hippo-memory 1.44.0 → 1.45.0

package/dist/src/store.js

@@ -1,3749 +0,0 @@
-/**
- * Storage layer for Hippo.
- *
- * SQLite is the source of truth.
- * Markdown + JSON files remain as human-readable compatibility mirrors.
- */
-import * as fs from 'fs';
-import * as path from 'path';
-import { Layer, generateId } from './memory.js';
-import { dumpFrontmatter, parseFrontmatter } from './yaml.js';
-import { openHippoDb, closeHippoDb, getMeta, setMeta, isFtsAvailable, pruneConsolidationRuns, getHippoDbPath, } from './db.js';
-import { rowToSessionHandoff, isHandoffOutcome } from './handoff.js';
-import { CARD_TRANSITIONS, CARD_LEASE_MS } from './card.js';
-import { tokenize } from './search.js';
-import { appendAuditEvent } from './audit.js';
-import { resolveTenantId } from './tenant.js';
-import { deriveOriginProject, originFromSource, findHippoStoreDir, realpathOrResolve } from './project-identity.js';
-import { checkRejectionGuard, RejectedValueError, rejectionDigest, normalizeValueForRejection, insertRejectedValue, findRejectedValue, } from './rejection.js';
-// AT1 (plan §5): resolveConflict's kind-aware loser removal needs
-// archiveRawMemory for kind='raw' losers. raw-archive.ts imports
-// markSummaryDirtyInTx from this module — both imports are used only
-// inside function bodies (never at module-evaluation time), so the cycle
-// is the standard safe mutual-function-reference shape under NodeNext ESM.
-import { archiveRawMemory } from './raw-archive.js';
-/**
- * Emit an audit event for a mutation against `db`. Wrapped so a broken audit
- * log can never crash the surrounding mutation — the SQLite store is still the
- * source of truth and audit failures are diagnosable from the missing rows.
- */
-function audit(db, op, targetId, metadata, actor = 'cli', tenantId) {
-    try {
-        appendAuditEvent(db, {
-            tenantId: tenantId ?? resolveTenantId({}),
-            actor,
-            op,
-            targetId,
-            metadata,
-        });
-    }
-    catch {
-        // Audit must never crash a mutation. Failures here mean the audit_log
-        // table is broken; the mutation has already succeeded.
-    }
-}
-/**
- * Refusal audit for the AT1 rejection guard (plan §3). Written by the
- * transaction OWNER post-rollback — writeEntry's catch (no outer tx exists
- * there, so this lands in a fresh implicit transaction) and api.supersede's
- * catch (after its own ROLLBACK) — never inside a scope the caller's own
- * rollback could claw back. Best-effort `audit()` semantics: never throws.
- */
-export function auditRejectionRefusal(db, err, actor) {
-    audit(db, 'reject_refusal', err.entryId, { digest: err.digest, reason: err.reason }, actor, err.tenantId);
-}
-const INDEX_VERSION = 3;
-const MEMORY_SELECT_COLUMNS = `id, created, last_retrieved, retrieval_count, strength, half_life_days, layer, tags_json, emotional_valence, schema_fit, source, outcome_score, outcome_positive, outcome_negative, conflicts_with_json, pinned, confidence, content, parents_json, starred, trace_outcome, source_session_id, valid_from, superseded_by, extracted_from, dag_level, dag_parent_id, kind, scope, owner, artifact_ref, tenant_id, origin_project, descendant_count, earliest_at, latest_at, summary_dirty, last_rebuilt_at, rebuild_count, dag_level_3_built_at`;
-// F1 (v1.7.0): qualified-and-aliased columns for the FTS join in
-// loadSearchRows. Every column is `m.<col> AS <col>` so rowToEntry's
-// unqualified field reads keep working unchanged. The trailing
-// bm25(memories_fts) AS bm25_score adds the FTS rank as a result column.
-// Only used inside the FTS path; non-FTS paths keep MEMORY_SELECT_COLUMNS.
-const MEMORY_SEARCH_COLUMNS = `m.id AS id, m.created AS created, m.last_retrieved AS last_retrieved, m.retrieval_count AS retrieval_count, m.strength AS strength, m.half_life_days AS half_life_days, m.layer AS layer, m.tags_json AS tags_json, m.emotional_valence AS emotional_valence, m.schema_fit AS schema_fit, m.source AS source, m.outcome_score AS outcome_score, m.outcome_positive AS outcome_positive, m.outcome_negative AS outcome_negative, m.conflicts_with_json AS conflicts_with_json, m.pinned AS pinned, m.confidence AS confidence, m.content AS content, m.parents_json AS parents_json, m.starred AS starred, m.trace_outcome AS trace_outcome, m.source_session_id AS source_session_id, m.valid_from AS valid_from, m.superseded_by AS superseded_by, m.extracted_from AS extracted_from, m.dag_level AS dag_level, m.dag_parent_id AS dag_parent_id, m.kind AS kind, m.scope AS scope, m.owner AS owner, m.artifact_ref AS artifact_ref, m.tenant_id AS tenant_id, m.origin_project AS origin_project, m.descendant_count AS descendant_count, m.earliest_at AS earliest_at, m.latest_at AS latest_at, m.summary_dirty AS summary_dirty, m.last_rebuilt_at AS last_rebuilt_at, m.rebuild_count AS rebuild_count, m.dag_level_3_built_at AS dag_level_3_built_at, bm25(memories_fts) AS bm25_score`;
-/**
- * Default candidate-pool size for `loadSearchEntries` when called with
- * `limit === undefined`. Single source of truth; `api.recall` imports
- * this for `RecallResult.windowSize` reporting so the two cannot drift.
- */
-export const DEFAULT_SEARCH_CANDIDATE_LIMIT = 200;
-/**
- * v1.7.2 — literal scopes excluded from recall by default-deny when the
- * caller passes no `scope`. The SQL clause in `loadSearchRows` and the JS
- * helper `passesScopeFilterForRecall` (src/api.ts) both read from this
- * constant. Adding a deny scope is a one-place change.
- *
- * Regex-based denies (e.g. `<source>:private:*`) stay in
- * `passesScopeFilterForRecall` as a separate JS step — they don't translate
- * cleanly to SQL.
- *
- * Invariant: never empty. An empty array would silently allow quarantine
- * scopes through both paths (SQL clause omitted, JS check vacuous). The
- * module-load assertion below pins this loudly.
- */
-export const RECALL_DEFAULT_DENY_SCOPES = ['unknown:legacy'];
-/**
- * @internal v1.7.3 — runtime guard against a future maintainer blanking a
- * load-bearing literal array. Extracted from the inline guard so the throw
- * path is directly testable. `as const` arrays widen via `readonly T[]` at
- * the call site so the empty case is reachable at runtime.
- */
-export function assertNonEmpty(arr, name) {
-    if (arr.length === 0) {
-        throw new Error(`${name} cannot be empty — would silently allow quarantine scopes`);
-    }
-}
-assertNonEmpty(RECALL_DEFAULT_DENY_SCOPES, 'RECALL_DEFAULT_DENY_SCOPES');
-function layerDir(root, layer) {
-    return path.join(root, layer);
-}
-/** Nearest ancestor store like git; the strict join is the fallback so `hippo init` still creates `<cwd>/.hippo`. */
-export function getHippoRoot(cwd = process.cwd(), opts) {
-    return findHippoStoreDir(cwd, opts) ?? path.join(realpathOrResolve(cwd), '.hippo');
-}
-export function isInitialized(hippoRoot) {
-    // A bare .hippo directory is not enough — autoInstallHooks /
-    // setupDailySchedule can create it without ever calling initStore,
-    // leaving a partial directory (integrations/, logs/, runs/) with no
-    // hippo.db. Returning true in that state caused `hippo init` to skip
-    // initStore and `hippo recall` to silently fall back to an empty store
-    // (incident 2026-04-26: ingest_direct.py against a bare .hippo).
-    // Treat the store as initialized only if hippo.db actually exists.
-    return fs.existsSync(path.join(hippoRoot, 'hippo.db'));
-}
-export function initStore(hippoRoot) {
-    ensureMirrorDirectories(hippoRoot);
-    const db = openHippoDb(hippoRoot);
-    try {
-        const bootstrapped = bootstrapLegacyStore(db, hippoRoot);
-        if (bootstrapped) {
-            syncMirrorFiles(hippoRoot, db);
-        }
-    }
-    finally {
-        closeHippoDb(db);
-    }
-}
-function ensureMirrorDirectories(hippoRoot) {
-    const dirs = [
-        hippoRoot,
-        path.join(hippoRoot, 'buffer'),
-        path.join(hippoRoot, 'episodic'),
-        path.join(hippoRoot, 'semantic'),
-        path.join(hippoRoot, 'conflicts'),
-    ];
-    for (const dir of dirs) {
-        fs.mkdirSync(dir, { recursive: true });
-    }
-}
-/**
- * Serialize a MemoryEntry to markdown with YAML frontmatter.
- */
-export function serializeEntry(entry) {
-    const frontmatter = {
-        id: entry.id,
-        created: entry.created,
-        last_retrieved: entry.last_retrieved,
-        retrieval_count: entry.retrieval_count,
-        strength: Math.round(entry.strength * 10000) / 10000,
-        half_life_days: entry.half_life_days,
-        layer: entry.layer,
-        tags: entry.tags,
-        emotional_valence: entry.emotional_valence,
-        schema_fit: entry.schema_fit,
-        source: entry.source,
-        outcome_score: entry.outcome_score,
-        outcome_positive: entry.outcome_positive,
-        outcome_negative: entry.outcome_negative,
-        conflicts_with: entry.conflicts_with,
-        pinned: entry.pinned,
-        confidence: entry.confidence ?? 'observed',
-        parents: entry.parents ?? [],
-        starred: entry.starred ?? false,
-        trace_outcome: entry.trace_outcome ?? null,
-        source_session_id: entry.source_session_id ?? null,
-        kind: entry.kind ?? 'distilled',
-        scope: entry.scope ?? null,
-        owner: entry.owner ?? null,
-        artifact_ref: entry.artifact_ref ?? null,
-    };
-    // Emit tenant_id only when not 'default' to keep diffs clean for the dominant
-    // single-tenant case (mirrors the plan's task 7 guidance).
-    const tenantId = entry.tenantId ?? 'default';
-    if (tenantId !== 'default') {
-        frontmatter['tenant_id'] = tenantId;
-    }
-    // v39: origin_project '' (user-global) is meaningful and must round-trip;
-    // only undefined/null (legacy/unstamped) is omitted.
-    if (entry.origin_project !== undefined && entry.origin_project !== null) {
-        frontmatter['origin_project'] = entry.origin_project;
-    }
-    // Spread into a fresh object literal: dumpFrontmatter's Record<string,
-    // YamlValue> parameter needs an index signature, which a named interface
-    // reference (EntryFrontmatterFields) doesn't structurally provide even
-    // though every property's value type already matches.
-    const fm = dumpFrontmatter({ ...frontmatter });
-    return `${fm}\n\n${entry.content}\n`;
-}
-/**
- * Deserialize a markdown file to a MemoryEntry.
- */
-export function deserializeEntry(raw) {
-    const { data, content } = parseFrontmatter(raw);
-    if (!data['id'] || !data['layer'])
-        return null;
-    // SAFETY: every `as X` below narrows a raw YAML frontmatter field to an
-    // enum/union member of MemoryEntry; frontmatter is only ever written by
-    // serializeEntry (whose own fields are typed), so out-of-range values here
-    // would indicate hand-edited files, which this parser is not required to
-    // reject — matches the pre-existing permissive-parse behavior.
-    return {
-        id: String(data['id']),
-        created: String(data['created'] ?? new Date().toISOString()),
-        last_retrieved: String(data['last_retrieved'] ?? new Date().toISOString()),
-        retrieval_count: Number(data['retrieval_count'] ?? 0),
-        strength: Number(data['strength'] ?? 1.0),
-        half_life_days: Number(data['half_life_days'] ?? 7),
-        layer: data['layer'],
-        tags: normalizeStringArray(data['tags']),
-        emotional_valence: data['emotional_valence'] ?? 'neutral',
-        schema_fit: Number(data['schema_fit'] ?? 0.5),
-        source: String(data['source'] ?? 'cli'),
-        outcome_score: data['outcome_score'] === null || data['outcome_score'] === undefined ? null : Number(data['outcome_score']),
-        outcome_positive: Number(data['outcome_positive'] ?? 0),
-        outcome_negative: Number(data['outcome_negative'] ?? 0),
-        conflicts_with: normalizeStringArray(data['conflicts_with']),
-        pinned: Boolean(data['pinned'] ?? false),
-        confidence: data['confidence'] ?? 'observed',
-        content: content.trim(),
-        parents: normalizeStringArray(data['parents']),
-        starred: Boolean(data['starred'] ?? false),
-        trace_outcome: data['trace_outcome'] ?? null,
-        source_session_id: data['source_session_id'] === null || data['source_session_id'] === undefined
-            ? null
-            : String(data['source_session_id']),
-        valid_from: data['valid_from'] ? String(data['valid_from']) : String(data['created'] ?? new Date().toISOString()),
-        superseded_by: data['superseded_by'] === null || data['superseded_by'] === undefined
-            ? null
-            : String(data['superseded_by']),
-        extracted_from: data['extracted_from'] ?? null,
-        dag_level: Number(data['dag_level'] ?? 0),
-        dag_parent_id: data['dag_parent_id'] ?? null,
-        kind: (data['kind'] ?? 'distilled'),
-        scope: data['scope'] === null || data['scope'] === undefined ? null : String(data['scope']),
-        owner: data['owner'] === null || data['owner'] === undefined ? null : String(data['owner']),
-        artifact_ref: data['artifact_ref'] === null || data['artifact_ref'] === undefined ? null : String(data['artifact_ref']),
-        tenantId: data['tenant_id'] === null || data['tenant_id'] === undefined ? 'default' : String(data['tenant_id']),
-        origin_project: data['origin_project'] === null || data['origin_project'] === undefined ? null : String(data['origin_project']),
-    };
-}
-function normalizeStringArray(value) {
-    if (!Array.isArray(value))
-        return [];
-    return value.map((item) => String(item));
-}
-function rowToEntry(row) {
-    // SAFETY: every `as X` below narrows a SQLite column value to an
-    // enum/union member of MemoryEntry; `row` comes from MEMORY_SELECT_COLUMNS
-    // / MEMORY_SEARCH_COLUMNS, which are the only queries producing MemoryRow,
-    // and the DB layer only ever writes these columns from the same enums.
-    const entry = {
-        id: row.id,
-        created: row.created,
-        last_retrieved: row.last_retrieved,
-        retrieval_count: Number(row.retrieval_count ?? 0),
-        strength: Number(row.strength ?? 1),
-        half_life_days: Number(row.half_life_days ?? 7),
-        layer: row.layer,
-        tags: parseJsonArray(row.tags_json),
-        emotional_valence: row.emotional_valence ?? 'neutral',
-        schema_fit: Number(row.schema_fit ?? 0.5),
-        source: row.source ?? 'cli',
-        outcome_score: row.outcome_score === null || row.outcome_score === undefined ? null : Number(row.outcome_score),
-        outcome_positive: Number(row.outcome_positive ?? 0),
-        outcome_negative: Number(row.outcome_negative ?? 0),
-        conflicts_with: parseJsonArray(row.conflicts_with_json),
-        pinned: Boolean(row.pinned),
-        confidence: row.confidence ?? 'observed',
-        content: row.content,
-        parents: parseJsonArray(row.parents_json),
-        starred: Boolean(row.starred),
-        trace_outcome: row.trace_outcome ?? null,
-        source_session_id: row.source_session_id ?? null,
-        valid_from: row.valid_from ?? row.created,
-        superseded_by: row.superseded_by ?? null,
-        extracted_from: row.extracted_from ?? null,
-        dag_level: Number(row.dag_level ?? 0),
-        dag_parent_id: row.dag_parent_id ?? null,
-        kind: (row.kind ?? 'distilled'),
-        scope: row.scope ?? null,
-        owner: row.owner ?? null,
-        artifact_ref: row.artifact_ref ?? null,
-        tenantId: row.tenant_id ?? 'default',
-        origin_project: row.origin_project ?? null,
-        descendant_count: Number(row.descendant_count ?? 0),
-        earliest_at: row.earliest_at ?? null,
-        latest_at: row.latest_at ?? null,
-        // v0.30 / E1 of DAG live-coupling (schema v28). Symmetric with v25 cache.
-        summary_dirty: (Number(row.summary_dirty ?? 0) === 1 ? 1 : 0),
-        last_rebuilt_at: row.last_rebuilt_at ?? null,
-        rebuild_count: Number(row.rebuild_count ?? 0),
-        dag_level_3_built_at: row.dag_level_3_built_at ?? null,
-    };
-    // F1 (v1.7.0): preserve bm25_score from the FTS path. `'bm25_score' in row`
-    // distinguishes "absent column" (non-FTS path) from "column present but
-    // value 0" — though FTS5 bm25() never returns 0, this is defensive.
-    if ('bm25_score' in row && row.bm25_score !== undefined && row.bm25_score !== null) {
-        entry.bm25_score = Number(row.bm25_score);
-    }
-    return entry;
-}
-function parseJsonArray(raw) {
-    if (!raw)
-        return [];
-    try {
-        const parsed = JSON.parse(raw);
-        return Array.isArray(parsed) ? parsed.map((item) => String(item)) : [];
-    }
-    catch {
-        return [];
-    }
-}
-/**
- * Strict parse for the `last_trace_id` meta value (LC1 F1(d) structural
- * fix). A bare Number(raw) would turn '', whitespace, or garbage into a
- * usable-looking 0/NaN — a consumer INSERTing recall_trace_outcomes with
- * trace_id=0 would hit a masked FK violation (row id 0 never exists).
- * Require a clean positive integer string; anything else is treated as
- * unset. This is the ONE place that decides "clean" — every consumer of
- * `HippoIndex.last_trace_id` (outcomeForLastRecall, tests) reads the
- * already-validated value out of `buildIndexFromDb`'s result and never
- * re-parses the raw meta string itself.
- */
-function parseLastTraceId(raw) {
-    const trimmed = (raw ?? '').trim();
-    if (!/^\d+$/.test(trimmed) || Number(trimmed) <= 0)
-        return null;
-    return trimmed;
-}
-function isPlainJsonObject(x) {
-    return x !== null && typeof x === 'object' && !Array.isArray(x);
-}
-function parseJsonObject(raw) {
-    if (!raw)
-        return {};
-    try {
-        const parsed = JSON.parse(raw);
-        if (isPlainJsonObject(parsed)) {
-            return parsed;
-        }
-        return {};
-    }
-    catch {
-        return {};
-    }
-}
-function rowToTaskSnapshot(row) {
-    return {
-        id: Number(row.id),
-        task: row.task,
-        summary: row.summary,
-        next_step: row.next_step,
-        status: row.status,
-        source: row.source,
-        session_id: row.session_id ?? null,
-        scope: row.scope ?? null,
-        created_at: row.created_at,
-        updated_at: row.updated_at,
-    };
-}
-function rowToMemoryConflict(row) {
-    return {
-        id: Number(row.id),
-        memory_a_id: row.memory_a_id,
-        memory_b_id: row.memory_b_id,
-        reason: row.reason,
-        score: Number(row.score ?? 0),
-        status: row.status,
-        detected_at: row.detected_at,
-        updated_at: row.updated_at,
-    };
-}
-function rowToSessionEvent(row) {
-    return {
-        id: Number(row.id),
-        session_id: row.session_id,
-        task: row.task ?? null,
-        event_type: row.event_type,
-        content: row.content,
-        source: row.source,
-        scope: row.scope ?? null,
-        metadata: parseJsonObject(row.metadata_json),
-        created_at: row.created_at,
-    };
-}
-// Tenant-scoped mirror file paths. The single-tenant 'default' deployment
-// keeps the original `active-task.md` / `recent-session.md` filenames for
-// on-disk back-compat; multi-tenant deployments get a `.<tenantId>` suffix
-// so tenant B saving cannot overwrite tenant A's mirror file.
-function activeTaskMirrorPath(hippoRoot, tenantId) {
-    const file = tenantId === 'default' ? 'active-task.md' : `active-task.${tenantId}.md`;
-    return path.join(hippoRoot, 'buffer', file);
-}
-function recentSessionMirrorPath(hippoRoot, tenantId) {
-    const file = tenantId === 'default' ? 'recent-session.md' : `recent-session.${tenantId}.md`;
-    return path.join(hippoRoot, 'buffer', file);
-}
-function writeActiveTaskMirror(hippoRoot, tenantId, snapshot) {
-    const filePath = activeTaskMirrorPath(hippoRoot, tenantId);
-    const fm = dumpFrontmatter({
-        id: snapshot.id,
-        task: snapshot.task,
-        status: snapshot.status,
-        source: snapshot.source,
-        session_id: snapshot.session_id,
-        created_at: snapshot.created_at,
-        updated_at: snapshot.updated_at,
-        next_step: snapshot.next_step,
-    });
-    const body = [
-        `# Active Task Snapshot`,
-        '',
-        `## Summary`,
-        snapshot.summary,
-        '',
-        `## Next step`,
-        snapshot.next_step,
-        '',
-        `## Task`,
-        snapshot.task,
-        '',
-    ];
-    if (snapshot.session_id) {
-        body.push(`## Session`, snapshot.session_id, '');
-    }
-    fs.mkdirSync(path.dirname(filePath), { recursive: true });
-    fs.writeFileSync(filePath, `${fm}\n\n${body.join('\n')}`, 'utf8');
-}
-function removeActiveTaskMirror(hippoRoot, tenantId) {
-    const filePath = activeTaskMirrorPath(hippoRoot, tenantId);
-    if (fs.existsSync(filePath)) {
-        fs.unlinkSync(filePath);
-    }
-}
-function writeRecentSessionMirror(hippoRoot, tenantId, events) {
-    const filePath = recentSessionMirrorPath(hippoRoot, tenantId);
-    if (events.length === 0) {
-        if (fs.existsSync(filePath)) {
-            fs.unlinkSync(filePath);
-        }
-        return;
-    }
-    const latest = events[events.length - 1];
-    const fm = dumpFrontmatter({
-        session_id: latest.session_id,
-        task: latest.task,
-        event_count: events.length,
-        updated_at: latest.created_at,
-    });
-    const lines = [
-        '# Recent Session Trail',
-        '',
-        `- Session: ${latest.session_id}`,
-        `- Task: ${latest.task ?? 'n/a'}`,
-        `- Updated: ${latest.created_at}`,
-        '',
-        '## Events',
-        '',
-    ];
-    for (const event of events) {
-        lines.push(`- [${event.created_at}] (${event.event_type}) ${event.content}`);
-    }
-    lines.push('');
-    fs.mkdirSync(path.dirname(filePath), { recursive: true });
-    fs.writeFileSync(filePath, `${fm}\n\n${lines.join('\n')}`, 'utf8');
-}
-function writeConflictMirrors(hippoRoot, conflicts) {
-    const conflictDir = path.join(hippoRoot, 'conflicts');
-    fs.mkdirSync(conflictDir, { recursive: true });
-    const keep = new Set();
-    for (const conflict of conflicts) {
-        const filename = `conflict_${conflict.id}.md`;
-        keep.add(filename);
-        const fm = dumpFrontmatter({
-            id: conflict.id,
-            memory_a_id: conflict.memory_a_id,
-            memory_b_id: conflict.memory_b_id,
-            reason: conflict.reason,
-            score: Math.round(conflict.score * 10000) / 10000,
-            status: conflict.status,
-            detected_at: conflict.detected_at,
-            updated_at: conflict.updated_at,
-        });
-        const body = [
-            '# Memory Conflict',
-            '',
-            `- Memory A: ${conflict.memory_a_id}`,
-            `- Memory B: ${conflict.memory_b_id}`,
-            `- Reason: ${conflict.reason}`,
-            `- Score: ${conflict.score.toFixed(3)}`,
-            `- Status: ${conflict.status}`,
-            '',
-        ].join('\n');
-        fs.writeFileSync(path.join(conflictDir, filename), `${fm}\n\n${body}`, 'utf8');
-    }
-    for (const existing of fs.readdirSync(conflictDir)) {
-        if (existing === '.gitkeep')
-            continue;
-        if (!keep.has(existing)) {
-            fs.unlinkSync(path.join(conflictDir, existing));
-        }
-    }
-}
-function canonicalConflictPair(aId, bId) {
-    return aId < bId
-        ? { memory_a_id: aId, memory_b_id: bId }
-        : { memory_a_id: bId, memory_b_id: aId };
-}
-function loadSearchRows(db, query, limit, tenantId, scopeFilter) {
-    // tenantId undefined = no tenant filter (legacy callers / cross-deployment
-    // helpers). tenantId set = strict tenant isolation, leveraging the composite
-    // idx_memories_tenant_created (leading column tenant_id, O(log n) lookup).
-    const tenantPredicate = tenantId !== undefined ? ` AND m.tenant_id = ?` : '';
-    const tenantPredicateNoAlias = tenantId !== undefined ? ` AND tenant_id = ?` : '';
-    const tenantOnlyPredicate = tenantId !== undefined ? ` WHERE tenant_id = ?` : '';
-    const tenantParams = tenantId !== undefined ? [tenantId] : [];
-    // v1.12.6 — belt-and-suspenders against `kind='archived'` leaking into recall.
-    // `kind='archived'` is a transient sentinel inside `archiveRawMemory`'s
-    // SAVEPOINT (src/raw-archive.ts:56): UPDATE kind = 'archived' immediately
-    // followed by DELETE, both inside one savepoint that commits or rolls back
-    // atomically. SQLite atomicity guarantees no concurrent reader sees the
-    // intermediate state. This filter is defensive-only against:
-    //   (a) future bugs that drop the SAVEPOINT,
-    //   (b) future bugs that introduce kind='archived' as a persisted state,
-    //   (c) external direct-SQL writes that bypass archiveRawMemory.
-    // tenantOnlyPredicate starts with " WHERE tenant_id = ?" when tenant is set;
-    // when unset, we have no WHERE yet, so the archived clause needs both AND
-    // and WHERE forms. The "tenant-only" path always has WHERE (from tenant or
-    // we synthesize one).
-    const archivedClauseAlias = ` AND m.kind != 'archived'`;
-    const archivedClauseNoAlias = ` AND kind != 'archived'`;
-    // For the "tenant-only" path: if no tenant set, tenantOnlyPredicate is '',
-    // so prepend WHERE; if tenant set, append AND. handled in each call site
-    // by always joining `tenantOnlyPredicate + archivedClauseTenantOnly` where
-    // the latter switches between " AND" and " WHERE" based on caller context.
-    const archivedClauseTenantOnly = tenantId !== undefined ? ` AND kind != 'archived'` : ` WHERE kind != 'archived'`;
-    // v1.7.1 — recall-mode scope predicate (root-cause fix for the
-    // `unknown:legacy` leak codex flagged on the v1.6.5 review). Forms:
-    //   undefined                     → no scope filter (background pipelines)
-    //   { mode: 'default-deny' }      → exclude unknown:legacy + ':private:'
-    //   { mode: 'exact' }             → m.scope = 'X'
-    //   { mode: 'default-deny-or-exact' } → default set OR m.scope = 'X'
-    // v1.25.0: the private-scope exclusion now ALSO runs here pre-window as a
-    // conservative LIKE approximation (see the deny-mode comment below); the
-    // exact anchored regex stays the authoritative JS post-filter in the
-    // recall consumers.
-    //
-    // **Cross-reference:** `passesScopeFilterForRecall` in src/api.ts encodes
-    // the same default-deny rule. If the deny list grows (e.g. add
-    // `unknown:purged`), update BOTH this SQL clause AND that helper AND the
-    // continuity inline closure. v1.7.2 will consolidate them.
-    let scopeClauseAlias = '';
-    let scopeClauseNoAlias = '';
-    let scopeClauseTenantOnly = '';
-    const scopeParams = [];
-    if (scopeFilter !== undefined) {
-        if (scopeFilter.mode === 'default-deny') {
-            // T2: bind from RECALL_DEFAULT_DENY_SCOPES so SQL and JS share one
-            // source of truth. Module-load assertion at the top of this file
-            // guarantees length > 0, so NOT IN () (a SQL parse error) is impossible.
-            // NULL handling: m.scope NOT IN (?, ?) returns NULL on m.scope = NULL
-            // (three-valued logic). The `m.scope IS NULL OR ...` disjunct admits
-            // NULL rows.
-            // v1.25.0 (codex review-stage P2): the private-scope exclusion must run
-            // BEFORE the LIMIT, or a store where >window matching rows are
-            // `<source>:private:*` (heavy private-channel ingestion) starves every
-            // admitted row out of the candidate window and recall returns
-            // empty/incomplete. SQL uses a deliberately CONSERVATIVE approximation
-            // of the exact JS regex (`NOT LIKE '%:private:%'`, ASCII
-            // case-insensitive): it denies a strict superset (any scope containing
-            // ':private:' anywhere, any case) — fail-closed for a security filter.
-            // The exact anchored regex (`passesScopeFilterForRecall` /
-            // `isPrivateScope`) remains the authoritative JS post-filter.
-            const placeholders = RECALL_DEFAULT_DENY_SCOPES.map(() => '?').join(', ');
-            scopeClauseAlias = ` AND (m.scope IS NULL OR (m.scope NOT IN (${placeholders}) AND m.scope NOT LIKE '%:private:%'))`;
-            scopeClauseNoAlias = ` AND (scope IS NULL OR (scope NOT IN (${placeholders}) AND scope NOT LIKE '%:private:%'))`;
-            scopeClauseTenantOnly = scopeClauseNoAlias;
-            scopeParams.push(...RECALL_DEFAULT_DENY_SCOPES);
-        }
-        else if (scopeFilter.mode === 'default-deny-or-exact') {
-            // v1.25.0 CLI semantics: default-admitted set PLUS the explicitly
-            // requested scope (see the RecallScopeFilter doc above). Same NULL
-            // three-valued-logic handling and same pre-window private exclusion as
-            // 'default-deny' (codex P2, comment above); the trailing `OR scope = ?`
-            // arm keeps the explicitly requested scope loadable, INCLUDING a
-            // requested private or quarantine scope (deliberate owner access, same
-            // as api.recall's exact-match for the same input).
-            const placeholders = RECALL_DEFAULT_DENY_SCOPES.map(() => '?').join(', ');
-            scopeClauseAlias = ` AND (m.scope IS NULL OR (m.scope NOT IN (${placeholders}) AND m.scope NOT LIKE '%:private:%') OR m.scope = ?)`;
-            scopeClauseNoAlias = ` AND (scope IS NULL OR (scope NOT IN (${placeholders}) AND scope NOT LIKE '%:private:%') OR scope = ?)`;
-            scopeClauseTenantOnly = scopeClauseNoAlias;
-            scopeParams.push(...RECALL_DEFAULT_DENY_SCOPES, scopeFilter.value);
-        }
-        else {
-            // mode === 'exact'
-            scopeClauseAlias = ` AND m.scope = ?`;
-            scopeClauseNoAlias = ` AND scope = ?`;
-            scopeClauseTenantOnly = scopeClauseNoAlias;
-            scopeParams.push(scopeFilter.value);
-        }
-    }
-    const terms = Array.from(new Set(tokenize(query)));
-    if (terms.length === 0) {
-        // F3 (v1.7.0) self-review: empty-query path is the second uncapped
-        // path (codex diff-pass caught the full-store fallback at the bottom;
-        // this no-terms path had the same shape). Apply LIMIT so all four
-        // candidate paths honour the caller's cap when set.
-        const sql = `SELECT ${MEMORY_SELECT_COLUMNS} FROM memories${tenantOnlyPredicate}${archivedClauseTenantOnly}${scopeClauseTenantOnly} ORDER BY created ASC, id ASC LIMIT ?`;
-        // SAFETY: sql selects exactly MEMORY_SELECT_COLUMNS, whose column list
-        // matches MemoryRow's field set.
-        return db.prepare(sql).all(...tenantParams, ...scopeParams, limit);
-    }
-    // v1.7.1 — test/diagnostic hook: `HIPPO_FORCE_LIKE_PATH=1` forces the
-    // LIKE-fallback path here only. Gated at the read-call site so writes
-    // (`syncFtsRow`, `deleteFtsRow`, `raw-archive.ts::archiveRaw`) keep using
-    // `isFtsAvailable` honestly and never silently skip FTS index sync.
-    // Lets tests exercise the LIKE branch deterministically without
-    // poisoning the on-disk FTS state.
-    const forceLikePath = process.env.HIPPO_FORCE_LIKE_PATH === '1';
-    if (!forceLikePath && isFtsAvailable(db)) {
-        try {
-            const ftsQuery = terms.map((t) => `"${t.replace(/"/g, '""')}"`).join(' OR ');
-            // memories_fts virtual table has no tenant_id column; filter via the
-            // joined memories row (cheap with idx_memories_tenant_created leading
-            // on tenant_id).
-            // F1 (v1.7.0): MEMORY_SEARCH_COLUMNS adds bm25_score as the trailing
-            // result column. Every other column is m.<col> AS <col> so rowToEntry
-            // sees the same shape it always has.
-            // SAFETY: MEMORY_SEARCH_COLUMNS aliases every column to the same name
-            // MEMORY_SELECT_COLUMNS uses (plus bm25_score), matching MemoryRow.
-            const rows = db.prepare(`
-        SELECT ${MEMORY_SEARCH_COLUMNS}
-        FROM memories m
-        JOIN memories_fts f ON f.id = m.id
-        WHERE memories_fts MATCH ?${tenantPredicate}${archivedClauseAlias}${scopeClauseAlias}
-        ORDER BY bm25(memories_fts), m.updated_at DESC, m.content ASC, m.id ASC
-        LIMIT ?
-      `).all(ftsQuery, ...tenantParams, ...scopeParams, limit);
-            if (rows.length > 0)
-                return rows;
-        }
-        catch {
-            // Fall back to LIKE matching below.
-        }
-    }
-    const escapeLike = (term) => term.replace(/[%_\\]/g, '\\$&');
-    const where = terms.map(() => `(LOWER(content) LIKE ? ESCAPE '\\' OR LOWER(tags_json) LIKE ? ESCAPE '\\')`).join(' OR ');
-    const params = terms.flatMap((term) => {
-        const like = `%${escapeLike(term)}%`;
-        return [like, like];
-    });
-    // SAFETY: this query selects exactly MEMORY_SELECT_COLUMNS, matching
-    // MemoryRow's field set.
-    const rows = db.prepare(`
-    SELECT ${MEMORY_SELECT_COLUMNS}
-    FROM memories
-    WHERE (${where})${tenantPredicateNoAlias}${archivedClauseNoAlias}${scopeClauseNoAlias}
-    ORDER BY updated_at DESC, created DESC, content ASC, id ASC
-    LIMIT ?
-  `).all(...params, ...tenantParams, ...scopeParams, limit);
-    if (rows.length > 0)
-        return rows;
-    // F3 (v1.7.0) codex P1: pre-v1.7.0 the full-store fallback ignored
-    // `limit` and could return the whole tenant store. With scorerWindow
-    // now reported on RecallResult, an unbounded fallback would lie about
-    // candidate-pool size. Apply LIMIT here so all four paths honour the
-    // caller's cap.
-    const fallback = `SELECT ${MEMORY_SELECT_COLUMNS} FROM memories${tenantOnlyPredicate}${archivedClauseTenantOnly}${scopeClauseTenantOnly} ORDER BY created ASC, id ASC LIMIT ?`;
-    // SAFETY: fallback selects exactly MEMORY_SELECT_COLUMNS, matching
-    // MemoryRow's field set.
-    return db.prepare(fallback).all(...tenantParams, ...scopeParams, limit);
-}
-function writeMarkdownMirror(hippoRoot, entry) {
-    removeEntryMirrors(hippoRoot, entry.id);
-    const dir = layerDir(hippoRoot, entry.layer);
-    fs.mkdirSync(dir, { recursive: true });
-    fs.writeFileSync(path.join(dir, `${entry.id}.md`), serializeEntry(entry), 'utf8');
-}
-// AT1 P1 fix (codex): `writeMarkdownMirror` writes ANY layer's mirror,
-// including `trace/<id>.md` for Layer.Trace rows (auto-promoted traces,
-// consolidate.ts) — but this enumeration only walked
-// Buffer/Episodic/Semantic. A rejected/forgotten trace row's markdown
-// content survived on disk while the purge (and `hippo reject`/plain
-// `forget`) reported success, and a stale trace mirror is exactly the
-// resurrection channel bootstrapLegacyStore/rebuildIndex guard against.
-// Fixes BOTH the AT1 reject-flow purge and the pre-existing plain-`forget`
-// gap for trace rows (deleteEntry has always called this same function).
-export function removeEntryMirrors(hippoRoot, id) {
-    for (const layer of [Layer.Buffer, Layer.Episodic, Layer.Semantic, Layer.Trace]) {
-        const file = path.join(layerDir(hippoRoot, layer), `${id}.md`);
-        if (fs.existsSync(file)) {
-            fs.unlinkSync(file);
-        }
-    }
-}
-/**
- * AT1 mirror-purge honesty fix (docs/plans/2026-08-15-at1-rejected-value-tombstone.md):
- * the candidate markdown mirror paths still on disk for `id`, computed the
- * same way `removeEntryMirrors` walks them (one per layer: buffer/episodic/
- * semantic), filtered to the ones that still `fs.existsSync`. Used to report
- * an EXPLICIT path when a best-effort purge fails and no reaper exists to
- * retry it — plain `removeEntryMirrors` returns void, giving no way to name
- * which file is stuck.
- */
-export function getExistingEntryMirrorPaths(hippoRoot, id) {
-    // AT1 P1 fix (codex): same missing Layer.Trace as removeEntryMirrors above
-    // — kept in lockstep with it since this function's whole purpose is
-    // walking the mirror paths "the same way removeEntryMirrors walks them"
-    // (see its own doc comment).
-    return [Layer.Buffer, Layer.Episodic, Layer.Semantic, Layer.Trace]
-        .map((layer) => path.join(layerDir(hippoRoot, layer), `${id}.md`))
-        .filter((file) => fs.existsSync(file));
-}
-/**
- * AT1 fix: best-effort markdown-mirror purge shared by `reject-flow.ts`'s
- * `rejectValue` and `resolveConflict`'s post-commit purge. Both used to log
- * "will retry via reaper on next open" for EVERY failure, but the reaper
- * (`cleanupArchivedMirrors`, raw-archive-mirror-cleanup.ts) only scans
- * `raw_archive` — that message was false for a non-raw id, which has no
- * reaper at all.
- *
- * Retries the unlink once synchronously (the common real-world failure is a
- * transient lock/AV-scanner false positive, not a permanent one). On a
- * second failure: raw ids still get the honest reaper message (true); non-raw
- * ids get the EXPLICIT leftover file path(s) and a manual-delete instruction,
- * since nothing will ever retry them automatically.
- *
- * Returns true if the mirror ended up purged (first or second attempt).
- */
-export function purgeMirrorBestEffort(hippoRoot, id, isRaw, logPrefix) {
-    try {
-        removeEntryMirrors(hippoRoot, id);
-        return true;
-    }
-    catch {
-        try {
-            removeEntryMirrors(hippoRoot, id);
-            return true;
-        }
-        catch (secondErr) {
-            const msg = secondErr instanceof Error ? secondErr.message : String(secondErr);
-            if (isRaw) {
-                console.error(`${logPrefix}: mirror cleanup failed for ${id} (will retry via reaper on next open): ${msg}`);
-            }
-            else {
-                const leftover = getExistingEntryMirrorPaths(hippoRoot, id);
-                const pathsNote = leftover.length > 0 ? leftover.join(', ') : `${id}.md (path unresolved)`;
-                console.error(`${logPrefix}: mirror cleanup failed for ${id} - no automatic retry exists for this file, ` +
-                    `delete it manually: ${pathsNote} (${msg})`);
-            }
-            return false;
-        }
-    }
-}
-function bootstrapLegacyStore(db, hippoRoot) {
-    // SAFETY: countRow's shape matches the single `COUNT(*) AS count` column
-    // selected above; `.get()` returns undefined only when no row exists.
-    const countRow = db.prepare(`SELECT COUNT(*) AS count FROM memories`).get();
-    const memoryCount = Number(countRow?.count ?? 0);
-    if (memoryCount > 0)
-        return false;
-    // AT1 P2 fix: memoryCount alone is not a reliable "already bootstrapped"
-    // signal once the rejection guard exists. If EVERY legacy mirror row is
-    // rejected, memories stays at 0 rows even after a successful bootstrap
-    // pass, so the memoryCount>0 gate above never trips — every subsequent
-    // initStore() call would re-run this whole function: re-scan the legacy
-    // mirrors, re-attempt (and re-refuse, re-auditing) every row, and
-    // re-INSERT the legacy consolidation_runs rows with no dedup, duplicating
-    // them on each open. A dedicated meta flag marks bootstrap as
-    // attempted-and-settled regardless of how many rows actually landed.
-    if (getMeta(db, 'legacy_bootstrap_completed', '0') === '1')
-        return false;
-    const legacyEntries = loadLegacyEntriesFromMarkdown(hippoRoot);
-    if (legacyEntries.length === 0)
-        return false;
-    db.exec('BEGIN');
-    try {
-        // AT1 (plan §3, round-3 redesign): run the guard LIVE per row rather
-        // than bypassing it. bootstrapLegacyStore is exactly the channel through
-        // which a stale/never-purged markdown mirror could resurrect a rejected
-        // value; a skip-and-count here closes that structurally, independent of
-        // mirror state. The refusal audit is written INLINE inside this
-        // still-open loop transaction (plain audit() — nothing is rolled back
-        // on a per-row skip, so the post-rollback auditRejectionRefusal helper
-        // is the wrong tool here).
-        let rejectedCount = 0;
-        for (const entry of legacyEntries) {
-            // v39: legacy markdown carries no origin_project; stamp from the store
-            // location so bootstrapped rows stay visible to ambient context.
-            const stamped = stampOriginProjectForImport(hippoRoot, entry);
-            try {
-                upsertEntryRow(db, stamped);
-            }
-            catch (err) {
-                if (err instanceof RejectedValueError) {
-                    rejectedCount++;
-                    audit(db, 'reject_refusal', err.entryId, { digest: err.digest, reason: err.reason }, 'cli', err.tenantId);
-                    continue;
-                }
-                throw err;
-            }
-        }
-        if (rejectedCount > 0) {
-            console.error(`bootstrapLegacyStore: skipped ${rejectedCount} rejected value(s) found in legacy mirrors`);
-        }
-        const legacyIndex = loadLegacyIndexFile(hippoRoot);
-        setMeta(db, 'last_retrieval_ids', JSON.stringify(legacyIndex.last_retrieval_ids ?? []));
-        // LC1: legacy index.json predates last_trace_id, so this is '' for every
-        // pre-v40 store — harmless, matches the ensureMetaDefaults default.
-        // Coerce like its neighbors below coerce theirs (independent-review-critic
-        // LOW finding): accept only a clean digit string, else fall back to ''
-        // rather than trusting whatever a hand-edited/corrupt index.json carries.
-        const legacyTraceId = String(legacyIndex.last_trace_id ?? '');
-        setMeta(db, 'last_trace_id', /^\d+$/.test(legacyTraceId) ? legacyTraceId : '');
-        const legacyStats = loadLegacyStatsFile(hippoRoot);
-        setMeta(db, 'total_remembered', String(Number(legacyStats.total_remembered ?? 0)));
-        setMeta(db, 'total_recalled', String(Number(legacyStats.total_recalled ?? 0)));
-        setMeta(db, 'total_forgotten', String(Number(legacyStats.total_forgotten ?? 0)));
-        const runs = Array.isArray(legacyStats.consolidation_runs) ? legacyStats.consolidation_runs : [];
-        const insertRun = db.prepare(`INSERT INTO consolidation_runs(timestamp, decayed, merged, removed) VALUES (?, ?, ?, ?)`);
-        for (const run of runs) {
-            if (!isPlainJsonObject(run))
-                continue;
-            const row = run;
-            insertRun.run(String(row.timestamp ?? new Date().toISOString()), Number(row.decayed ?? 0), Number(row.merged ?? 0), Number(row.removed ?? 0));
-        }
-        // AT1 P2 fix: stamp completion regardless of how many rows actually
-        // landed (all-rejected included) — see the gate comment above.
-        setMeta(db, 'legacy_bootstrap_completed', '1');
-        db.exec('COMMIT');
-    }
-    catch (error) {
-        try {
-            db.exec('ROLLBACK');
-        }
-        catch { /* already rolled back; keep the original error */ }
-        throw error;
-    }
-    return true;
-}
-function loadLegacyEntriesFromMarkdown(hippoRoot) {
-    const entries = [];
-    for (const layer of [Layer.Buffer, Layer.Episodic, Layer.Semantic]) {
-        const dir = layerDir(hippoRoot, layer);
-        if (!fs.existsSync(dir))
-            continue;
-        for (const file of fs.readdirSync(dir)) {
-            if (!file.endsWith('.md'))
-                continue;
-            const raw = fs.readFileSync(path.join(dir, file), 'utf8');
-            const entry = deserializeEntry(raw);
-            if (entry)
-                entries.push(entry);
-        }
-    }
-    return entries;
-}
-function loadLegacyIndexFile(hippoRoot) {
-    const indexPath = path.join(hippoRoot, 'index.json');
-    if (!fs.existsSync(indexPath)) {
-        return { version: 1, entries: {}, last_retrieval_ids: [], last_trace_id: null };
-    }
-    try {
-        // SAFETY: index.json is only ever written by writeIndexMirror below,
-        // which always serializes a HippoIndex; a hand-edited or corrupted file
-        // that violates the shape falls through to the catch block's fallback.
-        return JSON.parse(fs.readFileSync(indexPath, 'utf8'));
-    }
-    catch {
-        return { version: 1, entries: {}, last_retrieval_ids: [], last_trace_id: null };
-    }
-}
-function loadLegacyStatsFile(hippoRoot) {
-    const statsPath = path.join(hippoRoot, 'stats.json');
-    if (!fs.existsSync(statsPath)) {
-        return {
-            total_remembered: 0,
-            total_recalled: 0,
-            total_forgotten: 0,
-            consolidation_runs: [],
-        };
-    }
-    try {
-        // SAFETY: stats.json is only ever written by writeStatsMirror below,
-        // which always emits exactly these four fields; callers additionally
-        // guard every read with `?? 0` / `Array.isArray`, tolerating a
-        // hand-edited or corrupted file even if this optimistic cast is wrong.
-        return JSON.parse(fs.readFileSync(statsPath, 'utf8'));
-    }
-    catch {
-        return {
-            total_remembered: 0,
-            total_recalled: 0,
-            total_forgotten: 0,
-            consolidation_runs: [],
-        };
-    }
-}
-/**
- * `bypassRejectionGuard` (AT1, plan §3): ONLY `batchWriteAndDelete`'s call
- * site passes `true`. Consolidation merges are DETERMINISTIC CONCATENATION
- * (mergeContents, consolidate.ts:736-751), not LLM paraphrase — the bypass
- * is safe because the producer (consolidate.ts's merge pass) now checks the
- * merged content's rejection digest against the tenant's tombstones BEFORE
- * ever assembling a batch to write, and skips the merge entirely on a hit.
- * Every other caller (writeEntryDbOnly, bootstrapLegacyStore, rebuildIndex)
- * leaves this false and the guard runs live.
- *
- * AT1 P1 fix (codex, batch-transaction rejection race): the producer check
- * above runs on a DIFFERENT connection BEFORE this transaction opens — a
- * `hippo reject X` that commits in that window is invisible to it. This
- * parameter's contract is UNCHANGED (still the sole bypass, still trusted
- * by the producer-side check for the common case); what changed is that
- * `batchWriteAndDelete` no longer trusts it BLINDLY. It now runs its own
- * in-transaction point-probe (same connection, same digest lookup this
- * function's guard would have done) immediately before each upsert and
- * skips — rather than writes — any entry whose content matches a tombstone
- * that landed after the producer's check. See batchWriteAndDelete for the
- * skip logic.
- */
-function upsertEntryRow(db, entry, bypassRejectionGuard = false) {
-    if (!bypassRejectionGuard) {
-        checkRejectionGuard(db, entry.tenantId ?? 'default', entry.id, entry.content);
-    }
-    db.prepare(`
-    INSERT INTO memories(
-      id, created, last_retrieved, retrieval_count, strength, half_life_days, layer,
-      tags_json, emotional_valence, schema_fit, source, outcome_score,
-      outcome_positive, outcome_negative,
-      conflicts_with_json, pinned, confidence, content,
-      parents_json, starred,
-      trace_outcome, source_session_id,
-      valid_from, superseded_by,
-      extracted_from,
-      dag_level, dag_parent_id,
-      kind, scope, owner, artifact_ref,
-      tenant_id, origin_project,
-      descendant_count, earliest_at, latest_at,
-      dag_level_3_built_at,
-      updated_at
-    ) VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, datetime('now'))
-    ON CONFLICT(id) DO UPDATE SET
-      created = excluded.created,
-      last_retrieved = excluded.last_retrieved,
-      retrieval_count = excluded.retrieval_count,
-      strength = excluded.strength,
-      half_life_days = excluded.half_life_days,
-      layer = excluded.layer,
-      tags_json = excluded.tags_json,
-      emotional_valence = excluded.emotional_valence,
-      schema_fit = excluded.schema_fit,
-      source = excluded.source,
-      outcome_score = excluded.outcome_score,
-      outcome_positive = excluded.outcome_positive,
-      outcome_negative = excluded.outcome_negative,
-      conflicts_with_json = excluded.conflicts_with_json,
-      pinned = excluded.pinned,
-      confidence = excluded.confidence,
-      content = excluded.content,
-      parents_json = excluded.parents_json,
-      starred = excluded.starred,
-      trace_outcome = excluded.trace_outcome,
-      source_session_id = excluded.source_session_id,
-      valid_from = excluded.valid_from,
-      superseded_by = excluded.superseded_by,
-      extracted_from = excluded.extracted_from,
-      dag_level = excluded.dag_level,
-      dag_parent_id = excluded.dag_parent_id,
-      kind = excluded.kind,
-      scope = excluded.scope,
-      owner = excluded.owner,
-      artifact_ref = excluded.artifact_ref,
-      tenant_id = excluded.tenant_id,
-      origin_project = excluded.origin_project,
-      descendant_count = excluded.descendant_count,
-      earliest_at = excluded.earliest_at,
-      latest_at = excluded.latest_at,
-      dag_level_3_built_at = excluded.dag_level_3_built_at,
-      updated_at = datetime('now')
-  `).run(entry.id, entry.created, entry.last_retrieved, entry.retrieval_count, entry.strength, entry.half_life_days, entry.layer, JSON.stringify(entry.tags ?? []), entry.emotional_valence, entry.schema_fit, entry.source, entry.outcome_score, entry.outcome_positive ?? 0, entry.outcome_negative ?? 0, JSON.stringify(entry.conflicts_with ?? []), entry.pinned ? 1 : 0, entry.confidence, entry.content, JSON.stringify(entry.parents ?? []), entry.starred ? 1 : 0, entry.trace_outcome ?? null, entry.source_session_id ?? null, entry.valid_from ?? entry.created, entry.superseded_by ?? null, entry.extracted_from ?? null, entry.dag_level ?? 0, entry.dag_parent_id ?? null, entry.kind ?? 'distilled', entry.scope ?? null, entry.owner ?? null, entry.artifact_ref ?? null, entry.tenantId ?? 'default', entry.origin_project ?? null, entry.descendant_count ?? 0, entry.earliest_at ?? null, entry.latest_at ?? null, entry.dag_level_3_built_at ?? null);
-    syncFtsRow(db, entry);
-}
-function syncFtsRow(db, entry) {
-    if (!isFtsAvailable(db))
-        return;
-    try {
-        db.prepare(`DELETE FROM memories_fts WHERE id = ?`).run(entry.id);
-        db.prepare(`INSERT INTO memories_fts(id, content, tags) VALUES (?, ?, ?)`).run(entry.id, entry.content, entry.tags.join(' '));
-    }
-    catch {
-        // Best effort only. SQLite store is still authoritative even if FTS is unavailable.
-    }
-}
-function deleteFtsRow(db, id) {
-    if (!isFtsAvailable(db))
-        return;
-    try {
-        db.prepare(`DELETE FROM memories_fts WHERE id = ?`).run(id);
-    }
-    catch {
-        // Best effort.
-    }
-}
-/**
- * Derive the current `HippoIndex` (entries + last-retrieval/trace lockstep
- * meta) from SQLite, the source of truth. Exported (AT1) for the same
- * reason as `writeIndexMirror` below: `src/reject-flow.ts` needs to rebuild
- * the index mirror post-commit after a (possibly multi-row) reject removal,
- * without duplicating this query.
- */
-export function buildIndexFromDb(db) {
-    // SAFETY: rows' shape matches the seven columns named in the SELECT below.
-    const rows = db.prepare(`SELECT id, created, last_retrieved, strength, layer, tags_json, pinned FROM memories ORDER BY created ASC, id ASC`).all();
-    const entries = {};
-    for (const row of rows) {
-        // SAFETY: layer is only ever written from the Layer enum by this
-        // module's own INSERT/UPDATE paths.
-        const layer = row.layer;
-        entries[row.id] = {
-            id: row.id,
-            file: path.join(layer, `${row.id}.md`),
-            layer,
-            strength: Number(row.strength ?? 0),
-            tags: parseJsonArray(row.tags_json),
-            created: row.created,
-            last_retrieved: row.last_retrieved,
-            pinned: Boolean(row.pinned),
-        };
-    }
-    // LC1 codex round-2 med: the two lockstep keys must be read in ONE
-    // statement. Two autocommit SELECTs leave a window where a concurrent
-    // saveIndex (which commits both keys in one transaction) lands between
-    // them, handing the reader mismatched last_retrieval_ids / last_trace_id
-    // and re-opening the mislinkage hole saveIndex's BEGIN/COMMIT closed on
-    // the write side. One SELECT = one SQLite read snapshot.
-    // SAFETY: lockstepRows' shape matches the key/value columns named above.
-    const lockstepRows = db.prepare(`SELECT key, value FROM meta WHERE key IN ('last_retrieval_ids', 'last_trace_id')`).all();
-    const lockstep = new Map(lockstepRows.map((r) => [r.key, r.value]));
-    return {
-        version: INDEX_VERSION,
-        entries,
-        last_retrieval_ids: parseJsonArray(lockstep.get('last_retrieval_ids') ?? '[]'),
-        last_trace_id: parseLastTraceId(lockstep.get('last_trace_id') ?? ''),
-    };
-}
-function buildStatsFromDb(db) {
-    // SAFETY: runs' shape matches the four columns named in the SELECT above.
-    const runs = db.prepare(`SELECT timestamp, decayed, merged, removed FROM consolidation_runs ORDER BY timestamp ASC, id ASC`).all();
-    return {
-        total_remembered: Number(getMeta(db, 'total_remembered', '0')),
-        total_recalled: Number(getMeta(db, 'total_recalled', '0')),
-        total_forgotten: Number(getMeta(db, 'total_forgotten', '0')),
-        consolidation_runs: runs.map((run) => ({
-            timestamp: run.timestamp,
-            decayed: run.decayed,
-            merged: run.merged,
-            removed: run.removed,
-        })),
-    };
-}
-/**
- * Write the `index.json` mirror file for a given (already-derived) index.
- * Exported (AT1) so `src/reject-flow.ts` can replicate `deleteEntry`'s exact
- * post-commit "removeEntryMirrors then rewrite the index once" sequence for
- * the reject verb's (possibly multi-row) removal, without duplicating
- * `buildIndexFromDb`'s query.
- */
-export function writeIndexMirror(hippoRoot, index) {
-    fs.writeFileSync(path.join(hippoRoot, 'index.json'), JSON.stringify(index, null, 2), 'utf8');
-}
-function writeStatsMirror(hippoRoot, stats) {
-    fs.writeFileSync(path.join(hippoRoot, 'stats.json'), JSON.stringify(stats, null, 2), 'utf8');
-}
-function syncMirrorFiles(hippoRoot, db) {
-    // SAFETY: this query selects exactly MEMORY_SELECT_COLUMNS, matching
-    // MemoryRow's field set.
-    const entries = db.prepare(`SELECT ${MEMORY_SELECT_COLUMNS} FROM memories ORDER BY created ASC, id ASC`).all();
-    for (const entry of entries.map(rowToEntry)) {
-        writeMarkdownMirror(hippoRoot, entry);
-    }
-    // SAFETY: conflicts' shape matches the eight columns named in the SELECT
-    // above.
-    const conflicts = db.prepare(`
-    SELECT id, memory_a_id, memory_b_id, reason, score, status, detected_at, updated_at
-    FROM memory_conflicts
-    WHERE status = 'open'
-    ORDER BY updated_at DESC, id DESC
-  `).all();
-    writeConflictMirrors(hippoRoot, conflicts.map(rowToMemoryConflict));
-    writeIndexMirror(hippoRoot, buildIndexFromDb(db));
-    writeStatsMirror(hippoRoot, buildStatsFromDb(db));
-}
-/**
- * Load the current derived index from SQLite and refresh the mirror file.
- */
-export function loadIndex(hippoRoot) {
-    initStore(hippoRoot);
-    const db = openHippoDb(hippoRoot);
-    try {
-        const index = buildIndexFromDb(db);
-        writeIndexMirror(hippoRoot, index);
-        return index;
-    }
-    finally {
-        closeHippoDb(db);
-    }
-}
-/**
- * Persist mutable index metadata. Entry rows themselves are derived from SQLite.
- *
- * LC1 F1(c) structural fix: `last_retrieval_ids` and `last_trace_id` must
- * land atomically — callers (getContext, cmdRecall) fold a freshly-written
- * trace id into `index.last_trace_id` before calling this, relying on BOTH
- * meta keys committing together. Wrapped in BEGIN/COMMIT so a crash or a
- * mid-write failure can never advance one key without the other. The
- * filesystem mirror write stays AFTER commit — the DB is the source of
- * truth, the mirror is best-effort (matches every other per-call-handle
- * site's convention).
- */
-export function saveIndex(hippoRoot, index) {
-    initStore(hippoRoot);
-    const db = openHippoDb(hippoRoot);
-    try {
-        db.exec('BEGIN');
-        try {
-            setMeta(db, 'last_retrieval_ids', JSON.stringify(index.last_retrieval_ids ?? []));
-            setMeta(db, 'last_trace_id', index.last_trace_id ?? '');
-            db.exec('COMMIT');
-        }
-        catch (error) {
-            try {
-                db.exec('ROLLBACK');
-            }
-            catch { /* already rolled back; keep the original error */ }
-            throw error;
-        }
-        writeIndexMirror(hippoRoot, buildIndexFromDb(db));
-    }
-    finally {
-        closeHippoDb(db);
-    }
-}
-/**
- * Write a memory entry to SQLite and refresh compatibility mirrors.
- *
- * `opts.actor` defaults to 'cli' so unauthenticated direct-CLI callers still
- * get the right audit attribution. The HTTP server (A1) and api.* layer pass
- * the resolved actor (`api_key:<key_id>` / `localhost:cli`) so audit events
- * land with one row per write, no double-emit.
- *
- * `opts.afterWrite` is invoked inside the same SAVEPOINT as the memories
- * INSERT (mirrors archiveRawMemory's shape in raw-archive.ts). On callback
- * throw, the SAVEPOINT rolls back — the memory row never lands, and the
- * filesystem mirrors / audit emit never run. Used by E1.3+ connectors to
- * stamp idempotency rows atomically with the memory write.
- */
-/**
- * Stamp origin_project from the store's own location when the entry has
- * never been stamped (v39 memory scope isolation). The store dir is
- * `<project>/.hippo`, so its parent resolves to the owning project; the
- * home/global store resolves to '' (user-global). Callers that know a better
- * origin (shareMemory, syncGlobalToLocal) set entry.origin_project before
- * writing and this is a no-op. Returns a stamped copy; never mutates.
- *
- * NULL is deliberately PRESERVED, not re-stamped: null means "legacy row the
- * v39 migration found no evidence for" and is deny-by-default in ambient
- * context. A writeback (e.g. markRetrieved on a crossProject-included row)
- * must not launder it into an injectable origin - the migration is the only
- * evidence-based NULL converter (codex gating round 2 P1).
- */
-export function stampOriginProject(hippoRoot, entry) {
-    if (entry.origin_project !== undefined)
-        return entry;
-    return { ...entry, origin_project: deriveOriginProject(path.dirname(hippoRoot)) };
-}
-/**
- * Import-time variant that ALSO stamps null: used only where evidence exists
- * for rows that predate the origin column - the legacy-markdown bootstrap and
- * rebuildIndex import, which are the markdown-store equivalent of the v39 SQL
- * backfill. Same evidence order as the migration: the provenance source
- * (`shared:<project>:` / `promoted:<localRoot>`) wins over the destination
- * store's location, so a shared row imported into the global store keeps its
- * owning project instead of becoming user-global (codex gating round 3 P1).
- */
-function stampOriginProjectForImport(hippoRoot, entry) {
-    if (entry.origin_project !== undefined && entry.origin_project !== null)
-        return entry;
-    const fromSource = originFromSource(entry.source);
-    return {
-        ...entry,
-        origin_project: fromSource ?? deriveOriginProject(path.dirname(hippoRoot)),
-    };
-}
-export function writeEntry(hippoRoot, entry, opts) {
-    initStore(hippoRoot);
-    const stamped = stampOriginProject(hippoRoot, entry);
-    const db = openHippoDb(hippoRoot);
-    try {
-        writeEntryDbOnly(db, stamped, opts);
-        opts?.afterCommit?.();
-        writeEntryMirrors(hippoRoot, db, stamped);
-    }
-    catch (error) {
-        // AT1 (plan §3): writeEntryDbOnly's own SAVEPOINT has already unwound by
-        // the time this catch runs, so the refusal audit lands post-rollback in
-        // a fresh implicit transaction — then rethrow so the caller sees the
-        // refusal.
-        if (error instanceof RejectedValueError) {
-            auditRejectionRefusal(db, error, opts?.actor ?? 'cli');
-        }
-        throw error;
-    }
-    finally {
-        closeHippoDb(db);
-    }
-}
-/**
- * DB-only write path. Caller owns the open `db` handle. Runs SAVEPOINT +
- * upsert + afterWrite hook + audit row inside the SAVEPOINT scope. Caller
- * is responsible for opening `db`, optionally wrapping in a larger BEGIN/
- * COMMIT (e.g. supersede's BEGIN IMMEDIATE), closing `db`, AND calling
- * `writeEntryMirrors` after the larger tx commits — mirrors must run
- * post-commit so a rolled-back tx never leaves orphan markdown.
- *
- * Audit-order note: the audit row is emitted INSIDE the SAVEPOINT, so audit
- * commits atomically with the row INSERT. A subsequent mirror failure cannot
- * leave a recorded audit entry without its corresponding DB row. This is a
- * documented hardening over the prior writeEntry-as-monolith ordering.
- */
-export function writeEntryDbOnly(db, entry, opts) {
-    // SAVEPOINT (not BEGIN) so this nests safely inside any outer transaction
-    // a caller might hold (e.g. supersede's BEGIN IMMEDIATE). SQLite refuses
-    // BEGIN within a transaction; SAVEPOINT is the only way to scope rollback
-    // without disturbing outers.
-    db.exec('SAVEPOINT write_entry');
-    try {
-        upsertEntryRow(db, entry);
-        if (opts?.afterWrite) {
-            opts.afterWrite(db, entry.id);
-        }
-        audit(db, 'remember', entry.id, {
-            kind: entry.kind ?? 'distilled',
-            scope: entry.scope ?? null,
-        }, opts?.actor ?? 'cli', entry.tenantId);
-        // v0.30 / E2 — DAG live-coupling: child write under a level-2 summary
-        // marks the parent dirty for E3 sleep-cycle rebuild. Early-exit on
-        // null dag_parent_id (vast majority of writes); cost is one null check
-        // on the hot path.
-        if (entry.dag_parent_id) {
-            markSummaryDirtyInTx(db, entry.dag_parent_id, entry.tenantId, opts?.actor ?? 'cli');
-        }
-        db.exec('RELEASE SAVEPOINT write_entry');
-    }
-    catch (e) {
-        try {
-            db.exec('ROLLBACK TO SAVEPOINT write_entry');
-            db.exec('RELEASE SAVEPOINT write_entry');
-        }
-        catch {
-            // Ignore rollback failures — the throw below is what matters.
-        }
-        throw e;
-    }
-}
-/**
- * Filesystem mirrors path. Caller passes `hippoRoot` + an open `db` handle
- * (used by `buildIndexFromDb` to derive the index from the source of truth).
- * MUST be invoked AFTER the outer transaction commits — a mirror write
- * during a tx that subsequently rolls back would leave orphan markdown.
- */
-export function writeEntryMirrors(hippoRoot, db, entry) {
-    writeMarkdownMirror(hippoRoot, entry);
-    writeIndexMirror(hippoRoot, buildIndexFromDb(db));
-}
-/**
- * Read a memory entry by ID.
- *
- * When `tenantId` is provided, the read is scoped to that tenant (cross-tenant
- * lookups return null). When omitted, no tenant filter is applied — preserves
- * legacy single-tenant callers and the writeEntry/readEntry round-trip.
- */
-export function readEntry(hippoRoot, id, tenantId) {
-    initStore(hippoRoot);
-    const db = openHippoDb(hippoRoot);
-    try {
-        // SAFETY: both branches select exactly MEMORY_SELECT_COLUMNS, matching
-        // MemoryRow's field set.
-        const row = tenantId !== undefined
-            ? db.prepare(`SELECT ${MEMORY_SELECT_COLUMNS} FROM memories WHERE id = ? AND tenant_id = ?`).get(id, tenantId)
-            : db.prepare(`SELECT ${MEMORY_SELECT_COLUMNS} FROM memories WHERE id = ?`).get(id);
-        return row ? rowToEntry(row) : null;
-    }
-    finally {
-        closeHippoDb(db);
-    }
-}
-/**
- * Batched lookup. Caps at 500 ids per call to keep the IN(?,?,...) clause
- * within SQLite limits. Tenant filter is enforced when `tenantId` is passed.
- * Used by DAG-aware recall (docs/plans/2026-05-05-dag-recall.md Task 1.5)
- * to fetch parent summaries for a set of overflowed leaves.
- */
-export function loadEntriesByIds(hippoRoot, ids, tenantId) {
-    if (ids.length === 0)
-        return [];
-    const capped = ids.slice(0, 500);
-    initStore(hippoRoot);
-    const db = openHippoDb(hippoRoot);
-    try {
-        const placeholders = capped.map(() => '?').join(',');
-        // T2: no ORDER BY meant row order followed SQLite's IN(...) scan order
-        // (undefined w.r.t. the caller's `ids` order). created ASC, id ASC
-        // makes it deterministic.
-        // SAFETY: both branches select exactly MEMORY_SELECT_COLUMNS, matching
-        // MemoryRow's field set.
-        const rows = tenantId !== undefined
-            ? db.prepare(`SELECT ${MEMORY_SELECT_COLUMNS} FROM memories WHERE id IN (${placeholders}) AND tenant_id = ? ORDER BY created ASC, content ASC, id ASC`).all(...capped, tenantId)
-            : db.prepare(`SELECT ${MEMORY_SELECT_COLUMNS} FROM memories WHERE id IN (${placeholders}) ORDER BY created ASC, content ASC, id ASC`).all(...capped);
-        return rows.map(rowToEntry);
-    }
-    finally {
-        closeHippoDb(db);
-    }
-}
-/**
- * All `kind='raw'` rows for a given session, tenant-scoped, returned
- * oldest-first. Used by `api.assemble` to walk a session's chronological
- * context. Excludes superseded rows.
- *
- * Cap semantics (v1.6.2 codex fix): when `cap` is provided, the NEWEST
- * `cap` rows are loaded — `ORDER BY created DESC LIMIT cap` server-side,
- * reversed to oldest-first client-side. Pre-v1.6.2 ordered ASC + LIMIT,
- * which silently dropped the newest rows and broke fresh-tail in assemble.
- *
- * Returns `[]` for an empty sessionId. Final order: `created ASC, id ASC`.
- */
-export function loadSessionRawMemories(hippoRoot, sessionId, tenantId, cap) {
-    if (!sessionId)
-        return [];
-    initStore(hippoRoot);
-    const db = openHippoDb(hippoRoot);
-    try {
-        const params = [];
-        let sql = `SELECT ${MEMORY_SELECT_COLUMNS} FROM memories WHERE kind = 'raw' AND source_session_id = ? AND superseded_by IS NULL`;
-        params.push(sessionId);
-        if (tenantId !== undefined) {
-            sql += ' AND tenant_id = ?';
-            params.push(tenantId);
-        }
-        if (cap !== undefined && cap > 0) {
-            sql += ' ORDER BY created DESC, id DESC LIMIT ?';
-            params.push(cap);
-            // SAFETY: sql starts from MEMORY_SELECT_COLUMNS, matching MemoryRow.
-            const rows = db.prepare(sql).all(...params);
-            return rows.reverse().map(rowToEntry);
-        }
-        sql += ' ORDER BY created ASC, id ASC';
-        // SAFETY: sql starts from MEMORY_SELECT_COLUMNS, matching MemoryRow.
-        const rows = db.prepare(sql).all(...params);
-        return rows.map(rowToEntry);
-    }
-    finally {
-        closeHippoDb(db);
-    }
-}
-/**
- * Pre-cap, scope-aware row count for a session. Lets `assemble` report
- * the full session size even when `rowCap` truncates the loaded window,
- * WITHOUT leaking rows the caller wouldn't have been allowed to load.
- *
- * v1.6.3 codex P1 / senior P0: an earlier draft of this helper ran an
- * unscoped COUNT, which let a no-scope caller infer the existence of
- * private rows by comparing `totalRaw` against `items.length`. This
- * version SQL-encodes the same default-deny rule `passesScopeFilterForRecall`
- * applies in TS:
- *   - explicit scope passed: exact-match
- *   - no scope: rows where scope IS NULL, or scope is NOT a `<source>:private:*`
- *     pattern AND not the `unknown:legacy` quarantine bucket.
- *
- * `tenantId` is optional for back-compat. Pass `undefined` only when
- * intentionally counting cross-tenant; `assemble()` passes `ctx.tenantId`.
- */
-export function countSessionRawMemories(hippoRoot, sessionId, tenantId, scope) {
-    if (!sessionId)
-        return 0;
-    initStore(hippoRoot);
-    const db = openHippoDb(hippoRoot);
-    try {
-        const params = [];
-        let sql = `SELECT COUNT(*) AS c FROM memories WHERE kind = 'raw' AND source_session_id = ? AND superseded_by IS NULL`;
-        params.push(sessionId);
-        if (tenantId !== undefined) {
-            sql += ' AND tenant_id = ?';
-            params.push(tenantId);
-        }
-        if (scope !== undefined && scope !== '') {
-            sql += ' AND scope = ?';
-            params.push(scope);
-        }
-        else {
-            // SQL-ify the TS default-deny: scope IS NULL OR (NOT LIKE '%:private:%'
-            // AND != 'unknown:legacy'). Mirrors api.passesScopeFilterForRecall.
-            sql += ` AND (scope IS NULL OR (scope NOT LIKE '%:private:%' AND scope != 'unknown:legacy'))`;
-        }
-        // SAFETY: row's shape matches the single `COUNT(*) AS c` column above.
-        const row = db.prepare(sql).get(...params);
-        return Number(row?.c ?? 0);
-    }
-    finally {
-        closeHippoDb(db);
-    }
-}
-/**
- * Last N kind='raw' memories by `created` desc. Tenant scoped. When
- * `sessionId` is supplied, also constrains to a specific session — that
- * is the correct shape for "what did I just see in THIS session."
- *
- * v1.6.2 codex review fix: pre-v1.6.2 was tenant-wide only. With multiple
- * concurrent sessions in a tenant, fresh-tail recall surfaced unrelated
- * rows from other sessions and stamped them `isFreshTail=true`. Callers
- * that want session-scoped fresh-tail now pass `sessionId`. The
- * tenant-wide form (no sessionId) still exists for "anything new across
- * the whole tenant" — pass undefined to opt in.
- *
- * Bounded count cap at 200 — beyond that the caller should filter via
- * tags/scope rather than time-windowed recall.
- *
- * Deprecation note (v1.6.5) — the **tenant-wide call shape** (omitting
- * `sessionId`) is rarely the right shape for "what did I just see in this
- * conversation". `api.recall` enforces session scoping when
- * `HIPPO_REQUIRE_SESSION_SCOPED_FRESH_TAIL=1` is set, throwing
- * `RecallContractError` instead. Tenant-wide remains the back-compat default
- * but is discouraged for new callers. Passing `sessionId` is fully supported
- * and recommended; this function is NOT deprecated as a whole.
- */
-export function loadFreshRawMemories(hippoRoot, count, tenantId, sessionId) {
-    if (count <= 0)
-        return [];
-    const capped = Math.min(count, 200);
-    initStore(hippoRoot);
-    const db = openHippoDb(hippoRoot);
-    try {
-        const params = [];
-        let sql = `SELECT ${MEMORY_SELECT_COLUMNS} FROM memories WHERE kind = 'raw' AND superseded_by IS NULL`;
-        if (tenantId !== undefined) {
-            sql += ' AND tenant_id = ?';
-            params.push(tenantId);
-        }
-        if (sessionId !== undefined && sessionId !== '') {
-            sql += ' AND source_session_id = ?';
-            params.push(sessionId);
-        }
-        // T2: tie tail keeps the LIMIT window keyed on `created` while making
-        // same-`created` rows deterministic. `content` before `id` (codex
-        // review): ids are random UUIDs, so an id-only tail would pick WHICH
-        // same-created rows make the window per-instance; content is
-        // cross-ingest-stable.
-        sql += ' ORDER BY created DESC, content ASC, id ASC LIMIT ?';
-        params.push(capped);
-        // SAFETY: sql starts from MEMORY_SELECT_COLUMNS, matching MemoryRow.
-        const rows = db.prepare(sql).all(...params);
-        return rows.map(rowToEntry);
-    }
-    finally {
-        closeHippoDb(db);
-    }
-}
-/**
- * Direct DAG children of a parent summary. Tenant scoped. Returns only rows
- * whose `dag_parent_id` matches `parentId`; does NOT walk recursively.
- * Used by `drillDown` (Task 3).
- */
-export function loadChildrenOf(hippoRoot, parentId, tenantId) {
-    initStore(hippoRoot);
-    const db = openHippoDb(hippoRoot);
-    try {
-        // SAFETY: both branches select exactly MEMORY_SELECT_COLUMNS, matching
-        // MemoryRow's field set.
-        const rows = tenantId !== undefined
-            ? db.prepare(`SELECT ${MEMORY_SELECT_COLUMNS} FROM memories WHERE dag_parent_id = ? AND tenant_id = ? ORDER BY created ASC, id ASC`).all(parentId, tenantId)
-            : db.prepare(`SELECT ${MEMORY_SELECT_COLUMNS} FROM memories WHERE dag_parent_id = ? ORDER BY created ASC, id ASC`).all(parentId);
-        return rows.map(rowToEntry);
-    }
-    finally {
-        closeHippoDb(db);
-    }
-}
-/**
- * AT1 (plan §4, round-2 fix, designed from source): db-scoped delete core.
- * `deleteEntry` used to open+close its OWN connection, which meant it could
- * never compose inside a caller's transaction (unlike writeEntry/
- * writeEntryDbOnly, which already split this way). Split identically: row-
- * meta SELECT, `DELETE FROM memories`, FTS delete, `forget` audit, DAG
- * dirty-mark. NO filesystem I/O — the caller's own transaction may still be
- * rolled back, and mirror writes must only happen post-commit.
- *
- * `opts.suppressForgetAudit` (default false, off): two AT1 callers set this
- * so a removed non-raw row does NOT ALSO emit a `forget` row, because each
- * already writes its own aggregate audit trail — `src/reject-flow.ts`'s
- * `rejectValue` (single `reject_value` row covering every same-digest row
- * removed) and `resolveConflict` (`conflict_resolve` row per resolution).
- * Default keeps `deleteEntry` byte-identical to its pre-split behavior.
- *
- * Returns `{tenantId, dagParentId}` for the removed row, or `null` if no row
- * with `id` existed.
- */
-export function deleteEntryCore(db, id, opts) {
-    // SAFETY: row's shape matches the three columns named in the SELECT above.
-    const row = db
-        .prepare(`SELECT id, tenant_id, dag_parent_id FROM memories WHERE id = ?`)
-        .get(id);
-    if (!row?.id)
-        return null;
-    db.prepare(`DELETE FROM memories WHERE id = ?`).run(id);
-    deleteFtsRow(db, id);
-    if (!opts?.suppressForgetAudit) {
-        audit(db, 'forget', id, undefined, opts?.actor ?? 'cli', row.tenant_id);
-    }
-    // v0.30 / E2 — DAG live-coupling: forget of a child under a level-2
-    // summary marks parent dirty. Non-atomic with the DELETE (no SAVEPOINT
-    // wrapper here, same as pre-split deleteEntry); markSummaryDirtyInTx is
-    // idempotent so any future child mutation re-marks parent if this fails.
-    // Acceptable degradation, mirrors the pre-split audit best-effort posture.
-    if (row.dag_parent_id) {
-        markSummaryDirtyInTx(db, row.dag_parent_id, row.tenant_id ?? 'default', opts?.actor ?? 'cli');
-    }
-    return { tenantId: row.tenant_id ?? 'default', dagParentId: row.dag_parent_id ?? null };
-}
-/**
- * Delete an entry from SQLite and mirrors.
- *
- * `opts.actor` defaults to 'cli'. The api.* layer threads `ctx.actor` so HTTP
- * callers land with `api_key:<key_id>` in the audit log without a duplicate
- * emit from the api wrapper.
- *
- * Thin wrapper over `deleteEntryCore` (open → core → mirrors → close);
- * behavior is byte-identical to the pre-split implementation for every
- * existing caller.
- */
-export function deleteEntry(hippoRoot, id, opts) {
-    initStore(hippoRoot);
-    const db = openHippoDb(hippoRoot);
-    try {
-        const result = deleteEntryCore(db, id, opts);
-        if (!result)
-            return false;
-        removeEntryMirrors(hippoRoot, id);
-        writeIndexMirror(hippoRoot, buildIndexFromDb(db));
-        return true;
-    }
-    finally {
-        closeHippoDb(db);
-    }
-}
-/**
- * Batch-write and batch-delete entries in a single transaction.
- * Used by consolidation to avoid N open/close cycles.
- */
-export function batchWriteAndDelete(hippoRoot, toWrite, toDeleteIds) {
-    if (toWrite.length === 0 && toDeleteIds.length === 0)
-        return;
-    initStore(hippoRoot);
-    const db = openHippoDb(hippoRoot);
-    try {
-        // BEGIN IMMEDIATE (codex delta-review P2): the AT1 tombstone probes below
-        // READ before the first write. Under a deferred BEGIN, that read pins a
-        // WAL snapshot; a concurrent writer (e.g. `hippo reject`) committing
-        // between probe and first upsert would make the later write-lock upgrade
-        // fail with SQLITE_BUSY and roll back the ENTIRE batch — the exact race
-        // the probe exists to contain. Taking the write lock up front serializes
-        // the probe and the writes on one consistent snapshot.
-        db.exec('BEGIN IMMEDIATE');
-        // v0.30 / E2 — DAG live-coupling: BEFORE deletes, snapshot dag_parent_id
-        // for every doomed row so we can mark parents dirty post-COMMIT. Done
-        // inside the same BEGIN so the SELECT sees pre-delete state.
-        // independent-review-critic R1 HIGH: consolidate.ts/sleep flushes through
-        // this path every cycle; without these hooks parents NEVER get marked
-        // dirty for the dominant mutation source (decay, merge, garbage-collect).
-        const dirtyParents = new Set();
-        const tenantById = new Map();
-        if (toDeleteIds.length > 0) {
-            const placeholders = toDeleteIds.map(() => '?').join(',');
-            // SAFETY: rows' shape matches the two columns named in the SELECT
-            // above.
-            const rows = db.prepare(`SELECT dag_parent_id, tenant_id FROM memories WHERE id IN (${placeholders})`).all(...toDeleteIds);
-            for (const row of rows) {
-                if (row.dag_parent_id) {
-                    dirtyParents.add(row.dag_parent_id);
-                    tenantById.set(row.dag_parent_id, row.tenant_id ?? 'default');
-                }
-            }
-        }
-        // v39: consolidate's new semantic rows (and any other batch writer)
-        // bypass writeEntry, so stamp store-derived origins here too - a NULL
-        // origin would make freshly consolidated memories vanish from ambient
-        // context (codex gating review P1).
-        const stampedWrites = toWrite.map((e) => stampOriginProject(hippoRoot, e));
-        // AT1 P1 fix (codex, batch-transaction rejection race): the producer-side
-        // check (e.g. consolidate.ts's merge pass) runs BEFORE this transaction,
-        // on a different connection. A `hippo reject X` that commits in that
-        // window is invisible to it — a queued same-id write of X already
-        // sitting in `toWrite` (decay/replay re-persist, or a merge built before
-        // the reject) would silently re-INSERT the just-rejected row via the
-        // blind bypass. Fix: one indexed point probe per batch entry, on THIS
-        // connection, INSIDE this transaction — closes the race regardless of
-        // which write class hits it. N is small per sleep, so the extra query
-        // per entry is cheap.
-        //
-        // Skip, don't throw: the batch must still complete for every OTHER
-        // entry. Skipping is correct for every write class here — a merge
-        // summary skip just means that rollup is absent this cycle (its source
-        // facts stay merely demoted, recoverable next sleep); a skipped
-        // demotion/replay re-persist of a rejected-removed row means it stays
-        // gone, which is the entire point of the tombstone.
-        let batchRejectedSkips = 0;
-        const skippedWriteIds = new Set();
-        for (const entry of stampedWrites) {
-            const entryTenantId = entry.tenantId ?? 'default';
-            // Codex delta-review P2 fix: reuse checkRejectionGuard rather than a
-            // bare tombstone probe — the guard's content-INTRODUCTION
-            // classification must apply here too. A tombstone can legitimately
-            // coexist with a live same-content row (resolveConflict deliberately
-            // excludes keepId from its sweep; unreject-then-re-reject windows), and
-            // an unconditional skip would starve that row of decay/replay metadata
-            // updates forever. The guard throws only when the write is new-row or
-            // changes content TO the rejected value; unchanged same-id re-persists
-            // pass through, exactly as on the writeEntry path.
-            try {
-                checkRejectionGuard(db, entryTenantId, entry.id, entry.content);
-            }
-            catch (err) {
-                if (err instanceof RejectedValueError) {
-                    batchRejectedSkips++;
-                    skippedWriteIds.add(entry.id);
-                    audit(db, 'reject_refusal', entry.id, { digest: err.digest, reason: err.reason }, 'sleep-batch', entryTenantId);
-                    continue;
-                }
-                throw err;
-            }
-            // AT1 (plan §3, corrected): bypass the rejection guard here.
-            // Consolidation merges are DETERMINISTIC CONCATENATION (mergeContents,
-            // consolidate.ts:736-751) of already-guarded leaf facts, not an LLM
-            // paraphrase — refusing mid-batch would abort the whole consolidation
-            // transaction. The bypass is safe because consolidate.ts's merge pass
-            // now checks the merged content's rejection digest against the
-            // tenant's tombstones BEFORE ever pushing a merge into pendingWrites,
-            // skipping that merge entirely on a hit, AND because the point-probe
-            // immediately above closes the race window between that producer
-            // check and this COMMIT. The guard itself still belongs on leaf
-            // inserts, which write through writeEntry / writeEntryDbOnly and stay
-            // guarded (bypassRejectionGuard defaults false).
-            upsertEntryRow(db, entry, true);
-            // Hook for writes: child upserted under a level-2 summary marks parent dirty.
-            if (entry.dag_parent_id) {
-                dirtyParents.add(entry.dag_parent_id);
-                tenantById.set(entry.dag_parent_id, entry.tenantId);
-            }
-        }
-        for (const id of toDeleteIds) {
-            db.prepare('DELETE FROM memories WHERE id = ?').run(id);
-            deleteFtsRow(db, id);
-        }
-        // Fire dirty-mark for every collected parent INSIDE the BEGIN, so the
-        // dirty flag commits atomically with the writes + deletes.
-        for (const parentId of dirtyParents) {
-            markSummaryDirtyInTx(db, parentId, tenantById.get(parentId) ?? 'default', 'batch');
-        }
-        db.exec('COMMIT');
-        if (batchRejectedSkips > 0) {
-            console.error(`batchWriteAndDelete: skipped ${batchRejectedSkips} write(s) whose content matches a rejected value (tombstone hit during the batch transaction)`);
-        }
-        // Sync mirrors once after all DB writes. Entries skipped above were
-        // never inserted — writing their markdown mirror would resurrect the
-        // exact content the skip just kept out of the DB.
-        for (const entry of stampedWrites) {
-            if (skippedWriteIds.has(entry.id))
-                continue;
-            writeMarkdownMirror(hippoRoot, entry);
-        }
-        for (const id of toDeleteIds) {
-            removeEntryMirrors(hippoRoot, id);
-        }
-        writeIndexMirror(hippoRoot, buildIndexFromDb(db));
-    }
-    catch (error) {
-        try {
-            db.exec('ROLLBACK');
-        }
-        catch { /* ignore */ }
-        throw error;
-    }
-    finally {
-        closeHippoDb(db);
-    }
-}
-/**
- * Load all entries from SQLite.
- *
- * When `tenantId` is provided, results are scoped to that tenant. Omitting it
- * yields all rows (legacy behavior used by consolidate/autolearn etc.). Recall
- * paths that surface results to a user MUST pass a resolved tenant.
- */
-export function loadAllEntries(hippoRoot, tenantId) {
-    initStore(hippoRoot);
-    const db = openHippoDb(hippoRoot);
-    try {
-        // SAFETY: both branches select exactly MEMORY_SELECT_COLUMNS, matching
-        // MemoryRow's field set.
-        const rows = tenantId !== undefined
-            ? db.prepare(`SELECT ${MEMORY_SELECT_COLUMNS} FROM memories WHERE tenant_id = ? ORDER BY created ASC, id ASC`).all(tenantId)
-            : db.prepare(`SELECT ${MEMORY_SELECT_COLUMNS} FROM memories ORDER BY created ASC, id ASC`).all();
-        return rows.map(rowToEntry);
-    }
-    finally {
-        closeHippoDb(db);
-    }
-}
-// The pins plus the `recentNeeded` newest rows that pass `admit`, for ambient
-// injection. One connection: opening one costs ~5.8ms on a warm 1896-row store,
-// so a second handle loses more than the narrower scan saves.
-export function loadAmbientCandidates(hippoRoot, tenantId, recentNeeded, admit) {
-    initStore(hippoRoot);
-    // A SQL LIMIT takes an integer; the Array.slice this replaced truncated one,
-    // and include_recent is any non-negative finite number at the HTTP edge.
-    const needed = Math.trunc(recentNeeded);
-    const db = openHippoDb(hippoRoot);
-    try {
-        // SAFETY: every `where` below starts from MEMORY_SELECT_COLUMNS' table.
-        const run = (where, params) => db.prepare(`SELECT ${MEMORY_SELECT_COLUMNS} FROM memories WHERE ${where}`).all(...params).map(rowToEntry);
-        const byId = new Map();
-        const scoped = 'superseded_by IS NULL AND tenant_id = ?';
-        for (const e of run(`pinned = 1 AND ${scoped} ORDER BY created ASC, id ASC`, [tenantId])) {
-            if (admit(e))
-                byId.set(e.id, e);
-        }
-        if (needed > 0) {
-            // Text order is chronological only for canonical UTC ISO (memory.ts).
-            const drifted = db.prepare(`SELECT 1 FROM memories WHERE ${scoped} AND (length(created) <> 24 OR created NOT LIKE '%Z') LIMIT 1`).get(tenantId) !== undefined;
-            // `id DESC` mirrors getContext's comparator, not loadFreshRawMemories'
-            // cross-ingest-stable order: that would change what the hook injects.
-            const window = Math.max(needed * 4, 32);
-            const windowed = drifted
-                ? []
-                : run(`${scoped} ORDER BY created DESC, id DESC LIMIT ?`, [tenantId, window]);
-            let kept = windowed.filter(admit);
-            if (drifted || (kept.length < needed && windowed.length === window)) {
-                kept = run(`${scoped} ORDER BY created DESC, id DESC`, [tenantId]).filter(admit);
-            }
-            for (const e of kept)
-                byId.set(e.id, e);
-        }
-        // loadAllEntries' order: rankedPinned's comparator can tie and Array.sort
-        // is stable, so input order is load-bearing downstream.
-        return [...byId.values()].sort((a, b) => {
-            const byCreated = a.created.localeCompare(b.created);
-            return byCreated !== 0 ? byCreated : a.id.localeCompare(b.id);
-        });
-    }
-    finally {
-        closeHippoDb(db);
-    }
-}
-/**
- * Load likely search candidates directly from SQLite.
- * Uses FTS5 when available, falls back to LIKE matching, then full-store fallback.
- *
- * When `tenantId` is provided, every SELECT (FTS join, LIKE, fallback) filters
- * by tenant_id. Cross-tenant memories never surface. Omitted = no filter.
- */
-export function loadSearchEntries(hippoRoot, query, limit = DEFAULT_SEARCH_CANDIDATE_LIMIT, tenantId) {
-    initStore(hippoRoot);
-    const db = openHippoDb(hippoRoot);
-    try {
-        return loadSearchRows(db, query, limit, tenantId).map(rowToEntry);
-    }
-    finally {
-        closeHippoDb(db);
-    }
-}
-/**
- * v1.7.1 — recall-mode loader. Pushes the recall-side scope predicate into
- * SQL so `unknown:legacy` cannot leak via any consumer that hasn't remembered
- * to re-filter (root-cause-over-patches: codex flagged this on v1.6.5 review).
- *
- * - `requestedScope` undefined / '': default-deny on `unknown:legacy`.
- * - `requestedScope` non-empty string: exact match on `m.scope = requestedScope`.
- *
- * Private-scope (`<source>:private:*`) exclusion: SQL applies a conservative
- * pre-window approximation (`NOT LIKE '%:private:%'`, v1.25.0 — codex P2:
- * post-window-only filtering let private rows starve admitted candidates out
- * of the LIMIT window); the exact anchored regex
- * (`passesScopeFilterForRecall`) remains the authoritative JS post-filter in
- * the recall consumers.
- *
- * Consumers: `api.recall` (v1.7.1+), `cmdRecall`/`cmdExplain` direct CLI paths
- * and `searchBothHybrid` recall mode (v1.25.0). Background pipelines
- * (`consolidate`, `embeddings`, `refine-llm`, ...) keep using
- * `loadSearchEntries` so they can see quarantined rows when needed.
- *
- * `tenantId` widened to optional in v1.25.0 for the searchBothHybrid recall
- * mode (its `tenantId` option is optional); `loadSearchRows` already treats
- * undefined as "no tenant filter" for legacy callers.
- */
-export function loadRecallSearchEntries(hippoRoot, query, limit = DEFAULT_SEARCH_CANDIDATE_LIMIT, tenantId, requestedScope, explicitScopeMode = 'exact') {
-    initStore(hippoRoot);
-    const db = openHippoDb(hippoRoot);
-    try {
-        // explicitScopeMode only matters when requestedScope is set:
-        //   'exact'    — api.recall semantics: narrow to m.scope = requested.
-        //   'additive' — CLI --scope semantics (v1.25.0): default-admitted set
-        //                PLUS the requested scope; see RecallScopeFilter docs.
-        const scopeFilter = requestedScope && requestedScope !== ''
-            ? explicitScopeMode === 'additive'
-                ? { mode: 'default-deny-or-exact', value: requestedScope }
-                : { mode: 'exact', value: requestedScope }
-            : { mode: 'default-deny' };
-        return loadSearchRows(db, query, limit, tenantId, scopeFilter).map(rowToEntry);
-    }
-    finally {
-        closeHippoDb(db);
-    }
-}
-/**
- * Rebuild mirrors from SQLite, importing any legacy markdown files not already present.
- */
-export function rebuildIndex(hippoRoot) {
-    initStore(hippoRoot);
-    const db = openHippoDb(hippoRoot);
-    try {
-        // SAFETY: rows' shape matches the single `id` column selected above.
-        const existingIds = new Set(db.prepare(`SELECT id FROM memories`).all().map((row) => row.id));
-        const legacyEntries = loadLegacyEntriesFromMarkdown(hippoRoot).filter((entry) => !existingIds.has(entry.id));
-        if (legacyEntries.length > 0) {
-            db.exec('BEGIN');
-            try {
-                // AT1 (plan §3, round-3 redesign): same guard-with-per-row-skip as
-                // bootstrapLegacyStore — rebuildIndex is the other channel through
-                // which a stale markdown mirror could resurrect a rejected value.
-                // Refusal audit written INLINE (nothing rolls back on a skip).
-                let rejectedCount = 0;
-                for (const entry of legacyEntries) {
-                    // v39: same store-derived origin stamp as bootstrapLegacyStore.
-                    const stamped = stampOriginProjectForImport(hippoRoot, entry);
-                    try {
-                        upsertEntryRow(db, stamped);
-                    }
-                    catch (err) {
-                        if (err instanceof RejectedValueError) {
-                            rejectedCount++;
-                            audit(db, 'reject_refusal', err.entryId, { digest: err.digest, reason: err.reason }, 'cli', err.tenantId);
-                            continue;
-                        }
-                        throw err;
-                    }
-                }
-                if (rejectedCount > 0) {
-                    console.error(`rebuildIndex: skipped ${rejectedCount} rejected value(s) found in legacy mirrors`);
-                }
-                db.exec('COMMIT');
-            }
-            catch (err) {
-                try {
-                    db.exec('ROLLBACK');
-                }
-                catch { /* ignore if no active txn */ }
-                throw err;
-            }
-        }
-        syncMirrorFiles(hippoRoot, db);
-        return buildIndexFromDb(db);
-    }
-    finally {
-        closeHippoDb(db);
-    }
-}
-export function updateStats(hippoRoot, delta) {
-    initStore(hippoRoot);
-    const db = openHippoDb(hippoRoot);
-    try {
-        // One atomic statement per counter, and only for counters the caller
-        // named: the read-modify-write this replaces both lost increments to a
-        // concurrent writer and stamped stale values over the untouched two.
-        const increments = [
-            ['total_remembered', delta.remembered ?? 0],
-            ['total_recalled', delta.recalled ?? 0],
-            ['total_forgotten', delta.forgotten ?? 0],
-        ];
-        for (const [key, amount] of increments) {
-            if (amount === 0)
-                continue;
-            // Both binds are the same string: node:sqlite binds a JS number as REAL,
-            // which would store "1.0" into this TEXT column instead of "1".
-            db.prepare(`
-        INSERT INTO meta(key, value) VALUES(?, ?)
-        ON CONFLICT(key) DO UPDATE SET value = CAST(meta.value AS INTEGER) + CAST(? AS INTEGER)
-      `).run(key, String(amount), String(amount));
-        }
-        writeStatsMirror(hippoRoot, buildStatsFromDb(db));
-    }
-    finally {
-        closeHippoDb(db);
-    }
-}
-export function loadStats(hippoRoot) {
-    initStore(hippoRoot);
-    const db = openHippoDb(hippoRoot);
-    try {
-        const stats = buildStatsFromDb(db);
-        writeStatsMirror(hippoRoot, stats);
-        return stats;
-    }
-    finally {
-        closeHippoDb(db);
-    }
-}
-export function appendConsolidationRun(hippoRoot, run) {
-    initStore(hippoRoot);
-    const db = openHippoDb(hippoRoot);
-    try {
-        db.prepare(`INSERT INTO consolidation_runs(timestamp, decayed, merged, removed) VALUES (?, ?, ?, ?)`).run(run.timestamp, run.decayed, run.merged, run.removed);
-        pruneConsolidationRuns(db, 50);
-        writeStatsMirror(hippoRoot, buildStatsFromDb(db));
-    }
-    finally {
-        closeHippoDb(db);
-    }
-}
-/**
- * Load the session decay context from the store.
- * Uses consolidation_runs timestamps to compute session intervals.
- */
-export function loadSessionDecayContext(hippoRoot) {
-    initStore(hippoRoot);
-    const db = openHippoDb(hippoRoot);
-    try {
-        // Get recent consolidation timestamps (last 20)
-        // SAFETY: rows' shape matches the single `timestamp` column above.
-        const rows = db.prepare(`SELECT timestamp FROM consolidation_runs ORDER BY timestamp DESC, id DESC LIMIT 20`).all();
-        const sleepCount = Number(getMeta(db, 'sleep_count', '0')) || rows.length;
-        if (rows.length < 2) {
-            return { sleepCount, avgSessionIntervalDays: 0 };
-        }
-        // Compute average interval between consecutive sessions
-        const timestamps = rows.map((r) => new Date(r.timestamp).getTime()).reverse();
-        let totalInterval = 0;
-        for (let i = 1; i < timestamps.length; i++) {
-            totalInterval += timestamps[i] - timestamps[i - 1];
-        }
-        const avgMs = totalInterval / (timestamps.length - 1);
-        const avgDays = avgMs / (1000 * 60 * 60 * 24);
-        return { sleepCount, avgSessionIntervalDays: Math.max(0, avgDays) };
-    }
-    finally {
-        closeHippoDb(db);
-    }
-}
-/**
- * Increment the sleep counter. Called after each consolidation run.
- */
-export function incrementSleepCount(hippoRoot) {
-    initStore(hippoRoot);
-    const db = openHippoDb(hippoRoot);
-    try {
-        const current = Number(getMeta(db, 'sleep_count', '0')) || 0;
-        setMeta(db, 'sleep_count', String(current + 1));
-    }
-    finally {
-        closeHippoDb(db);
-    }
-}
-/**
- * Defensive runtime guard for tenant id arguments.
- *
- * The continuity helpers (saveActiveTaskSnapshot, listSessionEvents, etc.)
- * gained a required `tenantId` parameter in v0.41 / schema v22 to close a
- * cross-tenant data leak. TypeScript catches misbinding at compile time, but
- * JavaScript callers from older versions can silently pass a `sessionId`
- * where `tenantId` is now expected, e.g.
- *   loadLatestHandoff(root, 'sess-abc')   // WRONG: 'sess-abc' becomes the tenant
- * which would silently filter to a non-existent tenant and return null with
- * no error. This guard rejects the most common shape of that mistake (any
- * value beginning with the conventional `sess-` / `sess_` session prefix).
- *
- * False-positive cost: a tenant literally named `sess-...` will be rejected.
- * Acceptable tradeoff for catching the silent-leak class.
- */
-export function assertTenantId(fnName, value) {
-    if (typeof value !== 'string' || value.length === 0) {
-        throw new Error(`${fnName}: tenantId is required (got ${typeof value})`);
-    }
-    if (/^sess[-_]/i.test(value)) {
-        throw new Error(`${fnName}: tenantId looks like a session id ('${value}'). ` +
-            `In v0.41+ these helpers take (hippoRoot, tenantId, ...). ` +
-            `Pass the tenant id (e.g. 'default') and the session id separately.`);
-    }
-}
-export function saveActiveTaskSnapshot(hippoRoot, tenantId, snapshot) {
-    assertTenantId('saveActiveTaskSnapshot', tenantId);
-    initStore(hippoRoot);
-    const db = openHippoDb(hippoRoot);
-    const now = new Date().toISOString();
-    try {
-        db.exec('BEGIN');
-        db.prepare(`UPDATE task_snapshots SET status = 'superseded', updated_at = ? WHERE status = 'active' AND tenant_id = ?`).run(now, tenantId);
-        const result = db.prepare(`
-      INSERT INTO task_snapshots(task, summary, next_step, status, source, session_id, scope, tenant_id, created_at, updated_at)
-      VALUES (?, ?, ?, 'active', ?, ?, ?, ?, ?, ?)
-    `).run(snapshot.task, snapshot.summary, snapshot.next_step, snapshot.source ?? 'cli', snapshot.session_id ?? null, snapshot.scope ?? null, tenantId, now, now);
-        db.exec('COMMIT');
-        const id = Number(result.lastInsertRowid ?? 0);
-        // SAFETY: row's shape matches the ten columns named in the SELECT above.
-        const row = db.prepare(`
-      SELECT id, task, summary, next_step, status, source, session_id, scope, created_at, updated_at
-      FROM task_snapshots
-      WHERE id = ?
-    `).get(id);
-        if (!row) {
-            throw new Error('Failed to reload saved active task snapshot');
-        }
-        const loaded = rowToTaskSnapshot(row);
-        writeActiveTaskMirror(hippoRoot, tenantId, loaded);
-        return loaded;
-    }
-    catch (error) {
-        try {
-            db.exec('ROLLBACK');
-        }
-        catch {
-            // Ignore nested rollback failures.
-        }
-        throw error;
-    }
-    finally {
-        closeHippoDb(db);
-    }
-}
-export function loadActiveTaskSnapshot(hippoRoot, tenantId) {
-    assertTenantId('loadActiveTaskSnapshot', tenantId);
-    initStore(hippoRoot);
-    const db = openHippoDb(hippoRoot);
-    try {
-        // SAFETY: row's shape matches the ten columns named in the SELECT above.
-        const row = db.prepare(`
-      SELECT id, task, summary, next_step, status, source, session_id, scope, created_at, updated_at
-      FROM task_snapshots
-      WHERE status = 'active' AND tenant_id = ?
-      ORDER BY updated_at DESC, id DESC
-      LIMIT 1
-    `).get(tenantId);
-        if (!row) {
-            removeActiveTaskMirror(hippoRoot, tenantId);
-            return null;
-        }
-        const loaded = rowToTaskSnapshot(row);
-        writeActiveTaskMirror(hippoRoot, tenantId, loaded);
-        return loaded;
-    }
-    finally {
-        closeHippoDb(db);
-    }
-}
-/**
- * Default freshness bound for AMBIENT active-task-snapshot reads (DF1,
- * docs/plans/2026-08-23-df1-snapshot-lifecycle.md): 72h, chosen over 48h so
- * a Friday-evening orphan still offers continuity on Monday morning.
- * Exported so callers can override via `loadFreshActiveTaskSnapshot`'s
- * `opts.maxAgeMs`; deliberately no env knob (Simplicity First).
- */
-export const SNAPSHOT_AMBIENT_MAX_AGE_MS = 72 * 60 * 60 * 1000;
-/** A usable session id: non-null, non-empty string. Named predicate (not an
- * inline `typeof` check) so the owner-match rule in
- * `loadFreshActiveTaskSnapshot` states its contract once. */
-function isNonEmptySessionId(value) {
-    return typeof value === 'string' && value.length > 0;
-}
-/**
- * Bounded read for AMBIENT active-task-snapshot surfaces (UserPromptSubmit
- * hook context, MCP recall block) — the never-expires fix for DF1. A
- * snapshot written by `hippo pre-compact` has no death path tied to the
- * session that owns it, so an orphaned row would otherwise inject into
- * every prompt of every later session forever. Wraps `loadActiveTaskSnapshot`
- * (unchanged, still the source of truth for explicit continuity surfaces),
- * then applies, in order:
- *
- * 1. Owner match — ONLY when both `opts.sessionId` and the snapshot's
- *    `session_id` are non-null, non-empty strings and strictly equal
- *    (`===`). Owner reads are unbounded: the session that owns the snapshot
- *    can always see its own working state, regardless of age.
- * 2. Age check — everything else, including absent-vs-absent ids. A
- *    null/undefined/empty id on EITHER side never counts as an owner match;
- *    it falls through here instead. (`runPreCompact` can legitimately save a
- *    snapshot with `session_id = null`; a null-equals-null "match" would
- *    reopen indefinite ambient injection for exactly those rows.) Returns
- *    the snapshot only when `age(updated_at) <= maxAgeMs` (default
- *    `SNAPSHOT_AMBIENT_MAX_AGE_MS`); otherwise null.
- *
- * No SQL change — age derives from the existing `updated_at` column.
- */
-export function loadFreshActiveTaskSnapshot(hippoRoot, tenantId, opts = {}) {
-    const snapshot = loadActiveTaskSnapshot(hippoRoot, tenantId);
-    if (!snapshot)
-        return null;
-    const callerSessionId = opts.sessionId;
-    const isOwnerMatch = isNonEmptySessionId(callerSessionId) &&
-        isNonEmptySessionId(snapshot.session_id) &&
-        callerSessionId === snapshot.session_id;
-    if (isOwnerMatch)
-        return snapshot;
-    const maxAgeMs = opts.maxAgeMs ?? SNAPSHOT_AMBIENT_MAX_AGE_MS;
-    const ageMs = Date.now() - Date.parse(snapshot.updated_at);
-    return ageMs <= maxAgeMs ? snapshot : null;
-}
-export function clearActiveTaskSnapshot(hippoRoot, tenantId, clearedStatus = 'cleared') {
-    assertTenantId('clearActiveTaskSnapshot', tenantId);
-    initStore(hippoRoot);
-    const db = openHippoDb(hippoRoot);
-    const now = new Date().toISOString();
-    try {
-        // SAFETY: active's shape matches the single `id` column selected above.
-        const active = db.prepare(`SELECT id FROM task_snapshots WHERE status = 'active' AND tenant_id = ? ORDER BY updated_at DESC, id DESC LIMIT 1`).get(tenantId);
-        if (!active?.id) {
-            removeActiveTaskMirror(hippoRoot, tenantId);
-            return false;
-        }
-        db.prepare(`UPDATE task_snapshots SET status = ?, updated_at = ? WHERE id = ? AND tenant_id = ?`).run(clearedStatus, now, active.id, tenantId);
-        removeActiveTaskMirror(hippoRoot, tenantId);
-        return true;
-    }
-    finally {
-        closeHippoDb(db);
-    }
-}
-/**
- * Close the `active` task snapshot(s) owned by `sessionId`, for the T3
- * session-end death path (DF1, docs/plans/2026-08-23-df1-snapshot-lifecycle.md).
- * Only one `active` row exists per tenant in practice (supersession happens
- * at save), but the WHERE clause scopes on `session_id` too — not just
- * `status='active' AND tenant_id=?` — so an ending session can never close a
- * different, newer session's active snapshot. Returns the number of rows
- * closed (0 when no active row is owned by `sessionId`).
- */
-export function closeTaskSnapshotsForSession(hippoRoot, tenantId, sessionId, status = 'session-ended') {
-    assertTenantId('closeTaskSnapshotsForSession', tenantId);
-    initStore(hippoRoot);
-    const db = openHippoDb(hippoRoot);
-    const now = new Date().toISOString();
-    try {
-        const result = db.prepare(`UPDATE task_snapshots SET status = ?, updated_at = ? WHERE status = 'active' AND tenant_id = ? AND session_id = ?`).run(status, now, tenantId, sessionId);
-        return Number(result.changes ?? 0);
-    }
-    finally {
-        closeHippoDb(db);
-    }
-}
-export function appendSessionEvent(hippoRoot, tenantId, event) {
-    assertTenantId('appendSessionEvent', tenantId);
-    initStore(hippoRoot);
-    const db = openHippoDb(hippoRoot);
-    const now = new Date().toISOString();
-    // v1.2: scope is wired through. Default-deny in api.recall + cmdRecall
-    // continuity reads applies to slack:private:* and 'unknown:legacy' rows.
-    try {
-        const result = db.prepare(`
-      INSERT INTO session_events(session_id, task, event_type, content, source, scope, metadata_json, tenant_id, created_at)
-      VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?)
-    `).run(event.session_id, event.task ?? null, event.event_type, event.content, event.source ?? 'cli', event.scope ?? null, JSON.stringify(event.metadata ?? {}), tenantId, now);
-        const id = Number(result.lastInsertRowid ?? 0);
-        // SAFETY: row's shape matches the nine columns named in the SELECT
-        // above.
-        const row = db.prepare(`
-      SELECT id, session_id, task, event_type, content, source, scope, metadata_json, created_at
-      FROM session_events
-      WHERE id = ?
-    `).get(id);
-        if (!row) {
-            throw new Error('Failed to reload saved session event');
-        }
-        const loaded = rowToSessionEvent(row);
-        // SAFETY: recentRows' shape matches the nine columns named in the
-        // SELECT above.
-        const recentRows = db.prepare(`
-      SELECT id, session_id, task, event_type, content, source, scope, metadata_json, created_at
-      FROM session_events
-      WHERE session_id = ? AND tenant_id = ?
-      ORDER BY created_at DESC, id DESC
-      LIMIT ?
-    `).all(loaded.session_id, tenantId, 20);
-        const recent = recentRows.map(rowToSessionEvent).reverse();
-        writeRecentSessionMirror(hippoRoot, tenantId, recent);
-        return loaded;
-    }
-    finally {
-        closeHippoDb(db);
-    }
-}
-export function listSessionEvents(hippoRoot, tenantId, options = {}) {
-    assertTenantId('listSessionEvents', tenantId);
-    initStore(hippoRoot);
-    const db = openHippoDb(hippoRoot);
-    try {
-        const clauses = ['tenant_id = ?'];
-        const params = [tenantId];
-        if (options.session_id) {
-            clauses.push('session_id = ?');
-            params.push(options.session_id);
-        }
-        if (options.task) {
-            clauses.push('task = ?');
-            params.push(options.task);
-        }
-        const limit = Math.max(1, Math.trunc(options.limit ?? 8));
-        params.push(limit);
-        const where = `WHERE ${clauses.join(' AND ')}`;
-        // SAFETY: rows' shape matches the nine columns named in the SELECT
-        // above.
-        const rows = db.prepare(`
-      SELECT id, session_id, task, event_type, content, source, scope, metadata_json, created_at
-      FROM session_events
-      ${where}
-      ORDER BY created_at DESC, id DESC
-      LIMIT ?
-    `).all(...params);
-        return rows.map(rowToSessionEvent).reverse();
-    }
-    finally {
-        closeHippoDb(db);
-    }
-}
-/**
- * Return session_ids with a `session_complete` event newer than `sinceMs`.
- * Used by the sleep auto-promotion pass to bound scanning to a fixed window.
- */
-export function findPromotableSessions(hippoRoot, tenantId, sinceMs) {
-    assertTenantId('findPromotableSessions', tenantId);
-    initStore(hippoRoot);
-    const db = openHippoDb(hippoRoot);
-    try {
-        // SAFETY: rows' shape matches the single `session_id` column selected
-        // above.
-        const rows = db.prepare(`
-      SELECT DISTINCT session_id FROM session_events
-      WHERE event_type = 'session_complete' AND created_at >= ? AND tenant_id = ?
-    `).all(new Date(sinceMs).toISOString(), tenantId);
-        return rows;
-    }
-    finally {
-        closeHippoDb(db);
-    }
-}
-/**
- * Idempotency guard — true if a trace-layer memory with this source_session_id
- * already exists.
- */
-export function traceExistsForSession(hippoRoot, tenantId, session_id) {
-    assertTenantId('traceExistsForSession', tenantId);
-    initStore(hippoRoot);
-    const db = openHippoDb(hippoRoot);
-    try {
-        const row = db.prepare(`
-      SELECT 1 FROM memories
-      WHERE source_session_id = ? AND layer = 'trace' AND tenant_id = ?
-      LIMIT 1
-    `).get(session_id, tenantId);
-        return !!row;
-    }
-    finally {
-        closeHippoDb(db);
-    }
-}
-export function listMemoryConflicts(hippoRoot, status = 'open', tenantId) {
-    initStore(hippoRoot);
-    const db = openHippoDb(hippoRoot);
-    try {
-        // v0.28 — '*' is a sentinel meaning "no status filter, return all rows".
-        // Pre-v0.28 callers (cli/mcp/dashboard) always passed 'open' or default,
-        // so this sentinel is purely additive. The 4 SQL branches below cover
-        // {tenanted | unscoped} × {all-statuses | specific-status}.
-        const allStatuses = status === '*';
-        let rows;
-        if (tenantId !== undefined) {
-            // Tenanted query — JOIN to memories on both conflict members and require
-            // each in-tenant, so neither a normal cross-tenant pair nor a stale
-            // pre-fix row surfaces (consistent with resolveConflict).
-            // SAFETY: both branches select the same eight mc.* columns (aliased
-            // to MemoryConflictRow's field names) from memory_conflicts.
-            rows = allStatuses
-                ? db.prepare(`
-            SELECT mc.id, mc.memory_a_id, mc.memory_b_id, mc.reason, mc.score,
-                   mc.status, mc.detected_at, mc.updated_at
-            FROM memory_conflicts mc
-            JOIN memories ma ON ma.id = mc.memory_a_id
-            JOIN memories mb ON mb.id = mc.memory_b_id
-            WHERE ma.tenant_id = ? AND mb.tenant_id = ?
-            ORDER BY mc.updated_at DESC, mc.id DESC
-          `).all(tenantId, tenantId)
-                : db.prepare(`
-            SELECT mc.id, mc.memory_a_id, mc.memory_b_id, mc.reason, mc.score,
-                   mc.status, mc.detected_at, mc.updated_at
-            FROM memory_conflicts mc
-            JOIN memories ma ON ma.id = mc.memory_a_id
-            JOIN memories mb ON mb.id = mc.memory_b_id
-            WHERE mc.status = ? AND ma.tenant_id = ? AND mb.tenant_id = ?
-            ORDER BY mc.updated_at DESC, mc.id DESC
-          `).all(status, tenantId, tenantId);
-        }
-        else {
-            // Unscoped query — legacy direct-mode (CLI, tests, consolidate).
-            // SAFETY: both branches select the same eight columns matching
-            // MemoryConflictRow's field set.
-            rows = allStatuses
-                ? db.prepare(`
-            SELECT id, memory_a_id, memory_b_id, reason, score, status, detected_at, updated_at
-            FROM memory_conflicts
-            ORDER BY updated_at DESC, id DESC
-          `).all()
-                : db.prepare(`
-            SELECT id, memory_a_id, memory_b_id, reason, score, status, detected_at, updated_at
-            FROM memory_conflicts
-            WHERE status = ?
-            ORDER BY updated_at DESC, id DESC
-          `).all(status);
-        }
-        return rows.map(rowToMemoryConflict);
-    }
-    finally {
-        closeHippoDb(db);
-    }
-}
-export function replaceDetectedConflicts(hippoRoot, detected, detectedAt = new Date().toISOString()) {
-    initStore(hippoRoot);
-    const db = openHippoDb(hippoRoot);
-    try {
-        db.exec('BEGIN');
-        // Tenant guard (E2): a conflict is meaningful only within one tenant.
-        // Build id -> tenant_id once and skip cross-tenant pairs both when
-        // inserting rows and when rebuilding conflicts_with_json, so a stale
-        // cross-tenant row can neither persist nor leak a foreign id.
-        const tenantById = new Map();
-        // SAFETY: rows' shape matches the two columns named in the SELECT below.
-        for (const r of db.prepare(`SELECT id, tenant_id FROM memories`).all()) {
-            tenantById.set(r.id, r.tenant_id);
-        }
-        const sameTenant = (a, b) => {
-            const ta = tenantById.get(a);
-            const tb = tenantById.get(b);
-            return ta !== undefined && tb !== undefined && ta === tb;
-        };
-        const canonicalDetected = detected.map((conflict) => ({
-            ...canonicalConflictPair(conflict.memory_a_id, conflict.memory_b_id),
-            reason: conflict.reason,
-            score: conflict.score,
-        }));
-        const detectedKeys = new Set(canonicalDetected.map((conflict) => `${conflict.memory_a_id}::${conflict.memory_b_id}`));
-        // SAFETY: openRows' shape matches the eight columns named in the SELECT
-        // above.
-        const openRows = db.prepare(`
-      SELECT id, memory_a_id, memory_b_id, reason, score, status, detected_at, updated_at
-      FROM memory_conflicts
-      WHERE status = 'open'
-    `).all();
-        for (const row of openRows) {
-            const key = `${row.memory_a_id}::${row.memory_b_id}`;
-            const stale = !detectedKeys.has(key);
-            // v1.11.0 residue: auto-resolve any open cross-tenant row. The insert
-            // loop below (line 2089) and the refMap rebuild (line 2117) skip
-            // cross-tenant pairs, but the resolve-stale loop previously left
-            // re-detected cross-tenant rows lingering status='open'. The
-            // sameTenant() helper is already built one block up; no extra query.
-            const crossTenant = !sameTenant(row.memory_a_id, row.memory_b_id);
-            if (stale || crossTenant) {
-                db.prepare(`UPDATE memory_conflicts SET status = 'resolved', updated_at = ? WHERE id = ?`).run(detectedAt, row.id);
-            }
-        }
-        for (const conflict of canonicalDetected) {
-            // Skip cross-tenant pairs — never persist a conflict spanning tenants.
-            if (!sameTenant(conflict.memory_a_id, conflict.memory_b_id))
-                continue;
-            db.prepare(`
-        INSERT INTO memory_conflicts(memory_a_id, memory_b_id, reason, score, status, detected_at, updated_at)
-        VALUES (?, ?, ?, ?, 'open', ?, ?)
-        ON CONFLICT(memory_a_id, memory_b_id) DO UPDATE SET
-          reason = excluded.reason,
-          score = excluded.score,
-          status = 'open',
-          updated_at = excluded.updated_at
-      `).run(conflict.memory_a_id, conflict.memory_b_id, conflict.reason, conflict.score, detectedAt, detectedAt);
-        }
-        // SAFETY: openConflicts' shape matches the two columns named above.
-        const openConflicts = db.prepare(`
-      SELECT memory_a_id, memory_b_id
-      FROM memory_conflicts
-      WHERE status = 'open'
-    `).all();
-        const refMap = new Map();
-        for (const row of openConflicts) {
-            // Skip cross-tenant pairs so a stale row never seeds a foreign id
-            // into conflicts_with_json.
-            if (!sameTenant(row.memory_a_id, row.memory_b_id))
-                continue;
-            if (!refMap.has(row.memory_a_id))
-                refMap.set(row.memory_a_id, new Set());
-            if (!refMap.has(row.memory_b_id))
-                refMap.set(row.memory_b_id, new Set());
-            refMap.get(row.memory_a_id).add(row.memory_b_id);
-            refMap.get(row.memory_b_id).add(row.memory_a_id);
-        }
-        // SAFETY: memoryRows' shape matches the single `id` column selected
-        // above.
-        const memoryRows = db.prepare(`SELECT id FROM memories`).all();
-        for (const memory of memoryRows) {
-            const refs = Array.from(refMap.get(memory.id) ?? []).sort();
-            db.prepare(`UPDATE memories SET conflicts_with_json = ?, updated_at = datetime('now') WHERE id = ?`).run(JSON.stringify(refs), memory.id);
-        }
-        db.exec('COMMIT');
-        syncMirrorFiles(hippoRoot, db);
-    }
-    catch (error) {
-        try {
-            db.exec('ROLLBACK');
-        }
-        catch {
-            // Ignore nested rollback failures.
-        }
-        throw error;
-    }
-    finally {
-        closeHippoDb(db);
-    }
-}
-/**
- * Resolve a conflict by keeping one memory and weakening the other.
- * Sets conflict status to 'resolved' and halves the loser's half-life.
- * If --forget is used, the loser is removed entirely (kind-aware: raw rows
- * are archived via archiveRawMemory, others deleted via deleteEntryCore —
- * AT1 fix for the pre-existing crash where a raw loser aborted the whole
- * resolve transaction against the append-only trigger). `opts.rejectLoserValue`
- * additionally tombstones the loser's normalized digest so it cannot be
- * re-asserted later.
- *
- * Every resolution path (weaken / forget / reject) emits a `conflict_resolve`
- * audit row (AT1 — previously resolveConflict wrote zero audit rows on any path).
- *
- * Returns the resolved conflict, or null if not found.
- */
-export function resolveConflict(hippoRoot, conflictId, keepId, forgetLoser = false, tenantId, opts) {
-    initStore(hippoRoot);
-    const db = openHippoDb(hippoRoot);
-    // When tenantId is set, the conflict lookup requires BOTH members in-tenant
-    // and every memories mutation carries AND tenant_id = ?. A cross-tenant probe
-    // then returns null, indistinguishable from a bad id. Omitted tenantId =
-    // legacy unscoped behaviour (CLI direct mode, tests, consolidate.ts).
-    const memScope = tenantId !== undefined ? ' AND tenant_id = ?' : '';
-    const memArgs = tenantId !== undefined ? [tenantId] : [];
-    try {
-        // SAFETY: both branches select the same eight columns (aliased in the
-        // tenanted branch) matching MemoryConflictRow's field set.
-        const row = (tenantId !== undefined
-            ? db.prepare(`
-          SELECT mc.id, mc.memory_a_id, mc.memory_b_id, mc.reason, mc.score,
-                 mc.status, mc.detected_at, mc.updated_at
-          FROM memory_conflicts mc
-          JOIN memories ma ON ma.id = mc.memory_a_id
-          JOIN memories mb ON mb.id = mc.memory_b_id
-          WHERE mc.id = ? AND ma.tenant_id = ? AND mb.tenant_id = ?
-        `).get(conflictId, tenantId, tenantId)
-            : db.prepare(`
-          SELECT id, memory_a_id, memory_b_id, reason, score, status, detected_at, updated_at
-          FROM memory_conflicts WHERE id = ?
-        `).get(conflictId));
-        if (!row)
-            return null;
-        const conflict = rowToMemoryConflict(row);
-        if (conflict.status !== 'open')
-            return null;
-        const loserId = keepId === conflict.memory_a_id
-            ? conflict.memory_b_id
-            : keepId === conflict.memory_b_id
-                ? conflict.memory_a_id
-                : null;
-        if (!loserId)
-            return null;
-        db.exec('BEGIN');
-        // Mark conflict as resolved
-        db.prepare(`UPDATE memory_conflicts SET status = 'resolved', updated_at = datetime('now') WHERE id = ?`)
-            .run(conflictId);
-        // AT1 (plan §5): removal (forgetLoser OR rejectLoserValue — a tombstoned
-        // value cannot be left live) is now kind-aware. The old bare
-        // `DELETE FROM memories WHERE id = ?` aborted the whole transaction when
-        // the loser was kind='raw' (append-only trigger fires); route through
-        // the same helpers the reject verb uses (both db-scoped, both compose
-        // inside this BEGIN/COMMIT). loserRemoved / loserWasRaw drive both the
-        // conflicts_with_json skip below and the post-commit mirror purge.
-        let loserRemoved = false;
-        let loserWasRaw = false;
-        let rejectedDigest;
-        // AT1 P1 fix (codex): same-tenant duplicates of the loser's content that
-        // rejectLoserValue also removes (see below) — separate from loserId so
-        // the audit + post-commit mirror purge can cover ALL of them, not just
-        // loserId.
-        const extraRemovedIds = [];
-        const extraRemovedRawIds = [];
-        const removeLoser = forgetLoser || opts?.rejectLoserValue === true;
-        if (removeLoser) {
-            // SAFETY: loserRow's shape matches the three columns named in the
-            // SELECT above.
-            const loserRow = db
-                .prepare(`SELECT kind, content, tenant_id FROM memories WHERE id = ?${memScope}`)
-                .get(loserId, ...memArgs);
-            if (loserRow) {
-                const actor = opts?.rejectedBy ?? 'cli';
-                const reason = opts?.reason ?? `resolveConflict ${conflictId}: kept ${keepId}`;
-                if (opts?.rejectLoserValue) {
-                    rejectedDigest = rejectionDigest(loserRow.content);
-                    insertRejectedValue(db, {
-                        tenantId: loserRow.tenant_id ?? 'default',
-                        digest: rejectedDigest,
-                        reason,
-                        rejectedBy: actor,
-                        rejectedAt: new Date().toISOString(),
-                        sourceMemoryId: loserId,
-                        normalizedChars: normalizeValueForRejection(loserRow.content).length,
-                    });
-                    // AT1 P1 fix (codex): reject-flow.ts's `rejectValue` removes ALL
-                    // live same-tenant rows whose normalized digest matches, not just
-                    // the one id passed — but this branch only ever removed loserId,
-                    // leaving same-TENANT duplicates live while their shared content
-                    // was tombstoned. Same O(N) scan pattern as reject-flow.ts (human-
-                    // triggered command, tenant's row count is human-scale). CRITICAL
-                    // BOUNDARY: tenant-scoped ONLY — tombstones are tenant-scoped by
-                    // design, so a same-content row in ANOTHER tenant is legitimately
-                    // live and must NOT be touched here. `keepId` is excluded even if
-                    // its content coincidentally matches: the human explicitly chose
-                    // to keep it in this same resolution, and this branch must not
-                    // undo that choice in the same transaction.
-                    const loserTenantId = loserRow.tenant_id ?? 'default';
-                    // SAFETY: dupRows' shape matches the three columns named in the
-                    // SELECT above.
-                    const dupRows = db
-                        .prepare(`SELECT id, kind, content FROM memories WHERE tenant_id = ? AND id != ? AND id != ?`)
-                        .all(loserTenantId, loserId, keepId);
-                    for (const dup of dupRows) {
-                        if (rejectionDigest(dup.content) !== rejectedDigest)
-                            continue;
-                        if (dup.kind === 'raw') {
-                            archiveRawMemory(db, dup.id, { reason, who: actor });
-                            extraRemovedRawIds.push(dup.id);
-                        }
-                        else {
-                            deleteEntryCore(db, dup.id, { actor, suppressForgetAudit: true });
-                        }
-                        extraRemovedIds.push(dup.id);
-                    }
-                }
-                if (loserRow.kind === 'raw') {
-                    archiveRawMemory(db, loserId, { reason, who: actor });
-                    loserWasRaw = true;
-                }
-                else {
-                    deleteEntryCore(db, loserId, { actor, suppressForgetAudit: true });
-                }
-                loserRemoved = true;
-            }
-            // loserRow undefined = tenant-scope mismatch (or already gone); matches
-            // the old tenant-scoped DELETE's silent 0-rows-affected behavior.
-        }
-        else {
-            // Halve the loser's half-life (weakens it over time)
-            db.prepare(`UPDATE memories SET half_life_days = MAX(1, half_life_days / 2), updated_at = datetime('now') WHERE id = ?${memScope}`)
-                .run(loserId, ...memArgs);
-        }
-        // Clean up conflicts_with references
-        // SAFETY: keepRow's shape matches the single `conflicts_with_json`
-        // column selected above.
-        const keepRow = db.prepare(`SELECT conflicts_with_json FROM memories WHERE id = ?${memScope}`).get(keepId, ...memArgs);
-        if (keepRow) {
-            const refs = JSON.parse(keepRow.conflicts_with_json || '[]');
-            const cleaned = refs.filter((r) => r !== loserId);
-            db.prepare(`UPDATE memories SET conflicts_with_json = ?, updated_at = datetime('now') WHERE id = ?${memScope}`)
-                .run(JSON.stringify(cleaned), keepId, ...memArgs);
-        }
-        if (!loserRemoved) {
-            // SAFETY: loserRow's shape matches the single `conflicts_with_json`
-            // column named in the SELECT below.
-            const loserRow = db.prepare(`SELECT conflicts_with_json FROM memories WHERE id = ?${memScope}`).get(loserId, ...memArgs);
-            if (loserRow) {
-                const refs = JSON.parse(loserRow.conflicts_with_json || '[]');
-                const cleaned = refs.filter((r) => r !== keepId);
-                db.prepare(`UPDATE memories SET conflicts_with_json = ?, updated_at = datetime('now') WHERE id = ?${memScope}`)
-                    .run(JSON.stringify(cleaned), loserId, ...memArgs);
-            }
-        }
-        // AT1: the missing audit (plan §5 — resolveConflict wrote ZERO audit_log
-        // rows on any path before this). Every path — weaken, forget, reject —
-        // lands exactly one conflict_resolve row.
-        const conflictResolveMeta = {
-            conflictId,
-            keepId,
-            loserId,
-            disposition: loserRemoved ? (loserWasRaw ? 'archived_raw' : 'deleted') : 'weakened',
-            rejected: Boolean(opts?.rejectLoserValue),
-            // AT1 P1 fix: every row this call removed, not just loserId — the
-            // same-tenant duplicate sweep above (extraRemovedIds) needs an
-            // audit trail too.
-            removedIds: loserRemoved ? [loserId, ...extraRemovedIds] : [],
-        };
-        // Assigned only when present so the serialized audit payload keeps
-        // omitting the key, exactly as the pre-migration object literal did.
-        if (rejectedDigest !== undefined)
-            conflictResolveMeta.rejectedDigest = rejectedDigest;
-        // Fresh spread literal: ConflictResolveMeta is a closed interface (no
-        // index signature) and isn't directly assignable to audit()'s
-        // Record<string, JsonValue> metadata param; a spread into a fresh
-        // object literal satisfies it without widening the declared type above.
-        audit(db, 'conflict_resolve', keepId, { ...conflictResolveMeta }, opts?.rejectedBy ?? 'cli', tenantId);
-        db.exec('COMMIT');
-        syncMirrorFiles(hippoRoot, db);
-        // AT1 P1b fix: mirror purge + reaper stamp for EVERY removed loser, not
-        // just the rejectLoserValue path. Pre-AT1, the plain forgetLoser path on
-        // a raw loser crashed outright (bare DELETE FROM memories hit the
-        // append-only trigger) — there is no legacy "successful forget, no
-        // purge" behavior to preserve for that case. Post-AT1's kind-aware
-        // removal (archiveRawMemory / deleteEntryCore above) makes plain
-        // --forget succeed on every kind, but until this fix the mirror was
-        // only purged when rejectLoserValue was ALSO set: a plain raw --forget
-        // left its markdown mirror orphaned (the reaper still catches it
-        // eventually, since archiveRawMemory's own raw_archive insert leaves
-        // mirror_cleaned_at NULL) and a plain non-raw --forget left its mirror
-        // orphaned FOREVER (no reaper exists for non-raw rows). Same post-commit
-        // purge+reaper pattern as the reject verb (src/reject-flow.ts) and
-        // api.archiveRaw — reusing removeEntryMirrors + raw_archive bookkeeping.
-        if (loserRemoved) {
-            // AT1 P1 fix: loop over loserId AND every same-tenant duplicate the
-            // rejectLoserValue sweep above removed (extraRemovedIds) — previously
-            // only loserId's mirror was purged, leaving duplicate mirrors orphaned
-            // despite their rows being gone.
-            for (const removedId of [loserId, ...extraRemovedIds]) {
-                const isRaw = removedId === loserId ? loserWasRaw : extraRemovedRawIds.includes(removedId);
-                // AT1 fix: purgeMirrorBestEffort retries once, then — for non-raw ids,
-                // which cleanupArchivedMirrors' reaper never scans — reports the
-                // EXPLICIT leftover path(s) instead of the false "will retry via
-                // reaper" claim. See its own doc comment (store.ts, near
-                // removeEntryMirrors) for the full rationale.
-                const mirrorOk = purgeMirrorBestEffort(hippoRoot, removedId, isRaw, 'resolveConflict');
-                if (mirrorOk && isRaw) {
-                    db.prepare(`UPDATE raw_archive SET mirror_cleaned_at = ? WHERE memory_id = ?`).run(new Date().toISOString(), removedId);
-                }
-            }
-        }
-        return { conflict: { ...conflict, status: 'resolved' }, loserId };
-    }
-    catch (error) {
-        try {
-            db.exec('ROLLBACK');
-        }
-        catch { /* ignore */ }
-        throw error;
-    }
-    finally {
-        closeHippoDb(db);
-    }
-}
-// W1: the nine-column SELECT was cloned four times (plan rule 8); one
-// definition so a sixth caller can't drift from the other five.
-const HANDOFF_COLUMNS = 'id, session_id, repo_root, task_id, summary, next_action, artifacts_json, scope, created_at, constraints_json, evidence_json, outcome, target_runtime, card_id';
-/**
- * Save a session handoff record. Returns the persisted handoff.
- */
-export function saveSessionHandoff(hippoRoot, tenantId, handoff) {
-    assertTenantId('saveSessionHandoff', tenantId);
-    initStore(hippoRoot);
-    const db = openHippoDb(hippoRoot);
-    const now = new Date().toISOString();
-    // v1.2: scope is wired through. Read-side default-deny in api.recall +
-    // cmdRecall continuity excludes slack:private:* and 'unknown:legacy'.
-    try {
-        const result = db.prepare(`
-      INSERT INTO session_handoffs(session_id, repo_root, task_id, summary, next_action, artifacts_json, scope, tenant_id, created_at, constraints_json, evidence_json, outcome, target_runtime, card_id)
-      VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?)
-    `).run(handoff.sessionId, handoff.repoRoot ?? null, handoff.taskId ?? null, handoff.summary, handoff.nextAction ?? null, JSON.stringify(handoff.artifacts ?? []), handoff.scope ?? null, tenantId, now, JSON.stringify(handoff.constraints ?? []), handoff.evidence ? JSON.stringify(handoff.evidence) : null, handoff.outcome ?? null, handoff.targetRuntime ?? null, handoff.cardId ?? null);
-        const id = Number(result.lastInsertRowid ?? 0);
-        // SAFETY: row's shape matches HANDOFF_COLUMNS.
-        const row = db.prepare(`
-      SELECT ${HANDOFF_COLUMNS}
-      FROM session_handoffs
-      WHERE id = ?
-    `).get(id);
-        if (!row) {
-            throw new Error('Failed to reload saved session handoff');
-        }
-        return rowToSessionHandoff(row);
-    }
-    finally {
-        closeHippoDb(db);
-    }
-}
-/** Load the most recent handoff, optionally filtered by session ID. */
-export function loadLatestHandoff(hippoRoot, tenantId, sessionId, opts = {}) {
-    assertTenantId('loadLatestHandoff', tenantId);
-    initStore(hippoRoot);
-    const db = openHippoDb(hippoRoot);
-    try {
-        const conditions = ['tenant_id = ?'];
-        const params = [tenantId];
-        if (sessionId) {
-            conditions.push('session_id = ?');
-            params.push(sessionId);
-        }
-        if (opts.unfinishedOnly) {
-            // codex P2: restrict to each session's newest revision first — stampHandoffOutcome
-            // only stamps the newest row, so an older null-outcome revision must not resurrect.
-            conditions.push(`id IN (SELECT MAX(id) FROM session_handoffs WHERE tenant_id = ? GROUP BY session_id)`);
-            params.push(tenantId);
-            conditions.push(`(outcome IS NULL OR outcome IN ('partial','failure'))`);
-        }
-        if (opts.maxAgeMs != null) {
-            conditions.push('created_at >= ?');
-            params.push(new Date(Date.now() - opts.maxAgeMs).toISOString());
-        }
-        if (opts.scopeFilter === 'default-deny') {
-            // codex P2: admit scope before LIMIT 1, else a newer denied row hides an older eligible one.
-            const placeholders = RECALL_DEFAULT_DENY_SCOPES.map(() => '?').join(', ');
-            conditions.push(`(scope IS NULL OR (scope NOT IN (${placeholders}) AND scope NOT LIKE '%:private:%'))`);
-            params.push(...RECALL_DEFAULT_DENY_SCOPES);
-        }
-        // SAFETY: row's shape matches HANDOFF_COLUMNS.
-        const row = db.prepare(`
-      SELECT ${HANDOFF_COLUMNS}
-      FROM session_handoffs
-      WHERE ${conditions.join(' AND ')}
-      ORDER BY created_at DESC, id DESC
-      LIMIT 1
-    `).get(...params);
-        return row ? rowToSessionHandoff(row) : null;
-    }
-    finally {
-        closeHippoDb(db);
-    }
-}
-/**
- * Load a specific handoff by its row ID.
- */
-export function loadHandoffById(hippoRoot, tenantId, id) {
-    assertTenantId('loadHandoffById', tenantId);
-    initStore(hippoRoot);
-    const db = openHippoDb(hippoRoot);
-    try {
-        // SAFETY: row's shape matches HANDOFF_COLUMNS.
-        const row = db.prepare(`
-      SELECT ${HANDOFF_COLUMNS}
-      FROM session_handoffs
-      WHERE id = ? AND tenant_id = ?
-    `).get(id, tenantId);
-        return row ? rowToSessionHandoff(row) : null;
-    }
-    finally {
-        closeHippoDb(db);
-    }
-}
-/** Stamp the outcome on a session's newest handoff, only if it has none yet. Returns rows changed. */
-export function stampHandoffOutcome(hippoRoot, tenantId, sessionId, outcome) {
-    assertTenantId('stampHandoffOutcome', tenantId);
-    initStore(hippoRoot);
-    const db = openHippoDb(hippoRoot);
-    try {
-        const result = db.prepare(`
-      UPDATE session_handoffs SET outcome = ?
-      WHERE tenant_id = ? AND session_id = ? AND outcome IS NULL
-        AND id = (
-          SELECT id FROM session_handoffs
-          WHERE tenant_id = ? AND session_id = ?
-          ORDER BY created_at DESC, id DESC LIMIT 1
-        )
-    `).run(outcome, tenantId, sessionId, tenantId, sessionId);
-        return Number(result.changes ?? 0);
-    }
-    finally {
-        closeHippoDb(db);
-    }
-}
-/**
- * Auto-write a handoff at session-end from the session's active snapshot (DF1 T3).
- * @param evidence best-effort git state; outcome comes from the newest session_complete event.
- * @returns null unless the snapshot belongs to sessionId and no newer handoff already covers it.
- */
-export function writeSessionEndHandoff(hippoRoot, tenantId, sessionId, evidence) {
-    assertTenantId('writeSessionEndHandoff', tenantId);
-    const snapshot = loadActiveTaskSnapshot(hippoRoot, tenantId);
-    if (!snapshot || snapshot.session_id !== sessionId)
-        return null;
-    const existing = loadLatestHandoff(hippoRoot, tenantId, sessionId);
-    // Strict '>': a same-millisecond tie must not swallow the session's only write (test 6e).
-    if (existing && existing.updatedAt > snapshot.updated_at)
-        return null;
-    const db = openHippoDb(hippoRoot);
-    let outcome = null;
-    try {
-        // SAFETY: row's shape matches the single `content` column below.
-        const completeEvent = db.prepare(`
-      SELECT content FROM session_events
-      WHERE tenant_id = ? AND session_id = ? AND event_type = 'session_complete'
-      ORDER BY created_at DESC, id DESC LIMIT 1
-    `).get(tenantId, sessionId);
-        if (isHandoffOutcome(completeEvent?.content))
-            outcome = completeEvent.content;
-    }
-    finally {
-        closeHippoDb(db);
-    }
-    // codex P2: same-task refresh carries forward envelope fields nobody cleared,
-    // rather than dropping them when the snapshot rewrite has no opinion on them.
-    // codex P1: a scope mismatch must not leak private metadata into an unscoped envelope.
-    const carryForward = existing != null && existing.taskId === snapshot.task
-        && (existing.scope ?? null) === (snapshot.scope ?? null);
-    return saveSessionHandoff(hippoRoot, tenantId, {
-        version: 1,
-        sessionId,
-        repoRoot: carryForward ? existing.repoRoot : undefined,
-        taskId: snapshot.task,
-        summary: snapshot.summary,
-        nextAction: snapshot.next_step,
-        artifacts: carryForward ? existing.artifacts : [],
-        scope: snapshot.scope,
-        evidence,
-        outcome,
-        constraints: carryForward ? existing.constraints : undefined,
-        targetRuntime: carryForward ? existing.targetRuntime : undefined,
-        cardId: carryForward ? existing.cardId : undefined,
-    });
-}
-const CARD_COLUMNS = 'id, title, status, assignee_runtime, repo, contract, budget, lease_until, heartbeat_at, created_at, updated_at, tenant_id, scope';
-function rowToCard(row) {
-    return {
-        id: row.id,
-        title: row.title,
-        status: row.status,
-        assigneeRuntime: row.assignee_runtime,
-        repo: row.repo,
-        contract: row.contract,
-        budget: row.budget,
-        leaseUntil: row.lease_until,
-        heartbeatAt: row.heartbeat_at,
-        createdAt: row.created_at,
-        updatedAt: row.updated_at,
-        tenantId: row.tenant_id,
-        scope: row.scope,
-    };
-}
-function loadCardRow(db, tenantId, id) {
-    // SAFETY: row's shape matches CARD_COLUMNS; status only ever holds a CardStatus value.
-    const row = db.prepare(`SELECT ${CARD_COLUMNS} FROM cards WHERE id = ? AND tenant_id = ?`).get(id, tenantId);
-    return row ? rowToCard(row) : null;
-}
-function rowToCardRun(row) {
-    return {
-        id: row.id,
-        card: row.card,
-        runtime: row.runtime,
-        sessionId: row.session_id,
-        started: row.started,
-        ended: row.ended,
-        outcome: row.outcome,
-    };
-}
-function rowToCardComment(row) {
-    return { id: row.id, cardId: row.card_id, author: row.author, body: row.body, createdAt: row.created_at };
-}
-function insertCardComment(db, tenantId, cardId, author, body) {
-    const now = new Date().toISOString();
-    const result = db.prepare(`
-    INSERT INTO card_comments (card_id, author, body, created_at, tenant_id)
-    SELECT ?, ?, ?, ?, ? WHERE EXISTS (SELECT 1 FROM cards WHERE id = ? AND tenant_id = ?)
-  `).run(cardId, author, body, now, tenantId, cardId, tenantId);
-    if (Number(result.changes ?? 0) === 0) {
-        throw new Error(`unknown card id: ${cardId}`);
-    }
-    const id = Number(result.lastInsertRowid ?? 0);
-    return { id, cardId, author, body, createdAt: now };
-}
-function leaseUntilFrom(now) {
-    return new Date(Date.parse(now) + CARD_LEASE_MS).toISOString();
-}
-function assertRunId(runId) {
-    if (!Number.isSafeInteger(runId) || runId <= 0) {
-        throw new Error(`Invalid run id: ${runId} (expected a positive integer)`);
-    }
-}
-// A second run that has not ended means a corrupt store; throw rather than guess which run the caller means.
-function isLiveRun(db, tenantId, cardId, runId) {
-    // SAFETY: rows' shape matches the single `id` column named in the SELECT below.
-    const rows = db.prepare(`SELECT id FROM card_runs WHERE tenant_id = ? AND card = ? AND ended IS NULL`).all(tenantId, cardId);
-    if (rows.length > 1) {
-        throw new Error(`card ${cardId} has ${rows.length} runs that have not ended`);
-    }
-    return rows[0]?.id === runId;
-}
-function closeLiveRun(db, tenantId, cardId, outcome, now) {
-    db.prepare(`
-    UPDATE card_runs SET ended = ?, outcome = ?, updated_at = ?
-    WHERE card = ? AND tenant_id = ? AND ended IS NULL
-  `).run(now, outcome, now, cardId, tenantId);
-}
-// The single status-mutating seam (rule 15): CARD_TRANSITIONS is the one
-// runtime authority, so a hand-copied wrong `from` list fails fast here.
-export function transitionCard(db, tenantId, cardId, from, to, extra) {
-    for (const status of from) {
-        if (!CARD_TRANSITIONS[status].includes(to)) {
-            throw new Error(`illegal card transition: ${status} -> ${to}`);
-        }
-    }
-    const now = new Date().toISOString();
-    // Lease columns follow status: set on the move to running, cleared on every other move (rule 15).
-    const lease = to === 'running' ? [leaseUntilFrom(now), now] : [null, null];
-    const fromPlaceholders = from.map(() => '?').join(', ');
-    const sql = `
-    UPDATE cards SET status = ?, updated_at = ?, lease_until = ?, heartbeat_at = ?${extra?.setSql ? `, ${extra.setSql}` : ''}
-    WHERE id = ? AND tenant_id = ? AND status IN (${fromPlaceholders})${extra?.whereSql ? ` AND ${extra.whereSql}` : ''}
-  `;
-    const params = [to, now, ...lease, ...(extra?.params ?? []), cardId, tenantId, ...from];
-    const result = db.prepare(sql).run(...params);
-    return Number(result.changes ?? 0);
-}
-/** Creates a card; status is ready with no deps or once every dependsOn id is done, else backlog. An unknown dependsOn id throws and commits nothing. A repeated dependsOn id is recorded once. */
-export function createCard(hippoRoot, tenantId, input) {
-    assertTenantId('createCard', tenantId);
-    if (input.title.trim() === '') {
-        throw new Error('title must not be empty');
-    }
-    if (input.budget !== undefined && !(Number.isSafeInteger(input.budget) && input.budget > 0)) {
-        throw new Error(`Invalid budget: ${input.budget} (expected a positive integer)`);
-    }
-    initStore(hippoRoot);
-    const db = openHippoDb(hippoRoot);
-    try {
-        const dependsOn = [...new Set(input.dependsOn ?? [])];
-        let id = '';
-        db.exec('BEGIN IMMEDIATE');
-        try {
-            // Probe runs inside the transaction (mirrors batchWriteAndDelete): a parent
-            // completing between an outside-the-lock read and the INSERT would strand the child.
-            let allParentsDone = true;
-            if (dependsOn.length > 0) {
-                const placeholders = dependsOn.map(() => '?').join(', ');
-                // SAFETY: rows' shape matches the two columns named in the SELECT below.
-                const rows = db.prepare(`SELECT id, status FROM cards WHERE tenant_id = ? AND id IN (${placeholders})`).all(tenantId, ...dependsOn);
-                const found = new Map(rows.map((r) => [r.id, r.status]));
-                // Pre-check before any write: a typo'd --depends-on can never commit a card row.
-                for (const parentId of dependsOn) {
-                    if (!found.has(parentId)) {
-                        throw new Error(`unknown parent card id: ${parentId}`);
-                    }
-                }
-                allParentsDone = dependsOn.every((pid) => found.get(pid) === 'done');
-            }
-            id = generateId('card');
-            const now = new Date().toISOString();
-            const status = dependsOn.length === 0 || allParentsDone ? 'ready' : 'backlog';
-            db.prepare(`
-        INSERT INTO cards (id, title, status, repo, contract, budget, created_at, updated_at, tenant_id)
-        VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?)
-      `).run(id, input.title, status, input.repo ?? null, input.contract ?? null, input.budget ?? null, now, now, tenantId);
-            for (const parentId of dependsOn) {
-                db.prepare(`
-          INSERT INTO card_deps (parent, child, tenant_id, created_at) VALUES (?, ?, ?, ?)
-        `).run(parentId, id, tenantId, now);
-            }
-            db.exec('COMMIT');
-        }
-        catch (error) {
-            try {
-                db.exec('ROLLBACK');
-            }
-            catch { /* commit may have already rolled back */ }
-            throw error;
-        }
-        return loadCardRow(db, tenantId, id);
-    }
-    finally {
-        closeHippoDb(db);
-    }
-}
-/** Returns the card row for id, or null if it does not exist under this tenant. */
-export function loadCard(hippoRoot, tenantId, id) {
-    assertTenantId('loadCard', tenantId);
-    initStore(hippoRoot);
-    const db = openHippoDb(hippoRoot);
-    try {
-        return loadCardRow(db, tenantId, id);
-    }
-    finally {
-        closeHippoDb(db);
-    }
-}
-/** Lists cards for this tenant, optionally filtered to one status, newest-updated first. */
-export function listCards(hippoRoot, tenantId, opts = {}) {
-    assertTenantId('listCards', tenantId);
-    initStore(hippoRoot);
-    const db = openHippoDb(hippoRoot);
-    try {
-        const conditions = ['tenant_id = ?'];
-        const params = [tenantId];
-        if (opts.status) {
-            conditions.push('status = ?');
-            params.push(opts.status);
-        }
-        // SAFETY: rows' shape matches CARD_COLUMNS; status only ever holds a CardStatus value.
-        const rows = db.prepare(`
-      SELECT ${CARD_COLUMNS} FROM cards WHERE ${conditions.join(' AND ')} ORDER BY updated_at DESC, id DESC
-    `).all(...params);
-        return rows.map(rowToCard);
-    }
-    finally {
-        closeHippoDb(db);
-    }
-}
-/** Returns this card's parent and child ids from card_deps. */
-export function loadCardDeps(hippoRoot, tenantId, id) {
-    assertTenantId('loadCardDeps', tenantId);
-    initStore(hippoRoot);
-    const db = openHippoDb(hippoRoot);
-    try {
-        // SAFETY: rows' shape matches the single `parent` column named in the SELECT below.
-        const parents = db.prepare(`SELECT parent FROM card_deps WHERE tenant_id = ? AND child = ?`).all(tenantId, id).map((r) => r.parent);
-        // SAFETY: rows' shape matches the single `child` column named in the SELECT below.
-        const children = db.prepare(`SELECT child FROM card_deps WHERE tenant_id = ? AND parent = ?`).all(tenantId, id).map((r) => r.child);
-        return { parents, children };
-    }
-    finally {
-        closeHippoDb(db);
-    }
-}
-/** Returns this card's run history, most recent first. */
-export function loadCardRuns(hippoRoot, tenantId, id) {
-    assertTenantId('loadCardRuns', tenantId);
-    initStore(hippoRoot);
-    const db = openHippoDb(hippoRoot);
-    try {
-        // SAFETY: rows' shape matches CardRunRow.
-        const rows = db.prepare(`
-      SELECT id, card, runtime, session_id, started, ended, outcome
-      FROM card_runs WHERE tenant_id = ? AND card = ? ORDER BY started DESC, id DESC
-    `).all(tenantId, id);
-        return rows.map(rowToCardRun);
-    }
-    finally {
-        closeHippoDb(db);
-    }
-}
-/** Returns this card's comments, most recent first. */
-export function loadCardComments(hippoRoot, tenantId, id) {
-    assertTenantId('loadCardComments', tenantId);
-    initStore(hippoRoot);
-    const db = openHippoDb(hippoRoot);
-    try {
-        // SAFETY: rows' shape matches CardCommentRow.
-        const rows = db.prepare(`
-      SELECT id, card_id, author, body, created_at
-      FROM card_comments WHERE tenant_id = ? AND card_id = ? ORDER BY created_at DESC, id DESC
-    `).all(tenantId, id);
-        return rows.map(rowToCardComment);
-    }
-    finally {
-        closeHippoDb(db);
-    }
-}
-/** Read side of the card <-> handoff round trip: the newest handoff filed against this card. */
-export function loadLatestHandoffForCard(hippoRoot, tenantId, cardId) {
-    assertTenantId('loadLatestHandoffForCard', tenantId);
-    initStore(hippoRoot);
-    const db = openHippoDb(hippoRoot);
-    try {
-        // SAFETY: row's shape matches HANDOFF_COLUMNS.
-        const row = db.prepare(`
-      SELECT ${HANDOFF_COLUMNS} FROM session_handoffs
-      WHERE tenant_id = ? AND card_id = ? ORDER BY created_at DESC, id DESC LIMIT 1
-    `).get(tenantId, cardId);
-        return row ? rowToSessionHandoff(row) : null;
-    }
-    finally {
-        closeHippoDb(db);
-    }
-}
-/** Atomic claim: WHERE status IN (ready, blocked) AND assignee_runtime IS NULL decides the race. Throws on an unknown card id; returns null for a card not ready/blocked or already claimed. Sets a CARD_LEASE_MS lease and returns the new run's id as runId. */
-export function claimCard(hippoRoot, tenantId, id, runtime, sessionId) {
-    assertTenantId('claimCard', tenantId);
-    if (runtime.trim() === '') {
-        throw new Error('runtime must not be empty');
-    }
-    initStore(hippoRoot);
-    const db = openHippoDb(hippoRoot);
-    try {
-        db.exec('BEGIN IMMEDIATE');
-        let runId = 0;
-        try {
-            const changes = transitionCard(db, tenantId, id, ['ready', 'blocked'], 'running', {
-                setSql: 'assignee_runtime = ?',
-                whereSql: 'assignee_runtime IS NULL',
-                params: [runtime],
-            });
-            if (changes === 0) {
-                if (!loadCardRow(db, tenantId, id)) {
-                    throw new Error(`unknown card id: ${id}`);
-                }
-                db.exec('ROLLBACK');
-                return null;
-            }
-            const now = new Date().toISOString();
-            const insert = db.prepare(`
-        INSERT INTO card_runs (card, runtime, session_id, started, created_at, updated_at, tenant_id)
-        VALUES (?, ?, ?, ?, ?, ?, ?)
-      `).run(id, runtime, sessionId ?? null, now, now, now, tenantId);
-            runId = Number(insert.lastInsertRowid ?? 0);
-            db.exec('COMMIT');
-        }
-        catch (error) {
-            try {
-                db.exec('ROLLBACK');
-            }
-            catch { /* commit may have already rolled back */ }
-            throw error;
-        }
-        return { ...loadCardRow(db, tenantId, id), runId };
-    }
-    finally {
-        closeHippoDb(db);
-    }
-}
-/** Moves a running card's lease to CARD_LEASE_MS from now and records the heartbeat; updated_at is left alone. Throws on an unknown card id or a run id that is not a positive integer; returns null unless the card is running and runId is its live run. */
-export function heartbeatCard(hippoRoot, tenantId, id, runId) {
-    assertTenantId('heartbeatCard', tenantId);
-    assertRunId(runId);
-    initStore(hippoRoot);
-    const db = openHippoDb(hippoRoot);
-    try {
-        db.exec('BEGIN IMMEDIATE');
-        try {
-            const card = loadCardRow(db, tenantId, id);
-            if (!card) {
-                throw new Error(`unknown card id: ${id}`);
-            }
-            if (card.status !== 'running' || !isLiveRun(db, tenantId, id, runId)) {
-                db.exec('ROLLBACK');
-                return null;
-            }
-            const now = new Date().toISOString();
-            db.prepare(`UPDATE cards SET lease_until = ?, heartbeat_at = ? WHERE id = ? AND tenant_id = ?`)
-                .run(leaseUntilFrom(now), now, id, tenantId);
-            db.exec('COMMIT');
-        }
-        catch (error) {
-            try {
-                db.exec('ROLLBACK');
-            }
-            catch { /* commit may have already rolled back */ }
-            throw error;
-        }
-        return loadCardRow(db, tenantId, id);
-    }
-    finally {
-        closeHippoDb(db);
-    }
-}
-/** Requires the card be running; closes the live run as blocked and files reason as a comment. Throws on an unknown card id; returns null for a card not running. When runId is given, returns null unless it is the card's live run. */
-export function blockCard(hippoRoot, tenantId, id, reason, runId) {
-    assertTenantId('blockCard', tenantId);
-    if (reason.trim() === '') {
-        throw new Error('reason must not be empty');
-    }
-    if (runId !== undefined)
-        assertRunId(runId);
-    initStore(hippoRoot);
-    const db = openHippoDb(hippoRoot);
-    try {
-        db.exec('BEGIN IMMEDIATE');
-        try {
-            const allowed = runId === undefined || isLiveRun(db, tenantId, id, runId);
-            const changes = allowed ? transitionCard(db, tenantId, id, ['running'], 'blocked', { setSql: 'assignee_runtime = NULL' }) : 0;
-            if (changes === 0) {
-                if (!loadCardRow(db, tenantId, id)) {
-                    throw new Error(`unknown card id: ${id}`);
-                }
-                db.exec('ROLLBACK');
-                return null;
-            }
-            const now = new Date().toISOString();
-            // Close the interrupted run here so completeCard's ended IS NULL scope only ever matches the live run.
-            closeLiveRun(db, tenantId, id, 'blocked', now);
-            insertCardComment(db, tenantId, id, 'system', reason);
-            db.exec('COMMIT');
-        }
-        catch (error) {
-            try {
-                db.exec('ROLLBACK');
-            }
-            catch { /* commit may have already rolled back */ }
-            throw error;
-        }
-        return loadCardRow(db, tenantId, id);
-    }
-    finally {
-        closeHippoDb(db);
-    }
-}
-/** Requires the card be running; moves it to review, clearing its lease and heartbeat and keeping its live run. When runId is given, returns null unless it is the card's live run. Throws on an unknown card id; returns null for a card not running. */
-export function reviewCard(hippoRoot, tenantId, id, runId) {
-    assertTenantId('reviewCard', tenantId);
-    if (runId !== undefined)
-        assertRunId(runId);
-    initStore(hippoRoot);
-    const db = openHippoDb(hippoRoot);
-    try {
-        db.exec('BEGIN IMMEDIATE');
-        try {
-            const allowed = runId === undefined || isLiveRun(db, tenantId, id, runId);
-            const changes = allowed ? transitionCard(db, tenantId, id, ['running'], 'review') : 0;
-            if (changes === 0) {
-                if (!loadCardRow(db, tenantId, id)) {
-                    throw new Error(`unknown card id: ${id}`);
-                }
-                db.exec('ROLLBACK');
-                return null;
-            }
-            db.exec('COMMIT');
-        }
-        catch (error) {
-            try {
-                db.exec('ROLLBACK');
-            }
-            catch { /* commit may have already rolled back */ }
-            throw error;
-        }
-        return loadCardRow(db, tenantId, id);
-    }
-    finally {
-        closeHippoDb(db);
-    }
-}
-/** Requires the card be in review; closes the live run with outcome. Outcome 'success' moves the card to done and, in the same transaction, promotes any child whose parents are now all done; 'failure' or 'partial' moves it to shelved and promotes nothing. Throws on an unknown card id; returns null for a card not in review. When runId is given, returns null unless it is the card's live run. */
-export function completeCard(hippoRoot, tenantId, id, outcome, runId) {
-    assertTenantId('completeCard', tenantId);
-    if (!isHandoffOutcome(outcome)) {
-        throw new Error(`invalid card outcome: ${String(outcome)}`);
-    }
-    if (runId !== undefined)
-        assertRunId(runId);
-    initStore(hippoRoot);
-    const db = openHippoDb(hippoRoot);
-    try {
-        db.exec('BEGIN IMMEDIATE');
-        let promotedChildren = [];
-        try {
-            const target = outcome === 'success' ? 'done' : 'shelved';
-            const allowed = runId === undefined || isLiveRun(db, tenantId, id, runId);
-            const changes = allowed ? transitionCard(db, tenantId, id, ['review'], target) : 0;
-            if (changes === 0) {
-                if (!loadCardRow(db, tenantId, id)) {
-                    throw new Error(`unknown card id: ${id}`);
-                }
-                db.exec('ROLLBACK');
-                return null;
-            }
-            const now = new Date().toISOString();
-            closeLiveRun(db, tenantId, id, outcome, now);
-            // Not best-effort (rule 12): promotion runs in this same transaction, so a
-            // card can never be `done` with an un-evaluated child.
-            if (target === 'done') {
-                // SAFETY: rows' shape matches the single `child` column named in the SELECT below.
-                const children = db.prepare(`SELECT child FROM card_deps WHERE tenant_id = ? AND parent = ?`).all(tenantId, id).map((r) => r.child);
-                for (const childId of children) {
-                    // SAFETY: row's shape matches the single `status` column named in the SELECT below.
-                    const child = db.prepare(`SELECT status FROM cards WHERE tenant_id = ? AND id = ?`).get(tenantId, childId);
-                    if (!child || child.status !== 'backlog')
-                        continue;
-                    // SAFETY: rows' shape matches the single `parent` column named in the SELECT below.
-                    const parents = db.prepare(`SELECT parent FROM card_deps WHERE tenant_id = ? AND child = ?`).all(tenantId, childId).map((r) => r.parent);
-                    const placeholders = parents.map(() => '?').join(', ');
-                    // SAFETY: row's shape matches the single `c` column named in the SELECT below.
-                    const doneCount = db.prepare(`SELECT COUNT(*) as c FROM cards WHERE tenant_id = ? AND id IN (${placeholders}) AND status = 'done'`).get(tenantId, ...parents).c;
-                    if (doneCount === parents.length) {
-                        transitionCard(db, tenantId, childId, ['backlog'], 'ready');
-                        promotedChildren.push(childId);
-                    }
-                }
-            }
-            db.exec('COMMIT');
-        }
-        catch (error) {
-            try {
-                db.exec('ROLLBACK');
-            }
-            catch { /* commit may have already rolled back */ }
-            throw error;
-        }
-        return { card: loadCardRow(db, tenantId, id), promotedChildren };
-    }
-    finally {
-        closeHippoDb(db);
-    }
-}
-/** Returns to ready every running card of the tenant whose lease has expired or is missing: clears its assignee, closes its live run as 'reclaimed' and leaves its handoffs alone, all in one write transaction. Returns the reclaimed card ids in id order. */
-export function reclaimExpiredCards(hippoRoot, tenantId) {
-    assertTenantId('reclaimExpiredCards', tenantId);
-    initStore(hippoRoot);
-    const db = openHippoDb(hippoRoot);
-    try {
-        db.exec('BEGIN IMMEDIATE');
-        try {
-            // Read lease times under the write lock, so a heartbeat that committed while we waited wins.
-            const now = new Date().toISOString();
-            // SAFETY: rows' shape matches the single `id` column named in the SELECT below.
-            const ids = db.prepare(`
-        SELECT id FROM cards
-        WHERE tenant_id = ? AND status = 'running' AND (lease_until IS NULL OR lease_until < ?)
-        ORDER BY id
-      `).all(tenantId, now).map((r) => r.id);
-            for (const id of ids) {
-                transitionCard(db, tenantId, id, ['running'], 'ready', { setSql: 'assignee_runtime = NULL' });
-                closeLiveRun(db, tenantId, id, 'reclaimed', now);
-            }
-            db.exec('COMMIT');
-            return ids;
-        }
-        catch (error) {
-            try {
-                db.exec('ROLLBACK');
-            }
-            catch { /* commit may have already rolled back */ }
-            throw error;
-        }
-    }
-    finally {
-        closeHippoDb(db);
-    }
-}
-/** Appends a comment to cardId in any card status; throws if cardId is not a card of this tenant. */
-export function addCardComment(hippoRoot, tenantId, cardId, author, body) {
-    assertTenantId('addCardComment', tenantId);
-    if (body.trim() === '') {
-        throw new Error('body must not be empty');
-    }
-    initStore(hippoRoot);
-    const db = openHippoDb(hippoRoot);
-    try {
-        return insertCardComment(db, tenantId, cardId, author, body);
-    }
-    finally {
-        closeHippoDb(db);
-    }
-}
-// ---------------------------------------------------------------------------
-// v0.30 / E1 of DAG live-coupling — dirty-flag helpers for the existing
-// DAG layer's level-2 summaries.
-//
-// Used by E2 (child-write propagation in invalidation.ts / writeEntry /
-// forgetMemory / archiveRawMemory) to mark a summary dirty when one of its
-// children changes, and by E3's sleep-cycle rebuildDirtySummaries phase to
-// enumerate candidates without scanning every memory row.
-// ---------------------------------------------------------------------------
-/**
- * Load summaries flagged dirty for the given tenant. Sorted by latest_at
- * DESC (NULLS LAST) so E3's rebuild cap (HIPPO_DAG_REBUILD_CAP, default 20)
- * takes the most-recently-changed summaries first.
- *
- * Returns full MemoryEntry shape via MEMORY_SELECT_COLUMNS + rowToEntry
- * (v28 fields are part of the standard read path).
- */
-export function loadDirtySummaries(hippoRoot, tenantId) {
-    assertTenantId('loadDirtySummaries', tenantId);
-    initStore(hippoRoot);
-    const db = openHippoDb(hippoRoot);
-    try {
-        // SAFETY: this query selects exactly MEMORY_SELECT_COLUMNS, matching
-        // MemoryRow's field set.
-        const rows = db.prepare(`
-      SELECT ${MEMORY_SELECT_COLUMNS}
-        FROM memories
-       WHERE summary_dirty = 1
-         AND tenant_id = ?
-         AND kind != 'archived'
-       ORDER BY latest_at DESC NULLS LAST, id ASC
-    `).all(tenantId);
-        return rows.map(rowToEntry);
-    }
-    finally {
-        closeHippoDb(db);
-    }
-}
-/**
- * v0.30 / E2 — in-transaction variant of markSummaryDirty. Takes an open
- * db (caller is responsible for any SAVEPOINT/BEGIN). Used by E2's hook
- * sites: writeEntryDbOnly, api.supersede CAS, deleteEntry, archiveRawMemory,
- * batchWriteAndDelete. Each child mutation's dirty-mark is atomic with the
- * mutation itself (where the mutation IS in a SAVEPOINT/BEGIN — deleteEntry
- * is the exception, acceptably non-atomic by design).
- *
- * EXPORTED (required for cross-module use by api.ts + raw-archive.ts).
- * Risk of misuse (caller without open tx) is mitigated by the InTx
- * suffix + the DatabaseSyncLike typed param. Public surface for end users
- * stays at the markSummaryDirty (own-connection) variant.
- *
- * Same idempotency contract: 0->1 transition only, audit row only on
- * transition, no-op on non-summary / archived / unknown id / cross-tenant.
- */
-export function markSummaryDirtyInTx(db, summaryId, tenantId, actor) {
-    // v0.30 / E5: widened dag_level=2 -> IN (2, 3). RETURNING dag_level reads
-    // actual level in same round trip so audit metadata stays accurate without
-    // a SELECT-before-UPDATE extra DB op on this hot path (5 caller sites).
-    // SAFETY: result's shape matches the single `dag_level` column returned
-    // above.
-    const result = db.prepare(`
-    UPDATE memories
-       SET summary_dirty = 1
-     WHERE id = ?
-       AND tenant_id = ?
-       AND dag_level IN (2, 3)
-       AND summary_dirty = 0
-       AND kind != 'archived'
-    RETURNING dag_level
-  `).get(summaryId, tenantId);
-    if (result) {
-        audit(db, 'summary_marked_dirty', summaryId, { dag_level: result.dag_level, source: 'E2' }, actor, tenantId);
-    }
-}
-/**
- * Mark a summary as dirty. Idempotent (re-marking dirty is a no-op + no
- * second audit row). Tenant-scoped to prevent cross-tenant writes via
- * parent-lookup. Called by E2 from invalidation.ts / writeEntry /
- * forgetMemory / archiveRawMemory whenever a child is invalidated,
- * superseded, forgotten, or archived.
- *
- * Quietly no-ops if the target row doesn't exist or isn't a level-2
- * summary (E5 will widen the dag_level guard to IN (2, 3) when level-3
- * build path lands). Emits a 'summary_marked_dirty' audit row on actual
- * state transitions (0 -> 1) via the audit() helper, which try/catches
- * for missing audit_log (the v27 self-heal scenario).
- */
-export function markSummaryDirty(hippoRoot, summaryId, tenantId, actor = 'cli') {
-    assertTenantId('markSummaryDirty', tenantId);
-    initStore(hippoRoot);
-    const db = openHippoDb(hippoRoot);
-    try {
-        // v0.30 / E5: widened dag_level=2 -> IN (2, 3). RETURNING dag_level reads
-        // actual level in same round trip.
-        // SAFETY: result's shape matches the single `dag_level` column returned
-        // above.
-        const result = db.prepare(`
-      UPDATE memories
-         SET summary_dirty = 1
-       WHERE id = ?
-         AND tenant_id = ?
-         AND dag_level IN (2, 3)
-         AND summary_dirty = 0
-         AND kind != 'archived'
-      RETURNING dag_level
-    `).get(summaryId, tenantId);
-        if (result) {
-            // audit() wraps appendAuditEvent in try/catch (v27 heal scenario).
-            // metadata.source=E1 leaves a breadcrumb so E2-E5 debugging can
-            // distinguish dirty-marks across the arc's wiring layers.
-            audit(db, 'summary_marked_dirty', summaryId, { dag_level: result.dag_level, source: 'E1' }, actor, tenantId);
-        }
-    }
-    finally {
-        closeHippoDb(db);
-    }
-}
-// ---------------------------------------------------------------------------
-// v0.30 / E3 of DAG live-coupling — sleep-cycle rebuild surface.
-//
-// loadAllDirtySummaries / loadChildrenOfSummary / applyRebuildResult /
-// clearSummaryDirtyAfterBuild live HERE (not in dag.ts) because they need
-// module-private MEMORY_SELECT_COLUMNS, MemoryRow, rowToEntry, audit,
-// syncFtsRow, assertTenantId. dag.ts owns only the thin orchestrator
-// rebuildDirtySummaries() that calls into these.
-// ---------------------------------------------------------------------------
-/**
- * v0.30 / E5 — host-wide loader for L2 topic summaries without an L3 parent.
- * Used by consolidate phase 1.9 (buildEntityProfiles) to cluster L2s into
- * L3 entity profiles. Mirrors loadAllDirtySummaries pattern (E3): SQL-level
- * filter is cheaper than reusing in-memory `survivors` (which doesn't
- * contain L2s freshly created by phase 1.7 buildDag).
- *
- * Returns entries with tenantId attached so per-cluster writes stay
- * tenant-scoped via summary.tenantId.
- */
-export function loadAllL2Summaries(hippoRoot) {
-    initStore(hippoRoot);
-    const db = openHippoDb(hippoRoot);
-    try {
-        // SAFETY: this query selects exactly MEMORY_SELECT_COLUMNS, matching
-        // MemoryRow's field set.
-        const rows = db.prepare(`
-      SELECT ${MEMORY_SELECT_COLUMNS}
-        FROM memories
-       WHERE dag_level = 2
-         AND dag_parent_id IS NULL
-         AND kind != 'archived'
-       ORDER BY created ASC, id ASC
-    `).all();
-        return rows.map(rowToEntry);
-    }
-    finally {
-        closeHippoDb(db);
-    }
-}
-/**
- * v0.30 / E3 — host-wide variant of loadDirtySummaries. Iterates all tenants
- * in one query so consolidate.ts (host-wide per L106-109) does not need a
- * per-tenant loop. Each returned MemoryEntry carries its own tenantId (via
- * rowToEntry), so per-summary children + rebuild UPDATE stay tenant-scoped.
- *
- * Sort: latest_at DESC NULLS LAST, id ASC — same as per-tenant variant so
- * HIPPO_DAG_REBUILD_CAP takes most-recently-changed summaries first.
- */
-export function loadAllDirtySummaries(hippoRoot) {
-    initStore(hippoRoot);
-    const db = openHippoDb(hippoRoot);
-    try {
-        // SAFETY: this query selects exactly MEMORY_SELECT_COLUMNS, matching
-        // MemoryRow's field set.
-        const rows = db.prepare(`
-      SELECT ${MEMORY_SELECT_COLUMNS}
-        FROM memories
-       WHERE summary_dirty = 1
-         AND kind != 'archived'
-       ORDER BY latest_at DESC NULLS LAST, id ASC
-    `).all();
-        return rows.map(rowToEntry);
-    }
-    finally {
-        closeHippoDb(db);
-    }
-}
-/**
- * v0.30 / E3 — load live children of a DAG summary. Used by
- * rebuildDirtySummaries to regenerate content from the CURRENT child set
- * (not the children at create-time). Skips archived. Tenant-scoped
- * (defence in depth — dag_parent_id is unique-ish but tenant guard is
- * cheap). created column is TEXT NOT NULL since db.ts schema v1.
- */
-export function loadChildrenOfSummary(hippoRoot, summaryId, tenantId) {
-    assertTenantId('loadChildrenOfSummary', tenantId);
-    initStore(hippoRoot);
-    const db = openHippoDb(hippoRoot);
-    try {
-        // SAFETY: this query selects exactly MEMORY_SELECT_COLUMNS, matching
-        // MemoryRow's field set.
-        const rows = db.prepare(`
-      SELECT ${MEMORY_SELECT_COLUMNS}
-        FROM memories
-       WHERE dag_parent_id = ?
-         AND tenant_id = ?
-         AND kind != 'archived'
-       ORDER BY created ASC
-    `).all(summaryId, tenantId);
-        return rows.map(rowToEntry);
-    }
-    finally {
-        closeHippoDb(db);
-    }
-}
-/**
- * v0.30 / E3 — apply a rebuild result to a dirty summary. Atomic: one
- * prepared UPDATE statement plus syncFtsRow inside one SAVEPOINT.
- * WHERE includes `AND summary_dirty = 1` so concurrent sleep's race-loser
- * becomes a no-op (no rebuild_count bump, no audit row).
- *
- * Returns `{ changed, refused }`. `changed` is true when this call's UPDATE
- * (content or metadata-only) affected a row; false on race-loss / unknown id
- * / archived / wrong dag_level. `refused` is true only when a tombstone hit
- * suppressed the content write AND the metadata UPDATE still landed — see
- * the return-semantics comment below for the full contract.
- */
-export function applyRebuildResult(hippoRoot, summary, patch) {
-    assertTenantId('applyRebuildResult', summary.tenantId);
-    initStore(hippoRoot);
-    const db = openHippoDb(hippoRoot);
-    try {
-        db.exec('SAVEPOINT rebuild_summary');
-        try {
-            const nowIso = new Date().toISOString();
-            // AT1 P1a fix (docs/plans/2026-08-15-at1-rejected-value-tombstone.md):
-            // applyRebuildResult's bumpRebuildCount branch wrote patch.content via
-            // a direct UPDATE, bypassing the rejection guard entirely (the guard
-            // lives in upsertEntryRow's INSERT path, which this function never
-            // calls). A rebuild that regenerates byte-identical content to an
-            // already-rejected value (e.g. deterministic summarization of an
-            // unchanged child set) would silently re-assert it every sleep cycle.
-            // Check BEFORE choosing which UPDATE to run — only the
-            // bumpRebuildCount branch ever writes content, so a miss or a
-            // zero-child call is a no-op here (one indexed point query, guarded
-            // path only).
-            const tombstone = patch.bumpRebuildCount
-                ? findRejectedValue(db, summary.tenantId, rejectionDigest(patch.content))
-                : null;
-            // On a hit: do NOT write the new content. Fall through to the SAME
-            // metadata-only behavior the zero-child branch already has —
-            // descendant_count/earliest_at/latest_at update + summary_dirty
-            // cleared, no content write, no rebuild_count bump. Clearing dirty
-            // (rather than leaving it set) is deliberate: leaving it dirty would
-            // make every following sleep cycle re-attempt and re-refuse the
-            // identical rebuild forever (the DAG-loop this fix closes).
-            const applyContentWrite = patch.bumpRebuildCount && !tombstone;
-            // ONE prepared UPDATE per branch. Test #8 inspects the SQL string.
-            // v0.30 / E5: widened dag_level=2 -> IN (2, 3) on both branches.
-            const sql = applyContentWrite
-                ? `UPDATE memories
-              SET content = ?,
-                  descendant_count = ?,
-                  earliest_at = ?,
-                  latest_at = ?,
-                  last_rebuilt_at = ?,
-                  rebuild_count = COALESCE(rebuild_count, 0) + 1,
-                  summary_dirty = 0
-            WHERE id = ?
-              AND tenant_id = ?
-              AND dag_level IN (2, 3)
-              AND summary_dirty = 1
-              AND kind != 'archived'`
-                : `UPDATE memories
-              SET descendant_count = ?,
-                  earliest_at = ?,
-                  latest_at = ?,
-                  summary_dirty = 0
-            WHERE id = ?
-              AND tenant_id = ?
-              AND dag_level IN (2, 3)
-              AND summary_dirty = 1
-              AND kind != 'archived'`;
-            const result = applyContentWrite
-                ? db.prepare(sql).run(patch.content, patch.descendant_count, patch.earliest_at, patch.latest_at, nowIso, summary.id, summary.tenantId)
-                : db.prepare(sql).run(patch.descendant_count, patch.earliest_at, patch.latest_at, summary.id, summary.tenantId);
-            // Return-value semantics (v0.30/T4 split): `changed` reflects whether
-            // THIS call's UPDATE (content or metadata-only) affected a row — NOT
-            // whether patch.content specifically landed. On a refusal, metadata
-            // still applies, so changed=true even though content did not change.
-            // This preserves the pre-T4 no-infinite-retry choice: the caller
-            // (dag.ts rebuildDirtySummaries) treats changed=false as "race lost,
-            // silently retry next cycle" — returning false on a refusal would
-            // retry the same doomed LLM rebuild forever, so changed=true settles
-            // this cycle (dirty cleared) regardless of refusal.
-            // `refused` is the T4 addition: true only when a tombstone hit AND
-            // the metadata UPDATE landed (changed=true) — a refusal that loses
-            // the race to a concurrent writer reports refused=false too, since
-            // nothing from this call took effect. Before T4, a refusal also
-            // counted toward the caller's `rebuilt` stat because `changed` alone
-            // could not distinguish it; the caller now increments `refused`
-            // instead of `rebuilt` when this is true, so the stat reflects what
-            // happened without changing dirty-clearing or retry behavior.
-            const changed = (result.changes ?? 0) > 0;
-            const refused = Boolean(tombstone) && changed;
-            if (tombstone && changed) {
-                // refused === true here (same condition, narrowed for the tombstone.*
-                // access below). Best-effort refusal audit, written INLINE inside
-                // this still-open SAVEPOINT — nothing here rolls back on a refusal
-                // (the metadata UPDATE above already committed to this savepoint), so the
-                // post-rollback auditRejectionRefusal helper (writeEntry/supersede's
-                // tool) is the wrong one here; a direct audit() call is correct and
-                // commits with the rest of this savepoint.
-                audit(db, 'reject_refusal', summary.id, { digest: tombstone.digest, reason: tombstone.reason }, patch.actor, summary.tenantId);
-                console.error(`applyRebuildResult: refused rebuild content for ${summary.id} — matches a rejected value ` +
-                    `(digest ${tombstone.digest.slice(0, 12)}...); metadata updated, content unchanged`);
-            }
-            if (changed) {
-                // FTS sync — bare UPDATE on memories does NOT update memories_fts.
-                // R1 HIGH must-fix from plan-eng-r1. Construct the patched entry in
-                // memory and reuse the existing syncFtsRow helper (delete-then-insert).
-                // earliest_at/latest_at preserve null semantics (R2 must-fix).
-                // AT1: content stays summary.content (unchanged) when the write was
-                // refused — applyContentWrite is false, so patch.content was never
-                // written to the row FTS must mirror.
-                const patchedEntry = {
-                    ...summary,
-                    content: applyContentWrite ? patch.content : summary.content,
-                    descendant_count: patch.descendant_count,
-                    earliest_at: patch.earliest_at,
-                    latest_at: patch.latest_at,
-                    summary_dirty: 0,
-                    last_rebuilt_at: applyContentWrite ? nowIso : summary.last_rebuilt_at,
-                    rebuild_count: applyContentWrite
-                        ? (summary.rebuild_count ?? 0) + 1
-                        : summary.rebuild_count,
-                };
-                syncFtsRow(db, patchedEntry);
-                audit(db, 'summary_rebuilt', summary.id, {
-                    // v0.30 / E5: read actual level from the summary in scope
-                    // (NOT hardcoded 2). L2 -> 2, L3 -> 3.
-                    dag_level: summary.dag_level,
-                    source: 'E3-rebuild',
-                    zero_children: patch.zeroChildren,
-                    descendant_count: patch.descendant_count,
-                }, patch.actor, summary.tenantId);
-            }
-            db.exec('RELEASE SAVEPOINT rebuild_summary');
-            return { changed, refused };
-        }
-        catch (e) {
-            try {
-                db.exec('ROLLBACK TO SAVEPOINT rebuild_summary');
-                db.exec('RELEASE SAVEPOINT rebuild_summary');
-            }
-            catch {
-                // Ignore rollback failures — throw below is what matters.
-            }
-            throw e;
-        }
-    }
-    finally {
-        closeHippoDb(db);
-    }
-}
-/**
- * v0.30 / E3 — clear summary_dirty on a freshly-built summary. Called by
- * buildDag immediately after the child-link loop finishes. Without this,
- * each member's writeEntry call fires markSummaryDirtyInTx on the just-
- * created parent (E2 hook at store.ts:1214), and the same sleep cycle's
- * E3 rebuild phase would re-rebuild every new summary (2x LLM cost).
- *
- * Idempotent: no-op + no audit if summary isn't dirty. Audit
- * source='buildDag-clean' distinguishes from E3-rebuild source.
- */
-export function clearSummaryDirtyAfterBuild(hippoRoot, summaryId, tenantId, actor = 'cli', source = 'buildDag-clean') {
-    assertTenantId('clearSummaryDirtyAfterBuild', tenantId);
-    initStore(hippoRoot);
-    const db = openHippoDb(hippoRoot);
-    try {
-        // v0.30 / E5: widened dag_level=2 -> IN (2, 3). RETURNING dag_level reads
-        // actual level so audit metadata stays accurate without an extra SELECT.
-        // SAFETY: result's shape matches the single `dag_level` column returned
-        // below.
-        const result = db.prepare(`
-      UPDATE memories
-         SET summary_dirty = 0
-       WHERE id = ?
-         AND tenant_id = ?
-         AND dag_level IN (2, 3)
-         AND summary_dirty = 1
-         AND kind != 'archived'
-      RETURNING dag_level
-    `).get(summaryId, tenantId);
-        if (result) {
-            // v0.30 / E5: source param distinguishes buildDag-clean (L2) from
-            // buildEntityProfiles-clean (L3) and any future build path.
-            audit(db, 'summary_marked_clean', summaryId, { dag_level: result.dag_level, source }, actor, tenantId);
-        }
-    }
-    finally {
-        closeHippoDb(db);
-    }
-}
-export { getHippoDbPath };
-//# sourceMappingURL=store.js.map