mixdog 0.9.1 → 0.9.3

package/src/runtime/memory/index.mjs

@@ -9,7 +9,6 @@ process.removeAllListeners('warning')
 process.on('warning', () => {})
 
 import http from 'node:http'
-import crypto from 'node:crypto'
 import os from 'node:os'
 import fs from 'node:fs'
 import path from 'node:path'
@@ -17,47 +16,9 @@ import { fileURLToPath, pathToFileURL } from 'node:url'
 
 const PLUGIN_ROOT = path.resolve(path.dirname(fileURLToPath(import.meta.url)), '..', '..', '..')
 
-function readPluginVersion() {
-  try {
-    return JSON.parse(fs.readFileSync(path.join(PLUGIN_ROOT, 'package.json'), 'utf8')).version || '0.0.1'
-  } catch { return '0.0.1' }
-}
-const PLUGIN_VERSION = readPluginVersion()
-const PROMOTION_FINGERPRINT_ROOTS = ['src/memory']
-function collectPromotionFingerprintFiles() {
-  const out = []
-  const walk = (relDir) => {
-    let entries = []
-    try { entries = fs.readdirSync(path.join(PLUGIN_ROOT, relDir), { withFileTypes: true }) }
-    catch { return }
-    for (const ent of entries) {
-      const rel = `${relDir}/${ent.name}`.replace(/\\/g, '/')
-      if (ent.isDirectory()) {
-        walk(rel)
-      } else if (ent.isFile() && rel.endsWith('.mjs')) {
-        out.push(rel)
-      }
-    }
-  }
-  for (const root of PROMOTION_FINGERPRINT_ROOTS) walk(root)
-  return out.sort()
-}
-function readPromotionCodeFingerprint() {
-  const hash = crypto.createHash('sha256')
-  const files = collectPromotionFingerprintFiles()
-  for (const rel of files) {
-    hash.update(rel)
-    hash.update('\0')
-    try {
-      hash.update(fs.readFileSync(path.join(PLUGIN_ROOT, rel)))
-    } catch {
-      hash.update('missing')
-    }
-    hash.update('\0')
-  }
-  return `src/memory:${files.length}:${hash.digest('hex').slice(0, 16)}`
-}
-const BOOT_PROMOTION_CODE_FINGERPRINT = readPromotionCodeFingerprint()
+import { readPluginVersion, readPromotionCodeFingerprint } from './lib/promotion-fingerprint.mjs'
+const PLUGIN_VERSION = readPluginVersion(PLUGIN_ROOT)
+const BOOT_PROMOTION_CODE_FINGERPRINT = readPromotionCodeFingerprint(PLUGIN_ROOT)
 
 try { os.setPriority(os.constants.priority.PRIORITY_BELOW_NORMAL) } catch {}
 try {
@@ -90,6 +51,8 @@ import {
   stableSessionSourceRef,
   sessionMessageContent,
   createIngestTurnAllocator,
+  sessionMessageContentForIngest,
+  shouldExcludeIngestMessage,
 } from './lib/session-ingest.mjs'
 import { configureEmbedding, embedText, embedTexts, getEmbeddingDims, getEmbeddingDtype, getEmbeddingModelId, getKnownDimsForCurrentModel, isEmbeddingModelReady, primeEmbeddingDims, warmupEmbeddingProvider } from './lib/embedding-provider.mjs'
 import { startLlmWorker, stopLlmWorker } from './lib/llm-worker-host.mjs'
@@ -98,18 +61,22 @@ import { loadConfig as loadAgentConfig } from '../agent/orchestrator/config.mjs'
 import { initProviders } from '../agent/orchestrator/providers/registry.mjs'
 import { makeAgentDispatch } from '../agent/orchestrator/agent-runtime/agent-dispatch.mjs'
 import { getInFlightCycle1 } from './lib/memory-cycle1.mjs'
-import { claimAndMarkScheduledCycle, makeCycleRequestSignature, resolveCoalesceMaxRetries, scheduleCoalescedCycleRetry } from './lib/memory-cycle-requests.mjs'
+import { drainSessionCycle1 } from '../agent/orchestrator/session/compact.mjs'
+import { claimAndMarkScheduledCycle, resolveCoalesceMaxRetries, scheduleCoalescedCycleRetry } from './lib/memory-cycle-requests.mjs'
 import { searchRelevantHybrid } from './lib/memory-recall-store.mjs'
 import { fetchEntriesByIdsScoped } from './lib/memory-recall-id-patch.mjs'
 import { retrieveEntries } from './lib/memory-retrievers.mjs'
 import { pruneOldEntries } from './lib/memory-maintenance-store.mjs'
 import { computeEntryScore } from './lib/memory-score.mjs'
 import { runFullBackfill } from './lib/memory-ops-policy.mjs'
-import { listCore, addCore, editCore, deleteCore, compactCoreIds, CORE_SUMMARY_MAX } from './lib/core-memory-store.mjs'
+import { listCore, addCore, editCore, deleteCore, compactCoreIds, listCoreCandidates, promoteCoreCandidate, dismissCoreCandidate, CORE_SUMMARY_MAX } from './lib/core-memory-store.mjs'
 import { resolveProjectId, resolveProjectScope } from './lib/project-id-resolver.mjs'
 import { openTraceDatabase, closeTraceDatabase, insertTraceEvents, enqueueTraceEvents, insertAgentCalls, registerTraceExitDrain } from './lib/trace-store.mjs'
 import { updateJsonAtomicSync, writeJsonAtomicSync } from '../shared/atomic-file.mjs'
 import { resolvePluginData, mixdogHome } from '../shared/plugin-paths.mjs'
+import { parsePeriod, formatTs, coreRecallTerms, normalizeRecallProjectScope, sessionRecallTerms, interleaveRawRows, renderEntryLines } from './lib/recall-format.mjs'
+import { readBody, sendJson, sendError, isLocalOrigin, normalizeCoreProjectId } from './lib/http-wire.mjs'
+import { scheduledCycle1Signature, scheduledCycle2Signature, scheduledCycle3Signature } from './lib/cycle-signatures.mjs'
 const IS_MEMORY_ENTRY = !!process.argv[1] && import.meta.url === pathToFileURL(path.resolve(process.argv[1])).href
 const USE_ARG_DATA_DIR = IS_MEMORY_ENTRY || process.env.MIXDOG_WORKER_MODE === '1'
 const DATA_DIR = process.env.MIXDOG_DATA_DIR || (USE_ARG_DATA_DIR ? process.argv[2] : '') || resolvePluginData()
@@ -398,6 +365,13 @@ let _startupTimeout = null
 // getting the real stats and others getting `skippedInFlight: true` from
 // the inner guard.
 let _cycle1InFlight = null // shared cycle1 promise (outer coalesce layer)
+// Per-session recall-drain in-flight map. Multiple terminals share one
+// memory daemon (active-instance.json memory_port); concurrent recall calls
+// for the SAME session must share one drain promise (dedup), while DIFFERENT
+// sessions drain in parallel (cycle1's own advisory-lock/coalesce guard in
+// memory-cycle1.mjs still serializes the actual DB work). A drain never
+// blocks recall for sessions other than its own.
+const _recallDrainInFlight = new Map() // sessionId -> Promise
 let _initialized = false
 let _initPromise = null
 let _stopPromise = null
@@ -645,57 +619,78 @@ async function setCycleLastRun(kind, ts) {
 // Raw-row priority lookup for narrow-window queries. Raw rows (is_root=0,
 // chunk_root IS NULL) are inserted immediately by ingestTranscriptFile before
 // cycle1 runs, so they always carry the freshest turns in the DB.
-async function readRawRowsInWindow(db, tsFromMs, tsToMs, hardLimit = 10, { projectScope } = {}) {
+async function readRawRowsInWindow(db, tsFromMs, tsToMs, hardLimit = 10, { projectScope, sessionId } = {}) {
   try {
-    let sql, params
+    // Composable WHERE assembly (mirrors retrieveEntries' filter semantics so
+    // raw and chunked legs stay in filter parity: projectScope AND sessionId
+    // apply identically to both pools).
+    const where = ['chunk_root IS NULL', 'is_root = 0', 'ts >= $1', 'ts <= $2']
+    const params = [tsFromMs ?? 0, tsToMs ?? Date.now()]
     if (projectScope === 'common') {
-      sql = `SELECT id, ts, role, content, session_id, source_turn, chunk_root, is_root,
-              element, category, summary, status, score, last_seen_at, project_id
-       FROM entries
-       WHERE chunk_root IS NULL AND is_root = 0
-         AND ts >= $1 AND ts <= $2
-         AND project_id IS NULL
-       ORDER BY ts DESC
-       LIMIT $3`
-      params = [tsFromMs ?? 0, tsToMs ?? Date.now(), hardLimit]
+      where.push('project_id IS NULL')
     } else if (projectScope && projectScope !== 'all') {
-      sql = `SELECT id, ts, role, content, session_id, source_turn, chunk_root, is_root,
-              element, category, summary, status, score, last_seen_at, project_id
-       FROM entries
-       WHERE chunk_root IS NULL AND is_root = 0
-         AND ts >= $1 AND ts <= $2
-         AND (project_id IS NULL OR project_id = $3)
-       ORDER BY ts DESC
-       LIMIT $4`
-      params = [tsFromMs ?? 0, tsToMs ?? Date.now(), projectScope, hardLimit]
-    } else {
-      sql = `SELECT id, ts, role, content, session_id, source_turn, chunk_root, is_root,
+      params.push(projectScope)
+      where.push(`(project_id IS NULL OR project_id = $${params.length})`)
+    }
+    const sid = String(sessionId || '').trim()
+    if (sid) {
+      params.push(sid)
+      where.push(`session_id = $${params.length}`)
+    }
+    params.push(hardLimit)
+    const sql = `SELECT id, ts, role, content, session_id, source_turn, chunk_root, is_root,
               element, category, summary, status, score, last_seen_at, project_id
        FROM entries
-       WHERE chunk_root IS NULL AND is_root = 0
-         AND ts >= $1 AND ts <= $2
+       WHERE ${where.join(' AND ')}
        ORDER BY ts DESC
-       LIMIT $3`
-      params = [tsFromMs ?? 0, tsToMs ?? Date.now(), hardLimit]
-    }
+       LIMIT $${params.length}`
     const rows = (await db.query(sql, params)).rows
     return rows.map(r => ({ ...r, retrievalScore: 0, rrf: 0 }))
   } catch { return [] }
 }
 
-function sessionRecallTerms(query) {
-  return [...new Set(String(query || '').toLowerCase().match(/[\p{L}\p{N}_./:-]{2,}/gu) || [])]
-    .filter((term) => !CORE_RECALL_STOPWORDS.has(term))
-    .slice(0, 12)
-}
-
 async function recallSessionRows(args = {}) {
   const sessionId = String(args.sessionId || args.session_id || '').trim()
   if (!sessionId) return { text: '(no current session)' }
   const limit = Math.max(1, Math.min(100, Number(args.limit) || 20))
   const terms = sessionRecallTerms(args.query)
   const params = [sessionId]
-  const where = ['session_id = $1']
+  // Roots + not-yet-chunked leaves only. Once cycle1 turns raw leaves into
+  // (root, members) pairs, selecting every row unfiltered emitted the root's
+  // summary AND its own member rows in the same browse — duplicate content.
+  // A committed member (is_root=0 with a chunk_root) is always reachable via
+  // its root's `members` expansion below, so it never needs to be selected
+  // directly here.
+  const where = ['session_id = $1', '(is_root = 1 OR chunk_root IS NULL OR chunk_root = id)']
+  // Current-turn cutoff: the newest unchunked row is very often the calling
+  // turn's OWN recall request/tool-args, still being written when this query
+  // runs. Exclude it from a bare (no-query) browse so the in-flight turn
+  // doesn't self-echo; a query browse (explicit search intent) keeps it.
+  // Only treat the newest unchunked turn as "in-flight" when its latest row
+  // is fresh (within FRESHNESS_MS of now) — an older newest-unchunked-turn
+  // is completed history (cycle1 just hasn't gotten to it, or drain timed
+  // out) and must stay visible, not be silently hidden every browse.
+  const IN_FLIGHT_TURN_FRESHNESS_MS = 5 * 60 * 1000
+  let excludeSourceTurnId = null
+  if (terms.length === 0) {
+    try {
+      const r = await db.query(
+        `SELECT source_turn t, MAX(ts) last_ts FROM entries
+         WHERE session_id = $1 AND chunk_root IS NULL
+         GROUP BY source_turn ORDER BY source_turn DESC LIMIT 1`,
+        [sessionId],
+      )
+      const t = r.rows?.[0]?.t
+      const lastTs = Number(r.rows?.[0]?.last_ts)
+      if (t != null && Number.isFinite(lastTs) && (Date.now() - lastTs) <= IN_FLIGHT_TURN_FRESHNESS_MS) {
+        excludeSourceTurnId = Number(t)
+      }
+    } catch {}
+  }
+  if (Number.isFinite(excludeSourceTurnId)) {
+    params.push(excludeSourceTurnId)
+    where.push(`NOT (chunk_root IS NULL AND source_turn = $${params.length})`)
+  }
   if (terms.length > 0) {
     const textExpr = `lower(coalesce(content, '') || ' ' || coalesce(element, '') || ' ' || coalesce(summary, ''))`
     const clauses = terms.map((term) => {
@@ -716,16 +711,22 @@ async function recallSessionRows(args = {}) {
   if (rows.length < limit) {
     const seen = new Set(rows.map((row) => Number(row.id)).filter((id) => Number.isFinite(id)))
     const fillLimit = Math.max(0, limit - rows.length)
+    const fillWhere = ['session_id = $1', 'id <> ALL($2::bigint[])', '(is_root = 1 OR chunk_root IS NULL OR chunk_root = id)']
+    const fillParams = [sessionId, [...seen]]
+    if (Number.isFinite(excludeSourceTurnId)) {
+      fillParams.push(excludeSourceTurnId)
+      fillWhere.push(`NOT (chunk_root IS NULL AND source_turn = $${fillParams.length})`)
+    }
+    fillParams.push(fillLimit)
     const fillRows = fillLimit > 0
       ? (await db.query(`
           SELECT id, ts, role, content, session_id, source_turn, chunk_root, is_root,
                  element, category, summary, status, score, last_seen_at, project_id
           FROM entries
-          WHERE session_id = $1
-            AND id <> ALL($2::bigint[])
+          WHERE ${fillWhere.join(' AND ')}
           ORDER BY ts DESC, id DESC
-          LIMIT $3
-        `, [sessionId, [...seen], fillLimit])).rows
+          LIMIT $${fillParams.length}
+        `, fillParams)).rows
       : []
     if (fillRows.length > 0) rows = [...rows, ...fillRows]
   }
@@ -792,7 +793,17 @@ async function ingestSessionMessages(args = {}) {
     // are dropped so recall-fasttrack summaries stay conversation-focused and
     // do not re-inject content already in the protected system prefix.
     if (!role) continue
-    const content = cleanMemoryText(sessionMessageContent(m))
+    // Exclude synthetic / non-conversation rows entirely (reference-files
+    // injections, compaction summaries, protected-context `.` acks, internal
+    // runtime nudges). These are mechanical noise, not conversation.
+    if (shouldExcludeIngestMessage(m)) continue
+    // Pure-conversation shaping: only the human/model prose text. The ingest
+    // shaper NEVER inlines tool_call / tool_result traces and strips the
+    // deterministic manager.mjs user-turn prefix envelopes (# Session /
+    // # Additional context / # Prefetch / # Task) so only the real human
+    // prompt remains. cleanMemoryText then removes the <system-reminder> block
+    // and residual transcript noise.
+    const content = cleanMemoryText(sessionMessageContentForIngest(m))
     if (!content || !content.trim()) continue
     considered += 1
     const tsMs = parseTsToMs(m.ts ?? m.timestamp ?? (Date.now() - (messages.length - i)))
@@ -1178,7 +1189,7 @@ let _cycle1AgentDispatch = null
 function getCycle1CallLlm() {
   if (!_cycle1AgentDispatch) {
     _cycle1AgentDispatch = makeAgentDispatch({
-      role: 'cycle1-agent',
+      agent: 'cycle1-agent',
       taskType: 'maintenance',
       sourceType: 'memory-cycle',
       // cycle1 parses the full raw line-format response; the agent brief cap
@@ -1206,7 +1217,7 @@ let _cycle2AgentDispatch = null
 function getCycle2CallLlm() {
   if (!_cycle2AgentDispatch) {
     _cycle2AgentDispatch = makeAgentDispatch({
-      role: 'cycle2-agent',
+      agent: 'cycle2-agent',
       taskType: 'maintenance',
       sourceType: 'memory-cycle',
       brief: false,
@@ -1226,7 +1237,7 @@ let _cycle3AgentDispatch = null
 function getCycle3CallLlm() {
   if (!_cycle3AgentDispatch) {
     _cycle3AgentDispatch = makeAgentDispatch({
-      role: 'cycle3-agent',
+      agent: 'cycle3-agent',
       taskType: 'maintenance',
       sourceType: 'memory-cycle',
       brief: false,
@@ -1254,6 +1265,62 @@ async function recordCycle1Result(result) {
   if (!skipped && !coalescedNoop && !allFailed) {
     await setCycleLastRun('cycle1', now)
   }
+  if (!skipped && !coalescedNoop) markCycleDone('cycle1', !allFailed, allFailed ? 'all rows skipped' : null)
+}
+
+// ── Cycle health state (no new commands; consumed by /health + statusline) ──
+// In-memory per-cycle run ledger + a small state file the TUI statusline can
+// read without HTTP. "Silently stalled cycles" (2026-07: cycle2 poison
+// rotation sat unnoticed for months) become visible three ways: /health
+// fields, a WARN log with cooldown, and the L2 "Memory" segment.
+const CYCLE_STATE_FILE = path.join(DATA_DIR, 'memory-cycle-state.json')
+const _cycleHealth = {
+  cycle1: { last_success_at: 0, last_error_at: 0, last_error: null, consecutive_failures: 0 },
+  cycle2: { last_success_at: 0, last_error_at: 0, last_error: null, consecutive_failures: 0 },
+  cycle3: { last_success_at: 0, last_error_at: 0, last_error: null, consecutive_failures: 0 },
+}
+let _cycleRunning = null // { cycle, started_at }
+let _cycleBacklogSnapshot = { unchunked: 0, cycle2_pending: 0, at: 0 }
+let _lastBacklogWarnAt = 0
+const BACKLOG_WARN_COOLDOWN_MS = 10 * 60_000
+const BACKLOG_WARN_PENDING = 500
+const BACKLOG_WARN_FAILURES = 5
+
+function _writeCycleStateFile() {
+  try {
+    fs.writeFileSync(CYCLE_STATE_FILE, JSON.stringify({
+      running: _cycleRunning,
+      backlog: _cycleBacklogSnapshot,
+      cycles: _cycleHealth,
+      updatedAt: Date.now(),
+    }))
+  } catch { /* best-effort; statusline just shows nothing */ }
+}
+
+function markCycleRunning(cycle) {
+  _cycleRunning = { cycle, started_at: Date.now() }
+  _writeCycleStateFile()
+}
+
+function markCycleDone(cycle, ok, err = null) {
+  const h = _cycleHealth[cycle]
+  if (h) {
+    const now = Date.now()
+    if (ok) { h.last_success_at = now; h.consecutive_failures = 0; h.last_error = null }
+    else { h.last_error_at = now; h.consecutive_failures += 1; h.last_error = String(err || 'unknown').slice(0, 200) }
+    if (!ok && h.consecutive_failures >= BACKLOG_WARN_FAILURES) {
+      _warnCycleHealth(`${cycle} failing repeatedly (consecutive=${h.consecutive_failures}, last="${h.last_error}")`)
+    }
+  }
+  if (_cycleRunning?.cycle === cycle) _cycleRunning = null
+  _writeCycleStateFile()
+}
+
+function _warnCycleHealth(msg) {
+  const now = Date.now()
+  if (now - _lastBacklogWarnAt < BACKLOG_WARN_COOLDOWN_MS) return
+  _lastBacklogWarnAt = now
+  __mixdogMemoryLog(`[cycle-health] WARN ${msg}\n`)
 }
 
 function _startCycle1Run(config = {}, options = {}) {
@@ -1264,6 +1331,7 @@ function _startCycle1Run(config = {}, options = {}) {
   if (typeof options?.callLlm !== 'function') {
     options = { ...options, callLlm: getCycle1CallLlm() }
   }
+  markCycleRunning('cycle1')
   _cycle1InFlight = (async () => {
     try {
       const result = await runCycle1(db, config, options, DATA_DIR)
@@ -1276,7 +1344,11 @@ function _startCycle1Run(config = {}, options = {}) {
         await recordCycle1Result(result)
       }
       return result
+    } catch (err) {
+      markCycleDone('cycle1', false, err?.message || err)
+      throw err
     } finally {
+      if (_cycleRunning?.cycle === 'cycle1') { _cycleRunning = null; _writeCycleStateFile() }
       if (_cycle1InFlight === promise) _cycle1InFlight = null
     }
   })()
@@ -1303,7 +1375,14 @@ async function _awaitCycle1Run(config = {}, options = {}) {
   let timer
   const deadlinePromise = new Promise((resolve) => {
     timer = setTimeout(() => {
-      if (_cycle1InFlight === target) _cycle1InFlight = null
+      // Do NOT clear _cycle1InFlight here — the underlying runCycle1 is still
+      // running in the background and owns that slot; its own `finally`
+      // (_startCycle1Run above) clears it when the real work settles. Clearing
+      // it early made a later unbounded drain (deadlineMs:0, e.g. the query
+      // recall path) re-enter _startCycle1Run and spawn a SECOND concurrent
+      // cycle1 run instead of awaiting the one already in flight, defeating
+      // drain-to-zero silently. The caller here just stops WAITING at the
+      // deadline; state ownership stays with the promise itself.
       resolve({
         processed: 0,
         chunks: 0,
@@ -1339,34 +1418,6 @@ function periodicCycle1Config() {
   }
 }
 
-function scheduledCycle1Signature(config) {
-  return makeCycleRequestSignature('cycle1', config, {
-    preset: undefined,
-    concurrency: undefined,
-    maxConcurrent: undefined,
-  })
-}
-
-function scheduledCycle2Signature(config) {
-  return makeCycleRequestSignature('cycle2', config, {
-    cascadePreset: undefined,
-    concurrency: undefined,
-  })
-}
-
-function scheduledCycle3ApplyMode(config) {
-  const raw = String(config?.cycle3?.applyMode || 'conservative').trim().toLowerCase()
-  return (raw === 'proposal' || raw === 'dry-run' || raw === 'dryrun') ? 'proposal' : 'conservative'
-}
-
-function scheduledCycle3Signature(config) {
-  const retryConfig = config?.cycle3 || config
-  return makeCycleRequestSignature('cycle3', retryConfig, {
-    applyMode: scheduledCycle3ApplyMode(config),
-    apply: undefined,
-  })
-}
-
 async function enqueueScheduledCycle(kind, intervalMs, signature) {
   const claim = await claimAndMarkScheduledCycle(db, kind, intervalMs, signature, { reason: 'scheduled' })
   return claim.claimed === true
@@ -1427,6 +1478,7 @@ function scheduleScheduledCycle2(config, signature, attempt = 0) {
       return
     }
     _cycle2InFlight = true
+    markCycleRunning('cycle2')
     try {
       let c2Options = {
         coalescedRetry: true,
@@ -1445,8 +1497,10 @@ function scheduleScheduledCycle2(config, signature, attempt = 0) {
       }
     } catch (err) {
       __mixdogMemoryLog(`[cycle2] scheduled queue failed: ${err?.message || err}\n`)
+      markCycleDone('cycle2', false, err?.message || err)
     } finally {
       _cycle2InFlight = false
+      if (_cycleRunning?.cycle === 'cycle2') { _cycleRunning = null; _writeCycleStateFile() }
     }
   }, config, signature)
 }
@@ -1464,10 +1518,11 @@ function scheduleScheduledCycle3(config, signature, attempt = 0) {
       return
     }
     _cycle3InFlight = true
+    markCycleRunning('cycle3')
     try {
       let c3Options = {
         coalescedRetry: true,
-        onCoalescedSuccess: () => setCycleLastRun('cycle3', Date.now()),
+        onCoalescedSuccess: async () => { await setCycleLastRun('cycle3', Date.now()); markCycleDone('cycle3', true) },
       }
       if (typeof c3Options?.callLlm !== 'function') {
         c3Options = { ...c3Options, callLlm: getCycle3CallLlm() }
@@ -1480,8 +1535,10 @@ function scheduleScheduledCycle3(config, signature, attempt = 0) {
       }
     } catch (err) {
       __mixdogMemoryLog(`[cycle3] scheduled queue failed: ${err?.message || err}\n`)
+      markCycleDone('cycle3', false, err?.message || err)
     } finally {
       _cycle3InFlight = false
+      if (_cycleRunning?.cycle === 'cycle3') { _cycleRunning = null; _writeCycleStateFile() }
     }
   }, retryConfig, signature)
 }
@@ -1495,9 +1552,11 @@ async function _finalizeCycle2Run(result) {
     await setCycleLastRun('cycle2', Date.now())
     await setCycleLastRun('cycle2_last_error', '')
     __mixdogMemoryLog('[cycle2] completed\n')
+    markCycleDone('cycle2', true)
   } else {
     await setCycleLastRun('cycle2_last_error', result.error || 'unknown error')
     __mixdogMemoryLog(`[cycle2] failed: ${result.error}\n`)
+    markCycleDone('cycle2', false, result.error || 'unknown error')
   }
 }
 
@@ -1574,6 +1633,36 @@ async function checkCycles() {
   if (now - last.cycle3 >= cycle3Ms) {
     await enqueueScheduledCycle3(cycle3Ms, 'scheduled')
   }
+
+  // ── Backlog watch + self-kick (cycle-health) ─────────────────────────────
+  // Cheap counts each tick (60s): surface a WARN when the pipeline is
+  // building a backlog, and if a cycle has not SUCCEEDED for 2h+ while its
+  // backlog is over threshold, kick one unscheduled run now instead of
+  // waiting for the interval — a stalled cycle otherwise hides behind
+  // "the schedule ran it" (attempt != success; see 2026-07 cycle2 stall).
+  try {
+    const unchunked = Number((await db.query(
+      `SELECT COUNT(*) c FROM entries WHERE chunk_root IS NULL AND NULLIF(btrim(session_id), '') IS NOT NULL`,
+    )).rows[0]?.c ?? 0)
+    const cycle2Pending = Number((await db.query(
+      `SELECT COUNT(*) c FROM entries WHERE is_root = 1 AND status = 'pending'`,
+    )).rows[0]?.c ?? 0)
+    _cycleBacklogSnapshot = { unchunked, cycle2_pending: cycle2Pending, at: now }
+    _writeCycleStateFile()
+    if (unchunked > BACKLOG_WARN_PENDING || cycle2Pending > BACKLOG_WARN_PENDING) {
+      _warnCycleHealth(`backlog unchunked=${unchunked} cycle2_pending=${cycle2Pending}`)
+    }
+    const SELF_KICK_STALE_MS = 2 * 3600_000
+    const c1Stale = (_cycleHealth.cycle1.last_success_at || last.cycle1 || 0) < now - SELF_KICK_STALE_MS
+    const c2Stale = (_cycleHealth.cycle2.last_success_at || last.cycle2 || 0) < now - SELF_KICK_STALE_MS
+    if (c1Stale && unchunked > BACKLOG_WARN_PENDING) {
+      _warnCycleHealth(`cycle1 self-kick: no success 2h+, unchunked=${unchunked}`)
+      await enqueueScheduledCycle1(0, 'self-kick')
+    } else if (c2Stale && cycle2Pending > BACKLOG_WARN_PENDING) {
+      _warnCycleHealth(`cycle2 self-kick: no success 2h+, pending=${cycle2Pending}`)
+      await enqueueScheduledCycle2(0, 'self-kick')
+    }
+  } catch { /* counts are best-effort; never fail the tick */ }
 }
 let _cycle2InFlight = false
 let _cycle3InFlight = false
@@ -1654,114 +1743,6 @@ function _beginRuntimeInit() {
   return _initPromise
 }
 
-
-function parsePeriod(period, hasQuery) {
-  if (!period && hasQuery) period = '30d'
-  if (!period) return null
-  if (period === 'all') return null
-  if (period === 'last') return { mode: 'last' }
-  // Calendar-day windows: 'today' anchors at local midnight rather than
-  // rolling 24h. Without this, a query asking 'today' at 01:30 would silently
-  // include yesterday's last 22.5h of activity, mislabelling them as
-  // 'today's work'. 'yesterday' is the previous calendar day.
-  if (period === 'today') {
-    const start = new Date()
-    start.setHours(0, 0, 0, 0)
-    return { startMs: start.getTime(), endMs: Date.now() }
-  }
-  if (period === 'yesterday') {
-    const start = new Date()
-    start.setDate(start.getDate() - 1)
-    start.setHours(0, 0, 0, 0)
-    const end = new Date(start)
-    end.setHours(23, 59, 59, 999)
-    return { startMs: start.getTime(), endMs: end.getTime() }
-  }
-  if (period === 'this_week' || period === 'last_week') {
-    // R6 P9: calendar Mon-Sun previous/current week. Mon-start ISO
-    // convention. Replaces R5 rolling 7-14d range which was empty for
-    // sessions where "last week" decisions actually fell on Mon (4/27) of
-    // this week. Precise calendar bounds match natural-language intuition.
-    const d = new Date()
-    d.setHours(0, 0, 0, 0)
-    const dayOfWeek = d.getDay()
-    const daysSinceMon = (dayOfWeek + 6) % 7
-    const thisWeekMon = new Date(d)
-    thisWeekMon.setDate(d.getDate() - daysSinceMon)
-    if (period === 'this_week') {
-      return { startMs: thisWeekMon.getTime(), endMs: Date.now() }
-    }
-    const lastWeekMon = new Date(thisWeekMon)
-    lastWeekMon.setDate(thisWeekMon.getDate() - 7)
-    const lastWeekSunEnd = new Date(thisWeekMon.getTime() - 1)
-    return { startMs: lastWeekMon.getTime(), endMs: lastWeekSunEnd.getTime() }
-  }
-  const relMatch = period.match(/^(\d+)(m|h|d)$/)
-  if (relMatch) {
-    const n = parseInt(relMatch[1])
-    const unit = relMatch[2]
-    const now = new Date()
-    if (unit === 'm') {
-      // Minute granularity is for "resume from the previous turn / pick
-      // up where we left off" style recall — sub-hour windows where 1h
-      // is too coarse. n=0 is invalid (the regex requires \d+ which
-      // matches "0" but a zero-width window returns no rows; leave that
-      // as caller-supplied no-op).
-      const start = new Date(now.getTime() - n * 60_000)
-      return { startMs: start.getTime(), endMs: now.getTime() }
-    }
-    if (unit === 'h') {
-      const start = new Date(now.getTime() - n * 3600_000)
-      return { startMs: start.getTime(), endMs: now.getTime() }
-    }
-    const start = new Date(now)
-    start.setDate(start.getDate() - n)
-    return { startMs: start.getTime(), endMs: now.getTime() }
-  }
-  const rangeMatch = period.match(/^(\d{4}-\d{2}-\d{2})~(\d{4}-\d{2}-\d{2})$/)
-  if (rangeMatch) {
-    return {
-      startMs: Date.parse(rangeMatch[1] + 'T00:00:00'),
-      endMs:   Date.parse(rangeMatch[2] + 'T23:59:59.999'),
-    }
-  }
-  const dateMatch = period.match(/^(\d{4}-\d{2}-\d{2})$/)
-  if (dateMatch) {
-    return {
-      startMs: Date.parse(dateMatch[1] + 'T00:00:00'),
-      endMs:   Date.parse(dateMatch[1] + 'T23:59:59.999'),
-      exact: true,
-    }
-  }
-  return null
-}
-
-function formatTs(tsMs) {
-  const n = Number(tsMs)
-  if (Number.isFinite(n) && n > 1e12) {
-    return new Date(n).toLocaleString('sv-SE').slice(0, 16)
-  }
-  return String(tsMs ?? '').slice(0, 16)
-}
-
-const CORE_RECALL_STOPWORDS = new Set([
-  'about', 'after', 'again', 'before', 'check', 'color', 'decision', 'decided',
-  'earlier', 'memory', 'previous', 'routing', 'stored', 'tell', 'what',
-])
-
-function coreRecallTerms(query) {
-  return [...new Set(String(query || '').toLowerCase().match(/[\p{L}\p{N}_-]{4,}/gu) || [])]
-    .filter((term) => !CORE_RECALL_STOPWORDS.has(term))
-    .slice(0, 8)
-}
-
-function normalizeRecallProjectScope(projectScope) {
-  const raw = String(projectScope || 'common').trim()
-  if (!raw || raw.toLowerCase() === 'common') return null
-  if (raw.toLowerCase() === 'all') return '*'
-  return raw
-}
-
 async function recallCoreRows(query, { projectScope, category, limit } = {}) {
   const terms = coreRecallTerms(query)
   if (terms.length === 0) return []
@@ -1815,10 +1796,120 @@ async function recallCoreRows(query, { projectScope, category, limit } = {}) {
   }))
 }
 
+// Session-scoped full drain before a recall(query) search. Chunking is
+// partitioned by session_id (memory-cycle1.mjs:409-431 selected_sessions
+// GROUP BY session_id + ROW_NUMBER PARTITION BY session_id), so this drains
+// ONLY the calling session's backlog via the same session_id override
+// (memory-cycle1.mjs:394) — other sessions' pending rows are left for the
+// periodic cycle1 sweep. Reuses recall-fasttrack's drainSessionCycle1
+// (session/compact.mjs:504) which loops cycle1 until raw rows hit 0 or a
+// no-progress pass. Safety limits: a 500-row hard cap (both in the pending
+// pre-check and as the per-call cycle1 batch ceiling) and cooperative
+// abort-signal propagation through handleMemoryAction — no time budget.
+// Window 20 rows per classifier prompt × concurrency 5 (haiku — cost is
+// negligible; 500 rows ≈ 25 prompts ≈ 5 waves).
+//
+// Multi-terminal safety: the memory daemon is one shared instance across
+// terminals (active-instance.json memory_port). Concurrent recall(query)
+// calls for the SAME session share one in-flight drain promise (dedup);
+// different sessions drain independently in parallel (cycle1's own
+// advisory-lock/coalesce guard in memory-cycle1.mjs still serializes actual
+// DB writes). A drain only gates recall for its OWN session — every other
+// terminal's recall (different session, or no session) proceeds unblocked.
+const RECALL_DRAIN_HARD_CAP_ROWS = 500
+async function _drainSessionForRecallQuery(sessionId, signal, deadlineMs = 0) {
+  if (!sessionId || signal?.aborted) return
+  const existing = _recallDrainInFlight.get(sessionId)
+  if (existing) { try { await existing } catch {} return }
+  let pendingCount = 0
+  try {
+    const r = await db.query(
+      `SELECT COUNT(*) c FROM entries WHERE chunk_root IS NULL AND session_id = $1`,
+      [sessionId],
+    )
+    pendingCount = Number(r.rows?.[0]?.c ?? 0)
+  } catch { return }
+  if (pendingCount <= 0) return
+  const runTool = async (_name, toolArgs) => {
+    const result = await handleMemoryAction(toolArgs, signal)
+    return result?.text ?? ''
+  }
+  const dumpArgs = {
+    action: 'dump_session_roots',
+    sessionId,
+    includeRaw: true,
+    limit: Math.min(RECALL_DRAIN_HARD_CAP_ROWS, Math.max(1, pendingCount)),
+  }
+  const drainPromise = (async () => {
+    try {
+      return await drainSessionCycle1(runTool, {
+        sessionId,
+        dumpArgs,
+        deadlineMs, // 0 = no time budget (query path); bare browse passes a
+        // short bound so a browse call never blocks minutes on LLM chunking.
+        maxPasses: 20, // safety stopper; drainSessionCycle1 also self-stops on no-progress
+        cycleArgs: {
+          min_batch: 1,
+          session_cap: 1,
+          batch_size: RECALL_DRAIN_HARD_CAP_ROWS,
+          rows_per_session: RECALL_DRAIN_HARD_CAP_ROWS,
+          window_size: 20,
+          concurrency: 5,
+        },
+      })
+    } catch (err) {
+      __mixdogMemoryLog(`[recall] session drain aborted/failed (sess=${sessionId}): ${err?.message || err}\n`)
+      return null
+    }
+  })()
+  _recallDrainInFlight.set(sessionId, drainPromise)
+  try {
+    await drainPromise
+  } finally {
+    if (_recallDrainInFlight.get(sessionId) === drainPromise) _recallDrainInFlight.delete(sessionId)
+  }
+}
+
+// Bare-browse drain deadline: best-effort only. A browse call ("show me
+// recent context") must never block on LLM chunking for minutes the way a
+// query recall is allowed to — the raw-row merge already covers unchunked
+// content, so the drain here is a nice-to-have upgrade to chunked/scored
+// rows, not a correctness requirement. Failures/timeouts are silently
+// tolerated; the raw fallback in the caller applies regardless.
+const RECALL_BROWSE_DRAIN_DEADLINE_MS = 1800
+
 async function handleSearch(args, signal) {
   // Cooperative abort check: throw early if the caller already aborted
   // (IPC cancel handler signals the AbortController before re-entry).
   if (signal?.aborted) throw signal.reason ?? new Error('aborted')
+  // Drain this session's unchunked backlog to zero BEFORE searching, so a
+  // recall never returns raw/unclassified transcript tail instead of the
+  // chunked summary. Runs whenever a session is scoped, query or not — a
+  // bare "show recent" browse hits raw unchunked rows just as often as a
+  // query recall does. Query path keeps the unbounded (deadlineMs:0) drain
+  // since chunked accuracy matters more than latency there; bare browse
+  // gets a short best-effort deadline — it must never block on LLM
+  // chunking for minutes, the raw-row merge covers the fallback either way.
+  {
+    const _drainSessionId = String(args?.sessionId || args?.session_id || '').trim()
+    const _drainHasQuery = Array.isArray(args?.query)
+      ? args.query.some((v) => String(v || '').trim())
+      : String(args?.query ?? '').trim() !== ''
+    if (_drainSessionId) {
+      await _drainSessionForRecallQuery(
+        _drainSessionId,
+        signal,
+        _drainHasQuery ? 0 : RECALL_BROWSE_DRAIN_DEADLINE_MS,
+      )
+    }
+  }
+  // #id lookup normalization: search_memories and memory action:'search'
+  // callers pass a single `id` (or an id array under that same key), not
+  // the `ids` array below. Normalize once here so every dispatch path gets
+  // exact-id lookup, not just callers who already knew to use `ids`.
+  if (!Array.isArray(args.ids) && args.id != null) {
+    args = { ...args, ids: Array.isArray(args.id) ? args.id : [args.id] }
+  }
   if (args?.currentSession === true || args?.sessionId || args?.session_id) {
     return await recallSessionRows(args)
   }
@@ -1830,7 +1921,7 @@ async function handleSearch(args, signal) {
   if (Array.isArray(args.ids) && args.ids.length > 0) {
     const ids = args.ids
       .map(v => Number(v))
-      .filter(v => Number.isFinite(v) && v > 0)
+      .filter(v => Number.isInteger(v) && v > 0)
     if (ids.length === 0) return { text: '(no valid ids)' }
     const includeArchived = args.includeArchived !== false
     const category = args.category
@@ -1935,8 +2026,6 @@ async function handleSearch(args, signal) {
         })),
         deadlineRace,
       ])
-    } catch (err) {
-      throw err
     } finally {
       clearTimeout(deadlineTimer)
     }
@@ -1972,7 +2061,15 @@ async function handleSearch(args, signal) {
     offset = Math.min(RECALL_OFFSET_CAP, offset)
   }
   const recallCapPrefix = recallCapNotes.length ? `${recallCapNotes.join('; ')}\n` : ''
-  const sort = args.sort != null ? String(args.sort) : 'importance'
+  // Recent-browsing default: a query-less recall is a "show me the latest
+  // messages" browse, not a relevance search — chronological order is the
+  // only ordering that makes sense there, so sort defaults to 'date' when
+  // no query is present (explicit args.sort still wins). Query recalls keep
+  // the importance default.
+  const hasQueryForSort = Array.isArray(args.query)
+    ? args.query.some((v) => String(v || '').trim())
+    : String(args.query ?? '').trim() !== ''
+  const sort = args.sort != null ? String(args.sort) : (hasQueryForSort ? 'importance' : 'date')
   // Chunk content is the primary recall output. Members default to true so
   // callers receive the raw chunk leaves (the cycle1-produced semantic
   // chunks) rather than just the root's cycle2-compressed summary line.
@@ -2071,13 +2168,16 @@ async function handleSearch(args, signal) {
       })
     }
     if (includeRaw) {
-      // Reserve slots for raw rows under sort=importance: hybrid rows are
-      // already score-sorted descending, so a full hybrid page (limit rows)
-      // would shut out raw rows entirely after slice(offset, offset+limit).
-      // Reserve up to RAW_RESERVE slots near the top of the post-slice
-      // window by trimming the hybrid prefix before merging, then re-sort
-      // for sort=date or otherwise append (already ranked) for importance.
-      const RAW_FETCH = 20
+      // Raw rows (chunk_root IS NULL) carry no retrievalScore, so a naive
+      // append-after-hybrid under sort=importance always lands them past
+      // slice(offset, offset+limit) once the hybrid pool exceeds one page —
+      // every page beyond the first silently drops them. Fetch a wider raw
+      // window (bounded like the hybrid candidate pool) and spread the
+      // fetched raw rows evenly across the WHOLE hybrid list before slicing,
+      // so every offset page gets its proportional share instead of only
+      // page 0. Same projectScope/ts window as the hybrid leg — filter
+      // parity (item 3) is deliberate, not accidental.
+      const RAW_FETCH = Math.min(500, Math.max(20, limit + offset))
       const rawRows = await readRawRowsInWindow(
         db,
         temporal?.startMs ?? null,
@@ -2091,10 +2191,10 @@ async function handleSearch(args, signal) {
         for (const r of newRaw) filtered.push(r)
         filtered.sort((a, b) => (Number(b.ts) || 0) - (Number(a.ts) || 0))
       } else {
-        // sort=importance: append raw rows after the hybrid page (mostly
-        // ineffective — slice(offset, offset+limit) typically shuts them
-        // out). Proper includeRaw paging fix deferred (needs fetching extra rows / paging redesign).
-        for (const r of newRaw) filtered.push(r)
+        // sort=importance: interleave raw rows at a fixed stride through the
+        // full (pre-slice) hybrid list instead of appending at the tail, so
+        // offset > 0 pages also draw from the raw pool proportionally.
+        filtered = interleaveRawRows(filtered, newRaw)
       }
     }
     const coreRows = await recallCoreRows(query, { projectScope, category, limit })
@@ -2133,7 +2233,16 @@ async function handleSearch(args, signal) {
 
   const filters = { limit: limit + offset }
   if (temporal?.startMs != null) { filters.ts_from = temporal.startMs; filters.ts_to = temporal.endMs }
-  if (temporal?.mode === 'last' && _bootTimestamp) {
+  // period='last' used to hard-cap ts_to at _bootTimestamp-1 unconditionally,
+  // which silently hid the CURRENT session's own content from a query-less
+  // recent browse (the whole point of "what did we just talk about"). Keep
+  // the boot cap only for session-less global browsing, where 'last' means
+  // "the previously completed session" and there's no session-scoped drain
+  // above to have already surfaced the in-flight rows. When a sessionId is
+  // present the drain above already pulled that session's raw backlog to
+  // zero, so the current session's rows are safe (and wanted) to include.
+  const _hasScopedSession = Boolean(String(args?.sessionId || args?.session_id || '').trim())
+  if (temporal?.mode === 'last' && _bootTimestamp && !_hasScopedSession) {
     filters.ts_to = _bootTimestamp - 1
   }
   filters.projectScope = projectScope
@@ -2142,55 +2251,33 @@ async function handleSearch(args, signal) {
   if (!includeArchived) filters.excludeStatuses = ['archived']
   if (includeMembers) filters.includeMembers = true
   const rows = await retrieveEntries(db, filters)
-  const sliced = rows.slice(offset, offset + limit)
-  return { text: recallCapPrefix + renderEntryLines(sliced) }
-}
-
-function renderEntryLines(rows) {
-  if (!rows || rows.length === 0) return '(no results)'
-  const lines = []
-  // Bound total emitted lines (roots x members) so a many-member recall can't
-  // inject unbounded output. Per-line content is already capped at 1000 chars;
-  // this caps the line COUNT. Narrow the query (limit/period/projectScope) for more.
-  const RECALL_LINE_CAP = 200
-  let _capped = false
-  outer:
-  for (const r of rows) {
-    const hasMembers = Array.isArray(r.members) && r.members.length > 0
-    if (hasMembers) {
-      // Chunks present: emit each member as its own line. Root row is a
-      // grouping artifact for retrieval — the caller wants the chunk
-      // content (cycle1 raw), not the cycle2-compressed summary.
-      for (const m of r.members) {
-        if (lines.length >= RECALL_LINE_CAP) { _capped = true; break outer }
-        const mTs = formatTs(m.ts)
-        const role = m.role === 'user' ? 'u' : m.role === 'assistant' ? 'a' : (m.role || '?')
-        const content = cleanMemoryText(String(m.content ?? '')).slice(0, 1000)
-        lines.push(`[${mTs}] ${role}: ${content} #${m.id}`)
-      }
-    } else {
-      if (lines.length >= RECALL_LINE_CAP) { _capped = true; break }
-      // No chunks (root not yet chunked by cycle1, or orphan leaf): emit
-      // the row itself in the same shape. element/summary fall back to
-      // raw content when both are absent.
-      const ts = formatTs(r.ts)
-      const element = r.element ?? ''
-      const summary = r.summary ?? ''
-      // Standalone leaf rows (is_root=0, no parent chunks_root resolved
-      // into a `members` list) carry their u/a role just like inline
-      // chunk members — surface it so the format stays consistent across
-      // the two emission paths.
-      const rolePrefix = r.is_root === 0 && r.role
-        ? (r.role === 'user' ? 'u: ' : r.role === 'assistant' ? 'a: ' : `${r.role}: `)
-        : ''
-      const body = element || summary
-        ? `${element}${summary ? ' — ' + summary : ''}`
-        : cleanMemoryText(String(r.content ?? '')).slice(0, 1000)
-      lines.push(`[${ts}] ${rolePrefix}${body.slice(0, 1000)} #${r.id}`)
+  // Recent-browsing raw merge: a query-less recall must show the freshest
+  // turns even when cycle1 hasn't chunked them yet. Roots lag ingest by up
+  // to a cycle interval, so on sort=date pull the raw (unchunked) window
+  // too and merge chronologically — original text first, no summaries.
+  // Query-less + includeRaw:false callers keep the roots-only view.
+  let merged = rows
+  if (sort === 'date' && args.includeRaw !== false) {
+    const rawRows = await readRawRowsInWindow(
+      db,
+      temporal?.startMs ?? null,
+      temporal?.endMs ?? (filters.ts_to ?? Date.now()),
+      Math.min(500, Math.max(20, limit + offset)),
+      { projectScope },
+    )
+    const seenIds = new Set(rows.map(r => Number(r.id)))
+    // Drop raw leaves already inlined as some returned root's member.
+    for (const r of rows) {
+      if (Array.isArray(r.members)) for (const m of r.members) seenIds.add(Number(m.id))
+    }
+    const newRaw = rawRows.filter(r => !seenIds.has(Number(r.id)))
+    if (newRaw.length > 0) {
+      merged = [...rows, ...newRaw]
+      merged.sort((a, b) => (Number(b.ts) || 0) - (Number(a.ts) || 0) || (Number(b.id) || 0) - (Number(a.id) || 0))
     }
   }
-  if (_capped) lines.push(`[recall truncated — showing first ${RECALL_LINE_CAP} lines; narrow the query (limit/period/projectScope) for the rest]`)
-  return lines.join('\n')
+  const sliced = merged.slice(offset, offset + limit)
+  return { text: recallCapPrefix + renderEntryLines(sliced) }
 }
 
 async function dumpSessionRootChunks(args = {}) {
@@ -2824,11 +2911,57 @@ async function handleMemoryAction(args, signal) {
 
   if (action === 'core') {
     const op = String(args.op ?? '').trim().toLowerCase()
-    if (!['add', 'edit', 'delete', 'list'].includes(op)) {
-      return { text: 'core requires op: "add" | "edit" | "delete" | "list"', isError: true }
+    if (!['add', 'edit', 'delete', 'list', 'candidates', 'promote', 'dismiss'].includes(op)) {
+      return { text: 'core requires op: "add" | "edit" | "delete" | "list" | "candidates" | "promote" | "dismiss"', isError: true }
     }
     const dataDir = (typeof DATA_DIR === 'string' ? DATA_DIR : resolvePluginData())
     if (!dataDir) return { text: 'core: memory data dir is not initialized', isError: true }
+    // Core-candidate promotion pipeline (proposal mode). The candidate flag
+    // lives on generated `entries`, which carry a project_id, so these ops MUST
+    // be project-scoped just like add/edit/delete — an unscoped listing/promote
+    // would leak candidates across projects. project_id resolution mirrors the
+    // block below: 'common'/null → COMMON (project_id NULL), '*' → all pools
+    // (candidates op only, same escape hatch as op:'list'). UI calls exactly
+    // these op names.
+    if (op === 'candidates' || op === 'promote' || op === 'dismiss') {
+      const hasPid = Object.prototype.hasOwnProperty.call(args, 'project_id')
+      const scope = (() => {
+        if (!hasPid || args.project_id == null) return null
+        const s = String(args.project_id).trim()
+        if (s === '' || s.toLowerCase() === 'common') return null
+        if (s === '*') return '*'
+        return s
+      })()
+      try {
+        if (op === 'candidates') {
+          const list = await listCoreCandidates(dataDir, scope)
+          if (list.length === 0) return { text: 'core candidates: none' }
+          return {
+            text: list.map(c =>
+              // project=<pool> lets the UI thread project_id into the follow-up
+              // promote/dismiss call — matters under project_id:'*' listing where
+              // rows span pools. Uses the same COMMON/slug convention as op:'list'.
+              `id=${c.id} project=${c.project_id == null ? 'COMMON' : c.project_id} [${c.category}] score=${c.score == null ? '-' : c.score.toFixed(2)} ${c.element} — ${String(c.summary || '').slice(0, 200)} (${c.reason})`,
+            ).join('\n'),
+          }
+        }
+        // promote/dismiss operate on a single id but are scope-guarded: the
+        // candidate must belong to the resolved scope (or COMMON), never '*'.
+        if (scope === '*') {
+          return { text: `core ${op}: project_id "*" only valid for op="candidates"`, isError: true }
+        }
+        if (op === 'promote') {
+          const entry = await promoteCoreCandidate(dataDir, args.id, { ...args, scope })
+          const mergeNote = entry.merged_with ? ` (merged into core id=${entry.merged_with}, sim=${entry.sim})` : ''
+          return { text: `core promoted candidate id=${args.id} → core id=${entry.id}${mergeNote}: [${entry.category}] ${entry.element}` }
+        }
+        // dismiss
+        const removed = await dismissCoreCandidate(dataDir, args.id, { scope })
+        return { text: `core candidate dismissed (id=${removed.id}): [${removed.category}] ${removed.element}` }
+      } catch (e) {
+        return { text: `core ${op} failed: ${e.message}`, isError: true }
+      }
+    }
     // Local trim helper — the manage-block trimOrNull at :1807 is scoped to
     // that branch and unreachable from here.
     // Normalize project_id: 'common' (case-insensitive) or null → null (COMMON pool); non-empty string → slug.
@@ -3095,37 +3228,6 @@ function createHttpMcpServer() {
   return s
 }
 
-function readBody(req) {
-  return new Promise((resolve, reject) => {
-    const chunks = []
-    req.on('data', c => chunks.push(c))
-    req.on('end', () => {
-      const raw = Buffer.concat(chunks).toString('utf8').trim()
-      if (!raw) { resolve({}); return }
-      try { resolve(JSON.parse(raw)) }
-      catch (error) {
-        const e = new Error(`invalid JSON body: ${error.message}`)
-        e.statusCode = 400
-        reject(e)
-      }
-    })
-    req.on('error', reject)
-  })
-}
-
-function sendJson(res, data, status = 200) {
-  const body = JSON.stringify(data)
-  res.writeHead(status, {
-    'Content-Type': 'application/json; charset=utf-8',
-    'Content-Length': Buffer.byteLength(body),
-  })
-  res.end(body)
-}
-
-function sendError(res, msg, status = 500) {
-  sendJson(res, { error: msg }, status)
-}
-
 async function awaitRuntimeReadyForHttp(res) {
   if (_initialized) return true
   if (!_initPromise) {
@@ -3141,29 +3243,6 @@ async function awaitRuntimeReadyForHttp(res) {
   }
 }
 
-// Origin/Referer guard for /admin/* mutation routes. Memory-service binds
-// 127.0.0.1, but browser DNS-rebinding or a stray cross-origin fetch could
-// still reach destructive endpoints (purge, backfill, entry mutations).
-// Server-to-server callers (setup-server, hooks) issue raw http.request
-// without a browser Origin/Referer, so absent headers pass; any non-loopback
-// Origin/Referer is rejected. Mirrors setup-server.mjs isAllowedOrigin.
-function isLocalOrigin(req) {
-  const LOOP = /^https?:\/\/(localhost|127\.0\.0\.1|\[::1\])(:\d+)?(\/|$)/i
-  const origin = req.headers.origin || ''
-  const referer = req.headers.referer || ''
-  if (origin && !LOOP.test(origin)) return false
-  if (referer && !LOOP.test(referer)) return false
-  return true
-}
-
-function normalizeCoreProjectId(value, { allowStar = false } = {}) {
-  if (value == null) return null
-  const s = String(value).trim()
-  if (!s || s.toLowerCase() === 'common') return null
-  if (allowStar && s === '*') return '*'
-  return s
-}
-
 async function buildSessionCoreMemoryPayload(cwd) {
   const projectId = resolveProjectScope(typeof cwd === 'string' && cwd ? cwd : null)
   const generatedScopeClause = projectId !== null
@@ -3246,6 +3325,9 @@ const httpServer = http.createServer(async (req, res) => {
         active_core_summaries: stats.active_core_summaries,
         active_core_summary_missing: stats.active_core_summary_missing,
         mv_hot_active_populated: stats.mv_hot_active_populated,
+        cycle_running: _cycleRunning,
+        cycle_health: _cycleHealth,
+        cycle_backlog: _cycleBacklogSnapshot,
       })
     } catch (e) { sendError(res, e.message) }
     return
@@ -3920,8 +4002,46 @@ export async function stop() {
     // postmaster keeps running after the memory service exits.
     if (!memorySecondaryMode()) {
       try {
-        const { stopPgForShutdown } = await import('./lib/pg/supervisor.mjs')
-        await stopPgForShutdown()
+        // Conservative check: only skip stopPgForShutdown when the owner
+        // record is unambiguously (a) a memory-runtime-daemon owner record
+        // (kind check — guards against a stale/foreign pid reusing this pid
+        // number for an unrelated process) and (b) that pid is alive AND not
+        // this process. Any read/parse failure or ambiguous state falls back
+        // to stopping PG (previous unconditional behavior) rather than
+        // risking an orphaned PG postmaster.
+        const anotherOwnerAlive = await (async () => {
+          try {
+            const { readSingletonOwner } = await import('../shared/singleton-owner.mjs')
+            const ownerPath = path.join(DATA_DIR, 'memory-runtime-owner.json')
+            const { owner, alive } = readSingletonOwner(ownerPath)
+            if (!alive) return false
+            if (owner?.kind !== 'memory-runtime-daemon') return false
+            const ownerPid = Number(owner?.pid)
+            if (!Number.isInteger(ownerPid) || ownerPid === process.pid) return false
+            // Best-effort process-name check (mirrors supervisor.mjs's
+            // isPostgresPid pattern) — confirms the pid is actually a node
+            // process before trusting it as a live sibling memory owner.
+            // Falls back to true (trust the owner file) when the platform
+            // check is unavailable or inconclusive.
+            try {
+              if (process.platform === 'win32') {
+                const { execFileSync } = await import('node:child_process')
+                const out = execFileSync('tasklist', ['/FI', `PID eq ${ownerPid}`, '/FO', 'CSV', '/NH'], { encoding: 'utf8', windowsHide: true })
+                if (!String(out || '').toLowerCase().includes('node')) return false
+              } else if (process.platform === 'linux') {
+                const comm = fs.readFileSync(`/proc/${ownerPid}/comm`, 'utf8').trim()
+                if (!comm.includes('node')) return false
+              }
+            } catch { /* inconclusive — trust the owner file (already alive+kind-matched) */ }
+            return true
+          } catch { return false }
+        })()
+        if (anotherOwnerAlive) {
+          __mixdogMemoryLog('[memory-service] shutdown: another live memory owner holds memory-runtime-owner.json — leaving PG running\n')
+        } else {
+          const { stopPgForShutdown } = await import('./lib/pg/supervisor.mjs')
+          await stopPgForShutdown()
+        }
       } catch {}
     } else {
       __mixdogMemoryLog('[memory-service] secondary mode; leaving shared PG running\n')