mixdog 0.9.13 → 0.9.15

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "mixdog",
-  "version": "0.9.13",
+  "version": "0.9.15",
   "private": false,
   "type": "module",
   "description": "Standalone mixdog coding-agent CLI/TUI workspace.",

package/src/defaults/cycle3-review-prompt.md

@@ -49,6 +49,16 @@ or inconclusive, keep the CORE entry.
 - `keep` — durable and already one short clause.
 - `update` — durable but verbose or multi-sentence → rewrite as one ≤120-char clause.
 - `merge` — duplicates another entry → fold into the survivor (same project pool).
+- `superseded` — a NEWER active core entry directly CONTRADICTS the value/state
+  this older entry asserts (same
+  subject, changed fact: a renamed thing, a moved location, a reversed
+  preference, a superseded decision). The older entry is no longer true → retire
+  it. You MUST name the newer core id that replaces it as `<newer_id>` — it must
+  be another entry id under review that holds the current fact, and not the same
+  id. Requires clear evidence of that newer contradicting core; when the two
+  could both hold, or you cannot cite a concrete newer id → `keep`. Unlike
+  `delete`, `superseded` archives (never physically removes) and applies in
+  default mode.
 - `delete` — records a past event, not a current rule or structure; OR merely
   restates a rule already in **Current rules** below (rules load every session,
   so a CORE copy is redundant); OR is sourced from code, rules files, or skill
@@ -59,6 +69,9 @@ or inconclusive, keep the CORE entry.
 A verbose durable entry is always `update`, never `keep`.
 Delete is the rarest verdict. Prefer `keep` for durable rules/preferences and
 `update` for compression when the current behavior is still valid.
+Use `superseded` (not `delete`) when the entry WAS a valid durable rule/fact but
+a newer active fact has replaced it — supersession is fact-change retirement,
+delete is not-durable-in-the-first-place removal.
 
 ## Current rules (Source Of Truth — loaded into the session every turn)
 
@@ -83,6 +96,7 @@ One line per entry id, any order:
 <id>|keep
 <id>|update|<element>|<summary>
 <id>|merge|<target_id>|<source_ids_csv>
+<id>|superseded|<newer_id>
 <id>|delete
 ```
 

package/src/defaults/memory-promote-prompt.md

@@ -105,11 +105,12 @@ Archive everything else: implementation specs, code-internal constants,
 measurements, resolved-bug stories, and status snapshots.
 
 The cap is an upper bound, not a target. When `Active < cap`, seed and grow the
-active set: a pending row with a concrete A/B reason that is NOT a
-Source-Of-Truth duplicate MUST be promoted with `active` — promotion is NOT
-reserved for already-active rows, and an empty active set must be bootstrapped
-from clear, non-duplicate A/B pending rows. When `Active > cap`, contract
-strictly: any active entry without a concrete A/B reason must archive.
+active set with **durable** L1/L2/L3 lessons only (not task/status snapshots,
+open issues, or in-flight work state). Prefer promoting clear, non-duplicate
+A/B pending rows that encode lasting behavior or map anchors; transient
+`task`/`issue` rows should archive unless they distill to a durable lesson.
+When `Active > cap`, contract strictly: any active entry without a concrete
+A/B reason must archive.
 
 If useful content is buried inside work narrative, keep only the durable L2
 behavior lesson (via `update` on an active row, or `active` for a pending row);
@@ -123,10 +124,9 @@ archive the surrounding story.
 - Never merge across project_id boundaries.
 - `element` <=100 chars. `summary` <=200 chars. No literal `|` or newlines.
 - When a row genuinely fails the A/B bar or you are unsure it qualifies, prefer
-  `archived`. But never withhold `active` from a pending row that clearly meets
-  A/B merely because it is currently pending — clear, non-duplicate A/B pending
-  rows are promoted, not archived (rows that restate current rules or
-  user-curated core still archive per Source Of Truth).
+  `archived`. Pending rows that clearly meet A/B as a durable lesson may use
+  `active`; pending task/status churn and narrative snapshots should archive
+  even under cap (Source-Of-Truth duplicates still archive per above).
 
 ## Output
 

package/src/runtime/agent/orchestrator/session/manager/pending-messages.mjs

@@ -4,10 +4,13 @@ import { join } from 'path';
 import { resolvePluginData } from '../../../../shared/plugin-paths.mjs';
 import { updateJsonAtomicSync } from '../../../../shared/atomic-file.mjs';
 import { promptContentText, isInternalRuntimeNotificationText } from './prompt-utils.mjs';
+import { loadSession } from '../store.mjs';
 
 const _sessionPendingMessages = new Map();
 const PENDING_MESSAGES_FILE = 'session-pending-messages.json';
 const PENDING_MESSAGES_MODE = 0o600;
+const PENDING_ORPHAN_TTL_MS = 7 * 24 * 60 * 60 * 1000;
+const PENDING_ORPHAN_GRACE_MS = 60 * 60 * 1000;
 const _pendingPersistBuffers = new Map();
 let _pendingPersistImmediate = null;
 
@@ -19,25 +22,58 @@ function isValidPendingSessionId(sessionId) {
     return typeof sessionId === 'string' && /^[A-Za-z0-9_-]+$/.test(sessionId);
 }
 
+function isTuiSteeringPendingKey(sessionId) {
+    return typeof sessionId === 'string' && sessionId.startsWith('tui_');
+}
+
+function normalizeTuiSteeringQueueEntry(entry) {
+    if (typeof entry === 'string') {
+        const text = entry.trim();
+        return text || null;
+    }
+    if (!entry || typeof entry !== 'object') return null;
+    if (typeof entry.text === 'string' && entry.text.trim()) {
+        const text = entry.text.trim();
+        const id = typeof entry.id === 'string' && entry.id.trim() ? entry.id.trim() : null;
+        return id ? { id, text } : text;
+    }
+    return null;
+}
+
 function normalizePendingStore(raw) {
     const sessions = raw && typeof raw === 'object' && raw.sessions && typeof raw.sessions === 'object'
         ? raw.sessions
         : {};
-    const out = { version: 1, updatedAt: Date.now(), sessions: {} };
+    const storeUpdatedAt = Number(raw?.updatedAt) || Date.now();
+    const touchedRaw = raw && typeof raw === 'object' && raw.sessionTouchedAt && typeof raw.sessionTouchedAt === 'object'
+        ? raw.sessionTouchedAt
+        : {};
+    const out = { version: 1, updatedAt: storeUpdatedAt, sessions: {}, sessionTouchedAt: {} };
     for (const [sid, value] of Object.entries(sessions)) {
         if (!isValidPendingSessionId(sid) || !Array.isArray(value)) continue;
-        const q = value
-            .map((entry) => {
-                if (typeof entry === 'string') return entry;
-                if (entry && typeof entry === 'object' && typeof entry.message === 'string') return entry.message;
-                return '';
-            })
-            .filter(Boolean);
-        if (q.length > 0) out.sessions[sid] = q;
+        const q = isTuiSteeringPendingKey(sid)
+            ? value.map(normalizeTuiSteeringQueueEntry).filter(Boolean)
+            : value
+                .map((entry) => {
+                    if (typeof entry === 'string') return entry;
+                    if (entry && typeof entry === 'object' && typeof entry.message === 'string') return entry.message;
+                    return '';
+                })
+                .filter(Boolean);
+        if (q.length > 0) {
+            out.sessions[sid] = q;
+            const touched = Number(touchedRaw[sid]);
+            out.sessionTouchedAt[sid] = Number.isFinite(touched) && touched > 0 ? touched : storeUpdatedAt;
+        }
     }
     return out;
 }
 
+function touchPendingSessionEntry(next, sessionId, now = Date.now()) {
+    if (!next.sessionTouchedAt || typeof next.sessionTouchedAt !== 'object') next.sessionTouchedAt = {};
+    next.sessionTouchedAt[sessionId] = now;
+}
+
 function normalizePendingMessageEntry(entry) {
     if (typeof entry === 'string') {
         const text = entry.trim();
@@ -86,7 +122,9 @@ function persistPendingMessages(sessionId, messages) {
             const q = Array.isArray(next.sessions[sessionId]) ? next.sessions[sessionId] : [];
             q.push(...persistedMessages);
             next.sessions[sessionId] = q;
-            next.updatedAt = Date.now();
+            const now = Date.now();
+            next.updatedAt = now;
+            touchPendingSessionEntry(next, sessionId, now);
             depth = q.length;
             return next;
         }, { compact: true, lock: true, mode: PENDING_MESSAGES_MODE, fsync: false });
@@ -143,6 +181,7 @@ function drainPersistedPendingMessages(sessionId) {
             drained = q.filter((m) => typeof m === 'string' && m.length > 0);
             if (drained.length === 0) return undefined;
             delete next.sessions[sessionId];
+            if (next.sessionTouchedAt) delete next.sessionTouchedAt[sessionId];
             next.updatedAt = Date.now();
             return next;
         }, { compact: true, lock: true, mode: PENDING_MESSAGES_MODE, fsync: false });
@@ -152,6 +191,75 @@ function drainPersistedPendingMessages(sessionId) {
     return drained;
 }
 
+function clearPersistedPendingMessages(sessionId) {
+    if (!isValidPendingSessionId(sessionId)) return;
+    try {
+        updateJsonAtomicSync(pendingMessagesPath(), (raw) => {
+            const next = normalizePendingStore(raw);
+            if (!Object.prototype.hasOwnProperty.call(next.sessions, sessionId)) return undefined;
+            delete next.sessions[sessionId];
+            if (next.sessionTouchedAt) delete next.sessionTouchedAt[sessionId];
+            next.updatedAt = Date.now();
+            return next;
+        }, { compact: true, lock: true, mode: PENDING_MESSAGES_MODE, fsync: false });
+    } catch (err) {
+        try { process.stderr.write(`[session] pending-message clear failed sessionId=${sessionId}: ${err?.message || err}\n`); } catch {}
+    }
+}
+
+function shouldEvictPendingSession(sessionId, ttlMs, entryTouchedAt, now = Date.now()) {
+    if (isTuiSteeringPendingKey(sessionId)) {
+        const entryTouch = Number(entryTouchedAt) || 0;
+        if (entryTouch <= 0) return false;
+        return (now - entryTouch) > ttlMs;
+    }
+    const session = loadSession(sessionId);
+    if (session) {
+        const touched = Math.max(
+            Number(session.updatedAt) || 0,
+            Number(session.lastHeartbeatAt) || 0,
+            Number(session.createdAt) || 0,
+        );
+        return touched > 0 && (now - touched) > ttlMs;
+    }
+    const entryTouch = Number(entryTouchedAt) || 0;
+    return entryTouch > 0 && (now - entryTouch) > PENDING_ORPHAN_GRACE_MS;
+}
+
+export function sweepOrphanedPendingMessages({ ttlMs = PENDING_ORPHAN_TTL_MS } = {}) {
+    const now = Date.now();
+    const removed = [];
+    try {
+        updateJsonAtomicSync(pendingMessagesPath(), (raw) => {
+            const next = normalizePendingStore(raw);
+            const ids = Object.keys(next.sessions);
+            if (ids.length === 0) return undefined;
+            for (const sid of ids) {
+                const entryTouchedAt = next.sessionTouchedAt?.[sid];
+                if (shouldEvictPendingSession(sid, ttlMs, entryTouchedAt, now)) {
+                    delete next.sessions[sid];
+                    if (next.sessionTouchedAt) delete next.sessionTouchedAt[sid];
+                    removed.push(sid);
+                }
+            }
+            if (removed.length === 0) return undefined;
+            next.updatedAt = now;
+            return next;
+        }, { compact: true, lock: true, mode: PENDING_MESSAGES_MODE, fsync: false });
+    } catch (err) {
+        try { process.stderr.write(`[session] pending-message sweep failed: ${err?.message || err}\n`); } catch {}
+        return 0;
+    }
+    if (removed.length > 0) {
+        try {
+            process.stderr.write(
+                `[session] pending-message sweep: removed ${removed.length} stale/orphan queue(s) (ttl=${Math.round(ttlMs / 86400000)}d) (${removed.slice(0, 5).join(', ')}${removed.length > 5 ? `, +${removed.length - 5} more` : ''})\n`,
+            );
+        } catch { /* ignore */ }
+    }
+    return removed.length;
+}
+
 function modelVisiblePendingMessages(messages) {
     return (Array.isArray(messages) ? messages : [])
         .map(pendingMessageQueueEntry)
@@ -229,7 +337,20 @@ export function drainPendingMessages(sessionId) {
 
 // Cleanup hook for closeSession — drop the in-memory queue and buffered-persist
 // entry so both Maps do not accumulate one entry per closed session.
-export function _dropPendingMessageState(id) {
+export function _dropPendingMessageState(id, { clearPersisted = true } = {}) {
+    if (!clearPersisted) {
+        const buffered = _pendingPersistBuffers.get(id);
+        if (buffered?.length) {
+            try { persistPendingMessages(id, buffered); } catch { /* ignore */ }
+        }
+    }
     try { _sessionPendingMessages.delete(id); } catch { /* ignore */ }
     try { _pendingPersistBuffers.delete(id); } catch { /* ignore */ }
+    if (clearPersisted) {
+        try { clearPersistedPendingMessages(id); } catch { /* ignore */ }
+    }
 }
+
+setImmediate(() => {
+    try { sweepOrphanedPendingMessages(); } catch { /* ignore */ }
+});

package/src/runtime/agent/orchestrator/session/manager.mjs

@@ -72,6 +72,7 @@ import {
     enqueuePendingMessage,
     drainPendingMessages,
     _dropPendingMessageState,
+    sweepOrphanedPendingMessages,
 } from './manager/pending-messages.mjs';
 import {
     bumpUsageMetricsTurnId,
@@ -2082,7 +2083,7 @@ export function closeSession(id, reason = 'manual', opts = {}) {
     // Drop the in-memory pending-message queue and any buffered-persist entry
     // for this session — otherwise both Maps accumulate one entry per closed
     // session for the life of the mcp-server.
-    _dropPendingMessageState(id);
+    _dropPendingMessageState(id, { clearPersisted: tombstone });
     // 4. Defer runtime map clear to next tick so any settling askSession can
     //    observe `closed=true` / bumped generation before we yank the entry.
     //    Disk tombstone remains — that's what blocks resurrection.
@@ -2222,6 +2223,7 @@ function hasActiveRuntimeWork() {
 
 function _runCleanupCycle() {
     if (hasActiveRuntimeWork()) return;
+    sweepOrphanedPendingMessages();
     sweepIdleSessions({ includeTombstones: true });
 }
 

package/src/runtime/memory/index.mjs

@@ -580,6 +580,7 @@ const _cycleScheduler = createCycleScheduler({
 const _startCycle1Run = _cycleScheduler.startCycle1Run
 const _awaitCycle1Run = _cycleScheduler.awaitCycle1Run
 const _finalizeCycle2Run = _cycleScheduler.finalizeCycle2Run
+const _finalizeCycle3Run = _cycleScheduler.finalizeCycle3Run
 
 // Transcript watcher lifecycle stays in the facade (owns _transcriptIngest);
 // the cycle tick loop start/stop is delegated to the scheduler.
@@ -769,6 +770,10 @@ async function _handleMemCycle3(args, config, signal) {
   }
   const result = await runCycle3(db, config || {}, DATA_DIR, c3Options)
   if (signal?.aborted) throw signal.reason ?? new Error('aborted')
+  // Stamp cycle3 success: the MCP path bypasses the scheduler's coalesced
+  // onCoalescedSuccess, so without this last_success_at stayed 0 despite
+  // successful runs.
+  await _finalizeCycle3Run(result)
   const parts = ['reviewed', 'kept', 'updated', 'merged', 'deleted']
     .map(k => `${k}=${result?.[k] || 0}`)
   if (result?.proposed) {
@@ -1523,11 +1528,11 @@ async function buildSessionCoreMemoryPayload(cwd) {
     ORDER BY score DESC, last_seen_at DESC
   `, projectId !== null ? [projectId] : [])).rows
   const commonRows = (await db.query(
-    `SELECT summary FROM core_entries WHERE project_id IS NULL ORDER BY id ASC`
+    `SELECT summary FROM core_entries WHERE project_id IS NULL AND (status IS NULL OR status = 'active') ORDER BY id ASC`
   )).rows
   const scopedRows = projectId !== null
     ? (await db.query(
-        `SELECT summary FROM core_entries WHERE project_id = $1 ORDER BY id ASC`,
+        `SELECT summary FROM core_entries WHERE project_id = $1 AND (status IS NULL OR status = 'active') ORDER BY id ASC`,
         [projectId]
       )).rows
     : []

package/src/runtime/memory/lib/core-memory-store.mjs

@@ -63,7 +63,9 @@ function throwIfAborted(signal) {
 async function _backfillNullEmbeddings(db, options = {}) {
   const signal = options?.signal
   throwIfAborted(signal)
-  const r = await db.query(`SELECT id, element, summary FROM core_entries WHERE embedding IS NULL`)
+  // Only refill live cores — archiveCore intentionally nulls the embedding to
+  // drop archived rows from recall; refilling them would resurrect them.
+  const r = await db.query(`SELECT id, element, summary FROM core_entries WHERE embedding IS NULL AND (status IS NULL OR status = 'active')`)
   if (r.rows.length === 0) return 0
   let filled = 0
   for (const row of r.rows) {
@@ -144,6 +146,7 @@ async function _findTopKCore(db, projectId, embedding, excludeId, { forUpdate =
     FROM core_entries
     WHERE embedding IS NOT NULL
       AND project_id IS NOT DISTINCT FROM $2
+      AND (status IS NULL OR status = 'active')
       ${exclusion}
     ORDER BY embedding <=> $1::halfvec
     LIMIT ${CORE_DEDUP_TOP_K}${forUpdate ? ' FOR UPDATE' : ''}`
@@ -188,15 +191,18 @@ async function _llmJudgeMerge(existing, incoming) {
 export async function listCore(dataDir, projectId = null) {
   const db = _getDb(dataDir)
   const cols = `id, element, summary, category, project_id, created_at, updated_at`
+  // Only live cores enter recall/review — archived (superseded) rows are
+  // retired but retained for audit. Legacy NULL status = active.
+  const live = `(status IS NULL OR status = 'active')`
   if (projectId === '*') {
-    const r = await db.query(`SELECT ${cols} FROM core_entries ORDER BY project_id NULLS FIRST, id ASC`)
+    const r = await db.query(`SELECT ${cols} FROM core_entries WHERE ${live} ORDER BY project_id NULLS FIRST, id ASC`)
     return r.rows
   }
   if (projectId === null) {
-    const r = await db.query(`SELECT ${cols} FROM core_entries WHERE project_id IS NULL ORDER BY id ASC`)
+    const r = await db.query(`SELECT ${cols} FROM core_entries WHERE project_id IS NULL AND ${live} ORDER BY id ASC`)
     return r.rows
   }
-  const r = await db.query(`SELECT ${cols} FROM core_entries WHERE project_id = $1 ORDER BY id ASC`, [projectId])
+  const r = await db.query(`SELECT ${cols} FROM core_entries WHERE project_id = $1 AND ${live} ORDER BY id ASC`, [projectId])
   return r.rows
 }
 
@@ -242,14 +248,37 @@ export async function addCore(dataDir, { element, summary, category }, projectId
     }
     let r
     try {
+      // Savepoint so a unique-collision doesn't abort the whole tx — we recover
+      // by reviving an archived row on the same connection below.
+      await client.query('SAVEPOINT ins')
       r = await client.query(
         `INSERT INTO core_entries(element, summary, category, project_id, embedding, created_at, updated_at)
          VALUES ($1, $2, $3, $4, $5::halfvec, $6, $7)
          RETURNING id, element, summary, category, project_id, created_at, updated_at`,
         [el, sm, cat, projectId, embedding ? embeddingToSql(embedding) : null, now, now],
       )
+      await client.query('RELEASE SAVEPOINT ins')
     } catch (err) {
       if (err.code === '23505') {
+        await client.query('ROLLBACK TO SAVEPOINT ins')
+        // Unique (project_id, element) collision. If the colliding row is an
+        // archived (superseded) row, the fact is being re-asserted → revive it
+        // in place: flip back to active, clear archived_at, overwrite content.
+        // Avoids a partial-index migration. An active collision is a genuine
+        // duplicate → surface the error.
+        const revived = await client.query(
+          `UPDATE core_entries
+           SET summary = $1, category = $2, embedding = $3::halfvec,
+               status = 'active', archived_at = NULL, updated_at = $4
+           WHERE project_id IS NOT DISTINCT FROM $5 AND element = $6
+             AND status = 'archived'
+           RETURNING id, element, summary, category, project_id, created_at, updated_at`,
+          [sm, cat, embedding ? embeddingToSql(embedding) : null, now, projectId, el],
+        )
+        if (revived.rows.length > 0) {
+          await client.query('COMMIT')
+          return { ...revived.rows[0], revived_from_archived: true }
+        }
         throw new Error(`core entry already exists: project=${projectId ?? 'COMMON'} element=${JSON.stringify(el.slice(0, 200))}`)
       }
       throw err
@@ -339,6 +368,80 @@ export async function deleteCore(dataDir, id) {
   return r.rows[0]
 }
 
+// Archive (retire without physical removal) a core entry whose fact was
+// superseded by a newer active fact. Non-destructive: flips status to
+// 'archived' + stamps archived_at so the row can be recovered/audited, and
+// drops it from the recall/review pool. Safe-by-default: unlike deleteCore this
+// is reversible and runs in conservative mode. Relies on the nullable status/
+// archived_at columns added in ensureCurrentSchemaExtensions (no migration
+// beyond those additive columns).
+//
+// Takes the same core:${project} advisory lock as addCore/editCore and
+// re-checks the row inside it, so a concurrent addCore merge/overwrite that
+// changed the fact after cycle3 read it is NOT clobbered. `expect` carries the
+// element/summary cycle3 reviewed; if the live row drifted from it the archive
+// is skipped (returns { skipped:true, reason:'content drift' }).
+export async function archiveCore(dataDir, id, expect = null) {
+  const numId = Number(id)
+  if (!Number.isInteger(numId) || numId <= 0) throw new Error('integer id > 0 required')
+  const db = _getDb(dataDir)
+  const now = Date.now()
+  const client = await checkedConnect(db._pool, 'memory')
+  try {
+    await client.query('BEGIN')
+    await client.query(`SET LOCAL lock_timeout = '5s'`)
+    // Lock ORDER must match addCore/editCore: advisory (pool) FIRST, then the
+    // row FOR UPDATE — otherwise same-row concurrency deadlocks. The advisory
+    // key needs project_id, so read it first WITHOUT a row lock (plain SELECT,
+    // no FOR UPDATE → acquires no row lock, can't invert ordering), take the
+    // pool advisory lock, THEN FOR UPDATE the row and re-validate under it.
+    const pre = (await client.query(
+      `SELECT project_id FROM core_entries WHERE id = $1`,
+      [numId],
+    )).rows[0]
+    if (!pre) throw new Error(`no entry with id=${numId}`)
+    const poolKey = `core:${pre.project_id == null ? 'COMMON' : pre.project_id}`
+    await client.query(`SELECT pg_advisory_xact_lock(hashtext($1))`, [poolKey])
+    // Now take the row lock under the pool lock and re-read — a concurrent
+    // addCore holding the same advisory lock may have merged/overwritten or
+    // moved the row's project_id between our pre-read and the lock.
+    const locked = (await client.query(
+      `SELECT id, element, summary, project_id, status FROM core_entries WHERE id = $1 FOR UPDATE`,
+      [numId],
+    )).rows[0]
+    if (!locked || !(locked.status == null || locked.status === 'active')) {
+      await client.query('ROLLBACK')
+      return { id: numId, skipped: true, reason: 'concurrently archived/removed' }
+    }
+    // If project_id moved pools between pre-read and lock, our advisory lock is
+    // on the wrong pool → bail rather than archive under a mismatched lock.
+    if ((locked.project_id ?? null) !== (pre.project_id ?? null)) {
+      await client.query('ROLLBACK')
+      return { id: numId, skipped: true, reason: 'pool changed under lock' }
+    }
+    if (expect && (String(expect.element ?? '') !== String(locked.element ?? '') ||
+                   String(expect.summary ?? '') !== String(locked.summary ?? ''))) {
+      await client.query('ROLLBACK')
+      return { id: numId, skipped: true, reason: 'content drift' }
+    }
+    const r = await client.query(
+      `UPDATE core_entries
+       SET status = 'archived', archived_at = $1, updated_at = $2, embedding = NULL
+       WHERE id = $3 AND (status IS NULL OR status = 'active')
+       RETURNING *`,
+      [now, now, numId],
+    )
+    await client.query('COMMIT')
+    if (r.rows.length === 0) return { id: numId, skipped: true, reason: 'concurrently archived/removed' }
+    return r.rows[0]
+  } catch (err) {
+    try { await client.query('ROLLBACK') } catch {}
+    throw err
+  } finally {
+    client.release()
+  }
+}
+
 // ─── Core-candidate promotion pipeline (proposal mode) ───────────────────────
 //
 // nominateCoreCandidates flags strong active entries as core-memory
@@ -446,6 +549,7 @@ export async function nominateCoreCandidates(dataDir, options = {}) {
            SELECT inner_c.embedding
            FROM core_entries inner_c
            WHERE inner_c.embedding IS NOT NULL
+            AND (inner_c.status IS NULL OR inner_c.status = 'active')
              AND (inner_c.project_id IS NULL OR inner_c.project_id IS NOT DISTINCT FROM e.project_id)
            ORDER BY inner_c.embedding <=> e.embedding
            LIMIT 1

package/src/runtime/memory/lib/cycle-scheduler.mjs

@@ -30,6 +30,8 @@ const CYCLE1_AUTO_RESTART_COOLDOWN_MS = 5 * 60_000
 const BACKLOG_WARN_COOLDOWN_MS = 10 * 60_000
 const BACKLOG_WARN_PENDING = 500
 const BACKLOG_WARN_FAILURES = 5
+// Max back-to-back cycle2 passes per scheduled slot (config: cycle2.catchup_passes).
+const CYCLE2_CATCHUP_PASSES = 4
 
 export function createCycleScheduler(deps) {
   const {
@@ -255,20 +257,41 @@ export function createCycleScheduler(deps) {
       _cycle2InFlight = true
       markCycleRunning('cycle2')
       try {
-        let c2Options = {
-          coalescedRetry: true,
-          onCoalescedSuccess: _finalizeCycle2Run,
-        }
-        if (typeof c2Options?.callLlm !== 'function') {
-          c2Options = { ...c2Options, callLlm: getCycle2CallLlm() }
-        }
-        const result = await runCycle2(getDb(), config, c2Options, dataDir)
-        if (result?.skippedInFlight) {
-          scheduleScheduledCycle2(config, signature, attempt + 1)
-        } else if (result?.coalescedRetryNoop) {
-          log('[cycle2] scheduled queue noop\n')
-        } else if (result?.ok === false) {
-          await _finalizeCycle2Run(result)
+        // Catch-up drain: one scheduled slot may run several back-to-back
+        // passes while pending roots remain, so a backlog above the batch
+        // size drains in one interval instead of one batch per hour.
+        const drainPasses = Math.max(1, Number(config?.catchup_passes ?? CYCLE2_CATCHUP_PASSES))
+        for (let pass = 0; pass < drainPasses; pass++) {
+          let c2Options = {
+            coalescedRetry: true,
+            onCoalescedSuccess: _finalizeCycle2Run,
+          }
+          if (typeof c2Options?.callLlm !== 'function') {
+            c2Options = { ...c2Options, callLlm: getCycle2CallLlm() }
+          }
+          const result = await runCycle2(getDb(), config, c2Options, dataDir)
+          if (result?.skippedInFlight) {
+            scheduleScheduledCycle2(config, signature, attempt + 1)
+            break
+          }
+          if (result?.coalescedRetryNoop) {
+            log('[cycle2] scheduled queue noop\n')
+            break
+          }
+          if (result?.ok === false) {
+            await _finalizeCycle2Run(result)
+            break
+          }
+          // A gate parse/coverage failure marks the run failed even with
+          // ok=true; never chain passes on a failing gate.
+          if (result?.gate_failed === true) break
+          if (pass + 1 >= drainPasses) break
+          const pendingRes = await getDb().query(
+            `SELECT COUNT(*) c FROM entries WHERE is_root = 1 AND status = 'pending'`,
+          )
+          const pendingLeft = Number(pendingRes?.rows?.[0]?.c ?? 0)
+          if (pendingLeft <= 0) break
+          log(`[cycle2] catch-up pass ${pass + 2}/${drainPasses}: pending=${pendingLeft}\n`)
         }
       } catch (err) {
         log(`[cycle2] scheduled queue failed: ${err?.message || err}\n`)
@@ -489,6 +512,15 @@ export function createCycleScheduler(deps) {
     startCycle1Run: _startCycle1Run,
     awaitCycle1Run: _awaitCycle1Run,
     finalizeCycle2Run: _finalizeCycle2Run,
+    // cycle3 success recorder: MCP-driven runs go through runCycle3 directly
+    // (no coalesced onCoalescedSuccess), so callers stamp success here to keep
+    // cycles.cycle3.last_success_at honest. Non-mutating/failed runs skipped.
+    finalizeCycle3Run: async (result) => {
+      if (!result || result.skippedInFlight || result.coalescedRetryNoop) return
+      if (result.error) { markCycleDone('cycle3', false, result.error); return }
+      await setCycleLastRun('cycle3', Date.now())
+      markCycleDone('cycle3', true)
+    },
     periodicCycle1Config,
     // lifecycle
     startCycles,