hippo-memory 1.60.0 → 1.62.0

package/dist/customer-notes.js

@@ -21,12 +21,13 @@
  */
 import { BadRequestError, ConflictError, NotFoundError } from './api-errors.js';
 import { openHippoDb, closeHippoDb } from './db.js';
-import { writeEntry } from './store.js';
+import { writeEntry } from './store/entry-writes.js';
 import { assertTenantId } from './tenant.js';
-import { markGraphDirty, removeGraphEntitiesForObject } from './graph.js';
+import { markGraphDirty, removeGraphEntitiesForObject } from './graph/write.js';
 import { createMemory, Layer } from './memory.js';
 import { appendAuditEvent } from './audit.js';
 import { objectHalfLifeDays } from './half-life-migration.js';
+import { keysetAfter } from './keyset.js';
 export const VALID_NOTE_STATES = new Set([
     'active',
     'superseded',
@@ -93,9 +94,79 @@ const NOTE_COLS = `
 function buildNoteContent(customer, note) {
     return `${customer}\n\n${note}`;
 }
-// ---------------------------------------------------------------------------
-// Public API
-// ---------------------------------------------------------------------------
+// Preflight the supersede target BEFORE inserting the new row (so the new
+// autoincrement id can never be its own supersede target); read the
+// predecessor version in the same SELECT for server-derived versioning.
+// Mirrors saveProjectBrief / saveSkill (codex P1 2026-05-28).
+function preflightNoteSupersede(db, tenantId, supersedesId) {
+    // SAFETY: SELECT projects exactly status, version; .get() returns that
+    // shape for the matching row, or undefined when no note/tenant pair matches.
+    const pred = db.prepare(`SELECT status, version FROM customer_notes WHERE id = ? AND tenant_id = ?`).get(supersedesId, tenantId);
+    if (!pred) {
+        throw new NotFoundError(`saveCustomerNote: note ${supersedesId} to supersede not found for tenant ${tenantId}`);
+    }
+    if (pred.status !== 'active') {
+        throw new ConflictError(`saveCustomerNote: note ${supersedesId} is not active (status='${pred.status}'); only active notes can be superseded.`);
+    }
+    return pred.version + 1;
+}
+function insertNoteRow(db, memoryId, w, version) {
+    const result = db.prepare(`
+    INSERT INTO customer_notes(
+      memory_id, tenant_id, customer, note, version,
+      status, superseded_by, superseded_at, change_summary, closed_at, created_at
+    ) VALUES (?, ?, ?, ?, ?, 'active', NULL, NULL, ?, NULL, ?)
+  `).run(memoryId, w.tenantId, w.customer, w.note, version, w.changeSummary, w.now);
+    return Number(result.lastInsertRowid ?? 0);
+}
+function supersedeNoteRow(db, w, supersedesId, noteId, version) {
+    const sup = db.prepare(`
+    UPDATE customer_notes
+    SET status = 'superseded', superseded_by = ?, superseded_at = ?
+    WHERE id = ? AND tenant_id = ? AND status = 'active' AND id != ?
+  `).run(noteId, w.now, supersedesId, w.tenantId, noteId);
+    if (sup.changes === 0) {
+        throw new ConflictError(`saveCustomerNote: note ${supersedesId} could not be superseded (no longer active or self-reference).`);
+    }
+    appendAuditEvent(db, {
+        tenantId: w.tenantId,
+        actor: w.actor,
+        op: 'customer_note_supersede',
+        targetId: String(supersedesId),
+        metadata: {
+            note_id: supersedesId,
+            superseded_by: noteId,
+            new_version: version,
+        },
+    });
+}
+/** The afterWrite body: preflight, INSERT, supersede, reload, create audit, all in one SAVEPOINT. */
+function writeNoteRow(db, memoryId, w) {
+    const version = w.supersedesId !== undefined ? preflightNoteSupersede(db, w.tenantId, w.supersedesId) : 1;
+    const noteId = insertNoteRow(db, memoryId, w, version);
+    if (w.supersedesId !== undefined)
+        supersedeNoteRow(db, w, w.supersedesId, noteId, version);
+    // SAFETY: SELECT ${NOTE_COLS} projects exactly the CustomerNoteRow columns;
+    // .get() returns that row, or undefined only if the just-inserted id can't
+    // be found.
+    const row = db.prepare(`SELECT ${NOTE_COLS} FROM customer_notes WHERE id = ?`)
+        .get(noteId);
+    if (!row)
+        throw new Error('saveCustomerNote: failed to reload saved note row');
+    // GDPR-light metadata: ids + flags only, no note text.
+    appendAuditEvent(db, {
+        tenantId: w.tenantId,
+        actor: w.actor,
+        op: 'customer_note_create',
+        targetId: String(noteId),
+        metadata: {
+            note_id: noteId,
+            customer: w.customer,
+            version,
+        },
+    });
+    return row;
+}
 /**
  * Create a customer_note (or a new version that supersedes an existing one). Writes
  * the memory mirror + the customer_notes row atomically inside writeEntry's SAVEPOINT.
@@ -124,75 +195,14 @@ export function saveCustomerNote(hippoRoot, tenantId, opts, actor = 'cli') {
         baseHalfLifeDays: objectHalfLifeDays(hippoRoot),
         tenantId,
     });
+    const w = {
+        tenantId, actor, customer, note: opts.note, changeSummary, supersedesId: opts.supersedesNoteId, now,
+    };
     let savedRow;
     writeEntry(hippoRoot, mem, {
         actor,
         afterWrite: (db, memoryId) => {
-            // Preflight the supersede target BEFORE inserting the new row (so the new
-            // autoincrement id can never be its own supersede target); read the
-            // predecessor version in the same SELECT for server-derived versioning.
-            // Mirrors saveProjectBrief / saveSkill (codex P1 2026-05-28).
-            let version = 1;
-            if (opts.supersedesNoteId !== undefined) {
-                // SAFETY: SELECT projects exactly status, version; .get() returns that
-                // shape for the matching row, or undefined when no note/tenant pair matches.
-                const pred = db.prepare(`SELECT status, version FROM customer_notes WHERE id = ? AND tenant_id = ?`).get(opts.supersedesNoteId, tenantId);
-                if (!pred) {
-                    throw new NotFoundError(`saveCustomerNote: note ${opts.supersedesNoteId} to supersede not found for tenant ${tenantId}`);
-                }
-                if (pred.status !== 'active') {
-                    throw new ConflictError(`saveCustomerNote: note ${opts.supersedesNoteId} is not active (status='${pred.status}'); only active notes can be superseded.`);
-                }
-                version = pred.version + 1;
-            }
-            const result = db.prepare(`
-        INSERT INTO customer_notes(
-          memory_id, tenant_id, customer, note, version,
-          status, superseded_by, superseded_at, change_summary, closed_at, created_at
-        ) VALUES (?, ?, ?, ?, ?, 'active', NULL, NULL, ?, NULL, ?)
-      `).run(memoryId, tenantId, customer, opts.note, version, changeSummary, now);
-            const noteId = Number(result.lastInsertRowid ?? 0);
-            if (opts.supersedesNoteId !== undefined) {
-                const sup = db.prepare(`
-          UPDATE customer_notes
-          SET status = 'superseded', superseded_by = ?, superseded_at = ?
-          WHERE id = ? AND tenant_id = ? AND status = 'active' AND id != ?
-        `).run(noteId, now, opts.supersedesNoteId, tenantId, noteId);
-                if (sup.changes === 0) {
-                    throw new ConflictError(`saveCustomerNote: note ${opts.supersedesNoteId} could not be superseded (no longer active or self-reference).`);
-                }
-                appendAuditEvent(db, {
-                    tenantId,
-                    actor,
-                    op: 'customer_note_supersede',
-                    targetId: String(opts.supersedesNoteId),
-                    metadata: {
-                        note_id: opts.supersedesNoteId,
-                        superseded_by: noteId,
-                        new_version: version,
-                    },
-                });
-            }
-            // SAFETY: SELECT ${NOTE_COLS} projects exactly the CustomerNoteRow columns;
-            // .get() returns that row, or undefined only if the just-inserted id can't
-            // be found.
-            const row = db.prepare(`SELECT ${NOTE_COLS} FROM customer_notes WHERE id = ?`)
-                .get(noteId);
-            if (!row)
-                throw new Error('saveCustomerNote: failed to reload saved note row');
-            savedRow = row;
-            // GDPR-light metadata: ids + flags only, no note text.
-            appendAuditEvent(db, {
-                tenantId,
-                actor,
-                op: 'customer_note_create',
-                targetId: String(noteId),
-                metadata: {
-                    note_id: noteId,
-                    customer,
-                    version,
-                },
-            });
+            savedRow = writeNoteRow(db, memoryId, w);
         },
         afterCommit: () => markGraphDirty(hippoRoot, tenantId, mem.id),
     });
@@ -284,6 +294,7 @@ export function loadCustomerNoteById(hippoRoot, tenantId, id) {
 export function loadCustomerNotes(hippoRoot, tenantId, opts = {}) {
     assertTenantId('loadCustomerNotes', tenantId);
     const limit = opts.limit ?? 100;
+    const after = keysetAfter('created_at', 'id', opts.after);
     if (opts.status && !VALID_NOTE_STATES.has(opts.status)) {
         throw new BadRequestError(`loadCustomerNotes: status must be one of ${Array.from(VALID_NOTE_STATES).join('|')}; got ${opts.status}`);
     }
@@ -299,13 +310,13 @@ export function loadCustomerNotes(hippoRoot, tenantId, opts = {}) {
             clauses.push('customer = ?');
             params.push(opts.customer);
         }
-        params.push(limit);
+        params.push(...after.params, limit);
         // SAFETY: SELECT ${NOTE_COLS} projects exactly the CustomerNoteRow columns
         // regardless of the dynamic WHERE clause built above; .all() returns rows
         // in that shape.
         const rows = db.prepare(`
       SELECT ${NOTE_COLS} FROM customer_notes
-      WHERE ${clauses.join(' AND ')}
+      WHERE ${clauses.join(' AND ')}${after.sql}
       ORDER BY created_at DESC, id DESC
       LIMIT ?
     `).all(...params);

package/dist/dag.js

@@ -1,5 +1,6 @@
 import { createMemory, Layer } from './memory.js';
-import { writeEntry, loadAllDirtySummaries, loadChildrenOfSummary, applyRebuildResult, clearSummaryDirtyAfterBuild, } from './store.js';
+import { writeEntry } from './store/entry-writes.js';
+import { loadAllDirtySummaries, loadChildrenOfSummary, applyRebuildResult, clearSummaryDirtyAfterBuild, } from './store/summaries.js';
 import { RejectedValueError } from './rejection.js';
 import { redactSecretsStrict } from './secret-detect.js';
 import { fetchWithRetry, llmTimeoutMs } from './http-retry.js';
@@ -86,17 +87,14 @@ export async function generateDagSummary(label, factContents, opts) {
         return null;
     }
 }
-export async function buildDag(hippoRoot, facts, opts) {
-    const result = { candidateClusters: 0, summariesCreated: 0, factsLinked: 0, rejected: 0 };
-    const baseHalfLifeDays = loadConfig(hippoRoot).defaultHalfLifeDays;
-    const unparented = facts.filter((f) => f.dag_level === 1 && !f.dag_parent_id && f.tags.includes('extracted'));
-    // Hardening follow-up (mirrors consolidate.ts's mergeCandidatesByTenant,
-    // T1): partition unparented facts by tenantId BEFORE clustering so a
-    // cluster can never mix facts from different tenants into one
-    // LLM-synthesized summary. Map preserves insertion order, so
-    // single-tenant stores (every row 'default') get exactly one partition
-    // and iterate in the same order as before this fix — byte-identical
-    // behavior there.
+// Hardening follow-up (mirrors consolidate.ts's mergeCandidatesByTenant,
+// T1): partition unparented facts by tenantId BEFORE clustering so a
+// cluster can never mix facts from different tenants into one
+// LLM-synthesized summary. Map preserves insertion order, so
+// single-tenant stores (every row 'default') get exactly one partition
+// and iterate in the same order as before this fix — byte-identical
+// behavior there.
+function partitionFactsByTenant(unparented) {
     const unparentedByTenant = new Map();
     for (const fact of unparented) {
         const key = derivationPartitionKey(fact.tenantId, fact.scope, fact.origin_project);
@@ -106,79 +104,149 @@ export async function buildDag(hippoRoot, facts, opts) {
         else
             unparentedByTenant.set(key, [fact]);
     }
-    for (const [, tenantFacts] of unparentedByTenant) {
-        const factTenant = tenantFacts[0].tenantId;
-        const factScope = derivationScope(tenantFacts[0].scope);
+    return unparentedByTenant;
+}
+/** The L2 summary entry for one cluster, landing in the facts' own tenant and scope. */
+function createClusterSummaryEntry(summary, cluster, home) {
+    const memberCreatedAts = cluster.members.map((m) => m.created).sort();
+    // Every member of `cluster` shares home.tenantId by construction (the
+    // tenant partition above), so the summary lands in the same tenant
+    // as the facts it summarizes instead of always 'default'
+    // (memory.ts:535 defaults tenantId when the option is omitted).
+    const summaryEntry = createMemory(summary, {
+        layer: Layer.Semantic,
+        tags: [...cluster.entityTags, ...neverAutoShareTags(cluster.members), 'dag-summary'],
+        confidence: 'inferred',
+        dag_level: 2,
+        tenantId: home.tenantId,
+        scope: home.scope,
+        baseHalfLifeDays: home.baseHalfLifeDays,
+    });
+    summaryEntry.origin_project = home.originProject;
+    // Schema v25: cache descendant_count + earliest/latest_at on the summary
+    // row so DAG-aware recall (docs/plans/2026-05-05-dag-recall.md Task 2)
+    // can reason about scope without walking the children.
+    summaryEntry.descendant_count = cluster.members.length;
+    summaryEntry.earliest_at = memberCreatedAts[0];
+    summaryEntry.latest_at = memberCreatedAts[memberCreatedAts.length - 1];
+    return summaryEntry;
+}
+/** Summarize one eligible cluster, write the summary, then re-parent its members under it. */
+async function summarizeCluster(hippoRoot, cluster, home, opts, result) {
+    const summary = await generateDagSummary(cluster.label, cluster.members.map((m) => m.content), opts);
+    if (!summary)
+        return;
+    const summaryEntry = createClusterSummaryEntry(summary, cluster, home);
+    // AT1 (plan §3 containment): a refused LLM-synthesized summary skips
+    // ONLY this cluster — the sleep cycle continues to the next one. The
+    // member re-parenting writes below never run for a skipped cluster
+    // (there is no summary id to parent them under).
+    //
+    // The tombstone check itself is tenant-scoped for free: writeEntry ->
+    // writeEntryDbOnly -> upsertEntryRow calls
+    // checkRejectionGuard(db, entry.tenantId ?? 'default', ...)
+    // (store/entry-writes.ts), reading tenantId off the entry being written. Now
+    // that summaryEntry carries home.tenantId instead of the implicit
+    // 'default', the guard consults that tenant's tombstones — no
+    // separate check needed here (unlike consolidate.ts's merge pass,
+    // which pre-checks via findRejectedValue because it writes through
+    // batchWriteAndDelete's bypassRejectionGuard path instead of
+    // writeEntry).
+    try {
+        writeEntry(hippoRoot, summaryEntry);
+    }
+    catch (err) {
+        if (err instanceof RejectedValueError) {
+            result.rejected++;
+            log.warn(`buildDag: cluster "${cluster.label}" skipped: summary matches a rejected value`);
+            return;
+        }
+        throw err;
+    }
+    result.summariesCreated++;
+    for (const member of cluster.members) {
+        const updated = { ...member, dag_parent_id: summaryEntry.id };
+        writeEntry(hippoRoot, updated);
+        result.factsLinked++;
+    }
+    // v0.30 / E3 — cancel the cascade of dirty-marks fired by member
+    // writeEntry calls (E2 hook on writeEntryDbOnly in store/entry-writes.ts).
+    // The summary we just built IS fresh, no rebuild needed. Without this,
+    // E3 in the SAME sleep cycle would re-rebuild every new summary
+    // (2x LLM cost). plan-eng-r1 HIGH must-fix.
+    clearSummaryDirtyAfterBuild(hippoRoot, summaryEntry.id, summaryEntry.tenantId, 'buildDag');
+}
+export async function buildDag(hippoRoot, facts, opts) {
+    const result = { candidateClusters: 0, summariesCreated: 0, factsLinked: 0, rejected: 0 };
+    const baseHalfLifeDays = loadConfig(hippoRoot).defaultHalfLifeDays;
+    const unparented = facts.filter((f) => f.dag_level === 1 && !f.dag_parent_id && f.tags.includes('extracted'));
+    for (const [, tenantFacts] of partitionFactsByTenant(unparented)) {
+        const home = {
+            tenantId: tenantFacts[0].tenantId,
+            scope: derivationScope(tenantFacts[0].scope),
+            originProject: tenantFacts[0].origin_project,
+            baseHalfLifeDays,
+        };
         const clusters = clusterFacts(tenantFacts);
         const eligibleClusters = clusters.filter((c) => c.members.length >= 3);
         result.candidateClusters += eligibleClusters.length;
         for (const cluster of eligibleClusters) {
-            const summary = await generateDagSummary(cluster.label, cluster.members.map((m) => m.content), opts);
-            if (!summary)
-                continue;
-            const memberCreatedAts = cluster.members.map((m) => m.created).sort();
-            // Every member of `cluster` shares factTenant by construction (the
-            // tenant partition above), so the summary lands in the same tenant
-            // as the facts it summarizes instead of always 'default'
-            // (memory.ts:535 defaults tenantId when the option is omitted).
-            const summaryEntry = createMemory(summary, {
-                layer: Layer.Semantic,
-                tags: [...cluster.entityTags, ...neverAutoShareTags(cluster.members), 'dag-summary'],
-                confidence: 'inferred',
-                dag_level: 2,
-                tenantId: factTenant,
-                scope: factScope,
-                baseHalfLifeDays,
-            });
-            summaryEntry.origin_project = tenantFacts[0].origin_project;
-            // Schema v25: cache descendant_count + earliest/latest_at on the summary
-            // row so DAG-aware recall (docs/plans/2026-05-05-dag-recall.md Task 2)
-            // can reason about scope without walking the children.
-            summaryEntry.descendant_count = cluster.members.length;
-            summaryEntry.earliest_at = memberCreatedAts[0];
-            summaryEntry.latest_at = memberCreatedAts[memberCreatedAts.length - 1];
-            // AT1 (plan §3 containment): a refused LLM-synthesized summary skips
-            // ONLY this cluster — the sleep cycle continues to the next one. The
-            // member re-parenting writes below never run for a skipped cluster
-            // (there is no summary id to parent them under).
-            //
-            // The tombstone check itself is tenant-scoped for free: writeEntry ->
-            // writeEntryDbOnly -> upsertEntryRow calls
-            // checkRejectionGuard(db, entry.tenantId ?? 'default', ...)
-            // (store.ts:1172), reading tenantId off the entry being written. Now
-            // that summaryEntry carries factTenant instead of the implicit
-            // 'default', the guard consults that tenant's tombstones — no
-            // separate check needed here (unlike consolidate.ts's merge pass,
-            // which pre-checks via findRejectedValue because it writes through
-            // batchWriteAndDelete's bypassRejectionGuard path instead of
-            // writeEntry).
-            try {
-                writeEntry(hippoRoot, summaryEntry);
-            }
-            catch (err) {
-                if (err instanceof RejectedValueError) {
-                    result.rejected++;
-                    log.warn(`buildDag: cluster "${cluster.label}" skipped: summary matches a rejected value`);
-                    continue;
-                }
-                throw err;
-            }
-            result.summariesCreated++;
-            for (const member of cluster.members) {
-                const updated = { ...member, dag_parent_id: summaryEntry.id };
-                writeEntry(hippoRoot, updated);
-                result.factsLinked++;
-            }
-            // v0.30 / E3 — cancel the cascade of dirty-marks fired by member
-            // writeEntry calls (E2 hook on writeEntryDbOnly at store.ts:1214).
-            // The summary we just built IS fresh, no rebuild needed. Without this,
-            // E3 in the SAME sleep cycle would re-rebuild every new summary
-            // (2x LLM cost). plan-eng-r1 HIGH must-fix.
-            clearSummaryDirtyAfterBuild(hippoRoot, summaryEntry.id, summaryEntry.tenantId, 'buildDag');
+            await summarizeCluster(hippoRoot, cluster, home, opts, result);
         }
     }
     return result;
 }
+/** Regenerate one dirty summary from its children and tally the outcome; throws reach the caller's isolation. */
+async function rebuildOneSummary(hippoRoot, summary, opts, result) {
+    const children = loadChildrenOfSummary(hippoRoot, summary.id, summary.tenantId);
+    if (children.length === 0) {
+        // Zero-child case: clear dirty + zero counts, no LLM call, no rebuild_count bump.
+        const { changed } = applyRebuildResult(hippoRoot, summary, {
+            content: summary.content,
+            descendant_count: 0,
+            earliest_at: null,
+            latest_at: null,
+            bumpRebuildCount: false,
+            zeroChildren: true,
+            actor: 'sleep',
+        });
+        if (changed)
+            result.zeroChildSkipped++;
+        // changed=false → race lost / row vanished; silently skip. `refused`
+        // is always false here — applyRebuildResult only checks the
+        // tombstone when bumpRebuildCount is true (store/summaries.ts).
+        return;
+    }
+    // Derive label from summary's existing entity tags (mirrors clusterFacts)
+    const entityTags = summary.tags.filter((t) => t.startsWith('speaker:') || t.startsWith('topic:'));
+    const label = entityTags.length > 0
+        ? entityTags.map((t) => t.split(':')[1]).join(': ')
+        : summary.content.slice(0, 40);
+    const newContent = await generateDagSummary(label, children.map((c) => c.content), opts);
+    if (!newContent) {
+        // LLM null / fetch error → leave dirty for next cycle
+        result.failed++;
+        return;
+    }
+    const childCreatedAts = children.map((c) => c.created).sort();
+    const { changed, refused } = applyRebuildResult(hippoRoot, summary, {
+        content: newContent,
+        descendant_count: children.length,
+        earliest_at: childCreatedAts[0],
+        latest_at: childCreatedAts[childCreatedAts.length - 1],
+        bumpRebuildCount: true,
+        zeroChildren: false,
+        actor: 'sleep',
+    });
+    if (refused) {
+        result.refused++;
+    }
+    else if (changed) {
+        result.rebuilt++;
+    }
+    // changed=false (refused also false) → race lost; not failure, not
+    // success, silently skip
+}
 /**
  * v0.30 / E3 — sleep-cycle phase that drains the dirty L2 summary queue.
  * Thin orchestrator; the heavy lifting lives in store.ts (load + apply)
@@ -220,59 +288,12 @@ export async function rebuildDirtySummaries(hippoRoot, opts) {
             await new Promise((resolve) => setImmediate(resolve));
         }
         try {
-            const children = loadChildrenOfSummary(hippoRoot, summary.id, summary.tenantId);
-            if (children.length === 0) {
-                // Zero-child case: clear dirty + zero counts, no LLM call, no rebuild_count bump.
-                const { changed } = applyRebuildResult(hippoRoot, summary, {
-                    content: summary.content,
-                    descendant_count: 0,
-                    earliest_at: null,
-                    latest_at: null,
-                    bumpRebuildCount: false,
-                    zeroChildren: true,
-                    actor: 'sleep',
-                });
-                if (changed)
-                    result.zeroChildSkipped++;
-                // changed=false → race lost / row vanished; silently skip. `refused`
-                // is always false here — applyRebuildResult only checks the
-                // tombstone when bumpRebuildCount is true (store.ts:3398).
-                continue;
-            }
-            // Derive label from summary's existing entity tags (mirrors clusterFacts)
-            const entityTags = summary.tags.filter((t) => t.startsWith('speaker:') || t.startsWith('topic:'));
-            const label = entityTags.length > 0
-                ? entityTags.map((t) => t.split(':')[1]).join(': ')
-                : summary.content.slice(0, 40);
-            const newContent = await generateDagSummary(label, children.map((c) => c.content), opts);
-            if (!newContent) {
-                // LLM null / fetch error → leave dirty for next cycle
-                result.failed++;
-                continue;
-            }
-            const childCreatedAts = children.map((c) => c.created).sort();
-            const { changed, refused } = applyRebuildResult(hippoRoot, summary, {
-                content: newContent,
-                descendant_count: children.length,
-                earliest_at: childCreatedAts[0],
-                latest_at: childCreatedAts[childCreatedAts.length - 1],
-                bumpRebuildCount: true,
-                zeroChildren: false,
-                actor: 'sleep',
-            });
-            if (refused) {
-                result.refused++;
-            }
-            else if (changed) {
-                result.rebuilt++;
-            }
-            // changed=false (refused also false) → race lost; not failure, not
-            // success, silently skip
+            await rebuildOneSummary(hippoRoot, summary, opts, result);
         }
         catch (err) {
             // Per-summary failure isolation — one throw doesn't abort the queue.
             // independent-review MED #2 fold: log enough to triage in production
-            // (audit() wraps its own writes try/catch per store.ts:2566, so a
+            // (audit() wraps its own writes try/catch per store/audit-event.ts, so a
             // throw here is exotic: SQLite I/O error, prepare failure, etc).
             result.failed++;
             log.error(`rebuildDirtySummaries: summary ${summary.id} (tenant ${summary.tenantId}) failed: ${err instanceof Error ? err.message : String(err)}`);
@@ -280,6 +301,76 @@ export async function rebuildDirtySummaries(hippoRoot, opts) {
     }
     return result;
 }
+// independent-review HIGH #1 fold: cluster ONLY within-tenant.
+// clusterFacts has no tenant awareness; without this partition step a
+// multi-tenant host could form a cluster spanning tenants and produce
+// a single L3 with tenantId='default' that doesn't belong to either
+// child tenant. Fix: bucket by tenantId, run clusterFacts per-tenant,
+// pass tenantId to createMemory.
+function partitionL2sByTenant(unparented) {
+    const byTenant = new Map();
+    for (const l2 of unparented) {
+        const tid = l2.tenantId ?? 'default';
+        const key = derivationPartitionKey(tid, l2.scope, l2.origin_project);
+        const list = byTenant.get(key) ?? [];
+        list.push(l2);
+        byTenant.set(key, list);
+    }
+    return byTenant;
+}
+/** The L3 profile entry for one cluster of L2 summaries. */
+function createProfileEntry(summary, cluster, home) {
+    const memberCreatedAts = cluster.members.map((m) => m.created).sort();
+    const nowIso = new Date().toISOString();
+    const profileEntry = createMemory(summary, {
+        layer: Layer.Semantic,
+        tags: [...cluster.entityTags, ...neverAutoShareTags(cluster.members), 'dag-entity-profile'],
+        confidence: 'inferred',
+        dag_level: 3,
+        tenantId: home.tenantId, // HIGH #1 fold: thread tenant explicitly
+        scope: home.scope,
+        baseHalfLifeDays: home.baseHalfLifeDays,
+    });
+    profileEntry.origin_project = home.originProject;
+    profileEntry.descendant_count = cluster.members.length;
+    profileEntry.earliest_at = memberCreatedAts[0];
+    profileEntry.latest_at = memberCreatedAts[memberCreatedAts.length - 1];
+    profileEntry.dag_level_3_built_at = nowIso;
+    return profileEntry;
+}
+/** Profile one eligible cluster of L2s, write it, then re-link the L2s under it. */
+async function profileCluster(hippoRoot, cluster, home, opts, result) {
+    const summary = await generateDagSummary(cluster.label, cluster.members.map((m) => m.content), opts);
+    if (!summary) {
+        result.failed++;
+        return;
+    }
+    const profileEntry = createProfileEntry(summary, cluster, home);
+    // AT1 (plan §3 containment): per-cluster catch — skip this cluster,
+    // count, log once. The member re-linking writes below never run for a
+    // skipped cluster (mirrors buildDag above).
+    try {
+        writeEntry(hippoRoot, profileEntry);
+    }
+    catch (err) {
+        if (err instanceof RejectedValueError) {
+            result.rejected++;
+            log.warn(`buildEntityProfiles: cluster "${cluster.label}" skipped: profile matches a rejected value`);
+            return;
+        }
+        throw err;
+    }
+    result.profilesCreated++;
+    for (const member of cluster.members) {
+        const updated = { ...member, dag_parent_id: profileEntry.id };
+        writeEntry(hippoRoot, updated);
+        result.l2sLinked++;
+    }
+    // E3 born-dirty cancellation, same dance as buildDag L161-168 but for
+    // L3. Pass source='buildEntityProfiles-clean' to distinguish in audit.
+    // Args: (root, id, tenantId, actor, source).
+    clearSummaryDirtyAfterBuild(hippoRoot, profileEntry.id, home.tenantId, 'buildEntityProfiles', 'buildEntityProfiles-clean');
+}
 /**
  * v0.30 / E5 — build L3 entity profiles by clustering L2 summaries with
  * shared entity tags. Threshold 2+ L2s per entity. Mirrors buildDag L1->L2
@@ -302,72 +393,18 @@ export async function buildEntityProfiles(hippoRoot, l2Summaries, opts) {
     const baseHalfLifeDays = loadConfig(hippoRoot).defaultHalfLifeDays;
     // Only L2 with no L3 parent yet (avoid re-clustering already-profiled L2s).
     const unparented = l2Summaries.filter((s) => s.dag_level === 2 && !s.dag_parent_id);
-    // independent-review HIGH #1 fold: cluster ONLY within-tenant.
-    // clusterFacts has no tenant awareness; without this partition step a
-    // multi-tenant host could form a cluster spanning tenants and produce
-    // a single L3 with tenantId='default' that doesn't belong to either
-    // child tenant. Fix: bucket by tenantId, run clusterFacts per-tenant,
-    // pass tenantId to createMemory.
-    const byTenant = new Map();
-    for (const l2 of unparented) {
-        const tid = l2.tenantId ?? 'default';
-        const key = derivationPartitionKey(tid, l2.scope, l2.origin_project);
-        const list = byTenant.get(key) ?? [];
-        list.push(l2);
-        byTenant.set(key, list);
-    }
-    for (const [, tenantL2s] of byTenant) {
-        const tenantId = tenantL2s[0].tenantId ?? 'default';
-        const scope = derivationScope(tenantL2s[0].scope);
+    for (const [, tenantL2s] of partitionL2sByTenant(unparented)) {
+        const home = {
+            tenantId: tenantL2s[0].tenantId ?? 'default',
+            scope: derivationScope(tenantL2s[0].scope),
+            originProject: tenantL2s[0].origin_project,
+            baseHalfLifeDays,
+        };
         const clusters = clusterFacts(tenantL2s);
         const eligible = clusters.filter((c) => c.members.length >= 2);
         result.candidateClusters += eligible.length;
         for (const cluster of eligible) {
-            const summary = await generateDagSummary(cluster.label, cluster.members.map((m) => m.content), opts);
-            if (!summary) {
-                result.failed++;
-                continue;
-            }
-            const memberCreatedAts = cluster.members.map((m) => m.created).sort();
-            const nowIso = new Date().toISOString();
-            const profileEntry = createMemory(summary, {
-                layer: Layer.Semantic,
-                tags: [...cluster.entityTags, ...neverAutoShareTags(cluster.members), 'dag-entity-profile'],
-                confidence: 'inferred',
-                dag_level: 3,
-                tenantId, // HIGH #1 fold: thread tenant explicitly
-                scope,
-                baseHalfLifeDays,
-            });
-            profileEntry.origin_project = tenantL2s[0].origin_project;
-            profileEntry.descendant_count = cluster.members.length;
-            profileEntry.earliest_at = memberCreatedAts[0];
-            profileEntry.latest_at = memberCreatedAts[memberCreatedAts.length - 1];
-            profileEntry.dag_level_3_built_at = nowIso;
-            // AT1 (plan §3 containment): per-cluster catch — skip this cluster,
-            // count, log once. The member re-linking writes below never run for a
-            // skipped cluster (mirrors buildDag above).
-            try {
-                writeEntry(hippoRoot, profileEntry);
-            }
-            catch (err) {
-                if (err instanceof RejectedValueError) {
-                    result.rejected++;
-                    log.warn(`buildEntityProfiles: cluster "${cluster.label}" skipped: profile matches a rejected value`);
-                    continue;
-                }
-                throw err;
-            }
-            result.profilesCreated++;
-            for (const member of cluster.members) {
-                const updated = { ...member, dag_parent_id: profileEntry.id };
-                writeEntry(hippoRoot, updated);
-                result.l2sLinked++;
-            }
-            // E3 born-dirty cancellation, same dance as buildDag L161-168 but for
-            // L3. Pass source='buildEntityProfiles-clean' to distinguish in audit.
-            // Args: (root, id, tenantId, actor, source).
-            clearSummaryDirtyAfterBuild(hippoRoot, profileEntry.id, tenantId, 'buildEntityProfiles', 'buildEntityProfiles-clean');
+            await profileCluster(hippoRoot, cluster, home, opts, result);
         }
     }
     return result;