hippo-memory 1.62.0 → 1.63.0

package/dist/store/delete-and-batch.js

@@ -38,20 +38,11 @@ export function memoriesBackingObjects(hippoRoot) {
     return ids;
 }
 /**
- * AT1 (plan §4, round-2 fix, designed from source): db-scoped delete core.
- * `deleteEntry` used to open+close its OWN connection, which meant it could
- * never compose inside a caller's transaction (unlike writeEntry/
- * writeEntryDbOnly, which already split this way). Split identically: row-
- * meta SELECT, `DELETE FROM memories`, FTS delete, `forget` audit, DAG
- * dirty-mark. NO filesystem I/O — the caller's own transaction may still be
- * rolled back, and mirror writes must only happen post-commit.
+ * db-scoped delete core, so a delete can compose inside a caller's transaction.
+ * NO filesystem I/O: the caller's transaction may still roll back, and mirrors are written post-commit.
  *
- * `opts.suppressForgetAudit` (default false, off): two AT1 callers set this
- * so a removed non-raw row does NOT ALSO emit a `forget` row, because each
- * already writes its own aggregate audit trail — `src/reject-flow.ts`'s
- * `rejectValue` (single `reject_value` row covering every same-digest row
- * removed) and `resolveConflict` (`conflict_resolve` row per resolution).
- * Default keeps `deleteEntry` byte-identical to its pre-split behavior.
+ * `opts.suppressForgetAudit` (default false): `rejectValue` and `resolveConflict` set it because each
+ * writes its own aggregate audit row, so a removed row must not ALSO emit a `forget` row.
  *
  * Returns `{tenantId, dagParentId}` for the removed row, or `null` if no row with `id`
  * existed or `automatic` refused it (pinned, raw, kept for good or backing an object at DELETE time, so a late pin wins).
@@ -70,11 +61,8 @@ export function deleteEntryCore(db, id, opts) {
     if (!opts?.suppressForgetAudit) {
         audit(db, 'forget', id, opts?.reason ? { reason: opts.reason } : undefined, opts?.actor ?? 'cli', row.tenant_id);
     }
-    // v0.30 / E2 — DAG live-coupling: forget of a child under a level-2
-    // summary marks parent dirty. Non-atomic with the DELETE (no SAVEPOINT
-    // wrapper here, same as pre-split deleteEntry); markSummaryDirtyInTx is
-    // idempotent so any future child mutation re-marks parent if this fails.
-    // Acceptable degradation, mirrors the pre-split audit best-effort posture.
+    // Forgetting a child of a summary marks the parent dirty. Not atomic with the DELETE, but
+    // markSummaryDirtyInTx is idempotent, so the next child mutation re-marks the parent if this fails.
     if (row.dag_parent_id) {
         markSummaryDirtyInTx(db, row.dag_parent_id, row.tenant_id ?? 'default', opts?.actor ?? 'cli');
     }
@@ -94,26 +82,30 @@ export function deleteEntryCore(db, id, opts) {
 export function deleteEntry(hippoRoot, id, opts) {
     const db = openStore(hippoRoot);
     try {
-        db.exec('BEGIN IMMEDIATE');
-        let result;
-        try {
-            result = deleteEntryCore(db, id, opts);
-            db.exec('COMMIT');
-        }
-        catch (err) {
-            if (db.isTransaction !== false)
-                db.exec('ROLLBACK');
-            throw err;
-        }
-        if (!result)
-            return false;
-        purgeMirrorBestEffort(hippoRoot, id, false, 'deleteEntry');
-        return true;
+        return deleteEntryOn(db, hippoRoot, id, opts);
     }
     finally {
         closeHippoDb(db);
     }
 }
+/** deleteEntry on the caller's open store, so a loop of deletes opens the store once; each delete still commits alone. */
+export function deleteEntryOn(db, hippoRoot, id, opts) {
+    db.exec('BEGIN IMMEDIATE');
+    let result;
+    try {
+        result = deleteEntryCore(db, id, opts);
+        db.exec('COMMIT');
+    }
+    catch (err) {
+        if (db.isTransaction !== false)
+            db.exec('ROLLBACK');
+        throw err;
+    }
+    if (!result)
+        return false;
+    purgeMirrorBestEffort(hippoRoot, id, false, 'deleteEntry');
+    return true;
+}
 // The child fields a level-2/3 summary is built from (loadChildrenOfSummary, generateDagSummary).
 const SUMMARY_INPUTS = ['content', 'created', 'dag_parent_id', 'kind'];
 function mergeOwnChanges(base, ours, live) {
@@ -138,26 +130,16 @@ export function batchWriteAndDelete(hippoRoot, toWrite, toDeleteIds, opts) {
         return [];
     const db = openStore(hippoRoot);
     try {
-        // BEGIN IMMEDIATE (codex delta-review P2): the AT1 tombstone probes below
-        // READ before the first write. Under a deferred BEGIN, that read pins a
-        // WAL snapshot; a concurrent writer (e.g. `hippo reject`) committing
-        // between probe and first upsert would make the later write-lock upgrade
-        // fail with SQLITE_BUSY and roll back the ENTIRE batch — the exact race
-        // the probe exists to contain. Taking the write lock up front serializes
-        // the probe and the writes on one consistent snapshot.
+        // IMMEDIATE: the tombstone probes below read before the first write, and under a deferred BEGIN a
+        // concurrent `hippo reject` would make the lock upgrade fail with SQLITE_BUSY and roll back the batch.
         db.exec('BEGIN IMMEDIATE');
-        // v0.30 / E2 — DAG live-coupling: BEFORE deletes, snapshot dag_parent_id
-        // for every doomed row so we can mark parents dirty post-COMMIT. Done
-        // inside the same BEGIN so the SELECT sees pre-delete state.
-        // independent-review-critic R1 HIGH: consolidate.ts/sleep flushes through
-        // this path every cycle; without these hooks parents NEVER get marked
-        // dirty for the dominant mutation source (decay, merge, garbage-collect).
+        // Snapshot every doomed row's dag_parent_id before the deletes: consolidation flushes through here
+        // every cycle, so without it parents would never be marked dirty for decay, merge or garbage-collect.
         const dirty = { parents: new Set(), tenantById: new Map() };
         const deletableIds = [];
         if (toDeleteIds.length > 0) {
             // A row pinned after the caller decided to delete it survives.
-            const placeholders = toDeleteIds.map(() => '?').join(',');
-            for (const row of selectAutoDeletableRows(db, placeholders, toDeleteIds, dirty))
+            for (const row of selectAutoDeletableRows(db, toDeleteIds, dirty))
                 deletableIds.push(row.id);
         }
         // v39: batch writers bypass writeEntry, so stamp store-derived origins here too (a NULL origin hides new
@@ -202,8 +184,7 @@ function moveDormantAndDelete(db, dormantMoves, deletableIds, dirty) {
     const movable = [];
     if (dormantMoves.length > 0) {
         const byId = new Map(dormantMoves.map((m) => [m.entry.id, m]));
-        const placeholders = dormantMoves.map(() => '?').join(',');
-        for (const row of selectAutoDeletableRows(db, placeholders, [...byId.keys()], dirty))
+        for (const row of selectAutoDeletableRows(db, [...byId.keys()], dirty))
             movable.push(byId.get(row.id));
     }
     for (const move of movable) {
@@ -216,10 +197,10 @@ function moveDormantAndDelete(db, dormantMoves, deletableIds, dirty) {
     }
     return removedIds;
 }
-/** The still auto-deletable rows among `ids`, recording each one's DAG parent as dirty. */
-function selectAutoDeletableRows(db, placeholders, ids, dirty) {
+/** The still auto-deletable rows among `ids`, recording each one's DAG parent as dirty. Placeholders come from `ids` itself. */
+function selectAutoDeletableRows(db, ids, dirty) {
     // SAFETY: rows' shape matches the three columns named in the SELECT.
-    const rows = db.prepare(`SELECT id, dag_parent_id, tenant_id FROM memories WHERE id IN (${placeholders}) AND ${AUTOMATIC_DELETE_SQL}`).all(...ids);
+    const rows = db.prepare(`SELECT id, dag_parent_id, tenant_id FROM memories WHERE id IN (${ids.map(() => '?').join(',')}) AND ${AUTOMATIC_DELETE_SQL}`).all(...ids);
     for (const row of rows) {
         if (row.dag_parent_id) {
             dirty.parents.add(row.dag_parent_id);
@@ -229,23 +210,8 @@ function selectAutoDeletableRows(db, placeholders, ids, dirty) {
     return rows;
 }
 function applyBatchWrites(db, stampedWrites, snapshot, dirty) {
-    // AT1 P1 fix (codex, batch-transaction rejection race): the producer-side
-    // check (e.g. consolidate.ts's merge pass) runs BEFORE this transaction,
-    // on a different connection. A `hippo reject X` that commits in that
-    // window is invisible to it — a queued same-id write of X already
-    // sitting in `toWrite` (decay/replay re-persist, or a merge built before
-    // the reject) would silently re-INSERT the just-rejected row via the
-    // blind bypass. Fix: one indexed point probe per batch entry, on THIS
-    // connection, INSIDE this transaction — closes the race regardless of
-    // which write class hits it. N is small per sleep, so the extra query
-    // per entry is cheap.
-    //
-    // Skip, don't throw: the batch must still complete for every OTHER
-    // entry. Skipping is correct for every write class here — a merge
-    // summary skip just means that rollup is absent this cycle (its source
-    // facts stay merely demoted, recoverable next sleep); a skipped
-    // demotion/replay re-persist of a rejected-removed row means it stays
-    // gone, which is the entire point of the tombstone.
+    // Probe tombstones per entry on THIS connection inside the transaction: the producer's check ran earlier
+    // on another connection, so a reject committed in between would be re-inserted. Skip, never throw, so the rest lands.
     let batchRejectedSkips = 0;
     const written = [];
     const readLiveRow = db.prepare(`SELECT ${MEMORY_SELECT_COLUMNS} FROM memories WHERE id = ?`);
@@ -262,18 +228,8 @@ function applyBatchWrites(db, stampedWrites, snapshot, dirty) {
         if (base && !live)
             continue;
         written.push(row);
-        // AT1 (plan §3, corrected): bypass the rejection guard here.
-        // Consolidation merges are DETERMINISTIC CONCATENATION (mergeContents,
-        // consolidate.ts:736-751) of already-guarded leaf facts, not an LLM
-        // paraphrase — refusing mid-batch would abort the whole consolidation
-        // transaction. The bypass is safe because consolidate.ts's merge pass
-        // now checks the merged content's rejection digest against the
-        // tenant's tombstones BEFORE ever pushing a merge into pendingWrites,
-        // skipping that merge entirely on a hit, AND because the point-probe
-        // immediately above closes the race window between that producer
-        // check and this COMMIT. The guard itself still belongs on leaf
-        // inserts, which write through writeEntry / writeEntryDbOnly and stay
-        // guarded (bypassRejectionGuard defaults false).
+        // Bypass the guard: merges concatenate already-guarded facts, the merge pass checks merged content, and
+        // the probe above closes the race; a mid-batch refusal would abort the whole consolidation.
         upsertEntryRow(db, row, true);
         // Hook for writes: a new child, or a change to what its summary reads, marks the parent dirty; decay alone does not.
         if (row.dag_parent_id && (!live || SUMMARY_INPUTS.some((k) => row[k] !== live[k]))) {
@@ -286,15 +242,8 @@ function applyBatchWrites(db, stampedWrites, snapshot, dirty) {
 /** True, after auditing the refusal, when the write would introduce a rejected value. */
 function isRejectedBatchWrite(db, row) {
     const entryTenantId = row.tenantId ?? 'default';
-    // Codex delta-review P2 fix: reuse checkRejectionGuard rather than a
-    // bare tombstone probe — the guard's content-INTRODUCTION
-    // classification must apply here too. A tombstone can legitimately
-    // coexist with a live same-content row (resolveConflict deliberately
-    // excludes keepId from its sweep; unreject-then-re-reject windows), and
-    // an unconditional skip would starve that row of decay/replay metadata
-    // updates forever. The guard throws only when the write is new-row or
-    // changes content TO the rejected value; unchanged same-id re-persists
-    // pass through, exactly as on the writeEntry path.
+    // checkRejectionGuard, not a bare tombstone probe: a tombstone can coexist with a live same-content row,
+    // and skipping every re-persist would starve it of decay/replay updates; only new or changed content is refused.
     try {
         checkRejectionGuard(db, entryTenantId, row.id, row.content);
     }

package/dist/store/entry-reads.d.ts

@@ -8,11 +8,18 @@ import { type DatabaseSyncLike } from '../db.js';
  * legacy single-tenant callers and the writeEntry/readEntry round-trip.
  */
 export declare function readEntry(hippoRoot: string, id: string, tenantId?: string): MemoryEntry | null;
+/** Ids per `IN (...)` list: far under SQLite's bound-parameter limit, with room for the tenant filter. */
+export declare const ID_CHUNK = 500;
+/** `items` in consecutive slices of at most `size`. */
+export declare function chunked<T>(items: readonly T[], size?: number): T[][];
+/** Rows by id on the caller's handle, one query per chunk; an id missing or in another tenant is absent from the map. */
+export declare function selectEntriesByIds(db: DatabaseSyncLike, ids: readonly string[], tenantId?: string): Map<string, MemoryEntry>;
+/** Direct children of each parent, one query per chunk; each list is in `created ASC, id ASC` order. */
+export declare function selectChildrenByParent(db: DatabaseSyncLike, parentIds: readonly string[], tenantId?: string): Map<string, MemoryEntry[]>;
 /**
  * Batched lookup. Caps at 500 ids per call to keep the IN(?,?,...) clause
  * within SQLite limits. Tenant filter is enforced when `tenantId` is passed.
- * Used by DAG-aware recall (docs/plans/2026-05-05-dag-recall.md Task 1.5)
- * to fetch parent summaries for a set of overflowed leaves.
+ * Used by DAG-aware recall to fetch parent summaries for a set of overflowed leaves.
  */
 export declare function loadEntriesByIds(hippoRoot: string, ids: readonly string[], tenantId?: string): MemoryEntry[];
 /**
@@ -20,10 +27,8 @@ export declare function loadEntriesByIds(hippoRoot: string, ids: readonly string
  * oldest-first. Used by `api.assemble` to walk a session's chronological
  * context. Excludes superseded rows.
  *
- * Cap semantics (v1.6.2 codex fix): when `cap` is provided, the NEWEST
- * `cap` rows are loaded — `ORDER BY created DESC LIMIT cap` server-side,
- * reversed to oldest-first client-side. Pre-v1.6.2 ordered ASC + LIMIT,
- * which silently dropped the newest rows and broke fresh-tail in assemble.
+ * Cap semantics: when `cap` is provided, the NEWEST `cap` rows are loaded (DESC LIMIT server-side,
+ * reversed client-side); ASC + LIMIT would drop the newest rows and break fresh-tail in assemble.
  *
  * Returns `[]` for an empty sessionId. Final order: `created ASC, id ASC`.
  */
@@ -33,11 +38,8 @@ export declare function loadSessionRawMemories(hippoRoot: string, sessionId: str
  * the full session size even when `rowCap` truncates the loaded window,
  * WITHOUT leaking rows the caller wouldn't have been allowed to load.
  *
- * v1.6.3 codex P1 / senior P0: an earlier draft of this helper ran an
- * unscoped COUNT, which let a no-scope caller infer the existence of
- * private rows by comparing `totalRaw` against `items.length`. This
- * version SQL-encodes the same default-deny rule `passesScopeFilterForRecall`
- * applies in TS:
+ * An unscoped COUNT would let a no-scope caller infer private rows by comparing `totalRaw`
+ * against `items.length`, so this SQL-encodes the default-deny rule `passesScopeFilterForRecall` applies in TS:
  *   - explicit scope passed: exact-match
  *   - no scope: rows where scope IS NULL, or scope is NOT a `<source>:private:*`
  *     pattern AND not the `unknown:legacy` quarantine bucket.
@@ -51,29 +53,19 @@ export declare function countSessionRawMemories(hippoRoot: string, sessionId: st
  * `sessionId` is supplied, also constrains to a specific session — that
  * is the correct shape for "what did I just see in THIS session."
  *
- * v1.6.2 codex review fix: pre-v1.6.2 was tenant-wide only. With multiple
- * concurrent sessions in a tenant, fresh-tail recall surfaced unrelated
- * rows from other sessions and stamped them `isFreshTail=true`. Callers
- * that want session-scoped fresh-tail now pass `sessionId`. The
- * tenant-wide form (no sessionId) still exists for "anything new across
- * the whole tenant" — pass undefined to opt in.
+ * Without `sessionId`, concurrent sessions in a tenant surface each other's rows as fresh tail;
+ * pass undefined only for "anything new across the whole tenant".
  *
  * Bounded count cap at 200 — beyond that the caller should filter via
  * tags/scope rather than time-windowed recall.
  *
- * Deprecation note (v1.6.5) — the **tenant-wide call shape** (omitting
- * `sessionId`) is rarely the right shape for "what did I just see in this
- * conversation". `api.recall` enforces session scoping when
- * `HIPPO_REQUIRE_SESSION_SCOPED_FRESH_TAIL=1` is set, throwing
- * `RecallContractError` instead. Tenant-wide remains the back-compat default
- * but is discouraged for new callers. Passing `sessionId` is fully supported
- * and recommended; this function is NOT deprecated as a whole.
+ * The tenant-wide shape is the back-compat default but discouraged; `api.recall` throws
+ * `RecallContractError` for it when `HIPPO_REQUIRE_SESSION_SCOPED_FRESH_TAIL=1` is set.
  */
 export declare function loadFreshRawMemories(hippoRoot: string, count: number, tenantId?: string, sessionId?: string): MemoryEntry[];
 /**
  * Direct DAG children of a parent summary. Tenant scoped. Returns only rows
  * whose `dag_parent_id` matches `parentId`; does NOT walk recursively.
- * Used by `drillDown` (Task 3).
  */
 export declare function loadChildrenOf(hippoRoot: string, parentId: string, tenantId?: string): MemoryEntry[];
 /**

package/dist/store/entry-reads.js

@@ -1,6 +1,7 @@
 import { closeHippoDb } from '../db.js';
 import { MEMORY_SELECT_COLUMNS, rowToEntry, parseJsonArray } from './rows.js';
 import { openStore } from './open.js';
+import { escapeLike } from '../escape.js';
 /**
  * Read a memory entry by ID.
  *
@@ -22,11 +23,54 @@ export function readEntry(hippoRoot, id, tenantId) {
         closeHippoDb(db);
     }
 }
+/** Ids per `IN (...)` list: far under SQLite's bound-parameter limit, with room for the tenant filter. */
+export const ID_CHUNK = 500;
+/** `items` in consecutive slices of at most `size`. */
+export function chunked(items, size = ID_CHUNK) {
+    const out = [];
+    for (let i = 0; i < items.length; i += size)
+        out.push(items.slice(i, i + size));
+    return out;
+}
+/** Rows by id on the caller's handle, one query per chunk; an id missing or in another tenant is absent from the map. */
+export function selectEntriesByIds(db, ids, tenantId) {
+    const byId = new Map();
+    const tenantClause = tenantId !== undefined ? ' AND tenant_id = ?' : '';
+    const tenantArgs = tenantId !== undefined ? [tenantId] : [];
+    for (const chunk of chunked([...new Set(ids)])) {
+        const placeholders = chunk.map(() => '?').join(',');
+        // SAFETY: selects exactly MEMORY_SELECT_COLUMNS, matching MemoryRow's field set.
+        const rows = db.prepare(`SELECT ${MEMORY_SELECT_COLUMNS} FROM memories WHERE id IN (${placeholders})${tenantClause}`).all(...chunk, ...tenantArgs);
+        for (const row of rows)
+            byId.set(row.id, rowToEntry(row));
+    }
+    return byId;
+}
+/** Direct children of each parent, one query per chunk; each list is in `created ASC, id ASC` order. */
+export function selectChildrenByParent(db, parentIds, tenantId) {
+    const byParent = new Map();
+    const tenantClause = tenantId !== undefined ? ' AND tenant_id = ?' : '';
+    const tenantArgs = tenantId !== undefined ? [tenantId] : [];
+    for (const chunk of chunked([...new Set(parentIds)])) {
+        const placeholders = chunk.map(() => '?').join(',');
+        // SAFETY: selects exactly MEMORY_SELECT_COLUMNS, matching MemoryRow's field set.
+        const rows = db.prepare(`SELECT ${MEMORY_SELECT_COLUMNS} FROM memories WHERE dag_parent_id IN (${placeholders})${tenantClause} ORDER BY created ASC, id ASC`).all(...chunk, ...tenantArgs);
+        for (const row of rows) {
+            const entry = rowToEntry(row);
+            const parentId = entry.dag_parent_id ?? '';
+            const bucket = byParent.get(parentId);
+            if (bucket)
+                bucket.push(entry);
+            else
+                byParent.set(parentId, [entry]);
+        }
+    }
+    return byParent;
+}
 /**
  * Batched lookup. Caps at 500 ids per call to keep the IN(?,?,...) clause
  * within SQLite limits. Tenant filter is enforced when `tenantId` is passed.
- * Used by DAG-aware recall (docs/plans/2026-05-05-dag-recall.md Task 1.5)
- * to fetch parent summaries for a set of overflowed leaves.
+ * Used by DAG-aware recall to fetch parent summaries for a set of overflowed leaves.
  */
 export function loadEntriesByIds(hippoRoot, ids, tenantId) {
     if (ids.length === 0)
@@ -35,9 +79,7 @@ export function loadEntriesByIds(hippoRoot, ids, tenantId) {
     const db = openStore(hippoRoot);
     try {
         const placeholders = capped.map(() => '?').join(',');
-        // T2: no ORDER BY meant row order followed SQLite's IN(...) scan order
-        // (undefined w.r.t. the caller's `ids` order). created ASC, id ASC
-        // makes it deterministic.
+        // Without ORDER BY, rows follow SQLite's IN(...) scan order, which is undefined w.r.t. `ids`.
         // SAFETY: both branches select exactly MEMORY_SELECT_COLUMNS, matching
         // MemoryRow's field set.
         const rows = tenantId !== undefined
@@ -54,10 +96,8 @@ export function loadEntriesByIds(hippoRoot, ids, tenantId) {
  * oldest-first. Used by `api.assemble` to walk a session's chronological
  * context. Excludes superseded rows.
  *
- * Cap semantics (v1.6.2 codex fix): when `cap` is provided, the NEWEST
- * `cap` rows are loaded — `ORDER BY created DESC LIMIT cap` server-side,
- * reversed to oldest-first client-side. Pre-v1.6.2 ordered ASC + LIMIT,
- * which silently dropped the newest rows and broke fresh-tail in assemble.
+ * Cap semantics: when `cap` is provided, the NEWEST `cap` rows are loaded (DESC LIMIT server-side,
+ * reversed client-side); ASC + LIMIT would drop the newest rows and break fresh-tail in assemble.
  *
  * Returns `[]` for an empty sessionId. Final order: `created ASC, id ASC`.
  */
@@ -94,11 +134,8 @@ export function loadSessionRawMemories(hippoRoot, sessionId, tenantId, cap) {
  * the full session size even when `rowCap` truncates the loaded window,
  * WITHOUT leaking rows the caller wouldn't have been allowed to load.
  *
- * v1.6.3 codex P1 / senior P0: an earlier draft of this helper ran an
- * unscoped COUNT, which let a no-scope caller infer the existence of
- * private rows by comparing `totalRaw` against `items.length`. This
- * version SQL-encodes the same default-deny rule `passesScopeFilterForRecall`
- * applies in TS:
+ * An unscoped COUNT would let a no-scope caller infer private rows by comparing `totalRaw`
+ * against `items.length`, so this SQL-encodes the default-deny rule `passesScopeFilterForRecall` applies in TS:
  *   - explicit scope passed: exact-match
  *   - no scope: rows where scope IS NULL, or scope is NOT a `<source>:private:*`
  *     pattern AND not the `unknown:legacy` quarantine bucket.
@@ -140,23 +177,14 @@ export function countSessionRawMemories(hippoRoot, sessionId, tenantId, scope) {
  * `sessionId` is supplied, also constrains to a specific session — that
  * is the correct shape for "what did I just see in THIS session."
  *
- * v1.6.2 codex review fix: pre-v1.6.2 was tenant-wide only. With multiple
- * concurrent sessions in a tenant, fresh-tail recall surfaced unrelated
- * rows from other sessions and stamped them `isFreshTail=true`. Callers
- * that want session-scoped fresh-tail now pass `sessionId`. The
- * tenant-wide form (no sessionId) still exists for "anything new across
- * the whole tenant" — pass undefined to opt in.
+ * Without `sessionId`, concurrent sessions in a tenant surface each other's rows as fresh tail;
+ * pass undefined only for "anything new across the whole tenant".
  *
  * Bounded count cap at 200 — beyond that the caller should filter via
  * tags/scope rather than time-windowed recall.
  *
- * Deprecation note (v1.6.5) — the **tenant-wide call shape** (omitting
- * `sessionId`) is rarely the right shape for "what did I just see in this
- * conversation". `api.recall` enforces session scoping when
- * `HIPPO_REQUIRE_SESSION_SCOPED_FRESH_TAIL=1` is set, throwing
- * `RecallContractError` instead. Tenant-wide remains the back-compat default
- * but is discouraged for new callers. Passing `sessionId` is fully supported
- * and recommended; this function is NOT deprecated as a whole.
+ * The tenant-wide shape is the back-compat default but discouraged; `api.recall` throws
+ * `RecallContractError` for it when `HIPPO_REQUIRE_SESSION_SCOPED_FRESH_TAIL=1` is set.
  */
 export function loadFreshRawMemories(hippoRoot, count, tenantId, sessionId) {
     if (count <= 0)
@@ -174,11 +202,8 @@ export function loadFreshRawMemories(hippoRoot, count, tenantId, sessionId) {
             sql += ' AND source_session_id = ?';
             params.push(sessionId);
         }
-        // T2: tie tail keeps the LIMIT window keyed on `created` while making
-        // same-`created` rows deterministic. `content` before `id` (codex
-        // review): ids are random UUIDs, so an id-only tail would pick WHICH
-        // same-created rows make the window per-instance; content is
-        // cross-ingest-stable.
+        // Tie tail makes same-`created` rows deterministic; `content` before `id` because ids are random
+        // UUIDs, so an id-only tail would pick which same-created rows make the window per instance.
         sql += ' ORDER BY created DESC, content ASC, id ASC LIMIT ?';
         params.push(capped);
         // SAFETY: sql starts from MEMORY_SELECT_COLUMNS, matching MemoryRow.
@@ -192,17 +217,11 @@ export function loadFreshRawMemories(hippoRoot, count, tenantId, sessionId) {
 /**
  * Direct DAG children of a parent summary. Tenant scoped. Returns only rows
  * whose `dag_parent_id` matches `parentId`; does NOT walk recursively.
- * Used by `drillDown` (Task 3).
  */
 export function loadChildrenOf(hippoRoot, parentId, tenantId) {
     const db = openStore(hippoRoot);
     try {
-        // SAFETY: both branches select exactly MEMORY_SELECT_COLUMNS, matching
-        // MemoryRow's field set.
-        const rows = tenantId !== undefined
-            ? db.prepare(`SELECT ${MEMORY_SELECT_COLUMNS} FROM memories WHERE dag_parent_id = ? AND tenant_id = ? ORDER BY created ASC, id ASC`).all(parentId, tenantId)
-            : db.prepare(`SELECT ${MEMORY_SELECT_COLUMNS} FROM memories WHERE dag_parent_id = ? ORDER BY created ASC, id ASC`).all(parentId);
-        return rows.map(rowToEntry);
+        return selectChildrenByParent(db, [parentId], tenantId).get(parentId) ?? [];
     }
     finally {
         closeHippoDb(db);
@@ -236,7 +255,7 @@ export function selectAllEntries(db, tenantId) {
 /** Live rows whose source starts with `prefix`, on the caller's handle; LIKE folds case, so the prefix is checked again exactly. */
 export function selectLiveEntriesBySourcePrefix(db, tenantId, prefix) {
     // SAFETY: selects exactly MEMORY_SELECT_COLUMNS, matching MemoryRow's field set.
-    const rows = db.prepare(`SELECT ${MEMORY_SELECT_COLUMNS} FROM memories WHERE tenant_id = ? AND superseded_by IS NULL AND source LIKE ? ESCAPE '\\'`).all(tenantId, `${prefix.replace(/[%_\\]/g, '\\$&')}%`);
+    const rows = db.prepare(`SELECT ${MEMORY_SELECT_COLUMNS} FROM memories WHERE tenant_id = ? AND superseded_by IS NULL AND source LIKE ? ESCAPE '\\'`).all(tenantId, `${escapeLike(prefix)}%`);
     return rows.map(rowToEntry).filter((entry) => entry.source.startsWith(prefix));
 }
 // Content of every tenant row tagged `tag`, without reading the rest of the store.

package/dist/store/entry-row.d.ts

@@ -1,26 +1,8 @@
 import type { MemoryEntry } from '../memory.js';
 import { openHippoDb } from '../db.js';
 /**
- * `bypassRejectionGuard` (AT1, plan §3): ONLY `batchWriteAndDelete`'s call
- * site passes `true`. Consolidation merges are DETERMINISTIC CONCATENATION
- * (mergeContents, consolidate.ts:736-751), not LLM paraphrase — the bypass
- * is safe because the producer (consolidate.ts's merge pass) now checks the
- * merged content's rejection digest against the tenant's tombstones BEFORE
- * ever assembling a batch to write, and skips the merge entirely on a hit.
- * Every other caller (writeEntryDbOnly, bootstrapLegacyStore, rebuildIndex)
- * leaves this false and the guard runs live.
- *
- * AT1 P1 fix (codex, batch-transaction rejection race): the producer check
- * above runs on a DIFFERENT connection BEFORE this transaction opens — a
- * `hippo reject X` that commits in that window is invisible to it. This
- * parameter's contract is UNCHANGED (still the sole bypass, still trusted
- * by the producer-side check for the common case); what changed is that
- * `batchWriteAndDelete` no longer trusts it BLINDLY. It now runs its own
- * in-transaction point-probe (same connection, same digest lookup this
- * function's guard would have done) immediately before each upsert and
- * skips — rather than writes — any entry whose content matches a tombstone
- * that landed after the producer's check. See batchWriteAndDelete for the
- * skip logic.
+ * `bypassRejectionGuard`: ONLY `batchWriteAndDelete` passes `true`; its merges concatenate
+ * already-guarded facts, and it re-probes tombstones in-transaction before each upsert.
  */
 export declare function upsertEntryRow(db: ReturnType<typeof openHippoDb>, entry: MemoryEntry, bypassRejectionGuard?: boolean): void;
 export declare function syncFtsRow(db: ReturnType<typeof openHippoDb>, entry: MemoryEntry, isNewRow?: boolean): void;
@@ -29,14 +11,14 @@ export declare function deleteFtsRow(db: ReturnType<typeof openHippoDb>, id: str
  * Write a memory entry to SQLite and refresh compatibility mirrors.
  *
  * `opts.actor` defaults to 'cli' so unauthenticated direct-CLI callers still
- * get the right audit attribution. The HTTP server (A1) and api.* layer pass
+ * get the right audit attribution. The HTTP server and api.* layer pass
  * the resolved actor (`api_key:<key_id>` / `localhost:cli`) so audit events
  * land with one row per write, no double-emit.
  *
  * `opts.afterWrite` is invoked inside the same SAVEPOINT as the memories
  * INSERT (mirrors archiveRawMemory's shape in raw-archive.ts). On callback
  * throw, the SAVEPOINT rolls back — the memory row never lands, and the
- * filesystem mirrors / audit emit never run. Used by E1.3+ connectors to
+ * filesystem mirrors / audit emit never run. Used by connectors to
  * stamp idempotency rows atomically with the memory write.
  */
 /**
@@ -51,7 +33,7 @@ export declare function deleteFtsRow(db: ReturnType<typeof openHippoDb>, id: str
  * v39 migration found no evidence for" and is deny-by-default in ambient
  * context. A writeback (e.g. markRetrieved on a crossProject-included row)
  * must not launder it into an injectable origin - the migration is the only
- * evidence-based NULL converter (codex gating round 2 P1).
+ * evidence-based NULL converter.
  */
 export declare function stampOriginProject(hippoRoot: string, entry: MemoryEntry): MemoryEntry;
 /**
@@ -61,7 +43,7 @@ export declare function stampOriginProject(hippoRoot: string, entry: MemoryEntry
  * backfill. Same evidence order as the migration: the provenance source
  * (`shared:<project>:` / `promoted:<localRoot>`) wins over the destination
  * store's location, so a shared row imported into the global store keeps its
- * owning project instead of becoming user-global (codex gating round 3 P1).
+ * owning project instead of becoming user-global.
  */
 export declare function stampOriginProjectForImport(hippoRoot: string, entry: MemoryEntry): MemoryEntry;
 //# sourceMappingURL=entry-row.d.ts.map

package/dist/store/entry-row.js

@@ -4,26 +4,8 @@ import { deriveOriginProject, originFromSource } from '../project-identity.js';
 import { checkRejectionGuard } from '../rejection.js';
 import { log } from '../log.js';
 /**
- * `bypassRejectionGuard` (AT1, plan §3): ONLY `batchWriteAndDelete`'s call
- * site passes `true`. Consolidation merges are DETERMINISTIC CONCATENATION
- * (mergeContents, consolidate.ts:736-751), not LLM paraphrase — the bypass
- * is safe because the producer (consolidate.ts's merge pass) now checks the
- * merged content's rejection digest against the tenant's tombstones BEFORE
- * ever assembling a batch to write, and skips the merge entirely on a hit.
- * Every other caller (writeEntryDbOnly, bootstrapLegacyStore, rebuildIndex)
- * leaves this false and the guard runs live.
- *
- * AT1 P1 fix (codex, batch-transaction rejection race): the producer check
- * above runs on a DIFFERENT connection BEFORE this transaction opens — a
- * `hippo reject X` that commits in that window is invisible to it. This
- * parameter's contract is UNCHANGED (still the sole bypass, still trusted
- * by the producer-side check for the common case); what changed is that
- * `batchWriteAndDelete` no longer trusts it BLINDLY. It now runs its own
- * in-transaction point-probe (same connection, same digest lookup this
- * function's guard would have done) immediately before each upsert and
- * skips — rather than writes — any entry whose content matches a tombstone
- * that landed after the producer's check. See batchWriteAndDelete for the
- * skip logic.
+ * `bypassRejectionGuard`: ONLY `batchWriteAndDelete` passes `true`; its merges concatenate
+ * already-guarded facts, and it re-probes tombstones in-transaction before each upsert.
  */
 export function upsertEntryRow(db, entry, bypassRejectionGuard = false) {
     if (!bypassRejectionGuard) {
@@ -158,14 +140,14 @@ export function deleteFtsRow(db, id) {
  * Write a memory entry to SQLite and refresh compatibility mirrors.
  *
  * `opts.actor` defaults to 'cli' so unauthenticated direct-CLI callers still
- * get the right audit attribution. The HTTP server (A1) and api.* layer pass
+ * get the right audit attribution. The HTTP server and api.* layer pass
  * the resolved actor (`api_key:<key_id>` / `localhost:cli`) so audit events
  * land with one row per write, no double-emit.
  *
  * `opts.afterWrite` is invoked inside the same SAVEPOINT as the memories
  * INSERT (mirrors archiveRawMemory's shape in raw-archive.ts). On callback
  * throw, the SAVEPOINT rolls back — the memory row never lands, and the
- * filesystem mirrors / audit emit never run. Used by E1.3+ connectors to
+ * filesystem mirrors / audit emit never run. Used by connectors to
  * stamp idempotency rows atomically with the memory write.
  */
 /**
@@ -180,7 +162,7 @@ export function deleteFtsRow(db, id) {
  * v39 migration found no evidence for" and is deny-by-default in ambient
  * context. A writeback (e.g. markRetrieved on a crossProject-included row)
  * must not launder it into an injectable origin - the migration is the only
- * evidence-based NULL converter (codex gating round 2 P1).
+ * evidence-based NULL converter.
  */
 export function stampOriginProject(hippoRoot, entry) {
     if (entry.origin_project !== undefined)
@@ -194,7 +176,7 @@ export function stampOriginProject(hippoRoot, entry) {
  * backfill. Same evidence order as the migration: the provenance source
  * (`shared:<project>:` / `promoted:<localRoot>`) wins over the destination
  * store's location, so a shared row imported into the global store keeps its
- * owning project instead of becoming user-global (codex gating round 3 P1).
+ * owning project instead of becoming user-global.
  */
 export function stampOriginProjectForImport(hippoRoot, entry) {
     if (entry.origin_project !== undefined)

package/dist/store/entry-writes.d.ts

@@ -1,15 +1,14 @@
 import { type MemoryEntry } from '../memory.js';
 import { type DatabaseSyncLike } from '../db.js';
-export declare function writeEntry(hippoRoot: string, entry: MemoryEntry, opts?: {
+export interface WriteEntryOptions {
     actor?: string;
     afterWrite?: (db: DatabaseSyncLike, memoryId: string) => void;
-    /** Runs AFTER the DB row commits (RELEASE SAVEPOINT in writeEntryDbOnly) but
-     *  BEFORE the markdown mirrors are written. Lets a caller perform a post-commit
-     *  side effect (e.g. mark the graph dirty) that must still happen even if a
-     *  mirror write then throws. Keep it best-effort — it runs on a committed,
-     *  idle connection, so opening another handle inside it is safe. */
+    /** Runs after the row commits and before the mirrors, on an idle connection; keep it best-effort. */
     afterCommit?: () => void;
-}): void;
+}
+export declare function writeEntry(hippoRoot: string, entry: MemoryEntry, opts?: WriteEntryOptions): void;
+/** writeEntry on the caller's open store, so a loop of writes opens the store once; each row still commits alone. */
+export declare function writeEntryOn(db: DatabaseSyncLike, hippoRoot: string, entry: MemoryEntry, opts?: WriteEntryOptions): void;
 /**
  * DB-only write path. Caller owns the open `db` handle. Runs SAVEPOINT +
  * upsert + afterWrite hook + audit row inside the SAVEPOINT scope. Caller