hippo-memory 1.61.0 → 1.63.0

package/dist/store/search-rows.d.ts

@@ -1,29 +1,17 @@
 import type { MemoryEntry } from '../memory.js';
 import { type DatabaseSyncLike } from '../db.js';
 /**
- * v1.7.2 — recall-mode scope filter shape, exported so callers
- * (`loadRecallSearchEntries`) and tests can refer to it symbolically without
- * `Parameters<typeof loadSearchRows>[N]` indirection.
- *
- * Three modes:
- *   - 'default-deny' — exclude scopes in `RECALL_DEFAULT_DENY_SCOPES` (T2).
- *   - 'exact' — exact match on `m.scope = value` (api.recall's explicit-scope
- *     request semantics).
- *   - 'default-deny-or-exact' (v1.25.0) — the default-admitted set PLUS rows
- *     whose scope equals `value`. This is the CLI `--scope` semantics: the
- *     flag predates the envelope column as a TAG-boost ranking hint
- *     (`scope:<v>` tags, HIPPO_SCOPE), so an explicit flag must UNLOCK the
- *     named envelope scope in addition to the normal set rather than narrow
- *     the result to it — narrowing would return zero rows for every
- *     tag-scoped workflow (envelope scope NULL). Strictly safer than the
- *     pre-v1.25.0 CLI behavior (no filter at all): other private scopes and
- *     quarantine buckets stay denied.
+ * Recall-mode scope filter shape, exported so callers and tests can name it. Three modes:
+ *   - 'default-deny': exclude scopes in `RECALL_DEFAULT_DENY_SCOPES`.
+ *   - 'exact': exact match on `m.scope = value` (api.recall's explicit-scope request semantics).
+ *   - 'default-deny-or-exact': the default-admitted set PLUS rows whose scope equals `value` (CLI `--scope`).
+ *     The flag began as a tag-boost hint, so narrowing would return zero rows for tag-scoped workflows.
  *
  * Background pipelines (`consolidate`, `embeddings`, `refine-llm`, ...) call
  * `loadSearchEntries` (no scopeFilter arg) and see all rows including
  * quarantine.
  */
-/** @internal v1.7.2 — internal SQL-builder shape; not on the public API
+/** @internal Internal SQL-builder shape; not on the public API
  *  surface (not re-exported from `src/index.ts`). Subject to change. */
 export type RecallScopeFilter = {
     mode: 'default-deny';
@@ -34,6 +22,8 @@ export type RecallScopeFilter = {
     mode: 'default-deny-or-exact';
     value: string;
 };
+/** One project name, or every name a project's rows carry. */
+export type OriginFilter = string | readonly string[];
 /** Scope rule for recall: none requested is default-deny; 'exact' narrows to the request; 'additive' adds it to the default set. */
 export declare function recallScopeFilter(requestedScope: string | undefined, mode: 'exact' | 'additive'): RecallScopeFilter;
 /**
@@ -45,31 +35,24 @@ export declare function recallScopeFilter(requestedScope: string | undefined, mo
  */
 export declare function loadSearchEntries(hippoRoot: string, query: string, limit?: number, tenantId?: string): MemoryEntry[];
 /**
- * v1.7.1 — recall-mode loader. Pushes the recall-side scope predicate into
- * SQL so `unknown:legacy` cannot leak via any consumer that hasn't remembered
- * to re-filter (root-cause-over-patches: codex flagged this on v1.6.5 review).
+ * Recall-mode loader. Pushes the recall-side scope predicate into SQL so
+ * `unknown:legacy` cannot leak via any consumer that hasn't remembered to re-filter.
  *
  * - `requestedScope` undefined / '': default-deny on `unknown:legacy`.
  * - `requestedScope` non-empty string: exact match on `m.scope = requestedScope`.
  *
- * Private-scope (`<source>:private:*`) exclusion: SQL applies a conservative
- * pre-window approximation (`NOT LIKE '%:private:%'`, v1.25.0 — codex P2:
- * post-window-only filtering let private rows starve admitted candidates out
- * of the LIMIT window); the exact anchored regex
- * (`passesScopeFilterForRecall`) remains the authoritative JS post-filter in
- * the recall consumers.
+ * Private scopes: SQL applies a conservative `NOT LIKE '%:private:%'` before the LIMIT window so private
+ * rows cannot starve admitted ones; `passesScopeFilterForRecall` stays the exact JS post-filter.
  *
- * Consumers: `api.recall` (v1.7.1+), `cmdRecall`/`cmdExplain` direct CLI paths
- * and `searchBothHybrid` recall mode (v1.25.0). Background pipelines
+ * Consumers: `api.recall`, `cmdRecall`/`cmdExplain` direct CLI paths
+ * and `searchBothHybrid` recall mode. Background pipelines
  * (`consolidate`, `embeddings`, `refine-llm`, ...) keep using
  * `loadSearchEntries` so they can see quarantined rows when needed.
  *
- * `tenantId` widened to optional in v1.25.0 for the searchBothHybrid recall
- * mode (its `tenantId` option is optional); `loadSearchRows` already treats
- * undefined as "no tenant filter" for legacy callers.
+ * `tenantId` is optional because searchBothHybrid's is; undefined means no tenant filter.
  */
-export declare function loadRecallSearchEntries(hippoRoot: string, query: string, limit?: number, tenantId?: string, requestedScope?: string, explicitScopeMode?: 'exact' | 'additive', includeSuperseded?: boolean): MemoryEntry[];
-export declare function loadRecallSearchEntriesFromDb(db: DatabaseSyncLike, query: string, limit?: number, tenantId?: string, requestedScope?: string, explicitScopeMode?: 'exact' | 'additive', includeSuperseded?: boolean): MemoryEntry[];
+export declare function loadRecallSearchEntries(hippoRoot: string, query: string, limit?: number, tenantId?: string, requestedScope?: string, explicitScopeMode?: 'exact' | 'additive', includeSuperseded?: boolean, originProjects?: OriginFilter): MemoryEntry[];
+export declare function loadRecallSearchEntriesFromDb(db: DatabaseSyncLike, query: string, limit?: number, tenantId?: string, requestedScope?: string, explicitScopeMode?: 'exact' | 'additive', includeSuperseded?: boolean, originProjects?: OriginFilter): MemoryEntry[];
 /** Which rows the vector arm of hybrid search may add: the same tenant, scope and superseded rules as the lexical load. */
 export interface VectorCandidateSpec {
     tenantId?: string;

package/dist/store/search-rows.js

@@ -4,9 +4,11 @@ import { tokenize } from '../tokenize.js';
 import { RECALL_DEFAULT_DENY_SCOPES } from '../recall-scope.js';
 import { RAREST_TERM_COUNT, rarestPromptTerms } from '../prompt-recall.js';
 import { log } from '../log.js';
+import { originInSql } from '../project-identity.js';
 import { topVectorMatches } from '../vector-store.js';
 import { MEMORY_SELECT_COLUMNS, MEMORY_SEARCH_COLUMNS, DEFAULT_SEARCH_CANDIDATE_LIMIT, rowToEntry, } from './rows.js';
 import { openStore } from './open.js';
+import { escapeLike } from '../escape.js';
 /** The recall scope rule for a table column prefix (`m.` or none); `passesScopeFilterForRecall` in recall-scope.ts is its JS twin. */
 function recallScopeClause(col, scopeFilter) {
     if (scopeFilter === undefined)
@@ -22,6 +24,14 @@ function recallScopeClause(col, scopeFilter) {
     // The trailing arm keeps a deliberately requested scope loadable, private or quarantined included.
     return { sql: ` AND (${admitted} OR ${col}scope = ?)`, params: [...RECALL_DEFAULT_DENY_SCOPES, scopeFilter.value] };
 }
+// In SQL, not after the window cut, so other projects' matches cannot crowd the project's own rows out of the LIMIT.
+function withProject(scope, col, origin) {
+    if (origin === undefined)
+        return scope;
+    // A string is the shape published callers passed before a project could carry several names.
+    const originProjects = [origin].flat();
+    return { sql: `${scope.sql} AND (${col}origin_project = '' OR ${originInSql(originProjects, `${col}origin_project`)})`, params: [...scope.params, ...originProjects] };
+}
 /** Scope rule for recall: none requested is default-deny; 'exact' narrows to the request; 'additive' adds it to the default set. */
 export function recallScopeFilter(requestedScope, mode) {
     if (!requestedScope)
@@ -29,22 +39,15 @@ export function recallScopeFilter(requestedScope, mode) {
     return mode === 'additive' ? { mode: 'default-deny-or-exact', value: requestedScope } : { mode: 'exact', value: requestedScope };
 }
 const FTS_QUERY_SYNTAX_RE = /fts5: syntax error|unterminated string/i;
-function loadSearchRows(db, query, limit, tenantId, scopeFilter, includeSuperseded = true) {
-    const p = searchPredicates(tenantId, scopeFilter, includeSuperseded);
+function loadSearchRows(db, query, limit, tenantId, scopeFilter, includeSuperseded = true, originProjects) {
+    const p = searchPredicates(tenantId, scopeFilter, includeSuperseded, originProjects);
     const terms = Array.from(new Set(tokenize(query)));
     if (terms.length === 0) {
-        // F3 (v1.7.0) self-review: empty-query path is the second uncapped
-        // path (codex diff-pass caught the full-store fallback at the bottom;
-        // this no-terms path had the same shape). Apply LIMIT so all four
-        // candidate paths honour the caller's cap when set.
+        // LIMIT here too, so every candidate path honours the caller's cap.
         return selectAllCandidates(db, p, limit);
     }
-    // v1.7.1 — test/diagnostic hook: `HIPPO_FORCE_LIKE_PATH=1` forces the
-    // LIKE-fallback path here only. Gated at the read-call site so writes
-    // (`syncFtsRow`, `deleteFtsRow`, `raw-archive.ts::archiveRaw`) keep using
-    // `isFtsAvailable` honestly and never silently skip FTS index sync.
-    // Lets tests exercise the LIKE branch deterministically without
-    // poisoning the on-disk FTS state.
+    // `HIPPO_FORCE_LIKE_PATH=1` forces the LIKE path for tests; gated at this read site so
+    // writes keep using `isFtsAvailable` and never silently skip FTS index sync.
     const forceLikePath = envForceLikePath();
     if (!forceLikePath && isFtsAvailable(db)) {
         const rows = selectFtsCandidates(db, terms, p, limit);
@@ -54,14 +57,11 @@ function loadSearchRows(db, query, limit, tenantId, scopeFilter, includeSupersed
     const rows = selectLikeCandidates(db, terms, p, limit);
     if (rows.length > 0)
         return rows;
-    // F3 (v1.7.0) codex P1: pre-v1.7.0 the full-store fallback ignored
-    // `limit` and could return the whole tenant store. With scorerWindow
-    // now reported on RecallResult, an unbounded fallback would lie about
-    // candidate-pool size. Apply LIMIT here so all four paths honour the
-    // caller's cap.
+    // LIMIT the full-store fallback too: RecallResult reports the scorer window, so an
+    // unbounded fallback would misstate the candidate-pool size.
     return selectAllCandidates(db, p, limit);
 }
-function searchPredicates(tenantId, scopeFilter, includeSuperseded) {
+function searchPredicates(tenantId, scopeFilter, includeSuperseded, originProjects) {
     // tenantId undefined = no tenant filter (legacy callers / cross-deployment
     // helpers). tenantId set = strict tenant isolation, leveraging the composite
     // idx_memories_tenant_created (leading column tenant_id, O(log n) lookup).
@@ -69,19 +69,8 @@ function searchPredicates(tenantId, scopeFilter, includeSuperseded) {
     const tenantPredicateNoAlias = tenantId !== undefined ? ` AND tenant_id = ?` : '';
     const tenantOnlyPredicate = tenantId !== undefined ? ` WHERE tenant_id = ?` : '';
     const tenantParams = tenantId !== undefined ? [tenantId] : [];
-    // v1.12.6 — belt-and-suspenders against `kind='archived'` leaking into recall.
-    // `kind='archived'` is a transient sentinel inside `archiveRawMemory`'s
-    // SAVEPOINT (src/raw-archive.ts:56): UPDATE kind = 'archived' immediately
-    // followed by DELETE, both inside one savepoint that commits or rolls back
-    // atomically. SQLite atomicity guarantees no concurrent reader sees the
-    // intermediate state. This filter is defensive-only against:
-    //   (a) future bugs that drop the SAVEPOINT,
-    //   (b) future bugs that introduce kind='archived' as a persisted state,
-    //   (c) external direct-SQL writes that bypass archiveRawMemory.
-    // tenantOnlyPredicate starts with " WHERE tenant_id = ?" when tenant is set;
-    // when unset, we have no WHERE yet, so the archived clause needs both AND
-    // and WHERE forms. The "tenant-only" path always has WHERE (from tenant or
-    // we synthesize one).
+    // Defensive: kind='archived' is a transient sentinel inside archiveRawMemory's SAVEPOINT, so this only
+    // guards against a dropped SAVEPOINT, a persisted 'archived' state, or direct-SQL writes.
     const archivedClauseAlias = ` AND m.kind != 'archived'`;
     const archivedClauseNoAlias = ` AND kind != 'archived'`;
     // For the "tenant-only" path: if no tenant set, tenantOnlyPredicate is '',
@@ -89,8 +78,8 @@ function searchPredicates(tenantId, scopeFilter, includeSuperseded) {
     // by always joining `tenantOnlyPredicate + archivedClauseTenantOnly` where
     // the latter switches between " AND" and " WHERE" based on caller context.
     const archivedClauseTenantOnly = tenantId !== undefined ? ` AND kind != 'archived'` : ` WHERE kind != 'archived'`;
-    const aliasScope = recallScopeClause('m.', scopeFilter);
-    const plainScope = recallScopeClause('', scopeFilter);
+    const aliasScope = withProject(recallScopeClause('m.', scopeFilter), 'm.', originProjects);
+    const plainScope = withProject(recallScopeClause('', scopeFilter), '', originProjects);
     const scopeParams = aliasScope.params;
     const currentAlias = includeSuperseded ? '' : ' AND m.superseded_by IS NULL';
     const currentNoAlias = includeSuperseded ? '' : ' AND superseded_by IS NULL';
@@ -114,9 +103,6 @@ function selectFtsCandidates(db, terms, p, limit) {
         // memories_fts virtual table has no tenant_id column; filter via the
         // joined memories row (cheap with idx_memories_tenant_created leading
         // on tenant_id).
-        // F1 (v1.7.0): MEMORY_SEARCH_COLUMNS adds bm25_score as the trailing
-        // result column. Every other column is m.<col> AS <col> so rowToEntry
-        // sees the same shape it always has.
         // SAFETY: MEMORY_SEARCH_COLUMNS aliases every column to the same name
         // MEMORY_SELECT_COLUMNS uses (plus bm25_score), matching MemoryRow.
         return db.prepare(`
@@ -137,7 +123,6 @@ function selectFtsCandidates(db, terms, p, limit) {
     }
 }
 function selectLikeCandidates(db, terms, p, limit) {
-    const escapeLike = (term) => term.replace(/[%_\\]/g, '\\$&');
     const where = terms.map(() => `(LOWER(content) LIKE ? ESCAPE '\\' OR LOWER(tags_json) LIKE ? ESCAPE '\\')`).join(' OR ');
     const params = terms.flatMap((term) => {
         const like = `%${escapeLike(term)}%`;
@@ -170,42 +155,35 @@ export function loadSearchEntries(hippoRoot, query, limit = DEFAULT_SEARCH_CANDI
     }
 }
 /**
- * v1.7.1 — recall-mode loader. Pushes the recall-side scope predicate into
- * SQL so `unknown:legacy` cannot leak via any consumer that hasn't remembered
- * to re-filter (root-cause-over-patches: codex flagged this on v1.6.5 review).
+ * Recall-mode loader. Pushes the recall-side scope predicate into SQL so
+ * `unknown:legacy` cannot leak via any consumer that hasn't remembered to re-filter.
  *
  * - `requestedScope` undefined / '': default-deny on `unknown:legacy`.
  * - `requestedScope` non-empty string: exact match on `m.scope = requestedScope`.
  *
- * Private-scope (`<source>:private:*`) exclusion: SQL applies a conservative
- * pre-window approximation (`NOT LIKE '%:private:%'`, v1.25.0 — codex P2:
- * post-window-only filtering let private rows starve admitted candidates out
- * of the LIMIT window); the exact anchored regex
- * (`passesScopeFilterForRecall`) remains the authoritative JS post-filter in
- * the recall consumers.
+ * Private scopes: SQL applies a conservative `NOT LIKE '%:private:%'` before the LIMIT window so private
+ * rows cannot starve admitted ones; `passesScopeFilterForRecall` stays the exact JS post-filter.
  *
- * Consumers: `api.recall` (v1.7.1+), `cmdRecall`/`cmdExplain` direct CLI paths
- * and `searchBothHybrid` recall mode (v1.25.0). Background pipelines
+ * Consumers: `api.recall`, `cmdRecall`/`cmdExplain` direct CLI paths
+ * and `searchBothHybrid` recall mode. Background pipelines
  * (`consolidate`, `embeddings`, `refine-llm`, ...) keep using
  * `loadSearchEntries` so they can see quarantined rows when needed.
  *
- * `tenantId` widened to optional in v1.25.0 for the searchBothHybrid recall
- * mode (its `tenantId` option is optional); `loadSearchRows` already treats
- * undefined as "no tenant filter" for legacy callers.
+ * `tenantId` is optional because searchBothHybrid's is; undefined means no tenant filter.
  */
-export function loadRecallSearchEntries(hippoRoot, query, limit = DEFAULT_SEARCH_CANDIDATE_LIMIT, tenantId, requestedScope, explicitScopeMode = 'exact', includeSuperseded = true) {
+export function loadRecallSearchEntries(hippoRoot, query, limit = DEFAULT_SEARCH_CANDIDATE_LIMIT, tenantId, requestedScope, explicitScopeMode = 'exact', includeSuperseded = true, originProjects) {
     const db = openStore(hippoRoot);
     try {
-        return loadRecallSearchEntriesFromDb(db, query, limit, tenantId, requestedScope, explicitScopeMode, includeSuperseded);
+        return loadRecallSearchEntriesFromDb(db, query, limit, tenantId, requestedScope, explicitScopeMode, includeSuperseded, originProjects);
     }
     finally {
         closeHippoDb(db);
     }
 }
-// Split out so callers with an already-open db (Z1 prompt-recall path) skip
+// Split out so callers with an already-open db (the prompt-recall path) skip
 // the initStore+open/close cycle per store per call.
-export function loadRecallSearchEntriesFromDb(db, query, limit = DEFAULT_SEARCH_CANDIDATE_LIMIT, tenantId, requestedScope, explicitScopeMode = 'exact', includeSuperseded = true) {
-    return loadSearchRows(db, query, limit, tenantId, recallScopeFilter(requestedScope, explicitScopeMode), includeSuperseded).map(rowToEntry);
+export function loadRecallSearchEntriesFromDb(db, query, limit = DEFAULT_SEARCH_CANDIDATE_LIMIT, tenantId, requestedScope, explicitScopeMode = 'exact', includeSuperseded = true, originProjects) {
+    return loadSearchRows(db, query, limit, tenantId, recallScopeFilter(requestedScope, explicitScopeMode), includeSuperseded, originProjects).map(rowToEntry);
 }
 /** The rows nearest `queryVector` that pass `spec`, nearest first. */
 export function loadVectorCandidateEntries(hippoRoot, queryVector, spec) {

package/dist/store/sessions.d.ts

@@ -9,8 +9,7 @@ export declare function saveActiveTaskSnapshot(hippoRoot: string, tenantId: stri
 }): TaskSnapshot;
 export declare function loadActiveTaskSnapshot(hippoRoot: string, tenantId: string): TaskSnapshot | null;
 /**
- * Default freshness bound for AMBIENT active-task-snapshot reads (DF1,
- * docs/plans/2026-08-23-df1-snapshot-lifecycle.md): 72h, chosen over 48h so
+ * Default freshness bound for AMBIENT active-task-snapshot reads: 72h, chosen over 48h so
  * a Friday-evening orphan still offers continuity on Monday morning.
  * Exported so callers can override via `loadFreshActiveTaskSnapshot`'s
  * `opts.maxAgeMs`; deliberately no env knob (Simplicity First).
@@ -18,7 +17,7 @@ export declare function loadActiveTaskSnapshot(hippoRoot: string, tenantId: stri
 export declare const SNAPSHOT_AMBIENT_MAX_AGE_MS: number;
 /**
  * Bounded read for AMBIENT active-task-snapshot surfaces (UserPromptSubmit
- * hook context, MCP recall block) — the never-expires fix for DF1. A
+ * hook context, MCP recall block), so snapshots expire. A
  * snapshot written by `hippo pre-compact` has no death path tied to the
  * session that owns it, so an orphaned row would otherwise inject into
  * every prompt of every later session forever. Wraps `loadActiveTaskSnapshot`
@@ -45,8 +44,8 @@ export declare function loadFreshActiveTaskSnapshot(hippoRoot: string, tenantId:
 }): TaskSnapshot | null;
 export declare function clearActiveTaskSnapshot(hippoRoot: string, tenantId: string, clearedStatus?: string): boolean;
 /**
- * Close the `active` task snapshot(s) owned by `sessionId`, for the T3
- * session-end death path (DF1, docs/plans/2026-08-23-df1-snapshot-lifecycle.md).
+ * Close the `active` task snapshot(s) owned by `sessionId`, for the
+ * session-end death path.
  * Only one `active` row exists per tenant in practice (supersession happens
  * at save), but the WHERE clause scopes on `session_id` too — not just
  * `status='active' AND tenant_id=?` — so an ending session can never close a

package/dist/store/sessions.js

@@ -68,8 +68,7 @@ export function loadActiveTaskSnapshot(hippoRoot, tenantId) {
     }
 }
 /**
- * Default freshness bound for AMBIENT active-task-snapshot reads (DF1,
- * docs/plans/2026-08-23-df1-snapshot-lifecycle.md): 72h, chosen over 48h so
+ * Default freshness bound for AMBIENT active-task-snapshot reads: 72h, chosen over 48h so
  * a Friday-evening orphan still offers continuity on Monday morning.
  * Exported so callers can override via `loadFreshActiveTaskSnapshot`'s
  * `opts.maxAgeMs`; deliberately no env knob (Simplicity First).
@@ -83,7 +82,7 @@ function isNonEmptySessionId(value) {
 }
 /**
  * Bounded read for AMBIENT active-task-snapshot surfaces (UserPromptSubmit
- * hook context, MCP recall block) — the never-expires fix for DF1. A
+ * hook context, MCP recall block), so snapshots expire. A
  * snapshot written by `hippo pre-compact` has no death path tied to the
  * session that owns it, so an orphaned row would otherwise inject into
  * every prompt of every later session forever. Wraps `loadActiveTaskSnapshot`
@@ -138,8 +137,8 @@ export function clearActiveTaskSnapshot(hippoRoot, tenantId, clearedStatus = 'cl
     }
 }
 /**
- * Close the `active` task snapshot(s) owned by `sessionId`, for the T3
- * session-end death path (DF1, docs/plans/2026-08-23-df1-snapshot-lifecycle.md).
+ * Close the `active` task snapshot(s) owned by `sessionId`, for the
+ * session-end death path.
  * Only one `active` row exists per tenant in practice (supersession happens
  * at save), but the WHERE clause scopes on `session_id` too — not just
  * `status='active' AND tenant_id=?` — so an ending session can never close a
@@ -162,7 +161,7 @@ export function appendSessionEvent(hippoRoot, tenantId, event) {
     assertTenantId('appendSessionEvent', tenantId);
     const db = openStore(hippoRoot);
     const now = new Date().toISOString();
-    // v1.2: scope is wired through. Default-deny in api.recall + cmdRecall
+    // Scope is stored as given; default-deny in api.recall + cmdRecall
     // continuity reads applies to slack:private:* and 'unknown:legacy' rows.
     try {
         const result = db.prepare(`

package/dist/store/summaries.d.ts

@@ -1,7 +1,7 @@
 import type { MemoryEntry } from '../memory.js';
 /**
  * Load summaries flagged dirty for the given tenant. Sorted by latest_at
- * DESC (NULLS LAST) so E3's rebuild cap (HIPPO_DAG_REBUILD_CAP, default 20)
+ * DESC (NULLS LAST) so the rebuild cap (HIPPO_DAG_REBUILD_CAP, default 20)
  * takes the most-recently-changed summaries first.
  *
  * Returns full MemoryEntry shape via MEMORY_SELECT_COLUMNS + rowToEntry
@@ -11,21 +11,20 @@ export declare function loadDirtySummaries(hippoRoot: string, tenantId: string):
 /**
  * Mark a summary as dirty. Idempotent (re-marking dirty is a no-op + no
  * second audit row). Tenant-scoped to prevent cross-tenant writes via
- * parent-lookup. Called by E2 from invalidation.ts / writeEntry /
+ * parent-lookup. Called from invalidation.ts / writeEntry /
  * forgetMemory / archiveRawMemory whenever a child is invalidated,
  * superseded, forgotten, or archived.
  *
- * Quietly no-ops if the target row doesn't exist or isn't a level-2
- * summary (E5 will widen the dag_level guard to IN (2, 3) when level-3
- * build path lands). Emits a 'summary_marked_dirty' audit row on actual
+ * Quietly no-ops if the target row doesn't exist or isn't a level-2/3
+ * summary. Emits a 'summary_marked_dirty' audit row on actual
  * state transitions (0 -> 1) via the audit() helper, which try/catches
  * for missing audit_log (the v27 self-heal scenario).
  */
 export declare function markSummaryDirty(hippoRoot: string, summaryId: string, tenantId: string, actor?: string): void;
 /**
- * v0.30 / E5 — host-wide loader for L2 topic summaries without an L3 parent.
+ * Host-wide loader for L2 topic summaries without an L3 parent.
  * Used by consolidate phase 1.9 (buildEntityProfiles) to cluster L2s into
- * L3 entity profiles. Mirrors loadAllDirtySummaries pattern (E3): SQL-level
+ * L3 entity profiles. Mirrors loadAllDirtySummaries: SQL-level
  * filter is cheaper than reusing in-memory `survivors` (which doesn't
  * contain L2s freshly created by phase 1.7 buildDag).
  *
@@ -34,7 +33,7 @@ export declare function markSummaryDirty(hippoRoot: string, summaryId: string, t
  */
 export declare function loadAllL2Summaries(hippoRoot: string): MemoryEntry[];
 /**
- * v0.30 / E3 — host-wide variant of loadDirtySummaries. Iterates all tenants
+ * Host-wide variant of loadDirtySummaries. Iterates all tenants
  * in one query so consolidate.ts (host-wide per L106-109) does not need a
  * per-tenant loop. Each returned MemoryEntry carries its own tenantId (via
  * rowToEntry), so per-summary children + rebuild UPDATE stay tenant-scoped.
@@ -44,7 +43,7 @@ export declare function loadAllL2Summaries(hippoRoot: string): MemoryEntry[];
  */
 export declare function loadAllDirtySummaries(hippoRoot: string): MemoryEntry[];
 /**
- * v0.30 / E3 — load live children of a DAG summary. Used by
+ * Load live children of a DAG summary. Used by
  * rebuildDirtySummaries to regenerate content from the CURRENT child set
  * (not the children at create-time). Skips archived. Tenant-scoped
  * (defence in depth — dag_parent_id is unique-ish but tenant guard is
@@ -52,7 +51,7 @@ export declare function loadAllDirtySummaries(hippoRoot: string): MemoryEntry[];
  */
 export declare function loadChildrenOfSummary(hippoRoot: string, summaryId: string, tenantId: string): MemoryEntry[];
 /**
- * v0.30 / E3 — patch applied by applyRebuildResult. Two-branch shape
+ * Patch applied by applyRebuildResult. Two-branch shape
  * (bumpRebuildCount false for zero-child case, true for normal rebuild).
  */
 export interface RebuildPatch {
@@ -65,7 +64,7 @@ export interface RebuildPatch {
     actor: string;
 }
 /**
- * v0.30 / E3 — apply a rebuild result to a dirty summary. Atomic: one
+ * Apply a rebuild result to a dirty summary. Atomic: one
  * prepared UPDATE statement plus syncFtsRow inside one SAVEPOINT.
  * WHERE includes `AND summary_dirty = 1` so concurrent sleep's race-loser
  * becomes a no-op (no rebuild_count bump, no audit row).
@@ -81,14 +80,11 @@ export declare function applyRebuildResult(hippoRoot: string, summary: MemoryEnt
     refused: boolean;
 };
 /**
- * v0.30 / E3 — clear summary_dirty on a freshly-built summary. Called by
- * buildDag immediately after the child-link loop finishes. Without this,
- * each member's writeEntry call fires markSummaryDirtyInTx on the just-
- * created parent (E2 hook at store.ts:1214), and the same sleep cycle's
- * E3 rebuild phase would re-rebuild every new summary (2x LLM cost).
+ * Clear summary_dirty on a freshly-built summary. Called by buildDag right after the child-link loop:
+ * each member's writeEntry marks the new parent dirty, so the same cycle's rebuild would redo every new summary.
  *
  * Idempotent: no-op + no audit if summary isn't dirty. Audit
- * source='buildDag-clean' distinguishes from E3-rebuild source.
+ * source='buildDag-clean' distinguishes it from the rebuild's source.
  */
 export declare function clearSummaryDirtyAfterBuild(hippoRoot: string, summaryId: string, tenantId: string, actor?: string, source?: string): void;
 //# sourceMappingURL=summaries.d.ts.map