hippo-memory 1.59.0 → 1.61.0

package/dist/db/migrations/v38.js

@@ -0,0 +1,277 @@
+const ENTITIES_TABLE = `
+        CREATE TABLE entities (
+          id INTEGER PRIMARY KEY AUTOINCREMENT,
+          tenant_id TEXT NOT NULL,
+          entity_type TEXT NOT NULL
+            CHECK (entity_type IN ('person', 'project', 'customer', 'system', 'policy', 'decision')),
+          name TEXT NOT NULL,
+          memory_id TEXT,
+          source_kind TEXT NOT NULL CHECK (source_kind IN ('distilled', 'superseded')),
+          source_object_type TEXT
+            CHECK (source_object_type IS NULL OR source_object_type IN ('decision', 'policy', 'customer', 'project')),
+          source_object_id INTEGER,
+          created_at TEXT NOT NULL,
+          FOREIGN KEY (memory_id) REFERENCES memories(id) ON DELETE SET NULL
+        )
+      `;
+const RELATIONS_TABLE = `
+        CREATE TABLE relations (
+          id INTEGER PRIMARY KEY AUTOINCREMENT,
+          tenant_id TEXT NOT NULL,
+          from_entity_id INTEGER NOT NULL,
+          to_entity_id INTEGER NOT NULL,
+          rel_type TEXT NOT NULL
+            CHECK (rel_type IN ('owns', 'supersedes', 'depends-on', 'blocked-by', 'references')),
+          memory_id TEXT,
+          source_kind TEXT NOT NULL CHECK (source_kind IN ('distilled', 'superseded')),
+          source_object_type TEXT
+            CHECK (source_object_type IS NULL OR source_object_type IN ('decision', 'policy', 'customer', 'project')),
+          source_object_id INTEGER,
+          created_at TEXT NOT NULL,
+          FOREIGN KEY (from_entity_id) REFERENCES entities(id) ON DELETE CASCADE,
+          FOREIGN KEY (to_entity_id) REFERENCES entities(id) ON DELETE CASCADE,
+          FOREIGN KEY (memory_id) REFERENCES memories(id) ON DELETE SET NULL
+        )
+      `;
+// entities guard (dual-provenance): at least one valid provenance, no raw.
+//  - all-null  -> ABORT.
+//  - memory path (memory_id NOT NULL): source_kind == the FK'd memory's kind
+//    (raw / lying source_kind ABORT) AND tenant-match.
+//  - object path (memory_id NULL): the (type,id) points at an EXISTING same-tenant
+//    E2 row whose status is active|superseded (explicit 4-way CASE per table).
+const TRG_ENTITIES_CONSOLIDATED_ONLY_INSERT = `
+        CREATE TRIGGER IF NOT EXISTS trg_entities_consolidated_only_insert
+        BEFORE INSERT ON entities
+        BEGIN
+          SELECT CASE
+            WHEN (NEW.source_object_type IS NULL AND NEW.source_object_id IS NOT NULL)
+              OR (NEW.source_object_type IS NOT NULL AND NEW.source_object_id IS NULL)
+            THEN RAISE(ABORT, 'source_object_type and source_object_id must be set together (all-or-none)')
+            WHEN NEW.memory_id IS NULL AND NEW.source_object_id IS NULL
+            THEN RAISE(ABORT, 'graph row needs a memory or a source object')
+            WHEN NEW.memory_id IS NOT NULL AND NEW.source_kind != (SELECT kind FROM memories WHERE id = NEW.memory_id)
+            THEN RAISE(ABORT, 'entities.source_kind must equal the referenced memory kind; the graph indexes consolidated state only (no raw)')
+            WHEN NEW.memory_id IS NOT NULL AND NEW.tenant_id != (SELECT tenant_id FROM memories WHERE id = NEW.memory_id)
+            THEN RAISE(ABORT, 'entities.tenant_id must match memories.tenant_id for the referenced memory')
+            WHEN NEW.source_object_type ='decision'
+              AND NOT EXISTS (SELECT 1 FROM decisions WHERE id = NEW.source_object_id AND tenant_id = NEW.tenant_id AND status IN ('active', 'superseded'))
+            THEN RAISE(ABORT, 'entities.source_object must reference an active/superseded decision in the same tenant')
+            WHEN NEW.source_object_type ='policy'
+              AND NOT EXISTS (SELECT 1 FROM policies WHERE id = NEW.source_object_id AND tenant_id = NEW.tenant_id AND status IN ('active', 'superseded'))
+            THEN RAISE(ABORT, 'entities.source_object must reference an active/superseded policy in the same tenant')
+            WHEN NEW.source_object_type ='customer'
+              AND NOT EXISTS (SELECT 1 FROM customer_notes WHERE id = NEW.source_object_id AND tenant_id = NEW.tenant_id AND status IN ('active', 'superseded'))
+            THEN RAISE(ABORT, 'entities.source_object must reference an active/superseded customer_note in the same tenant')
+            WHEN NEW.source_object_type ='project'
+              AND NOT EXISTS (SELECT 1 FROM project_briefs WHERE id = NEW.source_object_id AND tenant_id = NEW.tenant_id AND status IN ('active', 'superseded'))
+            THEN RAISE(ABORT, 'entities.source_object must reference an active/superseded project_brief in the same tenant')
+          END;
+        END
+      `;
+const TRG_ENTITIES_CONSOLIDATED_ONLY_UPDATE = `
+        CREATE TRIGGER IF NOT EXISTS trg_entities_consolidated_only_update
+        BEFORE UPDATE ON entities
+        WHEN NEW.memory_id IS NOT OLD.memory_id
+          OR NEW.source_kind IS NOT OLD.source_kind
+          OR NEW.tenant_id IS NOT OLD.tenant_id
+          OR NEW.source_object_type IS NOT OLD.source_object_type
+          OR NEW.source_object_id IS NOT OLD.source_object_id
+        BEGIN
+          -- NO all-null ABORT on UPDATE: node:sqlite fires this BEFORE UPDATE trigger from
+          -- the FK ON DELETE SET NULL action even with recursive_triggers OFF (empirically
+          -- verified - the plan's "SET NULL does not fire the guard" premise is false for
+          -- this build). A mirror forget on a memory-only entity legitimately produces an
+          -- all-null row; aborting here would block the memory delete. The INSERT guard
+          -- still forbids CREATING a provenance-less row, and the next graph rebuild clears
+          -- any all-null orphan. A raw UPDATE to all-null is harmless (not recall-surfaced).
+          -- Object-path STATUS is validated only when the object columns THEMSELVES change
+          -- (an explicit re-point), NOT on the FK ON DELETE SET NULL transition (which changes
+          -- only memory_id). This threads the needle (codex P1 + P2 round 4): the SET NULL of a
+          -- since-closed object's mirror is NOT blocked (object cols unchanged -> object checks
+          -- skip), while an explicit raw UPDATE that re-points the row to a bad/closed/cross-
+          -- tenant object IS rejected. all-or-none + memory-path (raw/tenant) always apply.
+          SELECT CASE
+            WHEN (NEW.source_object_type IS NULL AND NEW.source_object_id IS NOT NULL)
+              OR (NEW.source_object_type IS NOT NULL AND NEW.source_object_id IS NULL)
+            THEN RAISE(ABORT, 'entities.source_object_type and source_object_id must be set together (all-or-none)')
+            WHEN NEW.memory_id IS NOT NULL AND NEW.source_kind != (SELECT kind FROM memories WHERE id = NEW.memory_id)
+            THEN RAISE(ABORT, 'entities.source_kind must equal the referenced memory kind; the graph indexes consolidated state only (no raw)')
+            WHEN NEW.memory_id IS NOT NULL AND NEW.tenant_id != (SELECT tenant_id FROM memories WHERE id = NEW.memory_id)
+            THEN RAISE(ABORT, 'entities.tenant_id must match memories.tenant_id for the referenced memory')
+            WHEN (NEW.source_object_type IS NOT OLD.source_object_type OR NEW.source_object_id IS NOT OLD.source_object_id OR NEW.tenant_id IS NOT OLD.tenant_id)
+              AND NEW.source_object_type ='decision'
+              AND NOT EXISTS (SELECT 1 FROM decisions WHERE id = NEW.source_object_id AND tenant_id = NEW.tenant_id AND status IN ('active', 'superseded'))
+            THEN RAISE(ABORT, 'entities.source_object must reference an active/superseded decision in the same tenant')
+            WHEN (NEW.source_object_type IS NOT OLD.source_object_type OR NEW.source_object_id IS NOT OLD.source_object_id OR NEW.tenant_id IS NOT OLD.tenant_id)
+              AND NEW.source_object_type ='policy'
+              AND NOT EXISTS (SELECT 1 FROM policies WHERE id = NEW.source_object_id AND tenant_id = NEW.tenant_id AND status IN ('active', 'superseded'))
+            THEN RAISE(ABORT, 'entities.source_object must reference an active/superseded policy in the same tenant')
+            WHEN (NEW.source_object_type IS NOT OLD.source_object_type OR NEW.source_object_id IS NOT OLD.source_object_id OR NEW.tenant_id IS NOT OLD.tenant_id)
+              AND NEW.source_object_type ='customer'
+              AND NOT EXISTS (SELECT 1 FROM customer_notes WHERE id = NEW.source_object_id AND tenant_id = NEW.tenant_id AND status IN ('active', 'superseded'))
+            THEN RAISE(ABORT, 'entities.source_object must reference an active/superseded customer_note in the same tenant')
+            WHEN (NEW.source_object_type IS NOT OLD.source_object_type OR NEW.source_object_id IS NOT OLD.source_object_id OR NEW.tenant_id IS NOT OLD.tenant_id)
+              AND NEW.source_object_type ='project'
+              AND NOT EXISTS (SELECT 1 FROM project_briefs WHERE id = NEW.source_object_id AND tenant_id = NEW.tenant_id AND status IN ('active', 'superseded'))
+            THEN RAISE(ABORT, 'entities.source_object must reference an active/superseded project_brief in the same tenant')
+          END;
+        END
+      `;
+// relations guard (dual-provenance) + the existing from/to endpoint same-tenant checks.
+const TRG_RELATIONS_CONSOLIDATED_ONLY_INSERT = `
+        CREATE TRIGGER IF NOT EXISTS trg_relations_consolidated_only_insert
+        BEFORE INSERT ON relations
+        BEGIN
+          SELECT CASE
+            WHEN (NEW.source_object_type IS NULL AND NEW.source_object_id IS NOT NULL)
+              OR (NEW.source_object_type IS NOT NULL AND NEW.source_object_id IS NULL)
+            THEN RAISE(ABORT, 'source_object_type and source_object_id must be set together (all-or-none)')
+            WHEN NEW.memory_id IS NULL AND NEW.source_object_id IS NULL
+            THEN RAISE(ABORT, 'graph row needs a memory or a source object')
+            WHEN NEW.memory_id IS NOT NULL AND NEW.source_kind != (SELECT kind FROM memories WHERE id = NEW.memory_id)
+            THEN RAISE(ABORT, 'relations.source_kind must equal the referenced memory kind; the graph indexes consolidated state only (no raw)')
+            WHEN NEW.memory_id IS NOT NULL AND NEW.tenant_id != (SELECT tenant_id FROM memories WHERE id = NEW.memory_id)
+            THEN RAISE(ABORT, 'relations.tenant_id must match memories.tenant_id for the referenced memory')
+            WHEN NEW.source_object_type ='decision'
+              AND NOT EXISTS (SELECT 1 FROM decisions WHERE id = NEW.source_object_id AND tenant_id = NEW.tenant_id AND status IN ('active', 'superseded'))
+            THEN RAISE(ABORT, 'relations.source_object must reference an active/superseded decision in the same tenant')
+            WHEN NEW.source_object_type ='policy'
+              AND NOT EXISTS (SELECT 1 FROM policies WHERE id = NEW.source_object_id AND tenant_id = NEW.tenant_id AND status IN ('active', 'superseded'))
+            THEN RAISE(ABORT, 'relations.source_object must reference an active/superseded policy in the same tenant')
+            WHEN NEW.source_object_type ='customer'
+              AND NOT EXISTS (SELECT 1 FROM customer_notes WHERE id = NEW.source_object_id AND tenant_id = NEW.tenant_id AND status IN ('active', 'superseded'))
+            THEN RAISE(ABORT, 'relations.source_object must reference an active/superseded customer_note in the same tenant')
+            WHEN NEW.source_object_type ='project'
+              AND NOT EXISTS (SELECT 1 FROM project_briefs WHERE id = NEW.source_object_id AND tenant_id = NEW.tenant_id AND status IN ('active', 'superseded'))
+            THEN RAISE(ABORT, 'relations.source_object must reference an active/superseded project_brief in the same tenant')
+            WHEN NEW.tenant_id != (SELECT tenant_id FROM entities WHERE id = NEW.from_entity_id)
+            THEN RAISE(ABORT, 'relations.tenant_id must match the from_entity tenant (no cross-tenant edges)')
+            WHEN NEW.tenant_id != (SELECT tenant_id FROM entities WHERE id = NEW.to_entity_id)
+            THEN RAISE(ABORT, 'relations.tenant_id must match the to_entity tenant (no cross-tenant edges)')
+          END;
+        END
+      `;
+const TRG_RELATIONS_CONSOLIDATED_ONLY_UPDATE = `
+        CREATE TRIGGER IF NOT EXISTS trg_relations_consolidated_only_update
+        BEFORE UPDATE ON relations
+        WHEN NEW.memory_id IS NOT OLD.memory_id
+          OR NEW.source_kind IS NOT OLD.source_kind
+          OR NEW.tenant_id IS NOT OLD.tenant_id
+          OR NEW.source_object_type IS NOT OLD.source_object_type
+          OR NEW.source_object_id IS NOT OLD.source_object_id
+          OR NEW.from_entity_id IS NOT OLD.from_entity_id
+          OR NEW.to_entity_id IS NOT OLD.to_entity_id
+        BEGIN
+          -- NO all-null ABORT on UPDATE (same reason as the entities UPDATE trigger): the FK
+          -- ON DELETE SET NULL fires this trigger in node:sqlite, and a mirror forget on a
+          -- memory-only relation legitimately nulls memory_id. The INSERT guard still forbids
+          -- creating a provenance-less relation; the rebuild clears any orphan.
+          -- Object-path STATUS validated only on an explicit object-column change, NOT on the
+          -- FK SET NULL transition (see the entities UPDATE trigger): SET NULL of a since-closed
+          -- object's mirror is not blocked (object cols unchanged), while an explicit re-point to
+          -- a bad object is rejected. all-or-none + memory-path + endpoint checks always apply.
+          SELECT CASE
+            WHEN (NEW.source_object_type IS NULL AND NEW.source_object_id IS NOT NULL)
+              OR (NEW.source_object_type IS NOT NULL AND NEW.source_object_id IS NULL)
+            THEN RAISE(ABORT, 'relations.source_object_type and source_object_id must be set together (all-or-none)')
+            WHEN NEW.memory_id IS NOT NULL AND NEW.source_kind != (SELECT kind FROM memories WHERE id = NEW.memory_id)
+            THEN RAISE(ABORT, 'relations.source_kind must equal the referenced memory kind; the graph indexes consolidated state only (no raw)')
+            WHEN NEW.memory_id IS NOT NULL AND NEW.tenant_id != (SELECT tenant_id FROM memories WHERE id = NEW.memory_id)
+            THEN RAISE(ABORT, 'relations.tenant_id must match memories.tenant_id for the referenced memory')
+            WHEN (NEW.source_object_type IS NOT OLD.source_object_type OR NEW.source_object_id IS NOT OLD.source_object_id OR NEW.tenant_id IS NOT OLD.tenant_id)
+              AND NEW.source_object_type ='decision'
+              AND NOT EXISTS (SELECT 1 FROM decisions WHERE id = NEW.source_object_id AND tenant_id = NEW.tenant_id AND status IN ('active', 'superseded'))
+            THEN RAISE(ABORT, 'relations.source_object must reference an active/superseded decision in the same tenant')
+            WHEN (NEW.source_object_type IS NOT OLD.source_object_type OR NEW.source_object_id IS NOT OLD.source_object_id OR NEW.tenant_id IS NOT OLD.tenant_id)
+              AND NEW.source_object_type ='policy'
+              AND NOT EXISTS (SELECT 1 FROM policies WHERE id = NEW.source_object_id AND tenant_id = NEW.tenant_id AND status IN ('active', 'superseded'))
+            THEN RAISE(ABORT, 'relations.source_object must reference an active/superseded policy in the same tenant')
+            WHEN (NEW.source_object_type IS NOT OLD.source_object_type OR NEW.source_object_id IS NOT OLD.source_object_id OR NEW.tenant_id IS NOT OLD.tenant_id)
+              AND NEW.source_object_type ='customer'
+              AND NOT EXISTS (SELECT 1 FROM customer_notes WHERE id = NEW.source_object_id AND tenant_id = NEW.tenant_id AND status IN ('active', 'superseded'))
+            THEN RAISE(ABORT, 'relations.source_object must reference an active/superseded customer_note in the same tenant')
+            WHEN (NEW.source_object_type IS NOT OLD.source_object_type OR NEW.source_object_id IS NOT OLD.source_object_id OR NEW.tenant_id IS NOT OLD.tenant_id)
+              AND NEW.source_object_type ='project'
+              AND NOT EXISTS (SELECT 1 FROM project_briefs WHERE id = NEW.source_object_id AND tenant_id = NEW.tenant_id AND status IN ('active', 'superseded'))
+            THEN RAISE(ABORT, 'relations.source_object must reference an active/superseded project_brief in the same tenant')
+            WHEN NEW.tenant_id != (SELECT tenant_id FROM entities WHERE id = NEW.from_entity_id)
+            THEN RAISE(ABORT, 'relations.tenant_id must match the from_entity tenant (no cross-tenant edges)')
+            WHEN NEW.tenant_id != (SELECT tenant_id FROM entities WHERE id = NEW.to_entity_id)
+            THEN RAISE(ABORT, 'relations.tenant_id must match the to_entity tenant (no cross-tenant edges)')
+          END;
+        END
+      `;
+// Recreated VERBATIM from v37 (logic unchanged): an entity that is a relation
+// endpoint cannot be moved cross-tenant while referenced. trg_memories_graph_referenced_guard
+// (on memories) and trg_graph_queue_* (on graph_extraction_queue) are NOT recreated
+// here: those tables are not dropped by v38, so the triggers survive.
+const TRG_ENTITIES_NO_TENANT_MOVE_WHEN_REFERENCED = `
+        CREATE TRIGGER IF NOT EXISTS trg_entities_no_tenant_move_when_referenced
+        BEFORE UPDATE ON entities
+        WHEN NEW.tenant_id IS NOT OLD.tenant_id
+          AND EXISTS (SELECT 1 FROM relations WHERE from_entity_id = OLD.id OR to_entity_id = OLD.id)
+        BEGIN
+          SELECT RAISE(ABORT, 'cannot move an entity cross-tenant while a relation references it as an endpoint (E3.3 graph-on-consolidated guard); rebuild/remove the relations first');
+        END
+      `;
+export const v38 = {
+    version: 38,
+    up: (db) => {
+        // E2-provenance: anchor graph entity/relation provenance to the authoritative E2
+        // object (decision/policy/customer-note/project-brief) instead of the decaying
+        // memory mirror (docs/plans/2026-06-03-graph-e2-provenance.md). An in-force E2
+        // object must STAY in the graph after its mirror memory is forgotten or
+        // consolidation-pruned. The graph is a PURE DERIVED CACHE (clearGraph + rebuild on
+        // every `graph extract` / `sleep`), so v38 DROPs+recreates entities/relations (no
+        // data copy) and the next extract repopulates. graph_extraction_queue is untouched.
+        //
+        // Two provenance paths, "at least one, no raw":
+        //  - memory path (memory_id NOT NULL): source_kind must equal the FK'd memory's live
+        //    kind and that kind is distilled|superseded (raw still ABORTs) + tenant-match.
+        //  - object path (memory_id NULL): source_object_type/id must reference an EXISTING
+        //    same-tenant E2 row whose status is active|superseded (not closed). E2 objects
+        //    are consolidated BY CONSTRUCTION, so the no-raw invariant still holds.
+        //  - all-null is rejected.
+        //
+        // memory_id is now NULLABLE with ON DELETE SET NULL (was NOT NULL / CASCADE), so a
+        // mirror forget/consolidate nulls the recall pointer without dropping the row. NOTE
+        // (empirically verified, contradicts the SQLite docs): node:sqlite DOES fire the
+        // BEFORE UPDATE guard from the FK SET NULL action even with recursive_triggers OFF.
+        // So the *_consolidated_only_UPDATE triggers deliberately OMIT the all-null ABORT
+        // (kept on INSERT) - otherwise a mirror delete of a memory-only row would be blocked.
+        // See the per-trigger comments below. A SET NULL leaves source_kind at its old value
+        // by design (the object path is distilled-by-construction; source_kind is only
+        // re-checked when memory_id NOT NULL).
+        // source_object_id is a SOFT (type,id) pointer (no hard FK) the rebuild re-validates,
+        // so a legitimate E2 hard-delete is never blocked; a `closed` E2 row drops at next
+        // extract. SQLite cannot parametrize a table name in a trigger, so the object-path
+        // validation is an explicit 4-way CASE (one arm per E2 table).
+        recreateGraphTables(db);
+        createGraphGuards(db);
+    },
+};
+function recreateGraphTables(db) {
+    // Drop child (relations FK entities) first, then parent.
+    db.exec('DROP TABLE IF EXISTS relations');
+    db.exec('DROP TABLE IF EXISTS entities');
+    db.exec(ENTITIES_TABLE);
+    db.exec(`CREATE INDEX IF NOT EXISTS idx_entities_tenant ON entities(tenant_id)`);
+    db.exec(`CREATE INDEX IF NOT EXISTS idx_entities_memory ON entities(memory_id)`);
+    db.exec(`CREATE INDEX IF NOT EXISTS idx_entities_source_object ON entities(source_object_type, source_object_id) WHERE source_object_id IS NOT NULL`);
+    db.exec(RELATIONS_TABLE);
+    db.exec(`CREATE INDEX IF NOT EXISTS idx_relations_tenant ON relations(tenant_id)`);
+    db.exec(`CREATE INDEX IF NOT EXISTS idx_relations_from ON relations(from_entity_id)`);
+    db.exec(`CREATE INDEX IF NOT EXISTS idx_relations_to ON relations(to_entity_id)`);
+    db.exec(`CREATE INDEX IF NOT EXISTS idx_relations_memory ON relations(memory_id)`);
+    // Mirrors idx_entities_source_object: removeGraphEntitiesForObject (close-time cleanup)
+    // deletes relations by (source_object_type, source_object_id), so index that pair.
+    db.exec(`CREATE INDEX IF NOT EXISTS idx_relations_source_object ON relations(source_object_type, source_object_id) WHERE source_object_id IS NOT NULL`);
+}
+function createGraphGuards(db) {
+    db.exec(TRG_ENTITIES_CONSOLIDATED_ONLY_INSERT);
+    db.exec(TRG_ENTITIES_CONSOLIDATED_ONLY_UPDATE);
+    db.exec(TRG_RELATIONS_CONSOLIDATED_ONLY_INSERT);
+    db.exec(TRG_RELATIONS_CONSOLIDATED_ONLY_UPDATE);
+    db.exec(TRG_ENTITIES_NO_TENANT_MOVE_WHEN_REFERENCED);
+}
+//# sourceMappingURL=v38.js.map

package/dist/db/migrations/v39.d.ts

@@ -0,0 +1,3 @@
+import type { Migration } from './types.js';
+export declare const v39: Migration;
+//# sourceMappingURL=v39.d.ts.map

package/dist/db/migrations/v39.js

@@ -0,0 +1,59 @@
+import * as os from 'os';
+import * as path from 'path';
+import { compareSemver } from '../../version.js';
+import { deriveOriginProject, originFromSource, isGlobalStoreRoot } from '../../project-identity.js';
+import { tableHasColumn } from '../tables.js';
+export const v39 = {
+    version: 39,
+    up: (db, ctx) => {
+        // Memory scope isolation (docs/plans/2026-07-01-memory-scope-isolation.md).
+        // origin_project: '<name>' = owned by that project, '' = user-global,
+        // NULL = legacy/unknown (ambient context treats NULL as deny).
+        if (!tableHasColumn(db, 'memories', 'origin_project')) {
+            db.exec(`ALTER TABLE memories ADD COLUMN origin_project TEXT`);
+        }
+        // Backfill on store-location evidence only (no path-tag guessing):
+        // 1. Rows shared from a project carry source 'shared:<project>:<ts>' -
+        //    take <project>; a share whose <project> is the home dir basename
+        //    maps to '' (user-global).
+        // 2. Every other row was written into THIS store, so it takes the
+        //    store's own origin: `<project>/.hippo` -> '<project>', the
+        //    home/global store -> '' (user-global).
+        // Rows stay NULL only when no hippoRoot was provided.
+        const hippoRoot = ctx?.hippoRoot;
+        if (hippoRoot) {
+            // Provenance-source evidence first (shared:<project>: / promoted:<localRoot>,
+            // parsed by the same helper the markdown-import stamp uses), then the
+            // store's own location for everything else.
+            const homeName = path.basename(os.homedir()).toLowerCase();
+            // SAFETY: sourcedRows' shape matches the two columns (id, source)
+            // named in the SELECT above.
+            const sourcedRows = db.prepare(`SELECT id, source FROM memories WHERE origin_project IS NULL AND (source LIKE 'shared:%' OR source LIKE 'promoted:%')`).all();
+            const setOrigin = db.prepare(`UPDATE memories SET origin_project = ? WHERE id = ?`);
+            for (const row of sourcedRows) {
+                const origin = originFromSource(row.source, homeName);
+                if (origin === null)
+                    continue;
+                setOrigin.run(origin, row.id);
+            }
+            // The global root itself is ALWAYS user-global (''), regardless of
+            // what surrounds it on disk - a HIPPO_HOME inside a dotfiles git
+            // repo must not stamp the whole corpus with that repo's name.
+            const storeOrigin = isGlobalStoreRoot(hippoRoot)
+                ? ''
+                : deriveOriginProject(path.dirname(hippoRoot));
+            db.prepare(`UPDATE memories SET origin_project = ? WHERE origin_project IS NULL`).run(storeOrigin);
+        }
+        // Rollback-safety guard (v24 precedent): a pre-isolation binary opening
+        // this DB would ignore origin_project and the secret veto and resume
+        // injecting cross-project rows. 1.24.0 is the first version with the
+        // isolation behavior. Forward-only - never lower an existing minimum.
+        // SAFETY: this get() result's shape matches the single `value` column
+        // named in the SELECT above.
+        const existingMin = db.prepare(`SELECT value FROM meta WHERE key = 'min_compatible_binary'`).get()?.value;
+        if (!existingMin || compareSemver('1.24.0', existingMin) > 0) {
+            db.prepare(`INSERT INTO meta(key, value) VALUES('min_compatible_binary', ?) ON CONFLICT(key) DO UPDATE SET value=excluded.value`).run('1.24.0');
+        }
+    },
+};
+//# sourceMappingURL=v39.js.map

package/dist/db/migrations/v40.d.ts

@@ -0,0 +1,3 @@
+import type { Migration } from './types.js';
+export declare const v40: Migration;
+//# sourceMappingURL=v40.d.ts.map

package/dist/db/migrations/v40.js

@@ -0,0 +1,74 @@
+export const v40 = {
+    version: 40,
+    up: (db) => {
+        // LC1 retrieval-trace persistence (docs/plans/2026-08-02-lc1-recall-trace-persistence.md).
+        // Follows the v18 goal_recall_log style: one parent trace row per
+        // recall, a WITHOUT ROWID child table for the ranked results, and a
+        // separate append-only outcomes table so audit_log pruning can never
+        // erase training data.
+        //
+        // F6 (deliberate, not an oversight): unlike v39, this migration does
+        // NOT bump `min_compatible_binary`. A pre-v40 binary opening this DB
+        // ignores the three new tables and keeps writing `last_retrieval_ids`
+        // exactly as before — it never touches `last_trace_id` (that key
+        // simply stays whatever it was). recordTraceOutcome's F4 consumer-
+        // side validation (recall-trace.ts) makes any resulting staleness
+        // harmless to linkage: it re-validates the named trace's tenant AND
+        // intersects credited ids against the trace's OWN result set before
+        // inserting, so a stale/mismatched trace id from an old-binary write
+        // gets silently skipped rather than mislinked. That preserves the
+        // plan's "drop the three tables + last_trace_id restores v39 behavior
+        // exactly" rollback promise — a min_compatible_binary bump would
+        // additionally lock old binaries out of the WHOLE store for what is
+        // purely an observability/training feature, which the rollback
+        // promise does not require.
+        db.exec(`
+        CREATE TABLE IF NOT EXISTS recall_traces (
+          id INTEGER PRIMARY KEY AUTOINCREMENT,
+          ts TEXT NOT NULL,
+          tenant_id TEXT NOT NULL DEFAULT 'default',
+          session_id TEXT,
+          pipeline TEXT NOT NULL CHECK (pipeline IN ('api','cli','context','mcp')),
+            -- 'mcp' reserved for the deferred MCP wire-up. Deliberate: SQLite
+            -- cannot ALTER a CHECK constraint, so extending it later means a
+            -- full table-rebuild migration. One unused enum value now is
+            -- cheaper than that rebuild.
+          query_hash TEXT NOT NULL,          -- sha256/16, NEVER raw query (audit convention, cli.ts:1532)
+          query_length INTEGER NOT NULL,
+          result_count INTEGER NOT NULL,
+          explain_mode INTEGER NOT NULL DEFAULT 0
+        );
+        CREATE INDEX IF NOT EXISTS idx_recall_traces_tenant_ts ON recall_traces(tenant_id, ts DESC);
+
+        CREATE TABLE IF NOT EXISTS recall_trace_results (
+          trace_id INTEGER NOT NULL REFERENCES recall_traces(id) ON DELETE CASCADE,
+          tenant_id TEXT NOT NULL DEFAULT 'default',  -- denormalized like goal_recall_log (v18
+                                                      -- precedent): tenant-scoped training queries
+                                                      -- over the memory index must not need a join
+                                                      -- back through recall_traces
+          memory_id TEXT NOT NULL,           -- NO FK to memories: traces must OUTLIVE forgotten
+                                             -- memories (they are LC2's negative class). PRAGMA
+                                             -- foreign_keys=ON is real, so an FK would either
+                                             -- block inserts or cascade-delete exactly the rows
+                                             -- training needs. Deliberate.
+          result_rank INTEGER NOT NULL,      -- NOT "rank" (SQL keyword; audit rule 10)
+          score REAL NOT NULL,
+          rerank_json TEXT,                  -- compact RerankStep[] when explain/trace present; else NULL
+          PRIMARY KEY (trace_id, result_rank)
+        ) WITHOUT ROWID;
+        CREATE INDEX IF NOT EXISTS idx_recall_trace_results_tenant_memory
+          ON recall_trace_results(tenant_id, memory_id);
+
+        CREATE TABLE IF NOT EXISTS recall_trace_outcomes (
+          id INTEGER PRIMARY KEY AUTOINCREMENT,
+          trace_id INTEGER NOT NULL REFERENCES recall_traces(id) ON DELETE CASCADE,
+          ts TEXT NOT NULL,
+          tenant_id TEXT NOT NULL DEFAULT 'default',
+          outcome TEXT NOT NULL CHECK (outcome IN ('positive','negative')),
+          memory_ids_json TEXT NOT NULL      -- ids actually credited by this outcome event
+        );
+        CREATE INDEX IF NOT EXISTS idx_recall_trace_outcomes_trace ON recall_trace_outcomes(trace_id);
+      `);
+    },
+};
+//# sourceMappingURL=v40.js.map

package/dist/db/migrations/v41.d.ts

@@ -0,0 +1,3 @@
+import type { Migration } from './types.js';
+export declare const v41: Migration;
+//# sourceMappingURL=v41.d.ts.map

package/dist/db/migrations/v41.js

@@ -0,0 +1,43 @@
+export const v41 = {
+    version: 41,
+    up: (db) => {
+        // AT1 rejected-value tombstone (docs/plans/2026-08-15-at1-rejected-value-tombstone.md).
+        // Additive table, template = v40 above. A human who rejects a fact gets
+        // a durable say: the write-path guard in upsertEntryRow refuses any
+        // write that would re-introduce a value whose normalized digest
+        // matches a row here.
+        //
+        // No raw content and no preview stored. Follows the raw_archive
+        // redaction precedent (raw-archive.ts payload is {redacted:true, ...}):
+        // a rejected value may itself be a secret or PII ("never store my key
+        // again") — persisting it in the tombstone would defeat the point. The
+        // human sees the content at reject time (CLI echoes it); afterwards
+        // `reason` is the human-readable identity.
+        //
+        // No FK on source_memory_id (v40 precedent above: tombstone outlives
+        // the row it was sourced from) — provenance only.
+        //
+        // Reserved-word check on column names (skill-episode lesson, rule 10):
+        // tenant/digest/reason/rejected/source/normalized/chars are non-reserved.
+        //
+        // No min_compatible_binary bump — a deliberate tradeoff (plan §2,
+        // flagged to the ship gate). An old binary sharing a synced store
+        // writes WITHOUT the guard until upgraded; documented in
+        // MEMORY_ENVELOPE.md rather than hard-locking every old binary out of
+        // the store, which is disproportionate for the dominant single-user
+        // single-binary deployment.
+        db.exec(`
+        CREATE TABLE IF NOT EXISTS rejected_values (
+          tenant_id  TEXT NOT NULL,
+          digest     TEXT NOT NULL,            -- sha256/64 of normalized content
+          reason     TEXT,                     -- human-supplied; the only description stored
+          rejected_by TEXT,                    -- actor ('user:<id>' / 'cli' / ...)
+          rejected_at TEXT NOT NULL,
+          source_memory_id TEXT,               -- provenance only; NO FK (tombstone outlives the row)
+          normalized_chars INTEGER,            -- weak sanity aid for humans listing tombstones
+          PRIMARY KEY (tenant_id, digest)
+        ) WITHOUT ROWID;
+      `);
+    },
+};
+//# sourceMappingURL=v41.js.map

package/dist/db/migrations/v42.d.ts

@@ -0,0 +1,3 @@
+import type { Migration } from './types.js';
+export declare const v42: Migration;
+//# sourceMappingURL=v42.d.ts.map

package/dist/db/migrations/v42.js

@@ -0,0 +1,41 @@
+import { tableHasColumn } from '../tables.js';
+export const v42 = {
+    version: 42,
+    up: (db) => {
+        // W1 handoff envelope (trajectories/01M2BQTM4AGFVMYY7G2XV5G7WY/plan.md).
+        // Five nullable columns so the envelope carries evidence and outcome
+        // and W2/W5 can filter on them without parsing JSON.
+        if (!tableHasColumn(db, 'session_handoffs', 'constraints_json')) {
+            db.exec(`ALTER TABLE session_handoffs ADD COLUMN constraints_json TEXT`);
+        }
+        if (!tableHasColumn(db, 'session_handoffs', 'evidence_json')) {
+            db.exec(`ALTER TABLE session_handoffs ADD COLUMN evidence_json TEXT`);
+        }
+        if (!tableHasColumn(db, 'session_handoffs', 'outcome')) {
+            db.exec(`ALTER TABLE session_handoffs ADD COLUMN outcome TEXT`);
+            // codex P2: backfill from session_complete so pre-existing handoffs don't
+            // all read as unfinished and get injected by the new 72h ambient fallback.
+            db.exec(`
+          UPDATE session_handoffs SET outcome = (
+            SELECT e.content FROM session_events e
+            WHERE e.tenant_id = session_handoffs.tenant_id AND e.session_id = session_handoffs.session_id
+              AND e.event_type = 'session_complete' AND e.content IN ('success','partial','failure')
+            ORDER BY e.created_at DESC, e.id DESC LIMIT 1
+          )
+          WHERE outcome IS NULL AND EXISTS (
+            SELECT 1 FROM session_events e
+            WHERE e.tenant_id = session_handoffs.tenant_id AND e.session_id = session_handoffs.session_id
+              AND e.event_type = 'session_complete' AND e.content IN ('success','partial','failure')
+          )
+        `);
+        }
+        if (!tableHasColumn(db, 'session_handoffs', 'target_runtime')) {
+            db.exec(`ALTER TABLE session_handoffs ADD COLUMN target_runtime TEXT`);
+        }
+        if (!tableHasColumn(db, 'session_handoffs', 'card_id')) {
+            db.exec(`ALTER TABLE session_handoffs ADD COLUMN card_id TEXT`);
+        }
+        db.exec(`CREATE INDEX IF NOT EXISTS idx_session_handoffs_tenant_outcome ON session_handoffs(tenant_id, outcome, created_at DESC)`);
+    },
+};
+//# sourceMappingURL=v42.js.map

package/dist/db/migrations/v43.d.ts

@@ -0,0 +1,3 @@
+import type { Migration } from './types.js';
+export declare const v43: Migration;
+//# sourceMappingURL=v43.d.ts.map

package/dist/db/migrations/v43.js

@@ -0,0 +1,67 @@
+export const v43 = {
+    version: 43,
+    up: (db) => {
+        // W2a work-queue cards (trajectories/01M2D5VSYJFK4YXQ0RG2NGCPYJ/plan.md). Additive only, v41 precedent.
+        db.exec(`
+        CREATE TABLE IF NOT EXISTS cards (
+          id TEXT PRIMARY KEY,
+          title TEXT NOT NULL,
+          status TEXT NOT NULL DEFAULT 'backlog',
+          assignee_runtime TEXT,
+          repo TEXT,
+          contract TEXT,
+          budget INTEGER,
+          lease_until TEXT,
+          heartbeat_at TEXT,
+          created_at TEXT NOT NULL,
+          updated_at TEXT NOT NULL,
+          tenant_id TEXT NOT NULL DEFAULT 'default',
+          scope TEXT
+        ) WITHOUT ROWID;
+        CREATE INDEX IF NOT EXISTS idx_cards_tenant_status
+          ON cards(tenant_id, status, updated_at DESC);
+
+        CREATE TABLE IF NOT EXISTS card_deps (
+          parent TEXT NOT NULL REFERENCES cards(id),
+          child TEXT NOT NULL REFERENCES cards(id),
+          tenant_id TEXT NOT NULL DEFAULT 'default',
+          created_at TEXT NOT NULL,
+          PRIMARY KEY (parent, child)
+        ) WITHOUT ROWID;
+        CREATE INDEX IF NOT EXISTS idx_card_deps_tenant_child
+          ON card_deps(tenant_id, child);
+        CREATE INDEX IF NOT EXISTS idx_card_deps_tenant_parent
+          ON card_deps(tenant_id, parent);
+
+        CREATE TABLE IF NOT EXISTS card_runs (
+          id INTEGER PRIMARY KEY AUTOINCREMENT,
+          card TEXT NOT NULL REFERENCES cards(id),
+          runtime TEXT NOT NULL,
+          session_id TEXT,
+          started TEXT NOT NULL,
+          ended TEXT,
+          outcome TEXT,
+          created_at TEXT NOT NULL,
+          updated_at TEXT NOT NULL,
+          tenant_id TEXT NOT NULL DEFAULT 'default'
+        );
+        CREATE INDEX IF NOT EXISTS idx_card_runs_tenant_card
+          ON card_runs(tenant_id, card, started DESC);
+
+        CREATE TABLE IF NOT EXISTS card_comments (
+          id INTEGER PRIMARY KEY AUTOINCREMENT,
+          card_id TEXT NOT NULL REFERENCES cards(id),
+          author TEXT NOT NULL,
+          body TEXT NOT NULL,
+          created_at TEXT NOT NULL,
+          tenant_id TEXT NOT NULL DEFAULT 'default'
+        );
+        CREATE INDEX IF NOT EXISTS idx_card_comments_tenant_card
+          ON card_comments(tenant_id, card_id, created_at DESC);
+
+        CREATE INDEX IF NOT EXISTS idx_session_handoffs_tenant_card
+          ON session_handoffs(tenant_id, card_id, created_at DESC);
+      `);
+    },
+};
+//# sourceMappingURL=v43.js.map

package/dist/db/migrations/v44.d.ts

@@ -0,0 +1,3 @@
+import type { Migration } from './types.js';
+export declare const v44: Migration;
+//# sourceMappingURL=v44.d.ts.map

package/dist/db/migrations/v44.js

@@ -0,0 +1,28 @@
+export const v44 = {
+    version: 44,
+    up: (db) => {
+        // Dormant memories (src/dormant.ts): with `dormant.enabled`, the sleep
+        // decay pass moves a faded memory here instead of deleting it. The row
+        // leaves `memories` in the same transaction, so recall, context and
+        // every sleep pass stop seeing it; entry_json is the full MemoryEntry
+        // snapshot `hippo dormant restore` writes back. No FK to memories (the
+        // memories row is gone by design). Additive only, v41 precedent: no
+        // min_compatible_binary bump. An older binary ignores the table and
+        // keeps deleting faded memories as it always did.
+        db.exec(`
+        CREATE TABLE IF NOT EXISTS dormant_memories (
+          tenant_id  TEXT NOT NULL DEFAULT 'default',
+          id         TEXT NOT NULL,
+          content    TEXT NOT NULL,
+          entry_json TEXT NOT NULL,
+          reason     TEXT NOT NULL,
+          strength   REAL NOT NULL,
+          dormant_at TEXT NOT NULL,
+          PRIMARY KEY (tenant_id, id)
+        ) WITHOUT ROWID;
+        CREATE INDEX IF NOT EXISTS idx_dormant_memories_tenant_time
+          ON dormant_memories(tenant_id, dormant_at DESC);
+      `);
+    },
+};
+//# sourceMappingURL=v44.js.map

package/dist/db/migrations/v45.d.ts

@@ -0,0 +1,3 @@
+import type { Migration } from './types.js';
+export declare const v45: Migration;
+//# sourceMappingURL=v45.d.ts.map