mixdog 0.9.1 → 0.9.3

package/src/runtime/memory/lib/memory-recall-scope-filter.mjs

@@ -18,11 +18,35 @@ export function buildCategoryFilterClause(offset, categories, { tableAlias = ''
   return { clause: `AND (${inner})`, params: [...cats] }
 }
 
+// Shared, param-less predicate excluding promoted/promoting core-candidate
+// roots AND member rows under such a root. Single source of truth so the hybrid
+// recall path (buildRecallScopeFilter) and the query-less browse path
+// (retrieveEntries) can't diverge. tableAlias='' → bare `entries` column refs.
+export function buildPromotedExclusionClauses(tableAlias = '') {
+  const p = `${tableAlias || 'entries'}.`
+  return [
+    // Promoted core-candidate roots have been absorbed into user-curated
+    // core_entries and archived by promoteCoreCandidate. Their content now
+    // lives in the {{USER_CORE}} slot, so surfacing the stale generated root
+    // would double-serve the same fact. 'promoting' (mid-flight or crashed
+    // promote awaiting recovery) is excluded too — its root is already archived
+    // and finalizes to 'promoted'. Member rows whose chunk_root points at a
+    // promoted/promoting root are excluded via EXISTS-on-root (the flag lives
+    // only on the root; members keep NULL). Constant predicates — no bind param.
+    `(${p}core_candidate_status IS NULL OR ${p}core_candidate_status NOT IN ('promoted', 'promoting'))`,
+    `NOT (${p}is_root = 0 AND ${p}chunk_root IS NOT NULL AND ${p}chunk_root <> ${p}id AND EXISTS (
+      SELECT 1 FROM entries r WHERE r.id = ${p}chunk_root AND r.is_root = 1 AND r.core_candidate_status IN ('promoted', 'promoting')
+    ))`,
+  ]
+}
+
 export function buildRecallScopeFilter(offset, options = {}, tableAlias = '') {
   const outerRef = tableAlias || 'entries'
   const p = `${outerRef}.`
   const clauses = [
     `NOT (${p}is_root = 0 AND ${p}chunk_root IS NOT DISTINCT FROM ${p}id AND ${p}status IS NOT DISTINCT FROM 'archived')`,
+    // Exclude promoted/promoting roots + their members (shared predicate).
+    ...buildPromotedExclusionClauses(tableAlias),
   ]
   const params = []
   let next = offset

package/src/runtime/memory/lib/memory-retrievers.mjs

@@ -1,5 +1,7 @@
 import { recallReadQuery } from './memory-recall-read-query.mjs'
 
+import { buildPromotedExclusionClauses } from './memory-recall-scope-filter.mjs'
+
 const VALID_CATEGORIES_SET = new Set([
   'rule', 'constraint', 'decision', 'fact', 'goal', 'preference', 'task', 'issue',
 ])
@@ -72,6 +74,12 @@ export async function retrieveEntries(db, filters = {}) {
     where.push(`chunk_root IS NULL`)
   }
 
+  // Exclude promoted/promoting core-candidate roots AND members under such a
+  // root — the query-less browse path (includeArchived) would otherwise surface
+  // rows the hybrid recall path already filters. Shared predicate (param-less)
+  // keeps this in lock-step with buildRecallScopeFilter.
+  where.push(...buildPromotedExclusionClauses())
+
   const limit = Math.max(1, Math.min(500, Number(filters.limit ?? 50)))
   const offset = Math.max(0, Number(filters.offset ?? 0))
   const sort = String(filters.sort ?? 'importance').trim().toLowerCase()

package/src/runtime/memory/lib/memory.mjs

@@ -136,9 +136,18 @@ export async function init(db, dims) {
   await db.exec(`CREATE INDEX IF NOT EXISTS idx_entries_phase_sweep ON entries(status, is_root, error_count, reviewed_at, id)`)
   await db.exec(`CREATE INDEX IF NOT EXISTS idx_entries_promoted_at ON entries(promoted_at) WHERE promoted_at IS NOT NULL`)
   await db.exec(`CREATE INDEX IF NOT EXISTS idx_entries_tsv         ON entries USING GIN (search_tsv)`)
-  await db.exec(`CREATE INDEX IF NOT EXISTS idx_entries_content_trgm ON entries USING GIN (content gin_trgm_ops) WHERE is_root = 1`)
-  await db.exec(`CREATE INDEX IF NOT EXISTS idx_entries_element_trgm ON entries USING GIN (element gin_trgm_ops) WHERE is_root = 1 AND element IS NOT NULL`)
-  await db.exec(`CREATE INDEX IF NOT EXISTS idx_entries_embedding_hnsw ON entries USING hnsw (embedding halfvec_cosine_ops) WHERE is_root = 1 AND embedding IS NOT NULL`)
+  // Recall CTEs (memory-recall-store.mjs dense/trgm legs) intentionally match
+  // BOTH root and leaf/chunk rows, so their SQL has NO `is_root = 1` predicate
+  // (only `embedding IS NOT NULL` / content|element|summary text filters).
+  // The old root-only PARTIAL indexes therefore could not be used by those
+  // queries — the planner fell back to a Seq Scan + top-N heapsort over every
+  // embedding (verified via EXPLAIN ANALYZE). Broaden the predicates to match
+  // the query shape so HNSW/GIN are actually used. A `summary` trgm index is
+  // added because the trgm leg also filters on `summary` but had no index.
+  await db.exec(`CREATE INDEX IF NOT EXISTS idx_entries_content_trgm ON entries USING GIN (content gin_trgm_ops)`)
+  await db.exec(`CREATE INDEX IF NOT EXISTS idx_entries_element_trgm ON entries USING GIN (element gin_trgm_ops) WHERE element IS NOT NULL`)
+  await db.exec(`CREATE INDEX IF NOT EXISTS idx_entries_summary_trgm ON entries USING GIN (summary gin_trgm_ops) WHERE summary IS NOT NULL`)
+  await db.exec(`CREATE INDEX IF NOT EXISTS idx_entries_embedding_hnsw ON entries USING hnsw (embedding halfvec_cosine_ops) WHERE embedding IS NOT NULL`)
 
   // BEFORE INSERT/UPDATE trigger keeps score in sync with category + last_seen_at
   // automatically; cycle code no longer needs to UPDATE entries SET score = ...
@@ -333,19 +342,127 @@ export async function validateEmbeddingDims(db, dimCount) {
   }
 }
 
+// One-time migration: broaden the recall indexes that were created as root-only
+// PARTIAL indexes (`WHERE is_root = 1 ...`) so they match the recall CTE query
+// predicates (which do NOT restrict is_root — recall matches leaf/chunk rows
+// too). A stale root-only index is unusable by those queries and forces a Seq
+// Scan. This runs on every boot (via ensureCurrentSchemaExtensions), so it is
+// carefully guarded: it only DROP+CREATEs an index when the CURRENT definition
+// still contains the `is_root = 1` predicate. Once broadened, every check is a
+// cheap catalog read and no rebuild happens. Best-effort: catalog-read or DDL
+// failures are logged and swallowed so a boot is never blocked by this.
+async function _migrateRecallIndexesIfStale(db) {
+  // Each entry: [indexName, newDefTailPredicate] where the presence of
+  // "is_root" in the live indexdef signals the stale root-only shape.
+  const targets = [
+    { name: 'idx_entries_content_trgm',   create: `CREATE INDEX idx_entries_content_trgm ON entries USING GIN (content gin_trgm_ops)` },
+    { name: 'idx_entries_element_trgm',   create: `CREATE INDEX idx_entries_element_trgm ON entries USING GIN (element gin_trgm_ops) WHERE element IS NOT NULL` },
+    { name: 'idx_entries_embedding_hnsw', create: `CREATE INDEX idx_entries_embedding_hnsw ON entries USING hnsw (embedding halfvec_cosine_ops) WHERE embedding IS NOT NULL` },
+  ]
+  try {
+    for (const t of targets) {
+      let def = null
+      try {
+        const r = await db.query(`SELECT indexdef FROM pg_indexes WHERE indexname = $1`, [t.name])
+        def = r.rows?.[0]?.indexdef ?? null
+      } catch { def = null }
+      // Missing index → post-loop IF-NOT-EXISTS ensures below self-heal trgm
+      // indexes; embedding_hnsw is also re-ensured by ensureCurrentSchemaExtensions.
+      if (def == null) continue
+      // Already broadened (no is_root predicate) → no-op, no rebuild.
+      if (!/is_root/i.test(def)) continue
+      try {
+        await db.exec(`DROP INDEX IF EXISTS ${t.name}`)
+        await db.exec(t.create)
+        __mixdogMemoryLog(`[memory] migrated stale root-only index ${t.name} → broadened to match recall query predicates\n`)
+      } catch (err) {
+        __mixdogMemoryLog(`[memory] recall index migration for ${t.name} failed: ${err?.message || err}\n`)
+      }
+    }
+    // Self-heal trgm recall indexes on already-bootstrapped DBs: init() will
+    // not re-run, and a missing index is not handled by the stale-shape loop
+    // above (def == null → continue). These IF-NOT-EXISTS ensures recreate any
+    // trgm index that never existed or whose migrate-create failed. No-op (cheap
+    // catalog check) when the broadened index is already present.
+    try {
+      await db.exec(`CREATE INDEX IF NOT EXISTS idx_entries_content_trgm ON entries USING GIN (content gin_trgm_ops)`)
+    } catch (err) {
+      __mixdogMemoryLog(`[memory] idx_entries_content_trgm ensure failed: ${err?.message || err}\n`)
+    }
+    try {
+      await db.exec(`CREATE INDEX IF NOT EXISTS idx_entries_element_trgm ON entries USING GIN (element gin_trgm_ops) WHERE element IS NOT NULL`)
+    } catch (err) {
+      __mixdogMemoryLog(`[memory] idx_entries_element_trgm ensure failed: ${err?.message || err}\n`)
+    }
+    try {
+      await db.exec(`CREATE INDEX IF NOT EXISTS idx_entries_summary_trgm ON entries USING GIN (summary gin_trgm_ops) WHERE summary IS NOT NULL`)
+    } catch (err) {
+      __mixdogMemoryLog(`[memory] idx_entries_summary_trgm ensure failed: ${err?.message || err}\n`)
+    }
+  } catch (err) {
+    __mixdogMemoryLog(`[memory] _migrateRecallIndexesIfStale failed: ${err?.message || err}\n`)
+  }
+}
+
 export async function ensureCurrentSchemaExtensions(db, dims) {
+  // One-time cleanup: attachment-only placeholder rows ('(attachment)' user
+  // content, e.g. Discord backend discord.mjs:724) predate the
+  // shouldExcludeIngestMessage() ingest-time filter (session-ingest.mjs).
+  // Delete any already-persisted rows so they stop polluting recall/cycle1.
+  // Idempotent (no-op once cleaned); best-effort so a failure never blocks boot.
+  try {
+    const cleaned = await db.query(
+      `DELETE FROM entries WHERE content = '(attachment)' AND role = 'user'`,
+    )
+    const n = Number(cleaned?.rowCount ?? 0)
+    if (n > 0) {
+      __mixdogMemoryLog(`[memory] ensureCurrentSchemaExtensions: removed ${n} attachment-only placeholder rows\n`)
+    }
+  } catch (err) {
+    __mixdogMemoryLog(`[memory] attachment-placeholder cleanup failed: ${err?.message || err}\n`)
+  }
   // core_entries gained an embedding column for cross-table semantic dedup
   // between user-curated rows and cycle2-promoted entries. ALTER + index are
   // idempotent and define the current runtime schema.
   if (Number.isInteger(dims) && dims > 0) {
     await db.exec(`ALTER TABLE core_entries ADD COLUMN IF NOT EXISTS embedding halfvec(${dims})`)
-    await db.exec(`CREATE INDEX IF NOT EXISTS idx_entries_embedding_hnsw ON entries USING hnsw (embedding halfvec_cosine_ops) WHERE is_root = 1 AND embedding IS NOT NULL`)
+    // One-time migration for EXISTING deployments (bootstrap-complete DBs never
+    // re-run init(), so the broadened index definitions there would otherwise
+    // never reach them). This path runs on EVERY boot, so we must NOT
+    // unconditionally DROP+CREATE an HNSW index (that would rebuild it on every
+    // startup). Only rebuild when the current index still carries the stale
+    // root-only `is_root = 1` predicate; once broadened, the check is a no-op.
+    await _migrateRecallIndexesIfStale(db)
+    // Residual (low risk, no action needed): cycle2's root-active embedding
+    // scans (memory-cycle2.mjs) now share this broader all-embedding HNSW
+    // instead of a root-only partial index; acceptable at current scale.
+    await db.exec(`CREATE INDEX IF NOT EXISTS idx_entries_embedding_hnsw ON entries USING hnsw (embedding halfvec_cosine_ops) WHERE embedding IS NOT NULL`)
     await db.exec(`CREATE INDEX IF NOT EXISTS core_entries_embedding_hnsw ON core_entries USING hnsw (embedding halfvec_cosine_ops) WHERE embedding IS NOT NULL`)
   }
   await db.exec(`ALTER TABLE entries ADD COLUMN IF NOT EXISTS core_summary text`)
 
 
 
+  // Core-candidate promotion pipeline (proposal mode): active entries the
+  // cycle2 nomination pass flags as strong core-memory candidates. Never
+  // auto-inserted into core_entries — a user approves each via the
+  // action:'core' op:'promote' handler. Columns are nullable and the ALTERs
+  // are idempotent (ADD COLUMN IF NOT EXISTS), safe to re-run every boot.
+  //   core_candidate_status: NULL (not a candidate) | 'candidate' | 'promoting'
+  //     (mid-flight promote, recoverable) | 'promoted' | 'dismissed'
+  //   core_candidate_at:     ms timestamp of last nomination/state change
+  // 'dismissed'/'promoted' are terminal for a given root so the pass never
+  // re-nominates the same entry.
+  await db.exec(`ALTER TABLE entries ADD COLUMN IF NOT EXISTS core_candidate_status text`)
+  await db.exec(`ALTER TABLE entries ADD COLUMN IF NOT EXISTS core_candidate_at bigint`)
+  // No index on core_candidate_status by design (round-2 finding #4): the only
+  // readers are listCoreCandidates (user picker, on-demand) and
+  // nominateCoreCandidates (once per cycle2, hourly). Both are rare and the
+  // entries table is small enough that a seq scan is fine — an index isn't
+  // worth the boot-time AccessExclusive build lock on the hot entries table.
+  // Drop it if a previous deploy created it (idempotent no-op otherwise).
+  await db.exec(`DROP INDEX IF EXISTS idx_entries_core_candidate`)
+
   // Dedupe core_entries before creating the unique index — keeps the row with
   // the most recent updated_at (id breaks ties), drops the rest.
   const dedupe = await db.query(`

package/src/runtime/memory/lib/pg/adapter.mjs

@@ -105,31 +105,50 @@ const _checkedConnect = checkedConnect
 // native PG db shim
 // ---------------------------------------------------------------------------
 
-function makeCompatDb(pgPool, schema) {
+function makeCompatDb(pgPool, schema, dataDir) {
   const db = {
     // query: use pool directly for single-statement queries
     query: async (sql, params) => {
-      const client = await _checkedConnect(pgPool, schema)
-      try {
-        return await client.query(sql, params)
-      } finally {
-        client.release()
-      }
+      return await withPgRetry(dataDir, schema, async (pool) => {
+        const client = await _checkedConnect(pool, schema)
+        try {
+          return await client.query(sql, params)
+        } finally {
+          client.release()
+        }
+      })
     },
 
     // exec: multi-statement SQL (semicolon-separated); single client for session state
     exec: async (sql) => {
-      const client = await _checkedConnect(pgPool, schema)
+      // Not retried: exec runs arbitrary multi-statement SQL where a partial
+      // failure mid-sequence is unobservable from here — replaying the whole
+      // string after recovery risks double-applying already-committed
+      // statements. On ECONNREFUSED, trigger recovery in the background (so
+      // the NEXT call gets a fresh pool) and propagate the original error.
+      const pool = instances.get(`${resolve(dataDir)}|${schema}`)?.pool ?? pgPool
       try {
-        await client.query(sql)
-      } finally {
-        client.release()
+        const client = await _checkedConnect(pool, schema)
+        try {
+          await client.query(sql)
+        } finally {
+          client.release()
+        }
+      } catch (err) {
+        if (err?.code === 'ECONNREFUSED') _recoverPgConnection(dataDir, schema).catch(() => {})
+        throw err
       }
     },
 
     // transaction: check out one client, BEGIN, run callback(tx), COMMIT or ROLLBACK
     transaction: async (fn) => {
-      const client = await _checkedConnect(pgPool, schema)
+      // Not retried — same rationale as exec(): a COMMIT that fails with
+      // ECONNREFUSED leaves the transaction's applied/rolled-back state
+      // unknown to this process; blindly replaying fn() could double-apply
+      // side effects. Recover in the background for the next caller and
+      // propagate the original error immediately.
+      const pool = instances.get(`${resolve(dataDir)}|${schema}`)?.pool ?? pgPool
+      const client = await _checkedConnect(pool, schema)
       try {
         await client.query('BEGIN')
         const tx = {
@@ -141,6 +160,7 @@ function makeCompatDb(pgPool, schema) {
         return result
       } catch (err) {
         try { await client.query('ROLLBACK') } catch {}
+        if (err?.code === 'ECONNREFUSED') _recoverPgConnection(dataDir, schema).catch(() => {})
         throw err
       } finally {
         client.release()
@@ -150,12 +170,116 @@ function makeCompatDb(pgPool, schema) {
     // close: drain pool
     close: () => pgPool.end(),
 
-    // Internal access for callers that need raw pool
-    _pool: pgPool,
+    // Internal access for callers that need raw pool. Getter (not a fixed
+    // field) so callers that hold onto `db` across a recovery cycle (e.g.
+    // trace-store's checkedConnect/pool.connect() call sites) transparently
+    // see the refreshed pool after withPgRetry swaps the cached instance —
+    // otherwise db._pool would keep pointing at the dead pre-recovery pool.
+    get _pool() {
+      return instances.get(`${resolve(dataDir)}|${schema}`)?.pool ?? pgPool
+    },
   }
   return db
 }
 
+// ---------------------------------------------------------------------------
+// Self-healing: pool query fails with ECONNREFUSED (target pg_port down while
+// the server process itself stays alive) → discard the stale pool via
+// closePgInstance and re-run ensurePgInstance so supervisor-pg restarts/
+// re-attaches PG, then retry the failed operation exactly once against the
+// fresh pool.
+//
+// Guards against runaway restart loops:
+//   - _recoverInFlight: at most one recovery coroutine per dataDir at a time;
+//     concurrent callers await the same promise instead of racing restarts.
+//   - _lastRecoverAt / RECOVER_COOLDOWN_MS: after a recovery attempt (success
+//     or failure) further ECONNREFUSED hits within the cooldown window
+//     surface the original error instead of re-triggering PG restart.
+// ---------------------------------------------------------------------------
+
+const RECOVER_COOLDOWN_MS = 15_000
+const _lastRecoverAt = new Map()   // dataDirKey → epoch ms of last recovery attempt
+const _recoverInFlight = new Map() // dataDirKey → Promise<boolean>
+
+function _instanceKeysForDataDir(dataDirKey) {
+  const prefix = `${dataDirKey}|`
+  return Array.from(instances.keys()).filter(k => k.startsWith(prefix))
+}
+
+async function _recoverPgConnection(dataDir, schema) {
+  const dataDirKey = resolve(dataDir)
+  // In-flight check FIRST: a concurrent recovery already running for this
+  // dataDir must be awaited by every caller (even ones arriving inside the
+  // cooldown window that starts once that recovery begins) — otherwise a
+  // caller that lands between the in-flight recovery's start and its cooldown
+  // stamp would see neither in-flight nor cooldown and could trigger a second
+  // redundant restart cycle.
+  if (_recoverInFlight.has(dataDirKey)) return _recoverInFlight.get(dataDirKey)
+  const now = Date.now()
+  const last = _lastRecoverAt.get(dataDirKey) || 0
+  if (now - last < RECOVER_COOLDOWN_MS) {
+    // Cooldown active — do not hammer PG restart on every failing query.
+    return false
+  }
+
+  const p = (async () => {
+    _lastRecoverAt.set(dataDirKey, Date.now())
+    __mixdogMemoryLog(`[pg-adapter] ECONNREFUSED on pool query — recovering PG for dataDir=${dataDirKey}\n`)
+    // memory + trace schemas share one PG cluster/port; discard every cached
+    // pool for this dataDir so a dead-port pool is never reused after restart.
+    // Track every schema whose pool was actually closed here so ALL of them
+    // get re-ensured below (not just the schema of the caller that happened
+    // to trigger this recovery) — otherwise a sibling schema's cached `db`
+    // handle is left pointing at an ended pool (its `_pool` getter falls back
+    // to the stale `pgPool` closure var) and its next query throws a
+    // "Cannot use a pool after calling end" TypeError instead of recovering.
+    const closedSchemas = new Set()
+    for (const key of _instanceKeysForDataDir(dataDirKey)) {
+      const sch = key.slice(dataDirKey.length + 1)
+      try { await closePgInstance(dataDir, { schema: sch }) } catch {}
+      closedSchemas.add(sch)
+    }
+    closedSchemas.add(schema) // the triggering schema, even if it had no cached instance yet
+    try {
+      for (const sch of closedSchemas) {
+        await ensurePgInstance(dataDir, { schema: sch })
+      }
+      __mixdogMemoryLog(`[pg-adapter] PG reconnect recovery complete for dataDir=${dataDirKey}\n`)
+      return true
+    } catch (e) {
+      __mixdogMemoryLog(`[pg-adapter] PG reconnect recovery failed for dataDir=${dataDirKey}: ${e?.message || e}\n`)
+      return false
+    }
+  })()
+  _recoverInFlight.set(dataDirKey, p)
+  try {
+    return await p
+  } finally {
+    _recoverInFlight.delete(dataDirKey)
+  }
+}
+
+/**
+ * Run `fn(pool)` against the current pool for (dataDir, schema); on
+ * ECONNREFUSED, recover PG (see _recoverPgConnection) and retry once against
+ * the refreshed pool. Non-ECONNREFUSED errors and cooldown/in-flight misses
+ * propagate the original error unchanged.
+ */
+async function withPgRetry(dataDir, schema, fn) {
+  const key = `${resolve(dataDir)}|${schema}`
+  const pool0 = instances.get(key)?.pool
+  try {
+    return await fn(pool0)
+  } catch (err) {
+    if (err?.code !== 'ECONNREFUSED') throw err
+    const recovered = await _recoverPgConnection(dataDir, schema)
+    if (!recovered) throw err
+    const pool1 = instances.get(key)?.pool
+    if (!pool1) throw err
+    return await fn(pool1)
+  }
+}
+
 // ---------------------------------------------------------------------------
 // Instance bootstrap — extensions + schemas (idempotent)
 // ---------------------------------------------------------------------------
@@ -299,7 +423,7 @@ export async function ensurePgInstance(dataDir, opts = {}) {
     await bootstrapInstance(pgPool, resolve(dataDir))
 
     // 5. Build the compat db shim.
-    const db = makeCompatDb(pgPool, schema)
+    const db = makeCompatDb(pgPool, schema, dataDir)
 
     const result = { db, pool: pgPool, host, port, runtimeDir, pgdataDir }
     instances.set(key, result)

package/src/runtime/memory/lib/promotion-fingerprint.mjs

@@ -0,0 +1,50 @@
+import fs from 'node:fs'
+import path from 'node:path'
+import crypto from 'node:crypto'
+
+// Plugin version + promotion code fingerprint. Extracted from index.mjs
+// (behavior-preserving). Callers pass PLUGIN_ROOT so this stays free of any
+// entry-point path resolution.
+
+export function readPluginVersion(pluginRoot) {
+  try {
+    return JSON.parse(fs.readFileSync(path.join(pluginRoot, 'package.json'), 'utf8')).version || '0.0.1'
+  } catch { return '0.0.1' }
+}
+
+const PROMOTION_FINGERPRINT_ROOTS = ['src/memory']
+
+function collectPromotionFingerprintFiles(pluginRoot) {
+  const out = []
+  const walk = (relDir) => {
+    let entries = []
+    try { entries = fs.readdirSync(path.join(pluginRoot, relDir), { withFileTypes: true }) }
+    catch { return }
+    for (const ent of entries) {
+      const rel = `${relDir}/${ent.name}`.replace(/\\/g, '/')
+      if (ent.isDirectory()) {
+        walk(rel)
+      } else if (ent.isFile() && rel.endsWith('.mjs')) {
+        out.push(rel)
+      }
+    }
+  }
+  for (const root of PROMOTION_FINGERPRINT_ROOTS) walk(root)
+  return out.sort()
+}
+
+export function readPromotionCodeFingerprint(pluginRoot) {
+  const hash = crypto.createHash('sha256')
+  const files = collectPromotionFingerprintFiles(pluginRoot)
+  for (const rel of files) {
+    hash.update(rel)
+    hash.update('\0')
+    try {
+      hash.update(fs.readFileSync(path.join(pluginRoot, rel)))
+    } catch {
+      hash.update('missing')
+    }
+    hash.update('\0')
+  }
+  return `src/memory:${files.length}:${hash.digest('hex').slice(0, 16)}`
+}

package/src/runtime/memory/lib/recall-format.mjs

@@ -0,0 +1,183 @@
+import { cleanMemoryText } from './memory.mjs'
+
+// Recall query/format helpers extracted verbatim from index.mjs
+// (behavior-preserving). Pure string/date logic plus row rendering.
+
+export function parsePeriod(period, hasQuery) {
+  if (!period && hasQuery) period = '30d'
+  if (!period) return null
+  if (period === 'all') return null
+  if (period === 'last') return { mode: 'last' }
+  // Calendar-day windows: 'today' anchors at local midnight rather than
+  // rolling 24h. Without this, a query asking 'today' at 01:30 would silently
+  // include yesterday's last 22.5h of activity, mislabelling them as
+  // 'today's work'. 'yesterday' is the previous calendar day.
+  if (period === 'today') {
+    const start = new Date()
+    start.setHours(0, 0, 0, 0)
+    return { startMs: start.getTime(), endMs: Date.now() }
+  }
+  if (period === 'yesterday') {
+    const start = new Date()
+    start.setDate(start.getDate() - 1)
+    start.setHours(0, 0, 0, 0)
+    const end = new Date(start)
+    end.setHours(23, 59, 59, 999)
+    return { startMs: start.getTime(), endMs: end.getTime() }
+  }
+  if (period === 'this_week' || period === 'last_week') {
+    // R6 P9: calendar Mon-Sun previous/current week. Mon-start ISO
+    // convention. Replaces R5 rolling 7-14d range which was empty for
+    // sessions where "last week" decisions actually fell on Mon (4/27) of
+    // this week. Precise calendar bounds match natural-language intuition.
+    const d = new Date()
+    d.setHours(0, 0, 0, 0)
+    const dayOfWeek = d.getDay()
+    const daysSinceMon = (dayOfWeek + 6) % 7
+    const thisWeekMon = new Date(d)
+    thisWeekMon.setDate(d.getDate() - daysSinceMon)
+    if (period === 'this_week') {
+      return { startMs: thisWeekMon.getTime(), endMs: Date.now() }
+    }
+    const lastWeekMon = new Date(thisWeekMon)
+    lastWeekMon.setDate(thisWeekMon.getDate() - 7)
+    const lastWeekSunEnd = new Date(thisWeekMon.getTime() - 1)
+    return { startMs: lastWeekMon.getTime(), endMs: lastWeekSunEnd.getTime() }
+  }
+  const relMatch = period.match(/^(\d+)(m|h|d)$/)
+  if (relMatch) {
+    const n = parseInt(relMatch[1])
+    const unit = relMatch[2]
+    const now = new Date()
+    if (unit === 'm') {
+      // Minute granularity is for "resume from the previous turn / pick
+      // up where we left off" style recall — sub-hour windows where 1h
+      // is too coarse. n=0 is invalid (the regex requires \d+ which
+      // matches "0" but a zero-width window returns no rows; leave that
+      // as caller-supplied no-op).
+      const start = new Date(now.getTime() - n * 60_000)
+      return { startMs: start.getTime(), endMs: now.getTime() }
+    }
+    if (unit === 'h') {
+      const start = new Date(now.getTime() - n * 3600_000)
+      return { startMs: start.getTime(), endMs: now.getTime() }
+    }
+    const start = new Date(now)
+    start.setDate(start.getDate() - n)
+    return { startMs: start.getTime(), endMs: now.getTime() }
+  }
+  const rangeMatch = period.match(/^(\d{4}-\d{2}-\d{2})~(\d{4}-\d{2}-\d{2})$/)
+  if (rangeMatch) {
+    return {
+      startMs: Date.parse(rangeMatch[1] + 'T00:00:00'),
+      endMs:   Date.parse(rangeMatch[2] + 'T23:59:59.999'),
+    }
+  }
+  const dateMatch = period.match(/^(\d{4}-\d{2}-\d{2})$/)
+  if (dateMatch) {
+    return {
+      startMs: Date.parse(dateMatch[1] + 'T00:00:00'),
+      endMs:   Date.parse(dateMatch[1] + 'T23:59:59.999'),
+      exact: true,
+    }
+  }
+  return null
+}
+
+export function formatTs(tsMs) {
+  const n = Number(tsMs)
+  if (Number.isFinite(n) && n > 1e12) {
+    return new Date(n).toLocaleString('sv-SE').slice(0, 16)
+  }
+  return String(tsMs ?? '').slice(0, 16)
+}
+
+export const CORE_RECALL_STOPWORDS = new Set([
+  'about', 'after', 'again', 'before', 'check', 'color', 'decision', 'decided',
+  'earlier', 'memory', 'previous', 'routing', 'stored', 'tell', 'what',
+])
+
+export function coreRecallTerms(query) {
+  return [...new Set(String(query || '').toLowerCase().match(/[\p{L}\p{N}_-]{4,}/gu) || [])]
+    .filter((term) => !CORE_RECALL_STOPWORDS.has(term))
+    .slice(0, 8)
+}
+
+export function normalizeRecallProjectScope(projectScope) {
+  const raw = String(projectScope || 'common').trim()
+  if (!raw || raw.toLowerCase() === 'common') return null
+  if (raw.toLowerCase() === 'all') return '*'
+  return raw
+}
+
+export function sessionRecallTerms(query) {
+  return [...new Set(String(query || '').toLowerCase().match(/[\p{L}\p{N}_./:-]{2,}/gu) || [])]
+    .filter((term) => !CORE_RECALL_STOPWORDS.has(term))
+    .slice(0, 12)
+}
+
+export function interleaveRawRows(hybridRows, rawRows) {
+  if (!Array.isArray(rawRows) || rawRows.length === 0) return hybridRows
+  const out = []
+  const stride = Math.max(1, Math.round(hybridRows.length / (rawRows.length + 1)))
+  let rawIdx = 0
+  for (let i = 0; i < hybridRows.length; i += 1) {
+    out.push(hybridRows[i])
+    if ((i + 1) % stride === 0 && rawIdx < rawRows.length) {
+      out.push(rawRows[rawIdx])
+      rawIdx += 1
+    }
+  }
+  while (rawIdx < rawRows.length) out.push(rawRows[rawIdx++])
+  return out
+}
+
+export function renderEntryLines(rows) {
+  if (!rows || rows.length === 0) return '(no results)'
+  const lines = []
+  // Bound total emitted lines (roots x members) so a many-member recall can't
+  // inject unbounded output. Per-line content is already capped at 1000 chars;
+  // this caps the line COUNT. Narrow the query (limit/period/projectScope) for more.
+  const RECALL_LINE_CAP = 200
+  let _capped = false
+  outer:
+  for (const r of rows) {
+    const hasMembers = Array.isArray(r.members) && r.members.length > 0
+    if (hasMembers) {
+      // Chunks present: emit each member as its own line. Root row is a
+      // grouping artifact for retrieval — the caller wants the chunk
+      // content (cycle1 raw), not the cycle2-compressed summary.
+      for (const m of r.members) {
+        if (lines.length >= RECALL_LINE_CAP) { _capped = true; break outer }
+        const mTs = formatTs(m.ts)
+        const role = m.role === 'user' ? 'u' : m.role === 'assistant' ? 'a' : (m.role || '?')
+        const content = cleanMemoryText(String(m.content ?? '')).slice(0, 1000)
+        lines.push(`[${mTs}] ${role}: ${content} #${m.id}`)
+      }
+    } else {
+      if (lines.length >= RECALL_LINE_CAP) { _capped = true; break }
+      // No chunks (root not yet chunked by cycle1, or orphan leaf): emit
+      // the row itself in the same shape. element/summary fall back to
+      // raw content when both are absent.
+      const ts = formatTs(r.ts)
+      const element = r.element ?? ''
+      const summary = r.summary ?? ''
+      // Standalone leaf rows (is_root=0, no parent chunks_root resolved
+      // into a `members` list) carry their u/a role just like inline
+      // chunk members — surface it so the format stays consistent across
+      // the two emission paths.
+      const rolePrefix = r.is_root === 0 && r.role
+        ? (r.role === 'user' ? 'u: ' : r.role === 'assistant' ? 'a: ' : `${r.role}: `)
+        : ''
+      const body = element || summary
+        ? `${element}${summary ? ' — ' + summary : ''}`
+        : cleanMemoryText(String(r.content ?? '')).slice(0, 1000)
+      // Unchunked raw leaf (cycle1 hasn't classified it yet): mark it so
+      // callers can tell fresh-but-unprocessed rows from chunked memory.
+      const pendingMark = (r.is_root === 0 && r.chunk_root == null) ? ' [pending]' : ''
+      lines.push(`[${ts}] ${rolePrefix}${body.slice(0, 1000)}${pendingMark} #${r.id}`)
+    }
+  }
+  if (_capped) lines.push(`[recall truncated — showing first ${RECALL_LINE_CAP} lines; narrow the query (limit/period/projectScope) for the rest]`)
+  return lines.join('\n')
+}