hippo-memory 1.61.0 → 1.63.0

package/dist/consolidate/traces.js

@@ -8,7 +8,8 @@ import { resolveTenantId } from '../tenant.js';
 import { appendAuditEvent, reportAuditWriteFailure } from '../audit.js';
 import { commonDerivationScope } from '../recall-scope.js';
 import { log } from '../log.js';
-import { REPLAY_COUNT_DEFAULT, isJsonString } from './run.js';
+import { REPLAY_COUNT_DEFAULT } from './run.js';
+import { isJsonString } from '../json.js';
 // -------------------------------------------------------------------------
 // 1.4. Auto-promote complete sessions to traces
 // -------------------------------------------------------------------------
@@ -24,10 +25,8 @@ export function promoteSessionTraces(run) {
     let tracesSkippedRejected = 0;
     const windowDays = run.config.autoTraceWindowDays ?? 7;
     const sinceMs = run.now.getTime() - windowDays * 24 * 60 * 60 * 1000;
-    // Auto-trace currently runs in a single-tenant context (the env-resolved
-    // tenant for this process). Multi-tenant deployments that want
-    // consolidation across all tenants need a per-tenant loop layered on top
-    // of this — tracked in docs/plans/2026-05-02-continuity-tables-tenant-scope.md.
+    // Auto-trace runs single-tenant (the env-resolved tenant); consolidating
+    // every tenant needs a per-tenant loop layered on top of this.
     const consolidationTenant = resolveTenantId({});
     const promotable = findPromotableSessions(run.hippoRoot, consolidationTenant, sinceMs);
     for (const session of promotable) {
@@ -60,7 +59,7 @@ function sessionTrace(run, consolidationTenant, sessionId) {
         session_id: sessionId,
         limit: 1000,
     });
-    // T7: a mixed-scope session would otherwise leak into one trace.
+    // A mixed-scope session would otherwise leak into one trace.
     const sessionScope = commonDerivationScope(events.map((e) => e.scope));
     if (!sessionScope.ok) {
         run.result.tracesSkippedMixedScope++;
@@ -91,26 +90,15 @@ function sessionTrace(run, consolidationTenant, sessionId) {
         tags: ['auto-promoted'],
         source: 'auto-promote',
         scope: sessionScope.scope,
-        // T1 fix (2026-08-15 hardening pass): stamp the trace into the SAME
-        // tenant the traceExistsForSession idempotency check (above) runs
-        // under. Before
-        // this, createMemory omitted tenantId and the trace always landed
-        // 'default' (memory.ts:535) while the idempotency check ran under
-        // consolidationTenant — for any non-default tenant that check never
-        // hit, and the trace regenerated every sleep.
+        // Same tenant as the traceExistsForSession check above, or a
+        // non-default tenant's trace regenerates every sleep.
         tenantId: consolidationTenant,
         baseHalfLifeDays: run.config.defaultHalfLifeDays,
     });
     return { trace, outcome };
 }
-// AT1 (same producer-side pattern as the merge pass below): traceExistsForSession
-// only sees rows CURRENTLY in the store — once a rejected trace is
-// removed, that idempotency check no longer blocks regeneration, and
-// this write would otherwise reach batchWriteAndDelete's guard bypass
-// unchecked, resurrecting it every sleep. Check under THE ENTRY'S OWN
-// stamped tenantId (read off `trace` after createMemory — never guess
-// the tenant) + the built content's digest. A hit skips the push
-// entirely: not counted as promoted, not added to survivors.
+// traceExistsForSession only sees live rows, so a removed rejected trace would regenerate every
+// sleep; check the tombstone under the entry's own stamped tenantId, never a guessed one.
 function traceRejected(run, trace, sessionId) {
     const consolidateDb = run.getConsolidateDb();
     if (!consolidateDb)

package/dist/customer-notes.d.ts

@@ -1,17 +1,16 @@
 /**
- * E2 customer_note first-class object - the LAST E2 object
- * (docs/plans/2026-06-01-e2-customer-note-object.md).
+ * customer_note first-class object.
  *
  * A `customer_note` is a discrete note recorded against an account/customer entity:
  * a `note` body scoped to a `customer`, evolving via the supersede delta lifecycle.
- * Entity-scoping is a free-form `customer` column (the `entities` table is unbuilt -
- * E3.1 planned - so an FK is deferred). Unlike project_brief's one-summary-per-repo,
+ * Entity-scoping is a free-form `customer` column (the `entities` table is unbuilt,
+ * so an FK is deferred). Unlike project_brief's one-summary-per-repo,
  * a customer accrues MANY discrete notes over time, each with its own supersede chain
  * (correct a note -> a new version preserving history; close retires it).
  *
  * Reuses the project_brief/skill supersede machinery verbatim (superseded_by self-FK
  * + CAS + INSERT-preflight + server-derived version + change_summary + supersede
- * tenant-match trigger). It has NO assembler/renderer (the simplest E2 object): the
+ * tenant-match trigger). It has NO assembler/renderer (the simplest first-class object): the
  * contribution is purely the entity-scoping dimension.
  *
  * The `customer_notes` table is the source of truth (survives memory decay); the
@@ -73,8 +72,7 @@ export interface ListCustomerNotesOpts {
  * the new version = predecessor.version + 1 (server-derived).
  *
  * The memory mirror carries a `customer:<lc>` tag (in addition to ['customer_note']
- * + caller extraTags) so scope-aware recall treats the note as entity-local - the
- * project_brief codex-P2 recall-locality lesson applied to entity scoping. There is
+ * + caller extraTags) so scope-aware recall treats the note as entity-local. There is
  * no self-recursion path (customer_note has no receipt-query/refresh).
  */
 export declare function saveCustomerNote(hippoRoot: string, tenantId: string, opts: SaveCustomerNoteOpts, actor?: string): CustomerNote;

package/dist/customer-notes.js

@@ -1,17 +1,16 @@
 /**
- * E2 customer_note first-class object - the LAST E2 object
- * (docs/plans/2026-06-01-e2-customer-note-object.md).
+ * customer_note first-class object.
  *
  * A `customer_note` is a discrete note recorded against an account/customer entity:
  * a `note` body scoped to a `customer`, evolving via the supersede delta lifecycle.
- * Entity-scoping is a free-form `customer` column (the `entities` table is unbuilt -
- * E3.1 planned - so an FK is deferred). Unlike project_brief's one-summary-per-repo,
+ * Entity-scoping is a free-form `customer` column (the `entities` table is unbuilt,
+ * so an FK is deferred). Unlike project_brief's one-summary-per-repo,
  * a customer accrues MANY discrete notes over time, each with its own supersede chain
  * (correct a note -> a new version preserving history; close retires it).
  *
  * Reuses the project_brief/skill supersede machinery verbatim (superseded_by self-FK
  * + CAS + INSERT-preflight + server-derived version + change_summary + supersede
- * tenant-match trigger). It has NO assembler/renderer (the simplest E2 object): the
+ * tenant-match trigger). It has NO assembler/renderer (the simplest first-class object): the
  * contribution is purely the entity-scoping dimension.
  *
  * The `customer_notes` table is the source of truth (survives memory decay); the
@@ -94,9 +93,78 @@ const NOTE_COLS = `
 function buildNoteContent(customer, note) {
     return `${customer}\n\n${note}`;
 }
-// ---------------------------------------------------------------------------
-// Public API
-// ---------------------------------------------------------------------------
+// Preflight the supersede target BEFORE inserting the new row (so the new
+// autoincrement id can never be its own supersede target); read the
+// predecessor version in the same SELECT for server-derived versioning.
+function preflightNoteSupersede(db, tenantId, supersedesId) {
+    // SAFETY: SELECT projects exactly status, version; .get() returns that
+    // shape for the matching row, or undefined when no note/tenant pair matches.
+    const pred = db.prepare(`SELECT status, version FROM customer_notes WHERE id = ? AND tenant_id = ?`).get(supersedesId, tenantId);
+    if (!pred) {
+        throw new NotFoundError(`saveCustomerNote: note ${supersedesId} to supersede not found for tenant ${tenantId}`);
+    }
+    if (pred.status !== 'active') {
+        throw new ConflictError(`saveCustomerNote: note ${supersedesId} is not active (status='${pred.status}'); only active notes can be superseded.`);
+    }
+    return pred.version + 1;
+}
+function insertNoteRow(db, memoryId, w, version) {
+    const result = db.prepare(`
+    INSERT INTO customer_notes(
+      memory_id, tenant_id, customer, note, version,
+      status, superseded_by, superseded_at, change_summary, closed_at, created_at
+    ) VALUES (?, ?, ?, ?, ?, 'active', NULL, NULL, ?, NULL, ?)
+  `).run(memoryId, w.tenantId, w.customer, w.note, version, w.changeSummary, w.now);
+    return Number(result.lastInsertRowid ?? 0);
+}
+function supersedeNoteRow(db, w, supersedesId, noteId, version) {
+    const sup = db.prepare(`
+    UPDATE customer_notes
+    SET status = 'superseded', superseded_by = ?, superseded_at = ?
+    WHERE id = ? AND tenant_id = ? AND status = 'active' AND id != ?
+  `).run(noteId, w.now, supersedesId, w.tenantId, noteId);
+    if (sup.changes === 0) {
+        throw new ConflictError(`saveCustomerNote: note ${supersedesId} could not be superseded (no longer active or self-reference).`);
+    }
+    appendAuditEvent(db, {
+        tenantId: w.tenantId,
+        actor: w.actor,
+        op: 'customer_note_supersede',
+        targetId: String(supersedesId),
+        metadata: {
+            note_id: supersedesId,
+            superseded_by: noteId,
+            new_version: version,
+        },
+    });
+}
+/** The afterWrite body: preflight, INSERT, supersede, reload, create audit, all in one SAVEPOINT. */
+function writeNoteRow(db, memoryId, w) {
+    const version = w.supersedesId !== undefined ? preflightNoteSupersede(db, w.tenantId, w.supersedesId) : 1;
+    const noteId = insertNoteRow(db, memoryId, w, version);
+    if (w.supersedesId !== undefined)
+        supersedeNoteRow(db, w, w.supersedesId, noteId, version);
+    // SAFETY: SELECT ${NOTE_COLS} projects exactly the CustomerNoteRow columns;
+    // .get() returns that row, or undefined only if the just-inserted id can't
+    // be found.
+    const row = db.prepare(`SELECT ${NOTE_COLS} FROM customer_notes WHERE id = ?`)
+        .get(noteId);
+    if (!row)
+        throw new Error('saveCustomerNote: failed to reload saved note row');
+    // GDPR-light metadata: ids + flags only, no note text.
+    appendAuditEvent(db, {
+        tenantId: w.tenantId,
+        actor: w.actor,
+        op: 'customer_note_create',
+        targetId: String(noteId),
+        metadata: {
+            note_id: noteId,
+            customer: w.customer,
+            version,
+        },
+    });
+    return row;
+}
 /**
  * Create a customer_note (or a new version that supersedes an existing one). Writes
  * the memory mirror + the customer_notes row atomically inside writeEntry's SAVEPOINT.
@@ -105,8 +173,7 @@ function buildNoteContent(customer, note) {
  * the new version = predecessor.version + 1 (server-derived).
  *
  * The memory mirror carries a `customer:<lc>` tag (in addition to ['customer_note']
- * + caller extraTags) so scope-aware recall treats the note as entity-local - the
- * project_brief codex-P2 recall-locality lesson applied to entity scoping. There is
+ * + caller extraTags) so scope-aware recall treats the note as entity-local. There is
  * no self-recursion path (customer_note has no receipt-query/refresh).
  */
 export function saveCustomerNote(hippoRoot, tenantId, opts, actor = 'cli') {
@@ -125,75 +192,14 @@ export function saveCustomerNote(hippoRoot, tenantId, opts, actor = 'cli') {
         baseHalfLifeDays: objectHalfLifeDays(hippoRoot),
         tenantId,
     });
+    const w = {
+        tenantId, actor, customer, note: opts.note, changeSummary, supersedesId: opts.supersedesNoteId, now,
+    };
     let savedRow;
     writeEntry(hippoRoot, mem, {
         actor,
         afterWrite: (db, memoryId) => {
-            // Preflight the supersede target BEFORE inserting the new row (so the new
-            // autoincrement id can never be its own supersede target); read the
-            // predecessor version in the same SELECT for server-derived versioning.
-            // Mirrors saveProjectBrief / saveSkill (codex P1 2026-05-28).
-            let version = 1;
-            if (opts.supersedesNoteId !== undefined) {
-                // SAFETY: SELECT projects exactly status, version; .get() returns that
-                // shape for the matching row, or undefined when no note/tenant pair matches.
-                const pred = db.prepare(`SELECT status, version FROM customer_notes WHERE id = ? AND tenant_id = ?`).get(opts.supersedesNoteId, tenantId);
-                if (!pred) {
-                    throw new NotFoundError(`saveCustomerNote: note ${opts.supersedesNoteId} to supersede not found for tenant ${tenantId}`);
-                }
-                if (pred.status !== 'active') {
-                    throw new ConflictError(`saveCustomerNote: note ${opts.supersedesNoteId} is not active (status='${pred.status}'); only active notes can be superseded.`);
-                }
-                version = pred.version + 1;
-            }
-            const result = db.prepare(`
-        INSERT INTO customer_notes(
-          memory_id, tenant_id, customer, note, version,
-          status, superseded_by, superseded_at, change_summary, closed_at, created_at
-        ) VALUES (?, ?, ?, ?, ?, 'active', NULL, NULL, ?, NULL, ?)
-      `).run(memoryId, tenantId, customer, opts.note, version, changeSummary, now);
-            const noteId = Number(result.lastInsertRowid ?? 0);
-            if (opts.supersedesNoteId !== undefined) {
-                const sup = db.prepare(`
-          UPDATE customer_notes
-          SET status = 'superseded', superseded_by = ?, superseded_at = ?
-          WHERE id = ? AND tenant_id = ? AND status = 'active' AND id != ?
-        `).run(noteId, now, opts.supersedesNoteId, tenantId, noteId);
-                if (sup.changes === 0) {
-                    throw new ConflictError(`saveCustomerNote: note ${opts.supersedesNoteId} could not be superseded (no longer active or self-reference).`);
-                }
-                appendAuditEvent(db, {
-                    tenantId,
-                    actor,
-                    op: 'customer_note_supersede',
-                    targetId: String(opts.supersedesNoteId),
-                    metadata: {
-                        note_id: opts.supersedesNoteId,
-                        superseded_by: noteId,
-                        new_version: version,
-                    },
-                });
-            }
-            // SAFETY: SELECT ${NOTE_COLS} projects exactly the CustomerNoteRow columns;
-            // .get() returns that row, or undefined only if the just-inserted id can't
-            // be found.
-            const row = db.prepare(`SELECT ${NOTE_COLS} FROM customer_notes WHERE id = ?`)
-                .get(noteId);
-            if (!row)
-                throw new Error('saveCustomerNote: failed to reload saved note row');
-            savedRow = row;
-            // GDPR-light metadata: ids + flags only, no note text.
-            appendAuditEvent(db, {
-                tenantId,
-                actor,
-                op: 'customer_note_create',
-                targetId: String(noteId),
-                metadata: {
-                    note_id: noteId,
-                    customer,
-                    version,
-                },
-            });
+            savedRow = writeNoteRow(db, memoryId, w);
         },
         afterCommit: () => markGraphDirty(hippoRoot, tenantId, mem.id),
     });
@@ -246,7 +252,7 @@ export function closeCustomerNote(hippoRoot, tenantId, id, actor = 'cli') {
             // Closing removes the object from the graph. Remove its rows DIRECTLY (deterministic),
             // not only via an enqueued rebuild whose queue item is lost if the mirror is later
             // forgotten (the queue row cascade-deletes with the memory), which would leave the closed
-            // object stale and could block that forget (codex P1). Still enqueue when a mirror exists
+            // object stale and could block that forget. Still enqueue when a mirror exists
             // so a concurrent rebuild re-derives consistently (harmless if it also runs).
             removeGraphEntitiesForObject(hippoRoot, tenantId, 'customer', closed.id);
             if (closed.memoryId) {

package/dist/dag.d.ts

@@ -16,11 +16,8 @@ export interface DagBuildResult {
     candidateClusters: number;
     summariesCreated: number;
     factsLinked: number;
-    /** AT1: clusters skipped because the LLM-synthesized summary landed on a
-     *  rejected value (plan §3 containment — per-cluster catch, not a whole-
-     *  phase abort). Member re-parenting writes are unaffected by construction
-     *  (same id + same content = guard-exempt), so this only ever counts
-     *  summary-creation refusals. */
+    /** Clusters skipped because the summary matched a rejected value. Re-parenting writes are
+     *  guard-exempt (same id + content), so only summary-creation refusals count. */
     rejected: number;
 }
 export declare function buildDag(hippoRoot: string, facts: MemoryEntry[], opts: DagSummaryOptions): Promise<DagBuildResult>;
@@ -33,21 +30,17 @@ export interface DagRebuildResult {
     capped: boolean;
 }
 /**
- * v0.30 / E3 — sleep-cycle phase that drains the dirty L2 summary queue.
+ * Sleep-cycle phase that drains the dirty L2 summary queue.
  * Thin orchestrator; the heavy lifting lives in store.ts (load + apply)
  * and dag.ts:generateDagSummary (LLM call).
  *
- * Per-summary try/catch isolation (plan-eng-r1 MED must-fix) — one
- * throwing rebuild does NOT abort the rest of the queue.
+ * Per-summary try/catch: one throwing rebuild does NOT abort the rest of the queue.
  *
  * Race-loser handling: applyRebuildResult's UPDATE WHERE includes
  * AND summary_dirty=1, so concurrent sleep's second writer returns
  * changed=false. Silent skip (neither rebuilt++ nor refused++ nor failed++).
  *
- * T4: applyRebuildResult returns { changed, refused } — a tombstone hit
- * (rebuild content matches a previously-rejected value) increments
- * `refused`, not `rebuilt`. Dirty still clears either way; only the stat
- * split changed (docs/plans/2026-08-15-hardening-at1-followups.md T4).
+ * A tombstone hit counts as `refused`, not `rebuilt`; dirty clears either way.
  */
 export declare function rebuildDirtySummaries(hippoRoot: string, opts: DagSummaryOptions & {
     cap?: number;
@@ -57,21 +50,17 @@ export interface EntityProfilesBuildResult {
     profilesCreated: number;
     l2sLinked: number;
     failed: number;
-    /** AT1: clusters skipped because the profile summary landed on a rejected
-     *  value (plan §3 containment). Kept distinct from `failed` (LLM null /
-     *  rate-limit) — a tombstone hit is a deliberate refusal, not an error. */
+    /** Clusters skipped because the profile matched a rejected value. Kept apart from
+     *  `failed`: a tombstone hit is a deliberate refusal, not an error. */
     rejected: number;
 }
 /**
- * v0.30 / E5 — build L3 entity profiles by clustering L2 summaries with
+ * Build L3 entity profiles by clustering L2 summaries with
  * shared entity tags. Threshold 2+ L2s per entity. Mirrors buildDag L1->L2
  * pattern, one level up.
  *
- * Born-dirty cancellation (E3 lesson): after linking L2 children to the new
- * L3 (each link write fires E2 hook on L3 via widened markSummaryDirtyInTx),
- * call clearSummaryDirtyAfterBuild with source='buildEntityProfiles-clean'
- * so E3 sleep-cycle rebuild doesn't re-rebuild the freshly-built L3 this
- * same cycle.
+ * Born-dirty cancellation: each L2 link write marks the new L3 dirty, so clear it
+ * or the same sleep cycle's rebuild re-rebuilds the freshly built L3.
  */
 export declare function buildEntityProfiles(hippoRoot: string, l2Summaries: MemoryEntry[], opts: DagSummaryOptions): Promise<EntityProfilesBuildResult>;
 //# sourceMappingURL=dag.d.ts.map