hippo-memory 1.61.0 → 1.63.0

package/dist/db/migrations/v26.js

@@ -2,14 +2,14 @@ import { tableHasColumn, tableExists } from '../tables.js';
 export const v26 = {
     version: 26,
     up: (db) => {
-        // v1.12.0 A5 v2 sub-1: add role column to api_keys for the admin/member
+        // Add role column to api_keys for the admin/member
         // distinction that gates /v1/sleep. Additive — existing keys backfill to
         // 'admin' via DEFAULT (single-tenant operator = admin by definition).
-        // No min_compatible_binary bump: old binaries (v1.11.x) ignore the
+        // No min_compatible_binary bump: old binaries ignore the
         // column on SELECTs that don't name it; new binaries on old data run
         // this migration at openHippoDb time before any createApiKey call.
         //
-        // v1.12.7 defensive: also guard on tableExists. If a DB landed in the
+        // Defensive: also guard on tableExists. If a DB landed in the
         // partial-v16-state (api_keys table missing despite schema_version >= 16),
         // running ALTER TABLE here would crash and block all later migrations.
         // The v27 heal below recreates api_keys with the role column already

package/dist/db/migrations/v27.js

@@ -2,16 +2,8 @@ import { tableHasColumn, tableExists } from '../tables.js';
 export const v27 = {
     version: 27,
     up: (db) => {
-        // v1.12.7 self-heal — re-assert the v16 schema (api_keys + audit_log).
-        //
-        // Surfaced 2026-05-24 on Keith's ~/.hippo/hippo.db: schema_version
-        // recorded as 25 but api_keys and audit_log tables were missing from
-        // migration v16. Root cause unknown — the migration runner has wrapped
-        // each migration in BEGIN/COMMIT since the first SQLite commit, so
-        // atomicity isn't the bug. Possible causes: DROP TABLE post-migration,
-        // SQL import / restore from a pre-v16 backup over a v16+ schema_version,
-        // or some edge case the wrapping doesn't catch. Cause may be operator
-        // action; either way the practical fix is the same.
+        // Self-heal: re-assert the v16 schema (api_keys + audit_log) on stores stamped past
+        // v16 whose tables are missing anyway (a dropped table or an old-backup restore).
         //
         // All CREATE IF NOT EXISTS — zero-cost no-op for users without the
         // bug, fixes anyone who has it. Includes the role column from the

package/dist/db/migrations/v28.js

@@ -2,16 +2,13 @@ import { tableHasColumn } from '../tables.js';
 export const v28 = {
     version: 28,
     up: (db) => {
-        // E1 of 5-episode DAG live-coupling arc (docs/plans/2026-05-25-dag-e1-schema-v28.md).
-        // Adds dirty-flag persistence for the existing DAG layer's level-2
-        // summaries so E2 (child-write propagation) and E3 (sleep-cycle
-        // rebuild) have somewhere to write + read the staleness signal. Adds
-        // dag_level_3_built_at as a column (Keith Q5 pick: lets E5 entity-
-        // profile build path land without a second migration).
+        // Dirty-flag persistence for level-2 DAG summaries, so child-write propagation and the
+        // sleep-cycle rebuild can write + read the staleness signal. dag_level_3_built_at lands
+        // now so the entity-profile build path needs no second migration.
         //
         // All columns are additive + DEFAULTed/nullable, so backfill is
         // automatic for existing rows. No min_compatible_binary bump: old
-        // binaries (v1.12.x) ignore the columns on SELECTs that don't name
+        // binaries ignore the columns on SELECTs that don't name
         // them; new binaries on old data hit this migration at openHippoDb
         // time before any DAG path touches summary_dirty.
         //
@@ -29,7 +26,7 @@ export const v28 = {
             db.exec(`ALTER TABLE memories ADD COLUMN rebuild_count INTEGER NOT NULL DEFAULT 0`);
         }
         if (!tableHasColumn(db, 'memories', 'dag_level_3_built_at')) {
-            // Reserved for E5: buildEntityProfiles will set this on level-3
+            // buildEntityProfiles sets this on level-3
             // rows when they're created. Always NULL for level 0/1/2 rows.
             db.exec(`ALTER TABLE memories ADD COLUMN dag_level_3_built_at TEXT`);
         }

package/dist/db/migrations/v29.js

@@ -2,9 +2,8 @@ import { tableExists } from '../tables.js';
 export const v29 = {
     version: 29,
     up: (db) => {
-        // E2 prediction first-class object (docs/plans/2026-05-26-e2-prediction-object.md).
-        // Adds a canonical predictions table for J3 reference-class /
-        // planning-fallacy detector (a follow-up episode). Predictions
+        // Prediction first-class object: a predictions table for the reference-class /
+        // planning-fallacy detector. Predictions
         // duplicate claim_text in the table itself so memory deletion
         // (forget/consolidate/archive) does not lose prediction data; FK
         // memory_id is NULLABLE with ON DELETE SET NULL.
@@ -16,7 +15,7 @@ export const v29 = {
         // FK target. Precedent: v14 memories.kind trigger pair at db.ts:298-322.
         //
         // CHECK constraint pins closure_state to (open|closed|closed-unknown).
-        // J3 computes accuracy (clean vs regressed) from (estimate_value,
+        // Accuracy (clean vs regressed) is computed from (estimate_value,
         // actual_value) at query time.
         if (!tableExists(db, 'predictions')) {
             db.exec(`

package/dist/db/migrations/v30.js

@@ -67,9 +67,9 @@ const TRG_DECISIONS_SUPERSEDE_TENANT_MATCH_UPDATE = `
 export const v30 = {
     version: 30,
     up: (db) => {
-        // E2 decision first-class object (docs/plans/2026-05-28-e2-decision-object.md).
+        // Decision first-class object.
         // Promotes `hippo decide` from a tagged memory (which decayed on a 90-day
-        // half-life even while the decision was still in force) to a canonical
+        // half-life even while the decision was still in force) to a dedicated
         // decisions table that is the source of truth. The memory mirror is kept
         // for recall but is no longer authoritative; memory_id is NULLABLE with
         // ON DELETE SET NULL so forget/consolidate/archive does not lose a

package/dist/db/migrations/v31.js

@@ -2,7 +2,7 @@ import { tableExists } from '../tables.js';
 export const v31 = {
     version: 31,
     up: (db) => {
-        // E2 incident first-class object (docs/plans/2026-05-29-e2-incident-object.md).
+        // Incident first-class object.
         // Mirrors the v30 decisions block but for an open -> resolved -> closed
         // lifecycle (NOT supersede): there is no superseded_by self-FK and no
         // supersede trigger. An incident is a postmortem capsule: a recorded

package/dist/db/migrations/v32.js

@@ -71,7 +71,7 @@ const TRG_PROCESSES_SUPERSEDE_TENANT_MATCH_UPDATE = `
 export const v32 = {
     version: 32,
     up: (db) => {
-        // E2 process first-class object (docs/plans/2026-05-29-e2-process-object.md).
+        // Process first-class object.
         // A process is a "living process map": a named, ordered list of steps that
         // evolves. Unlike incident (open->resolved->closed, no supersede), process
         // REUSES the v30 decisions supersede path as its delta mechanism: a process

package/dist/db/migrations/v33.js

@@ -75,7 +75,7 @@ const TRG_POLICIES_SUPERSEDE_TENANT_MATCH_UPDATE = `
 export const v33 = {
     version: 33,
     up: (db) => {
-        // E2 policy first-class object (docs/plans/2026-05-30-e2-policy-object.md).
+        // Policy first-class object.
         // The "bi-temporal-first" object type: a named rule/statement that is in
         // force over an EFFECTIVE-TIME range (valid_from required, valid_to nullable
         // = open-ended) and evolves via the v32 processes supersede machinery
@@ -86,10 +86,10 @@ export const v33 = {
         // axis (the as-of query loadPoliciesAsOf); transaction-time is present via
         // created_at + the supersede chain's superseded_at (time-travel deferred).
         //
-        // All date inputs are normalized to canonical ISO-8601 datetime
+        // All date inputs are normalized to standard ISO-8601 datetime
         // (toISOString) at the store boundary before persist/compare, so the
         // fixed-width values sort lexically and the half-open [valid_from, valid_to)
-        // as-of comparison is correct (plan-eng-critic round-1 CRIT fix).
+        // as-of comparison is correct.
         if (!tableExists(db, 'policies')) {
             db.exec(POLICIES_TABLE);
             db.exec(IDX_POLICIES_TENANT_STATUS);

package/dist/db/migrations/v34.js

@@ -69,7 +69,7 @@ const TRG_SKILLS_SUPERSEDE_TENANT_MATCH_UPDATE = `
 export const v34 = {
     version: 34,
     up: (db) => {
-        // E2 skill first-class object (docs/plans/2026-05-30-e2-skill-object.md).
+        // Skill first-class object.
         // A skill is a reusable, agent-followable capability: an `instructions` body
         // + an optional `trigger_text` (when to apply), evolving via the v32
         // processes supersede machinery (superseded_by self-FK + supersede

package/dist/db/migrations/v35.js

@@ -72,8 +72,7 @@ const TRG_PROJECT_BRIEFS_SUPERSEDE_TENANT_MATCH_UPDATE = `
 export const v35 = {
     version: 35,
     up: (db) => {
-        // E2 project_brief first-class object
-        // (docs/plans/2026-05-30-e2-project-brief-object.md). A project_brief is the
+        // project_brief first-class object. A project_brief is the
         // living, repo-scoped summary of a repository's state: a `summary` body
         // scoped to a `repo`, evolving via the v34 skills supersede machinery
         // (superseded_by self-FK + supersede tenant-match trigger + version +
@@ -82,8 +81,8 @@ export const v35 = {
         // PLUS `summary` (the brief body). The distinguishing op (refreshBrief, in
         // src/project-briefs.ts) auto-assembles the summary from the repo's receipts
         // (memory rows tagged path:<repo>); it needs no schema support beyond `repo`.
-        // All column names were checked against SQLite reserved words (skill-episode
-        // lesson re: `trigger`): repo/summary/version/status/etc. are non-reserved.
+        // All column names were checked against SQLite reserved words:
+        // repo/summary/version/status/etc. are non-reserved.
         if (!tableExists(db, 'project_briefs')) {
             db.exec(PROJECT_BRIEFS_TABLE);
             db.exec(IDX_PROJECT_BRIEFS_TENANT_STATUS);

package/dist/db/migrations/v36.js

@@ -72,17 +72,16 @@ const TRG_CUSTOMER_NOTES_SUPERSEDE_TENANT_MATCH_UPDATE = `
 export const v36 = {
     version: 36,
     up: (db) => {
-        // E2 customer_note first-class object (the LAST E2 object)
-        // (docs/plans/2026-06-01-e2-customer-note-object.md). A customer_note is a
+        // customer_note first-class object. A customer_note is a
         // discrete note recorded against an account/customer entity, evolving via the
         // v35 project_briefs supersede machinery (superseded_by self-FK + supersede
         // tenant-match trigger + version + change_summary). This table = the v35
         // project_briefs table with repo/summary replaced by `customer` (the
         // entity-scoping dimension; a free-form account/customer id - the entities
-        // table is unbuilt E3.1, so a FK is deferred) PLUS `note` (the note body).
+        // table is unbuilt, so a FK is deferred) PLUS `note` (the note body).
         // MANY notes per customer (each its own supersede chain), unlike the
         // one-summary-per-repo project_brief. All column names checked against SQLite
-        // reserved words (skill-episode lesson, codebase-audit rule 10): customer/note/
+        // reserved words: customer/note/
         // version/status/etc. are non-reserved.
         if (!tableExists(db, 'customer_notes')) {
             db.exec(CUSTOMER_NOTES_TABLE);

package/dist/db/migrations/v37.js

@@ -139,7 +139,7 @@ const TRG_GRAPH_QUEUE_CONSOLIDATED_ONLY_UPDATE = `
             END;
           END
         `;
-// Reverse guard (codex-review-critic 2026-06-01, P1): the graph-table triggers
+// Reverse guard: the graph-table triggers
 // only fire on writes to the GRAPH tables. They do NOT fire when an
 // already-indexed memory is later mutated. So 'UPDATE memories SET kind=raw'
 // (or a tenant change) on a memory the graph references would silently leave
@@ -162,7 +162,7 @@ const TRG_MEMORIES_GRAPH_REFERENCED_GUARD = `
             SELECT RAISE(ABORT, 'cannot change the kind or tenant of a memory while the graph references it (E3.3 graph-on-consolidated guard); a graph-referenced memory is immutable in kind/tenant - rebuild/remove the graph rows first, or rebuild them after supersession');
           END
         `;
-// Reverse guard #2 (codex-review-critic 2026-06-01 retry, P2): an entity that is
+// Second reverse guard: an entity that is
 // a relation endpoint cannot be moved cross-tenant. The entity UPDATE trigger
 // validates the entity against its source memory, but an existing relation
 // pointing at the entity is NOT re-validated, so a raw 'UPDATE entities SET
@@ -181,7 +181,7 @@ const TRG_ENTITIES_NO_TENANT_MOVE_WHEN_REFERENCED = `
 export const v37 = {
     version: 37,
     up: (db) => {
-        // E3.3 graph-on-consolidated guard (docs/plans/2026-06-01-e3-graph-guard.md).
+        // Graph-on-consolidated guard.
         // The graph layer (entities + relations) sits ON TOP OF consolidated state and
         // must NEVER index the raw layer. The substrate: entities + relations +
         // graph_extraction_queue, each FK-ing to memories and guarded so they can only
@@ -192,8 +192,8 @@ export const v37 = {
         // is a BEFORE INSERT *and* BEFORE UPDATE trigger (the subquery-capable pattern
         // from the v30 decisions / predictions tenant-match triggers). Both INSERT and
         // UPDATE are guarded: an INSERT-only guard is bypassable via a raw SQL UPDATE
-        // that moves a row onto a raw memory (plan-eng-critic 2026-06-01). All column
-        // names checked vs SQL reserved words (rule 10): rel_type avoids REFERENCES.
+        // that moves a row onto a raw memory. All column
+        // names checked vs SQL reserved words: rel_type avoids REFERENCES.
         if (!tableExists(db, 'entities')) {
             db.exec(ENTITIES_TABLE);
             db.exec(`CREATE INDEX IF NOT EXISTS idx_entities_tenant ON entities(tenant_id)`);

package/dist/db/migrations/v38.js

@@ -38,7 +38,7 @@ const RELATIONS_TABLE = `
 //  - memory path (memory_id NOT NULL): source_kind == the FK'd memory's kind
 //    (raw / lying source_kind ABORT) AND tenant-match.
 //  - object path (memory_id NULL): the (type,id) points at an EXISTING same-tenant
-//    E2 row whose status is active|superseded (explicit 4-way CASE per table).
+//    object row whose status is active|superseded (explicit 4-way CASE per table).
 const TRG_ENTITIES_CONSOLIDATED_ONLY_INSERT = `
         CREATE TRIGGER IF NOT EXISTS trg_entities_consolidated_only_insert
         BEFORE INSERT ON entities
@@ -217,10 +217,9 @@ const TRG_ENTITIES_NO_TENANT_MOVE_WHEN_REFERENCED = `
 export const v38 = {
     version: 38,
     up: (db) => {
-        // E2-provenance: anchor graph entity/relation provenance to the authoritative E2
-        // object (decision/policy/customer-note/project-brief) instead of the decaying
-        // memory mirror (docs/plans/2026-06-03-graph-e2-provenance.md). An in-force E2
-        // object must STAY in the graph after its mirror memory is forgotten or
+        // Object provenance: anchor graph entity/relation provenance to the authoritative
+        // first-class object (decision/policy/customer-note/project-brief) instead of the
+        // decaying memory mirror. An in-force object must STAY in the graph after its mirror memory is forgotten or
         // consolidation-pruned. The graph is a PURE DERIVED CACHE (clearGraph + rebuild on
         // every `graph extract` / `sleep`), so v38 DROPs+recreates entities/relations (no
         // data copy) and the next extract repopulates. graph_extraction_queue is untouched.
@@ -229,7 +228,7 @@ export const v38 = {
         //  - memory path (memory_id NOT NULL): source_kind must equal the FK'd memory's live
         //    kind and that kind is distilled|superseded (raw still ABORTs) + tenant-match.
         //  - object path (memory_id NULL): source_object_type/id must reference an EXISTING
-        //    same-tenant E2 row whose status is active|superseded (not closed). E2 objects
+        //    same-tenant object row whose status is active|superseded (not closed). Such objects
         //    are consolidated BY CONSTRUCTION, so the no-raw invariant still holds.
         //  - all-null is rejected.
         //
@@ -243,9 +242,9 @@ export const v38 = {
         // by design (the object path is distilled-by-construction; source_kind is only
         // re-checked when memory_id NOT NULL).
         // source_object_id is a SOFT (type,id) pointer (no hard FK) the rebuild re-validates,
-        // so a legitimate E2 hard-delete is never blocked; a `closed` E2 row drops at next
+        // so a legitimate object hard-delete is never blocked; a `closed` object row drops at next
         // extract. SQLite cannot parametrize a table name in a trigger, so the object-path
-        // validation is an explicit 4-way CASE (one arm per E2 table).
+        // validation is an explicit 4-way CASE (one arm per object table).
         recreateGraphTables(db);
         createGraphGuards(db);
     },

package/dist/db/migrations/v39.js

@@ -6,7 +6,7 @@ import { tableHasColumn } from '../tables.js';
 export const v39 = {
     version: 39,
     up: (db, ctx) => {
-        // Memory scope isolation (docs/plans/2026-07-01-memory-scope-isolation.md).
+        // Memory scope isolation.
         // origin_project: '<name>' = owned by that project, '' = user-global,
         // NULL = legacy/unknown (ambient context treats NULL as deny).
         if (!tableHasColumn(db, 'memories', 'origin_project')) {

package/dist/db/migrations/v40.js

@@ -1,27 +1,15 @@
 export const v40 = {
     version: 40,
     up: (db) => {
-        // LC1 retrieval-trace persistence (docs/plans/2026-08-02-lc1-recall-trace-persistence.md).
+        // Retrieval-trace persistence.
         // Follows the v18 goal_recall_log style: one parent trace row per
         // recall, a WITHOUT ROWID child table for the ranked results, and a
         // separate append-only outcomes table so audit_log pruning can never
         // erase training data.
         //
-        // F6 (deliberate, not an oversight): unlike v39, this migration does
-        // NOT bump `min_compatible_binary`. A pre-v40 binary opening this DB
-        // ignores the three new tables and keeps writing `last_retrieval_ids`
-        // exactly as before — it never touches `last_trace_id` (that key
-        // simply stays whatever it was). recordTraceOutcome's F4 consumer-
-        // side validation (recall-trace.ts) makes any resulting staleness
-        // harmless to linkage: it re-validates the named trace's tenant AND
-        // intersects credited ids against the trace's OWN result set before
-        // inserting, so a stale/mismatched trace id from an old-binary write
-        // gets silently skipped rather than mislinked. That preserves the
-        // plan's "drop the three tables + last_trace_id restores v39 behavior
-        // exactly" rollback promise — a min_compatible_binary bump would
-        // additionally lock old binaries out of the WHOLE store for what is
-        // purely an observability/training feature, which the rollback
-        // promise does not require.
+        // No min_compatible_binary bump, on purpose: an old binary ignores these tables and
+        // recordTraceOutcome re-validates trace ids, so its stale writes are skipped; a bump
+        // would lock old binaries out of the whole store for an observability feature.
         db.exec(`
         CREATE TABLE IF NOT EXISTS recall_traces (
           id INTEGER PRIMARY KEY AUTOINCREMENT,

package/dist/db/migrations/v41.js

@@ -1,7 +1,7 @@
 export const v41 = {
     version: 41,
     up: (db) => {
-        // AT1 rejected-value tombstone (docs/plans/2026-08-15-at1-rejected-value-tombstone.md).
+        // Rejected-value tombstone.
         // Additive table, template = v40 above. A human who rejects a fact gets
         // a durable say: the write-path guard in upsertEntryRow refuses any
         // write that would re-introduce a value whose normalized digest
@@ -17,11 +17,10 @@ export const v41 = {
         // No FK on source_memory_id (v40 precedent above: tombstone outlives
         // the row it was sourced from) — provenance only.
         //
-        // Reserved-word check on column names (skill-episode lesson, rule 10):
+        // Reserved-word check on column names:
         // tenant/digest/reason/rejected/source/normalized/chars are non-reserved.
         //
-        // No min_compatible_binary bump — a deliberate tradeoff (plan §2,
-        // flagged to the ship gate). An old binary sharing a synced store
+        // No min_compatible_binary bump, a deliberate tradeoff: an old binary sharing a synced store
         // writes WITHOUT the guard until upgraded; documented in
         // MEMORY_ENVELOPE.md rather than hard-locking every old binary out of
         // the store, which is disproportionate for the dominant single-user

package/dist/db/migrations/v42.js

@@ -2,9 +2,8 @@ import { tableHasColumn } from '../tables.js';
 export const v42 = {
     version: 42,
     up: (db) => {
-        // W1 handoff envelope (trajectories/01M2BQTM4AGFVMYY7G2XV5G7WY/plan.md).
-        // Five nullable columns so the envelope carries evidence and outcome
-        // and W2/W5 can filter on them without parsing JSON.
+        // Handoff envelope: five nullable columns so the envelope carries evidence and
+        // outcome and readers can filter on them without parsing JSON.
         if (!tableHasColumn(db, 'session_handoffs', 'constraints_json')) {
             db.exec(`ALTER TABLE session_handoffs ADD COLUMN constraints_json TEXT`);
         }
@@ -13,7 +12,7 @@ export const v42 = {
         }
         if (!tableHasColumn(db, 'session_handoffs', 'outcome')) {
             db.exec(`ALTER TABLE session_handoffs ADD COLUMN outcome TEXT`);
-            // codex P2: backfill from session_complete so pre-existing handoffs don't
+            // Backfill from session_complete so pre-existing handoffs don't
             // all read as unfinished and get injected by the new 72h ambient fallback.
             db.exec(`
           UPDATE session_handoffs SET outcome = (

package/dist/db/migrations/v45.js

@@ -1,7 +1,7 @@
 export const v45 = {
     version: 45,
     up: (db) => {
-        // Token ledger (src/token-ledger.ts, ROADMAP TE0): one row per block of
+        // Token ledger (src/token-ledger.ts): one row per block of
         // memory text hippo hands an agent (hook, CLI, MCP, HTTP). `event` is 'inject'
         // (sent), 'skip' (unchanged since the session's last inject, not sent), 'reset'
         // (compaction dropped earlier injections, so the next one must be sent) or

package/dist/db/migrations/v46.js

@@ -1,7 +1,7 @@
 export const v46 = {
     version: 46,
     up: (db) => {
-        // CD13 failure log (src/failure-log.ts): hashes only, since failure text can carry paths and secrets.
+        // Failure log (src/failure-log.ts): hashes only, since failure text can carry paths and secrets.
         // Additive only: no min_compatible_binary bump.
         db.exec(`
         CREATE TABLE IF NOT EXISTS failure_log (

package/dist/db/migrations/v47.js

@@ -1,7 +1,7 @@
 export const v47 = {
     version: 47,
     up: (db) => {
-        // Scope grants (src/auth.ts, ROADMAP EI2): a member key reads a
+        // Scope grants (src/auth.ts): a member key reads a
         // restricted scope only by an explicit row here. Additive only: no
         // min_compatible_binary bump.
         db.exec(`

package/dist/db/migrations/v48.js

@@ -2,7 +2,7 @@ import { MEMORY_QUARANTINE_DDL } from '../continuity.js';
 export const v48 = {
     version: 48,
     up: (db) => {
-        // Quarantine (src/quarantine.ts, CD5): a poisoned or suspect memory sits here pending
+        // Quarantine (src/quarantine.ts): a poisoned or suspect memory sits here pending
         // admin review instead of being hidden with no record. Additive only: no min_compatible_binary bump.
         db.exec(MEMORY_QUARANTINE_DDL);
     },

package/dist/decisions.d.ts

@@ -1,5 +1,5 @@
 /**
- * E2 decision first-class object (docs/plans/2026-05-28-e2-decision-object.md).
+ * Decision first-class object.
  *
  * `hippo decide` used to write only a tagged memory (tags ['decision'], source
  * 'decision') with a 90-day half-life, so an in-force decision decayed out of
@@ -16,7 +16,7 @@
  * Tenant scoping: every helper requires tenantId. BEFORE INSERT/UPDATE triggers
  * enforce decisions.tenant_id == the referenced memory's tenant_id, and a
  * superseded_by same-tenant trigger makes cross-tenant supersession
- * unrepresentable. Mirrors the v0.31 predictions pattern (src/predictions.ts).
+ * unrepresentable. Mirrors the predictions pattern (src/predictions.ts).
  *
  * Dual-write atomicity: `saveDecision` writes the memory + decisions row (and,
  * when superseding, the old row's UPDATE) inside writeEntry's SAVEPOINT