@remit/backend 0.0.68 → 0.0.70

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@remit/backend",
-  "version": "0.0.68",
+  "version": "0.0.70",
   "description": "Remit Mail Inspector API backend",
   "license": "MIT",
   "author": "",

package/src/handlers/system-update.test.ts

@@ -341,4 +341,26 @@ describe("POST /system/update", () => {
 			assert.ok(!(forbidden in request));
 		}
 	});
+
+	it("stamps requestedAt with the moment of the request, in UTC", async () => {
+		// The updater installs a request only while it is still current (#587), so
+		// requestedAt is the field that decides it. A missing, fixed or non-UTC
+		// stamp would make every request expire on arrival.
+		writeState(okState);
+		const before = Date.now();
+
+		await applyUpdate("v1.5.0", buildEvent(USER));
+
+		const after = Date.now();
+		const request = JSON.parse(
+			readFileSync(join(controlDir, "request.json"), "utf8"),
+		) as { requestedAt: string };
+
+		assert.match(
+			request.requestedAt,
+			/^\d{4}-\d{2}-\d{2}T\d{2}:\d{2}:\d{2}(\.\d+)?Z$/,
+		);
+		const stamped = Date.parse(request.requestedAt);
+		assert.ok(stamped >= before - 1000 && stamped <= after + 1000);
+	});
 });

package/src/service/organize.test.ts

@@ -1,6 +1,10 @@
 import assert from "node:assert/strict";
 import { afterEach, beforeEach, describe, it } from "node:test";
-import type { FilterAnchorItem, FilterItem } from "@remit/data-ports";
+import type {
+	CreateFilterAnchorInput,
+	FilterAnchorItem,
+	FilterItem,
+} from "@remit/data-ports";
 import { BadRequestError, NotFoundError } from "@remit/data-ports/errors";
 import { FilterMatchOperator, FilterState } from "@remit/domain-enums";
 import type {
@@ -17,7 +21,10 @@ import {
 	type OrganizeMatchDeps,
 	type OrganizePredicate,
 } from "./organize.js";
-import { _resetSemanticCapabilityForTest } from "./semantic-capability.js";
+import {
+	_resetSemanticCapabilityForTest,
+	isSemanticSearchUnavailable,
+} from "./semantic-capability.js";
 
 const moduleNotFound = (): Error => {
 	const error = new Error("Cannot find package 'sqlite-vec' imported from …");
@@ -28,11 +35,16 @@ const moduleNotFound = (): Error => {
 const ACCOUNT_CONFIG_ID = "cfg-1";
 const ANCHOR_VECTOR = [1, 0, 0, 0];
 const ORTHOGONAL_VECTOR = [0, 1, 0, 0];
+/** The model the fixtures' embedder is currently configured with. */
+const CURRENT_EMBEDDING_ID = "test-model@4";
+/** The model a persisted anchor was written under before a same-dimension swap. */
+const STALE_EMBEDDING_ID = "older-model@4";
+const ANCHOR_SOURCE_TEXT = "book me a table";
 
 const anchorPayload: AnchorPayload = {
 	anchorEmbedding: ANCHOR_VECTOR,
-	anchorEmbeddingId: "test-model@4",
-	anchorSourceText: "book me a table",
+	anchorEmbeddingId: CURRENT_EMBEDDING_ID,
+	anchorSourceText: ANCHOR_SOURCE_TEXT,
 };
 
 const metadata = (over: Partial<ChunkMetadata>): ChunkMetadata => ({
@@ -113,6 +125,7 @@ const trackingClient = (
 	const labeled: Array<{ messageId: string; labelId: string }> = [];
 	let filterWrites = 0;
 	let filterAnchorWrites = 0;
+	const anchorPuts: CreateFilterAnchorInput[] = [];
 	const activeFilters = seed.activeFilters ?? [];
 	const filterAnchorRows = seed.filterAnchorRows ?? [];
 	const threadMessages = seed.threadMessages ?? {};
@@ -162,9 +175,16 @@ const trackingClient = (
 			refreshExpiry: async (filter: FilterItem) => filter,
 		},
 		filterAnchor: {
-			put: async () => {
+			put: async (input: CreateFilterAnchorInput) => {
 				filterAnchorWrites += 1;
-				return {} as never;
+				anchorPuts.push(input);
+				const row: FilterAnchorItem = { ...input, createdAt: 0, updatedAt: 1 };
+				const at = filterAnchorRows.findIndex(
+					(existing) => existing.filterId === input.filterId,
+				);
+				if (at === -1) filterAnchorRows.push(row);
+				else filterAnchorRows[at] = row;
+				return row;
 			},
 			get: async (_accountConfigId: string, filterId: string) =>
 				filterAnchorRows.find((row) => row.filterId === filterId) ?? null,
@@ -176,6 +196,7 @@ const trackingClient = (
 		labeled,
 		filterWrites: () => filterWrites,
 		filterAnchorWrites: () => filterAnchorWrites,
+		anchorPuts,
 	};
 };
 
@@ -238,10 +259,16 @@ const matchDeps = (
 				vectorStore: store,
 				embed: async (text: string) =>
 					text.includes("reservation") ? ANCHOR_VECTOR : ORTHOGONAL_VECTOR,
+				embeddingId: CURRENT_EMBEDDING_ID,
 			};
 		},
 		listAccountFilterMessages: async () => corpus,
-		filterAnchors: { listByAccountConfig: async () => filterAnchorRows },
+		filterAnchors: {
+			listByAccountConfig: async () => filterAnchorRows,
+			put: async () => {
+				throw new Error("matchDeps must not repair an anchor");
+			},
+		},
 		semanticBuilds: () => semanticBuilds,
 	};
 };
@@ -273,10 +300,16 @@ const vectorlessDeps = (
 				embed: async () => {
 					throw moduleNotFound();
 				},
+				embeddingId: CURRENT_EMBEDDING_ID,
 			};
 		},
 		listAccountFilterMessages: async () => corpus,
-		filterAnchors: { listByAccountConfig: async () => [] },
+		filterAnchors: {
+			listByAccountConfig: async () => [],
+			put: async () => {
+				throw moduleNotFound();
+			},
+		},
 		semanticUsed: () => semanticUsed,
 	};
 };
@@ -391,8 +424,8 @@ describe("matchOrganize honors the persisted FilterAnchor (reader #350)", () =>
 			accountConfigId: ACCOUNT_CONFIG_ID,
 			filterId: "filter-a",
 			anchorEmbedding: ANCHOR_VECTOR,
-			anchorEmbeddingId: "test-model@4",
-			anchorSourceText: "book me a table",
+			anchorEmbeddingId: CURRENT_EMBEDDING_ID,
+			anchorSourceText: ANCHOR_SOURCE_TEXT,
 			anchorMessageId: "msg-anchor",
 			createdAt: 0,
 			updatedAt: 0,
@@ -409,9 +442,15 @@ describe("matchOrganize honors the persisted FilterAnchor (reader #350)", () =>
 				},
 				vectorStore: store,
 				embed: async () => ANCHOR_VECTOR,
+				embeddingId: CURRENT_EMBEDDING_ID,
 			}),
 			listAccountFilterMessages: async () => [],
-			filterAnchors: { listByAccountConfig: async () => [persistedAnchor] },
+			filterAnchors: {
+				listByAccountConfig: async () => [persistedAnchor],
+				put: async () => {
+					throw new Error("a current anchor must not be rewritten");
+				},
+			},
 		};
 
 		const { messageIds } = await matchOrganize(
@@ -542,6 +581,67 @@ describe("matchOrganize on a deployment without the vector pipeline", () => {
 		assert.equal(semanticUnavailable, true);
 	});
 
+	it("keeps widening from a drifted persisted anchor when no embedding model is available", async () => {
+		// Self-host: sqlite-vec is present, `@huggingface/transformers` is not.
+		// The anchor's stamp will never match — after a model swap, or forever
+		// for one pooled from pre-#349 chunks and stamped
+		// UNKNOWN_CHUNK_EMBEDDING_ID — and there is no embedder to repair it
+		// with, so the widen must query with the vector it has rather than go
+		// dark and take every later /search/semantic with it.
+		const store = createMemoryVectorStore();
+		await store.upsert([
+			bodyChunk("msg-1", ANCHOR_VECTOR),
+			bodyChunk("msg-stored-space", ORTHOGONAL_VECTOR),
+		]);
+		const drifted: FilterAnchorItem = {
+			accountConfigId: ACCOUNT_CONFIG_ID,
+			filterId: "filter-a",
+			anchorEmbedding: ORTHOGONAL_VECTOR,
+			anchorEmbeddingId: STALE_EMBEDDING_ID,
+			anchorSourceText: ANCHOR_SOURCE_TEXT,
+			anchorMessageId: "msg-anchor",
+			createdAt: 0,
+			updatedAt: 0,
+		};
+		const deps: OrganizeMatchDeps = {
+			semantic: () => ({
+				buildAnchor: async () => {
+					throw new Error("a persisted anchor must not be re-derived");
+				},
+				vectorStore: store,
+				embed: async () => {
+					throw moduleNotFound();
+				},
+				embeddingId: CURRENT_EMBEDDING_ID,
+			}),
+			listAccountFilterMessages: async () => [],
+			filterAnchors: {
+				listByAccountConfig: async () => [drifted],
+				put: async () => {
+					throw new Error("an unrepairable anchor must not be rewritten");
+				},
+			},
+		};
+
+		const { messageIds, semanticUnavailable } = await matchOrganize(
+			deps,
+			ACCOUNT_CONFIG_ID,
+			predicate(),
+		);
+
+		assert.deepEqual(
+			messageIds,
+			["msg-stored-space"],
+			"the kNN read needs no embedder, so the stored anchor vector still returns real hits",
+		);
+		assert.equal(semanticUnavailable, false);
+		assert.equal(
+			isSemanticSearchUnavailable(),
+			false,
+			"one unrepairable anchor must not disable free-text semantic search for the rest of the process",
+		);
+	});
+
 	it("propagates a genuine (non-capability) semantic failure loudly", async () => {
 		const deps: OrganizeMatchDeps = {
 			semantic: () => ({
@@ -553,9 +653,15 @@ describe("matchOrganize on a deployment without the vector pipeline", () => {
 					getByMessage: async () => [],
 				},
 				embed: async () => [],
+				embeddingId: CURRENT_EMBEDDING_ID,
 			}),
 			listAccountFilterMessages: async () => [],
-			filterAnchors: { listByAccountConfig: async () => [] },
+			filterAnchors: {
+				listByAccountConfig: async () => [],
+				put: async () => {
+					throw new Error("unreachable");
+				},
+			},
 		};
 
 		await assert.rejects(
@@ -885,8 +991,8 @@ describe("applyOrganize resolves move precedence against current Active filters
 			accountConfigId: ACCOUNT_CONFIG_ID,
 			filterId: "filter-newer-semantic",
 			anchorEmbedding: ANCHOR_VECTOR,
-			anchorEmbeddingId: "test-model@4",
-			anchorSourceText: "book me a table",
+			anchorEmbeddingId: CURRENT_EMBEDDING_ID,
+			anchorSourceText: ANCHOR_SOURCE_TEXT,
 			anchorMessageId: "msg-anchor-2",
 			createdAt: 0,
 			updatedAt: 0,
@@ -923,6 +1029,186 @@ describe("applyOrganize resolves move precedence against current Active filters
 	});
 });
 
+/**
+ * A same-dimension embedding-model swap leaves every persisted FilterAnchor
+ * stamped with the old model's id and its vector in the old model's space.
+ * Index-time matching repairs that lazily (RFC 039 Decision 1a); the
+ * back-apply paths must do the same, or they score a current-model vector
+ * against a stale-model anchor and silently disagree with the pipeline they
+ * claim to mirror (reader #399).
+ */
+describe("back-apply repairs a drifted anchor the way index-time matching does (reader #399)", () => {
+	const staleAnchor = (
+		filterId: string,
+		// Written under the previous model: same dimensions, different space, so
+		// nothing but the id stamp distinguishes it from a usable anchor.
+		anchorEmbedding: number[] = ORTHOGONAL_VECTOR,
+	): FilterAnchorItem => ({
+		accountConfigId: ACCOUNT_CONFIG_ID,
+		filterId,
+		anchorEmbedding,
+		anchorEmbeddingId: STALE_EMBEDDING_ID,
+		anchorSourceText: ANCHOR_SOURCE_TEXT,
+		anchorMessageId: "msg-anchor",
+		createdAt: 0,
+		updatedAt: 0,
+	});
+
+	/** Every text embeds into the current model's space. */
+	const currentModelDeps = (
+		store: ReturnType<typeof createMemoryVectorStore>,
+		anchors: FilterAnchorItem[],
+		embed: (text: string) => Promise<number[]> = async () => ANCHOR_VECTOR,
+	): OrganizeMatchDeps & { anchorPuts: CreateFilterAnchorInput[] } => {
+		const anchorPuts: CreateFilterAnchorInput[] = [];
+		return {
+			semantic: () => ({
+				buildAnchor: async () => {
+					throw new Error("a persisted anchor must be repaired, not replaced");
+				},
+				vectorStore: store,
+				embed,
+				embeddingId: CURRENT_EMBEDDING_ID,
+			}),
+			listAccountFilterMessages: async () => [],
+			filterAnchors: {
+				listByAccountConfig: async () => anchors,
+				put: async (input: CreateFilterAnchorInput) => {
+					anchorPuts.push(input);
+					return { ...input, createdAt: 0, updatedAt: 1 };
+				},
+			},
+			anchorPuts,
+		};
+	};
+
+	it("matchSemantic re-embeds a drifted persisted anchor instead of querying with the stale vector", async () => {
+		const store = createMemoryVectorStore();
+		await store.upsert([
+			bodyChunk("msg-1", ANCHOR_VECTOR),
+			bodyChunk("msg-stale-space", ORTHOGONAL_VECTOR),
+		]);
+		const deps = currentModelDeps(store, [staleAnchor("filter-a")]);
+
+		const { messageIds } = await matchOrganize(
+			deps,
+			ACCOUNT_CONFIG_ID,
+			predicate(),
+		);
+
+		assert.deepEqual(
+			messageIds,
+			["msg-1"],
+			"the widen runs on the re-embedded anchor, not the stale-space vector that would have matched msg-stale-space",
+		);
+		assert.deepEqual(
+			deps.anchorPuts.map((put) => [put.filterId, put.anchorEmbeddingId]),
+			[["filter-a", CURRENT_EMBEDDING_ID]],
+			"the repair is written back in place under the current model's id",
+		);
+		assert.deepEqual(deps.anchorPuts[0].anchorEmbedding, ANCHOR_VECTOR);
+		assert.equal(deps.anchorPuts[0].anchorSourceText, ANCHOR_SOURCE_TEXT);
+	});
+
+	it("filterCurrentlyMatches re-embeds a drifted anchor, so the drifted filter still outranks the move", async () => {
+		const store = createMemoryVectorStore();
+		await store.upsert([bodyChunk("msg-1", ANCHOR_VECTOR)]);
+		const p = predicate({
+			actionLabelId: "lbl-1",
+			actionMailboxId: "mbox-old",
+		});
+		const newerSemanticFilter = filterItem({
+			filterId: "filter-newer-semantic",
+			ruleChangedAt: 1_000,
+			actionChangedAt: 1_000,
+			actionMailboxId: "mbox-new",
+			hasAnchor: true,
+		});
+		const drifted = staleAnchor("filter-newer-semantic");
+
+		const { messageIds: matched } = await matchOrganize(
+			matchDeps(store),
+			ACCOUNT_CONFIG_ID,
+			p,
+		);
+		const tracked = trackingClient({
+			activeFilters: [newerSemanticFilter],
+			filterAnchorRows: [drifted],
+			threadMessages: { "msg-1": { subject: "Dinner reservation" } },
+		});
+		const mover = trackingMoveService();
+		const result = await applyOrganize(
+			{
+				client: tracked.client,
+				moveService: mover.moveService,
+				match: currentModelDeps(store, [drifted]),
+			},
+			ACCOUNT_CONFIG_ID,
+			matched,
+			p,
+		);
+
+		assert.equal(result.applied, 1);
+		assert.deepEqual(
+			mover.moves,
+			[],
+			"scored against the re-embedded anchor the newer filter contests the move; against the stale one it would silently lose",
+		);
+		assert.deepEqual(
+			tracked.anchorPuts.map((put) => [put.filterId, put.anchorEmbeddingId]),
+			[["filter-newer-semantic", CURRENT_EMBEDDING_ID]],
+			"the repair is written back in place, not left for the next pass",
+		);
+	});
+
+	it("keeps a failed re-embed isolated to its own filter rather than throwing out of the arbitration", async () => {
+		const store = createMemoryVectorStore();
+		await store.upsert([bodyChunk("msg-1", ANCHOR_VECTOR)]);
+		const p = predicate({ actionMailboxId: "mbox-target" });
+		// The stale vector would score a match, so scoring against it — which is
+		// exactly what this path did before the repair existed — suppresses the
+		// move. A stamp that cannot be honoured is not a match: the filter is
+		// skipped and loudly logged, and the rest of the pass is unaffected.
+		const drifted = staleAnchor("filter-broken-anchor", ANCHOR_VECTOR);
+		const tracked = trackingClient({
+			activeFilters: [
+				filterItem({
+					filterId: "filter-broken-anchor",
+					ruleChangedAt: 1_000,
+					actionChangedAt: 1_000,
+					actionMailboxId: "mbox-elsewhere",
+					hasAnchor: true,
+				}),
+			],
+			filterAnchorRows: [drifted],
+			threadMessages: { "msg-1": { subject: "Dinner reservation" } },
+		});
+		const mover = trackingMoveService();
+
+		const result = await applyOrganize(
+			{
+				client: tracked.client,
+				moveService: mover.moveService,
+				match: currentModelDeps(store, [drifted], async (text) => {
+					if (text === ANCHOR_SOURCE_TEXT) throw new Error("embedder refused");
+					return ANCHOR_VECTOR;
+				}),
+			},
+			ACCOUNT_CONFIG_ID,
+			["msg-1"],
+			p,
+		);
+
+		assert.equal(result.applied, 1);
+		assert.equal(result.failed, 0);
+		assert.deepEqual(
+			mover.moves.map((move) => move.destinationMailboxId),
+			["mbox-target"],
+			"an un-repairable anchor skips its own filter — it neither decides the arbitration on a stale score nor aborts the pass",
+		);
+	});
+});
+
 describe("matchOrganize with ListId and FromDomain clauses", () => {
 	const senderChunk = (
 		messageId: string,

package/src/service/organize.ts

@@ -1,11 +1,15 @@
+import { inspect } from "node:util";
 import type {
+	FilterAnchorItem,
 	FilterItem,
 	IFilterAnchorRepository,
 	OrganizeJobRequestItem,
 } from "@remit/data-ports";
 import { BadRequestError, NotFoundError } from "@remit/data-ports/errors";
 import { FilterClauseField, FilterState } from "@remit/domain-enums";
+import { logger } from "@remit/logger-lambda";
 import {
+	type AnchorEmbedder,
 	buildMatchText,
 	cosineSimilarity,
 	DEFAULT_SEMANTIC_MATCH_THRESHOLD,
@@ -13,6 +17,7 @@ import {
 	literalClausesMatch,
 	NO_ACTION,
 	PlacementMoveService,
+	refreshAnchorForEmbedder,
 	selectMoveWinner,
 } from "@remit/mailbox-service";
 import {
@@ -26,7 +31,10 @@ import {
 	buildVectorStoreFromEnv,
 } from "@remit/search-service/from-env";
 import type { RemitClient } from "./data-client.js";
-import { noteSemanticCapabilityAbsence } from "./semantic-capability.js";
+import {
+	isSemanticCapabilityAbsence,
+	noteSemanticCapabilityAbsence,
+} from "./semantic-capability.js";
 
 /**
  * Hard cap on both the previewed and the applied set. A back-apply is a
@@ -96,6 +104,13 @@ export interface OrganizeSemanticDeps {
 	 * kNN read (see `semantic-capability.ts`).
 	 */
 	embed: (text: string) => Promise<number[]>;
+	/**
+	 * The configured model's `<modelId>@<dimensions>` id, compared against a
+	 * persisted anchor's `anchorEmbeddingId` to catch a same-dimension model
+	 * swap that would otherwise score a current-model vector against a
+	 * stale-model anchor (RFC 039 Decision 1a, reader #399).
+	 */
+	readonly embeddingId: string;
 }
 
 /**
@@ -133,8 +148,10 @@ export interface OrganizeMatchDeps {
 	 * "the standing filter this anchor came from," if one still exists, to
 	 * read its fixed-at-save-time vector instead of re-deriving one from the
 	 * anchor message's current chunks (reader #350 / RFC 039 Decision 1).
+	 * `put` is the write half of the lazy anchor-drift repair
+	 * ({@link refreshAnchorForEmbedder}), never a new standing rule.
 	 */
-	filterAnchors: Pick<IFilterAnchorRepository, "listByAccountConfig">;
+	filterAnchors: Pick<IFilterAnchorRepository, "listByAccountConfig" | "put">;
 }
 
 /** The matched ids plus whether the semantic widen was skipped as unavailable. */
@@ -189,31 +206,67 @@ const filterMessageFromChunks = (
  * rows, read-only, and never touches the vector store. Returns `undefined`
  * when no standing filter was ever anchored on this message (or it has since
  * been deleted), in which case the caller falls back to deriving the anchor
- * live from the message's current chunk vectors, exactly as before.
+ * live from the message's current chunk vectors, exactly as before. The whole
+ * row is returned, not just its payload, so the caller can run the same
+ * anchor-drift repair index-time matching does.
  */
 const findPersistedAnchor = async (
 	filterAnchors: Pick<IFilterAnchorRepository, "listByAccountConfig">,
 	accountConfigId: string,
 	anchorMessageId: string,
-): Promise<AnchorPayload | undefined> => {
-	const anchors = await filterAnchors.listByAccountConfig(accountConfigId);
-	const persisted = anchors.find(
+): Promise<FilterAnchorItem | undefined> =>
+	(await filterAnchors.listByAccountConfig(accountConfigId)).find(
 		(anchor) => anchor.anchorMessageId === anchorMessageId,
 	);
-	if (!persisted) return undefined;
-	return {
-		anchorEmbedding: persisted.anchorEmbedding,
-		anchorEmbeddingId: persisted.anchorEmbeddingId,
-		anchorSourceText: persisted.anchorSourceText,
-	};
-};
+
+/**
+ * The anchor the widen queries with: the persisted row, re-embedded in place
+ * when the embedding model has drifted since it was written. A deployment that
+ * ships no embedding model cannot repair it, and the kNN read itself needs
+ * none, so that case keeps querying with the stored vector rather than going
+ * dark — and is classified without recording the absence, which would
+ * otherwise disable every later `/search/semantic` (see
+ * `semantic-capability.ts`).
+ *
+ * The classifier is wider than a missing embedder: `LocalEmbeddingService`
+ * raises ERR_EMBEDDING_MODEL_UNAVAILABLE for anything that stops the pipeline
+ * loading, a corrupt model file included, and a write failure carrying one of
+ * those codes lands here too. Any of them falls back to the stale vector, so
+ * the fallback is logged — it is the wrong-score condition this repair exists
+ * to close, taken deliberately over returning nothing. Every other failure
+ * propagates.
+ */
+const anchorForWiden = async (
+	deps: OrganizeMatchDeps,
+	semantic: OrganizeSemanticDeps,
+	persisted: FilterAnchorItem,
+): Promise<FilterAnchorItem> =>
+	refreshAnchorForEmbedder(
+		{ anchorRepository: deps.filterAnchors, embedder: semantic },
+		persisted,
+	).catch((error: unknown) => {
+		if (!isSemanticCapabilityAbsence(error)) throw error;
+		logger.warn(
+			{
+				alert: "filter_anchor_repair_unavailable",
+				filterId: persisted.filterId,
+				accountConfigId: persisted.accountConfigId,
+				errorName: (error as { name?: string })?.name,
+				error: inspect(error),
+			},
+			"Cannot re-embed a drifted anchor in this deployment; widening on the stored (previous-model) vector rather than returning nothing",
+		);
+		return persisted;
+	});
 
 /**
  * The semantic (anchor) arm: read the anchor vector — the persisted
  * `FilterAnchor` for a message a standing filter was built from (fixed at
  * save time, unaffected by the anchor message's later deletion or
- * re-chunking), or else pool it fresh from the anchor message's existing
- * chunk vectors, the same as before this filter existed or ever had one.
+ * re-chunking, and re-embedded in place when the embedding model has drifted
+ * since — {@link refreshAnchorForEmbedder}), or else pool it fresh from the
+ * anchor message's existing chunk vectors, the same as before this filter
+ * existed or ever had one.
  * Fan out with a k-NN query gated on the cosine threshold, then refine by
  * literal clauses reconstructed from the same chunk vectors. Every read here
  * goes through the vector store; a deployment without the vector pipeline
@@ -228,13 +281,14 @@ const matchSemantic = async (
 	limit: number,
 ): Promise<string[] | null> => {
 	const semantic = deps.semantic();
-	const anchor =
-		(await findPersistedAnchor(
-			deps.filterAnchors,
-			accountConfigId,
-			predicate.anchorMessageId,
-		)) ??
-		(await semantic.buildAnchor(accountConfigId, predicate.anchorMessageId));
+	const persisted = await findPersistedAnchor(
+		deps.filterAnchors,
+		accountConfigId,
+		predicate.anchorMessageId,
+	);
+	const anchor: AnchorPayload | null = persisted
+		? await anchorForWiden(deps, semantic, persisted)
+		: await semantic.buildAnchor(accountConfigId, predicate.anchorMessageId);
 	if (!anchor) return null;
 	const threshold =
 		predicate.similarityThreshold ?? DEFAULT_SEMANTIC_MATCH_THRESHOLD;
@@ -408,6 +462,7 @@ const buildSemanticFromEnv = (): OrganizeSemanticDeps => {
 			buildMessageAnchor({ store }, { accountConfigId, anchorMessageId }),
 		vectorStore: store,
 		embed: async (text) => (await embedder.embed([text]))[0],
+		embeddingId: embedder.embeddingId,
 	};
 	return cachedSemantic;
 };
@@ -548,14 +603,18 @@ const findFilterMessageForPrecedence = async (
  * Whether one *other* Active filter with a move action currently matches this
  * message — mirrors `FilterPipeline.filterMatches` (mailbox-service
  * filters/pipeline.ts) exactly: literal clauses first, then, for a filter
- * with a semantic anchor, its own persisted `FilterAnchor` compared against
+ * with a semantic anchor, its own persisted `FilterAnchor` — re-embedded in
+ * place through the same {@link refreshAnchorForEmbedder} the pipeline calls
+ * when the model has drifted since the anchor was written — compared against
  * the candidate's embedding. A stale/incompatible anchor on the *other*
  * filter is isolated to that filter (skipped, not thrown) — the same
- * resilience `filterMatches` gives index-time matching, so one bad anchor
- * elsewhere never breaks this back-apply's move.
+ * resilience `filterMatches` gives index-time matching, so one bad anchor,
+ * or one anchor that cannot be re-embedded, never breaks this back-apply's
+ * move.
  */
 const filterCurrentlyMatches = async (
-	filterAnchorService: Pick<IFilterAnchorRepository, "get">,
+	filterAnchorService: Pick<IFilterAnchorRepository, "get" | "put">,
+	embedder: () => AnchorEmbedder,
 	accountConfigId: string,
 	filter: FilterItem,
 	msg: FilterMessage,
@@ -567,21 +626,37 @@ const filterCurrentlyMatches = async (
 	if (!filter.hasAnchor) {
 		return filter.literalClauses.length > 0;
 	}
-	const anchor = await filterAnchorService.get(
+	const stored = await filterAnchorService.get(
 		accountConfigId,
 		filter.filterId,
 	);
-	if (!anchor) return false;
+	if (!stored) return false;
 	const vector = await embed();
 	if (!vector) return false;
-	try {
-		return (
-			cosineSimilarity(vector, anchor.anchorEmbedding) >=
-			DEFAULT_SEMANTIC_MATCH_THRESHOLD
+	const repairAnchor = async (): Promise<FilterAnchorItem> =>
+		refreshAnchorForEmbedder(
+			{ anchorRepository: filterAnchorService, embedder: embedder() },
+			stored,
 		);
-	} catch {
-		return false;
-	}
+	return repairAnchor()
+		.then(
+			(anchor) =>
+				cosineSimilarity(vector, anchor.anchorEmbedding) >=
+				DEFAULT_SEMANTIC_MATCH_THRESHOLD,
+		)
+		.catch((error: unknown) => {
+			logger.error(
+				{
+					alert: "filter_anchor_match_failed",
+					filterId: filter.filterId,
+					accountConfigId,
+					errorName: (error as { name?: string })?.name,
+					error: inspect(error),
+				},
+				"Filter anchor comparison failed during back-apply precedence; skipping this filter, the rest still arbitrate (bad/stale anchor vector or a failed repair, non-fatal)",
+			);
+			return false;
+		});
 };
 
 /**
@@ -634,6 +709,7 @@ const findCurrentMoveWinner = async (
 	for (const filter of movers) {
 		const isMatch = await filterCurrentlyMatches(
 			deps.client.filterAnchor,
+			() => deps.match.semantic(),
 			accountConfigId,
 			filter,
 			msg,

package/src/service/semantic-capability.ts

@@ -20,7 +20,13 @@ import { isSelfHostSqlBackend } from "../data-backend.js";
  * model involved — so it needs only `sqlite-vec`, which the backend image now
  * carries as a musl build (Dockerfile sqlite-vec-musl stage,
  * SQLITE_VEC_EXTENSION_PATH). matchOrganize never consults the memoized flag
- * below; a missing embedder therefore never disables the widen.
+ * below; a missing embedder therefore never disables the widen. The one place
+ * the widen would reach for an embedder is repairing a persisted FilterAnchor
+ * whose model has drifted (organize.ts matchSemantic): with no embedder there
+ * is no repair to be had, so it queries with the stored vector and classifies
+ * the failure through {@link isSemanticCapabilityAbsence}, which deliberately
+ * does not record the absence. Recording it there would take every later
+ * free-text semantic query down on the strength of one filter's stale stamp.
  *
  * The e2e-dev lane runs this backend from source rather than the container, so
  * `@huggingface/transformers` IS present and the local embedder instead tries to
@@ -59,17 +65,25 @@ export const _resetSemanticCapabilityForTest = (): void => {
 
 export const isSemanticSearchUnavailable = (): boolean => semanticUnavailable;
 
+/**
+ * Whether a failure is this deployment simply not carrying the semantic
+ * pipeline — the missing-module/extension shape on a self-host SQL backend.
+ * Records nothing, for the caller that must degrade one operation without
+ * disabling `/search/semantic` process-wide.
+ */
+export const isSemanticCapabilityAbsence = (error: unknown): boolean => {
+	if (!isSelfHostSqlBackend()) return false;
+	const code = (error as { code?: unknown } | null)?.code;
+	return typeof code === "string" && CAPABILITY_ABSENCE_CODES.has(code);
+};
+
 /**
  * Classify a semantic-search failure. Returns true — and remembers the
  * absence — when it is the missing-module/extension shape on a self-host SQL
  * backend; any other error is the caller's to rethrow.
  */
 export const noteSemanticCapabilityAbsence = (error: unknown): boolean => {
-	if (!isSelfHostSqlBackend()) return false;
-	const code = (error as { code?: unknown } | null)?.code;
-	if (typeof code !== "string" || !CAPABILITY_ABSENCE_CODES.has(code)) {
-		return false;
-	}
+	if (!isSemanticCapabilityAbsence(error)) return false;
 	if (!semanticUnavailable) {
 		logger.warn(
 			{ error: error instanceof Error ? error.message : String(error) },