hippo-memory 1.62.0 → 1.63.0

package/dist/consolidate/llm-passes.js

@@ -72,9 +72,9 @@ async function dagBuildPass(run, { apiKey, llmError, llmOpts }) {
     }
 }
 // -------------------------------------------------------------------------
-// 1.8. DAG summary rebuild — drain dirty queue from E2's child-write hooks
+// 1.8. DAG summary rebuild — drain dirty queue from the child-write hooks
 // -------------------------------------------------------------------------
-// Consumer of E2's summary_dirty flag. Walks dirty L2 summaries, regenerates
+// Consumer of the summary_dirty flag. Walks dirty L2 summaries, regenerates
 // each via generateDagSummary, atomically refreshes content + 6 metadata
 // columns + clears summary_dirty (with FTS sync). Same apiKey/dryRun gate
 // as buildDag above. Cap HIPPO_DAG_REBUILD_CAP (default 20, hard ceiling
@@ -84,8 +84,7 @@ async function dagRebuildPass(run, { llmError, llmOpts }) {
     try {
         const { rebuildDirtySummaries } = await import('../dag.js');
         const rawCap = envDagRebuildCap();
-        // R1 MED must-fix: hard ceiling so misconfigured env can't burn
-        // unbounded LLM cost.
+        // Hard ceiling so a misconfigured env can't burn unbounded LLM cost.
         const cap = rawCap !== undefined ? Math.min(rawCap, 1000) : 20;
         const rebuildResult = await rebuildDirtySummaries(run.hippoRoot, { ...llmOpts, onError: llmError('dag rebuild'), cap });
         result.summariesRebuilt = rebuildResult.rebuilt;
@@ -115,7 +114,7 @@ async function dagRebuildPass(run, { llmError, llmOpts }) {
 // -------------------------------------------------------------------------
 // 1.9. DAG entity profiles — cluster L2 topic summaries into L3 profiles
 // -------------------------------------------------------------------------
-// E5 phase: aggregate per-entity L2 summaries (e.g. all the speaker:Alice
+// Aggregate per-entity L2 summaries (e.g. all the speaker:Alice
 // topic summaries) into a single L3 entity profile. Runs even when phase
 // 1.7 buildDag was skipped (re-clusters existing L2s every sleep).
 //

package/dist/consolidate/merge.js

@@ -54,13 +54,8 @@ export function mergePass(run) {
         && !e.pinned // a pin merged with a look-alike would read as one of two values
         && tokenize(e.content).length > 0);
     const used = new Set();
-    // T1 fix (2026-08-15 hardening pass): partition by tenantId BEFORE the
-    // overlap loop so a cluster can never span tenants. Previously textOverlap
-    // clustered across the whole host-wide `survivors` list with no tenant
-    // boundary, and mergeContents concatenated cross-tenant content into one
-    // row. Map preserves insertion order, so single-tenant stores (every row
-    // 'default') get exactly one partition and iterate in the same order as
-    // before this fix — byte-identical behavior there.
+    // Partition BEFORE the overlap loop so a cluster can never span tenants and merge cross-tenant content.
+    // Map keeps insertion order, so a single-tenant store gets one partition in the original order.
     const mergeCandidatesByTenant = new Map();
     for (const entry of mergeCandidates) {
         const key = derivationPartitionKey(entry.tenantId, entry.scope, entry.origin_project);
@@ -70,12 +65,8 @@ export function mergePass(run) {
         else
             mergeCandidatesByTenant.set(key, [entry]);
     }
-    // AT1 consolidation-loop fix (docs/plans/2026-08-15-at1-rejected-value-tombstone.md):
-    // reuses the single consolidateDb handle opened lazily in consolidate()
-    // for the whole non-dry-run consolidate — see that
-    // declaration's comment. Only needed for real writes — a dry-run preview
-    // never reaches batchWriteAndDelete's guard bypass, so there is nothing
-    // here for it to protect against.
+    // The rejection guard reuses the one consolidateDb handle opened lazily in consolidate(); a dry-run
+    // never reaches batchWriteAndDelete's guard bypass, so it has nothing to protect there.
     let mergesSkippedRejected = 0;
     for (const [, tenantCandidates] of mergeCandidatesByTenant) {
         const partition = {
@@ -115,13 +106,8 @@ function mergeCluster(run, partition, cluster, related, used) {
     const mergedContent = mergeContents(cluster);
     const allTags = Array.from(new Set(cluster.flatMap((e) => e.tags))).sort();
     const maxValence = pickStrongestValence(cluster);
-    // AT1 P2 fix: build the semantic entry FIRST — createMemory is cheap
-    // and pure — so the tombstone check below runs under the tenant the
-    // row will ACTUALLY land in.
-    // T1 fix: createMemory now receives tenantId: mergeTenant (the
-    // partition's tenant — every member of `cluster` shares it by
-    // construction), so the row lands in its source tenant instead of
-    // always 'default'.
+    // Build the semantic entry FIRST (createMemory is cheap and pure) so the tombstone check below runs
+    // under the partition's tenant, the one every cluster member shares and the row will land in.
     let semantic = null;
     if (!dryRun) {
         semantic = {
@@ -152,9 +138,8 @@ function mergeCluster(run, partition, cluster, related, used) {
         result.semanticCreated++;
         // Demote source episodics (they've been compressed into neocortex):
         // scale half_life_days so they decay sooner while staying recoverable.
-        // Immediate ranking is deliberately unchanged: the 2026-06-10 DAG
-        // slice-1 eval measured that dropping children below a worse-retrieving
-        // summary regresses budget-bounded QA (docs/evals/). The stored
+        // Immediate ranking is deliberately unchanged: dropping children below a
+        // worse-retrieving summary regresses budget-bounded QA. The stored
         // strength is refreshed to the live value so inspect, replay sampling,
         // and strength-sorted assembly see the truth instead of a fake 0.3.
         // Mutate in place (not a copy): `cluster` holds the same object

package/dist/consolidate/run.d.ts

@@ -15,7 +15,7 @@ export interface ConsolidationResult {
     semanticCreated: number;
     replayed: number;
     promotedTraces: number;
-    /** T7: sessions skipped because their events span two derivation scopes. */
+    /** Sessions skipped because their events span two derivation scopes. */
     tracesSkippedMixedScope: number;
     extractionCandidates: number;
     extracted: number;
@@ -35,13 +35,6 @@ export interface ConsolidationResult {
 }
 export declare const REPLAY_COUNT_DEFAULT = 5;
 export declare function keptAsWritten(entry: MemoryEntry): boolean;
-/** JSON value shape for a session event's free-form metadata field, cast to
- *  once at its `Record<string, unknown>` origin so it can be narrowed via
- *  isJsonString below rather than left as unparsed `unknown`. */
-export type JsonValue = string | number | boolean | null | JsonValue[] | {
-    [key: string]: JsonValue;
-};
-export declare function isJsonString(value: JsonValue): value is string;
 /** The sleep's one tombstone-check handle: opened on first use, never under dryRun, closed once. */
 interface LazyDb {
     get: () => DatabaseSyncLike | null;

package/dist/consolidate/run.js

@@ -4,31 +4,9 @@ export const REPLAY_COUNT_DEFAULT = 5;
 export function keptAsWritten(entry) {
     return entry.tags.some((tag) => NO_MERGE_TAGS.has(tag));
 }
-export function isJsonString(value) {
-    return typeof value === 'string';
-}
-// AT1 rejection-guard db handle (docs/plans/2026-08-15-at1-rejected-value-tombstone.md):
-// covers BOTH the auto-promote pass (1.4) and the merge
-// pass (3) — both build deterministic content that
-// batchWriteAndDelete writes through the guard's bypass, so both need a
-// producer-side tombstone check before pushing to pendingWrites.
-//
-// T3 fix (2026-08-15 hardening pass, perf hygiene): memoized lazy getter,
-// not an eager open. The handle only serves these two tombstone checks —
-// a sleep with zero promotable sessions and zero merge clusters never
-// reaches either use site, so opening it unconditionally on every
-// non-dry-run sleep paid a db-open cost for nothing. dryRun still never
-// opens (getConsolidateDb short-circuits before touching the handle).
-// consolidateDbOpened (not just a truthy handle check) is the
-// single source of truth for "was this ever opened", so the finally
-// closes it exactly once and never double-opens.
-//
-// AT1 P2 fix (codex, handle-leak restructure): the getter's lifetime must
-// start IMMEDIATELY before the try whose finally closes it, covering every
-// phase that can touch it — not just the merge pass. An exception thrown by
-// auto-promote (1.4), replay (1.5), batch extraction (1.6), the DAG
-// passes (1.7-1.9), or physics (2) would otherwise propagate past an open handle
-// with nothing to close it.
+// Auto-promote (1.4) and merge (3) write deterministic content through the guard's bypass, so both
+// need this tombstone check. Lazy so a sleep reaching neither never opens it; call it IMMEDIATELY
+// before the try whose finally closes it, so a throw in any phase cannot leak the handle.
 export function lazyConsolidateDb(hippoRoot, dryRun) {
     let consolidateDbHandle = null;
     let consolidateDbOpened = false;

package/dist/consolidate/sleep.js

@@ -33,10 +33,8 @@ export async function consolidate(hippoRoot, options = {}) {
     const dryRun = options.dryRun ?? false;
     const result = newConsolidationResult(dryRun);
     const halfLife = migrateHalfLives(hippoRoot, dryRun, result);
-    // L9: host-wide by design. Consolidation runs across all tenants in one
-    // pass — per-tenant filtering would create N consolidation runs per host
-    // with no cross-tenant dedup. The api.sleep audit row tags this with the
-    // admin synthetic actor; see api.ts:2050 for the rationale.
+    // Host-wide by design: per-tenant filtering would mean N runs per host and no cross-tenant dedup.
+    // The api.sleep audit row tags this with the admin synthetic actor.
     const all = loadAllEntries(hippoRoot);
     if (dryRun)
         for (const e of all)
@@ -153,24 +151,14 @@ function logRun(run, decay) {
     if (decay.rescuedEntries.length > 0)
         auditRescues(run, decay);
 }
-// One audit row per rescue (attributability, D1). Written here, AFTER
-// batchWriteAndDelete has committed this cycle's writes/deletes
-// (and after conflict detection + run logging), not inline in the decay
-// pass — same durability posture as api.ts's top-level 'consolidate'
-// summary audit row (written only once the whole sleep has completed).
-// Writing it earlier would assert rescues for a cycle whose effects
-// never landed if a later phase threw. Real writes only — dry-run
-// previews the decision (details line above) but persists nothing.
+// One audit row per rescue, written only after batchWriteAndDelete commits: writing earlier
+// would assert rescues for a cycle whose effects never landed if a later phase threw.
 function auditRescues(run, { rescuedEntries, rankById }) {
     const { result } = run;
     try {
         const auditDb = openHippoDb(run.hippoRoot);
         try {
-            // Review-round F5: per-row try/catch, not one try/catch around the
-            // whole loop — a single failed appendAuditEvent must not silently
-            // drop every remaining row. Mirrors the physics pass's
-            // skipped-warning precedent: count losses, keep
-            // the overall fail-soft posture, tell the operator via details.
+            // Per-row try/catch: one failed appendAuditEvent must not silently drop every remaining row.
             let auditFailures = 0;
             for (const entry of rescuedEntries) {
                 try {

package/dist/consolidate/traces.js

@@ -8,7 +8,8 @@ import { resolveTenantId } from '../tenant.js';
 import { appendAuditEvent, reportAuditWriteFailure } from '../audit.js';
 import { commonDerivationScope } from '../recall-scope.js';
 import { log } from '../log.js';
-import { REPLAY_COUNT_DEFAULT, isJsonString } from './run.js';
+import { REPLAY_COUNT_DEFAULT } from './run.js';
+import { isJsonString } from '../json.js';
 // -------------------------------------------------------------------------
 // 1.4. Auto-promote complete sessions to traces
 // -------------------------------------------------------------------------
@@ -24,10 +25,8 @@ export function promoteSessionTraces(run) {
     let tracesSkippedRejected = 0;
     const windowDays = run.config.autoTraceWindowDays ?? 7;
     const sinceMs = run.now.getTime() - windowDays * 24 * 60 * 60 * 1000;
-    // Auto-trace currently runs in a single-tenant context (the env-resolved
-    // tenant for this process). Multi-tenant deployments that want
-    // consolidation across all tenants need a per-tenant loop layered on top
-    // of this — tracked in docs/plans/2026-05-02-continuity-tables-tenant-scope.md.
+    // Auto-trace runs single-tenant (the env-resolved tenant); consolidating
+    // every tenant needs a per-tenant loop layered on top of this.
     const consolidationTenant = resolveTenantId({});
     const promotable = findPromotableSessions(run.hippoRoot, consolidationTenant, sinceMs);
     for (const session of promotable) {
@@ -60,7 +59,7 @@ function sessionTrace(run, consolidationTenant, sessionId) {
         session_id: sessionId,
         limit: 1000,
     });
-    // T7: a mixed-scope session would otherwise leak into one trace.
+    // A mixed-scope session would otherwise leak into one trace.
     const sessionScope = commonDerivationScope(events.map((e) => e.scope));
     if (!sessionScope.ok) {
         run.result.tracesSkippedMixedScope++;
@@ -91,26 +90,15 @@ function sessionTrace(run, consolidationTenant, sessionId) {
         tags: ['auto-promoted'],
         source: 'auto-promote',
         scope: sessionScope.scope,
-        // T1 fix (2026-08-15 hardening pass): stamp the trace into the SAME
-        // tenant the traceExistsForSession idempotency check (above) runs
-        // under. Before
-        // this, createMemory omitted tenantId and the trace always landed
-        // 'default' (memory.ts:535) while the idempotency check ran under
-        // consolidationTenant — for any non-default tenant that check never
-        // hit, and the trace regenerated every sleep.
+        // Same tenant as the traceExistsForSession check above, or a
+        // non-default tenant's trace regenerates every sleep.
         tenantId: consolidationTenant,
         baseHalfLifeDays: run.config.defaultHalfLifeDays,
     });
     return { trace, outcome };
 }
-// AT1 (same producer-side pattern as the merge pass below): traceExistsForSession
-// only sees rows CURRENTLY in the store — once a rejected trace is
-// removed, that idempotency check no longer blocks regeneration, and
-// this write would otherwise reach batchWriteAndDelete's guard bypass
-// unchecked, resurrecting it every sleep. Check under THE ENTRY'S OWN
-// stamped tenantId (read off `trace` after createMemory — never guess
-// the tenant) + the built content's digest. A hit skips the push
-// entirely: not counted as promoted, not added to survivors.
+// traceExistsForSession only sees live rows, so a removed rejected trace would regenerate every
+// sleep; check the tombstone under the entry's own stamped tenantId, never a guessed one.
 function traceRejected(run, trace, sessionId) {
     const consolidateDb = run.getConsolidateDb();
     if (!consolidateDb)

package/dist/customer-notes.d.ts

@@ -1,17 +1,16 @@
 /**
- * E2 customer_note first-class object - the LAST E2 object
- * (docs/plans/2026-06-01-e2-customer-note-object.md).
+ * customer_note first-class object.
  *
  * A `customer_note` is a discrete note recorded against an account/customer entity:
  * a `note` body scoped to a `customer`, evolving via the supersede delta lifecycle.
- * Entity-scoping is a free-form `customer` column (the `entities` table is unbuilt -
- * E3.1 planned - so an FK is deferred). Unlike project_brief's one-summary-per-repo,
+ * Entity-scoping is a free-form `customer` column (the `entities` table is unbuilt,
+ * so an FK is deferred). Unlike project_brief's one-summary-per-repo,
  * a customer accrues MANY discrete notes over time, each with its own supersede chain
  * (correct a note -> a new version preserving history; close retires it).
  *
  * Reuses the project_brief/skill supersede machinery verbatim (superseded_by self-FK
  * + CAS + INSERT-preflight + server-derived version + change_summary + supersede
- * tenant-match trigger). It has NO assembler/renderer (the simplest E2 object): the
+ * tenant-match trigger). It has NO assembler/renderer (the simplest first-class object): the
  * contribution is purely the entity-scoping dimension.
  *
  * The `customer_notes` table is the source of truth (survives memory decay); the
@@ -73,8 +72,7 @@ export interface ListCustomerNotesOpts {
  * the new version = predecessor.version + 1 (server-derived).
  *
  * The memory mirror carries a `customer:<lc>` tag (in addition to ['customer_note']
- * + caller extraTags) so scope-aware recall treats the note as entity-local - the
- * project_brief codex-P2 recall-locality lesson applied to entity scoping. There is
+ * + caller extraTags) so scope-aware recall treats the note as entity-local. There is
  * no self-recursion path (customer_note has no receipt-query/refresh).
  */
 export declare function saveCustomerNote(hippoRoot: string, tenantId: string, opts: SaveCustomerNoteOpts, actor?: string): CustomerNote;

package/dist/customer-notes.js

@@ -1,17 +1,16 @@
 /**
- * E2 customer_note first-class object - the LAST E2 object
- * (docs/plans/2026-06-01-e2-customer-note-object.md).
+ * customer_note first-class object.
  *
  * A `customer_note` is a discrete note recorded against an account/customer entity:
  * a `note` body scoped to a `customer`, evolving via the supersede delta lifecycle.
- * Entity-scoping is a free-form `customer` column (the `entities` table is unbuilt -
- * E3.1 planned - so an FK is deferred). Unlike project_brief's one-summary-per-repo,
+ * Entity-scoping is a free-form `customer` column (the `entities` table is unbuilt,
+ * so an FK is deferred). Unlike project_brief's one-summary-per-repo,
  * a customer accrues MANY discrete notes over time, each with its own supersede chain
  * (correct a note -> a new version preserving history; close retires it).
  *
  * Reuses the project_brief/skill supersede machinery verbatim (superseded_by self-FK
  * + CAS + INSERT-preflight + server-derived version + change_summary + supersede
- * tenant-match trigger). It has NO assembler/renderer (the simplest E2 object): the
+ * tenant-match trigger). It has NO assembler/renderer (the simplest first-class object): the
  * contribution is purely the entity-scoping dimension.
  *
  * The `customer_notes` table is the source of truth (survives memory decay); the
@@ -97,7 +96,6 @@ function buildNoteContent(customer, note) {
 // Preflight the supersede target BEFORE inserting the new row (so the new
 // autoincrement id can never be its own supersede target); read the
 // predecessor version in the same SELECT for server-derived versioning.
-// Mirrors saveProjectBrief / saveSkill (codex P1 2026-05-28).
 function preflightNoteSupersede(db, tenantId, supersedesId) {
     // SAFETY: SELECT projects exactly status, version; .get() returns that
     // shape for the matching row, or undefined when no note/tenant pair matches.
@@ -175,8 +173,7 @@ function writeNoteRow(db, memoryId, w) {
  * the new version = predecessor.version + 1 (server-derived).
  *
  * The memory mirror carries a `customer:<lc>` tag (in addition to ['customer_note']
- * + caller extraTags) so scope-aware recall treats the note as entity-local - the
- * project_brief codex-P2 recall-locality lesson applied to entity scoping. There is
+ * + caller extraTags) so scope-aware recall treats the note as entity-local. There is
  * no self-recursion path (customer_note has no receipt-query/refresh).
  */
 export function saveCustomerNote(hippoRoot, tenantId, opts, actor = 'cli') {
@@ -255,7 +252,7 @@ export function closeCustomerNote(hippoRoot, tenantId, id, actor = 'cli') {
             // Closing removes the object from the graph. Remove its rows DIRECTLY (deterministic),
             // not only via an enqueued rebuild whose queue item is lost if the mirror is later
             // forgotten (the queue row cascade-deletes with the memory), which would leave the closed
-            // object stale and could block that forget (codex P1). Still enqueue when a mirror exists
+            // object stale and could block that forget. Still enqueue when a mirror exists
             // so a concurrent rebuild re-derives consistently (harmless if it also runs).
             removeGraphEntitiesForObject(hippoRoot, tenantId, 'customer', closed.id);
             if (closed.memoryId) {

package/dist/dag.d.ts

@@ -16,11 +16,8 @@ export interface DagBuildResult {
     candidateClusters: number;
     summariesCreated: number;
     factsLinked: number;
-    /** AT1: clusters skipped because the LLM-synthesized summary landed on a
-     *  rejected value (plan §3 containment — per-cluster catch, not a whole-
-     *  phase abort). Member re-parenting writes are unaffected by construction
-     *  (same id + same content = guard-exempt), so this only ever counts
-     *  summary-creation refusals. */
+    /** Clusters skipped because the summary matched a rejected value. Re-parenting writes are
+     *  guard-exempt (same id + content), so only summary-creation refusals count. */
     rejected: number;
 }
 export declare function buildDag(hippoRoot: string, facts: MemoryEntry[], opts: DagSummaryOptions): Promise<DagBuildResult>;
@@ -33,21 +30,17 @@ export interface DagRebuildResult {
     capped: boolean;
 }
 /**
- * v0.30 / E3 — sleep-cycle phase that drains the dirty L2 summary queue.
+ * Sleep-cycle phase that drains the dirty L2 summary queue.
  * Thin orchestrator; the heavy lifting lives in store.ts (load + apply)
  * and dag.ts:generateDagSummary (LLM call).
  *
- * Per-summary try/catch isolation (plan-eng-r1 MED must-fix) — one
- * throwing rebuild does NOT abort the rest of the queue.
+ * Per-summary try/catch: one throwing rebuild does NOT abort the rest of the queue.
  *
  * Race-loser handling: applyRebuildResult's UPDATE WHERE includes
  * AND summary_dirty=1, so concurrent sleep's second writer returns
  * changed=false. Silent skip (neither rebuilt++ nor refused++ nor failed++).
  *
- * T4: applyRebuildResult returns { changed, refused } — a tombstone hit
- * (rebuild content matches a previously-rejected value) increments
- * `refused`, not `rebuilt`. Dirty still clears either way; only the stat
- * split changed (docs/plans/2026-08-15-hardening-at1-followups.md T4).
+ * A tombstone hit counts as `refused`, not `rebuilt`; dirty clears either way.
  */
 export declare function rebuildDirtySummaries(hippoRoot: string, opts: DagSummaryOptions & {
     cap?: number;
@@ -57,21 +50,17 @@ export interface EntityProfilesBuildResult {
     profilesCreated: number;
     l2sLinked: number;
     failed: number;
-    /** AT1: clusters skipped because the profile summary landed on a rejected
-     *  value (plan §3 containment). Kept distinct from `failed` (LLM null /
-     *  rate-limit) — a tombstone hit is a deliberate refusal, not an error. */
+    /** Clusters skipped because the profile matched a rejected value. Kept apart from
+     *  `failed`: a tombstone hit is a deliberate refusal, not an error. */
     rejected: number;
 }
 /**
- * v0.30 / E5 — build L3 entity profiles by clustering L2 summaries with
+ * Build L3 entity profiles by clustering L2 summaries with
  * shared entity tags. Threshold 2+ L2s per entity. Mirrors buildDag L1->L2
  * pattern, one level up.
  *
- * Born-dirty cancellation (E3 lesson): after linking L2 children to the new
- * L3 (each link write fires E2 hook on L3 via widened markSummaryDirtyInTx),
- * call clearSummaryDirtyAfterBuild with source='buildEntityProfiles-clean'
- * so E3 sleep-cycle rebuild doesn't re-rebuild the freshly-built L3 this
- * same cycle.
+ * Born-dirty cancellation: each L2 link write marks the new L3 dirty, so clear it
+ * or the same sleep cycle's rebuild re-rebuilds the freshly built L3.
  */
 export declare function buildEntityProfiles(hippoRoot: string, l2Summaries: MemoryEntry[], opts: DagSummaryOptions): Promise<EntityProfilesBuildResult>;
 //# sourceMappingURL=dag.d.ts.map

package/dist/dag.js

@@ -87,13 +87,9 @@ export async function generateDagSummary(label, factContents, opts) {
         return null;
     }
 }
-// Hardening follow-up (mirrors consolidate.ts's mergeCandidatesByTenant,
-// T1): partition unparented facts by tenantId BEFORE clustering so a
-// cluster can never mix facts from different tenants into one
-// LLM-synthesized summary. Map preserves insertion order, so
-// single-tenant stores (every row 'default') get exactly one partition
-// and iterate in the same order as before this fix — byte-identical
-// behavior there.
+// Partition BEFORE clustering so one LLM summary never mixes facts from different tenants.
+// Map keeps insertion order, so a single-tenant store iterates in its original order.
+// buildEntityProfiles partitions its L2s with this same key.
 function partitionFactsByTenant(unparented) {
     const unparentedByTenant = new Map();
     for (const fact of unparented) {
@@ -123,9 +119,8 @@ function createClusterSummaryEntry(summary, cluster, home) {
         baseHalfLifeDays: home.baseHalfLifeDays,
     });
     summaryEntry.origin_project = home.originProject;
-    // Schema v25: cache descendant_count + earliest/latest_at on the summary
-    // row so DAG-aware recall (docs/plans/2026-05-05-dag-recall.md Task 2)
-    // can reason about scope without walking the children.
+    // Cache descendant_count + earliest/latest_at on the summary row so
+    // DAG-aware recall can reason about scope without walking the children.
     summaryEntry.descendant_count = cluster.members.length;
     summaryEntry.earliest_at = memberCreatedAts[0];
     summaryEntry.latest_at = memberCreatedAts[memberCreatedAts.length - 1];
@@ -137,21 +132,8 @@ async function summarizeCluster(hippoRoot, cluster, home, opts, result) {
     if (!summary)
         return;
     const summaryEntry = createClusterSummaryEntry(summary, cluster, home);
-    // AT1 (plan §3 containment): a refused LLM-synthesized summary skips
-    // ONLY this cluster — the sleep cycle continues to the next one. The
-    // member re-parenting writes below never run for a skipped cluster
-    // (there is no summary id to parent them under).
-    //
-    // The tombstone check itself is tenant-scoped for free: writeEntry ->
-    // writeEntryDbOnly -> upsertEntryRow calls
-    // checkRejectionGuard(db, entry.tenantId ?? 'default', ...)
-    // (store/entry-writes.ts), reading tenantId off the entry being written. Now
-    // that summaryEntry carries home.tenantId instead of the implicit
-    // 'default', the guard consults that tenant's tombstones — no
-    // separate check needed here (unlike consolidate.ts's merge pass,
-    // which pre-checks via findRejectedValue because it writes through
-    // batchWriteAndDelete's bypassRejectionGuard path instead of
-    // writeEntry).
+    // A refused summary skips only this cluster. writeEntry's guard reads tenantId off the entry
+    // (home.tenantId), so it already checks this tenant's tombstones: no separate check here.
     try {
         writeEntry(hippoRoot, summaryEntry);
     }
@@ -169,11 +151,8 @@ async function summarizeCluster(hippoRoot, cluster, home, opts, result) {
         writeEntry(hippoRoot, updated);
         result.factsLinked++;
     }
-    // v0.30 / E3 — cancel the cascade of dirty-marks fired by member
-    // writeEntry calls (E2 hook on writeEntryDbOnly in store/entry-writes.ts).
-    // The summary we just built IS fresh, no rebuild needed. Without this,
-    // E3 in the SAME sleep cycle would re-rebuild every new summary
-    // (2x LLM cost). plan-eng-r1 HIGH must-fix.
+    // Member writes just marked this fresh summary dirty; clear it, or the same sleep cycle's
+    // rebuild pass would re-rebuild every new summary at twice the LLM cost.
     clearSummaryDirtyAfterBuild(hippoRoot, summaryEntry.id, summaryEntry.tenantId, 'buildDag');
 }
 export async function buildDag(hippoRoot, facts, opts) {
@@ -248,21 +227,17 @@ async function rebuildOneSummary(hippoRoot, summary, opts, result) {
     // success, silently skip
 }
 /**
- * v0.30 / E3 — sleep-cycle phase that drains the dirty L2 summary queue.
+ * Sleep-cycle phase that drains the dirty L2 summary queue.
  * Thin orchestrator; the heavy lifting lives in store.ts (load + apply)
  * and dag.ts:generateDagSummary (LLM call).
  *
- * Per-summary try/catch isolation (plan-eng-r1 MED must-fix) — one
- * throwing rebuild does NOT abort the rest of the queue.
+ * Per-summary try/catch: one throwing rebuild does NOT abort the rest of the queue.
  *
  * Race-loser handling: applyRebuildResult's UPDATE WHERE includes
  * AND summary_dirty=1, so concurrent sleep's second writer returns
  * changed=false. Silent skip (neither rebuilt++ nor refused++ nor failed++).
  *
- * T4: applyRebuildResult returns { changed, refused } — a tombstone hit
- * (rebuild content matches a previously-rejected value) increments
- * `refused`, not `rebuilt`. Dirty still clears either way; only the stat
- * split changed (docs/plans/2026-08-15-hardening-at1-followups.md T4).
+ * A tombstone hit counts as `refused`, not `rebuilt`; dirty clears either way.
  */
 export async function rebuildDirtySummaries(hippoRoot, opts) {
     const cap = opts.cap ?? 20;
@@ -291,33 +266,14 @@ export async function rebuildDirtySummaries(hippoRoot, opts) {
             await rebuildOneSummary(hippoRoot, summary, opts, result);
         }
         catch (err) {
-            // Per-summary failure isolation — one throw doesn't abort the queue.
-            // independent-review MED #2 fold: log enough to triage in production
-            // (audit() wraps its own writes try/catch per store/audit-event.ts, so a
-            // throw here is exotic: SQLite I/O error, prepare failure, etc).
+            // One throw doesn't abort the queue; log enough to triage an exotic
+            // failure (SQLite I/O, prepare), since audit() already catches its own.
             result.failed++;
             log.error(`rebuildDirtySummaries: summary ${summary.id} (tenant ${summary.tenantId}) failed: ${err instanceof Error ? err.message : String(err)}`);
         }
     }
     return result;
 }
-// independent-review HIGH #1 fold: cluster ONLY within-tenant.
-// clusterFacts has no tenant awareness; without this partition step a
-// multi-tenant host could form a cluster spanning tenants and produce
-// a single L3 with tenantId='default' that doesn't belong to either
-// child tenant. Fix: bucket by tenantId, run clusterFacts per-tenant,
-// pass tenantId to createMemory.
-function partitionL2sByTenant(unparented) {
-    const byTenant = new Map();
-    for (const l2 of unparented) {
-        const tid = l2.tenantId ?? 'default';
-        const key = derivationPartitionKey(tid, l2.scope, l2.origin_project);
-        const list = byTenant.get(key) ?? [];
-        list.push(l2);
-        byTenant.set(key, list);
-    }
-    return byTenant;
-}
 /** The L3 profile entry for one cluster of L2 summaries. */
 function createProfileEntry(summary, cluster, home) {
     const memberCreatedAts = cluster.members.map((m) => m.created).sort();
@@ -327,7 +283,7 @@ function createProfileEntry(summary, cluster, home) {
         tags: [...cluster.entityTags, ...neverAutoShareTags(cluster.members), 'dag-entity-profile'],
         confidence: 'inferred',
         dag_level: 3,
-        tenantId: home.tenantId, // HIGH #1 fold: thread tenant explicitly
+        tenantId: home.tenantId,
         scope: home.scope,
         baseHalfLifeDays: home.baseHalfLifeDays,
     });
@@ -346,9 +302,7 @@ async function profileCluster(hippoRoot, cluster, home, opts, result) {
         return;
     }
     const profileEntry = createProfileEntry(summary, cluster, home);
-    // AT1 (plan §3 containment): per-cluster catch — skip this cluster,
-    // count, log once. The member re-linking writes below never run for a
-    // skipped cluster (mirrors buildDag above).
+    // A refused profile skips only this cluster; the re-linking below never runs for it.
     try {
         writeEntry(hippoRoot, profileEntry);
     }
@@ -366,21 +320,17 @@ async function profileCluster(hippoRoot, cluster, home, opts, result) {
         writeEntry(hippoRoot, updated);
         result.l2sLinked++;
     }
-    // E3 born-dirty cancellation, same dance as buildDag L161-168 but for
-    // L3. Pass source='buildEntityProfiles-clean' to distinguish in audit.
-    // Args: (root, id, tenantId, actor, source).
+    // Re-linking just marked the fresh L3 dirty; clear it so this cycle's rebuild skips it.
+    // The distinct source tags the audit row.
     clearSummaryDirtyAfterBuild(hippoRoot, profileEntry.id, home.tenantId, 'buildEntityProfiles', 'buildEntityProfiles-clean');
 }
 /**
- * v0.30 / E5 — build L3 entity profiles by clustering L2 summaries with
+ * Build L3 entity profiles by clustering L2 summaries with
  * shared entity tags. Threshold 2+ L2s per entity. Mirrors buildDag L1->L2
  * pattern, one level up.
  *
- * Born-dirty cancellation (E3 lesson): after linking L2 children to the new
- * L3 (each link write fires E2 hook on L3 via widened markSummaryDirtyInTx),
- * call clearSummaryDirtyAfterBuild with source='buildEntityProfiles-clean'
- * so E3 sleep-cycle rebuild doesn't re-rebuild the freshly-built L3 this
- * same cycle.
+ * Born-dirty cancellation: each L2 link write marks the new L3 dirty, so clear it
+ * or the same sleep cycle's rebuild re-rebuilds the freshly built L3.
  */
 export async function buildEntityProfiles(hippoRoot, l2Summaries, opts) {
     const result = {
@@ -393,9 +343,9 @@ export async function buildEntityProfiles(hippoRoot, l2Summaries, opts) {
     const baseHalfLifeDays = loadConfig(hippoRoot).defaultHalfLifeDays;
     // Only L2 with no L3 parent yet (avoid re-clustering already-profiled L2s).
     const unparented = l2Summaries.filter((s) => s.dag_level === 2 && !s.dag_parent_id);
-    for (const [, tenantL2s] of partitionL2sByTenant(unparented)) {
+    for (const [, tenantL2s] of partitionFactsByTenant(unparented)) {
         const home = {
-            tenantId: tenantL2s[0].tenantId ?? 'default',
+            tenantId: tenantL2s[0].tenantId,
             scope: derivationScope(tenantL2s[0].scope),
             originProject: tenantL2s[0].origin_project,
             baseHalfLifeDays,

package/dist/db/continuity.js

@@ -112,8 +112,8 @@ const CARD_COMMENTS_DDL = `
       tenant_id TEXT NOT NULL DEFAULT 'default'
     )
   `;
-// Before the loop on stamped stores: a table lost after its migration stamped (2026-08-15
-// incident) is never re-migrated, and v4/v16/v22 ALTER or read it. Fresh stores use the chain.
+// Before the loop on stamped stores: a table lost after its migration stamped
+// is never re-migrated, and v4/v16/v22 ALTER or read it. Fresh stores use the chain.
 export function ensureContinuityTables(db) {
     db.exec(TASK_SNAPSHOTS_DDL);
     db.exec(SESSION_EVENTS_DDL);

package/dist/db/migrations/v14.js

@@ -2,7 +2,7 @@ import { tableHasColumn } from '../tables.js';
 export const v14 = {
     version: 14,
     up: (db) => {
-        // A3 provenance envelope: kind, scope, owner, artifact_ref.
+        // Provenance envelope: kind, scope, owner, artifact_ref.
         // SQLite ALTER TABLE ADD COLUMN cannot add CHECK; CHECK enforcement lives
         // in INSERT/UPDATE triggers added later in this migration.
         if (!tableHasColumn(db, 'memories', 'kind')) {

package/dist/db/migrations/v15.js

@@ -1,8 +1,7 @@
 export const v15 = {
     version: 15,
     up: (db) => {
-        // A3 hardening (post-review): close the NULL-kind bypass and add raw_archive
-        // dedup safety. Both findings landed in /review on commits 41b1f4d..6456e7d.
+        // Close the NULL-kind bypass and add raw_archive dedup safety.
         //
         // (1) Original v14 triggers used `WHEN NEW.kind IS NOT NULL AND NEW.kind NOT IN (...)`.
         //     A direct INSERT/UPDATE setting kind=NULL bypassed the CHECK substitute. Replace