hippo-memory 1.61.0 → 1.63.0

package/dist/dag.js

@@ -87,17 +87,10 @@ export async function generateDagSummary(label, factContents, opts) {
         return null;
     }
 }
-export async function buildDag(hippoRoot, facts, opts) {
-    const result = { candidateClusters: 0, summariesCreated: 0, factsLinked: 0, rejected: 0 };
-    const baseHalfLifeDays = loadConfig(hippoRoot).defaultHalfLifeDays;
-    const unparented = facts.filter((f) => f.dag_level === 1 && !f.dag_parent_id && f.tags.includes('extracted'));
-    // Hardening follow-up (mirrors consolidate.ts's mergeCandidatesByTenant,
-    // T1): partition unparented facts by tenantId BEFORE clustering so a
-    // cluster can never mix facts from different tenants into one
-    // LLM-synthesized summary. Map preserves insertion order, so
-    // single-tenant stores (every row 'default') get exactly one partition
-    // and iterate in the same order as before this fix — byte-identical
-    // behavior there.
+// Partition BEFORE clustering so one LLM summary never mixes facts from different tenants.
+// Map keeps insertion order, so a single-tenant store iterates in its original order.
+// buildEntityProfiles partitions its L2s with this same key.
+function partitionFactsByTenant(unparented) {
     const unparentedByTenant = new Map();
     for (const fact of unparented) {
         const key = derivationPartitionKey(fact.tenantId, fact.scope, fact.origin_project);
@@ -107,95 +100,144 @@ export async function buildDag(hippoRoot, facts, opts) {
         else
             unparentedByTenant.set(key, [fact]);
     }
-    for (const [, tenantFacts] of unparentedByTenant) {
-        const factTenant = tenantFacts[0].tenantId;
-        const factScope = derivationScope(tenantFacts[0].scope);
+    return unparentedByTenant;
+}
+/** The L2 summary entry for one cluster, landing in the facts' own tenant and scope. */
+function createClusterSummaryEntry(summary, cluster, home) {
+    const memberCreatedAts = cluster.members.map((m) => m.created).sort();
+    // Every member of `cluster` shares home.tenantId by construction (the
+    // tenant partition above), so the summary lands in the same tenant
+    // as the facts it summarizes instead of always 'default'
+    // (memory.ts:535 defaults tenantId when the option is omitted).
+    const summaryEntry = createMemory(summary, {
+        layer: Layer.Semantic,
+        tags: [...cluster.entityTags, ...neverAutoShareTags(cluster.members), 'dag-summary'],
+        confidence: 'inferred',
+        dag_level: 2,
+        tenantId: home.tenantId,
+        scope: home.scope,
+        baseHalfLifeDays: home.baseHalfLifeDays,
+    });
+    summaryEntry.origin_project = home.originProject;
+    // Cache descendant_count + earliest/latest_at on the summary row so
+    // DAG-aware recall can reason about scope without walking the children.
+    summaryEntry.descendant_count = cluster.members.length;
+    summaryEntry.earliest_at = memberCreatedAts[0];
+    summaryEntry.latest_at = memberCreatedAts[memberCreatedAts.length - 1];
+    return summaryEntry;
+}
+/** Summarize one eligible cluster, write the summary, then re-parent its members under it. */
+async function summarizeCluster(hippoRoot, cluster, home, opts, result) {
+    const summary = await generateDagSummary(cluster.label, cluster.members.map((m) => m.content), opts);
+    if (!summary)
+        return;
+    const summaryEntry = createClusterSummaryEntry(summary, cluster, home);
+    // A refused summary skips only this cluster. writeEntry's guard reads tenantId off the entry
+    // (home.tenantId), so it already checks this tenant's tombstones: no separate check here.
+    try {
+        writeEntry(hippoRoot, summaryEntry);
+    }
+    catch (err) {
+        if (err instanceof RejectedValueError) {
+            result.rejected++;
+            log.warn(`buildDag: cluster "${cluster.label}" skipped: summary matches a rejected value`);
+            return;
+        }
+        throw err;
+    }
+    result.summariesCreated++;
+    for (const member of cluster.members) {
+        const updated = { ...member, dag_parent_id: summaryEntry.id };
+        writeEntry(hippoRoot, updated);
+        result.factsLinked++;
+    }
+    // Member writes just marked this fresh summary dirty; clear it, or the same sleep cycle's
+    // rebuild pass would re-rebuild every new summary at twice the LLM cost.
+    clearSummaryDirtyAfterBuild(hippoRoot, summaryEntry.id, summaryEntry.tenantId, 'buildDag');
+}
+export async function buildDag(hippoRoot, facts, opts) {
+    const result = { candidateClusters: 0, summariesCreated: 0, factsLinked: 0, rejected: 0 };
+    const baseHalfLifeDays = loadConfig(hippoRoot).defaultHalfLifeDays;
+    const unparented = facts.filter((f) => f.dag_level === 1 && !f.dag_parent_id && f.tags.includes('extracted'));
+    for (const [, tenantFacts] of partitionFactsByTenant(unparented)) {
+        const home = {
+            tenantId: tenantFacts[0].tenantId,
+            scope: derivationScope(tenantFacts[0].scope),
+            originProject: tenantFacts[0].origin_project,
+            baseHalfLifeDays,
+        };
         const clusters = clusterFacts(tenantFacts);
         const eligibleClusters = clusters.filter((c) => c.members.length >= 3);
         result.candidateClusters += eligibleClusters.length;
         for (const cluster of eligibleClusters) {
-            const summary = await generateDagSummary(cluster.label, cluster.members.map((m) => m.content), opts);
-            if (!summary)
-                continue;
-            const memberCreatedAts = cluster.members.map((m) => m.created).sort();
-            // Every member of `cluster` shares factTenant by construction (the
-            // tenant partition above), so the summary lands in the same tenant
-            // as the facts it summarizes instead of always 'default'
-            // (memory.ts:535 defaults tenantId when the option is omitted).
-            const summaryEntry = createMemory(summary, {
-                layer: Layer.Semantic,
-                tags: [...cluster.entityTags, ...neverAutoShareTags(cluster.members), 'dag-summary'],
-                confidence: 'inferred',
-                dag_level: 2,
-                tenantId: factTenant,
-                scope: factScope,
-                baseHalfLifeDays,
-            });
-            summaryEntry.origin_project = tenantFacts[0].origin_project;
-            // Schema v25: cache descendant_count + earliest/latest_at on the summary
-            // row so DAG-aware recall (docs/plans/2026-05-05-dag-recall.md Task 2)
-            // can reason about scope without walking the children.
-            summaryEntry.descendant_count = cluster.members.length;
-            summaryEntry.earliest_at = memberCreatedAts[0];
-            summaryEntry.latest_at = memberCreatedAts[memberCreatedAts.length - 1];
-            // AT1 (plan §3 containment): a refused LLM-synthesized summary skips
-            // ONLY this cluster — the sleep cycle continues to the next one. The
-            // member re-parenting writes below never run for a skipped cluster
-            // (there is no summary id to parent them under).
-            //
-            // The tombstone check itself is tenant-scoped for free: writeEntry ->
-            // writeEntryDbOnly -> upsertEntryRow calls
-            // checkRejectionGuard(db, entry.tenantId ?? 'default', ...)
-            // (store/entry-writes.ts), reading tenantId off the entry being written. Now
-            // that summaryEntry carries factTenant instead of the implicit
-            // 'default', the guard consults that tenant's tombstones — no
-            // separate check needed here (unlike consolidate.ts's merge pass,
-            // which pre-checks via findRejectedValue because it writes through
-            // batchWriteAndDelete's bypassRejectionGuard path instead of
-            // writeEntry).
-            try {
-                writeEntry(hippoRoot, summaryEntry);
-            }
-            catch (err) {
-                if (err instanceof RejectedValueError) {
-                    result.rejected++;
-                    log.warn(`buildDag: cluster "${cluster.label}" skipped: summary matches a rejected value`);
-                    continue;
-                }
-                throw err;
-            }
-            result.summariesCreated++;
-            for (const member of cluster.members) {
-                const updated = { ...member, dag_parent_id: summaryEntry.id };
-                writeEntry(hippoRoot, updated);
-                result.factsLinked++;
-            }
-            // v0.30 / E3 — cancel the cascade of dirty-marks fired by member
-            // writeEntry calls (E2 hook on writeEntryDbOnly in store/entry-writes.ts).
-            // The summary we just built IS fresh, no rebuild needed. Without this,
-            // E3 in the SAME sleep cycle would re-rebuild every new summary
-            // (2x LLM cost). plan-eng-r1 HIGH must-fix.
-            clearSummaryDirtyAfterBuild(hippoRoot, summaryEntry.id, summaryEntry.tenantId, 'buildDag');
+            await summarizeCluster(hippoRoot, cluster, home, opts, result);
         }
     }
     return result;
 }
+/** Regenerate one dirty summary from its children and tally the outcome; throws reach the caller's isolation. */
+async function rebuildOneSummary(hippoRoot, summary, opts, result) {
+    const children = loadChildrenOfSummary(hippoRoot, summary.id, summary.tenantId);
+    if (children.length === 0) {
+        // Zero-child case: clear dirty + zero counts, no LLM call, no rebuild_count bump.
+        const { changed } = applyRebuildResult(hippoRoot, summary, {
+            content: summary.content,
+            descendant_count: 0,
+            earliest_at: null,
+            latest_at: null,
+            bumpRebuildCount: false,
+            zeroChildren: true,
+            actor: 'sleep',
+        });
+        if (changed)
+            result.zeroChildSkipped++;
+        // changed=false → race lost / row vanished; silently skip. `refused`
+        // is always false here — applyRebuildResult only checks the
+        // tombstone when bumpRebuildCount is true (store/summaries.ts).
+        return;
+    }
+    // Derive label from summary's existing entity tags (mirrors clusterFacts)
+    const entityTags = summary.tags.filter((t) => t.startsWith('speaker:') || t.startsWith('topic:'));
+    const label = entityTags.length > 0
+        ? entityTags.map((t) => t.split(':')[1]).join(': ')
+        : summary.content.slice(0, 40);
+    const newContent = await generateDagSummary(label, children.map((c) => c.content), opts);
+    if (!newContent) {
+        // LLM null / fetch error → leave dirty for next cycle
+        result.failed++;
+        return;
+    }
+    const childCreatedAts = children.map((c) => c.created).sort();
+    const { changed, refused } = applyRebuildResult(hippoRoot, summary, {
+        content: newContent,
+        descendant_count: children.length,
+        earliest_at: childCreatedAts[0],
+        latest_at: childCreatedAts[childCreatedAts.length - 1],
+        bumpRebuildCount: true,
+        zeroChildren: false,
+        actor: 'sleep',
+    });
+    if (refused) {
+        result.refused++;
+    }
+    else if (changed) {
+        result.rebuilt++;
+    }
+    // changed=false (refused also false) → race lost; not failure, not
+    // success, silently skip
+}
 /**
- * v0.30 / E3 — sleep-cycle phase that drains the dirty L2 summary queue.
+ * Sleep-cycle phase that drains the dirty L2 summary queue.
  * Thin orchestrator; the heavy lifting lives in store.ts (load + apply)
  * and dag.ts:generateDagSummary (LLM call).
  *
- * Per-summary try/catch isolation (plan-eng-r1 MED must-fix) — one
- * throwing rebuild does NOT abort the rest of the queue.
+ * Per-summary try/catch: one throwing rebuild does NOT abort the rest of the queue.
  *
  * Race-loser handling: applyRebuildResult's UPDATE WHERE includes
  * AND summary_dirty=1, so concurrent sleep's second writer returns
  * changed=false. Silent skip (neither rebuilt++ nor refused++ nor failed++).
  *
- * T4: applyRebuildResult returns { changed, refused } — a tombstone hit
- * (rebuild content matches a previously-rejected value) increments
- * `refused`, not `rebuilt`. Dirty still clears either way; only the stat
- * split changed (docs/plans/2026-08-15-hardening-at1-followups.md T4).
+ * A tombstone hit counts as `refused`, not `rebuilt`; dirty clears either way.
  */
 export async function rebuildDirtySummaries(hippoRoot, opts) {
     const cap = opts.cap ?? 20;
@@ -221,76 +263,74 @@ export async function rebuildDirtySummaries(hippoRoot, opts) {
             await new Promise((resolve) => setImmediate(resolve));
         }
         try {
-            const children = loadChildrenOfSummary(hippoRoot, summary.id, summary.tenantId);
-            if (children.length === 0) {
-                // Zero-child case: clear dirty + zero counts, no LLM call, no rebuild_count bump.
-                const { changed } = applyRebuildResult(hippoRoot, summary, {
-                    content: summary.content,
-                    descendant_count: 0,
-                    earliest_at: null,
-                    latest_at: null,
-                    bumpRebuildCount: false,
-                    zeroChildren: true,
-                    actor: 'sleep',
-                });
-                if (changed)
-                    result.zeroChildSkipped++;
-                // changed=false → race lost / row vanished; silently skip. `refused`
-                // is always false here — applyRebuildResult only checks the
-                // tombstone when bumpRebuildCount is true (store/summaries.ts).
-                continue;
-            }
-            // Derive label from summary's existing entity tags (mirrors clusterFacts)
-            const entityTags = summary.tags.filter((t) => t.startsWith('speaker:') || t.startsWith('topic:'));
-            const label = entityTags.length > 0
-                ? entityTags.map((t) => t.split(':')[1]).join(': ')
-                : summary.content.slice(0, 40);
-            const newContent = await generateDagSummary(label, children.map((c) => c.content), opts);
-            if (!newContent) {
-                // LLM null / fetch error → leave dirty for next cycle
-                result.failed++;
-                continue;
-            }
-            const childCreatedAts = children.map((c) => c.created).sort();
-            const { changed, refused } = applyRebuildResult(hippoRoot, summary, {
-                content: newContent,
-                descendant_count: children.length,
-                earliest_at: childCreatedAts[0],
-                latest_at: childCreatedAts[childCreatedAts.length - 1],
-                bumpRebuildCount: true,
-                zeroChildren: false,
-                actor: 'sleep',
-            });
-            if (refused) {
-                result.refused++;
-            }
-            else if (changed) {
-                result.rebuilt++;
-            }
-            // changed=false (refused also false) → race lost; not failure, not
-            // success, silently skip
+            await rebuildOneSummary(hippoRoot, summary, opts, result);
         }
         catch (err) {
-            // Per-summary failure isolation — one throw doesn't abort the queue.
-            // independent-review MED #2 fold: log enough to triage in production
-            // (audit() wraps its own writes try/catch per store/audit-event.ts, so a
-            // throw here is exotic: SQLite I/O error, prepare failure, etc).
+            // One throw doesn't abort the queue; log enough to triage an exotic
+            // failure (SQLite I/O, prepare), since audit() already catches its own.
             result.failed++;
             log.error(`rebuildDirtySummaries: summary ${summary.id} (tenant ${summary.tenantId}) failed: ${err instanceof Error ? err.message : String(err)}`);
         }
     }
     return result;
 }
+/** The L3 profile entry for one cluster of L2 summaries. */
+function createProfileEntry(summary, cluster, home) {
+    const memberCreatedAts = cluster.members.map((m) => m.created).sort();
+    const nowIso = new Date().toISOString();
+    const profileEntry = createMemory(summary, {
+        layer: Layer.Semantic,
+        tags: [...cluster.entityTags, ...neverAutoShareTags(cluster.members), 'dag-entity-profile'],
+        confidence: 'inferred',
+        dag_level: 3,
+        tenantId: home.tenantId,
+        scope: home.scope,
+        baseHalfLifeDays: home.baseHalfLifeDays,
+    });
+    profileEntry.origin_project = home.originProject;
+    profileEntry.descendant_count = cluster.members.length;
+    profileEntry.earliest_at = memberCreatedAts[0];
+    profileEntry.latest_at = memberCreatedAts[memberCreatedAts.length - 1];
+    profileEntry.dag_level_3_built_at = nowIso;
+    return profileEntry;
+}
+/** Profile one eligible cluster of L2s, write it, then re-link the L2s under it. */
+async function profileCluster(hippoRoot, cluster, home, opts, result) {
+    const summary = await generateDagSummary(cluster.label, cluster.members.map((m) => m.content), opts);
+    if (!summary) {
+        result.failed++;
+        return;
+    }
+    const profileEntry = createProfileEntry(summary, cluster, home);
+    // A refused profile skips only this cluster; the re-linking below never runs for it.
+    try {
+        writeEntry(hippoRoot, profileEntry);
+    }
+    catch (err) {
+        if (err instanceof RejectedValueError) {
+            result.rejected++;
+            log.warn(`buildEntityProfiles: cluster "${cluster.label}" skipped: profile matches a rejected value`);
+            return;
+        }
+        throw err;
+    }
+    result.profilesCreated++;
+    for (const member of cluster.members) {
+        const updated = { ...member, dag_parent_id: profileEntry.id };
+        writeEntry(hippoRoot, updated);
+        result.l2sLinked++;
+    }
+    // Re-linking just marked the fresh L3 dirty; clear it so this cycle's rebuild skips it.
+    // The distinct source tags the audit row.
+    clearSummaryDirtyAfterBuild(hippoRoot, profileEntry.id, home.tenantId, 'buildEntityProfiles', 'buildEntityProfiles-clean');
+}
 /**
- * v0.30 / E5 — build L3 entity profiles by clustering L2 summaries with
+ * Build L3 entity profiles by clustering L2 summaries with
  * shared entity tags. Threshold 2+ L2s per entity. Mirrors buildDag L1->L2
  * pattern, one level up.
  *
- * Born-dirty cancellation (E3 lesson): after linking L2 children to the new
- * L3 (each link write fires E2 hook on L3 via widened markSummaryDirtyInTx),
- * call clearSummaryDirtyAfterBuild with source='buildEntityProfiles-clean'
- * so E3 sleep-cycle rebuild doesn't re-rebuild the freshly-built L3 this
- * same cycle.
+ * Born-dirty cancellation: each L2 link write marks the new L3 dirty, so clear it
+ * or the same sleep cycle's rebuild re-rebuilds the freshly built L3.
  */
 export async function buildEntityProfiles(hippoRoot, l2Summaries, opts) {
     const result = {
@@ -303,72 +343,18 @@ export async function buildEntityProfiles(hippoRoot, l2Summaries, opts) {
     const baseHalfLifeDays = loadConfig(hippoRoot).defaultHalfLifeDays;
     // Only L2 with no L3 parent yet (avoid re-clustering already-profiled L2s).
     const unparented = l2Summaries.filter((s) => s.dag_level === 2 && !s.dag_parent_id);
-    // independent-review HIGH #1 fold: cluster ONLY within-tenant.
-    // clusterFacts has no tenant awareness; without this partition step a
-    // multi-tenant host could form a cluster spanning tenants and produce
-    // a single L3 with tenantId='default' that doesn't belong to either
-    // child tenant. Fix: bucket by tenantId, run clusterFacts per-tenant,
-    // pass tenantId to createMemory.
-    const byTenant = new Map();
-    for (const l2 of unparented) {
-        const tid = l2.tenantId ?? 'default';
-        const key = derivationPartitionKey(tid, l2.scope, l2.origin_project);
-        const list = byTenant.get(key) ?? [];
-        list.push(l2);
-        byTenant.set(key, list);
-    }
-    for (const [, tenantL2s] of byTenant) {
-        const tenantId = tenantL2s[0].tenantId ?? 'default';
-        const scope = derivationScope(tenantL2s[0].scope);
+    for (const [, tenantL2s] of partitionFactsByTenant(unparented)) {
+        const home = {
+            tenantId: tenantL2s[0].tenantId,
+            scope: derivationScope(tenantL2s[0].scope),
+            originProject: tenantL2s[0].origin_project,
+            baseHalfLifeDays,
+        };
         const clusters = clusterFacts(tenantL2s);
         const eligible = clusters.filter((c) => c.members.length >= 2);
         result.candidateClusters += eligible.length;
         for (const cluster of eligible) {
-            const summary = await generateDagSummary(cluster.label, cluster.members.map((m) => m.content), opts);
-            if (!summary) {
-                result.failed++;
-                continue;
-            }
-            const memberCreatedAts = cluster.members.map((m) => m.created).sort();
-            const nowIso = new Date().toISOString();
-            const profileEntry = createMemory(summary, {
-                layer: Layer.Semantic,
-                tags: [...cluster.entityTags, ...neverAutoShareTags(cluster.members), 'dag-entity-profile'],
-                confidence: 'inferred',
-                dag_level: 3,
-                tenantId, // HIGH #1 fold: thread tenant explicitly
-                scope,
-                baseHalfLifeDays,
-            });
-            profileEntry.origin_project = tenantL2s[0].origin_project;
-            profileEntry.descendant_count = cluster.members.length;
-            profileEntry.earliest_at = memberCreatedAts[0];
-            profileEntry.latest_at = memberCreatedAts[memberCreatedAts.length - 1];
-            profileEntry.dag_level_3_built_at = nowIso;
-            // AT1 (plan §3 containment): per-cluster catch — skip this cluster,
-            // count, log once. The member re-linking writes below never run for a
-            // skipped cluster (mirrors buildDag above).
-            try {
-                writeEntry(hippoRoot, profileEntry);
-            }
-            catch (err) {
-                if (err instanceof RejectedValueError) {
-                    result.rejected++;
-                    log.warn(`buildEntityProfiles: cluster "${cluster.label}" skipped: profile matches a rejected value`);
-                    continue;
-                }
-                throw err;
-            }
-            result.profilesCreated++;
-            for (const member of cluster.members) {
-                const updated = { ...member, dag_parent_id: profileEntry.id };
-                writeEntry(hippoRoot, updated);
-                result.l2sLinked++;
-            }
-            // E3 born-dirty cancellation, same dance as buildDag L161-168 but for
-            // L3. Pass source='buildEntityProfiles-clean' to distinguish in audit.
-            // Args: (root, id, tenantId, actor, source).
-            clearSummaryDirtyAfterBuild(hippoRoot, profileEntry.id, tenantId, 'buildEntityProfiles', 'buildEntityProfiles-clean');
+            await profileCluster(hippoRoot, cluster, home, opts, result);
         }
     }
     return result;

package/dist/db/continuity.js

@@ -112,8 +112,8 @@ const CARD_COMMENTS_DDL = `
       tenant_id TEXT NOT NULL DEFAULT 'default'
     )
   `;
-// Before the loop on stamped stores: a table lost after its migration stamped (2026-08-15
-// incident) is never re-migrated, and v4/v16/v22 ALTER or read it. Fresh stores use the chain.
+// Before the loop on stamped stores: a table lost after its migration stamped
+// is never re-migrated, and v4/v16/v22 ALTER or read it. Fresh stores use the chain.
 export function ensureContinuityTables(db) {
     db.exec(TASK_SNAPSHOTS_DDL);
     db.exec(SESSION_EVENTS_DDL);

package/dist/db/migrations/v14.js

@@ -2,7 +2,7 @@ import { tableHasColumn } from '../tables.js';
 export const v14 = {
     version: 14,
     up: (db) => {
-        // A3 provenance envelope: kind, scope, owner, artifact_ref.
+        // Provenance envelope: kind, scope, owner, artifact_ref.
         // SQLite ALTER TABLE ADD COLUMN cannot add CHECK; CHECK enforcement lives
         // in INSERT/UPDATE triggers added later in this migration.
         if (!tableHasColumn(db, 'memories', 'kind')) {

package/dist/db/migrations/v15.js

@@ -1,8 +1,7 @@
 export const v15 = {
     version: 15,
     up: (db) => {
-        // A3 hardening (post-review): close the NULL-kind bypass and add raw_archive
-        // dedup safety. Both findings landed in /review on commits 41b1f4d..6456e7d.
+        // Close the NULL-kind bypass and add raw_archive dedup safety.
         //
         // (1) Original v14 triggers used `WHEN NEW.kind IS NOT NULL AND NEW.kind NOT IN (...)`.
         //     A direct INSERT/UPDATE setting kind=NULL bypassed the CHECK substitute. Replace

package/dist/db/migrations/v16.js

@@ -2,9 +2,8 @@ import { tableHasColumn } from '../tables.js';
 export const v16 = {
     version: 16,
     up: (db) => {
-        // A5 stub auth: add tenant_id to all data tables. Single-tenant per deployment;
-        // multi-tenant enforcement deferred to v2 (full A5). The columns are needed now
-        // so future B-track tables don't have to backfill.
+        // Stub auth: add tenant_id to all data tables. Single-tenant per deployment for now;
+        // the columns land early so later tables don't have to backfill.
         if (!tableHasColumn(db, 'memories', 'tenant_id')) {
             db.exec(`ALTER TABLE memories ADD COLUMN tenant_id TEXT NOT NULL DEFAULT 'default'`);
         }
@@ -26,7 +25,7 @@ export const v16 = {
         db.exec(`CREATE INDEX IF NOT EXISTS idx_working_memory_tenant ON working_memory(tenant_id, importance DESC, created_at DESC)`);
         db.exec(`CREATE INDEX IF NOT EXISTS idx_consolidation_runs_tenant_ts ON consolidation_runs(tenant_id, timestamp DESC)`);
         db.exec(`CREATE INDEX IF NOT EXISTS idx_task_snapshots_tenant_status ON task_snapshots(tenant_id, status, updated_at DESC)`);
-        // A5 stub auth: api_keys (scrypt-hashed; plaintext returned to caller exactly once)
+        // Stub auth: api_keys (scrypt-hashed; plaintext returned to caller exactly once)
         // and audit_log (append-only mutation trail). Both carry tenant_id from day 1 so
         // future multi-tenant enforcement is a config flip, not a re-migration.
         db.exec(`

package/dist/db/migrations/v17.js

@@ -1,8 +1,7 @@
 export const v17 = {
     version: 17,
     up: (db) => {
-        // E1.3 Slack ingestion: idempotency log, per-channel backfill cursors, DLQ.
-        // See docs/plans/2026-04-29-e1.3-slack-ingestion.md.
+        // Slack ingestion: idempotency log, per-channel backfill cursors, DLQ.
         db.exec(`
         CREATE TABLE IF NOT EXISTS slack_event_log (
           event_id TEXT PRIMARY KEY,
@@ -31,7 +30,7 @@ export const v17 = {
         )
       `);
         db.exec(`CREATE INDEX IF NOT EXISTS idx_slack_dlq_tenant_received ON slack_dlq(tenant_id, received_at)`);
-        // Multi-tenant routing seam (review patch #6). Empty by default — single-
+        // Multi-tenant routing seam. Empty by default: single-
         // tenant deployments resolve via HIPPO_TENANT fallback. Multi-workspace
         // deployments populate this table to map team_id → tenant_id.
         db.exec(`

package/dist/db/migrations/v19.js

@@ -2,7 +2,7 @@ import { tableHasColumn } from '../tables.js';
 export const v19 = {
     version: 19,
     up: (db) => {
-        // v0.39 commit 3 (Slack hardening): widen slack_dlq with bucketing,
+        // Slack hardening: widen slack_dlq with bucketing,
         // retry tracking, and the signature/timestamp pair that lets `hippo
         // slack dlq replay` re-verify before re-running ingest. ALTER ADD
         // COLUMN with DEFAULT is non-destructive — legacy rows take the

package/dist/db/migrations/v20.js

@@ -1,7 +1,7 @@
 export const v20 = {
     version: 20,
     up: (db) => {
-        // v0.39 commit 4 (GDPR Path A backfill): redact every existing
+        // GDPR Path A backfill: redact every existing
         // raw_archive.payload_json so historical archives match the new
         // metadata-only contract from src/raw-archive.ts. Read each row, parse
         // the existing JSON to extract tenant_id and kind (best effort), then

package/dist/db/migrations/v21.js

@@ -2,12 +2,8 @@ import { tableHasColumn } from '../tables.js';
 export const v21 = {
     version: 21,
     up: (db) => {
-        // v0.39 codex round 3: per-row mirror cleanup tracking. Replaces the
-        // global gdpr_v20_mirror_cleanup meta gate (which made the reaper
-        // one-shot and silently swallowed failed unlinks). With this column the
-        // reaper processes only rows WHERE mirror_cleaned_at IS NULL, sets the
-        // timestamp on success, and leaves it NULL on any unlink failure so the
-        // next openHippoDb retries automatically.
+        // Per-row mirror cleanup tracking: a failed unlink leaves mirror_cleaned_at NULL so the
+        // next openHippoDb retries it, where a one-shot global gate swallowed the failure.
         if (!tableHasColumn(db, 'raw_archive', 'mirror_cleaned_at')) {
             db.exec(`ALTER TABLE raw_archive ADD COLUMN mirror_cleaned_at TEXT`);
         }

package/dist/db/migrations/v22.js

@@ -2,10 +2,8 @@ import { tableHasColumn } from '../tables.js';
 export const v22 = {
     version: 22,
     up: (db) => {
-        // Tenant-isolation gap on continuity tables (codex review 2026-05-02).
-        // session_events and session_handoffs predate the v16 tenant migration
-        // and were never added to it, so the v0.40.0 provenance gate work
-        // exposed a real cross-tenant leak when continuity primitives are used.
+        // session_events and session_handoffs predate the v16 tenant migration and were
+        // never added to it: a cross-tenant leak whenever continuity primitives are used.
         // Adds tenant_id (NOT NULL DEFAULT 'default') with smart backfill from
         // task_snapshots.session_id when unambiguous, plus an optional scope
         // column so a private-channel-derived handoff can default-deny via the

package/dist/db/migrations/v23.js

@@ -22,7 +22,7 @@ export const v23 = {
         if (!tableHasColumn(db, 'task_snapshots', 'scope')) {
             db.exec(`ALTER TABLE task_snapshots ADD COLUMN scope TEXT`);
         }
-        // Quarantine policy (codex round 1 P1): pre-existing continuity rows
+        // Quarantine policy: pre-existing continuity rows
         // with NULL scope cannot be safely classified as public after the fact.
         // Mark them 'unknown:legacy' so the api.recall + cmdRecall default-deny
         // filter excludes them for no-scope callers. Fresh rows from new

package/dist/db/migrations/v24.js

@@ -1,7 +1,7 @@
 export const v24 = {
     version: 24,
     up: (db) => {
-        // v1.3.0 GitHub connector schema (codex round 1, 2026-05-04).
+        // GitHub connector schema.
         // Six tables + a min_compatible_binary meta row for rollback safety.
         db.exec(`
         CREATE TABLE IF NOT EXISTS github_event_log (
@@ -50,7 +50,7 @@ export const v24 = {
           added_at TEXT NOT NULL
         )
       `);
-        // PAT-mode multi-tenant routing (codex P0 #4). Maps repo_full_name to
+        // PAT-mode multi-tenant routing. Maps repo_full_name to
         // tenant when the webhook envelope has no `installation` field. Composite
         // PK so the same repo can intentionally be visible to multiple tenants
         // (e.g., shared tooling accounts) — collision is on (repo, tenant) pair.
@@ -62,10 +62,8 @@ export const v24 = {
           PRIMARY KEY (repo_full_name, tenant_id)
         )
       `);
-        // Rollback-safety guard (codex P0 #2). Any binary < 1.2.1 lacks the
-        // generic *:private:* default-deny and would leak github:private:* rows
-        // if it opened this DB. The startup guard in v1.2.1+ refuses to open a
-        // DB whose min_compatible_binary is newer than its own version.
+        // Rollback-safety guard: an older binary lacks the *:private:* default-deny and would leak
+        // github:private:* rows; the startup guard refuses a DB whose min_compatible_binary is newer.
         db.prepare(`INSERT INTO meta(key, value) VALUES('min_compatible_binary', ?) ON CONFLICT(key) DO UPDATE SET value=excluded.value`).run('1.2.1');
     },
 };

package/dist/db/migrations/v25.js

@@ -2,12 +2,11 @@ import { tableHasColumn } from '../tables.js';
 export const v25 = {
     version: 25,
     up: (db) => {
-        // v1.5.0 DAG-aware recall — cache summary metadata so the assembler can
+        // DAG-aware recall: cache summary metadata so the assembler can
         // reason about scope without re-walking the DAG. Three additive,
         // optional columns. No min_compatible_binary bump: these columns are
         // pure metadata; older binaries opening this DB will see them as NULL
-        // / 0 and behave as before. See docs/plans/2026-05-05-dag-recall.md
-        // Task 1.
+        // / 0 and behave as before.
         if (!tableHasColumn(db, 'memories', 'descendant_count')) {
             db.exec(`ALTER TABLE memories ADD COLUMN descendant_count INTEGER NOT NULL DEFAULT 0`);
         }