fix(core): recognize a DB-first note's storage echo by its accepted content

[phernandez]

Summary

On production, about 1 in 15 app saves still fully re-indexed its own storage echo. Trace (tenant c4addccf): the materializer finished the S3 PUT at :58.1, the webhook index read entity.checksum at :59.7, and the materializer recorded the new ETag at :00.6. The gate saw the previous ETag and re-read a note the index already held.

• EntityRepository.get_by_file_paths also returns the note's accepted db_checksum (note_content at the same path).
• IndexedChecksums.holds_accepted_content: when the storage checksum does not match, an object whose content checksum equals the accepted one is current.
• A row masked by a pending graph publication (checksum=None) is still read, so the repair path is unchanged; other bytes are read as before.
• move_orphan_checksum_source -> content_checksum_source: it now serves the move-vacate marker and the accepted echo. Locally both checksum domains are SHA-256, so the storage checksum serves both.

Tests

• test-int/test_accepted_content_echo_gate.py (real DB and files): the exact window (accepted revision two in storage, entity still recording revision one) is current; a pending publication still reads; someone else's bytes still read. The accepted case fails without the fix.
• Updated fake rows and expected IndexedChecksums for the fourth column.

Basic Memory Cloud reads the content checksum from the notification's object metadata (bm-file-checksum), so the check adds no storage request for webhook jobs.

🤖 Generated with Claude Code

https://claude.ai/code/session_01T8wjd6HrtSA2LN9ssC4NzF

[chatgpt-codex-connector]

Codex Review Summary

This comment shows the latest Codex review activity on this pull request.

Review	Status	Commit	Review trigger
📝 Code Review	✅ Completed 2026-10-07T21:12:15.902766Z	ad21358	New commits

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: ff026326b0

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[chatgpt-codex-connector]

Handle first-write echoes when the entity checksum is null

When the storage echo belongs to a newly created DB-first note, create_pending_accepted_entity initializes Entity.checksum to None; after graph publication but before materialization records the storage checksum, this produces IndexedChecksums(checksum=None, accepted_content_checksum=<matching hash>). This guard therefore rejects the exact accepted-content match and causes a full read/reindex instead of marking the echo current, leaving the create path exposed to the duplicate indexing/publication work this change is meant to prevent. The new integration test misses this because it first materializes revision one and only simulates an update; distinguish a deliberately masked incomplete projection from a legitimate not-yet-recorded storage checksum and cover the initial-create echo.

AGENTS.md reference: AGENTS.md:L137-L139

Useful? React with 👍 / 👎.

[phernandez]

Fixed in ad21358: the indexed-checksum query applies the incomplete-projection mask to the accepted checksum as well, so a masked row has nothing to match and is still read, and holds_accepted_content no longer requires a storage checksum. New first-write-echo case (entity checksum unset, object holds the accepted content) is current; it fails with the old guard, and repair-still-reads fails if the query stops masking.