mixdog 0.9.0 → 0.9.2

package/src/runtime/memory/index.mjs

@@ -90,6 +90,8 @@ import {
   stableSessionSourceRef,
   sessionMessageContent,
   createIngestTurnAllocator,
+  sessionMessageContentForIngest,
+  shouldExcludeIngestMessage,
 } from './lib/session-ingest.mjs'
 import { configureEmbedding, embedText, embedTexts, getEmbeddingDims, getEmbeddingDtype, getEmbeddingModelId, getKnownDimsForCurrentModel, isEmbeddingModelReady, primeEmbeddingDims, warmupEmbeddingProvider } from './lib/embedding-provider.mjs'
 import { startLlmWorker, stopLlmWorker } from './lib/llm-worker-host.mjs'
@@ -98,6 +100,7 @@ import { loadConfig as loadAgentConfig } from '../agent/orchestrator/config.mjs'
 import { initProviders } from '../agent/orchestrator/providers/registry.mjs'
 import { makeAgentDispatch } from '../agent/orchestrator/agent-runtime/agent-dispatch.mjs'
 import { getInFlightCycle1 } from './lib/memory-cycle1.mjs'
+import { drainSessionCycle1 } from '../agent/orchestrator/session/compact.mjs'
 import { claimAndMarkScheduledCycle, makeCycleRequestSignature, resolveCoalesceMaxRetries, scheduleCoalescedCycleRetry } from './lib/memory-cycle-requests.mjs'
 import { searchRelevantHybrid } from './lib/memory-recall-store.mjs'
 import { fetchEntriesByIdsScoped } from './lib/memory-recall-id-patch.mjs'
@@ -398,6 +401,13 @@ let _startupTimeout = null
 // getting the real stats and others getting `skippedInFlight: true` from
 // the inner guard.
 let _cycle1InFlight = null // shared cycle1 promise (outer coalesce layer)
+// Per-session recall-drain in-flight map. Multiple terminals share one
+// memory daemon (active-instance.json memory_port); concurrent recall calls
+// for the SAME session must share one drain promise (dedup), while DIFFERENT
+// sessions drain in parallel (cycle1's own advisory-lock/coalesce guard in
+// memory-cycle1.mjs still serializes the actual DB work). A drain never
+// blocks recall for sessions other than its own.
+const _recallDrainInFlight = new Map() // sessionId -> Promise
 let _initialized = false
 let _initPromise = null
 let _stopPromise = null
@@ -683,6 +693,28 @@ async function readRawRowsInWindow(db, tsFromMs, tsToMs, hardLimit = 10, { proje
   } catch { return [] }
 }
 
+// Spread raw (unchunked) rows evenly across a hybrid-ranked list at a fixed
+// stride so every offset page draws its proportional share of raw rows,
+// instead of them all landing after the hybrid page-0 window (the old
+// append-only behaviour). Stride is derived from the ratio of hybrid:raw
+// counts so a small raw set doesn't get pushed arbitrarily deep, and a large
+// raw set doesn't crowd out every hybrid hit near the top.
+function interleaveRawRows(hybridRows, rawRows) {
+  if (!Array.isArray(rawRows) || rawRows.length === 0) return hybridRows
+  const out = []
+  const stride = Math.max(1, Math.round(hybridRows.length / (rawRows.length + 1)))
+  let rawIdx = 0
+  for (let i = 0; i < hybridRows.length; i += 1) {
+    out.push(hybridRows[i])
+    if ((i + 1) % stride === 0 && rawIdx < rawRows.length) {
+      out.push(rawRows[rawIdx])
+      rawIdx += 1
+    }
+  }
+  while (rawIdx < rawRows.length) out.push(rawRows[rawIdx++])
+  return out
+}
+
 function sessionRecallTerms(query) {
   return [...new Set(String(query || '').toLowerCase().match(/[\p{L}\p{N}_./:-]{2,}/gu) || [])]
     .filter((term) => !CORE_RECALL_STOPWORDS.has(term))
@@ -788,12 +820,21 @@ async function ingestSessionMessages(args = {}) {
     const m = messages[i]
     if (!m || typeof m !== 'object') continue
     const role = normalizeIngestRole(m.role)
-    // Persist the whole session conversation by role: user/assistant carry the
-    // dialogue, tool carries tool_results, system/developer carry steering
-    // context. Previously only user/assistant were kept, silently dropping
-    // recent tool/system/developer state that recall fast-track must surface.
+    // ingest_session persists user/assistant only; system/developer/tool rows
+    // are dropped so recall-fasttrack summaries stay conversation-focused and
+    // do not re-inject content already in the protected system prefix.
     if (!role) continue
-    const content = cleanMemoryText(sessionMessageContent(m))
+    // Exclude synthetic / non-conversation rows entirely (reference-files
+    // injections, compaction summaries, protected-context `.` acks, internal
+    // runtime nudges). These are mechanical noise, not conversation.
+    if (shouldExcludeIngestMessage(m)) continue
+    // Pure-conversation shaping: only the human/model prose text. The ingest
+    // shaper NEVER inlines tool_call / tool_result traces and strips the
+    // deterministic manager.mjs user-turn prefix envelopes (# Session /
+    // # Additional context / # Prefetch / # Task) so only the real human
+    // prompt remains. cleanMemoryText then removes the <system-reminder> block
+    // and residual transcript noise.
+    const content = cleanMemoryText(sessionMessageContentForIngest(m))
     if (!content || !content.trim()) continue
     considered += 1
     const tsMs = parseTsToMs(m.ts ?? m.timestamp ?? (Date.now() - (messages.length - i)))
@@ -1179,7 +1220,7 @@ let _cycle1AgentDispatch = null
 function getCycle1CallLlm() {
   if (!_cycle1AgentDispatch) {
     _cycle1AgentDispatch = makeAgentDispatch({
-      role: 'cycle1-agent',
+      agent: 'cycle1-agent',
       taskType: 'maintenance',
       sourceType: 'memory-cycle',
       // cycle1 parses the full raw line-format response; the agent brief cap
@@ -1207,7 +1248,7 @@ let _cycle2AgentDispatch = null
 function getCycle2CallLlm() {
   if (!_cycle2AgentDispatch) {
     _cycle2AgentDispatch = makeAgentDispatch({
-      role: 'cycle2-agent',
+      agent: 'cycle2-agent',
       taskType: 'maintenance',
       sourceType: 'memory-cycle',
       brief: false,
@@ -1227,7 +1268,7 @@ let _cycle3AgentDispatch = null
 function getCycle3CallLlm() {
   if (!_cycle3AgentDispatch) {
     _cycle3AgentDispatch = makeAgentDispatch({
-      role: 'cycle3-agent',
+      agent: 'cycle3-agent',
       taskType: 'maintenance',
       sourceType: 'memory-cycle',
       brief: false,
@@ -1816,10 +1857,94 @@ async function recallCoreRows(query, { projectScope, category, limit } = {}) {
   }))
 }
 
+// Session-scoped full drain before a recall(query) search. Chunking is
+// partitioned by session_id (memory-cycle1.mjs:409-431 selected_sessions
+// GROUP BY session_id + ROW_NUMBER PARTITION BY session_id), so this drains
+// ONLY the calling session's backlog via the same session_id override
+// (memory-cycle1.mjs:394) — other sessions' pending rows are left for the
+// periodic cycle1 sweep. Reuses recall-fasttrack's drainSessionCycle1
+// (session/compact.mjs:504) which loops cycle1 until raw rows hit 0 or a
+// no-progress pass. Safety limits: a 2,000-row hard cap (both in the pending
+// pre-check and as the per-call cycle1 batch ceiling) and cooperative
+// abort-signal propagation through handleMemoryAction — no time budget.
+//
+// Multi-terminal safety: the memory daemon is one shared instance across
+// terminals (active-instance.json memory_port). Concurrent recall(query)
+// calls for the SAME session share one in-flight drain promise (dedup);
+// different sessions drain independently in parallel (cycle1's own
+// advisory-lock/coalesce guard in memory-cycle1.mjs still serializes actual
+// DB writes). A drain only gates recall for its OWN session — every other
+// terminal's recall (different session, or no session) proceeds unblocked.
+const RECALL_DRAIN_HARD_CAP_ROWS = 2000
+async function _drainSessionForRecallQuery(sessionId, signal) {
+  if (!sessionId || signal?.aborted) return
+  const existing = _recallDrainInFlight.get(sessionId)
+  if (existing) { try { await existing } catch {} return }
+  let pendingCount = 0
+  try {
+    const r = await db.query(
+      `SELECT COUNT(*) c FROM entries WHERE chunk_root IS NULL AND session_id = $1`,
+      [sessionId],
+    )
+    pendingCount = Number(r.rows?.[0]?.c ?? 0)
+  } catch { return }
+  if (pendingCount <= 0) return
+  const runTool = async (_name, toolArgs) => {
+    const result = await handleMemoryAction(toolArgs, signal)
+    return result?.text ?? ''
+  }
+  const dumpArgs = {
+    action: 'dump_session_roots',
+    sessionId,
+    includeRaw: true,
+    limit: Math.min(RECALL_DRAIN_HARD_CAP_ROWS, Math.max(1000, pendingCount)),
+  }
+  const drainPromise = (async () => {
+    try {
+      return await drainSessionCycle1(runTool, {
+        sessionId,
+        dumpArgs,
+        deadlineMs: 0, // no time budget — drive the session's backlog to 0
+        maxPasses: 20, // safety stopper; drainSessionCycle1 also self-stops on no-progress
+        cycleArgs: {
+          min_batch: 1,
+          session_cap: 1,
+          batch_size: RECALL_DRAIN_HARD_CAP_ROWS,
+          rows_per_session: RECALL_DRAIN_HARD_CAP_ROWS,
+          window_size: 20,
+          concurrency: 4,
+        },
+      })
+    } catch (err) {
+      __mixdogMemoryLog(`[recall] session drain aborted/failed (sess=${sessionId}): ${err?.message || err}\n`)
+      return null
+    }
+  })()
+  _recallDrainInFlight.set(sessionId, drainPromise)
+  try {
+    await drainPromise
+  } finally {
+    if (_recallDrainInFlight.get(sessionId) === drainPromise) _recallDrainInFlight.delete(sessionId)
+  }
+}
+
 async function handleSearch(args, signal) {
   // Cooperative abort check: throw early if the caller already aborted
   // (IPC cancel handler signals the AbortController before re-entry).
   if (signal?.aborted) throw signal.reason ?? new Error('aborted')
+  // Drain this session's unchunked backlog to zero BEFORE searching, so a
+  // query recall never returns raw/unclassified transcript tail instead of
+  // the chunked summary. Only runs when both a session and a query are
+  // present; a bare recent-browsing call (no query) skips this entirely.
+  {
+    const _drainSessionId = String(args?.sessionId || args?.session_id || '').trim()
+    const _drainHasQuery = Array.isArray(args?.query)
+      ? args.query.some((v) => String(v || '').trim())
+      : String(args?.query ?? '').trim() !== ''
+    if (_drainSessionId && _drainHasQuery) {
+      await _drainSessionForRecallQuery(_drainSessionId, signal)
+    }
+  }
   if (args?.currentSession === true || args?.sessionId || args?.session_id) {
     return await recallSessionRows(args)
   }
@@ -1936,8 +2061,6 @@ async function handleSearch(args, signal) {
         })),
         deadlineRace,
       ])
-    } catch (err) {
-      throw err
     } finally {
       clearTimeout(deadlineTimer)
     }
@@ -2072,13 +2195,16 @@ async function handleSearch(args, signal) {
       })
     }
     if (includeRaw) {
-      // Reserve slots for raw rows under sort=importance: hybrid rows are
-      // already score-sorted descending, so a full hybrid page (limit rows)
-      // would shut out raw rows entirely after slice(offset, offset+limit).
-      // Reserve up to RAW_RESERVE slots near the top of the post-slice
-      // window by trimming the hybrid prefix before merging, then re-sort
-      // for sort=date or otherwise append (already ranked) for importance.
-      const RAW_FETCH = 20
+      // Raw rows (chunk_root IS NULL) carry no retrievalScore, so a naive
+      // append-after-hybrid under sort=importance always lands them past
+      // slice(offset, offset+limit) once the hybrid pool exceeds one page —
+      // every page beyond the first silently drops them. Fetch a wider raw
+      // window (bounded like the hybrid candidate pool) and spread the
+      // fetched raw rows evenly across the WHOLE hybrid list before slicing,
+      // so every offset page gets its proportional share instead of only
+      // page 0. Same projectScope/ts window as the hybrid leg — filter
+      // parity (item 3) is deliberate, not accidental.
+      const RAW_FETCH = Math.min(500, Math.max(20, limit + offset))
       const rawRows = await readRawRowsInWindow(
         db,
         temporal?.startMs ?? null,
@@ -2092,10 +2218,10 @@ async function handleSearch(args, signal) {
         for (const r of newRaw) filtered.push(r)
         filtered.sort((a, b) => (Number(b.ts) || 0) - (Number(a.ts) || 0))
       } else {
-        // sort=importance: append raw rows after the hybrid page (mostly
-        // ineffective — slice(offset, offset+limit) typically shuts them
-        // out). Proper includeRaw paging fix deferred (needs fetching extra rows / paging redesign).
-        for (const r of newRaw) filtered.push(r)
+        // sort=importance: interleave raw rows at a fixed stride through the
+        // full (pre-slice) hybrid list instead of appending at the tail, so
+        // offset > 0 pages also draw from the raw pool proportionally.
+        filtered = interleaveRawRows(filtered, newRaw)
       }
     }
     const coreRows = await recallCoreRows(query, { projectScope, category, limit })
@@ -3666,26 +3792,6 @@ const httpServer = http.createServer(async (req, res) => {
     return
   }
 
-  if (req.method === 'POST' && req.url === '/session-start/recap') {
-    try {
-      const body = await readBody(req)
-      const projectId = resolveProjectScope(typeof body.cwd === 'string' && body.cwd ? body.cwd : null)
-      const rows = projectId !== null
-        ? (await db.query(`
-            SELECT id, ts, summary FROM entries
-            WHERE is_root = 1 AND (project_id IS NULL OR project_id = $1)
-            ORDER BY ts DESC, id DESC LIMIT 20
-          `, [projectId])).rows
-        : (await db.query(`
-            SELECT id, ts, summary FROM entries
-            WHERE is_root = 1
-            ORDER BY ts DESC, id DESC LIMIT 20
-          `)).rows
-      sendJson(res, { ok: true, projectId, rows })
-    } catch (e) { sendError(res, e.message) }
-    return
-  }
-
   if (req.method === 'POST' && req.url === '/api/tool') {
     if (!isLocalOrigin(req)) {
       sendJson(res, { content: [{ type: 'text', text: 'forbidden: cross-origin' }], isError: true }, 403)
@@ -3941,8 +4047,46 @@ export async function stop() {
     // postmaster keeps running after the memory service exits.
     if (!memorySecondaryMode()) {
       try {
-        const { stopPgForShutdown } = await import('./lib/pg/supervisor.mjs')
-        await stopPgForShutdown()
+        // Conservative check: only skip stopPgForShutdown when the owner
+        // record is unambiguously (a) a memory-runtime-daemon owner record
+        // (kind check — guards against a stale/foreign pid reusing this pid
+        // number for an unrelated process) and (b) that pid is alive AND not
+        // this process. Any read/parse failure or ambiguous state falls back
+        // to stopping PG (previous unconditional behavior) rather than
+        // risking an orphaned PG postmaster.
+        const anotherOwnerAlive = await (async () => {
+          try {
+            const { readSingletonOwner } = await import('../shared/singleton-owner.mjs')
+            const ownerPath = path.join(DATA_DIR, 'memory-runtime-owner.json')
+            const { owner, alive } = readSingletonOwner(ownerPath)
+            if (!alive) return false
+            if (owner?.kind !== 'memory-runtime-daemon') return false
+            const ownerPid = Number(owner?.pid)
+            if (!Number.isInteger(ownerPid) || ownerPid === process.pid) return false
+            // Best-effort process-name check (mirrors supervisor.mjs's
+            // isPostgresPid pattern) — confirms the pid is actually a node
+            // process before trusting it as a live sibling memory owner.
+            // Falls back to true (trust the owner file) when the platform
+            // check is unavailable or inconclusive.
+            try {
+              if (process.platform === 'win32') {
+                const { execFileSync } = await import('node:child_process')
+                const out = execFileSync('tasklist', ['/FI', `PID eq ${ownerPid}`, '/FO', 'CSV', '/NH'], { encoding: 'utf8', windowsHide: true })
+                if (!String(out || '').toLowerCase().includes('node')) return false
+              } else if (process.platform === 'linux') {
+                const comm = fs.readFileSync(`/proc/${ownerPid}/comm`, 'utf8').trim()
+                if (!comm.includes('node')) return false
+              }
+            } catch { /* inconclusive — trust the owner file (already alive+kind-matched) */ }
+            return true
+          } catch { return false }
+        })()
+        if (anotherOwnerAlive) {
+          __mixdogMemoryLog('[memory-service] shutdown: another live memory owner holds memory-runtime-owner.json — leaving PG running\n')
+        } else {
+          const { stopPgForShutdown } = await import('./lib/pg/supervisor.mjs')
+          await stopPgForShutdown()
+        }
       } catch {}
     } else {
       __mixdogMemoryLog('[memory-service] secondary mode; leaving shared PG running\n')

package/src/runtime/memory/lib/agent-ipc.mjs

@@ -40,7 +40,7 @@ function nextCallId() {
  * unavailable (worker not forked) or the parent reports an error.
  *
  * @param {object} opts           agent-dispatch construction options
- * @param {string} [opts.role]
+ * @param {string} [opts.agent]
  * @param {string} [opts.taskType]
  * @param {string} [opts.mode]
  * @param {string} [opts.preset]   preset id/name (passed at call time)
@@ -86,7 +86,7 @@ export function callAgentDispatch(opts = {}, prompt) {
         callId,
         tool: 'agent_dispatch',
         params: {
-          role: opts.role || null,
+          agent: opts.agent || null,
           taskType: opts.taskType || null,
           mode: opts.mode || null,
           preset: opts.preset || null,

package/src/runtime/memory/lib/core-memory-store.mjs

@@ -170,7 +170,7 @@ async function _llmJudgeMerge(existing, incoming) {
     `INCOMING: ${incoming.element} — ${String(incoming.summary || '')}`
   try {
     const raw = await callAgentDispatch({
-      role: 'cycle2-agent',
+      agent: 'cycle2-agent',
       taskType: 'maintenance',
       mode: 'core-merge-judge',
       preset: resolveMaintenancePreset('memory'),

package/src/runtime/memory/lib/llm-worker-host.mjs

@@ -6,12 +6,8 @@
  * Each task spawns a child process directly and communicates via stdio.
  */
 
-let active = false
-
 export function startLlmWorker() {
-  active = true
 }
 
 export async function stopLlmWorker() {
-  active = false
 }

package/src/runtime/memory/lib/memory-cycle1.mjs

@@ -520,7 +520,7 @@ async function _runCycle1Impl(db, config = {}, options = {}, _dataDir = null) {
     const _tLlm = Date.now()
     try {
       raw = await llmCall({
-        role: 'cycle1-agent',
+        agent: 'cycle1-agent',
         taskType: 'maintenance',
         mode: 'cycle1',
         preset,

package/src/runtime/memory/lib/memory-cycle2.mjs

@@ -47,7 +47,7 @@ function resourceDir() {
 
 async function invokeLlm(prompt, mode, preset, timeout, llmCall = callAgentDispatch) {
   return await llmCall({
-    role: 'cycle2-agent',
+    agent: 'cycle2-agent',
     taskType: 'maintenance',
     mode,
     preset,
@@ -347,7 +347,7 @@ async function _llmJudgePair(summaryA, summaryB, siblingContext = [], options =
     `Two memory entries below. Are they restating the same principle? Reply ONE WORD: merge or distinct.\n\nA: ${summaryA}\nB: ${summaryB}${siblings}`
   try {
     const raw = await llmCall({
-      role: 'cycle2-agent',
+      agent: 'cycle2-agent',
       taskType: 'maintenance',
       mode: 'cycle2-phase_merge_judge',
       preset: 'HAIKU',
@@ -808,7 +808,7 @@ async function sonnetCascade(candidates, rulesDigest, options = {}) {
   let raw
   try {
     raw = await llmCall({
-      role: 'cycle2-agent',
+      agent: 'cycle2-agent',
       taskType: 'maintenance',
       mode: 'cycle2-cascade',
       preset,
@@ -1305,13 +1305,16 @@ async function _runCycle2Impl(db, config = {}, options = {}, dataDir = null) {
       )
     }
   } else if (rows.length > 0) {
-    // Parse failure — bump error_count, do not advance reviewed_at.
+    // Parse failure — bump error_count and advance reviewed_at so the
+    // failing row sorts to the back of reviewed_at ASC NULLS FIRST (see
+    // ~:1067-1073), matching CYCLE1_OMITTED_COOLDOWN_MS-style cooldown
+    // semantics instead of spinning forever on the same row.
     for (const r of rows) {
       throwIfAborted(signal)
       try {
         await db.query(
-          `UPDATE entries SET error_count = COALESCE(error_count, 0) + 1 WHERE id = $1`,
-          [r.id],
+          `UPDATE entries SET error_count = COALESCE(error_count, 0) + 1, reviewed_at = $1 WHERE id = $2`,
+          [sweepCursor, r.id],
         )
       } catch {}
     }

package/src/runtime/memory/lib/memory-cycle3.mjs

@@ -36,7 +36,7 @@ function resourceDir() {
 
 async function invokeLlm(prompt, mode, preset, timeout, llmCall = callAgentDispatch) {
   return await llmCall({
-    role: 'cycle3-agent',
+    agent: 'cycle3-agent',
     taskType: 'maintenance',
     mode,
     preset,

package/src/runtime/memory/lib/memory-ops-policy.mjs

@@ -5,7 +5,6 @@ function __mixdogMemoryLog(...args) {
 }
 
 import fs from 'node:fs'
-import os from 'node:os'
 import path from 'node:path'
 import { mixdogHome } from '../../shared/plugin-paths.mjs'
 

package/src/runtime/memory/lib/memory.mjs

@@ -136,9 +136,18 @@ export async function init(db, dims) {
   await db.exec(`CREATE INDEX IF NOT EXISTS idx_entries_phase_sweep ON entries(status, is_root, error_count, reviewed_at, id)`)
   await db.exec(`CREATE INDEX IF NOT EXISTS idx_entries_promoted_at ON entries(promoted_at) WHERE promoted_at IS NOT NULL`)
   await db.exec(`CREATE INDEX IF NOT EXISTS idx_entries_tsv         ON entries USING GIN (search_tsv)`)
-  await db.exec(`CREATE INDEX IF NOT EXISTS idx_entries_content_trgm ON entries USING GIN (content gin_trgm_ops) WHERE is_root = 1`)
-  await db.exec(`CREATE INDEX IF NOT EXISTS idx_entries_element_trgm ON entries USING GIN (element gin_trgm_ops) WHERE is_root = 1 AND element IS NOT NULL`)
-  await db.exec(`CREATE INDEX IF NOT EXISTS idx_entries_embedding_hnsw ON entries USING hnsw (embedding halfvec_cosine_ops) WHERE is_root = 1 AND embedding IS NOT NULL`)
+  // Recall CTEs (memory-recall-store.mjs dense/trgm legs) intentionally match
+  // BOTH root and leaf/chunk rows, so their SQL has NO `is_root = 1` predicate
+  // (only `embedding IS NOT NULL` / content|element|summary text filters).
+  // The old root-only PARTIAL indexes therefore could not be used by those
+  // queries — the planner fell back to a Seq Scan + top-N heapsort over every
+  // embedding (verified via EXPLAIN ANALYZE). Broaden the predicates to match
+  // the query shape so HNSW/GIN are actually used. A `summary` trgm index is
+  // added because the trgm leg also filters on `summary` but had no index.
+  await db.exec(`CREATE INDEX IF NOT EXISTS idx_entries_content_trgm ON entries USING GIN (content gin_trgm_ops)`)
+  await db.exec(`CREATE INDEX IF NOT EXISTS idx_entries_element_trgm ON entries USING GIN (element gin_trgm_ops) WHERE element IS NOT NULL`)
+  await db.exec(`CREATE INDEX IF NOT EXISTS idx_entries_summary_trgm ON entries USING GIN (summary gin_trgm_ops) WHERE summary IS NOT NULL`)
+  await db.exec(`CREATE INDEX IF NOT EXISTS idx_entries_embedding_hnsw ON entries USING hnsw (embedding halfvec_cosine_ops) WHERE embedding IS NOT NULL`)
 
   // BEFORE INSERT/UPDATE trigger keeps score in sync with category + last_seen_at
   // automatically; cycle code no longer needs to UPDATE entries SET score = ...
@@ -333,13 +342,101 @@ export async function validateEmbeddingDims(db, dimCount) {
   }
 }
 
+// One-time migration: broaden the recall indexes that were created as root-only
+// PARTIAL indexes (`WHERE is_root = 1 ...`) so they match the recall CTE query
+// predicates (which do NOT restrict is_root — recall matches leaf/chunk rows
+// too). A stale root-only index is unusable by those queries and forces a Seq
+// Scan. This runs on every boot (via ensureCurrentSchemaExtensions), so it is
+// carefully guarded: it only DROP+CREATEs an index when the CURRENT definition
+// still contains the `is_root = 1` predicate. Once broadened, every check is a
+// cheap catalog read and no rebuild happens. Best-effort: catalog-read or DDL
+// failures are logged and swallowed so a boot is never blocked by this.
+async function _migrateRecallIndexesIfStale(db) {
+  // Each entry: [indexName, newDefTailPredicate] where the presence of
+  // "is_root" in the live indexdef signals the stale root-only shape.
+  const targets = [
+    { name: 'idx_entries_content_trgm',   create: `CREATE INDEX idx_entries_content_trgm ON entries USING GIN (content gin_trgm_ops)` },
+    { name: 'idx_entries_element_trgm',   create: `CREATE INDEX idx_entries_element_trgm ON entries USING GIN (element gin_trgm_ops) WHERE element IS NOT NULL` },
+    { name: 'idx_entries_embedding_hnsw', create: `CREATE INDEX idx_entries_embedding_hnsw ON entries USING hnsw (embedding halfvec_cosine_ops) WHERE embedding IS NOT NULL` },
+  ]
+  try {
+    for (const t of targets) {
+      let def = null
+      try {
+        const r = await db.query(`SELECT indexdef FROM pg_indexes WHERE indexname = $1`, [t.name])
+        def = r.rows?.[0]?.indexdef ?? null
+      } catch { def = null }
+      // Missing index → post-loop IF-NOT-EXISTS ensures below self-heal trgm
+      // indexes; embedding_hnsw is also re-ensured by ensureCurrentSchemaExtensions.
+      if (def == null) continue
+      // Already broadened (no is_root predicate) → no-op, no rebuild.
+      if (!/is_root/i.test(def)) continue
+      try {
+        await db.exec(`DROP INDEX IF EXISTS ${t.name}`)
+        await db.exec(t.create)
+        __mixdogMemoryLog(`[memory] migrated stale root-only index ${t.name} → broadened to match recall query predicates\n`)
+      } catch (err) {
+        __mixdogMemoryLog(`[memory] recall index migration for ${t.name} failed: ${err?.message || err}\n`)
+      }
+    }
+    // Self-heal trgm recall indexes on already-bootstrapped DBs: init() will
+    // not re-run, and a missing index is not handled by the stale-shape loop
+    // above (def == null → continue). These IF-NOT-EXISTS ensures recreate any
+    // trgm index that never existed or whose migrate-create failed. No-op (cheap
+    // catalog check) when the broadened index is already present.
+    try {
+      await db.exec(`CREATE INDEX IF NOT EXISTS idx_entries_content_trgm ON entries USING GIN (content gin_trgm_ops)`)
+    } catch (err) {
+      __mixdogMemoryLog(`[memory] idx_entries_content_trgm ensure failed: ${err?.message || err}\n`)
+    }
+    try {
+      await db.exec(`CREATE INDEX IF NOT EXISTS idx_entries_element_trgm ON entries USING GIN (element gin_trgm_ops) WHERE element IS NOT NULL`)
+    } catch (err) {
+      __mixdogMemoryLog(`[memory] idx_entries_element_trgm ensure failed: ${err?.message || err}\n`)
+    }
+    try {
+      await db.exec(`CREATE INDEX IF NOT EXISTS idx_entries_summary_trgm ON entries USING GIN (summary gin_trgm_ops) WHERE summary IS NOT NULL`)
+    } catch (err) {
+      __mixdogMemoryLog(`[memory] idx_entries_summary_trgm ensure failed: ${err?.message || err}\n`)
+    }
+  } catch (err) {
+    __mixdogMemoryLog(`[memory] _migrateRecallIndexesIfStale failed: ${err?.message || err}\n`)
+  }
+}
+
 export async function ensureCurrentSchemaExtensions(db, dims) {
+  // One-time cleanup: attachment-only placeholder rows ('(attachment)' user
+  // content, e.g. Discord backend discord.mjs:724) predate the
+  // shouldExcludeIngestMessage() ingest-time filter (session-ingest.mjs).
+  // Delete any already-persisted rows so they stop polluting recall/cycle1.
+  // Idempotent (no-op once cleaned); best-effort so a failure never blocks boot.
+  try {
+    const cleaned = await db.query(
+      `DELETE FROM entries WHERE content = '(attachment)' AND role = 'user'`,
+    )
+    const n = Number(cleaned?.rowCount ?? 0)
+    if (n > 0) {
+      __mixdogMemoryLog(`[memory] ensureCurrentSchemaExtensions: removed ${n} attachment-only placeholder rows\n`)
+    }
+  } catch (err) {
+    __mixdogMemoryLog(`[memory] attachment-placeholder cleanup failed: ${err?.message || err}\n`)
+  }
   // core_entries gained an embedding column for cross-table semantic dedup
   // between user-curated rows and cycle2-promoted entries. ALTER + index are
   // idempotent and define the current runtime schema.
   if (Number.isInteger(dims) && dims > 0) {
     await db.exec(`ALTER TABLE core_entries ADD COLUMN IF NOT EXISTS embedding halfvec(${dims})`)
-    await db.exec(`CREATE INDEX IF NOT EXISTS idx_entries_embedding_hnsw ON entries USING hnsw (embedding halfvec_cosine_ops) WHERE is_root = 1 AND embedding IS NOT NULL`)
+    // One-time migration for EXISTING deployments (bootstrap-complete DBs never
+    // re-run init(), so the broadened index definitions there would otherwise
+    // never reach them). This path runs on EVERY boot, so we must NOT
+    // unconditionally DROP+CREATE an HNSW index (that would rebuild it on every
+    // startup). Only rebuild when the current index still carries the stale
+    // root-only `is_root = 1` predicate; once broadened, the check is a no-op.
+    await _migrateRecallIndexesIfStale(db)
+    // Residual (low risk, no action needed): cycle2's root-active embedding
+    // scans (memory-cycle2.mjs) now share this broader all-embedding HNSW
+    // instead of a root-only partial index; acceptable at current scale.
+    await db.exec(`CREATE INDEX IF NOT EXISTS idx_entries_embedding_hnsw ON entries USING hnsw (embedding halfvec_cosine_ops) WHERE embedding IS NOT NULL`)
     await db.exec(`CREATE INDEX IF NOT EXISTS core_entries_embedding_hnsw ON core_entries USING hnsw (embedding halfvec_cosine_ops) WHERE embedding IS NOT NULL`)
   }
   await db.exec(`ALTER TABLE entries ADD COLUMN IF NOT EXISTS core_summary text`)