fix: address Codex review P1/P2 findings on d5dbcdb

5 fixes for issues flagged by the Codex reviewer:

- P1 service.py: historical supports query now filters by
  memory.workspace_id so a cross-workspace support cannot leak into
  the include_history scene.
- P2 service.py: evidence facets (memory_types, time_from, time_to) are
  applied in history mode instead of being skipped by the live-only
  evidence_filter short-circuit.
- P2 service.py: entity candidate cap applies after session-scope
  pruning so private evidence cannot crowd out public entities.
- P1 engine.py: secure_erase re-checks successors after the potentially
  long index.delete and cleans up any new target IDs before calling
  store.secure_erase_memory.
- P2 graph_scene.py: ghost canonical nodes that collide with a live
  canonical_id are keyed as :ghost so the live node keeps its mass,
  community, and relations.

Co-authored-by: Codex review bot (addressed findings from d5dbcdb)

Author: Coding-Dev-Tools

engraphis/core/engine.py

@@ -2539,6 +2539,19 @@ def secure_erase(self, memory_id: str, *, actor: str = "user") -> dict:
             index_cleanup = "deleted"
         except Exception:  # noqa: BLE001 - must still erase the authoritative local copy
             index_cleanup = "failed"
+        # Re-check successors after the (potentially long) index.delete: a
+        # concurrent write or sync may have produced a new replacement while
+        # the vector backend was busy. secure_erase_memory re-computes its own
+        # target set, but we want the vector side to observe any new IDs too.
+        if index_cleanup == "deleted":
+            refreshed = self.store.secure_erase_target_ids(memory_id)
+            new_ids = set(refreshed) - set(target_ids)
+            if new_ids:
+                try:
+                    self.index.delete(list(new_ids))
+                except Exception:  # noqa: BLE001
+                    index_cleanup = "partial"
+            target_ids = refreshed
         result = self.store.secure_erase_memory(
             memory_id, actor=actor, _target_ids=target_ids,
         )

engraphis/core/graph_scene.py

@@ -2127,6 +2127,12 @@ def build_graph_scene(
             [], [], min_support=0,
         )
         for node_id, node in historical_graph["nodes"].items():
+            live = graph["nodes"].get(node_id)
+            if live is not None:
+                # The canonical ID already holds a live evidence node.
+                # Record the historical-only alias under a distinct key so
+                # the live node keeps its mass, community, and relations.
+                node_id = f"{node_id}:ghost"
             node["ghost"] = True
             node["mass_score"] = 0.0
             node["gravity_mass"] = 0.0
@@ -2158,9 +2164,26 @@ def build_graph_scene(
                 if values:
                     node[field] = max(values) if field in {"valid_to", "expired_at"} else min(values)
             graph["nodes"][node_id] = node
-        graph["member_to_canonical"].update(historical_graph["member_to_canonical"])
-        graph["community_members"].update(historical_graph["community_members"])
-        graph["community_anchors"].update(historical_graph["community_anchors"])
+        for member, canonical in historical_graph["member_to_canonical"].items():
+            if canonical in graph["nodes"]:
+                # Route the member to the ghost alias when the live slot
+                # is already occupied so member_to_canonical stays a bijection.
+                if graph["nodes"][canonical].get("ghost") is not True:
+                    canonical = f"{canonical}:ghost"
+            graph["member_to_canonical"][member] = canonical
+        for community_id, members in historical_graph["community_members"].items():
+            existing = graph["community_members"].get(community_id)
+            if existing is None:
+                graph["community_members"][community_id] = list(members)
+            else:
+                seen = set(existing)
+                for member_id in members:
+                    if member_id not in seen:
+                        existing.append(member_id)
+                        seen.add(member_id)
+        for community_id, anchor in historical_graph["community_anchors"].items():
+            if community_id not in graph["community_anchors"]:
+                graph["community_anchors"][community_id] = anchor
 
     if connected_only:
         connected_canonical_ids = {

engraphis/service.py

@@ -7724,11 +7724,39 @@ def _graph_scene_rows_unlocked(self, *, workspace: str, repo: Optional[str] = No
                 marks = ",".join("?" for _ in clean_types)
                 entity_sql += f" AND etype IN ({marks})"
                 entity_params.extend(clean_types)
+        # Fetch with generous headroom; the entity cap applies after
+        # session-scope pruning so private evidence cannot crowd out
+        # public entities in the candidate set.
         entity_sql += " ORDER BY canonical_id, id LIMIT ?"
         entity_params.append(MAX_GRAPH_ANALYSIS_ENTITIES * 3 + 1)
-        entity_rows = [dict(row) for row in self.store.conn.execute(
+        raw_entity_rows = [dict(row) for row in self.store.conn.execute(
             entity_sql, entity_params
         ).fetchall()]
+        # _graph_entity_visibility_sql requires an EXISTS check against
+        # memories. Apply it before the cap so session-private evidence
+        # does not consume the candidate budget.
+        entity_rows = []
+        for start in range(0, len(raw_entity_rows), 500):
+            chunk = raw_entity_rows[start:start + 500]
+            chunk_ids = [row.get("id") for row in chunk]
+            if not chunk_ids:
+                continue
+            marks = ",".join("?" for _ in chunk_ids)
+            visible = {
+                r["id"] for r in self.store.conn.execute(
+                    f"SELECT DISTINCT entity.id FROM entities entity "
+                    f"WHERE entity.id IN ({marks}) AND "
+                    + _graph_entity_visibility_sql("entity"),
+                    chunk_ids,
+                ).fetchall()
+            }
+            for row in chunk:
+                if row.get("id") in visible:
+                    entity_rows.append(row)
+                    if len(entity_rows) > MAX_GRAPH_ANALYSIS_ENTITIES:
+                        break
+            if len(entity_rows) > MAX_GRAPH_ANALYSIS_ENTITIES:
+                break
 
         edge_sql = (
             "SELECT id, workspace_id, repo_id, src, dst, relation, layer, weight, "
@@ -7766,14 +7794,15 @@ def _graph_scene_rows_unlocked(self, *, workspace: str, repo: Optional[str] = No
         # History visibility is enforced by ``_graph_edge_history_visibility_sql``.
         # The ordinary evidence predicate below is intentionally live-only and would
         # otherwise erase the closed relations that history mode is meant to expose.
-        evidence_filter = not include_history
+        evidence_filter = not include_history and not prune_entities
         prune_entities = bool(
             clean_memory_types or lower_time is not None or upper_time is not None
         )
         allow_supportless = not (
             clean_memory_types or lower_time is not None or upper_time is not None
         )
-        if evidence_filter:
+        if prune_entities and include_history:
+            evidence_filter = True
             edge_sql += " AND ("
             if allow_supportless:
                 edge_sql += (
@@ -8117,8 +8146,9 @@ def _graph_scene_rows_unlocked(self, *, workspace: str, repo: Optional[str] = No
                     "AND (memory.ingested_at IS NULL OR memory.ingested_at<=?) "
                     "AND memory.expired_at IS NULL "
                     "AND COALESCE(memory.scope, 'workspace')!='session' "
+                    "AND memory.workspace_id=? "
                     "ORDER BY support.edge_id, support.memory_id, support.source_kind",
-                    [*chunk, t, known_t, t, known_t],
+                    [*chunk, t, known_t, t, known_t, wid],
                 ).fetchall()
                 historical_supports.extend(dict(row) for row in rows)
             for support in historical_supports: