0.0, 0.0, 0.0, 0.0, 0.0, 0.0, 0.0, 0.0,
+        0.0, 0.0, 0.0, 0.0, 0.0, 0.0, 0.0, 0.0, 0.0, 0.0, 0.0, 0.0, 0.0, 0.0, 0.0, 0.0, 0.0, 0.0,
+        0.0, 0.0, 0.0, 0.0, 0.0, 0.0, 0.0, 0.0, 0.0, 0.0, 0.0, 0.0, 0.0, 0.0, 0.0, 0.0, 0.0, 0.0,
+        0.0, 0.0, 0.0, 0.0, 0.0, 0.0, 0.0, 0.0, 0.0, 0.0, 0.0, 0.0, 0.0, 0.0, 0.0, 0.0, 0.0, 0.0,
+        0.0, 0.0, 0.0, 0.0, 0.0, 0.0, 0.0, 0.0, 0.0, 0.0, 0.0, 0.0, 0.0, 0.0, 0.0, 0.0, 0.0, 0.0,
+        0.0, 0.0, 0.0, 0.0, 0.0, 0.0,
+    ]);
+    store.store(m1).unwrap();
+
+    let mut m2 = make_memory("python", "Python scripting");
+    // Very different embedding
+    let mut emb2 = vec![0.0; 384];
+    emb2[1] = 1.0;
+    m2.embedding = Some(emb2);
+    store.store(m2).unwrap();
+
+    // Store one without embedding
+    store.store(make_memory("go", "Go programming")).unwrap();
+
+    // Search with a query vector close to m1
+    let mut query = vec![0.0; 384];
+    query[0] = 0.9;
+    let results = store.search_by_embedding(&query, 5).unwrap();
+
+    assert!(!results.is_empty());
+    // First result should be closest to query
+    assert_eq!(results[0].0.topic, "rust");
+}
+
+#[test]
+fn test_delete_cleans_vec_table() {
+    let store = test_store();
+    let mut mem = make_memory("test", "to delete with vec");
+    mem.embedding = Some(vec![0.5; 384]);
+    let id = store.store(mem).unwrap();
+
+    store.delete(&id).unwrap();
+
+    // Verify vec_memories is also cleaned
+    let query = vec![0.5; 384];
+    let results = store.search_by_embedding(&query, 10).unwrap();
+    assert!(results.is_empty());
+}
+
+#[test]
+fn test_search_hybrid() {
+    let store = test_store();
+
+    // Store memory with both text and embedding
+    let mut mem = make_memory("rust", "Rust is great for systems programming");
+    mem.embedding = Some(vec![0.8; 384]);
+    store.store(mem).unwrap();
+
+    let mut mem2 = make_memory("python", "Python is great for scripting");
+    let mut emb2 = vec![0.0; 384];
+    emb2[1] = 1.0;
+    mem2.embedding = Some(emb2);
+    store.store(mem2).unwrap();
+
+    // Hybrid search with both text match and close embedding
+    let query_emb = vec![0.7; 384]; // close to m1's embedding
+    let results = store
+        .search_hybrid("rust programming", &query_emb, 5)
+        .unwrap();
+
+    assert!(!results.is_empty());
+    // Rust should rank first (matches both FTS and vector)
+    assert_eq!(results[0].0.topic, "rust");
+    // Score should be > 0
+    assert!(results[0].1 > 0.0);
+}
+
+/// Audit regression: `1.0 / (1.0 + rank.abs())` inverted FTS relevance —
+/// a stronger bm25 match (more negative rank) scored LOWER than a weak
+/// one. Neither memory has an embedding, which isolates the FTS
+/// component of the hybrid score (vector side is 0.0 for both).
+#[test]
+fn test_search_hybrid_ranks_strong_fts_match_above_weak_one() {
+    let store = test_store();
+
+    // Strong match: the query term repeated, short document — bm25
+    // favors high term frequency in a short field.
+    store
+        .store(make_memory(
+            "t",
+            "database database database database database",
+        ))
+        .unwrap();
+    // Weak match: the query term appears once, diluted by many other
+    // unrelated terms — bm25 penalizes this relative to the strong doc.
+    store
+        .store(make_memory(
+            "t",
+            "we briefly touched on a database as one topic among many \
+                 entirely unrelated software engineering concerns discussed today",
+        ))
+        .unwrap();
+
+    let no_embedding = vec![0.0; 384];
+    let results = store.search_hybrid("database", &no_embedding, 5).unwrap();
+    assert_eq!(results.len(), 2);
+    let strong = results
+        .iter()
+        .find(|(m, _)| m.summary.starts_with("database database"))
+        .expect("strong match must be present");
+    let weak = results
+        .iter()
+        .find(|(m, _)| m.summary.starts_with("we briefly"))
+        .expect("weak match must be present");
+    assert!(
+        strong.1 > weak.1,
+        "strong FTS match ({}) must outscore weak match ({})",
+        strong.1,
+        weak.1
+    );
+}
+
+/// Audit regression: `find_similar_memory` used to compare
+/// `DEDUP_SIMILARITY_THRESHOLD` (0.85) against the hybrid
+/// `0.3*fts + 0.7*cosine` score. A memory found ONLY via the vector
+/// side (no shared keywords, so fts=0) could score at most
+/// `0.3*0 + 0.7*1.0 = 0.70` even for a byte-identical embedding —
+/// always below 0.85, so semantic-only duplicates were never caught.
+/// Switching to pure `search_by_embedding` (cosine) fixes this: an
+/// identical embedding now scores ~1.0, comfortably above threshold,
+/// regardless of keyword overlap.
+#[test]
+fn test_find_similar_memory_detects_purely_semantic_duplicate() {
+    let store = test_store();
+    let embedding = vec![0.42; 384];
+
+    let mut original = make_memory("t", "the quick brown fox jumps over the lazy dog");
+    original.embedding = Some(embedding.clone());
+    store.store(original).unwrap();
+
+    // Shares literally no keywords with the stored summary — the FTS
+    // component of the old hybrid comparison would be exactly 0.0.
+    let found = icm_core::find_similar_memory(
+        &store,
+        "a fast animal leaping above a sleepy canine",
+        &embedding,
+        "t",
+        icm_core::DEDUP_SIMILARITY_THRESHOLD,
+    )
+    .unwrap();
+    assert!(
+        found.is_some(),
+        "an identical embedding must be detected as a duplicate even with zero keyword overlap"
+    );
+    assert!(found.unwrap().1 > 0.99);
+}
diff --git a/crates/icm-store/src/store/tests/facts.rs b/crates/icm-store/src/store/tests/facts.rs
new file mode 100644
index 00000000..92e9a427
--- /dev/null
+++ b/crates/icm-store/src/store/tests/facts.rs
@@ -0,0 +1,162 @@
+//! Per-domain tests for the SQLite backend (`store::tests`).
+
+use super::*;
+
+#[test]
+fn test_facts_set_and_get_roundtrip() {
+    let store = test_store();
+    let id = store
+        .set_fact("project:icm", "gcp.project", "rtk-ai-labs-01", "cli")
+        .unwrap();
+    assert!(!id.is_empty());
+
+    let f = store
+        .get_fact("project:icm", "gcp.project")
+        .unwrap()
+        .expect("active fact must exist");
+    assert_eq!(f.value, "rtk-ai-labs-01");
+    assert_eq!(f.source, "cli");
+    assert!(f.is_active());
+}
+
+#[test]
+fn test_facts_set_same_value_is_noop() {
+    let store = test_store();
+    let id1 = store.set_fact("e", "k", "v", "src").unwrap();
+    let id2 = store.set_fact("e", "k", "v", "src2").unwrap();
+    assert_eq!(id1, id2, "same value re-asserted must NOT create a new row");
+    let history = store.history("e", "k").unwrap();
+    assert_eq!(history.len(), 1);
+    // Source is NOT updated by the no-op (intentional: avoids
+    // creating noise just because the same fact was re-asserted
+    // from a different surface).
+    assert_eq!(history[0].source, "src");
+}
+
+#[test]
+fn test_facts_supersede_keeps_history() {
+    let store = test_store();
+    let id1 = store
+        .set_fact("project:icm", "version", "0.10.51", "release-please")
+        .unwrap();
+    let id2 = store
+        .set_fact("project:icm", "version", "0.10.52", "release-please")
+        .unwrap();
+    assert_ne!(id1, id2);
+
+    let active = store
+        .get_fact("project:icm", "version")
+        .unwrap()
+        .expect("active fact must exist after supersession");
+    assert_eq!(active.value, "0.10.52");
+    assert!(active.is_active());
+
+    let history = store.history("project:icm", "version").unwrap();
+    assert_eq!(history.len(), 2);
+    // History returned newest-first.
+    assert_eq!(history[0].value, "0.10.52");
+    assert!(history[0].is_active());
+    assert_eq!(history[1].value, "0.10.51");
+    assert!(!history[1].is_active(), "older row must be superseded");
+}
+
+#[test]
+fn test_facts_list_by_entity_alpha_sorted() {
+    let store = test_store();
+    store
+        .set_fact("host:db", "owner", "ops-team", "cli")
+        .unwrap();
+    store
+        .set_fact("host:db", "deploy.region", "europe-west1", "cli")
+        .unwrap();
+    store.set_fact("host:db", "cpu.cores", "16", "cli").unwrap();
+    store
+        .set_fact("host:web", "owner", "ui-team", "cli")
+        .unwrap();
+
+    let all = store.list_facts("host:db", None).unwrap();
+    let keys: Vec<&str> = all.iter().map(|f| f.key.as_str()).collect();
+    assert_eq!(keys, vec!["cpu.cores", "deploy.region", "owner"]);
+    // Other entity NOT included.
+    assert!(all.iter().all(|f| f.entity == "host:db"));
+}
+
+#[test]
+fn test_facts_list_prefix_filter() {
+    let store = test_store();
+    store
+        .set_fact("svc:api", "deploy.region", "europe-west1", "cli")
+        .unwrap();
+    store
+        .set_fact("svc:api", "deploy.replicas", "3", "cli")
+        .unwrap();
+    store
+        .set_fact("svc:api", "owner", "platform-team", "cli")
+        .unwrap();
+
+    let deploys = store.list_facts("svc:api", Some("deploy.")).unwrap();
+    assert_eq!(deploys.len(), 2);
+    assert!(deploys.iter().all(|f| f.key.starts_with("deploy.")));
+}
+
+#[test]
+fn test_facts_forget_drops_history_too() {
+    let store = test_store();
+    store.set_fact("e", "k", "v1", "cli").unwrap();
+    store.set_fact("e", "k", "v2", "cli").unwrap();
+    let n = store.forget_fact("e", "k").unwrap();
+    assert_eq!(n, 2, "must delete both active and superseded rows");
+    assert!(store.get_fact("e", "k").unwrap().is_none());
+    assert!(store.history("e", "k").unwrap().is_empty());
+}
+
+#[test]
+fn test_facts_stats_breakdown() {
+    let store = test_store();
+    store.set_fact("e1", "a", "1", "cli").unwrap();
+    store.set_fact("e1", "b", "2", "cli").unwrap();
+    store.set_fact("e2", "a", "3", "cli").unwrap();
+    // Supersede e1.a — history grows, active stays the same.
+    store.set_fact("e1", "a", "1-bis", "cli").unwrap();
+
+    let stats = store.facts_stats().unwrap();
+    assert_eq!(stats.active_count, 3, "3 active slots");
+    assert_eq!(stats.total_count, 4, "4 rows including superseded");
+    assert_eq!(stats.distinct_entities, 2);
+    let top: Vec<&str> = stats.top_entities.iter().map(|(e, _)| e.as_str()).collect();
+    assert!(top.contains(&"e1") && top.contains(&"e2"));
+}
+
+#[test]
+fn test_facts_rejects_empty_entity_or_key() {
+    let store = test_store();
+    assert!(store.set_fact("", "k", "v", "cli").is_err());
+    assert!(store.set_fact("e", "", "v", "cli").is_err());
+}
+
+/// Issue #273 perf invariant: primary-key lookup must stay
+/// sub-millisecond even at 10k facts. Loose budget so CI runners
+/// don't flake.
+#[test]
+fn perf_facts_get_at_10k_under_5ms() {
+    let store = test_store();
+    for i in 0..10_000 {
+        let entity = format!("entity:{}", i % 100);
+        let key = format!("key.{i}");
+        store
+            .set_fact(&entity, &key, &format!("val-{i}"), "bench")
+            .unwrap();
+    }
+    let start = std::time::Instant::now();
+    for _ in 0..1_000 {
+        let _ = store.get_fact("entity:42", "key.42").unwrap();
+    }
+    let elapsed = start.elapsed();
+    let per_lookup_us = elapsed.as_micros() / 1_000;
+    // 5ms / lookup in debug mode — generous; release is well
+    // under 1ms.
+    assert!(
+        per_lookup_us < 5_000,
+        "facts.get averaged {per_lookup_us}us / lookup over 1k iters (budget 5000us)",
+    );
+}
diff --git a/crates/icm-store/src/store/tests/feedback.rs b/crates/icm-store/src/store/tests/feedback.rs
new file mode 100644
index 00000000..82838439
--- /dev/null
+++ b/crates/icm-store/src/store/tests/feedback.rs
@@ -0,0 +1,193 @@
+//! Per-domain tests for the SQLite backend (`store::tests`).
+
+use super::*;
+
+// === FeedbackStore tests ===
+
+#[test]
+fn test_feedback_store_and_list() {
+    let store = test_store();
+    let fb = make_feedback("triage", "issue about crashes", "low", "high");
+    let id = fb.id.clone();
+    store.store_feedback(fb).unwrap();
+
+    let results = store.list_feedback(None, 10).unwrap();
+    assert_eq!(results.len(), 1);
+    assert_eq!(results[0].id, id);
+    assert_eq!(results[0].topic, "triage");
+    assert_eq!(results[0].predicted, "low");
+    assert_eq!(results[0].corrected, "high");
+}
+
+#[test]
+fn test_feedback_list_by_topic() {
+    let store = test_store();
+    store
+        .store_feedback(make_feedback("triage", "ctx1", "a", "b"))
+        .unwrap();
+    store
+        .store_feedback(make_feedback("pr-review", "ctx2", "c", "d"))
+        .unwrap();
+
+    let triage = store.list_feedback(Some("triage"), 10).unwrap();
+    assert_eq!(triage.len(), 1);
+    assert_eq!(triage[0].topic, "triage");
+
+    let all = store.list_feedback(None, 10).unwrap();
+    assert_eq!(all.len(), 2);
+}
+
+#[test]
+fn test_feedback_search() {
+    let store = test_store();
+    store
+        .store_feedback(make_feedback(
+            "triage",
+            "user reports memory leak",
+            "low priority",
+            "high priority",
+        ))
+        .unwrap();
+    store
+        .store_feedback(make_feedback(
+            "triage",
+            "build failure on CI",
+            "feature",
+            "bug",
+        ))
+        .unwrap();
+
+    let results = store
+        .search_feedback("memory leak", None, None, 10)
+        .unwrap();
+    assert_eq!(results.len(), 1);
+    assert!(results[0].context.contains("memory leak"));
+}
+
+#[test]
+fn test_feedback_search_with_topic_filter() {
+    let store = test_store();
+    store
+        .store_feedback(make_feedback("triage", "memory issue", "low", "high"))
+        .unwrap();
+    store
+        .store_feedback(make_feedback("pr-review", "memory usage", "ok", "bad"))
+        .unwrap();
+
+    let results = store
+        .search_feedback("memory", None, Some("triage"), 10)
+        .unwrap();
+    assert_eq!(results.len(), 1);
+    assert_eq!(results[0].topic, "triage");
+}
+
+/// Manual-testing finding: `feedback search` had no semantic fallback
+/// at all — pure FTS5 with implicit AND, so a query missing even one
+/// exact token (no stemming: "formatting" != "format") returned
+/// nothing, even with an obviously relevant entry stored. Proves the
+/// fix: the exact real-world query that failed now succeeds once an
+/// embedding is attached and a query embedding is supplied.
+#[test]
+fn feedback_search_falls_back_to_semantic_similarity_on_partial_fts_miss() {
+    let store = SqliteStore::in_memory_with_dims(64).unwrap();
+
+    let mut fb = make_feedback(
+        "code-style",
+        "user asked to format a date",
+        "used strftime with %Y-%m-%d",
+        "should use format_local helper for timezone consistency",
+    );
+    fb.embedding = Some(vec![0.5_f32; 64]);
+    store.store_feedback(fb).unwrap();
+
+    // FTS-only (no query embedding) must reproduce the original bug:
+    // "formatting" has no exact-token match anywhere in the entry.
+    let fts_only = store
+        .search_feedback("date formatting", None, None, 10)
+        .unwrap();
+    assert!(
+        fts_only.is_empty(),
+        "sanity check: FTS-only must still miss this partial-token query"
+    );
+
+    // With a query embedding, semantic similarity must find it even
+    // though the FTS side still misses.
+    let query_embedding = vec![0.5_f32; 64];
+    let hybrid = store
+        .search_feedback("date formatting", Some(&query_embedding), None, 10)
+        .unwrap();
+    assert_eq!(
+        hybrid.len(),
+        1,
+        "semantic fallback must surface the entry FTS alone misses"
+    );
+}
+
+#[test]
+fn test_feedback_increment_applied() {
+    let store = test_store();
+    let fb = make_feedback("triage", "ctx", "a", "b");
+    let id = fb.id.clone();
+    store.store_feedback(fb).unwrap();
+
+    store.increment_applied(&id).unwrap();
+    store.increment_applied(&id).unwrap();
+
+    let results = store.list_feedback(None, 10).unwrap();
+    assert_eq!(results[0].applied_count, 2);
+}
+
+#[test]
+fn test_feedback_increment_applied_not_found() {
+    let store = test_store();
+    let result = store.increment_applied("nonexistent");
+    assert!(result.is_err());
+}
+
+#[test]
+fn test_feedback_delete() {
+    let store = test_store();
+    let fb = make_feedback("triage", "ctx", "a", "b");
+    let id = fb.id.clone();
+    store.store_feedback(fb).unwrap();
+
+    store.delete_feedback(&id).unwrap();
+    let results = store.list_feedback(None, 10).unwrap();
+    assert!(results.is_empty());
+}
+
+#[test]
+fn test_feedback_delete_not_found() {
+    let store = test_store();
+    let result = store.delete_feedback("nonexistent");
+    assert!(result.is_err());
+}
+
+#[test]
+fn test_feedback_stats() {
+    let store = test_store();
+    store
+        .store_feedback(make_feedback("triage", "ctx1", "a", "b"))
+        .unwrap();
+    store
+        .store_feedback(make_feedback("triage", "ctx2", "c", "d"))
+        .unwrap();
+    store
+        .store_feedback(make_feedback("pr-review", "ctx3", "e", "f"))
+        .unwrap();
+
+    let fb = make_feedback("triage", "ctx4", "g", "h");
+    let id = fb.id.clone();
+    store.store_feedback(fb).unwrap();
+    store.increment_applied(&id).unwrap();
+
+    let stats = store.feedback_stats().unwrap();
+    assert_eq!(stats.total, 4);
+    assert_eq!(stats.by_topic.len(), 2);
+    assert_eq!(stats.by_topic[0].0, "triage");
+    assert_eq!(stats.by_topic[0].1, 3);
+    assert_eq!(stats.most_applied.len(), 1);
+    assert_eq!(stats.most_applied[0].1, 1);
+}
+
+// === sanitize_fts_query tests ===
diff --git a/crates/icm-store/src/store/tests/graph.rs b/crates/icm-store/src/store/tests/graph.rs
new file mode 100644
index 00000000..5b0d0bbc
--- /dev/null
+++ b/crates/icm-store/src/store/tests/graph.rs
@@ -0,0 +1,480 @@
+//! Per-domain tests for the SQLite backend (`store::tests`).
+
+use super::*;
+
+#[test]
+fn test_expand_with_neighbors_brings_hop_1() {
+    let store = test_store();
+    // Create 3 memories. m1 is a direct query hit; m2 and m3 are
+    // related to m1 via related_ids; m3 is unrelated.
+    let mut m1 = make_memory("decisions", "primary hit");
+    let mut m2 = make_memory("decisions", "related neighbor");
+    let m3 = make_memory("unrelated", "far away");
+
+    // Set up the edges before storing.
+    m1.related_ids.push(m2.id.clone());
+    m2.related_ids.push(m1.id.clone());
+
+    let id1 = store.store(m1.clone()).unwrap();
+    let _id2 = store.store(m2.clone()).unwrap();
+    let _id3 = store.store(m3.clone()).unwrap();
+
+    let m1_full = store.get(&id1).unwrap().unwrap();
+    let initial = vec![(m1_full, 0.9_f32)];
+
+    let expanded = store.expand_with_neighbors(&initial, 5, 0.5, 10).unwrap();
+
+    assert_eq!(expanded.len(), 2, "primary + 1 neighbor");
+    assert!(expanded.iter().any(|(m, _)| m.id == m1.id));
+    assert!(
+        expanded.iter().any(|(m, _)| m.id == m2.id),
+        "neighbor should be pulled in"
+    );
+    assert!(
+        expanded.iter().all(|(m, _)| m.id != m3.id),
+        "unrelated memory must not be pulled in: {expanded:?}"
+    );
+}
+
+#[test]
+fn test_expand_with_neighbors_dedupes_initial() {
+    let store = test_store();
+    let mut m1 = make_memory("t", "hit 1");
+    let mut m2 = make_memory("t", "hit 2");
+    m1.related_ids.push(m2.id.clone());
+    m2.related_ids.push(m1.id.clone());
+
+    let id1 = store.store(m1.clone()).unwrap();
+    let id2 = store.store(m2.clone()).unwrap();
+
+    // Both already in the initial set — no neighbor to add.
+    let m1_full = store.get(&id1).unwrap().unwrap();
+    let m2_full = store.get(&id2).unwrap().unwrap();
+    let initial = vec![(m1_full, 0.9_f32), (m2_full, 0.85_f32)];
+
+    let expanded = store.expand_with_neighbors(&initial, 5, 0.5, 10).unwrap();
+    assert_eq!(expanded.len(), 2, "no duplicates when both already present");
+}
+
+#[test]
+fn test_expand_with_neighbors_respects_max_neighbors() {
+    let store = test_store();
+    // m1 has 5 neighbors. Cap max_neighbors at 2.
+    let mut m1 = make_memory("t", "hub");
+    let n1 = make_memory("t", "neighbor 1");
+    let n2 = make_memory("t", "neighbor 2");
+    let n3 = make_memory("t", "neighbor 3");
+    let n4 = make_memory("t", "neighbor 4");
+    let n5 = make_memory("t", "neighbor 5");
+    m1.related_ids.extend([
+        n1.id.clone(),
+        n2.id.clone(),
+        n3.id.clone(),
+        n4.id.clone(),
+        n5.id.clone(),
+    ]);
+
+    let id1 = store.store(m1.clone()).unwrap();
+    for n in [&n1, &n2, &n3, &n4, &n5] {
+        store.store(n.clone()).unwrap();
+    }
+
+    let m1_full = store.get(&id1).unwrap().unwrap();
+    let initial = vec![(m1_full, 0.9_f32)];
+
+    let expanded = store.expand_with_neighbors(&initial, 2, 0.5, 10).unwrap();
+    // 1 primary + 2 neighbors = 3.
+    assert_eq!(expanded.len(), 3);
+}
+
+#[test]
+fn test_expand_with_neighbors_applies_discount() {
+    let store = test_store();
+    let mut m1 = make_memory("t", "primary");
+    let m2 = make_memory("t", "neighbor");
+    m1.related_ids.push(m2.id.clone());
+
+    let id1 = store.store(m1.clone()).unwrap();
+    store.store(m2.clone()).unwrap();
+
+    let m1_full = store.get(&id1).unwrap().unwrap();
+    let initial = vec![(m1_full, 0.9_f32)];
+
+    let expanded = store.expand_with_neighbors(&initial, 5, 0.5, 10).unwrap();
+
+    // Find neighbor score: should be 0.9 * 0.5 = 0.45
+    let neighbor_score = expanded
+        .iter()
+        .find(|(m, _)| m.id == m2.id)
+        .map(|(_, s)| *s)
+        .unwrap();
+    assert!(
+        (neighbor_score - 0.45).abs() < 1e-5,
+        "neighbor discount wrong: {neighbor_score}"
+    );
+}
+
+#[test]
+fn test_expand_with_neighbors_respects_max_total() {
+    let store = test_store();
+    // 3 primaries + 3 neighbors, but max_total=4 caps output.
+    let mut m1 = make_memory("t", "p1");
+    let mut m2 = make_memory("t", "p2");
+    let mut m3 = make_memory("t", "p3");
+    let n1 = make_memory("t", "n1");
+    let n2 = make_memory("t", "n2");
+    let n3 = make_memory("t", "n3");
+    m1.related_ids.push(n1.id.clone());
+    m2.related_ids.push(n2.id.clone());
+    m3.related_ids.push(n3.id.clone());
+
+    let id1 = store.store(m1.clone()).unwrap();
+    let id2 = store.store(m2.clone()).unwrap();
+    let id3 = store.store(m3.clone()).unwrap();
+    store.store(n1).unwrap();
+    store.store(n2).unwrap();
+    store.store(n3).unwrap();
+
+    let initial = vec![
+        (store.get(&id1).unwrap().unwrap(), 0.9),
+        (store.get(&id2).unwrap().unwrap(), 0.85),
+        (store.get(&id3).unwrap().unwrap(), 0.8),
+    ];
+
+    let expanded = store.expand_with_neighbors(&initial, 5, 0.5, 4).unwrap();
+    assert_eq!(expanded.len(), 4, "must respect max_total cap");
+    // Top scorer remains first.
+    assert!((expanded[0].1 - 0.9).abs() < 1e-5);
+}
+
+#[test]
+fn test_expand_with_neighbors_empty_initial_passthrough() {
+    let store = test_store();
+    let expanded = store.expand_with_neighbors(&[], 5, 0.5, 10).unwrap();
+    assert!(expanded.is_empty());
+}
+
+#[test]
+fn test_expand_with_neighbors_zero_neighbors_disables() {
+    let store = test_store();
+    let mut m1 = make_memory("t", "primary");
+    let m2 = make_memory("t", "would-be neighbor");
+    m1.related_ids.push(m2.id.clone());
+
+    let id1 = store.store(m1.clone()).unwrap();
+    store.store(m2).unwrap();
+
+    let initial = vec![(store.get(&id1).unwrap().unwrap(), 0.9)];
+    let expanded = store.expand_with_neighbors(&initial, 0, 0.5, 10).unwrap();
+    assert_eq!(expanded.len(), 1, "max_neighbors=0 disables expansion");
+}
+
+#[test]
+fn test_expand_with_neighbors_skips_missing_targets() {
+    let store = test_store();
+    // m1 points to a ghost id that no longer exists (e.g., deleted).
+    let mut m1 = make_memory("t", "has ghost link");
+    m1.related_ids.push("01GHOSTID".into());
+    let id1 = store.store(m1.clone()).unwrap();
+
+    let initial = vec![(store.get(&id1).unwrap().unwrap(), 0.9)];
+    let expanded = store.expand_with_neighbors(&initial, 5, 0.5, 10).unwrap();
+    assert_eq!(expanded.len(), 1, "ghost link must be silently skipped");
+}
+
+// get_many (batched fetch)
+
+#[test]
+fn test_get_many_returns_requested_ids() {
+    let store = test_store();
+    let m1 = make_memory("t", "first");
+    let m2 = make_memory("t", "second");
+    let m3 = make_memory("t", "third");
+    let id1 = store.store(m1.clone()).unwrap();
+    let id2 = store.store(m2.clone()).unwrap();
+    store.store(m3).unwrap();
+
+    let got = store.get_many(&[id1.as_str(), id2.as_str()]).unwrap();
+    assert_eq!(got.len(), 2);
+    assert!(got.contains_key(&id1));
+    assert!(got.contains_key(&id2));
+}
+
+#[test]
+fn test_get_many_empty_input_returns_empty() {
+    let store = test_store();
+    let got = store.get_many(&[]).unwrap();
+    assert!(got.is_empty());
+}
+
+#[test]
+fn test_get_many_missing_ids_silently_dropped() {
+    let store = test_store();
+    let m1 = make_memory("t", "real");
+    let id1 = store.store(m1).unwrap();
+
+    let got = store.get_many(&[id1.as_str(), "01NONEXISTENT"]).unwrap();
+    assert_eq!(got.len(), 1);
+    assert!(got.contains_key(&id1));
+}
+
+#[test]
+fn test_get_many_dedupes_input() {
+    let store = test_store();
+    let m1 = make_memory("t", "only");
+    let id1 = store.store(m1).unwrap();
+
+    // Same id three times — must not blow up the IN clause.
+    let got = store
+        .get_many(&[id1.as_str(), id1.as_str(), id1.as_str()])
+        .unwrap();
+    assert_eq!(got.len(), 1);
+}
+
+// LRU cache invalidation
+
+#[test]
+fn test_cache_serves_after_first_get() {
+    let store = test_store();
+    let m = make_memory("t", "original");
+    let id = store.store(m).unwrap();
+
+    // Warm the cache.
+    let first = store.get(&id).unwrap().unwrap();
+    assert_eq!(first.summary, "original");
+
+    // Mutate the row out-of-band so a stale cache hit would show.
+    store
+        .conn
+        .execute(
+            "UPDATE memories SET summary = 'mutated' WHERE id = ?1",
+            params![id],
+        )
+        .unwrap();
+
+    // Cache is unaware of the raw SQL write, so we should still
+    // see "original" — that's the proof the cache is serving reads.
+    let cached = store.get(&id).unwrap().unwrap();
+    assert_eq!(cached.summary, "original", "cache must serve hot reads");
+}
+
+#[test]
+fn test_update_invalidates_cache() {
+    let store = test_store();
+    let m = make_memory("t", "v1");
+    let id = store.store(m).unwrap();
+
+    // Warm cache.
+    let _ = store.get(&id).unwrap();
+
+    // Proper update through the trait flushes the cache entry.
+    let mut updated = store.get(&id).unwrap().unwrap();
+    updated.summary = "v2".into();
+    store.update(&updated).unwrap();
+
+    let after = store.get(&id).unwrap().unwrap();
+    assert_eq!(after.summary, "v2");
+}
+
+#[test]
+fn test_delete_invalidates_cache() {
+    let store = test_store();
+    let m = make_memory("t", "doomed");
+    let id = store.store(m).unwrap();
+
+    // Warm the cache, then delete.
+    let _ = store.get(&id).unwrap();
+    store.delete(&id).unwrap();
+
+    let after = store.get(&id).unwrap();
+    assert!(after.is_none(), "deleted memory must not survive in cache");
+}
+
+#[test]
+fn test_apply_decay_clears_cache() {
+    let store = test_store();
+    let m1 = make_memory("t", "a");
+    let m2 = make_memory("t", "b");
+    let id1 = store.store(m1).unwrap();
+    let id2 = store.store(m2).unwrap();
+
+    // Warm cache for both.
+    let before1 = store.get(&id1).unwrap().unwrap().weight;
+    let _ = store.get(&id2).unwrap();
+
+    store.apply_decay(0.5).unwrap();
+
+    // After decay, cache must have been wiped, so the next read
+    // returns the decayed weight from disk.
+    let after1 = store.get(&id1).unwrap().unwrap().weight;
+    assert!(
+        after1 < before1,
+        "post-decay weight should reflect DB, not stale cache (before={before1}, after={after1})"
+    );
+}
+
+#[test]
+fn test_get_many_uses_cache_for_warm_ids() {
+    let store = test_store();
+    let m = make_memory("t", "warm");
+    let id = store.store(m).unwrap();
+
+    // Warm the cache via single get.
+    let _ = store.get(&id).unwrap();
+
+    // Out-of-band mutate — cached value should still be served by
+    // get_many for this id.
+    store
+        .conn
+        .execute(
+            "UPDATE memories SET summary = 'mutated' WHERE id = ?1",
+            params![id],
+        )
+        .unwrap();
+
+    let got = store.get_many(&[id.as_str()]).unwrap();
+    assert_eq!(got.get(&id).unwrap().summary, "warm");
+}
+
+// content-hash dedup
+
+#[test]
+fn test_dedup_same_topic_summary_collapses() {
+    let store = test_store();
+    let m1 = make_memory("dedup", "Use Turso for cloud sync");
+    let m2 = make_memory("dedup", "Use Turso for cloud sync"); // identical content
+    let id1 = store.store(m1).unwrap();
+    let id2 = store.store(m2).unwrap();
+    // Both calls return the SAME id (the first row's). Second store
+    // is a no-op at the DB level, but the contract still returns an
+    // id pointing at a real row.
+    assert_eq!(id1, id2, "dedup must return the existing row's id");
+    assert_eq!(store.count().unwrap(), 1, "only one row in memories");
+}
+
+#[test]
+fn test_dedup_normalizes_whitespace_and_case() {
+    let store = test_store();
+    let m1 = make_memory("DEDUP", "Use   Turso   for cloud sync");
+    let m2 = make_memory("dedup", "use turso for cloud sync");
+    let id1 = store.store(m1).unwrap();
+    let id2 = store.store(m2).unwrap();
+    assert_eq!(id1, id2);
+    assert_eq!(store.count().unwrap(), 1);
+}
+
+/// Audit regression: SQLite's built-in `LOWER()` is ASCII-only and does
+/// not fold 'É' → 'é', while `summary_hash` uses Rust's Unicode-correct
+/// `to_lowercase()`. Two topics that differ only in the case of an
+/// accented letter must still dedup — this used to fail because the
+/// (now-removed) `LOWER(topic)` index column and SELECT comparison
+/// disagreed with the hash's own case-folding.
+#[test]
+fn test_dedup_normalizes_accented_case() {
+    let store = test_store();
+    let m1 = make_memory("Décisions", "on utilise Turso pour la synchro");
+    let m2 = make_memory("DÉCISIONS", "on utilise Turso pour la synchro");
+    let id1 = store.store(m1).unwrap();
+    let id2 = store.store(m2).unwrap();
+    assert_eq!(
+        id1, id2,
+        "accented topics differing only in case must dedup to the same row"
+    );
+    assert_eq!(store.count().unwrap(), 1);
+}
+
+#[test]
+fn test_dedup_different_topic_keeps_both() {
+    let store = test_store();
+    let m1 = make_memory("topic-a", "shared body");
+    let m2 = make_memory("topic-b", "shared body");
+    let id1 = store.store(m1).unwrap();
+    let id2 = store.store(m2).unwrap();
+    assert_ne!(id1, id2, "different topic = different row");
+    assert_eq!(store.count().unwrap(), 2);
+}
+
+#[test]
+fn test_store_is_atomic() {
+    let store = test_store();
+    let mut mem = make_memory("atomic", "test atomicity");
+    mem.embedding = Some(vec![0.1; 384]);
+    let id = mem.id.clone();
+
+    store.store(mem).unwrap();
+
+    // Verify main table has the row
+    let retrieved = store.get(&id).unwrap().unwrap();
+    assert_eq!(retrieved.summary, "test atomicity");
+
+    // Verify vec_memories also has the row
+    let vec_count: i64 = store
+        .conn
+        .query_row(
+            "SELECT count(*) FROM vec_memories WHERE memory_id = ?1",
+            params![id],
+            |row| row.get(0),
+        )
+        .unwrap();
+    assert_eq!(vec_count, 1);
+}
+
+#[test]
+fn test_busy_timeout_pragma() {
+    // Audit #185 M: 6/20 parallel hook handlers timed out at the
+    // previous 5s busy_timeout. Bumping to 30s covers realistic
+    // burst-write contention (large transcript extraction triggers
+    // many writes on PreCompact/SessionEnd) without hiding genuine
+    // lock issues — anyone holding a write lock for >30s has a
+    // real bug worth surfacing.
+    let store = test_store();
+    let timeout: i64 = store
+        .conn
+        .query_row("PRAGMA busy_timeout", [], |row| row.get(0))
+        .unwrap();
+    assert_eq!(timeout, 30000);
+}
+
+#[test]
+fn test_fts_sanitize_utf8_safe() {
+    // Build a string with multibyte chars near the 10k boundary.
+    // Each emoji is 4 bytes. Fill up to just past 10_000 bytes.
+    let base = "a".repeat(9_998);
+    // Add a 4-byte emoji that straddles the 10_000 boundary
+    let input = format!("{base}\u{1F600}\u{1F600}"); // 9998 + 4 + 4 = 10006 bytes
+    assert!(input.len() > 10_000);
+
+    // This should not panic (the old code could split a UTF-8 char)
+    let result = sanitize_fts_query(&input);
+    // The result should be valid UTF-8 (it's a String, so it is by construction)
+    assert!(!result.is_empty());
+    // The truncated input should not contain partial emoji
+    // (9998 + 4 = 10002 > 10000, so the emoji at 9998 is excluded; end = 9998)
+    // Result should just be the 'a' tokens
+}
+
+#[test]
+fn test_forget_topic() {
+    let store = test_store();
+
+    // Create 3 memories in topic "ephemeral"
+    for i in 0..3 {
+        let m = make_memory("ephemeral", &format!("item {i}"));
+        store.store(m).unwrap();
+    }
+
+    // Verify they exist
+    let before = store.get_by_topic("ephemeral").unwrap();
+    assert_eq!(before.len(), 3);
+
+    // Delete all memories in the topic
+    for m in &before {
+        store.delete(&m.id).unwrap();
+    }
+
+    // Verify 0 remain
+    let after = store.get_by_topic("ephemeral").unwrap();
+    assert!(after.is_empty());
+}
+
+// === TranscriptStore tests ===
diff --git a/crates/icm-store/src/store/tests/hooks.rs b/crates/icm-store/src/store/tests/hooks.rs
new file mode 100644
index 00000000..e64215a0
--- /dev/null
+++ b/crates/icm-store/src/store/tests/hooks.rs
@@ -0,0 +1,221 @@
+//! Per-domain tests for the SQLite backend (`store::tests`).
+
+use super::*;
+
+// Hook telemetry
+
+#[test]
+fn test_record_hook_event_persists() {
+    let store = test_store();
+    let id = store.record_hook_event(&insert("post", 12, 0)).unwrap();
+    assert!(id > 0);
+    assert_eq!(store.hook_event_count().unwrap(), 1);
+}
+
+#[test]
+fn test_hook_events_recent_orders_newest_first_and_filters() {
+    let store = test_store();
+    store.record_hook_event(&insert("post", 10, 0)).unwrap();
+    store.record_hook_event(&insert("end", 9, 0)).unwrap();
+    store.record_hook_event(&insert("post", 20, 1)).unwrap();
+
+    let all = store.hook_events_recent(10, None).unwrap();
+    assert_eq!(all.len(), 3);
+    // Newest first: third insert wins position 0.
+    assert_eq!(all[0].event, "post");
+    assert_eq!(all[0].exit_code, 1);
+
+    let posts = store.hook_events_recent(10, Some("post")).unwrap();
+    assert_eq!(posts.len(), 2);
+    assert!(posts.iter().all(|r| r.event == "post"));
+
+    let ends = store.hook_events_recent(10, Some("end")).unwrap();
+    assert_eq!(ends.len(), 1);
+    assert_eq!(ends[0].duration_ms, Some(9));
+}
+
+#[test]
+fn test_hook_stats_buckets_by_event_and_computes_percentiles() {
+    let store = test_store();
+    // post: durations [10, 20, 30] — p50=20, p99=30
+    store.record_hook_event(&insert("post", 10, 0)).unwrap();
+    store.record_hook_event(&insert("post", 20, 0)).unwrap();
+    store.record_hook_event(&insert("post", 30, 1)).unwrap();
+    // end: single 9ms success
+    store.record_hook_event(&insert("end", 9, 0)).unwrap();
+
+    // Use a wide window so all rows fall inside.
+    let cutoff = (chrono::Utc::now() - chrono::Duration::hours(1)).to_rfc3339();
+    let stats = store.hook_stats(&cutoff).unwrap();
+    let by_event: std::collections::HashMap<_, _> =
+        stats.into_iter().map(|r| (r.event.clone(), r)).collect();
+
+    let post = &by_event["post"];
+    assert_eq!(post.count, 3);
+    assert_eq!(post.error_count, 1);
+    assert_eq!(post.p50_duration_ms, 20);
+    assert_eq!(post.p99_duration_ms, 30);
+
+    let end = &by_event["end"];
+    assert_eq!(end.count, 1);
+    assert_eq!(end.error_count, 0);
+    assert_eq!(end.p50_duration_ms, 9);
+}
+
+#[test]
+fn test_prune_hook_events_drops_old_rows_only() {
+    let store = test_store();
+    store.record_hook_event(&insert("post", 10, 0)).unwrap();
+    // Cutoff in the future → wipes everything.
+    let future = (chrono::Utc::now() + chrono::Duration::hours(1)).to_rfc3339();
+    let n = store.prune_hook_events(&future).unwrap();
+    assert_eq!(n, 1);
+    assert_eq!(store.hook_event_count().unwrap(), 0);
+
+    // Re-insert, then prune with a past cutoff → keeps row.
+    store.record_hook_event(&insert("post", 10, 0)).unwrap();
+    let past = (chrono::Utc::now() - chrono::Duration::hours(1)).to_rfc3339();
+    let n = store.prune_hook_events(&past).unwrap();
+    assert_eq!(n, 0);
+    assert_eq!(store.hook_event_count().unwrap(), 1);
+}
+
+// code_areas (issue #196)
+
+#[test]
+fn test_upsert_code_area_inserts_then_increments_touch_count() {
+    let store = test_store();
+    store
+        .upsert_code_area("proj", "src/foo.rs", None, Some("s1"), Some("Edit"))
+        .unwrap();
+    let after_first = store.list_code_areas(None, None, None, 10).unwrap();
+    assert_eq!(after_first.len(), 1);
+    assert_eq!(after_first[0].touch_count, 1);
+    assert_eq!(after_first[0].project, "proj");
+    assert_eq!(after_first[0].file_path, "src/foo.rs");
+
+    // Same path again — touch_count++ and last_touched_at updates.
+    let first_touched_at = after_first[0].first_touched_at;
+    store
+        .upsert_code_area("proj", "src/foo.rs", None, Some("s2"), Some("Write"))
+        .unwrap();
+    let after_second = store.list_code_areas(None, None, None, 10).unwrap();
+    assert_eq!(after_second.len(), 1, "no duplicate row on re-touch");
+    assert_eq!(after_second[0].touch_count, 2);
+    // first_touched_at is preserved across re-touches.
+    assert_eq!(after_second[0].first_touched_at, first_touched_at);
+    // session_id / tool_name are refreshed to the latest.
+    assert_eq!(after_second[0].session_id.as_deref(), Some("s2"));
+    assert_eq!(after_second[0].tool_name.as_deref(), Some("Write"));
+}
+
+#[test]
+fn test_upsert_code_area_preserves_existing_description_when_passed_none() {
+    let store = test_store();
+    store
+        .upsert_code_area("proj", "f.rs", Some("initial note"), None, None)
+        .unwrap();
+    store
+        .upsert_code_area("proj", "f.rs", None, None, None)
+        .unwrap();
+    let rows = store.list_code_areas(None, None, None, 10).unwrap();
+    assert_eq!(rows.len(), 1);
+    assert_eq!(rows[0].description.as_deref(), Some("initial note"));
+}
+
+#[test]
+fn test_upsert_code_area_overwrites_description_when_passed_some() {
+    let store = test_store();
+    store
+        .upsert_code_area("proj", "f.rs", Some("v1"), None, None)
+        .unwrap();
+    store
+        .upsert_code_area("proj", "f.rs", Some("v2"), None, None)
+        .unwrap();
+    let rows = store.list_code_areas(None, None, None, 10).unwrap();
+    assert_eq!(rows[0].description.as_deref(), Some("v2"));
+}
+
+#[test]
+fn test_list_code_areas_filters_by_project_and_path_suffix() {
+    let store = test_store();
+    store
+        .upsert_code_area("alpha", "src/a.rs", None, None, None)
+        .unwrap();
+    store
+        .upsert_code_area("alpha", "src/b.rs", None, None, None)
+        .unwrap();
+    store
+        .upsert_code_area("beta", "src/a.rs", None, None, None)
+        .unwrap();
+
+    let only_alpha = store
+        .list_code_areas(Some("alpha"), None, None, 10)
+        .unwrap();
+    assert_eq!(only_alpha.len(), 2);
+
+    // Suffix match catches both alpha/src/a.rs and beta/src/a.rs.
+    let any_a = store
+        .list_code_areas(None, Some("src/a.rs"), None, 10)
+        .unwrap();
+    assert_eq!(any_a.len(), 2);
+    for r in &any_a {
+        assert!(r.file_path.ends_with("src/a.rs"));
+    }
+
+    // Project + path combine.
+    let alpha_a = store
+        .list_code_areas(Some("alpha"), Some("src/a.rs"), None, 10)
+        .unwrap();
+    assert_eq!(alpha_a.len(), 1);
+    assert_eq!(alpha_a[0].project, "alpha");
+}
+
+#[test]
+fn test_list_code_areas_filters_by_since_timestamp() {
+    let store = test_store();
+    store
+        .upsert_code_area("p", "old.rs", None, None, None)
+        .unwrap();
+    // Cutoff one hour ahead skips everything we just inserted.
+    let cutoff = chrono::Utc::now() + chrono::Duration::hours(1);
+    let after = store.list_code_areas(None, None, Some(cutoff), 10).unwrap();
+    assert!(after.is_empty());
+    // Cutoff one hour behind keeps the row.
+    let past = chrono::Utc::now() - chrono::Duration::hours(1);
+    let after = store.list_code_areas(None, None, Some(past), 10).unwrap();
+    assert_eq!(after.len(), 1);
+}
+
+#[test]
+fn test_list_code_areas_orders_by_last_touched_desc() {
+    let store = test_store();
+    store
+        .upsert_code_area("p", "first.rs", None, None, None)
+        .unwrap();
+    // Sleep so the second insert lands at a strictly later second.
+    std::thread::sleep(std::time::Duration::from_millis(1100));
+    store
+        .upsert_code_area("p", "second.rs", None, None, None)
+        .unwrap();
+    let rows = store.list_code_areas(None, None, None, 10).unwrap();
+    assert_eq!(rows.len(), 2);
+    assert_eq!(rows[0].file_path, "second.rs");
+    assert_eq!(rows[1].file_path, "first.rs");
+}
+
+#[test]
+fn test_code_area_count_matches_unique_paths() {
+    let store = test_store();
+    assert_eq!(store.code_area_count().unwrap(), 0);
+    store
+        .upsert_code_area("p", "f.rs", None, None, None)
+        .unwrap();
+    store
+        .upsert_code_area("p", "f.rs", None, None, None)
+        .unwrap(); // re-touch
+    store
+        .upsert_code_area("p", "g.rs", None, None, None)
+        .unwrap();
+    assert_eq!(store.code_area_count().unwrap(), 2);
+}
diff --git a/crates/icm-store/src/store/tests/maintenance.rs b/crates/icm-store/src/store/tests/maintenance.rs
new file mode 100644
index 00000000..d4e3cd01
--- /dev/null
+++ b/crates/icm-store/src/store/tests/maintenance.rs
@@ -0,0 +1,388 @@
+//! Per-domain tests for the SQLite backend (`store::tests`).
+
+use super::*;
+
+#[test]
+fn integrity_check_ok_on_healthy_db() {
+    let store = test_store();
+    store.store(make_memory("t", "healthy row")).unwrap();
+    assert_eq!(store.integrity_check().unwrap(), vec!["ok".to_string()]);
+}
+
+#[test]
+fn integrity_check_structural_works_on_a_read_only_connection() {
+    // #313 follow-up: `icm doctor` / `repair --dry-run` must inspect a DB
+    // without a writable open. The structural check runs `PRAGMA
+    // integrity_check` only (no FTS INSERT), so it works read-only.
+    let dir = tempfile::tempdir().unwrap();
+    let path = dir.path().join("ro.db");
+    let _ = seed_writable_db(&path);
+
+    let ro = SqliteStore::open_readonly(&path).unwrap();
+    assert!(ro.is_readonly());
+    // Read-only structural check succeeds and reports healthy.
+    assert_eq!(
+        ro.integrity_check_structural().unwrap(),
+        vec!["ok".to_string()]
+    );
+    // The full check issues an FTS `INSERT` a read-only connection can't
+    // run, so it degrades to reporting that as a problem — which is exactly
+    // why the read-only inspection paths use the structural variant.
+    assert_ne!(ro.integrity_check().unwrap(), vec!["ok".to_string()]);
+}
+
+#[test]
+fn rebuild_search_indexes_lists_fts_tables_and_keeps_integrity() {
+    let store = test_store();
+    store.store(make_memory("t", "a row to index")).unwrap();
+    let rebuilt = store.rebuild_search_indexes().unwrap();
+    // memories_fts always exists; the concepts/feedback/messages FTS
+    // tables are created by schema init too.
+    assert!(
+        rebuilt.contains(&"memories_fts".to_string()),
+        "got: {rebuilt:?}"
+    );
+    assert_eq!(store.integrity_check().unwrap(), vec!["ok".to_string()]);
+}
+
+#[test]
+fn rebuild_search_indexes_regenerates_fts_from_content() {
+    // The core repair mechanism (#313): rebuilding must reconstruct the
+    // FTS index from the intact content table. Deterministically wipe the
+    // FTS index (the "index damaged, base table intact" class) and prove
+    // rebuild restores searchability.
+    let store = test_store();
+    store
+        .store(make_memory("t", "singulartoken repairable"))
+        .unwrap();
+
+    let fts_hits = |s: &SqliteStore| -> i64 {
+        s.conn
+            .query_row(
+                "SELECT COUNT(*) FROM memories_fts WHERE memories_fts MATCH 'singulartoken'",
+                [],
+                |r| r.get(0),
+            )
+            .unwrap()
+    };
+    assert_eq!(fts_hits(&store), 1, "token should be indexed after store");
+
+    // Wipe the FTS index while leaving the content row in `memories`.
+    store
+        .conn
+        .execute_batch("INSERT INTO memories_fts(memories_fts) VALUES('delete-all');")
+        .unwrap();
+    assert_eq!(fts_hits(&store), 0, "index wiped → no FTS hit");
+
+    // integrity_check (rank=1 content check) must flag the desync so that
+    // `icm repair` actually triggers on it rather than reporting healthy.
+    assert_ne!(
+        store.integrity_check().unwrap(),
+        vec!["ok".to_string()],
+        "index/content desync must be detected"
+    );
+
+    store.rebuild_search_indexes().unwrap();
+    assert_eq!(fts_hits(&store), 1, "rebuild must regenerate the FTS index");
+    assert_eq!(store.integrity_check().unwrap(), vec!["ok".to_string()]);
+}
+
+#[test]
+fn open_maintenance_errors_on_missing_file() {
+    let dir = tempfile::tempdir().unwrap();
+    let path = dir.path().join("absent.db");
+    match SqliteStore::open_maintenance(&path) {
+        Ok(_) => panic!("open_maintenance on missing file must error"),
+        Err(IcmError::NotFound(_)) => {}
+        Err(other) => panic!("expected NotFound, got {other:?}"),
+    }
+}
+
+#[test]
+fn open_maintenance_opens_existing_db_writable() {
+    let dir = tempfile::tempdir().unwrap();
+    let path = dir.path().join("seeded.db");
+    let _ = seed_writable_db(&path);
+    let store = SqliteStore::open_maintenance(&path).unwrap();
+    assert!(!store.is_readonly());
+    assert_eq!(store.integrity_check().unwrap(), vec!["ok".to_string()]);
+}
+
+// === Read-only store (issue #263) ===
+
+#[test]
+fn open_readonly_errors_on_missing_file() {
+    let dir = tempfile::tempdir().unwrap();
+    let path = dir.path().join("absent.db");
+    match SqliteStore::open_readonly(&path) {
+        Ok(_) => panic!("open_readonly on missing file must error"),
+        Err(IcmError::NotFound(msg)) => {
+            assert!(msg.contains("absent.db"), "msg: {msg}")
+        }
+        Err(other) => panic!("expected NotFound, got {other:?}"),
+    }
+}
+
+#[test]
+fn open_readonly_can_read_existing_db() {
+    let dir = tempfile::tempdir().unwrap();
+    let path = dir.path().join("seeded.db");
+    let seeded = seed_writable_db(&path);
+
+    let ro = SqliteStore::open_readonly(&path).unwrap();
+    assert!(ro.is_readonly());
+
+    // Read by id: must return the seeded memory verbatim.
+    let got = ro.get(&seeded.id).unwrap().expect("memory must be present");
+    assert_eq!(got.topic, "project:icm");
+    assert_eq!(got.summary, "read-only fixture summary");
+}
+
+#[test]
+fn read_only_connection_sees_writes_committed_after_open() {
+    // #319: a long-lived `--read-only serve` connection must observe
+    // writes that hooks/CLI commit to the same DB *after* the server
+    // opened. The old `immutable=1` open served a permanently stale
+    // snapshot (and eventually spurious "database disk image is malformed"
+    // on a healthy DB).
+    let dir = tempfile::tempdir().unwrap();
+    let path = dir.path().join("live.db");
+    let _ = seed_writable_db(&path); // 1 memory, WAL mode
+
+    let ro = SqliteStore::open_readonly(&path).unwrap();
+    assert_eq!(ro.count().unwrap(), 1);
+
+    // A separate writer commits a new memory to the same file.
+    {
+        let rw = SqliteStore::new(&path).unwrap();
+        let mut m = make_memory("project:icm", "written after the reader opened");
+        m.embedding = Some(vec![0.2_f32; icm_core::DEFAULT_EMBEDDING_DIMS]);
+        rw.store(m).unwrap();
+    }
+
+    // The already-open read-only connection must now see it.
+    assert_eq!(
+        ro.count().unwrap(),
+        2,
+        "read-only connection must see writes committed after it opened"
+    );
+}
+
+#[cfg(unix)]
+#[test]
+fn open_readonly_falls_back_to_immutable_on_unwritable_dir() {
+    // #263 must keep working after #319: on a `chmod -w` parent directory
+    // the live `mode=ro` open can't create the `-shm` sidecar for a WAL
+    // DB, so open_readonly must fall back to `immutable=1` and still read.
+    use std::os::unix::fs::PermissionsExt;
+    let dir = tempfile::tempdir().unwrap();
+    let path = dir.path().join("sandboxed.db");
+    let seeded = seed_writable_db(&path);
+    // Keep the DB in WAL mode (that's what forces the -shm requirement)
+    // but fold all rows into the main file and drop the sidecars, so a
+    // fresh read-only open must recreate -shm — which fails in a
+    // read-only dir. (A DELETE-mode DB would open fine via plain mode=ro
+    // and never exercise the fallback.)
+    {
+        let rw = SqliteStore::new(&path).unwrap();
+        rw.conn
+            .execute_batch("PRAGMA wal_checkpoint(TRUNCATE);")
+            .unwrap();
+    }
+    for ext in ["-wal", "-shm"] {
+        let mut side = path.as_os_str().to_os_string();
+        side.push(ext);
+        let _ = std::fs::remove_file(std::path::PathBuf::from(side));
+    }
+
+    let original = std::fs::metadata(dir.path()).unwrap().permissions();
+    std::fs::set_permissions(dir.path(), std::fs::Permissions::from_mode(0o555)).unwrap();
+
+    // Guard: confirm the live `mode=ro` path is genuinely unusable here,
+    // otherwise this test would pass without ever exercising the fallback.
+    let live_reads = match open_readonly_uri(&path, false) {
+        Ok(conn) => conn
+            .query_row("SELECT count(*) FROM sqlite_master", [], |_| Ok(()))
+            .is_ok(),
+        Err(_) => false,
+    };
+    // The public open_readonly must still succeed via the immutable fallback.
+    let opened = SqliteStore::open_readonly(&path);
+
+    // Restore permissions before asserting so tempdir cleanup succeeds.
+    std::fs::set_permissions(dir.path(), original).unwrap();
+
+    assert!(
+        !live_reads,
+        "sandbox setup must make the live mode=ro path unusable, else the fallback isn't tested"
+    );
+    let ro = opened.expect("read-only open must fall back to immutable on a chmod -w dir");
+    let got = ro
+        .get(&seeded.id)
+        .unwrap()
+        .expect("memory must be readable");
+    assert_eq!(got.topic, "project:icm");
+}
+
+#[test]
+fn read_only_recall_path_skips_access_bookkeeping() {
+    let dir = tempfile::tempdir().unwrap();
+    let path = dir.path().join("seeded.db");
+    let seeded = seed_writable_db(&path);
+
+    let ro = SqliteStore::open_readonly(&path).unwrap();
+    // The exact methods recall depends on:
+    ro.maybe_auto_decay().unwrap();
+    ro.update_access(&seeded.id).unwrap();
+    ro.batch_update_access(&[&seeded.id]).unwrap();
+
+    // Re-open writable to confirm nothing actually changed.
+    let rw = SqliteStore::new(&path).unwrap();
+    let after = rw.get(&seeded.id).unwrap().unwrap();
+    assert_eq!(
+        after.access_count, seeded.access_count,
+        "access_count must NOT have been bumped by a read-only call",
+    );
+    assert_eq!(
+        after.last_accessed, seeded.last_accessed,
+        "last_accessed must NOT have been touched by a read-only call",
+    );
+}
+
+#[test]
+fn read_only_apply_decay_returns_readonly_error() {
+    let dir = tempfile::tempdir().unwrap();
+    let path = dir.path().join("seeded.db");
+    seed_writable_db(&path);
+    let ro = SqliteStore::open_readonly(&path).unwrap();
+    let err = ro.apply_decay(0.9).unwrap_err();
+    match err {
+        IcmError::ReadOnly(op) => assert_eq!(op, "apply_decay"),
+        other => panic!("expected ReadOnly, got {other:?}"),
+    }
+}
+
+#[test]
+fn read_only_mutation_attempts_are_rejected_by_sqlite() {
+    // Defense-in-depth: even mutation methods that aren't explicitly
+    // gated must fail because the SQLite connection itself is
+    // opened RO. If this test ever passes, SQLite's RO flag has
+    // been bypassed somewhere.
+    let dir = tempfile::tempdir().unwrap();
+    let path = dir.path().join("seeded.db");
+    seed_writable_db(&path);
+    let ro = SqliteStore::open_readonly(&path).unwrap();
+    let m = make_memory("project:icm", "should not land");
+    let err = ro.store(m).unwrap_err();
+    // SQLite's own "attempt to write a readonly database" wraps into
+    // IcmError::Database — the actual variant doesn't matter, only
+    // that the write was blocked.
+    match err {
+        IcmError::Database(_) | IcmError::ReadOnly(_) => {}
+        other => panic!("expected Database or ReadOnly, got {other:?}"),
+    }
+}
+
+// === Embedding dim peek (issue #267) ===
+
+/// `read_stored_embedding_dims` must NOT trigger schema init: it is
+/// called from the CLI *before* `with_dims` precisely to avoid the
+/// destructive recreate path when running in `--no-embeddings`
+/// against a DB that was populated with a non-default dim.
+#[test]
+fn read_stored_dims_returns_none_for_missing_file() {
+    let dir = tempfile::tempdir().unwrap();
+    let path = dir.path().join("does-not-exist.db");
+    assert_eq!(
+        SqliteStore::read_stored_embedding_dims(&path).unwrap(),
+        None
+    );
+}
+
+#[test]
+fn read_stored_dims_returns_none_for_legacy_db_without_metadata() {
+    let dir = tempfile::tempdir().unwrap();
+    let path = dir.path().join("legacy.db");
+    // Plain SQLite file with no icm_metadata table — pretends to be a
+    // pre-metadata legacy DB.
+    let conn = Connection::open(&path).unwrap();
+    conn.execute("CREATE TABLE foo (id TEXT)", []).unwrap();
+    drop(conn);
+    assert_eq!(
+        SqliteStore::read_stored_embedding_dims(&path).unwrap(),
+        None
+    );
+}
+
+#[test]
+fn read_stored_dims_returns_stored_value_for_populated_db() {
+    let dir = tempfile::tempdir().unwrap();
+    let path = dir.path().join("populated.db");
+    // Build a DB at 1024 dims (representative of multilingual-e5-large).
+    let store = SqliteStore::with_dims(&path, 1024).unwrap();
+    drop(store);
+
+    assert_eq!(
+        SqliteStore::read_stored_embedding_dims(&path).unwrap(),
+        Some(1024),
+        "should return the stored dim, not the default 384",
+    );
+}
+
+/// Issue #267 regression: opening the store at the *stored* dim
+/// (the path the CLI now takes when no embedder is loaded) must
+/// leave `vec_memories` and the `embedding` blobs intact. Before
+/// the fix the CLI passed `DEFAULT_EMBEDDING_DIMS` instead and the
+/// `stored != requested` branch of `init_db_with_dims` would
+/// silently DROP `vec_memories` + NULL out every embedding.
+#[test]
+fn opening_at_stored_dims_preserves_vectors() {
+    let dir = tempfile::tempdir().unwrap();
+    let path = dir.path().join("preserve.db");
+
+    // First open: build the DB at 1024 dims and seed a memory with a
+    // matching embedding.
+    {
+        let store = SqliteStore::with_dims(&path, 1024).unwrap();
+        let mut mem = make_memory("topic-1024", "user prefers e5-large");
+        mem.embedding = Some(vec![0.5_f32; 1024]);
+        store.store(mem.clone()).unwrap();
+    }
+
+    // CLI-side resolution: peek the stored dims, then reopen at
+    // exactly that value (the fix path).
+    let stored = SqliteStore::read_stored_embedding_dims(&path)
+        .unwrap()
+        .expect("stored dim must be readable on populated DB");
+    assert_eq!(stored, 1024);
+
+    let store = SqliteStore::with_dims(&path, stored).unwrap();
+    // Vec table still exists with the original dim.
+    let dim_str: String = store
+        .conn
+        .query_row(
+            "SELECT value FROM icm_metadata WHERE key = 'embedding_dims'",
+            [],
+            |row| row.get(0),
+        )
+        .unwrap();
+    assert_eq!(dim_str, "1024");
+
+    // The seeded memory's embedding still has the original 1024
+    // floats — the destructive migration did NOT run.
+    let kept_bytes: Option<i64> = store
+        .conn
+        .query_row(
+            "SELECT length(embedding) FROM memories WHERE topic = 'topic-1024'",
+            [],
+            |row| row.get(0),
+        )
+        .unwrap();
+    assert_eq!(
+        kept_bytes,
+        Some(1024 * 4),
+        "embedding blob must NOT have been NULLed by the open path",
+    );
+}
+
+// === MemoryStore tests ===
diff --git a/crates/icm-store/src/store/tests/memoir.rs b/crates/icm-store/src/store/tests/memoir.rs
new file mode 100644
index 00000000..bb584f3a
--- /dev/null
+++ b/crates/icm-store/src/store/tests/memoir.rs
@@ -0,0 +1,407 @@
+//! Per-domain tests for the SQLite backend (`store::tests`).
+
+use super::*;
+
+#[test]
+fn test_memoir_crud() {
+    let store = test_store();
+    let m = make_memoir("my-project");
+    let id = store.create_memoir(m).unwrap();
+
+    let retrieved = store.get_memoir(&id).unwrap().unwrap();
+    assert_eq!(retrieved.name, "my-project");
+
+    let by_name = store.get_memoir_by_name("my-project").unwrap().unwrap();
+    assert_eq!(by_name.id, id);
+
+    store.delete_memoir(&id).unwrap();
+    assert!(store.get_memoir(&id).unwrap().is_none());
+}
+
+#[test]
+fn test_memoir_unique_name() {
+    let store = test_store();
+    store.create_memoir(make_memoir("dup")).unwrap();
+    let result = store.create_memoir(make_memoir("dup"));
+    assert!(result.is_err());
+}
+
+#[test]
+fn test_list_memoirs() {
+    let store = test_store();
+    store.create_memoir(make_memoir("beta")).unwrap();
+    store.create_memoir(make_memoir("alpha")).unwrap();
+
+    let list = store.list_memoirs().unwrap();
+    assert_eq!(list.len(), 2);
+    assert_eq!(list[0].name, "alpha"); // sorted by name
+    assert_eq!(list[1].name, "beta");
+}
+
+#[test]
+fn test_concept_crud() {
+    let store = test_store();
+    let m_id = store.create_memoir(make_memoir("proj")).unwrap();
+
+    let mut c = make_concept(&m_id, "event-sourcing", "Events stored in SQLite");
+    c.labels = vec![Label::new("domain", "arch"), Label::new("type", "decision")];
+    let c_id = store.add_concept(c).unwrap();
+
+    let retrieved = store.get_concept(&c_id).unwrap().unwrap();
+    assert_eq!(retrieved.name, "event-sourcing");
+    assert_eq!(retrieved.labels.len(), 2);
+
+    let by_name = store
+        .get_concept_by_name(&m_id, "event-sourcing")
+        .unwrap()
+        .unwrap();
+    assert_eq!(by_name.id, c_id);
+
+    store.delete_concept(&c_id).unwrap();
+    assert!(store.get_concept(&c_id).unwrap().is_none());
+}
+
+#[test]
+fn test_concept_unique_within_memoir() {
+    let store = test_store();
+    let m_id = store.create_memoir(make_memoir("proj")).unwrap();
+
+    store
+        .add_concept(make_concept(&m_id, "dup", "first"))
+        .unwrap();
+    let result = store.add_concept(make_concept(&m_id, "dup", "second"));
+    assert!(result.is_err());
+}
+
+#[test]
+fn test_concept_same_name_different_memoirs() {
+    let store = test_store();
+    let m1 = store.create_memoir(make_memoir("proj1")).unwrap();
+    let m2 = store.create_memoir(make_memoir("proj2")).unwrap();
+
+    store
+        .add_concept(make_concept(&m1, "sqlite", "def1"))
+        .unwrap();
+    store
+        .add_concept(make_concept(&m2, "sqlite", "def2"))
+        .unwrap();
+
+    let c1 = store.get_concept_by_name(&m1, "sqlite").unwrap().unwrap();
+    let c2 = store.get_concept_by_name(&m2, "sqlite").unwrap().unwrap();
+    assert_ne!(c1.id, c2.id);
+}
+
+#[test]
+fn test_refine_concept() {
+    let store = test_store();
+    let m_id = store.create_memoir(make_memoir("proj")).unwrap();
+    let c_id = store
+        .add_concept(make_concept(&m_id, "es", "Events v1"))
+        .unwrap();
+
+    let orig = store.get_concept(&c_id).unwrap().unwrap();
+    assert_eq!(orig.revision, 1);
+    let orig_confidence = orig.confidence;
+
+    store
+        .refine_concept(&c_id, "Events v2 with snapshots", &["mem-1".into()])
+        .unwrap();
+
+    let refined = store.get_concept(&c_id).unwrap().unwrap();
+    assert_eq!(refined.revision, 2);
+    assert_eq!(refined.definition, "Events v2 with snapshots");
+    assert!(refined.confidence > orig_confidence);
+    assert!(refined.source_memory_ids.contains(&"mem-1".into()));
+}
+
+#[test]
+fn test_concept_links() {
+    let store = test_store();
+    let m_id = store.create_memoir(make_memoir("proj")).unwrap();
+    let c1_id = store
+        .add_concept(make_concept(&m_id, "event-sourcing", "ES pattern"))
+        .unwrap();
+    let c2_id = store
+        .add_concept(make_concept(&m_id, "sqlite", "SQLite storage"))
+        .unwrap();
+
+    let link = ConceptLink::new(c1_id.clone(), c2_id.clone(), Relation::DependsOn);
+    let link_id = store.add_link(link).unwrap();
+
+    let from = store.get_links_from(&c1_id).unwrap();
+    assert_eq!(from.len(), 1);
+    assert_eq!(from[0].target_id, c2_id);
+    assert_eq!(from[0].relation, Relation::DependsOn);
+
+    let to = store.get_links_to(&c2_id).unwrap();
+    assert_eq!(to.len(), 1);
+    assert_eq!(to[0].source_id, c1_id);
+
+    store.delete_link(&link_id).unwrap();
+    assert!(store.get_links_from(&c1_id).unwrap().is_empty());
+}
+
+#[test]
+fn test_self_link_rejected() {
+    let store = test_store();
+    let m_id = store.create_memoir(make_memoir("proj")).unwrap();
+    let c_id = store
+        .add_concept(make_concept(&m_id, "concept", "def"))
+        .unwrap();
+
+    let link = ConceptLink::new(c_id.clone(), c_id, Relation::RelatedTo);
+    let result = store.add_link(link);
+    assert!(result.is_err());
+}
+
+#[test]
+fn test_transitive_cycle_rejected() {
+    // Audit M11/CYC1: A → B → C → A used to be silently accepted,
+    // corrupting BFS in `get_neighborhood`. Now the third edge
+    // (closing the cycle) is rejected with `InvalidInput`.
+    let store = test_store();
+    let m_id = store.create_memoir(make_memoir("proj")).unwrap();
+    let a = store.add_concept(make_concept(&m_id, "A", "a")).unwrap();
+    let b = store.add_concept(make_concept(&m_id, "B", "b")).unwrap();
+    let c = store.add_concept(make_concept(&m_id, "C", "c")).unwrap();
+
+    // A → B: ok
+    store
+        .add_link(ConceptLink::new(a.clone(), b.clone(), Relation::DependsOn))
+        .unwrap();
+    // B → C: ok
+    store
+        .add_link(ConceptLink::new(b.clone(), c.clone(), Relation::Refines))
+        .unwrap();
+    // C → A: would close the cycle — reject
+    let cycle_attempt = store.add_link(ConceptLink::new(c, a, Relation::RelatedTo));
+    assert!(
+        cycle_attempt.is_err(),
+        "C → A should be rejected as a cycle"
+    );
+    let err_msg = cycle_attempt.unwrap_err().to_string();
+    assert!(
+        err_msg.contains("cycle"),
+        "error message should mention cycle: {err_msg}"
+    );
+}
+
+#[test]
+fn test_dag_links_still_allowed() {
+    // Sanity: rejecting cycles must not break legitimate DAG links.
+    let store = test_store();
+    let m_id = store.create_memoir(make_memoir("proj")).unwrap();
+    let a = store.add_concept(make_concept(&m_id, "A", "a")).unwrap();
+    let b = store.add_concept(make_concept(&m_id, "B", "b")).unwrap();
+    let c = store.add_concept(make_concept(&m_id, "C", "c")).unwrap();
+
+    // A → B, A → C, B → C — three edges in a DAG, all should pass.
+    store
+        .add_link(ConceptLink::new(a.clone(), b.clone(), Relation::DependsOn))
+        .unwrap();
+    store
+        .add_link(ConceptLink::new(a, c.clone(), Relation::DependsOn))
+        .unwrap();
+    store
+        .add_link(ConceptLink::new(b, c, Relation::Refines))
+        .unwrap();
+}
+
+#[test]
+fn test_get_neighbors() {
+    let store = test_store();
+    let m_id = store.create_memoir(make_memoir("proj")).unwrap();
+    let c1 = store
+        .add_concept(make_concept(&m_id, "a", "node a"))
+        .unwrap();
+    let c2 = store
+        .add_concept(make_concept(&m_id, "b", "node b"))
+        .unwrap();
+    let c3 = store
+        .add_concept(make_concept(&m_id, "c", "node c"))
+        .unwrap();
+
+    store
+        .add_link(ConceptLink::new(
+            c1.clone(),
+            c2.clone(),
+            Relation::DependsOn,
+        ))
+        .unwrap();
+    store
+        .add_link(ConceptLink::new(c3.clone(), c1.clone(), Relation::PartOf))
+        .unwrap();
+
+    let neighbors = store.get_neighbors(&c1, None).unwrap();
+    assert_eq!(neighbors.len(), 2);
+
+    let dep_neighbors = store.get_neighbors(&c1, Some(Relation::DependsOn)).unwrap();
+    assert_eq!(dep_neighbors.len(), 1);
+    assert_eq!(dep_neighbors[0].name, "b");
+}
+
+#[test]
+fn test_get_neighborhood_bfs() {
+    let store = test_store();
+    let m_id = store.create_memoir(make_memoir("proj")).unwrap();
+    let c1 = store
+        .add_concept(make_concept(&m_id, "a", "node a"))
+        .unwrap();
+    let c2 = store
+        .add_concept(make_concept(&m_id, "b", "node b"))
+        .unwrap();
+    let c3 = store
+        .add_concept(make_concept(&m_id, "c", "node c"))
+        .unwrap();
+    let c4 = store
+        .add_concept(make_concept(&m_id, "d", "node d"))
+        .unwrap();
+
+    // a -> b -> c -> d
+    store
+        .add_link(ConceptLink::new(
+            c1.clone(),
+            c2.clone(),
+            Relation::DependsOn,
+        ))
+        .unwrap();
+    store
+        .add_link(ConceptLink::new(
+            c2.clone(),
+            c3.clone(),
+            Relation::DependsOn,
+        ))
+        .unwrap();
+    store
+        .add_link(ConceptLink::new(c3, c4, Relation::DependsOn))
+        .unwrap();
+
+    // depth=1 should get a + b
+    let (concepts, links) = store.get_neighborhood(&c1, 1).unwrap();
+    assert_eq!(concepts.len(), 2);
+    assert!(!links.is_empty());
+
+    // depth=2 should get a + b + c
+    let (concepts, _) = store.get_neighborhood(&c1, 2).unwrap();
+    assert_eq!(concepts.len(), 3);
+
+    // depth=3 should get all 4
+    let (concepts, _) = store.get_neighborhood(&c1, 3).unwrap();
+    assert_eq!(concepts.len(), 4);
+}
+
+#[test]
+fn test_cascade_delete_memoir() {
+    let store = test_store();
+    let m_id = store.create_memoir(make_memoir("proj")).unwrap();
+    let c1 = store.add_concept(make_concept(&m_id, "a", "def")).unwrap();
+    let c2 = store.add_concept(make_concept(&m_id, "b", "def")).unwrap();
+    store
+        .add_link(ConceptLink::new(c1, c2, Relation::RelatedTo))
+        .unwrap();
+
+    store.delete_memoir(&m_id).unwrap();
+
+    // Concepts and links should be gone
+    let concepts = store.list_concepts(&m_id).unwrap();
+    assert!(concepts.is_empty());
+}
+
+#[test]
+fn test_memoir_stats() {
+    let store = test_store();
+    let m_id = store.create_memoir(make_memoir("proj")).unwrap();
+
+    let mut c = make_concept(&m_id, "es", "event sourcing");
+    c.labels = vec![Label::new("domain", "arch")];
+    let c1 = store.add_concept(c).unwrap();
+
+    let mut c = make_concept(&m_id, "sqlite", "sqlite storage");
+    c.labels = vec![Label::new("domain", "arch"), Label::new("type", "tech")];
+    let c2 = store.add_concept(c).unwrap();
+
+    store
+        .add_link(ConceptLink::new(c1, c2, Relation::DependsOn))
+        .unwrap();
+
+    let stats = store.memoir_stats(&m_id).unwrap();
+    assert_eq!(stats.total_concepts, 2);
+    assert_eq!(stats.total_links, 1);
+    assert!(stats.avg_confidence > 0.0);
+    assert!(!stats.label_counts.is_empty());
+}
+
+#[test]
+fn test_search_concepts_fts() {
+    let store = test_store();
+    let m_id = store.create_memoir(make_memoir("proj")).unwrap();
+
+    store
+        .add_concept(make_concept(
+            &m_id,
+            "event-sourcing",
+            "Store domain events in append-only log",
+        ))
+        .unwrap();
+    store
+        .add_concept(make_concept(
+            &m_id,
+            "cqrs",
+            "Command Query Responsibility Segregation",
+        ))
+        .unwrap();
+
+    let results = store.search_concepts_fts(&m_id, "events", 10).unwrap();
+    assert_eq!(results.len(), 1);
+    assert_eq!(results[0].name, "event-sourcing");
+}
+
+#[test]
+fn test_search_concepts_by_label() {
+    let store = test_store();
+    let m_id = store.create_memoir(make_memoir("proj")).unwrap();
+
+    let mut c1 = make_concept(&m_id, "es", "event sourcing");
+    c1.labels = vec![Label::new("domain", "arch")];
+    store.add_concept(c1).unwrap();
+
+    let mut c2 = make_concept(&m_id, "sqlite", "storage");
+    c2.labels = vec![Label::new("domain", "tech")];
+    store.add_concept(c2).unwrap();
+
+    let results = store
+        .search_concepts_by_label(&m_id, &Label::new("domain", "arch"), 10)
+        .unwrap();
+    assert_eq!(results.len(), 1);
+    assert_eq!(results[0].name, "es");
+}
+
+/// Audit regression: the label pattern built by `search_concepts_by_label`
+/// interpolated `namespace`/`value` into a LIKE pattern unescaped, so a
+/// literal `_` in a search value acted as a SQL "any single char"
+/// wildcard instead of matching only that exact character.
+#[test]
+fn test_search_concepts_by_label_escapes_wildcards() {
+    let store = test_store();
+    let m_id = store.create_memoir(make_memoir("proj")).unwrap();
+
+    let mut c1 = make_concept(&m_id, "c1", "def1");
+    c1.labels = vec![Label::new("domain", "test")];
+    store.add_concept(c1).unwrap();
+
+    let mut c2 = make_concept(&m_id, "c2", "def2");
+    c2.labels = vec![Label::new("domain", "text")];
+    store.add_concept(c2).unwrap();
+
+    // "te_t" is not the literal value of either concept, but with an
+    // unescaped `_` it matches both "test" and "text" as a wildcard.
+    let results = store
+        .search_concepts_by_label(&m_id, &Label::new("domain", "te_t"), 10)
+        .unwrap();
+    assert!(
+        results.is_empty(),
+        "unescaped '_' wildcard matched unrelated label values: {results:?}"
+    );
+}
+
+// === Vector search tests ===
diff --git a/crates/icm-store/src/store/tests/memory.rs b/crates/icm-store/src/store/tests/memory.rs
new file mode 100644
index 00000000..bd24d6c8
--- /dev/null
+++ b/crates/icm-store/src/store/tests/memory.rs
@@ -0,0 +1,663 @@
+//! Per-domain tests for the SQLite backend (`store::tests`).
+
+use super::*;
+
+#[test]
+fn test_store_and_get() {
+    let store = test_store();
+    let mem = make_memory("test", "hello world");
+    let id = mem.id.clone();
+
+    store.store(mem).unwrap();
+    let retrieved = store.get(&id).unwrap().unwrap();
+    assert_eq!(retrieved.summary, "hello world");
+    assert_eq!(retrieved.topic, "test");
+}
+
+#[test]
+fn test_get_not_found() {
+    let store = test_store();
+    let result = store.get("nonexistent").unwrap();
+    assert!(result.is_none());
+}
+
+#[test]
+fn test_update() {
+    let store = test_store();
+    let mut mem = make_memory("test", "original");
+    let id = mem.id.clone();
+    store.store(mem.clone()).unwrap();
+
+    mem.summary = "updated".into();
+    store.update(&mem).unwrap();
+
+    let retrieved = store.get(&id).unwrap().unwrap();
+    assert_eq!(retrieved.summary, "updated");
+}
+
+#[test]
+fn test_delete() {
+    let store = test_store();
+    let mem = make_memory("test", "to delete");
+    let id = mem.id.clone();
+    store.store(mem).unwrap();
+
+    store.delete(&id).unwrap();
+    assert!(store.get(&id).unwrap().is_none());
+}
+
+#[test]
+fn test_delete_not_found() {
+    let store = test_store();
+    let result = store.delete("nonexistent");
+    assert!(matches!(result, Err(IcmError::NotFound(_))));
+}
+
+/// Manual-testing finding: deleting a memory left it as a dangling
+/// entry in every other memory's `related_ids` (auto-link
+/// back-references) forever. `expand_with_neighbors` tolerates the
+/// miss silently, but each stale id still spends a slot out of the
+/// caller's `max_neighbors` budget instead of surfacing a real, live
+/// neighbor, and any external consumer of the JSON export sees a
+/// reference to nothing.
+#[test]
+fn test_delete_cleans_up_dangling_related_ids() {
+    let store = test_store();
+
+    let mut a = make_memory("t", "memory a");
+    let mut b = make_memory("t", "memory b");
+    let mut c = make_memory("t", "memory c");
+    let a_id = store.store(a.clone()).unwrap();
+    let b_id = store.store(b.clone()).unwrap();
+    let c_id = store.store(c.clone()).unwrap();
+
+    a.id = a_id.clone();
+    a.related_ids = vec![b_id.clone(), c_id.clone()];
+    store.update(&a).unwrap();
+    b.id = b_id.clone();
+    b.related_ids = vec![a_id.clone(), c_id.clone()];
+    store.update(&b).unwrap();
+    c.id = c_id.clone();
+    c.related_ids = vec![a_id.clone(), b_id.clone()];
+    store.update(&c).unwrap();
+
+    store.delete(&a_id).unwrap();
+
+    let b_after = store.get(&b_id).unwrap().unwrap();
+    assert_eq!(
+        b_after.related_ids,
+        vec![c_id.clone()],
+        "b's related_ids must no longer reference the deleted a"
+    );
+    let c_after = store.get(&c_id).unwrap().unwrap();
+    assert_eq!(
+        c_after.related_ids,
+        vec![b_id.clone()],
+        "c's related_ids must no longer reference the deleted a"
+    );
+}
+
+#[test]
+fn test_search_fts() {
+    let store = test_store();
+    store
+        .store(make_memory(
+            "rust",
+            "Rust is a systems programming language",
+        ))
+        .unwrap();
+    store
+        .store(make_memory("python", "Python is great for scripting"))
+        .unwrap();
+
+    let results = store.search_fts("rust programming", 10).unwrap();
+    assert_eq!(results.len(), 1);
+    assert_eq!(results[0].topic, "rust");
+}
+
+#[test]
+fn test_search_by_keywords() {
+    let store = test_store();
+    let mut mem = make_memory("test", "database optimization tips");
+    mem.keywords = vec!["database".into(), "optimization".into()];
+    store.store(mem).unwrap();
+
+    let results = store.search_by_keywords(&["database"], 10).unwrap();
+    assert_eq!(results.len(), 1);
+}
+
+#[test]
+fn test_list_topics() {
+    let store = test_store();
+    store.store(make_memory("alpha", "first")).unwrap();
+    store.store(make_memory("alpha", "second")).unwrap();
+    store.store(make_memory("beta", "third")).unwrap();
+
+    let topics = store.list_topics().unwrap();
+    assert_eq!(topics.len(), 2);
+    assert!(topics.contains(&("alpha".into(), 2)));
+    assert!(topics.contains(&("beta".into(), 1)));
+}
+
+#[test]
+fn test_restore_upgrades_importance_on_dedup() {
+    // Audit #185 H2: re-storing the same content with a higher
+    // importance must upgrade the existing row, not silently
+    // drop the new value.
+    let store = test_store();
+    let mut first = make_memory("topic", "long enough summary content for storage");
+    first.importance = Importance::Medium;
+    let id1 = store.store(first).unwrap();
+
+    let mut second = make_memory("topic", "long enough summary content for storage");
+    second.importance = Importance::Critical;
+    let id2 = store.store(second).unwrap();
+    assert_eq!(id1, id2, "dedup must return the same id");
+
+    let merged = store.get(&id1).unwrap().unwrap();
+    assert_eq!(
+        merged.importance,
+        Importance::Critical,
+        "re-store with higher priority must upgrade importance"
+    );
+}
+
+#[test]
+fn test_restore_does_not_downgrade_importance_on_dedup() {
+    // Sanity: a re-store with a lower priority is a no-op so an
+    // accidental write can't downgrade an already-flagged
+    // critical memory.
+    let store = test_store();
+    let mut first = make_memory("topic", "long enough summary content for storage");
+    first.importance = Importance::Critical;
+    let id1 = store.store(first).unwrap();
+
+    let mut second = make_memory("topic", "long enough summary content for storage");
+    second.importance = Importance::Low;
+    store.store(second).unwrap();
+
+    let preserved = store.get(&id1).unwrap().unwrap();
+    assert_eq!(
+        preserved.importance,
+        Importance::Critical,
+        "re-store with lower priority must not downgrade importance"
+    );
+}
+
+#[test]
+fn test_restore_unions_keywords_on_dedup() {
+    let store = test_store();
+    let mut first = make_memory("topic", "long enough summary content for storage");
+    first.keywords = vec!["alpha".into(), "beta".into()];
+    let id1 = store.store(first).unwrap();
+
+    let mut second = make_memory("topic", "long enough summary content for storage");
+    second.keywords = vec!["beta".into(), "gamma".into()];
+    store.store(second).unwrap();
+
+    let merged = store.get(&id1).unwrap().unwrap();
+    assert_eq!(
+        merged.keywords,
+        vec!["alpha".to_string(), "beta".to_string(), "gamma".to_string(),],
+        "keywords must be unioned and deduped, preserving existing order"
+    );
+}
+
+#[test]
+fn test_restore_sets_raw_excerpt_when_previously_none() {
+    let store = test_store();
+    let first = make_memory("topic", "long enough summary content for storage");
+    let id1 = store.store(first).unwrap();
+    assert!(store.get(&id1).unwrap().unwrap().raw_excerpt.is_none());
+
+    let mut second = make_memory("topic", "long enough summary content for storage");
+    second.raw_excerpt = Some("verbatim copy from source".into());
+    store.store(second).unwrap();
+
+    let merged = store.get(&id1).unwrap().unwrap();
+    assert_eq!(
+        merged.raw_excerpt.as_deref(),
+        Some("verbatim copy from source"),
+    );
+}
+
+#[test]
+fn test_restore_keeps_existing_raw_excerpt_when_new_is_none() {
+    let store = test_store();
+    let mut first = make_memory("topic", "long enough summary content for storage");
+    first.raw_excerpt = Some("important verbatim".into());
+    let id1 = store.store(first).unwrap();
+
+    let second = make_memory("topic", "long enough summary content for storage");
+    store.store(second).unwrap();
+
+    let preserved = store.get(&id1).unwrap().unwrap();
+    assert_eq!(
+        preserved.raw_excerpt.as_deref(),
+        Some("important verbatim"),
+        "re-store with None must not erase existing raw_excerpt"
+    );
+}
+
+#[test]
+fn test_restore_unchanged_metadata_is_noop() {
+    let store = test_store();
+    let mut first = make_memory("topic", "long enough summary content for storage");
+    first.importance = Importance::High;
+    first.keywords = vec!["alpha".into()];
+    let id1 = store.store(first.clone()).unwrap();
+    let original = store.get(&id1).unwrap().unwrap();
+
+    std::thread::sleep(std::time::Duration::from_millis(10));
+    store.store(first).unwrap();
+    let after = store.get(&id1).unwrap().unwrap();
+
+    assert_eq!(
+        original.updated_at, after.updated_at,
+        "no-op re-store must not bump updated_at"
+    );
+}
+
+#[test]
+fn test_apply_decay() {
+    let store = test_store();
+    store.store(make_memory("test", "decayable")).unwrap();
+
+    let mut critical = make_memory("test", "critical memory");
+    critical.importance = Importance::Critical;
+    store.store(critical).unwrap();
+
+    let affected = store.apply_decay(0.9).unwrap();
+    assert_eq!(affected, 1); // Only the non-critical one
+}
+
+/// Audit regression: `apply_decay` must never drive weight negative.
+/// Low importance (2x multiplier), zero access count, factor=0.4 (still
+/// inside the CLI's own `[0.0, 1.0)` validation) makes the raw
+/// multiplier `1.0 - (1.0-0.4)*2.0 = -0.2` — negative before the
+/// `MAX(0.0, ...)` clamp.
+#[test]
+fn test_apply_decay_never_goes_negative() {
+    let store = test_store();
+    let mut low = make_memory("t", "low importance, never accessed");
+    low.importance = Importance::Low;
+    store.store(low).unwrap();
+
+    store.apply_decay(0.4).unwrap();
+
+    let mem = store.get_by_topic("t").unwrap().into_iter().next().unwrap();
+    assert!(
+        mem.weight >= 0.0,
+        "weight must never go negative, got {}",
+        mem.weight
+    );
+}
+
+/// Audit regression: `maybe_auto_decay` used to apply a flat 0.95 step
+/// whenever >= 1 day had passed, regardless of how many days actually
+/// elapsed. Simulate a 5-day gap (by backdating `last_decay_at`
+/// directly) and assert the applied decay compounds to ~0.95^5, not a
+/// single 0.95 step.
+#[test]
+fn test_maybe_auto_decay_scales_with_elapsed_days() {
+    let store = test_store();
+    let mut mem = make_memory("t", "elapsed-days probe");
+    mem.importance = Importance::Medium;
+    store.store(mem).unwrap();
+
+    let five_days_ago = (Utc::now() - chrono::Duration::days(5)).to_rfc3339();
+    store
+        .conn
+        .execute(
+            "INSERT INTO icm_metadata (key, value) VALUES ('last_decay_at', ?1)",
+            params![five_days_ago],
+        )
+        .unwrap();
+
+    store.maybe_auto_decay().unwrap();
+
+    let after = store.get_by_topic("t").unwrap().into_iter().next().unwrap();
+    // Medium importance, access_count=0 -> multiplier = factor directly.
+    let expected_single_step = 0.95_f32;
+    let expected_five_days = 0.95_f32.powi(5);
+    assert!(
+        (after.weight - expected_five_days).abs() < 0.01,
+        "expected weight ~{expected_five_days} (0.95^5) for a 5-day gap, got {}",
+        after.weight
+    );
+    assert!(
+        after.weight < expected_single_step - 0.05,
+        "a 5-day gap must decay more than a single flat 0.95 step \
+             (got {}, single-step would be {expected_single_step})",
+        after.weight
+    );
+}
+
+#[test]
+fn test_apply_decay_caps_access_count_amplification() {
+    // Audit #185 H7: the pre-fix decay formula had an uncapped
+    // `1 + access_count * 0.1` term, which let memories with 100+
+    // accesses become effectively decay-immune. Repro the gaming
+    // and assert the capped formula prevents it.
+    //
+    // After 5 decay rounds at factor=0.8:
+    // - real (access=0): naively 0.95 ^ 5 ≈ 0.77 → with importance
+    //   medium and the capped slowdown, weight should drop to
+    //   roughly 0.5×.
+    // - junk (access=100): pre-fix it stayed near 0.95 (no decay
+    //   amplification immune); post-fix it's capped at 5 accesses
+    //   so it decays at the same rate as a memory with 5 accesses.
+    // The exact ratio depends on the cap; the crucial property is
+    // that after enough decay rounds, junk's weight no longer
+    // exceeds real's weight. We assert that property directly
+    // rather than pinning specific weight numbers.
+    let store = test_store();
+
+    let mut real = make_memory("topic", "real high-importance fact");
+    real.importance = Importance::Medium;
+    let real_id = store.store(real).unwrap();
+
+    let mut junk = make_memory("topic", "junk fact accessed by gaming loop");
+    junk.importance = Importance::Medium;
+    let junk_id = store.store(junk).unwrap();
+
+    // Inflate junk's access_count to 100 (the M01 reproduction).
+    store
+        .conn
+        .execute(
+            "UPDATE memories SET access_count = 100 WHERE id = ?1",
+            params![junk_id],
+        )
+        .unwrap();
+
+    // 5 aggressive decay rounds.
+    for _ in 0..5 {
+        store.apply_decay(0.8).unwrap();
+    }
+
+    let real_after = store.get(&real_id).unwrap().unwrap();
+    let junk_after = store.get(&junk_id).unwrap().unwrap();
+
+    // Pre-fix: junk weight ≈ 0.95, real weight ≈ 0.31 → junk dominates.
+    // Post-fix: with the cap, junk decays meaningfully even at
+    // access=100. We require junk weight < real weight + a small
+    // headroom — the cap must not let a low-relevance, frequently-
+    // accessed memory overtake real same-importance memories.
+    assert!(
+        junk_after.weight < real_after.weight * 1.6,
+        "junk weight {} must not dominate real weight {} after 5 decay rounds (cap is broken)",
+        junk_after.weight,
+        real_after.weight,
+    );
+
+    // Sanity: junk did still decay measurably (cap didn't make it
+    // permanent).
+    assert!(
+        junk_after.weight < 0.97,
+        "junk weight {} barely decayed at all (cap is too aggressive a slowdown)",
+        junk_after.weight,
+    );
+}
+
+#[test]
+fn test_prune() {
+    let store = test_store();
+    let mut low = make_memory("test", "low weight");
+    low.weight = 0.05;
+    store.store(low).unwrap();
+
+    store.store(make_memory("test", "normal weight")).unwrap();
+
+    let pruned = store.prune(0.1).unwrap();
+    assert_eq!(pruned, 1);
+    assert_eq!(store.count().unwrap(), 1);
+}
+
+#[test]
+fn test_stats() {
+    let store = test_store();
+    store.store(make_memory("a", "first")).unwrap();
+    store.store(make_memory("b", "second")).unwrap();
+
+    let stats = store.stats().unwrap();
+    assert_eq!(stats.total_memories, 2);
+    assert_eq!(stats.total_topics, 2);
+    assert!(stats.avg_weight > 0.0);
+    assert!(stats.oldest_memory.is_some());
+    assert!(stats.newest_memory.is_some());
+}
+
+#[test]
+fn test_update_access() {
+    let store = test_store();
+    let mem = make_memory("test", "access test");
+    let id = mem.id.clone();
+    store.store(mem).unwrap();
+
+    store.update_access(&id).unwrap();
+    let retrieved = store.get(&id).unwrap().unwrap();
+    assert_eq!(retrieved.access_count, 1);
+}
+
+#[test]
+fn test_consolidate_topic() {
+    let store = test_store();
+    store.store(make_memory("topic-a", "entry 1")).unwrap();
+    store.store(make_memory("topic-a", "entry 2")).unwrap();
+    store.store(make_memory("topic-b", "other")).unwrap();
+
+    let consolidated = make_memory("topic-a", "consolidated summary");
+    store.consolidate_topic("topic-a", consolidated).unwrap();
+
+    let memories = store.get_by_topic("topic-a").unwrap();
+    assert_eq!(memories.len(), 1);
+    assert_eq!(memories[0].summary, "consolidated summary");
+
+    // topic-b should be untouched
+    assert_eq!(store.get_by_topic("topic-b").unwrap().len(), 1);
+}
+
+/// Audit regression: consolidation must honor the "critical = never
+/// forget" contract that `apply_decay` and `prune` already respect.
+#[test]
+fn consolidate_topic_preserves_critical_memories() {
+    let store = test_store();
+    store.store(make_memory("t", "expendable 1")).unwrap();
+    store.store(make_memory("t", "expendable 2")).unwrap();
+    store
+        .store(Memory::new(
+            "t".into(),
+            "never forget this".into(),
+            Importance::Critical,
+        ))
+        .unwrap();
+
+    store
+        .consolidate_topic("t", make_memory("t", "rollup"))
+        .unwrap();
+
+    let after = store.get_by_topic("t").unwrap();
+    let summaries: Vec<&str> = after.iter().map(|m| m.summary.as_str()).collect();
+    assert_eq!(after.len(), 2, "critical + consolidated must both survive");
+    assert!(summaries.contains(&"never forget this"));
+    assert!(summaries.contains(&"rollup"));
+    assert!(!summaries.contains(&"expendable 1"));
+}
+
+/// Manual-testing finding: consolidate_topic bulk-deletes the topic's
+/// non-critical memories and does its own DELETE, entirely separate
+/// from the single-id `delete()` — so it had the same dangling
+/// related_ids bug in a second place. An external memory (in a
+/// different topic) that referenced one of the consolidated-away ids
+/// must have that reference cleaned up too.
+#[test]
+fn consolidate_topic_cleans_up_dangling_related_ids_in_other_memories() {
+    let store = test_store();
+    let a_id = store.store(make_memory("t", "memory a")).unwrap();
+    let b_id = store.store(make_memory("t", "memory b")).unwrap();
+
+    let mut external = make_memory("other-topic", "external memory");
+    external.related_ids = vec![a_id.clone(), b_id.clone()];
+    let external_id = store.store(external).unwrap();
+
+    store
+        .consolidate_topic("t", make_memory("t", "rollup"))
+        .unwrap();
+
+    let external_after = store.get(&external_id).unwrap().unwrap();
+    assert!(
+        external_after.related_ids.is_empty(),
+        "external memory must no longer reference the consolidated-away ids: {:?}",
+        external_after.related_ids
+    );
+}
+
+/// Audit regression: critical memories are exempt from consolidation, so
+/// they must not count toward the auto-consolidate threshold — otherwise
+/// a topic full of criticals would churn a fresh rollup on every store.
+#[test]
+fn auto_consolidate_ignores_critical_for_threshold() {
+    let store = test_store();
+    for i in 0..3 {
+        store
+            .store(Memory::new(
+                "t".into(),
+                format!("critical {i}"),
+                Importance::Critical,
+            ))
+            .unwrap();
+    }
+    store.store(make_memory("t", "one expendable")).unwrap();
+
+    // 4 total but only 1 consolidatable — below threshold 3.
+    assert!(!store.auto_consolidate("t", 3).unwrap());
+    assert_eq!(store.get_by_topic("t").unwrap().len(), 4);
+
+    store.store(make_memory("t", "expendable 2")).unwrap();
+    store.store(make_memory("t", "expendable 3")).unwrap();
+
+    // Now 3 consolidatable — rollup fires, criticals survive.
+    assert!(store.auto_consolidate("t", 3).unwrap());
+    let after = store.get_by_topic("t").unwrap();
+    let criticals = after
+        .iter()
+        .filter(|m| matches!(m.importance, Importance::Critical))
+        .count();
+    assert_eq!(criticals, 3, "all criticals must survive the rollup");
+    assert_eq!(after.len(), 4, "3 criticals + 1 consolidated");
+}
+
+/// Audit regression: `update()` previously bypassed all validation, so
+/// oversized or NUL-carrying payloads could enter via store-small-then-
+/// update-big.
+#[test]
+fn update_rejects_oversized_and_nul_payloads() {
+    let store = test_store();
+    let id = store.store(make_memory("t", "small")).unwrap();
+    let mut m = store.get(&id).unwrap().unwrap();
+
+    m.summary = "x".repeat(MAX_SUMMARY_BYTES + 1);
+    assert!(matches!(store.update(&m), Err(IcmError::InvalidInput(_))));
+
+    m.summary = "has a \0 NUL".into();
+    assert!(matches!(store.update(&m), Err(IcmError::InvalidInput(_))));
+
+    // The stored row is untouched by the rejected updates.
+    assert_eq!(store.get(&id).unwrap().unwrap().summary, "small");
+}
+
+/// Audit regression: the MCP consolidate path passes a caller-provided
+/// summary that previously bypassed every size check.
+#[test]
+fn consolidate_topic_validates_consolidated_summary() {
+    let store = test_store();
+    store.store(make_memory("t", "entry")).unwrap();
+
+    let oversized = make_memory("t", &"x".repeat(MAX_SUMMARY_BYTES + 1));
+    assert!(matches!(
+        store.consolidate_topic("t", oversized),
+        Err(IcmError::InvalidInput(_))
+    ));
+    // Originals untouched on rejection.
+    assert_eq!(store.get_by_topic("t").unwrap().len(), 1);
+}
+
+/// Audit regression: transcript messages had no size bound at all; they
+/// are best-effort logs, so oversized content is truncated, not lost.
+#[test]
+fn record_message_truncates_oversized_content() {
+    let store = test_store();
+    let sid = store.create_session("test-agent", None, None).unwrap();
+    let big = "é".repeat(200 * 1024); // 400 KB of two-byte chars
+    store
+        .record_message(&sid, Role::User, &big, None, None, None)
+        .unwrap();
+
+    let msgs = store.list_session_messages(&sid, 10, 0).unwrap();
+    assert_eq!(msgs.len(), 1);
+    assert!(msgs[0].content.len() <= 256 * 1024);
+    assert!(!msgs[0].content.is_empty());
+    // Truncation must respect char boundaries (no broken UTF-8).
+    assert!(msgs[0].content.chars().all(|c| c == 'é'));
+}
+
+/// Reproduces issue #44: after consolidation, recall should only return the
+/// consolidated memory — not stale fragments from the originals.
+#[test]
+fn test_consolidate_no_stale_fts_results() {
+    let store = test_store();
+
+    // Step 1: store 3 related memories on the same topic
+    store
+        .store(make_memory(
+            "errors-resolved",
+            "fix: null pointer in parser",
+        ))
+        .unwrap();
+    store
+        .store(make_memory(
+            "errors-resolved",
+            "fix: timeout in HTTP client",
+        ))
+        .unwrap();
+    store
+        .store(make_memory(
+            "errors-resolved",
+            "fix: race condition in cache",
+        ))
+        .unwrap();
+
+    // Verify FTS finds them before consolidation
+    let before = store.search_fts("fix", 10).unwrap();
+    assert_eq!(before.len(), 3);
+
+    // Step 2: consolidate
+    let consolidated = make_memory(
+        "errors-resolved",
+        "All errors resolved: parser, HTTP, cache",
+    );
+    store
+        .consolidate_topic("errors-resolved", consolidated)
+        .unwrap();
+
+    // Step 3: recall — should only return the consolidated memory
+    let after = store.search_fts("fix", 10).unwrap();
+    assert!(
+        after.len() <= 1,
+        "expected at most 1 result after consolidation, got {}",
+        after.len()
+    );
+
+    // The consolidated memory should be findable
+    let consolidated_results = store.search_fts("errors resolved parser", 10).unwrap();
+    assert_eq!(consolidated_results.len(), 1);
+    assert!(consolidated_results[0]
+        .summary
+        .contains("All errors resolved"));
+
+    // Verify topic has exactly 1 memory
+    let topic_mems = store.get_by_topic("errors-resolved").unwrap();
+    assert_eq!(topic_mems.len(), 1);
+}
+
+// === MemoirStore tests ===
diff --git a/crates/icm-store/src/store/tests/mod.rs b/crates/icm-store/src/store/tests/mod.rs
new file mode 100644
index 00000000..72359c09
--- /dev/null
+++ b/crates/icm-store/src/store/tests/mod.rs
@@ -0,0 +1,70 @@
+//! Test suite for the SQLite backend (`store::tests`).
+
+use super::*;
+use icm_core::Importance;
+
+fn test_store() -> SqliteStore {
+    SqliteStore::in_memory().unwrap()
+}
+
+fn make_memory(topic: &str, summary: &str) -> Memory {
+    Memory::new(topic.into(), summary.into(), Importance::Medium)
+}
+
+fn make_memoir(name: &str) -> Memoir {
+    Memoir::new(name.into(), format!("Description for {name}"))
+}
+
+fn make_concept(memoir_id: &str, name: &str, definition: &str) -> Concept {
+    Concept::new(memoir_id.into(), name.into(), definition.into())
+}
+
+// === Integrity check / repair (issue #313) ===
+
+fn seed_writable_db(path: &Path) -> Memory {
+    let store = SqliteStore::new(path).unwrap();
+    let mut m = make_memory("project:icm", "read-only fixture summary");
+    m.embedding = Some(vec![0.1_f32; icm_core::DEFAULT_EMBEDDING_DIMS]);
+    store.store(m.clone()).unwrap();
+    m
+}
+
+fn make_feedback(topic: &str, context: &str, predicted: &str, corrected: &str) -> Feedback {
+    Feedback::new(
+        topic.into(),
+        context.into(),
+        predicted.into(),
+        corrected.into(),
+        None,
+        "test".into(),
+    )
+}
+
+fn insert(event: &str, duration_ms: i64, exit_code: i32) -> HookEventInsert {
+    HookEventInsert {
+        event: event.into(),
+        project: None,
+        session_id: None,
+        tool_name: None,
+        duration_ms: Some(duration_ms),
+        exit_code,
+        payload_size: None,
+        note: None,
+    }
+}
+
+use std::path::Path;
+
+mod consolidate;
+mod embeddings;
+mod facts;
+mod feedback;
+mod graph;
+mod hooks;
+mod maintenance;
+mod memoir;
+mod memory;
+mod perf;
+mod search;
+mod transcript;
+mod validation;
diff --git a/crates/icm-store/src/store/tests/perf.rs b/crates/icm-store/src/store/tests/perf.rs
new file mode 100644
index 00000000..cc7e2d0c
--- /dev/null
+++ b/crates/icm-store/src/store/tests/perf.rs
@@ -0,0 +1,673 @@
+//! Per-domain tests for the SQLite backend (`store::tests`).
+
+use super::*;
+
+#[test]
+fn test_bulk_insert_100() {
+    let store = test_store();
+    for i in 0..100 {
+        store
+            .store(make_memory("bulk", &format!("memory number {i}")))
+            .unwrap();
+    }
+    assert_eq!(store.count().unwrap(), 100);
+    let by_topic = store.get_by_topic("bulk").unwrap();
+    assert_eq!(by_topic.len(), 100);
+}
+
+#[test]
+fn test_fts_search_many_entries() {
+    let store = test_store();
+    for i in 0..50 {
+        store
+            .store(make_memory(
+                "lang",
+                &format!("programming language number {i}"),
+            ))
+            .unwrap();
+    }
+    store
+        .store(make_memory(
+            "unique",
+            "Rust is a memory-safe systems language",
+        ))
+        .unwrap();
+
+    let results = store.search_fts("memory-safe systems", 10).unwrap();
+    assert!(!results.is_empty());
+    assert_eq!(results[0].topic, "unique");
+}
+
+#[test]
+fn test_decay_bulk() {
+    let store = test_store();
+    for i in 0..50 {
+        let mut mem = make_memory("decay", &format!("entry {i}"));
+        if i % 5 == 0 {
+            mem.importance = Importance::Critical;
+        }
+        store.store(mem).unwrap();
+    }
+    // 10 critical, 40 non-critical
+    let affected = store.apply_decay(0.9).unwrap();
+    assert_eq!(affected, 40);
+}
+
+#[test]
+fn test_prune_leaves_important() {
+    let store = test_store();
+    for i in 0..20 {
+        let mut mem = make_memory("prune", &format!("entry {i}"));
+        mem.weight = if i < 10 { 0.01 } else { 0.5 };
+        store.store(mem).unwrap();
+    }
+    let pruned = store.prune(0.1).unwrap();
+    assert_eq!(pruned, 10);
+    assert_eq!(store.count().unwrap(), 10);
+}
+
+#[test]
+fn test_many_topics_listing() {
+    let store = test_store();
+    for i in 0..30 {
+        store
+            .store(make_memory(&format!("topic-{i}"), &format!("content {i}")))
+            .unwrap();
+    }
+    let topics = store.list_topics().unwrap();
+    assert_eq!(topics.len(), 30);
+}
+
+#[test]
+fn test_consolidate_large_topic() {
+    let store = test_store();
+    for i in 0..25 {
+        store
+            .store(make_memory("big-topic", &format!("detail {i}")))
+            .unwrap();
+    }
+    let consolidated = make_memory("big-topic", "consolidated summary of 25 entries");
+    store.consolidate_topic("big-topic", consolidated).unwrap();
+    let remaining = store.get_by_topic("big-topic").unwrap();
+    assert_eq!(remaining.len(), 1);
+    assert!(remaining[0].summary.contains("consolidated"));
+}
+
+#[test]
+fn test_get_by_topic_returns_sorted_by_weight() {
+    let store = test_store();
+    let mut low = make_memory("ux", "low weight");
+    low.weight = 0.3;
+    store.store(low).unwrap();
+
+    let mut high = make_memory("ux", "high weight");
+    high.weight = 0.9;
+    store.store(high).unwrap();
+
+    let results = store.get_by_topic("ux").unwrap();
+    assert_eq!(results.len(), 2);
+    assert!(results[0].weight >= results[1].weight);
+}
+
+#[test]
+fn test_update_access_increments_correctly() {
+    let store = test_store();
+    let mem = make_memory("ux", "access counter");
+    let id = mem.id.clone();
+    store.store(mem).unwrap();
+
+    for _ in 0..5 {
+        store.update_access(&id).unwrap();
+    }
+    let retrieved = store.get(&id).unwrap().unwrap();
+    assert_eq!(retrieved.access_count, 5);
+}
+
+#[test]
+fn test_stats_on_empty_store() {
+    let store = test_store();
+    let stats = store.stats().unwrap();
+    assert_eq!(stats.total_memories, 0);
+    assert_eq!(stats.total_topics, 0);
+    assert_eq!(stats.avg_weight, 0.0);
+    assert!(stats.oldest_memory.is_none());
+    assert!(stats.newest_memory.is_none());
+}
+
+#[test]
+fn test_double_delete_returns_not_found() {
+    let store = test_store();
+    let mem = make_memory("ux", "delete twice");
+    let id = mem.id.clone();
+    store.store(mem).unwrap();
+
+    store.delete(&id).unwrap();
+    let result = store.delete(&id);
+    assert!(matches!(result, Err(IcmError::NotFound(_))));
+}
+
+#[test]
+fn test_update_syncs_embedding() {
+    let store = test_store();
+    let mut mem = make_memory("test", "before update");
+    let id = mem.id.clone();
+    store.store(mem.clone()).unwrap();
+
+    // Initially no embedding
+    assert!(store.get(&id).unwrap().unwrap().embedding.is_none());
+
+    // Update with embedding
+    mem.embedding = Some(vec![0.3; 384]);
+    store.update(&mem).unwrap();
+
+    let retrieved = store.get(&id).unwrap().unwrap();
+    assert!(retrieved.embedding.is_some());
+
+    // Should be findable via vector search
+    let results = store.search_by_embedding(&vec![0.3; 384], 5).unwrap();
+    assert_eq!(results.len(), 1);
+    assert_eq!(results[0].0.id, id);
+}
+
+#[test]
+fn perf_store_1000() {
+    let store = test_store();
+    let start = std::time::Instant::now();
+    for i in 0..1000 {
+        store
+            .store(make_memory("perf", &format!("memory number {i}")))
+            .unwrap();
+    }
+    let elapsed = start.elapsed();
+    assert!(
+        elapsed.as_millis() < 2000,
+        "1000 stores took {}ms (max 2000ms)",
+        elapsed.as_millis()
+    );
+}
+
+#[test]
+fn perf_store_with_embeddings_1000() {
+    let store = test_store();
+    let start = std::time::Instant::now();
+    for i in 0..1000 {
+        let mut mem = make_memory("perf", &format!("embedded memory {i}"));
+        mem.embedding = Some(vec![0.1; 384]);
+        store.store(mem).unwrap();
+    }
+    let elapsed = start.elapsed();
+    assert!(
+        elapsed.as_millis() < 3000,
+        "1000 stores+embedding took {}ms (max 3000ms)",
+        elapsed.as_millis()
+    );
+}
+
+#[test]
+fn perf_fts_search_100() {
+    let store = test_store();
+    for i in 0..500 {
+        store
+            .store(make_memory(
+                "lang",
+                &format!("programming language {i} with features"),
+            ))
+            .unwrap();
+    }
+    let start = std::time::Instant::now();
+    for _ in 0..100 {
+        store
+            .search_fts("programming language features", 10)
+            .unwrap();
+    }
+    let elapsed = start.elapsed();
+    assert!(
+        elapsed.as_millis() < 1000,
+        "100 FTS searches took {}ms (max 1000ms)",
+        elapsed.as_millis()
+    );
+}
+
+#[test]
+fn perf_vector_search_100() {
+    let store = test_store();
+    for i in 0..500 {
+        let mut mem = make_memory("vec", &format!("vector memory {i}"));
+        let mut emb = vec![0.0; 384];
+        emb[i % 384] = 1.0;
+        mem.embedding = Some(emb);
+        store.store(mem).unwrap();
+    }
+    let query = vec![0.5; 384];
+    let start = std::time::Instant::now();
+    for _ in 0..100 {
+        store.search_by_embedding(&query, 10).unwrap();
+    }
+    let elapsed = start.elapsed();
+    assert!(
+        elapsed.as_millis() < 5000,
+        "100 vector searches took {}ms (max 5000ms)",
+        elapsed.as_millis()
+    );
+}
+
+#[test]
+fn perf_hybrid_search_100() {
+    let store = test_store();
+    for i in 0..500 {
+        let mut mem = make_memory("hybrid", &format!("hybrid searchable memory {i}"));
+        mem.embedding = Some(vec![0.1; 384]);
+        store.store(mem).unwrap();
+    }
+    let query_emb = vec![0.1; 384];
+    let start = std::time::Instant::now();
+    for _ in 0..100 {
+        store
+            .search_hybrid("hybrid searchable", &query_emb, 10)
+            .unwrap();
+    }
+    let elapsed = start.elapsed();
+    assert!(
+        elapsed.as_millis() < 10000,
+        "100 hybrid searches took {}ms (max 10000ms)",
+        elapsed.as_millis()
+    );
+}
+
+#[test]
+fn perf_decay_1000() {
+    let store = test_store();
+    for i in 0..1000 {
+        store
+            .store(make_memory("decay", &format!("decayable {i}")))
+            .unwrap();
+    }
+    let start = std::time::Instant::now();
+    store.apply_decay(0.95).unwrap();
+    let elapsed = start.elapsed();
+    assert!(
+        elapsed.as_millis() < 500,
+        "decay on 1000 memories took {}ms (max 500ms)",
+        elapsed.as_millis()
+    );
+}
+
+#[test]
+fn perf_get_by_id_1000() {
+    let store = test_store();
+    let mut ids = Vec::new();
+    for i in 0..1000 {
+        let mem = make_memory("get", &format!("lookup {i}"));
+        let id = mem.id.clone();
+        store.store(mem).unwrap();
+        ids.push(id);
+    }
+    let start = std::time::Instant::now();
+    for id in &ids {
+        store.get(id).unwrap();
+    }
+    let elapsed = start.elapsed();
+    assert!(
+        elapsed.as_millis() < 1000,
+        "1000 gets took {}ms (max 1000ms)",
+        elapsed.as_millis()
+    );
+}
+
+/// Measure cache-hot vs cache-cold `get()` cost.
+///
+/// Run with `cargo test -p icm-store -- --ignored --nocapture
+/// bench_cache_hit_vs_miss`. Informational only — no assertion.
+#[test]
+#[ignore]
+fn bench_cache_hit_vs_miss() {
+    let store = test_store();
+    let mut ids: Vec<String> = Vec::new();
+    for i in 0..50 {
+        let mem = make_memory("bench", &format!("memory {i}"));
+        ids.push(mem.id.clone());
+        store.store(mem).unwrap();
+    }
+
+    // Cold: clear cache, read each id once. Mix of cache-fill + DB hit.
+    store.cache_clear();
+    let cold = std::time::Instant::now();
+    for id in &ids {
+        store.get(id).unwrap();
+    }
+    let cold_elapsed = cold.elapsed();
+
+    // Warm: cache already populated by the cold pass; 1000 iterations
+    // of the same id set are all cache hits.
+    let warm = std::time::Instant::now();
+    for _ in 0..1000 {
+        for id in &ids {
+            store.get(id).unwrap();
+        }
+    }
+    let warm_elapsed = warm.elapsed();
+    let warm_per_get_ns = warm_elapsed.as_nanos() / (1000 * ids.len() as u128);
+    let cold_per_get_ns = cold_elapsed.as_nanos() / ids.len() as u128;
+
+    eprintln!("=== bench_cache_hit_vs_miss ===");
+    eprintln!("  cold (50 fills,   first read each): {cold_per_get_ns} ns/get");
+    eprintln!("  warm (50000 hits, all cache reads): {warm_per_get_ns} ns/get");
+    if warm_per_get_ns > 0 {
+        eprintln!(
+            "  speedup on hot reads: {:.1}x",
+            cold_per_get_ns as f64 / warm_per_get_ns as f64
+        );
+    }
+}
+
+/// Measure batched `get_many` vs per-id `get` round-trips.
+///
+/// Run with `cargo test -p icm-store -- --ignored --nocapture
+/// bench_get_many_vs_n_plus_one`. Informational only.
+#[test]
+#[ignore]
+fn bench_get_many_vs_n_plus_one() {
+    let store = test_store();
+    let mut ids: Vec<String> = Vec::new();
+    for i in 0..50 {
+        let mem = make_memory("bench", &format!("entry {i}"));
+        ids.push(mem.id.clone());
+        store.store(mem).unwrap();
+    }
+    let id_refs: Vec<&str> = ids.iter().map(|s| s.as_str()).collect();
+
+    // Cold batched fetch.
+    store.cache_clear();
+    let t = std::time::Instant::now();
+    let got = store.get_many(&id_refs).unwrap();
+    let batch_elapsed = t.elapsed();
+    assert_eq!(got.len(), 50);
+
+    // Cold N+1 fetch.
+    store.cache_clear();
+    let t = std::time::Instant::now();
+    for id in &id_refs {
+        store.get(id).unwrap();
+    }
+    let n_plus_one_elapsed = t.elapsed();
+
+    eprintln!("=== bench_get_many_vs_n_plus_one (50 ids) ===");
+    eprintln!("  batched get_many: {} µs", batch_elapsed.as_micros());
+    eprintln!("  N+1 individual:   {} µs", n_plus_one_elapsed.as_micros());
+    if batch_elapsed.as_micros() > 0 {
+        eprintln!(
+            "  speedup: {:.1}x",
+            n_plus_one_elapsed.as_micros() as f64 / batch_elapsed.as_micros() as f64
+        );
+    }
+}
+
+// === Additional performance tests ===
+
+#[test]
+fn perf_search_fts_latency_with_1000_entries() {
+    let store = test_store();
+    for i in 0..1000 {
+        store
+                .store(make_memory(
+                    &format!("topic-{}", i % 50),
+                    &format!("detailed description about system component {i} with features and architecture"),
+                ))
+                .unwrap();
+    }
+    let start = std::time::Instant::now();
+    for _ in 0..50 {
+        let results = store
+            .search_fts("system component architecture", 10)
+            .unwrap();
+        assert!(!results.is_empty());
+    }
+    let elapsed = start.elapsed();
+    assert!(
+        elapsed.as_millis() < 2000,
+        "50 FTS searches over 1000 entries took {}ms (max 2000ms)",
+        elapsed.as_millis()
+    );
+}
+
+#[test]
+fn perf_sequential_store_operations_rapid() {
+    let store = test_store();
+    let start = std::time::Instant::now();
+    // Simulate concurrent-like rapid sequential operations mixing stores, gets, searches
+    for i in 0..500 {
+        let mem = make_memory("rapid", &format!("rapid entry {i}"));
+        let id = mem.id.clone();
+        store.store(mem).unwrap();
+        // Interleave reads
+        if i % 5 == 0 {
+            store.get(&id).unwrap();
+        }
+        // Interleave searches
+        if i % 20 == 0 {
+            store.search_fts("rapid entry", 5).unwrap();
+        }
+    }
+    let elapsed = start.elapsed();
+    assert!(
+        elapsed.as_millis() < 3000,
+        "500 mixed store/get/search ops took {}ms (max 3000ms)",
+        elapsed.as_millis()
+    );
+    assert_eq!(store.count().unwrap(), 500);
+}
+
+#[test]
+fn perf_memoir_creation_and_concept_linking() {
+    let store = test_store();
+    let start = std::time::Instant::now();
+
+    // Create 10 memoirs, each with 10 concepts and links between them
+    for m in 0..10 {
+        let m_id = store
+            .create_memoir(make_memoir(&format!("perf-memoir-{m}")))
+            .unwrap();
+        let mut concept_ids = Vec::new();
+        for c in 0..10 {
+            let c_id = store
+                .add_concept(make_concept(
+                    &m_id,
+                    &format!("concept-{m}-{c}"),
+                    &format!("Definition for concept {c} in memoir {m}"),
+                ))
+                .unwrap();
+            concept_ids.push(c_id);
+        }
+        // Link each concept to the next one (chain)
+        for w in concept_ids.windows(2) {
+            store
+                .add_link(ConceptLink::new(
+                    w[0].clone(),
+                    w[1].clone(),
+                    Relation::DependsOn,
+                ))
+                .unwrap();
+        }
+    }
+    let elapsed = start.elapsed();
+    assert!(
+        elapsed.as_millis() < 3000,
+        "10 memoirs x 10 concepts + links took {}ms (max 3000ms)",
+        elapsed.as_millis()
+    );
+
+    // Verify structure
+    let memoirs = store.list_memoirs().unwrap();
+    assert_eq!(memoirs.len(), 10);
+}
+
+#[test]
+fn perf_neighborhood_bfs_large_graph() {
+    let store = test_store();
+    let m_id = store.create_memoir(make_memoir("large-graph")).unwrap();
+
+    // Create a large graph: 50 concepts in a chain
+    let mut concept_ids = Vec::new();
+    for i in 0..50 {
+        let c_id = store
+            .add_concept(make_concept(
+                &m_id,
+                &format!("node-{i}"),
+                &format!("Graph node number {i}"),
+            ))
+            .unwrap();
+        concept_ids.push(c_id);
+    }
+    // Chain: 0->1->2->...->49
+    for w in concept_ids.windows(2) {
+        store
+            .add_link(ConceptLink::new(
+                w[0].clone(),
+                w[1].clone(),
+                Relation::DependsOn,
+            ))
+            .unwrap();
+    }
+    // Add some cross-links for complexity
+    for i in (0..50).step_by(5) {
+        if i + 10 < 50 {
+            store
+                .add_link(ConceptLink::new(
+                    concept_ids[i].clone(),
+                    concept_ids[i + 10].clone(),
+                    Relation::RelatedTo,
+                ))
+                .unwrap();
+        }
+    }
+
+    let start = std::time::Instant::now();
+    // BFS traversal at various depths
+    for depth in 1..=5 {
+        let (concepts, links) = store.get_neighborhood(&concept_ids[0], depth).unwrap();
+        assert!(!concepts.is_empty());
+        assert!(!links.is_empty());
+    }
+    let elapsed = start.elapsed();
+    assert!(
+        elapsed.as_millis() < 2000,
+        "BFS traversals (depth 1-5) on 50-node graph took {}ms (max 2000ms)",
+        elapsed.as_millis()
+    );
+}
+
+#[test]
+fn perf_embedding_storage_batch() {
+    let store = test_store();
+    let start = std::time::Instant::now();
+    for i in 0..500 {
+        let mut mem = make_memory("embed-perf", &format!("embedding batch entry {i}"));
+        let mut emb = vec![0.0f32; 384];
+        // Vary embeddings so they're not all identical
+        emb[i % 384] = 1.0;
+        emb[(i * 7) % 384] = 0.5;
+        mem.embedding = Some(emb);
+        store.store(mem).unwrap();
+    }
+    let elapsed = start.elapsed();
+    assert!(
+        elapsed.as_millis() < 3000,
+        "500 stores with embeddings took {}ms (max 3000ms)",
+        elapsed.as_millis()
+    );
+
+    // Now search
+    let query = vec![0.5f32; 384];
+    let search_start = std::time::Instant::now();
+    for _ in 0..50 {
+        let results = store.search_by_embedding(&query, 10).unwrap();
+        assert!(!results.is_empty());
+    }
+    let search_elapsed = search_start.elapsed();
+    assert!(
+        search_elapsed.as_millis() < 3000,
+        "50 vector searches over 500 entries took {}ms (max 3000ms)",
+        search_elapsed.as_millis()
+    );
+}
+
+#[test]
+fn perf_keyword_search_with_many_entries() {
+    let store = test_store();
+    for i in 0..1000 {
+        let mut mem = make_memory(
+            &format!("kw-topic-{}", i % 20),
+            &format!("keyword searchable entry number {i}"),
+        );
+        mem.keywords = vec![
+            format!("keyword-{}", i % 10),
+            format!("category-{}", i % 5),
+            "common".into(),
+        ];
+        store.store(mem).unwrap();
+    }
+
+    let start = std::time::Instant::now();
+    for i in 0..50 {
+        let results = store
+            .search_by_keywords(&[&format!("keyword-{}", i % 10)], 10)
+            .unwrap();
+        assert!(!results.is_empty());
+    }
+    let elapsed = start.elapsed();
+    assert!(
+        elapsed.as_millis() < 2000,
+        "50 keyword searches over 1000 entries took {}ms (max 2000ms)",
+        elapsed.as_millis()
+    );
+}
+
+#[test]
+fn perf_consolidate_large_topic_timing() {
+    let store = test_store();
+    for i in 0..100 {
+        store
+            .store(make_memory(
+                "consolidate-perf",
+                &format!("detail entry {i} with various information"),
+            ))
+            .unwrap();
+    }
+    let start = std::time::Instant::now();
+    let consolidated = make_memory("consolidate-perf", "All 100 entries consolidated");
+    store
+        .consolidate_topic("consolidate-perf", consolidated)
+        .unwrap();
+    let elapsed = start.elapsed();
+    assert!(
+        elapsed.as_millis() < 1000,
+        "Consolidating 100 entries took {}ms (max 1000ms)",
+        elapsed.as_millis()
+    );
+    assert_eq!(store.get_by_topic("consolidate-perf").unwrap().len(), 1);
+}
+
+#[test]
+fn perf_list_topics_many() {
+    let store = test_store();
+    // Create 200 distinct topics
+    for i in 0..200 {
+        store
+            .store(make_memory(
+                &format!("distinct-topic-{i}"),
+                &format!("content for topic {i}"),
+            ))
+            .unwrap();
+    }
+    let start = std::time::Instant::now();
+    for _ in 0..50 {
+        let topics = store.list_topics().unwrap();
+        assert_eq!(topics.len(), 200);
+    }
+    let elapsed = start.elapsed();
+    assert!(
+        elapsed.as_millis() < 1000,
+        "50 list_topics calls over 200 topics took {}ms (max 1000ms)",
+        elapsed.as_millis()
+    );
+}
diff --git a/crates/icm-store/src/store/tests/search.rs b/crates/icm-store/src/store/tests/search.rs
new file mode 100644
index 00000000..ef4789aa
--- /dev/null
+++ b/crates/icm-store/src/store/tests/search.rs
@@ -0,0 +1,177 @@
+//! Per-domain tests for the SQLite backend (`store::tests`).
+
+use super::*;
+
+#[test]
+fn test_sanitize_fts_empty() {
+    assert_eq!(sanitize_fts_query(""), "");
+    assert_eq!(sanitize_fts_query("   "), "");
+}
+
+#[test]
+fn test_sanitize_fts_special_chars() {
+    // All FTS5 operators should be stripped
+    assert_eq!(sanitize_fts_query("hello-world"), "\"hello\" \"world\"");
+    assert_eq!(sanitize_fts_query("foo*bar"), "\"foo\" \"bar\"");
+    assert_eq!(sanitize_fts_query("a:b"), "\"a\" \"b\"");
+    assert_eq!(sanitize_fts_query("(test)"), "\"test\"");
+    assert_eq!(sanitize_fts_query("x^y+z~w"), "\"x\" \"y\" \"z\" \"w\"");
+}
+
+#[test]
+fn test_sanitize_fts_quotes_stripped() {
+    // Embedded quotes must be removed before wrapping in quotes
+    assert_eq!(sanitize_fts_query("say \"hello\""), "\"say\" \"hello\"");
+}
+
+#[test]
+fn test_sanitize_fts_unicode() {
+    assert_eq!(sanitize_fts_query("café résumé"), "\"café\" \"résumé\"");
+    assert_eq!(sanitize_fts_query("日本語テスト"), "\"日本語テスト\"");
+}
+
+#[test]
+fn test_sanitize_fts_long_input_truncated() {
+    let long = "a ".repeat(6000); // 12000 chars
+    let result = sanitize_fts_query(&long);
+    // Input is truncated to 10_000 chars, then tokens are capped at 100
+    let token_count = result.split_whitespace().count();
+    assert!(token_count <= 100);
+}
+
+#[test]
+fn test_sanitize_fts_many_tokens_capped() {
+    // 200 tokens should be capped to 100
+    let many_tokens: String = (0..200)
+        .map(|i| format!("word{i}"))
+        .collect::<Vec<_>>()
+        .join(" ");
+    let result = sanitize_fts_query(&many_tokens);
+    let token_count = result.split_whitespace().count();
+    assert_eq!(token_count, 100);
+}
+
+// === search limit cap tests ===
+
+#[test]
+fn test_search_fts_limit_capped() {
+    let store = test_store();
+    // Store a memory so search has something to find
+    store.store(make_memory("test", "hello world")).unwrap();
+
+    // Even with a huge limit, it should not error (capped internally)
+    let results = store.search_fts("hello", 999_999).unwrap();
+    assert!(results.len() <= 100);
+}
+
+#[test]
+fn test_search_by_keywords_limit_capped() {
+    let store = test_store();
+    let mut mem = make_memory("test", "keyword search test");
+    mem.keywords = vec!["findme".into()];
+    store.store(mem).unwrap();
+
+    let results = store.search_by_keywords(&["findme"], 999_999).unwrap();
+    assert!(results.len() <= 100);
+}
+
+// === Additional MemoryStore coverage ===
+
+#[test]
+fn test_search_fts_empty_query() {
+    let store = test_store();
+    store.store(make_memory("topic", "hello world")).unwrap();
+    let results = store.search_fts("", 10).unwrap();
+    assert!(results.is_empty());
+}
+
+#[test]
+fn test_search_by_keywords_empty() {
+    let store = test_store();
+    let results = store.search_by_keywords(&[], 10).unwrap();
+    assert!(results.is_empty());
+}
+
+/// Audit regression: an unescaped `%` keyword degenerates into a
+/// match-everything LIKE pattern instead of matching literal `%`.
+#[test]
+fn test_search_by_keywords_escapes_percent_wildcard() {
+    let store = test_store();
+    // Contains the literal substring "100%" — the only row that should
+    // match a properly-escaped '100%' keyword.
+    store
+        .store(make_memory("t", "revenue grew by 100% year over year"))
+        .unwrap();
+    // Decoy: contains "100" but NOT the literal "100%". An unescaped
+    // '%' in the keyword makes the LIKE pattern `%100%%`, which SQLite
+    // collapses to `%100%` ("contains 100 anywhere") — this row would
+    // wrongly match under that bug, since it's the difference between
+    // "contains the substring 100%" and "contains 100".
+    store
+        .store(make_memory("t", "the report has exactly 100 lines total"))
+        .unwrap();
+
+    let results = store.search_by_keywords(&["100%"], 10).unwrap();
+    assert_eq!(
+        results.len(),
+        1,
+        "a literal '100%' keyword must match only rows containing that exact \
+             substring, not any row containing '100', got {} hits",
+        results.len()
+    );
+    assert!(results[0].summary.contains("100%"));
+}
+
+/// Audit regression: an unescaped `_` keyword matches any single
+/// character in that position, so "snake_case" would also match
+/// "snakeXcase" for any X.
+#[test]
+fn test_search_by_keywords_escapes_underscore_wildcard() {
+    let store = test_store();
+    store
+        .store(make_memory("t", "uses snake_case naming"))
+        .unwrap();
+    store
+        .store(make_memory(
+            "t",
+            "uses snakeXcase naming (not the real word)",
+        ))
+        .unwrap();
+
+    let results = store.search_by_keywords(&["snake_case"], 10).unwrap();
+    assert_eq!(
+        results.len(),
+        1,
+        "'_' in a keyword must be literal, not a single-char wildcard, got {} hits",
+        results.len()
+    );
+    assert!(results[0].summary.contains("snake_case"));
+}
+
+#[test]
+fn test_update_nonexistent_memory() {
+    let store = test_store();
+    let mut mem = make_memory("t", "s");
+    mem.id = "nonexistent-id".to_string();
+    let result = store.update(&mem);
+    assert!(result.is_err());
+}
+
+#[test]
+fn test_delete_nonexistent_memory() {
+    let store = test_store();
+    let result = store.delete("nonexistent-id");
+    assert!(result.is_err());
+}
+
+#[test]
+fn test_batch_update_access() {
+    let store = test_store();
+    let id1 = store.store(make_memory("t", "one")).unwrap();
+    let id2 = store.store(make_memory("t", "two")).unwrap();
+    store.batch_update_access(&[&id1, &id2]).unwrap();
+    let m1 = store.get(&id1).unwrap().unwrap();
+    let m2 = store.get(&id2).unwrap().unwrap();
+    assert_eq!(m1.access_count, 1);
+    assert_eq!(m2.access_count, 1);
+}
diff --git a/crates/icm-store/src/store/tests/transcript.rs b/crates/icm-store/src/store/tests/transcript.rs
new file mode 100644
index 00000000..255c700c
--- /dev/null
+++ b/crates/icm-store/src/store/tests/transcript.rs
@@ -0,0 +1,293 @@
+//! Per-domain tests for the SQLite backend (`store::tests`).
+
+use super::*;
+
+#[test]
+fn test_transcript_create_session_and_record() {
+    let store = test_store();
+    let sid = store
+        .create_session("claude-code", Some("proj"), None)
+        .unwrap();
+    assert!(!sid.is_empty());
+
+    let mid = store
+        .record_message(&sid, Role::User, "hello world", None, None, None)
+        .unwrap();
+    assert!(!mid.is_empty());
+
+    let msgs = store.list_session_messages(&sid, 10, 0).unwrap();
+    assert_eq!(msgs.len(), 1);
+    assert_eq!(msgs[0].content, "hello world");
+    assert_eq!(msgs[0].role, Role::User);
+}
+
+/// Issue #272 perf invariant: FTS5 search across a few thousand
+/// archived messages must stay sub-second. The bench keeps the
+/// budget loose so CI noise doesn't flake; the goal is a regression
+/// bell, not microbenchmarking.
+#[test]
+fn perf_session_archive_search_2k_messages() {
+    let store = test_store();
+    let sid = store
+        .ensure_session("perf-sess", "claude-code", Some("icm"), None)
+        .unwrap();
+    for i in 0..2_000 {
+        // Sprinkle the keyword into ~1% of messages so search
+        // returns something but doesn't degenerate to a full scan.
+        let body = if i % 100 == 0 {
+            format!("turbofish needle hit {i}")
+        } else {
+            format!("filler payload number {i}")
+        };
+        store
+            .record_message(&sid, Role::User, &body, None, None, None)
+            .unwrap();
+    }
+    let start = std::time::Instant::now();
+    let hits = store
+        .search_transcripts("turbofish", None, None, 50)
+        .unwrap();
+    let elapsed = start.elapsed();
+    assert!(
+        hits.len() >= 10,
+        "expected at least 10 hits, got {}",
+        hits.len()
+    );
+    assert!(
+        elapsed.as_millis() < 1500,
+        "search across 2k archived messages took {}ms (budget 1500ms)",
+        elapsed.as_millis(),
+    );
+}
+
+// === FactsStore tests (issue #273) ===
+
+/// Issue #272: `ensure_session` must be idempotent so repeated
+/// hook fires keyed by the same external `session_id` land under
+/// one row, not N.
+#[test]
+fn test_ensure_session_is_idempotent() {
+    let store = test_store();
+    let external_id = "claude-sess-abc-123";
+    let id1 = store
+        .ensure_session(external_id, "claude-code", Some("icm"), None)
+        .unwrap();
+    assert_eq!(id1, external_id);
+
+    // Re-call with the same id — must NOT create a new row.
+    let id2 = store
+        .ensure_session(external_id, "claude-code", Some("icm"), None)
+        .unwrap();
+    assert_eq!(id2, external_id);
+
+    let sessions = store.list_sessions(Some("icm"), 10).unwrap();
+    assert_eq!(
+        sessions.len(),
+        1,
+        "ensure_session must be idempotent, got: {sessions:?}",
+    );
+    assert_eq!(sessions[0].id, external_id);
+
+    // Recording into the same id works.
+    store
+        .record_message(external_id, Role::User, "first turn", None, None, None)
+        .unwrap();
+    store
+        .record_message(
+            external_id,
+            Role::Tool,
+            "tool out",
+            Some("bash"),
+            None,
+            None,
+        )
+        .unwrap();
+    let msgs = store.list_session_messages(external_id, 10, 0).unwrap();
+    assert_eq!(msgs.len(), 2);
+}
+
+#[test]
+fn test_transcript_record_into_missing_session_fails() {
+    let store = test_store();
+    let err = store
+        .record_message("nonexistent", Role::User, "hi", None, None, None)
+        .unwrap_err();
+    assert!(err.to_string().to_lowercase().contains("session"));
+}
+
+#[test]
+fn test_transcript_search_fts5_boolean_and_phrase() {
+    let store = test_store();
+    let sid = store
+        .create_session("cli", Some("db-debate"), None)
+        .unwrap();
+    store
+        .record_message(
+            &sid,
+            Role::Assistant,
+            "Postgres 16 supports JSONB and BRIN indexes natively.",
+            None,
+            None,
+            None,
+        )
+        .unwrap();
+    store
+        .record_message(
+            &sid,
+            Role::Assistant,
+            "MySQL lacks BRIN; its JSON type is stored differently.",
+            None,
+            None,
+            None,
+        )
+        .unwrap();
+    store
+        .record_message(&sid, Role::User, "Et SQLite ?", None, None, None)
+        .unwrap();
+
+    // Boolean OR
+    let hits = store
+        .search_transcripts("postgres OR mysql", None, None, 10)
+        .unwrap();
+    assert_eq!(hits.len(), 2);
+
+    // Exact phrase
+    let phrase_hits = store
+        .search_transcripts("\"BRIN indexes\"", None, None, 10)
+        .unwrap();
+    assert_eq!(phrase_hits.len(), 1);
+    assert!(phrase_hits[0].message.content.contains("Postgres"));
+}
+
+/// Audit regression: `search_transcripts` bound the raw query straight
+/// to `messages_fts MATCH ?1` with no handling for malformed FTS5
+/// syntax. A trailing boolean operator or an unbalanced paren threw a
+/// raw sqlite error instead of degrading gracefully to "no results" —
+/// while still preserving valid FTS5 syntax (see the OR/phrase test
+/// above), which a blanket `sanitize_fts_query` call would have broken.
+#[test]
+fn test_transcript_search_malformed_fts5_query_degrades_gracefully() {
+    let store = test_store();
+    let sid = store.create_session("cli", None, None).unwrap();
+    store
+        .record_message(&sid, Role::User, "hello world", None, None, None)
+        .unwrap();
+
+    for bad_query in ["hello AND", "(hello", "hello OR OR"] {
+        let result = store.search_transcripts(bad_query, None, None, 10);
+        assert!(
+            result.is_ok(),
+            "malformed FTS5 query {bad_query:?} must not error: {result:?}"
+        );
+        assert!(result.unwrap().is_empty());
+    }
+}
+
+#[test]
+fn test_transcript_search_scoped_by_session_and_project() {
+    let store = test_store();
+    let s1 = store.create_session("cli", Some("alpha"), None).unwrap();
+    let s2 = store.create_session("cli", Some("beta"), None).unwrap();
+    store
+        .record_message(&s1, Role::User, "alpha wants postgres", None, None, None)
+        .unwrap();
+    store
+        .record_message(&s2, Role::User, "beta wants postgres", None, None, None)
+        .unwrap();
+
+    // Global search returns both
+    let all = store
+        .search_transcripts("postgres", None, None, 10)
+        .unwrap();
+    assert_eq!(all.len(), 2);
+
+    // Session filter
+    let only_s1 = store
+        .search_transcripts("postgres", Some(&s1), None, 10)
+        .unwrap();
+    assert_eq!(only_s1.len(), 1);
+    assert_eq!(only_s1[0].message.session_id, s1);
+
+    // Project filter
+    let only_beta = store
+        .search_transcripts("postgres", None, Some("beta"), 10)
+        .unwrap();
+    assert_eq!(only_beta.len(), 1);
+    assert_eq!(only_beta[0].session.project.as_deref(), Some("beta"));
+}
+
+#[test]
+fn test_transcript_stats_breakdown() {
+    let store = test_store();
+    let s = store.create_session("claude-code", None, None).unwrap();
+    store
+        .record_message(&s, Role::User, "q", None, None, None)
+        .unwrap();
+    store
+        .record_message(&s, Role::Assistant, "a", None, None, None)
+        .unwrap();
+    store
+        .record_message(&s, Role::Tool, "{}", Some("Bash"), Some(10), None)
+        .unwrap();
+
+    let stats = store.transcript_stats().unwrap();
+    assert_eq!(stats.total_sessions, 1);
+    assert_eq!(stats.total_messages, 3);
+    assert!(stats.total_bytes > 0);
+    assert_eq!(stats.by_role.len(), 3);
+    assert!(stats.by_agent.iter().any(|(a, _)| a == "claude-code"));
+    assert_eq!(stats.top_sessions.len(), 1);
+    assert_eq!(stats.top_sessions[0].1, 3);
+}
+
+#[test]
+fn test_transcript_forget_cascade_deletes_messages() {
+    let store = test_store();
+    let s = store.create_session("cli", None, None).unwrap();
+    for i in 0..5 {
+        store
+            .record_message(&s, Role::User, &format!("msg {i}"), None, None, None)
+            .unwrap();
+    }
+
+    store.forget_session(&s).unwrap();
+
+    assert!(store.get_session(&s).unwrap().is_none());
+    let msgs = store.list_session_messages(&s, 100, 0).unwrap();
+    assert!(msgs.is_empty());
+}
+
+#[test]
+fn test_transcript_list_sessions_sorted_by_updated() {
+    let store = test_store();
+    let a = store.create_session("cli", Some("p"), None).unwrap();
+    let b = store.create_session("cli", Some("p"), None).unwrap();
+    // Bump `a` by recording a message (updates its updated_at)
+    store
+        .record_message(&a, Role::User, "bump", None, None, None)
+        .unwrap();
+
+    let list = store.list_sessions(Some("p"), 10).unwrap();
+    assert_eq!(list.len(), 2);
+    assert_eq!(list[0].id, a); // most recently updated first
+    assert_eq!(list[1].id, b);
+}
+
+#[test]
+fn test_transcript_messages_chronological() {
+    let store = test_store();
+    let s = store.create_session("cli", None, None).unwrap();
+    let ids: Vec<_> = (0..3)
+        .map(|i| {
+            store
+                .record_message(&s, Role::User, &format!("{i}"), None, None, None)
+                .unwrap()
+        })
+        .collect();
+
+    let msgs = store.list_session_messages(&s, 10, 0).unwrap();
+    let got: Vec<_> = msgs.iter().map(|m| m.id.clone()).collect();
+    assert_eq!(got, ids);
+}
+
+// Hook telemetry
diff --git a/crates/icm-store/src/store/tests/validation.rs b/crates/icm-store/src/store/tests/validation.rs
new file mode 100644
index 00000000..bf7dc049
--- /dev/null
+++ b/crates/icm-store/src/store/tests/validation.rs
@@ -0,0 +1,253 @@
+//! Per-domain tests for the SQLite backend (`store::tests`).
+
+use super::*;
+
+#[test]
+fn test_sanitize_fts_query() {
+    // Normal words get quoted
+    assert_eq!(sanitize_fts_query("hello world"), "\"hello\" \"world\"");
+
+    // Special chars become spaces, splitting into separate tokens
+    assert_eq!(sanitize_fts_query("sqlite-vec"), "\"sqlite\" \"vec\"");
+    assert_eq!(sanitize_fts_query("foo*bar"), "\"foo\" \"bar\"");
+    assert_eq!(sanitize_fts_query("col:value"), "\"col\" \"value\"");
+
+    // Empty/whitespace returns empty
+    assert_eq!(sanitize_fts_query(""), "");
+    assert_eq!(sanitize_fts_query("  "), "");
+    assert_eq!(sanitize_fts_query("---"), "");
+
+    // Mixed content
+    assert_eq!(
+        sanitize_fts_query("no-such column:vec"),
+        "\"no\" \"such\" \"column\" \"vec\""
+    );
+}
+
+#[test]
+fn test_search_fts_special_chars() {
+    let store = test_store();
+    store
+        .store(make_memory(
+            "tools",
+            "sqlite-vec is a vector search extension",
+        ))
+        .unwrap();
+
+    // This query used to crash with "no such column: vec"
+    let results = store.search_fts("sqlite-vec", 10).unwrap();
+    assert_eq!(results.len(), 1);
+    assert_eq!(results[0].topic, "tools");
+
+    // Pure special chars should return empty, not error
+    let results = store.search_fts("---", 10).unwrap();
+    assert!(results.is_empty());
+}
+
+#[test]
+fn test_search_concepts_fts_special_chars() {
+    let store = test_store();
+    let m_id = store.create_memoir(make_memoir("proj")).unwrap();
+
+    store
+        .add_concept(make_concept(
+            &m_id,
+            "sqlite-vec",
+            "Vector search extension for SQLite",
+        ))
+        .unwrap();
+
+    // Should not crash with special chars in query
+    let results = store.search_concepts_fts(&m_id, "sqlite-vec", 10).unwrap();
+    assert_eq!(results.len(), 1);
+    assert_eq!(results[0].name, "sqlite-vec");
+
+    // Pure special chars should return empty
+    let results = store.search_concepts_fts(&m_id, "***", 10).unwrap();
+    assert!(results.is_empty());
+}
+
+#[test]
+fn test_sql_injection_in_topic() {
+    let store = test_store();
+    let mem = make_memory("'; DROP TABLE memories; --", "should be safe");
+    store.store(mem.clone()).unwrap();
+
+    let retrieved = store.get(&mem.id).unwrap().unwrap();
+    assert_eq!(retrieved.topic, "'; DROP TABLE memories; --");
+    assert_eq!(store.count().unwrap(), 1);
+    let topics = store.list_topics().unwrap();
+    assert_eq!(topics.len(), 1);
+}
+
+#[test]
+fn test_sql_injection_in_summary() {
+    let store = test_store();
+    let mem = make_memory("test", "value'); DELETE FROM memories WHERE ('1'='1");
+    store.store(mem).unwrap();
+    assert_eq!(store.count().unwrap(), 1);
+}
+
+#[test]
+fn test_sql_injection_in_fts_query() {
+    let store = test_store();
+    store
+        .store(make_memory("test", "normal content here"))
+        .unwrap();
+
+    // FTS5 injection attempts
+    let results = store.search_fts("') OR 1=1 --", 10).unwrap();
+    assert!(results.is_empty() || results.len() <= 1);
+
+    let results = store.search_fts("NEAR(a b)", 10).unwrap();
+    let _ = results;
+}
+
+#[test]
+fn test_sql_injection_in_keywords() {
+    let store = test_store();
+    let mut mem = make_memory("test", "keyword injection");
+    mem.keywords = vec!["normal".into(), "'; DROP TABLE memories; --".into()];
+    store.store(mem).unwrap();
+    assert_eq!(store.count().unwrap(), 1);
+
+    let results = store
+        .search_by_keywords(&["'; DROP TABLE memories; --"], 10)
+        .unwrap();
+    let _ = results;
+}
+
+#[test]
+fn test_null_bytes_in_summary_rejected() {
+    // Audit finding: libsql binds text via NUL-terminated C strings,
+    // so anything past the first `\0` was silently dropped — a
+    // memory written as `"before\0after"` came back as `"before"`.
+    // We now reject the write so callers know their data isn't
+    // round-tripping intact.
+    let store = test_store();
+    let mem = make_memory("test", "before\0after");
+    let err = store.store(mem).unwrap_err();
+    assert!(
+        matches!(err, IcmError::InvalidInput(ref m) if m.contains("NUL")),
+        "expected InvalidInput(NUL...) got {err:?}"
+    );
+}
+
+#[test]
+fn test_null_bytes_in_topic_rejected() {
+    let store = test_store();
+    let mem = make_memory("topic\0fake", "real summary content");
+    let err = store.store(mem).unwrap_err();
+    assert!(
+        matches!(err, IcmError::InvalidInput(ref m) if m.contains("NUL")),
+        "expected InvalidInput(NUL...) got {err:?}"
+    );
+}
+
+#[test]
+fn test_unicode_topic_with_trailing_null_rejected() {
+    // The previous permissive behaviour stored the topic
+    // `\u{1F600}\u{1F4A9}\u{0000}` and round-tripped only the
+    // pre-NUL prefix. Now we reject so callers don't think they
+    // stored what they passed.
+    let store = test_store();
+    let unicode_topic = "\u{1F600}\u{1F4A9}\u{0000}";
+    let mem = make_memory(unicode_topic, "emoji topic content here");
+    let err = store.store(mem).unwrap_err();
+    assert!(
+        matches!(err, IcmError::InvalidInput(ref m) if m.contains("NUL")),
+        "expected NUL rejection on emoji+NUL topic, got {err:?}"
+    );
+}
+
+#[test]
+fn test_unicode_emoji_topic_without_null_accepted() {
+    // Sanity: legitimate emoji topics should still work.
+    let store = test_store();
+    let mem = make_memory("\u{1F525}-decisions", "real content here please");
+    let id = store.store(mem.clone()).unwrap();
+    let retrieved = store.get(&id).unwrap().unwrap();
+    assert!(retrieved.topic.starts_with('\u{1F525}'));
+}
+
+#[test]
+fn test_summary_within_cap_accepted() {
+    let store = test_store();
+    let summary = "a".repeat(60_000);
+    let mem = make_memory("test", &summary);
+    store.store(mem.clone()).unwrap();
+    let retrieved = store.get(&mem.id).unwrap().unwrap();
+    assert_eq!(retrieved.summary.len(), 60_000);
+}
+
+#[test]
+fn test_summary_exceeding_cap_rejected() {
+    // Audit finding: a 1 MB single text block landed verbatim as a
+    // single memory's summary, blowing up DB size and embedding
+    // compute. Cap at 64 KB.
+    let store = test_store();
+    let long_summary = "a".repeat(100_000);
+    let mem = make_memory("test", &long_summary);
+    let err = store.store(mem).unwrap_err();
+    assert!(
+        matches!(err, IcmError::InvalidInput(ref m) if m.contains("summary exceeds")),
+        "expected summary-size rejection got {err:?}"
+    );
+}
+
+#[test]
+fn test_empty_topic_rejected() {
+    let store = test_store();
+    let mem = make_memory("", "real summary content here");
+    let err = store.store(mem).unwrap_err();
+    assert!(
+        matches!(err, IcmError::InvalidInput(ref m) if m.contains("topic cannot be empty")),
+        "expected empty-topic rejection got {err:?}"
+    );
+}
+
+#[test]
+fn test_whitespace_only_topic_rejected() {
+    let store = test_store();
+    let mem = make_memory("   \t  ", "real summary content here");
+    let err = store.store(mem).unwrap_err();
+    assert!(
+        matches!(err, IcmError::InvalidInput(ref m) if m.contains("topic cannot be empty")),
+        "expected empty-after-trim rejection got {err:?}"
+    );
+}
+
+#[test]
+fn test_empty_summary_rejected() {
+    let store = test_store();
+    let mem = make_memory("topic", "");
+    let err = store.store(mem).unwrap_err();
+    assert!(
+        matches!(err, IcmError::InvalidInput(ref m) if m.contains("summary cannot be empty")),
+        "expected empty-summary rejection got {err:?}"
+    );
+}
+
+#[test]
+fn test_topic_with_newline_rejected() {
+    let store = test_store();
+    let mem = make_memory("topic\nfake-topic", "real summary content here");
+    let err = store.store(mem).unwrap_err();
+    assert!(
+        matches!(err, IcmError::InvalidInput(ref m) if m.contains("newline")),
+        "expected newline rejection got {err:?}"
+    );
+}
+
+#[test]
+fn test_topic_trailing_whitespace_trimmed_on_store() {
+    // Two topics that visually look identical (`"trail "` vs
+    // `"trail"`) should land in the same bucket. We trim on the
+    // way in.
+    let store = test_store();
+    let id1 = store
+        .store(make_memory("  trail  ", "summary one content"))
+        .unwrap();
+    let mem1 = store.get(&id1).unwrap().unwrap();
+    assert_eq!(mem1.topic, "trail", "topic should be trimmed");
+}
diff --git a/crates/icm-store/src/store/transcript.rs b/crates/icm-store/src/store/transcript.rs
new file mode 100644
index 00000000..4006a97a
--- /dev/null
+++ b/crates/icm-store/src/store/transcript.rs
@@ -0,0 +1,509 @@
+//! SQLite backend — split out of the former monolithic `store.rs`.
+//!
+//! `SqliteStore` and the shared row/parse helpers live in `super`
+//! (`store/mod.rs`); each submodule here holds one trait impl (or a
+//! coherent group of inherent methods) on that type.
+
+use super::*;
+
+fn row_to_session(row: &rusqlite::Row<'_>) -> rusqlite::Result<Session> {
+    let started_at: String = row.get("started_at")?;
+    let updated_at: String = row.get("updated_at")?;
+    Ok(Session {
+        id: row.get("id")?,
+        agent: row.get("agent")?,
+        project: row.get("project")?,
+        started_at: parse_ts(&started_at),
+        updated_at: parse_ts(&updated_at),
+        metadata: row.get("metadata")?,
+    })
+}
+
+fn row_to_message(row: &rusqlite::Row<'_>) -> rusqlite::Result<Message> {
+    let role_str: String = row.get("role")?;
+    let ts: String = row.get("ts")?;
+    let role = Role::parse(&role_str).unwrap_or(Role::Tool);
+    Ok(Message {
+        id: row.get("id")?,
+        session_id: row.get("session_id")?,
+        role,
+        content: row.get("content")?,
+        tool_name: row.get("tool_name")?,
+        tokens: row.get("tokens")?,
+        ts: parse_ts(&ts),
+        metadata: row.get("metadata")?,
+    })
+}
+
+fn parse_ts(s: &str) -> DateTime<Utc> {
+    DateTime::parse_from_rfc3339(s)
+        .map(|t| t.with_timezone(&Utc))
+        .unwrap_or_else(|_| Utc::now())
+}
+
+impl TranscriptStore for SqliteStore {
+    fn create_session(
+        &self,
+        agent: &str,
+        project: Option<&str>,
+        metadata: Option<&str>,
+    ) -> IcmResult<String> {
+        let metadata = metadata.map(|s| truncate_at_char_boundary(s, MAX_METADATA_BYTES));
+        let session = Session::new(
+            agent.to_string(),
+            project.map(|s| s.to_string()),
+            metadata.map(|s| s.to_string()),
+        );
+        let conn = &self.conn;
+        conn.execute(
+            "INSERT INTO sessions (id, agent, project, started_at, updated_at, metadata)
+             VALUES (?1, ?2, ?3, ?4, ?5, ?6)",
+            params![
+                session.id,
+                session.agent,
+                session.project,
+                session.started_at.to_rfc3339(),
+                session.updated_at.to_rfc3339(),
+                session.metadata,
+            ],
+        )
+        .map_err(db_err)?;
+        Ok(session.id)
+    }
+
+    fn get_session(&self, id: &str) -> IcmResult<Option<Session>> {
+        let conn = &self.conn;
+        let row = conn
+            .query_row(
+                "SELECT id, agent, project, started_at, updated_at, metadata
+                 FROM sessions WHERE id = ?1",
+                params![id],
+                row_to_session,
+            )
+            .map(Some)
+            .or_else(|e| match e {
+                rusqlite::Error::QueryReturnedNoRows => Ok(None),
+                other => Err(db_err(other)),
+            })?;
+        Ok(row)
+    }
+
+    fn ensure_session(
+        &self,
+        id: &str,
+        agent: &str,
+        project: Option<&str>,
+        metadata: Option<&str>,
+    ) -> IcmResult<String> {
+        let conn = &self.conn;
+        let now = chrono::Utc::now().to_rfc3339();
+        let metadata = metadata.map(|s| truncate_at_char_boundary(s, MAX_METADATA_BYTES));
+        // INSERT OR IGNORE keeps the first row stable across re-fires.
+        // The `id` is the host agent's session id (Claude Code, Codex,
+        // Gemini, etc.) so repeated hook posts route to the same row.
+        conn.execute(
+            "INSERT OR IGNORE INTO sessions (id, agent, project, started_at, updated_at, metadata)
+             VALUES (?1, ?2, ?3, ?4, ?5, ?6)",
+            params![id, agent, project, now, now, metadata.unwrap_or("{}")],
+        )
+        .map_err(db_err)?;
+        Ok(id.to_string())
+    }
+
+    fn list_sessions(&self, project: Option<&str>, limit: usize) -> IcmResult<Vec<Session>> {
+        let conn = &self.conn;
+        match project {
+            Some(p) => {
+                let mut stmt = conn
+                    .prepare(
+                        "SELECT id, agent, project, started_at, updated_at, metadata
+                         FROM sessions WHERE project = ?1
+                         ORDER BY updated_at DESC LIMIT ?2",
+                    )
+                    .map_err(db_err)?;
+                let rows = stmt
+                    .query_map(params![p, limit as i64], row_to_session)
+                    .map_err(db_err)?
+                    .collect::<Result<Vec<_>, _>>()
+                    .map_err(db_err)?;
+                Ok(rows)
+            }
+            None => {
+                let mut stmt = conn
+                    .prepare(
+                        "SELECT id, agent, project, started_at, updated_at, metadata
+                         FROM sessions ORDER BY updated_at DESC LIMIT ?1",
+                    )
+                    .map_err(db_err)?;
+                let rows = stmt
+                    .query_map(params![limit as i64], row_to_session)
+                    .map_err(db_err)?
+                    .collect::<Result<Vec<_>, _>>()
+                    .map_err(db_err)?;
+                Ok(rows)
+            }
+        }
+    }
+
+    fn record_message(
+        &self,
+        session_id: &str,
+        role: Role,
+        content: &str,
+        tool_name: Option<&str>,
+        tokens: Option<i64>,
+        metadata: Option<&str>,
+    ) -> IcmResult<String> {
+        /// Cap on a single transcript message. Unlike memory writes (which
+        /// reject oversized input), transcripts are best-effort logs — a
+        /// multi-MB tool dump is truncated rather than lost entirely. The
+        /// MCP `icm_transcript_record` path previously had no bound at all
+        /// (audit finding).
+        const MAX_MESSAGE_BYTES: usize = 256 * 1024;
+        // metadata/tool_name got no cap at all even after content was capped
+        // in round 2 (audit finding) - same best-effort-truncate rationale,
+        // just smaller since they're auxiliary, not the main payload.
+        const MAX_TOOL_NAME_BYTES: usize = 512;
+
+        let content = truncate_at_char_boundary(content, MAX_MESSAGE_BYTES);
+        let tool_name = tool_name.map(|s| truncate_at_char_boundary(s, MAX_TOOL_NAME_BYTES));
+        let metadata = metadata.map(|s| truncate_at_char_boundary(s, MAX_METADATA_BYTES));
+
+        let msg = Message::new(
+            session_id.to_string(),
+            role,
+            content.to_string(),
+            tool_name.map(|s| s.to_string()),
+            tokens,
+            metadata.map(|s| s.to_string()),
+        );
+        let conn = &self.conn;
+
+        // Ensure the session exists — referential integrity check is friendlier
+        // than raw FK failure.
+        let session_exists: bool = conn
+            .query_row(
+                "SELECT COUNT(*) > 0 FROM sessions WHERE id = ?1",
+                params![session_id],
+                |r| r.get(0),
+            )
+            .map_err(db_err)?;
+        if !session_exists {
+            return Err(IcmError::NotFound(format!(
+                "session {} does not exist",
+                session_id
+            )));
+        }
+
+        conn.execute(
+            "INSERT INTO messages (id, session_id, role, content, tool_name, tokens, ts, metadata)
+             VALUES (?1, ?2, ?3, ?4, ?5, ?6, ?7, ?8)",
+            params![
+                msg.id,
+                msg.session_id,
+                msg.role.as_str(),
+                msg.content,
+                msg.tool_name,
+                msg.tokens,
+                msg.ts.to_rfc3339(),
+                msg.metadata,
+            ],
+        )
+        .map_err(db_err)?;
+        conn.execute(
+            "UPDATE sessions SET updated_at = ?1 WHERE id = ?2",
+            params![msg.ts.to_rfc3339(), session_id],
+        )
+        .map_err(db_err)?;
+        Ok(msg.id)
+    }
+
+    fn list_session_messages(
+        &self,
+        session_id: &str,
+        limit: usize,
+        offset: usize,
+    ) -> IcmResult<Vec<Message>> {
+        let conn = &self.conn;
+        let mut stmt = conn
+            .prepare(
+                "SELECT id, session_id, role, content, tool_name, tokens, ts, metadata
+                 FROM messages WHERE session_id = ?1
+                 ORDER BY ts ASC LIMIT ?2 OFFSET ?3",
+            )
+            .map_err(db_err)?;
+        let rows: Vec<Message> = stmt
+            .query_map(
+                params![session_id, limit as i64, offset as i64],
+                row_to_message,
+            )
+            .map_err(db_err)?
+            .collect::<Result<Vec<_>, _>>()
+            .map_err(db_err)?;
+        Ok(rows)
+    }
+
+    fn search_transcripts(
+        &self,
+        query: &str,
+        session_id: Option<&str>,
+        project: Option<&str>,
+        limit: usize,
+    ) -> IcmResult<Vec<TranscriptHit>> {
+        // Unlike search_feedback, raw query text is bound straight to
+        // `messages_fts MATCH ?1` — intentionally, since callers rely on
+        // real FTS5 syntax here (boolean OR, phrase quoting; see
+        // test_transcript_search_fts5_boolean_and_phrase). Sanitizing like
+        // search_feedback does would silently break that. Malformed syntax
+        // (e.g. "hello AND", "(hello") threw a raw sqlite error instead of
+        // degrading gracefully (audit finding) — that's handled below by
+        // treating an FTS5 syntax error as "no results" rather than
+        // propagating the sqlite internals to the caller.
+        let conn = &self.conn;
+        // Build dynamic WHERE filters. FTS MATCH comes first for index usage.
+        let mut sql = String::from(
+            "SELECT m.id, m.session_id, m.role, m.content, m.tool_name, m.tokens, m.ts, m.metadata,
+                    s.id AS s_id, s.agent AS s_agent, s.project AS s_project,
+                    s.started_at AS s_started_at, s.updated_at AS s_updated_at,
+                    s.metadata AS s_metadata,
+                    bm25(messages_fts) AS score
+             FROM messages_fts
+             JOIN messages m ON m.rowid = messages_fts.rowid
+             JOIN sessions s ON s.id = m.session_id
+             WHERE messages_fts MATCH ?1",
+        );
+        // Param numbering: ?1 = query (always). Session if present is ?2.
+        // Project is ?2 if no session, else ?3.
+        if session_id.is_some() {
+            sql.push_str(" AND m.session_id = ?2");
+        }
+        if project.is_some() {
+            if session_id.is_some() {
+                sql.push_str(" AND s.project = ?3");
+            } else {
+                sql.push_str(" AND s.project = ?2");
+            }
+        }
+        sql.push_str(" ORDER BY score ASC LIMIT ?");
+        sql.push_str(match (session_id.is_some(), project.is_some()) {
+            (true, true) => "4",
+            (true, false) | (false, true) => "3",
+            (false, false) => "2",
+        });
+
+        let mut stmt = conn.prepare(&sql).map_err(db_err)?;
+        let limit_i = limit as i64;
+        // Compute against raw rusqlite errors so a malformed FTS5 query
+        // (syntax error) can be distinguished from a real db failure below,
+        // instead of eagerly converting to IcmError via `?`.
+        let mut compute = || -> rusqlite::Result<Vec<TranscriptHit>> {
+            Ok(match (session_id, project) {
+                (Some(sid), Some(p)) => stmt
+                    .query_map(params![query, sid, p, limit_i], |row| {
+                        let msg = Message {
+                            id: row.get("id")?,
+                            session_id: row.get("session_id")?,
+                            role: Role::parse(&row.get::<_, String>("role")?).unwrap_or(Role::Tool),
+                            content: row.get("content")?,
+                            tool_name: row.get("tool_name")?,
+                            tokens: row.get("tokens")?,
+                            ts: parse_ts(&row.get::<_, String>("ts")?),
+                            metadata: row.get("metadata")?,
+                        };
+                        let sess = Session {
+                            id: row.get("s_id")?,
+                            agent: row.get("s_agent")?,
+                            project: row.get("s_project")?,
+                            started_at: parse_ts(&row.get::<_, String>("s_started_at")?),
+                            updated_at: parse_ts(&row.get::<_, String>("s_updated_at")?),
+                            metadata: row.get("s_metadata")?,
+                        };
+                        let raw_score: f64 = row.get("score")?;
+                        Ok(TranscriptHit {
+                            message: msg,
+                            session: sess,
+                            score: -raw_score, // FTS5 bm25 returns negative for better rank
+                        })
+                    })?
+                    .collect::<Result<Vec<_>, _>>()?,
+                (Some(sid), None) => stmt
+                    .query_map(params![query, sid, limit_i], |row| {
+                        let msg = Message {
+                            id: row.get("id")?,
+                            session_id: row.get("session_id")?,
+                            role: Role::parse(&row.get::<_, String>("role")?).unwrap_or(Role::Tool),
+                            content: row.get("content")?,
+                            tool_name: row.get("tool_name")?,
+                            tokens: row.get("tokens")?,
+                            ts: parse_ts(&row.get::<_, String>("ts")?),
+                            metadata: row.get("metadata")?,
+                        };
+                        let sess = Session {
+                            id: row.get("s_id")?,
+                            agent: row.get("s_agent")?,
+                            project: row.get("s_project")?,
+                            started_at: parse_ts(&row.get::<_, String>("s_started_at")?),
+                            updated_at: parse_ts(&row.get::<_, String>("s_updated_at")?),
+                            metadata: row.get("s_metadata")?,
+                        };
+                        let raw_score: f64 = row.get("score")?;
+                        Ok(TranscriptHit {
+                            message: msg,
+                            session: sess,
+                            score: -raw_score,
+                        })
+                    })?
+                    .collect::<Result<Vec<_>, _>>()?,
+                (None, Some(p)) => stmt
+                    .query_map(params![query, p, limit_i], |row| {
+                        let msg = Message {
+                            id: row.get("id")?,
+                            session_id: row.get("session_id")?,
+                            role: Role::parse(&row.get::<_, String>("role")?).unwrap_or(Role::Tool),
+                            content: row.get("content")?,
+                            tool_name: row.get("tool_name")?,
+                            tokens: row.get("tokens")?,
+                            ts: parse_ts(&row.get::<_, String>("ts")?),
+                            metadata: row.get("metadata")?,
+                        };
+                        let sess = Session {
+                            id: row.get("s_id")?,
+                            agent: row.get("s_agent")?,
+                            project: row.get("s_project")?,
+                            started_at: parse_ts(&row.get::<_, String>("s_started_at")?),
+                            updated_at: parse_ts(&row.get::<_, String>("s_updated_at")?),
+                            metadata: row.get("s_metadata")?,
+                        };
+                        let raw_score: f64 = row.get("score")?;
+                        Ok(TranscriptHit {
+                            message: msg,
+                            session: sess,
+                            score: -raw_score,
+                        })
+                    })?
+                    .collect::<Result<Vec<_>, _>>()?,
+                (None, None) => stmt
+                    .query_map(params![query, limit_i], |row| {
+                        let msg = Message {
+                            id: row.get("id")?,
+                            session_id: row.get("session_id")?,
+                            role: Role::parse(&row.get::<_, String>("role")?).unwrap_or(Role::Tool),
+                            content: row.get("content")?,
+                            tool_name: row.get("tool_name")?,
+                            tokens: row.get("tokens")?,
+                            ts: parse_ts(&row.get::<_, String>("ts")?),
+                            metadata: row.get("metadata")?,
+                        };
+                        let sess = Session {
+                            id: row.get("s_id")?,
+                            agent: row.get("s_agent")?,
+                            project: row.get("s_project")?,
+                            started_at: parse_ts(&row.get::<_, String>("s_started_at")?),
+                            updated_at: parse_ts(&row.get::<_, String>("s_updated_at")?),
+                            metadata: row.get("s_metadata")?,
+                        };
+                        let raw_score: f64 = row.get("score")?;
+                        Ok(TranscriptHit {
+                            message: msg,
+                            session: sess,
+                            score: -raw_score,
+                        })
+                    })?
+                    .collect::<Result<Vec<_>, _>>()?,
+            })
+        };
+        let rows = match compute() {
+            Ok(rows) => rows,
+            Err(e) if is_fts5_syntax_error(&e) => Vec::new(),
+            Err(e) => return Err(db_err(e)),
+        };
+        Ok(rows)
+    }
+
+    fn forget_session(&self, id: &str) -> IcmResult<()> {
+        let conn = &self.conn;
+        // Explicit delete of messages (in case FK cascade isn't enabled on older DBs).
+        conn.execute("DELETE FROM messages WHERE session_id = ?1", params![id])
+            .map_err(db_err)?;
+        conn.execute("DELETE FROM sessions WHERE id = ?1", params![id])
+            .map_err(db_err)?;
+        Ok(())
+    }
+
+    fn transcript_stats(&self) -> IcmResult<TranscriptStats> {
+        let conn = &self.conn;
+
+        let total_sessions: usize = conn
+            .query_row("SELECT COUNT(*) FROM sessions", [], |r| r.get(0))
+            .map_err(db_err)?;
+        let total_messages: usize = conn
+            .query_row("SELECT COUNT(*) FROM messages", [], |r| r.get(0))
+            .map_err(db_err)?;
+        let total_bytes: u64 = conn
+            .query_row(
+                "SELECT COALESCE(SUM(LENGTH(content)), 0) FROM messages",
+                [],
+                |r| r.get::<_, i64>(0),
+            )
+            .map_err(db_err)? as u64;
+
+        let mut stmt_role = conn
+            .prepare("SELECT role, COUNT(*) FROM messages GROUP BY role ORDER BY 2 DESC")
+            .map_err(db_err)?;
+        let by_role: Vec<(String, usize)> = stmt_role
+            .query_map([], |r: &rusqlite::Row<'_>| {
+                Ok((r.get::<_, String>(0)?, r.get::<_, i64>(1)? as usize))
+            })
+            .map_err(db_err)?
+            .collect::<Result<Vec<_>, _>>()
+            .map_err(db_err)?;
+
+        let mut stmt_agent = conn
+            .prepare("SELECT agent, COUNT(*) FROM sessions GROUP BY agent ORDER BY 2 DESC")
+            .map_err(db_err)?;
+        let by_agent: Vec<(String, usize)> = stmt_agent
+            .query_map([], |r: &rusqlite::Row<'_>| {
+                Ok((r.get::<_, String>(0)?, r.get::<_, i64>(1)? as usize))
+            })
+            .map_err(db_err)?
+            .collect::<Result<Vec<_>, _>>()
+            .map_err(db_err)?;
+
+        let mut stmt_top = conn
+            .prepare(
+                "SELECT session_id, COUNT(*) FROM messages
+                 GROUP BY session_id ORDER BY 2 DESC LIMIT 10",
+            )
+            .map_err(db_err)?;
+        let top_sessions: Vec<(String, usize)> = stmt_top
+            .query_map([], |r: &rusqlite::Row<'_>| {
+                Ok((r.get::<_, String>(0)?, r.get::<_, i64>(1)? as usize))
+            })
+            .map_err(db_err)?
+            .collect::<Result<Vec<_>, _>>()
+            .map_err(db_err)?;
+
+        let (oldest, newest): (Option<DateTime<Utc>>, Option<DateTime<Utc>>) = conn
+            .query_row(
+                "SELECT MIN(ts), MAX(ts) FROM messages",
+                [],
+                |r: &rusqlite::Row<'_>| {
+                    let o: Option<String> = r.get(0)?;
+                    let n: Option<String> = r.get(1)?;
+                    Ok((o.as_deref().map(parse_ts), n.as_deref().map(parse_ts)))
+                },
+            )
+            .unwrap_or((None, None));
+
+        Ok(TranscriptStats {
+            total_sessions,
+            total_messages,
+            total_bytes,
+            by_role,
+            by_agent,
+            top_sessions,
+            oldest,
+            newest,
+        })
+    }
+}