hippo-memory 1.61.0 → 1.62.0

package/dist/cli/status.js

@@ -31,36 +31,7 @@ export function cmdStatus(hippoRoot) {
     const entries = loadAllEntries(hippoRoot);
     const stats = loadStats(hippoRoot);
     const now = evalNow();
-    const byLayer = {
-        [Layer.Buffer]: 0,
-        [Layer.Episodic]: 0,
-        [Layer.Semantic]: 0,
-        [Layer.Trace]: 0,
-    };
-    const byConfidence = {
-        verified: 0,
-        observed: 0,
-        inferred: 0,
-        stale: 0,
-    };
-    let totalStrength = 0;
-    let pinned = 0;
-    let atRisk = 0; // strength < 0.2
-    let agedOut = 0;
-    for (const e of entries) {
-        const s = calculateStrength(e, now);
-        byLayer[e.layer] = (byLayer[e.layer] ?? 0) + 1;
-        totalStrength += s;
-        if (e.pinned)
-            pinned++;
-        if (s < 0.2)
-            atRisk++;
-        const facets = confidenceFacets(e, now);
-        byConfidence[facets.tier] = (byConfidence[facets.tier] ?? 0) + 1;
-        if (facets.agedOut)
-            agedOut++;
-    }
-    const avgStrength = entries.length > 0 ? totalStrength / entries.length : 0;
+    const { byLayer, byConfidence, pinned, atRisk, agedOut, avgStrength } = tallyStatus(entries, now);
     console.log('Hippo Status');
     console.log('---------------------------');
     console.log(`Total memories:    ${entries.length}`);
@@ -92,7 +63,44 @@ export function cmdStatus(hippoRoot) {
     else {
         console.log(`Last sleep:        never`);
     }
-    // Embedding status (provider-aware)
+    printEmbeddingStatus(hippoRoot, entries);
+    printPhysicsStatus(hippoRoot);
+}
+function tallyStatus(entries, now) {
+    const byLayer = {
+        [Layer.Buffer]: 0,
+        [Layer.Episodic]: 0,
+        [Layer.Semantic]: 0,
+        [Layer.Trace]: 0,
+    };
+    const byConfidence = {
+        verified: 0,
+        observed: 0,
+        inferred: 0,
+        stale: 0,
+    };
+    let totalStrength = 0;
+    let pinned = 0;
+    let atRisk = 0; // strength < 0.2
+    let agedOut = 0;
+    for (const e of entries) {
+        const s = calculateStrength(e, now);
+        byLayer[e.layer] = (byLayer[e.layer] ?? 0) + 1;
+        totalStrength += s;
+        if (e.pinned)
+            pinned++;
+        if (s < 0.2)
+            atRisk++;
+        const facets = confidenceFacets(e, now);
+        byConfidence[facets.tier] = (byConfidence[facets.tier] ?? 0) + 1;
+        if (facets.agedOut)
+            agedOut++;
+    }
+    const avgStrength = entries.length > 0 ? totalStrength / entries.length : 0;
+    return { byLayer, byConfidence, pinned, atRisk, agedOut, avgStrength };
+}
+// Embedding status (provider-aware)
+function printEmbeddingStatus(hippoRoot, entries) {
     const embedProvider = (() => {
         try {
             return resolveEmbeddingProvider(hippoRoot);
@@ -105,42 +113,43 @@ export function cmdStatus(hippoRoot) {
     console.log('');
     if (!embedProvider) {
         console.log(`Embeddings:        misconfigured (check embeddings.provider / apiBaseUrl), BM25 only`);
+        return;
+    }
+    const embeddingsDisabled = loadConfig(hippoRoot).embeddings.enabled === false;
+    const embAvail = embedProvider.isAvailable();
+    if (embeddingsDisabled) {
+        console.log(`Embeddings:        disabled in config (embeddings.enabled = false), BM25 only`);
+    }
+    else if (embedProvider.kind === 'local') {
+        console.log(`Embeddings:        ${embAvail ? `available [${embedProvider.id}]` : 'not installed (BM25 only)'}`);
+    }
+    else if (embAvail) {
+        console.log(`Embeddings:        ${embedProvider.kind} api [${embedProvider.id}]`);
     }
     else {
-        const embeddingsDisabled = loadConfig(hippoRoot).embeddings.enabled === false;
-        const embAvail = embedProvider.isAvailable();
-        if (embeddingsDisabled) {
-            console.log(`Embeddings:        disabled in config (embeddings.enabled = false), BM25 only`);
-        }
-        else if (embedProvider.kind === 'local') {
-            console.log(`Embeddings:        ${embAvail ? `available [${embedProvider.id}]` : 'not installed (BM25 only)'}`);
-        }
-        else if (embAvail) {
-            console.log(`Embeddings:        ${embedProvider.kind} api [${embedProvider.id}]`);
-        }
-        else {
-            console.log(`Embeddings:        ${embedProvider.kind} configured but ${embedProvider.keyEnv} not set (BM25 only)`);
-        }
-        // Show cached counts whenever vectors exist on disk (even when disabled or
-        // the key was removed), so the user still sees what is already indexed.
-        const embIndex = loadEmbeddingIndex(hippoRoot);
-        if (embAvail || Object.keys(embIndex).length > 0) {
-            const activeIds = new Set(entries.map((e) => e.id));
-            const activeEmbedded = Object.keys(embIndex).filter((id) => activeIds.has(id)).length;
-            const orphaned = Object.keys(embIndex).length - activeEmbedded;
-            const dims = Object.values(embIndex)[0]?.length;
-            let line = `Embedded:          ${activeEmbedded}/${entries.length} memories`;
-            if (dims)
-                line += ` (${dims}-dim)`;
-            if (orphaned > 0)
-                line += ` (${orphaned} orphaned, run \`hippo embed\` to prune)`;
-            console.log(line);
-            if (embeddingModelRequiresReindex(hippoRoot, embedProvider.id, embIndex)) {
-                console.log(`                   model changed, run \`hippo embed\` to reindex`);
-            }
-        }
+        console.log(`Embeddings:        ${embedProvider.kind} configured but ${embedProvider.keyEnv} not set (BM25 only)`);
+    }
+    // Show cached counts whenever vectors exist on disk (even when disabled or
+    // the key was removed), so the user still sees what is already indexed.
+    const embIndex = loadEmbeddingIndex(hippoRoot);
+    if (!embAvail && Object.keys(embIndex).length === 0)
+        return;
+    const activeIds = new Set(entries.map((e) => e.id));
+    const activeEmbedded = Object.keys(embIndex).filter((id) => activeIds.has(id)).length;
+    const orphaned = Object.keys(embIndex).length - activeEmbedded;
+    const dims = Object.values(embIndex)[0]?.length;
+    let line = `Embedded:          ${activeEmbedded}/${entries.length} memories`;
+    if (dims)
+        line += ` (${dims}-dim)`;
+    if (orphaned > 0)
+        line += ` (${orphaned} orphaned, run \`hippo embed\` to prune)`;
+    console.log(line);
+    if (embeddingModelRequiresReindex(hippoRoot, embedProvider.id, embIndex)) {
+        console.log(`                   model changed, run \`hippo embed\` to reindex`);
     }
-    // Physics status
+}
+// Physics status
+function printPhysicsStatus(hippoRoot) {
     try {
         const db = openHippoDb(hippoRoot);
         try {

package/dist/cli/transfer.js

@@ -112,18 +112,8 @@ export function cmdImport(hippoRoot, args, flags) {
             ? [String(flags['tag'])]
             : [];
     const targetRoot = useGlobal ? getGlobalRoot() : hippoRoot;
-    if (flags['agents']) {
-        const opts = { machine: currentMachine(), dryRun };
-        // A folder without a store of its own imports as session end would there, so its notes are not hidden.
-        const report = useGlobal || isInitialized(hippoRoot)
-            ? importForStore(useGlobal ? getGlobalRoot() : hippoRoot, opts)
-            : importAtSessionEnd(process.cwd(), undefined, opts);
-        for (const line of detailLines(report, dryRun))
-            console.log(line);
-        for (const warning of report.warnings)
-            printError(`hippo: agent memories: ${warning}`);
-        return;
-    }
+    if (flags['agents'])
+        return importAgentMemories(hippoRoot, useGlobal, dryRun);
     if (useGlobal) {
         initGlobal();
     }
@@ -142,93 +132,29 @@ export function cmdImport(hippoRoot, args, flags) {
     // It writes through api.remember/archiveRaw which are tenant-scoped, so we
     // resolve the tenant and pass it through. --global is not supported for
     // vault import (the connector raw-archive path is tenant-local).
-    if (flags['vault']) {
-        const folderPath = String(flags['vault']);
-        if (!fs.existsSync(folderPath) || !fs.statSync(folderPath).isDirectory()) {
-            printError(`Vault folder not found (or not a directory): ${folderPath}`);
-            process.exit(1);
-        }
-        if (useGlobal) {
-            printError('hippo import --vault does not support --global (raw rows are tenant-local).');
-            process.exit(1);
-        }
-        if (typeof flags['name'] !== 'string' || !flags['name'].trim()) {
-            // --name is the vault identity key for the destructive source-deletion sync;
-            // inferring it from the folder basename let same-basename vaults collide and
-            // clobber each other (codex R10 P2). A valueless `--name` parses as boolean
-            // true, and String(true) === "true" would silently import under vault:true:*
-            // - reject a non-string so it fails fast instead (codex R11 P2).
-            printError('hippo import --vault requires --name <vault> (a non-empty identity key for source-deletion sync).');
-            process.exit(1);
-        }
-        if (flags['scope'] !== undefined && (typeof flags['scope'] !== 'string' || !flags['scope'].trim())) {
-            // Same valueless-flag trap: a bare `--scope` must not become scope "true".
-            // Example uses the source-prefixed private form, since a bare `private` scope
-            // is NOT treated as private by recall and importVault rejects it (R13 P2).
-            printError('hippo import --vault: --scope requires a value (e.g. --scope vault:private:notes).');
-            process.exit(1);
-        }
-        const tenantId = resolveTenantId({});
-        const vaultOptions = {
-            ...importOptions,
-            tenantId,
-            name: flags['name'] ? String(flags['name']) : undefined,
-            scope: flags['scope'] ? String(flags['scope']) : undefined,
-        };
-        const vaultResult = importVault(folderPath, vaultOptions);
-        console.log(`\nImport Vault: ${folderPath}${dryRun ? ' (dry run - no writes)' : ''}`);
-        console.log(`  Notes found:           ${vaultResult.total}`);
-        console.log(`  ${dryRun ? 'Would import:         ' : 'Imported:             '}${vaultResult.imported}`);
-        console.log(`  Skipped (unchanged):   ${vaultResult.skipped}`);
-        if ((vaultResult.rejected ?? 0) > 0) {
-            console.log(`  Rejected (tombstoned): ${vaultResult.rejected}`);
-        }
-        warnRedacted(vaultResult.redacted);
-        console.log(`  ${dryRun ? 'Would archive:        ' : 'Archived (removed):   '}${vaultResult.archived ?? 0}`);
-        console.log(`  Store:                 ${hippoRoot}`);
-        // Batch producer, same contract as the single-file import below: vault rows
-        // write through api.remember (which never embeds), so backfill them here.
-        // Floating promise is deliberate; see the comment at the single-file site.
-        if (!dryRun && vaultResult.imported >= 1) {
-            void embedAll(hippoRoot).catch(() => { });
-        }
-        return;
-    }
-    // Determine which importer to use based on flag
-    let filePath;
-    let importer;
-    let importerName = '';
-    if (flags['chatgpt']) {
-        filePath = String(flags['chatgpt']);
-        importer = importChatGPT;
-        importerName = 'ChatGPT';
-    }
-    else if (flags['claude']) {
-        filePath = String(flags['claude']);
-        importer = importClaude;
-        importerName = 'Claude';
-    }
-    else if (flags['cursor']) {
-        filePath = String(flags['cursor']);
-        importer = importCursor;
-        importerName = 'Cursor';
-    }
-    else if (flags['file']) {
-        filePath = String(flags['file']);
-        importer = importGenericFile;
-        importerName = 'File';
-    }
-    else if (flags['markdown']) {
-        filePath = String(flags['markdown']);
-        importer = importMarkdown;
-        importerName = 'Markdown';
-    }
-    else if (args[0]) {
-        // Positional: try to auto-detect from extension
-        filePath = args[0];
-        importer = importGenericFile;
-        importerName = 'File';
-    }
+    if (flags['vault'])
+        return importVaultFolder(hippoRoot, flags, importOptions, useGlobal, dryRun);
+    importFromFile(targetRoot, args, flags, importOptions, useGlobal, dryRun);
+}
+// Determine which importer to use based on flag
+function pickImporter(args, flags) {
+    if (flags['chatgpt'])
+        return { filePath: String(flags['chatgpt']), importer: importChatGPT, importerName: 'ChatGPT' };
+    if (flags['claude'])
+        return { filePath: String(flags['claude']), importer: importClaude, importerName: 'Claude' };
+    if (flags['cursor'])
+        return { filePath: String(flags['cursor']), importer: importCursor, importerName: 'Cursor' };
+    if (flags['file'])
+        return { filePath: String(flags['file']), importer: importGenericFile, importerName: 'File' };
+    if (flags['markdown'])
+        return { filePath: String(flags['markdown']), importer: importMarkdown, importerName: 'Markdown' };
+    // Positional: try to auto-detect from extension
+    if (args[0])
+        return { filePath: args[0], importer: importGenericFile, importerName: 'File' };
+    return { filePath: undefined, importer: undefined, importerName: '' };
+}
+function importFromFile(targetRoot, args, flags, importOptions, useGlobal, dryRun) {
+    const { filePath, importer, importerName } = pickImporter(args, flags);
     if (!filePath || !importer) {
         printError('Usage: hippo import <--chatgpt|--claude|--cursor|--file|--markdown|--vault> <path>, or hippo import --agents [--dry-run]');
         process.exit(1);
@@ -272,6 +198,66 @@ export function cmdImport(hippoRoot, args, flags) {
         console.log(`  Store:                 ${storeLabel}`);
     }
 }
+function importAgentMemories(hippoRoot, useGlobal, dryRun) {
+    const opts = { machine: currentMachine(), dryRun };
+    // A folder without a store of its own imports as session end would there, so its notes are not hidden.
+    const report = useGlobal || isInitialized(hippoRoot)
+        ? importForStore(useGlobal ? getGlobalRoot() : hippoRoot, opts)
+        : importAtSessionEnd(process.cwd(), undefined, opts);
+    for (const line of detailLines(report, dryRun))
+        console.log(line);
+    for (const warning of report.warnings)
+        printError(`hippo: agent memories: ${warning}`);
+}
+function importVaultFolder(hippoRoot, flags, importOptions, useGlobal, dryRun) {
+    const folderPath = String(flags['vault']);
+    if (!fs.existsSync(folderPath) || !fs.statSync(folderPath).isDirectory()) {
+        printError(`Vault folder not found (or not a directory): ${folderPath}`);
+        process.exit(1);
+    }
+    if (useGlobal) {
+        printError('hippo import --vault does not support --global (raw rows are tenant-local).');
+        process.exit(1);
+    }
+    if (typeof flags['name'] !== 'string' || !flags['name'].trim()) {
+        // --name is the vault identity key for the destructive source-deletion sync; inferring it from the folder basename let
+        // same-basename vaults collide and clobber each other (codex R10 P2). A valueless `--name` parses as boolean true, and
+        // String(true) === "true" would silently import under vault:true:* - reject a non-string so it fails fast instead (codex R11 P2).
+        printError('hippo import --vault requires --name <vault> (a non-empty identity key for source-deletion sync).');
+        process.exit(1);
+    }
+    if (flags['scope'] !== undefined && (typeof flags['scope'] !== 'string' || !flags['scope'].trim())) {
+        // Same valueless-flag trap: a bare `--scope` must not become scope "true".
+        // Example uses the source-prefixed private form, since a bare `private` scope
+        // is NOT treated as private by recall and importVault rejects it (R13 P2).
+        printError('hippo import --vault: --scope requires a value (e.g. --scope vault:private:notes).');
+        process.exit(1);
+    }
+    const tenantId = resolveTenantId({});
+    const vaultOptions = {
+        ...importOptions,
+        tenantId,
+        name: flags['name'] ? String(flags['name']) : undefined,
+        scope: flags['scope'] ? String(flags['scope']) : undefined,
+    };
+    const vaultResult = importVault(folderPath, vaultOptions);
+    console.log(`\nImport Vault: ${folderPath}${dryRun ? ' (dry run - no writes)' : ''}`);
+    console.log(`  Notes found:           ${vaultResult.total}`);
+    console.log(`  ${dryRun ? 'Would import:         ' : 'Imported:             '}${vaultResult.imported}`);
+    console.log(`  Skipped (unchanged):   ${vaultResult.skipped}`);
+    if ((vaultResult.rejected ?? 0) > 0) {
+        console.log(`  Rejected (tombstoned): ${vaultResult.rejected}`);
+    }
+    warnRedacted(vaultResult.redacted);
+    console.log(`  ${dryRun ? 'Would archive:        ' : 'Archived (removed):   '}${vaultResult.archived ?? 0}`);
+    console.log(`  Store:                 ${hippoRoot}`);
+    // Batch producer, same contract as the single-file import below: vault rows
+    // write through api.remember (which never embeds), so backfill them here.
+    // Floating promise is deliberate; see the comment at the single-file site.
+    if (!dryRun && vaultResult.imported >= 1) {
+        void embedAll(hippoRoot).catch(() => { });
+    }
+}
 // ---------------------------------------------------------------------------
 // Promote command
 // ---------------------------------------------------------------------------

package/dist/compaction-record.d.ts

@@ -25,8 +25,6 @@ export interface CompactionRecord {
     status: CompactionStatus;
 }
 export type Log = (message: string) => void;
-/** Where the session ran: rows written through the global store keep the project the session was in. */
-export declare function compactionOrigin(hippoRoot: string, cwd: string | null): string;
 interface ScrubbedSummary {
     summary: string;
     items: string[];

package/dist/compaction-record.js

@@ -30,7 +30,7 @@ const CLAIMED_SUFFIX = '.claimed';
 /** The marker redactSecretsStrict writes; an item holding it was a secret before it was stored. */
 const REDACTED = '[REDACTED]';
 /** Where the session ran: rows written through the global store keep the project the session was in. */
-export function compactionOrigin(hippoRoot, cwd) {
+function compactionOrigin(hippoRoot, cwd) {
     if (!isGlobalStoreRoot(hippoRoot))
         return deriveOriginProject(path.dirname(hippoRoot));
     // No cwd means user-global, as stampOriginProject gives the global store; undefined would fall back to the hook's own cwd.

package/dist/customer-notes.js

@@ -94,9 +94,79 @@ const NOTE_COLS = `
 function buildNoteContent(customer, note) {
     return `${customer}\n\n${note}`;
 }
-// ---------------------------------------------------------------------------
-// Public API
-// ---------------------------------------------------------------------------
+// Preflight the supersede target BEFORE inserting the new row (so the new
+// autoincrement id can never be its own supersede target); read the
+// predecessor version in the same SELECT for server-derived versioning.
+// Mirrors saveProjectBrief / saveSkill (codex P1 2026-05-28).
+function preflightNoteSupersede(db, tenantId, supersedesId) {
+    // SAFETY: SELECT projects exactly status, version; .get() returns that
+    // shape for the matching row, or undefined when no note/tenant pair matches.
+    const pred = db.prepare(`SELECT status, version FROM customer_notes WHERE id = ? AND tenant_id = ?`).get(supersedesId, tenantId);
+    if (!pred) {
+        throw new NotFoundError(`saveCustomerNote: note ${supersedesId} to supersede not found for tenant ${tenantId}`);
+    }
+    if (pred.status !== 'active') {
+        throw new ConflictError(`saveCustomerNote: note ${supersedesId} is not active (status='${pred.status}'); only active notes can be superseded.`);
+    }
+    return pred.version + 1;
+}
+function insertNoteRow(db, memoryId, w, version) {
+    const result = db.prepare(`
+    INSERT INTO customer_notes(
+      memory_id, tenant_id, customer, note, version,
+      status, superseded_by, superseded_at, change_summary, closed_at, created_at
+    ) VALUES (?, ?, ?, ?, ?, 'active', NULL, NULL, ?, NULL, ?)
+  `).run(memoryId, w.tenantId, w.customer, w.note, version, w.changeSummary, w.now);
+    return Number(result.lastInsertRowid ?? 0);
+}
+function supersedeNoteRow(db, w, supersedesId, noteId, version) {
+    const sup = db.prepare(`
+    UPDATE customer_notes
+    SET status = 'superseded', superseded_by = ?, superseded_at = ?
+    WHERE id = ? AND tenant_id = ? AND status = 'active' AND id != ?
+  `).run(noteId, w.now, supersedesId, w.tenantId, noteId);
+    if (sup.changes === 0) {
+        throw new ConflictError(`saveCustomerNote: note ${supersedesId} could not be superseded (no longer active or self-reference).`);
+    }
+    appendAuditEvent(db, {
+        tenantId: w.tenantId,
+        actor: w.actor,
+        op: 'customer_note_supersede',
+        targetId: String(supersedesId),
+        metadata: {
+            note_id: supersedesId,
+            superseded_by: noteId,
+            new_version: version,
+        },
+    });
+}
+/** The afterWrite body: preflight, INSERT, supersede, reload, create audit, all in one SAVEPOINT. */
+function writeNoteRow(db, memoryId, w) {
+    const version = w.supersedesId !== undefined ? preflightNoteSupersede(db, w.tenantId, w.supersedesId) : 1;
+    const noteId = insertNoteRow(db, memoryId, w, version);
+    if (w.supersedesId !== undefined)
+        supersedeNoteRow(db, w, w.supersedesId, noteId, version);
+    // SAFETY: SELECT ${NOTE_COLS} projects exactly the CustomerNoteRow columns;
+    // .get() returns that row, or undefined only if the just-inserted id can't
+    // be found.
+    const row = db.prepare(`SELECT ${NOTE_COLS} FROM customer_notes WHERE id = ?`)
+        .get(noteId);
+    if (!row)
+        throw new Error('saveCustomerNote: failed to reload saved note row');
+    // GDPR-light metadata: ids + flags only, no note text.
+    appendAuditEvent(db, {
+        tenantId: w.tenantId,
+        actor: w.actor,
+        op: 'customer_note_create',
+        targetId: String(noteId),
+        metadata: {
+            note_id: noteId,
+            customer: w.customer,
+            version,
+        },
+    });
+    return row;
+}
 /**
  * Create a customer_note (or a new version that supersedes an existing one). Writes
  * the memory mirror + the customer_notes row atomically inside writeEntry's SAVEPOINT.
@@ -125,75 +195,14 @@ export function saveCustomerNote(hippoRoot, tenantId, opts, actor = 'cli') {
         baseHalfLifeDays: objectHalfLifeDays(hippoRoot),
         tenantId,
     });
+    const w = {
+        tenantId, actor, customer, note: opts.note, changeSummary, supersedesId: opts.supersedesNoteId, now,
+    };
     let savedRow;
     writeEntry(hippoRoot, mem, {
         actor,
         afterWrite: (db, memoryId) => {
-            // Preflight the supersede target BEFORE inserting the new row (so the new
-            // autoincrement id can never be its own supersede target); read the
-            // predecessor version in the same SELECT for server-derived versioning.
-            // Mirrors saveProjectBrief / saveSkill (codex P1 2026-05-28).
-            let version = 1;
-            if (opts.supersedesNoteId !== undefined) {
-                // SAFETY: SELECT projects exactly status, version; .get() returns that
-                // shape for the matching row, or undefined when no note/tenant pair matches.
-                const pred = db.prepare(`SELECT status, version FROM customer_notes WHERE id = ? AND tenant_id = ?`).get(opts.supersedesNoteId, tenantId);
-                if (!pred) {
-                    throw new NotFoundError(`saveCustomerNote: note ${opts.supersedesNoteId} to supersede not found for tenant ${tenantId}`);
-                }
-                if (pred.status !== 'active') {
-                    throw new ConflictError(`saveCustomerNote: note ${opts.supersedesNoteId} is not active (status='${pred.status}'); only active notes can be superseded.`);
-                }
-                version = pred.version + 1;
-            }
-            const result = db.prepare(`
-        INSERT INTO customer_notes(
-          memory_id, tenant_id, customer, note, version,
-          status, superseded_by, superseded_at, change_summary, closed_at, created_at
-        ) VALUES (?, ?, ?, ?, ?, 'active', NULL, NULL, ?, NULL, ?)
-      `).run(memoryId, tenantId, customer, opts.note, version, changeSummary, now);
-            const noteId = Number(result.lastInsertRowid ?? 0);
-            if (opts.supersedesNoteId !== undefined) {
-                const sup = db.prepare(`
-          UPDATE customer_notes
-          SET status = 'superseded', superseded_by = ?, superseded_at = ?
-          WHERE id = ? AND tenant_id = ? AND status = 'active' AND id != ?
-        `).run(noteId, now, opts.supersedesNoteId, tenantId, noteId);
-                if (sup.changes === 0) {
-                    throw new ConflictError(`saveCustomerNote: note ${opts.supersedesNoteId} could not be superseded (no longer active or self-reference).`);
-                }
-                appendAuditEvent(db, {
-                    tenantId,
-                    actor,
-                    op: 'customer_note_supersede',
-                    targetId: String(opts.supersedesNoteId),
-                    metadata: {
-                        note_id: opts.supersedesNoteId,
-                        superseded_by: noteId,
-                        new_version: version,
-                    },
-                });
-            }
-            // SAFETY: SELECT ${NOTE_COLS} projects exactly the CustomerNoteRow columns;
-            // .get() returns that row, or undefined only if the just-inserted id can't
-            // be found.
-            const row = db.prepare(`SELECT ${NOTE_COLS} FROM customer_notes WHERE id = ?`)
-                .get(noteId);
-            if (!row)
-                throw new Error('saveCustomerNote: failed to reload saved note row');
-            savedRow = row;
-            // GDPR-light metadata: ids + flags only, no note text.
-            appendAuditEvent(db, {
-                tenantId,
-                actor,
-                op: 'customer_note_create',
-                targetId: String(noteId),
-                metadata: {
-                    note_id: noteId,
-                    customer,
-                    version,
-                },
-            });
+            savedRow = writeNoteRow(db, memoryId, w);
         },
         afterCommit: () => markGraphDirty(hippoRoot, tenantId, mem.id),
     });