hippo-memory 1.61.0 → 1.62.0

package/dist/doctor.js

@@ -15,7 +15,7 @@ import { openHippoDbReadOnly, closeHippoDb, getSchemaVersion, getCurrentSchemaVe
 import { REPLAY_AFTER_MS, TRANSCRIPT_FILL_WINDOW_MS } from './compaction-record.js';
 import { isEmbeddingAvailable } from './local-embedding.js';
 import { CODEX_TRUST_LINE, codexHomeDir, isCodexPresent, isJsonObject } from './hooks/shared.js';
-import { planUserGlobalRepair } from './project-merge.js';
+import { planProjectRepair } from './project-merge.js';
 import { resolveTenantId } from './tenant.js';
 /** Minimum Node.js version hippo supports (package.json engines). */
 export const MIN_NODE = '22.16.0';
@@ -131,16 +131,20 @@ function compactionsCheck(db, now) {
             : { id: 'compactions', status: 'warn', detail: `cannot read the compaction records: ${message}` };
     }
 }
-/** Merged rows older sleep saved as user-global, counted by the repair's own dry run so a truly user-global merge never warns. */
+/** Old project tags in the global store, counted by the repair's own plan so a truly user-global merge never warns. */
 function projectsCheck(globalRoot) {
     let db = null;
     try {
         db = openHippoDbReadOnly(globalRoot);
-        const r = planUserGlobalRepair(db, resolveTenantId({}));
-        const n = r.toProject.length + r.setAside.length;
-        return n === 0
-            ? { id: 'projects', status: 'pass', detail: 'no merged memories in the global store are tagged user-global by mistake' }
-            : { id: 'projects', status: 'warn', detail: `${n} merged memories in the global store are tagged user-global, so every project's context can show them`, fix: 'hippo projects repair --global   (dry run; add --apply to write)' };
+        const r = planProjectRepair(db, globalRoot, resolveTenantId({}));
+        const found = [
+            r.copies.length > 0 ? `${r.copies.length} imported notes copied under the wrong project` : '',
+            r.folds.length > 0 ? `${r.folds.length} old project names that now resolve to another project` : '',
+            r.toProject.length + r.setAside.length > 0 ? `${r.toProject.length + r.setAside.length} merged memories tagged user-global` : '',
+        ].filter((s) => s !== '');
+        return found.length === 0
+            ? { id: 'projects', status: 'pass', detail: 'no duplicate or out-of-date project tags in the global store' }
+            : { id: 'projects', status: 'warn', detail: `global store: ${found.join('; ')}`, fix: 'hippo projects repair --global   (dry run; add --apply to write)' };
     }
     catch (err) {
         return { id: 'projects', status: 'info', detail: `project tags not checked (${err instanceof Error ? err.message : String(err)})` };

package/dist/goals.js

@@ -159,6 +159,101 @@ export function getActiveGoalsWithDb(db, opts) {
   `).all(opts.tenantId, opts.sessionId);
     return rows.map(rowToGoal);
 }
+// Load retrieval_policy rows for active goals so per-policy multipliers
+// can compose onto the base goal-tag boost. Composed result is hard-capped
+// at MAX_FINAL_MULTIPLIER (3.0x) BEFORE applying to score -- even an
+// `errorPriority: 9.0` policy cannot exceed 3.0x.
+function loadGoalPolicies(db, active) {
+    const policiesByGoalId = new Map();
+    for (const g of active) {
+        if (!g.retrievalPolicyId)
+            continue;
+        // SAFETY: the row comes from the SELECT above, which projects exactly
+        // these seven retrieval_policy columns.
+        const row = db.prepare(`
+      SELECT id, goal_id, policy_type, weight_schema_fit, weight_recency, weight_outcome, error_priority
+      FROM retrieval_policy WHERE id = ?
+    `).get(g.retrievalPolicyId);
+        if (row) {
+            policiesByGoalId.set(g.id, {
+                id: row.id,
+                goalId: row.goal_id,
+                policyType: row.policy_type,
+                weightSchemaFit: row.weight_schema_fit,
+                weightRecency: row.weight_recency,
+                weightOutcome: row.weight_outcome,
+                errorPriority: row.error_priority,
+            });
+        }
+    }
+    return policiesByGoalId;
+}
+/** The capped boost for one row whose tags match `matches` active goals. */
+function goalBoostMultiplier(entry, tags, matches, goalsByTag, policiesByGoalId) {
+    // Base 2.0x for first match, +0.5x per additional, capped at 3.0x.
+    let multiplier = Math.min(2.0 + 0.5 * (matches.length - 1), MAX_FINAL_MULTIPLIER);
+    // Compose per-policy multipliers per matched tag.
+    for (const tag of matches) {
+        const goal = goalsByTag.get(tag);
+        const policy = policiesByGoalId.get(goal.id);
+        if (!policy)
+            continue;
+        if (policy.policyType === 'error-prioritized' && tags.includes('error')) {
+            multiplier *= policy.errorPriority;
+        }
+        else if (policy.policyType === 'schema-fit-biased') {
+            // Linearly weight schema_fit in [0,1] up to (weightSchemaFit)x.
+            // Default 1.0 is a no-op.
+            multiplier *=
+                1.0 +
+                    Math.max(0, policy.weightSchemaFit - 1.0) *
+                        (entry.schema_fit ?? 0.5);
+        }
+        else if (policy.policyType === 'recency-first') {
+            multiplier *= policy.weightRecency;
+        }
+        else if (policy.policyType === 'hybrid') {
+            multiplier *= policy.weightOutcome;
+        }
+    }
+    // Hard cap AFTER all composition.
+    return Math.min(multiplier, MAX_FINAL_MULTIPLIER);
+}
+/** Log rows for the top `limit` boosted rows, one per matched goal. */
+function buildGoalRecallLog(db, boosted, matchesByEntryId, goalsByTag, opts) {
+    const { sessionId, tenantId, limit } = opts;
+    // Filter to local memories only -- global memory IDs aren't in this DB's
+    // memories table, so the FK on goal_recall_log.memory_id would fail.
+    // dlPFC depth's outcome propagation is session-scoped to local; boost on
+    // ranking still applies to global results, just no log row -> no
+    // propagation.
+    const topKIds = boosted.slice(0, limit).map((r) => r.entry.id);
+    const localIds = new Set();
+    if (topKIds.length > 0) {
+        const placeholders = topKIds.map(() => '?').join(',');
+        // SAFETY: rows come from the SELECT above, which projects exactly one
+        // column, `id`, from memories.
+        const localRows = db.prepare(`SELECT id FROM memories WHERE id IN (${placeholders})`).all(...topKIds);
+        for (const row of localRows)
+            localIds.add(row.id);
+    }
+    const recalledAt = new Date().toISOString();
+    const log = [];
+    for (const r of boosted.slice(0, limit)) {
+        if (!localIds.has(r.entry.id))
+            continue; // global -> skip log insert
+        const matches = matchesByEntryId.get(r.entry.id);
+        if (!matches || matches.length === 0)
+            continue;
+        for (const tag of matches) {
+            const goal = goalsByTag.get(tag);
+            if (!goal)
+                continue;
+            log.push({ goalId: goal.id, memoryId: r.entry.id, tenantId, sessionId, recalledAt, score: r.score });
+        }
+    }
+    return log;
+}
 /**
  * dlPFC goal-stack boost. Applies the multi-goal boost to entry-backed scored
  * rows when (tenant, session) has active goals and returns the log rows to
@@ -179,37 +274,12 @@ export function getActiveGoalsWithDb(db, opts) {
  * @internal Recall ranking helper. Subject to change.
  */
 export function computeGoalStackBoost(db, results, opts) {
-    const { sessionId, tenantId, limit, trace } = opts;
+    const { sessionId, tenantId, trace } = opts;
     const active = getActiveGoalsWithDb(db, { sessionId, tenantId });
     if (active.length === 0)
         return { results, log: [] };
     const goalsByTag = new Map(active.map((g) => [g.goalName, g]));
-    // Load retrieval_policy rows for active goals so per-policy multipliers
-    // can compose onto the base goal-tag boost. Composed result is hard-capped
-    // at MAX_FINAL_MULTIPLIER (3.0x) BEFORE applying to score -- even an
-    // `errorPriority: 9.0` policy cannot exceed 3.0x.
-    const policiesByGoalId = new Map();
-    for (const g of active) {
-        if (!g.retrievalPolicyId)
-            continue;
-        // SAFETY: the row comes from the SELECT above, which projects exactly
-        // these seven retrieval_policy columns.
-        const row = db.prepare(`
-      SELECT id, goal_id, policy_type, weight_schema_fit, weight_recency, weight_outcome, error_priority
-      FROM retrieval_policy WHERE id = ?
-    `).get(g.retrievalPolicyId);
-        if (row) {
-            policiesByGoalId.set(g.id, {
-                id: row.id,
-                goalId: row.goal_id,
-                policyType: row.policy_type,
-                weightSchemaFit: row.weight_schema_fit,
-                weightRecency: row.weight_recency,
-                weightOutcome: row.weight_outcome,
-                errorPriority: row.error_priority,
-            });
-        }
-    }
+    const policiesByGoalId = loadGoalPolicies(db, active);
     // Goal-tag matches per boosted row, keyed by entry id. Kept as a side table
     // (rather than a spread-on `_goalMatches` marker property) so `boosted`
     // stays exactly R[] end to end, with no cast-tag-then-strip round trip.
@@ -220,34 +290,7 @@ export function computeGoalStackBoost(db, results, opts) {
         const matches = tags.filter((t) => goalsByTag.has(t));
         if (matches.length === 0)
             return r;
-        // Base 2.0x for first match, +0.5x per additional, capped at 3.0x.
-        let multiplier = Math.min(2.0 + 0.5 * (matches.length - 1), MAX_FINAL_MULTIPLIER);
-        // Compose per-policy multipliers per matched tag.
-        for (const tag of matches) {
-            const goal = goalsByTag.get(tag);
-            const policy = policiesByGoalId.get(goal.id);
-            if (!policy)
-                continue;
-            if (policy.policyType === 'error-prioritized' && tags.includes('error')) {
-                multiplier *= policy.errorPriority;
-            }
-            else if (policy.policyType === 'schema-fit-biased') {
-                // Linearly weight schema_fit in [0,1] up to (weightSchemaFit)x.
-                // Default 1.0 is a no-op.
-                multiplier *=
-                    1.0 +
-                        Math.max(0, policy.weightSchemaFit - 1.0) *
-                            (r.entry.schema_fit ?? 0.5);
-            }
-            else if (policy.policyType === 'recency-first') {
-                multiplier *= policy.weightRecency;
-            }
-            else if (policy.policyType === 'hybrid') {
-                multiplier *= policy.weightOutcome;
-            }
-        }
-        // Hard cap AFTER all composition.
-        multiplier = Math.min(multiplier, MAX_FINAL_MULTIPLIER);
+        const multiplier = goalBoostMultiplier(r.entry, tags, matches, goalsByTag, policiesByGoalId);
         // A7 recall-trace side-channel: record the goal-boost step BEFORE the
         // score is mutated, keyed by entry id. Pure read of r.score here; the
         // mutation below is byte-identical to pre-A7.
@@ -271,37 +314,7 @@ export function computeGoalStackBoost(db, results, opts) {
         // inherits its determinism via sort stability, and ties preserve the
         // prior (meaningful) rank instead of reordering by content.
         .sort((a, b) => b.score - a.score);
-    // Filter to local memories only -- global memory IDs aren't in this DB's
-    // memories table, so the FK on goal_recall_log.memory_id would fail.
-    // dlPFC depth's outcome propagation is session-scoped to local; boost on
-    // ranking still applies to global results, just no log row -> no
-    // propagation.
-    const topKIds = boosted.slice(0, limit).map((r) => r.entry.id);
-    const localIds = new Set();
-    if (topKIds.length > 0) {
-        const placeholders = topKIds.map(() => '?').join(',');
-        // SAFETY: rows come from the SELECT above, which projects exactly one
-        // column, `id`, from memories.
-        const localRows = db.prepare(`SELECT id FROM memories WHERE id IN (${placeholders})`).all(...topKIds);
-        for (const row of localRows)
-            localIds.add(row.id);
-    }
-    const recalledAt = new Date().toISOString();
-    const log = [];
-    for (const r of boosted.slice(0, limit)) {
-        if (!localIds.has(r.entry.id))
-            continue; // global -> skip log insert
-        const matches = matchesByEntryId.get(r.entry.id);
-        if (!matches || matches.length === 0)
-            continue;
-        for (const tag of matches) {
-            const goal = goalsByTag.get(tag);
-            if (!goal)
-                continue;
-            log.push({ goalId: goal.id, memoryId: r.entry.id, tenantId, sessionId, recalledAt, score: r.score });
-        }
-    }
-    return { results: boosted, log };
+    return { results: boosted, log: buildGoalRecallLog(db, boosted, matchesByEntryId, goalsByTag, opts) };
 }
 /**
  * Writes goal-boost log rows. INSERT OR IGNORE because UNIQUE(memory_id, goal_id)

package/dist/incidents.js

@@ -77,6 +77,50 @@ const INCIDENT_COLS = `
 // ---------------------------------------------------------------------------
 // Public API
 // ---------------------------------------------------------------------------
+// Validate every linked receipt BEFORE inserting the row. Each must be a
+// memory in the SAME tenant; a cross-tenant or nonexistent id rejects the
+// whole write rather than recording an unverifiable receipt.
+function validateLinkedMemoryIds(db, tenantId, linkInput) {
+    const validated = [];
+    for (const linkId of linkInput) {
+        // SAFETY: row shape matches the single `id` column named in the SELECT above.
+        const exists = db.prepare(`SELECT id FROM memories WHERE id = ? AND tenant_id = ?`).get(linkId, tenantId);
+        if (!exists) {
+            throw new NotFoundError(`saveIncident: linked memory ${linkId} not found for tenant ${tenantId}`);
+        }
+        validated.push(linkId);
+    }
+    return validated;
+}
+/** The afterWrite body: link validation, INSERT, reload, open audit, all in one SAVEPOINT. */
+function writeIncidentRow(db, memoryId, tenantId, opts, actor, now) {
+    const validated = validateLinkedMemoryIds(db, tenantId, opts.linkedMemoryIds ?? []);
+    const result = db.prepare(`
+    INSERT INTO incidents(
+      memory_id, tenant_id, incident_text, context,
+      status, resolution_text, resolved_at, closed_at, linked_memory_ids, created_at
+    ) VALUES (?, ?, ?, ?, 'open', NULL, NULL, NULL, ?, ?)
+  `).run(memoryId, tenantId, opts.incidentText, opts.context ?? null, JSON.stringify(validated), now);
+    const incidentId = Number(result.lastInsertRowid ?? 0);
+    // SAFETY: row's shape matches the columns named in INCIDENT_COLS above.
+    const row = db.prepare(`SELECT ${INCIDENT_COLS} FROM incidents WHERE id = ?`)
+        .get(incidentId);
+    if (!row)
+        throw new Error('saveIncident: failed to reload saved incident row');
+    // GDPR-light metadata: id + flag only, no incident_text.
+    appendAuditEvent(db, {
+        tenantId,
+        actor,
+        op: 'incident_open',
+        targetId: String(incidentId),
+        metadata: {
+            incident_id: incidentId,
+            has_context: opts.context !== undefined && opts.context !== null && opts.context !== '',
+            linked_memory_count: validated.length,
+        },
+    });
+    return row;
+}
 /**
  * Create an incident. Writes the memory mirror + the incidents row atomically
  * inside writeEntry's SAVEPOINT 'write_entry'.
@@ -106,50 +150,13 @@ export function saveIncident(hippoRoot, tenantId, opts, actor = 'cli') {
         baseHalfLifeDays: objectHalfLifeDays(hippoRoot),
         tenantId,
     });
-    const linkInput = opts.linkedMemoryIds ?? [];
     // Populated inside afterWrite so the linked-id validation, the INSERT, and the
     // memory write all share one SAVEPOINT.
     let savedRow;
     writeEntry(hippoRoot, mem, {
         actor,
         afterWrite: (db, memoryId) => {
-            // Validate every linked receipt BEFORE inserting the row. Each must be a
-            // memory in the SAME tenant; a cross-tenant or nonexistent id rejects the
-            // whole write rather than recording an unverifiable receipt.
-            const validated = [];
-            for (const linkId of linkInput) {
-                // SAFETY: row shape matches the single `id` column named in the SELECT above.
-                const exists = db.prepare(`SELECT id FROM memories WHERE id = ? AND tenant_id = ?`).get(linkId, tenantId);
-                if (!exists) {
-                    throw new NotFoundError(`saveIncident: linked memory ${linkId} not found for tenant ${tenantId}`);
-                }
-                validated.push(linkId);
-            }
-            const result = db.prepare(`
-        INSERT INTO incidents(
-          memory_id, tenant_id, incident_text, context,
-          status, resolution_text, resolved_at, closed_at, linked_memory_ids, created_at
-        ) VALUES (?, ?, ?, ?, 'open', NULL, NULL, NULL, ?, ?)
-      `).run(memoryId, tenantId, opts.incidentText, opts.context ?? null, JSON.stringify(validated), now);
-            const incidentId = Number(result.lastInsertRowid ?? 0);
-            // SAFETY: row's shape matches the columns named in INCIDENT_COLS above.
-            const row = db.prepare(`SELECT ${INCIDENT_COLS} FROM incidents WHERE id = ?`)
-                .get(incidentId);
-            if (!row)
-                throw new Error('saveIncident: failed to reload saved incident row');
-            savedRow = row;
-            // GDPR-light metadata: id + flag only, no incident_text.
-            appendAuditEvent(db, {
-                tenantId,
-                actor,
-                op: 'incident_open',
-                targetId: String(incidentId),
-                metadata: {
-                    incident_id: incidentId,
-                    has_context: opts.context !== undefined && opts.context !== null && opts.context !== '',
-                    linked_memory_count: validated.length,
-                },
-            });
+            savedRow = writeIncidentRow(db, memoryId, tenantId, opts, actor, now);
         },
     });
     if (!savedRow) {

package/dist/policies.js

@@ -111,9 +111,79 @@ function buildPolicyContent(policyName, policyText, validFrom, validTo) {
     const range = validTo ? `${validFrom} to ${validTo}` : `${validFrom} onward`;
     return `${policyName}\n\n${policyText}\n\nEffective: ${range}`;
 }
-// ---------------------------------------------------------------------------
-// Public API
-// ---------------------------------------------------------------------------
+// Preflight the supersede target BEFORE inserting the new row (so the new
+// autoincrement id can never be its own supersede target); read the
+// predecessor version in the same SELECT for server-derived versioning.
+// Mirrors saveProcess / saveDecision (codex P1 2026-05-28).
+function preflightPolicySupersede(db, tenantId, supersedesId) {
+    // SAFETY: SELECT projects exactly status, version; .get() returns that
+    // shape for the matching row, or undefined when no policy/tenant pair matches.
+    const pred = db.prepare(`SELECT status, version FROM policies WHERE id = ? AND tenant_id = ?`).get(supersedesId, tenantId);
+    if (!pred) {
+        throw new NotFoundError(`savePolicy: policy ${supersedesId} to supersede not found for tenant ${tenantId}`);
+    }
+    if (pred.status !== 'active') {
+        throw new ConflictError(`savePolicy: policy ${supersedesId} is not active (status='${pred.status}'); only active policies can be superseded.`);
+    }
+    return pred.version + 1;
+}
+function insertPolicyRow(db, memoryId, w, version) {
+    const result = db.prepare(`
+    INSERT INTO policies(
+      memory_id, tenant_id, policy_name, policy_text, valid_from, valid_to,
+      version, status, superseded_by, superseded_at, change_summary, closed_at, created_at
+    ) VALUES (?, ?, ?, ?, ?, ?, ?, 'active', NULL, NULL, ?, NULL, ?)
+  `).run(memoryId, w.tenantId, w.policyName, w.policyText, w.validFrom, w.validTo, version, w.changeSummary, w.now);
+    return Number(result.lastInsertRowid ?? 0);
+}
+function supersedePolicyRow(db, w, supersedesId, policyId, version) {
+    const sup = db.prepare(`
+    UPDATE policies
+    SET status = 'superseded', superseded_by = ?, superseded_at = ?
+    WHERE id = ? AND tenant_id = ? AND status = 'active' AND id != ?
+  `).run(policyId, w.now, supersedesId, w.tenantId, policyId);
+    if (sup.changes === 0) {
+        throw new ConflictError(`savePolicy: policy ${supersedesId} could not be superseded (no longer active or self-reference).`);
+    }
+    appendAuditEvent(db, {
+        tenantId: w.tenantId,
+        actor: w.actor,
+        op: 'policy_supersede',
+        targetId: String(supersedesId),
+        metadata: {
+            policy_id: supersedesId,
+            superseded_by: policyId,
+            new_version: version,
+        },
+    });
+}
+/** The afterWrite body: preflight, INSERT, supersede, reload, create audit, all in one SAVEPOINT. */
+function writePolicyRow(db, memoryId, w) {
+    const version = w.supersedesId !== undefined ? preflightPolicySupersede(db, w.tenantId, w.supersedesId) : 1;
+    const policyId = insertPolicyRow(db, memoryId, w, version);
+    if (w.supersedesId !== undefined)
+        supersedePolicyRow(db, w, w.supersedesId, policyId, version);
+    // SAFETY: SELECT ${POLICY_COLS} projects exactly the PolicyRow columns;
+    // .get() returns that row, or undefined only if the just-inserted id can't
+    // be found.
+    const row = db.prepare(`SELECT ${POLICY_COLS} FROM policies WHERE id = ?`)
+        .get(policyId);
+    if (!row)
+        throw new Error('savePolicy: failed to reload saved policy row');
+    // GDPR-light metadata: ids + flags only, no policy text.
+    appendAuditEvent(db, {
+        tenantId: w.tenantId,
+        actor: w.actor,
+        op: 'policy_create',
+        targetId: String(policyId),
+        metadata: {
+            policy_id: policyId,
+            version,
+            open_ended: w.validTo === null,
+        },
+    });
+    return row;
+}
 /**
  * Create a policy (or a new version that supersedes an existing one). Writes the
  * memory mirror + the policies row atomically inside writeEntry's SAVEPOINT.
@@ -151,75 +221,22 @@ export function savePolicy(hippoRoot, tenantId, opts, actor = 'cli') {
         baseHalfLifeDays: objectHalfLifeDays(hippoRoot),
         tenantId,
     });
+    const w = {
+        tenantId,
+        actor,
+        policyName: opts.policyName,
+        policyText: opts.policyText,
+        validFrom,
+        validTo,
+        changeSummary,
+        supersedesId: opts.supersedesPolicyId,
+        now,
+    };
     let savedRow;
     writeEntry(hippoRoot, mem, {
         actor,
         afterWrite: (db, memoryId) => {
-            // Preflight the supersede target BEFORE inserting the new row (so the new
-            // autoincrement id can never be its own supersede target); read the
-            // predecessor version in the same SELECT for server-derived versioning.
-            // Mirrors saveProcess / saveDecision (codex P1 2026-05-28).
-            let version = 1;
-            if (opts.supersedesPolicyId !== undefined) {
-                // SAFETY: SELECT projects exactly status, version; .get() returns that
-                // shape for the matching row, or undefined when no policy/tenant pair matches.
-                const pred = db.prepare(`SELECT status, version FROM policies WHERE id = ? AND tenant_id = ?`).get(opts.supersedesPolicyId, tenantId);
-                if (!pred) {
-                    throw new NotFoundError(`savePolicy: policy ${opts.supersedesPolicyId} to supersede not found for tenant ${tenantId}`);
-                }
-                if (pred.status !== 'active') {
-                    throw new ConflictError(`savePolicy: policy ${opts.supersedesPolicyId} is not active (status='${pred.status}'); only active policies can be superseded.`);
-                }
-                version = pred.version + 1;
-            }
-            const result = db.prepare(`
-        INSERT INTO policies(
-          memory_id, tenant_id, policy_name, policy_text, valid_from, valid_to,
-          version, status, superseded_by, superseded_at, change_summary, closed_at, created_at
-        ) VALUES (?, ?, ?, ?, ?, ?, ?, 'active', NULL, NULL, ?, NULL, ?)
-      `).run(memoryId, tenantId, opts.policyName, opts.policyText, validFrom, validTo, version, changeSummary, now);
-            const policyId = Number(result.lastInsertRowid ?? 0);
-            if (opts.supersedesPolicyId !== undefined) {
-                const sup = db.prepare(`
-          UPDATE policies
-          SET status = 'superseded', superseded_by = ?, superseded_at = ?
-          WHERE id = ? AND tenant_id = ? AND status = 'active' AND id != ?
-        `).run(policyId, now, opts.supersedesPolicyId, tenantId, policyId);
-                if (sup.changes === 0) {
-                    throw new ConflictError(`savePolicy: policy ${opts.supersedesPolicyId} could not be superseded (no longer active or self-reference).`);
-                }
-                appendAuditEvent(db, {
-                    tenantId,
-                    actor,
-                    op: 'policy_supersede',
-                    targetId: String(opts.supersedesPolicyId),
-                    metadata: {
-                        policy_id: opts.supersedesPolicyId,
-                        superseded_by: policyId,
-                        new_version: version,
-                    },
-                });
-            }
-            // SAFETY: SELECT ${POLICY_COLS} projects exactly the PolicyRow columns;
-            // .get() returns that row, or undefined only if the just-inserted id can't
-            // be found.
-            const row = db.prepare(`SELECT ${POLICY_COLS} FROM policies WHERE id = ?`)
-                .get(policyId);
-            if (!row)
-                throw new Error('savePolicy: failed to reload saved policy row');
-            savedRow = row;
-            // GDPR-light metadata: ids + flags only, no policy text.
-            appendAuditEvent(db, {
-                tenantId,
-                actor,
-                op: 'policy_create',
-                targetId: String(policyId),
-                metadata: {
-                    policy_id: policyId,
-                    version,
-                    open_ended: validTo === null,
-                },
-            });
+            savedRow = writePolicyRow(db, memoryId, w);
         },
         afterCommit: () => markGraphDirty(hippoRoot, tenantId, mem.id),
     });