fix(memory): read note access from an unlocked snapshot and defer unavailable cleanup

[waleedlatif1]

Summary

• Memory note access (POST /api/mothership/memories/access and the memory_notes_access checkpoint control) now resolves in a read-only repeatable-read transaction with no row or advisory locks. It previously took FOR SHARE on the user, chat, workspace, member and permission rows plus the Project and permission-group locks, so every check committed as a write transaction and blocked writers on those rows (including account deletion's user FOR UPDATE NOWAIT). Allow/deny decisions, permission bits and error codes are unchanged.
• loadProjectAccess, requireCurrentCopilotProjectInvocation, requireProjectFileOwnerRole and requireCurrentFileSubject gain a snapshot mode; every existing caller keeps its locking reads.
• Workspace access resolves once per check and derives shared mutation from the resolved role (requireCurrentHumanRole now returns it) instead of a second role lookup. The projects flag is read before the transaction.
• Memory cleanup events defer hourly without spending attempts when the worker does not serve the cleanup route yet (401 to a customer key, 404/405/501) or when the processor lacks the key or the destination, instead of dead-lettering after ~17 minutes.
• Cleanup drops the credential-fingerprint and source-env equality checks, which failed whenever the outbox processor's environment differed from the enqueuing app's or the key rotated. It replays the enqueuing deployment's source env, sends the key only to destinations the processor configures, and still parses rows queued with the old fields.
• Account deletion enqueues cleanup events in one bulk insert instead of one insert per destination and target.

Type of Change

• Bug fix

Testing

• resolve-access.integration.ts: new case resolves workspace-target access for workspace and organization chats while another transaction holds the user row FOR UPDATE and the Project exclusively (blocks on the previous code).
• cleanup.integration.ts: 404 and an unconfigured destination stay pending with attempts unchanged and an hour's backoff; a row carrying the retired fingerprint field completes (both dead-lettered on the previous code).
• cleanup-outbox.test.ts, workspace-authorization.test.ts; Biome on changed files. Type-check, audits and integration suites run in CI.

Checklist

• Code follows project style guidelines
• Self-reviewed my changes
• Tests added/updated and passing (new tests pass the test-audit authoring gate)
• No new warnings introduced
• I confirm that I have read and agree to the terms outlined in the Contributor License Agreement (CLA)

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

1 Skipped Deployment

Project	Deployment	Actions	Updated
docs	Skipped		Oct 16, 2026 3:00am UTC

[cubic-dev-ai]

No issues found across 9 files

Confidence score: 5/5

• Automated review surfaced no issues in the provided summaries.
• No files require special attention.

_{Turn on auto-fix | Re-trigger cubic}

[greptile-apps]

Confidence Score: 5/5

[High impact] The PR appears safe to merge; no blocking issue was found.

Summary

This PR makes memory access checks use an unlocked, read-only snapshot and lets cleanup wait for missing worker routes or configuration.

• Memory access answers come from one unlocked snapshot.
• Cleanup events wait when their worker or settings are unavailable.
• Account deletion queues memory cleanup events in batches.

No new actionable issues were found. No previous review threads were supplied. Tests were inspected but not run.

Diagram

%%{init: {'theme': 'neutral'}}%%
flowchart TD
  A[Memory access request] --> B[Read account, chat, roles, and policy in one snapshot]
  B --> C[Return access decision]
  D[Account or target deletion] --> E[Queue cleanup in bulk]
  E --> F{Worker route and configuration ready?}
  F -->|No| G[Wait one hour without spending an attempt]
  G --> F
  F -->|Yes| H[Send cleanup with the saved source environment]

Loading

_{Reviews (2) · Last reviewed commit: "fix(memory): accept additive fields in n..." · Reviewed by Greptile}

[waleedlatif1]

@greptile

[waleedlatif1]

@cubic-dev-ai review this PR

[cubic-dev-ai]

@cubic-dev-ai review this PR

@waleedlatif1 I have started the AI code review. It will take a few minutes to complete.

[cubic-dev-ai]

No issues found across 10 files

Confidence score: 5/5

• Automated review surfaced no issues in the provided summaries.
• No files require special attention.

_{Turn on auto-fix | Re-trigger cubic}