Give every memory a node, and show only the ones on your path

A hand-written memory used to carry a NULL depth, described in the model as
"belongs to the adventure rather than to a path". That sounds harmless and
is not: a NULL is a coordinate no fork can cap, so a note typed on one line
followed the reader onto branches whose story it never described. It takes
the head now — the story you were reading when you wrote it — and obeys
exactly the rule a summarised memory obeys.

The unanchored escape clause in lineage.Path.clause existed for that single
case and is deleted rather than left unused. Its docstring argued that a
capped depth would drop a typed memory the moment its branch stopped being
the newest entry; anchoring answers the same worry better, because the
memory is not exempt from the path, it is on one.

The drawer now shows the path being read and nothing else, filtered by the
clause retrieval itself uses, so the bank you can see is the bank the model
can see. Nothing is stranded: a memory lives on a branch, switching to that
branch shows it, and deleting the branch deletes it. Pinning decides order,
the path decides existence.

Migration 62 lands existing NULL-depth memories at depth 0 of their branch
rather than at the tip. 0 is at or before every fork point, so every memory
stays visible from exactly the paths it is visible from today — nobody's
bank loses a row on deploy. The tip is the tidier-sounding choice and would
have emptied them out of every branch forked earlier than they were typed.

This supersedes the on_path flag and the "another branch" badge from
earlier today; anchoring makes them redundant, and they are removed.

Four tests changed because they asserted the old contract, not because
they broke. The one worth reading is the pair replacing
test_a_hand_written_memory_is_not_lost_at_the_first_fork: typed on shared
trunk it still survives a fork, and typed on ground the fork never
travelled it no longer follows you.

402 tests. Verified on tools/branch_fixture.py: each branch's drawer holds
its own memory and not the other's.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_015H5qiyiR7gtFQaoDphHZ3g

backend/app/routers/adventures.py

@@ -4,7 +4,7 @@ import threading
 
 from fastapi import APIRouter, Body, Depends, HTTPException, Request
 from fastapi.responses import StreamingResponse
-from sqlalchemy import func, select
+from sqlalchemy import func
 from sqlalchemy.orm import Session, load_only, undefer
 from sqlalchemy.orm.attributes import set_committed_value
 
@@ -1881,36 +1881,23 @@ def list_memories(
     # model happens to carry. `embedding_blob` is deferred and so would stay
     # out today — this is about the next wide column, not that one.
     #
-    # Adventure-wide, not path-scoped, and that is the split: retrieval reads
-    # the story being played, the drawer manages the bank. Hiding a branch's
-    # memories from the drawer would mean memories nobody can find to delete,
-    # in a phase whose rule is that nothing is ever removed automatically.
-    rows = (
+    # **The bank you can see is the bank the model can see.** Filtered by the
+    # same clause retrieval uses, so the drawer answers one question rather than
+    # two: an adventure-wide list would show memories from branches this story
+    # never went down, which are never retrieved, and a reader has no way to
+    # tell those apart from the ones actually in play. Nothing is stranded by
+    # this — a memory lives on a branch, so switching to that branch shows it,
+    # and deleting the branch takes its memories with it.
+    return (
         db.query(models.Memory)
         .options(load_only(*MEMORY_LIST_COLUMNS))
-        .filter(models.Memory.adventure_id == adventure_id)
+        .filter(
+            models.Memory.adventure_id == adventure_id,
+            lineage.path_of(db, adventure).clause(models.Memory),
+        )
         .order_by(models.Memory.id)
         .all()
     )
-    # ...but listing them alike would be its own lie. A memory on a branch this
-    # story never travelled is never retrieved, so showing it beside one that is
-    # tells the player the model remembers something it cannot see. The ids come
-    # from **the predicate retrieval itself uses**, deliberately: two spellings
-    # of "on this path" would eventually disagree, and the failure would be a
-    # badge that says the opposite of what the model gets.
-    on_path = {
-        row[0] for row in db.execute(
-            select(models.Memory.id).where(
-                models.Memory.adventure_id == adventure_id,
-                lineage.path_of(db, adventure).clause(
-                    models.Memory, unanchored=True
-                ),
-            )
-        )
-    }
-    for row in rows:
-        row.on_path = row.id in on_path
-    return rows
 
 
 @router.post("/{adventure_id}/memories", response_model=schemas.MemoryOut, status_code=201)