mixdog 0.9.19 → 0.9.21

package/src/runtime/memory/index.mjs

@@ -83,6 +83,9 @@ import { init as initKoMorph } from './lib/ko-morph.mjs'
 import { createCycleLlmAdapters } from './lib/cycle-llm-adapters.mjs'
 import { createCycleScheduler } from './lib/cycle-scheduler.mjs'
 import { createQueryHandlers } from './lib/query-handlers.mjs'
+import { createSessionIngestRuntime } from './lib/session-ingest-runtime.mjs'
+import { createMemoryActionHandlers } from './lib/memory-action-handlers.mjs'
+import { createHttpRouter } from './lib/http-router.mjs'
 import {
   readMainConfig,
   readRecapEnabled,
@@ -161,6 +164,88 @@ function touchDaemonIdleTimer(reason = 'activity') {
   _idleShutdownTimer.unref?.()
 }
 
+// ── Connected-client tracking + prompt shutdown ───────────────────────────
+// The daemon is shared by multiple proxy clients (TUI host + channels worker,
+// potentially several sessions). Each client registers/deregisters over HTTP
+// (see /client/register, /client/deregister in lib/http-router.mjs). When the
+// last client goes away we arm a short grace timer (default 10s) so a quick
+// reconnect keeps the daemon warm, but an actually-closed CLI reaps the daemon
+// in seconds instead of waiting out the 10-minute idle TTL (kept as backstop).
+const MEMORY_CLIENT_GRACE_MS = Math.max(0, Number(process.env.MIXDOG_MEMORY_CLIENT_GRACE_MS) || 10_000)
+const _connectedClients = new Map() // clientPid -> lastSeenMs
+let _everHadClient = false
+let _clientGraceTimer = null
+let _clientSweepTimer = null
+
+function _clientShutdownEnabled() {
+  return MEMORY_DAEMON_MODE && MEMORY_CLIENT_GRACE_MS > 0
+}
+
+function pruneDeadClients() {
+  for (const pid of [..._connectedClients.keys()]) {
+    if (!_isPidAliveLocal(pid)) _connectedClients.delete(pid)
+  }
+}
+
+function cancelClientGrace() {
+  if (_clientGraceTimer) {
+    try { clearTimeout(_clientGraceTimer) } catch {}
+    _clientGraceTimer = null
+  }
+}
+
+function armClientGrace(reason = 'last client gone') {
+  if (!_clientShutdownEnabled() || _clientGraceTimer) return
+  _clientGraceTimer = setTimeout(() => {
+    _clientGraceTimer = null
+    pruneDeadClients()
+    if (_connectedClients.size > 0) return
+    __mixdogMemoryLog(`[memory-service] daemon client grace elapsed (${reason}); shutting down\n`)
+    stop()
+      .then(() => process.exit(0))
+      .catch((e) => {
+        __mixdogMemoryLog(`[memory-service] daemon client-grace shutdown failed: ${e?.message || e}\n`)
+        process.exit(1)
+      })
+  }, MEMORY_CLIENT_GRACE_MS)
+  _clientGraceTimer.unref?.()
+}
+
+function startClientSweep() {
+  if (_clientSweepTimer || !_clientShutdownEnabled()) return
+  // Reap clients that died without deregistering so a crashed CLI still frees
+  // the daemon in grace-scale time rather than waiting for the idle TTL.
+  const interval = Math.max(1000, Math.min(MEMORY_CLIENT_GRACE_MS, 5000))
+  _clientSweepTimer = setInterval(() => {
+    pruneDeadClients()
+    if (_everHadClient && _connectedClients.size === 0) armClientGrace('all clients gone (sweep)')
+  }, interval)
+  _clientSweepTimer.unref?.()
+}
+
+function registerClient(clientPid) {
+  const pid = parsePositivePid(clientPid)
+  if (!pid) return true
+  // Reject registration once shutdown has begun. stop() sets _stopPromise
+  // synchronously (before its first await) and, in daemon mode, always ends
+  // in process.exit — so a daemon that is draining will never revive. Signal
+  // the proxy (via a distinct 503) to respawn a fresh daemon instead of
+  // binding to this dying one, which would fail the subsequent /api/tool.
+  if (_stopPromise) return false
+  _connectedClients.set(pid, Date.now())
+  _everHadClient = true
+  cancelClientGrace()
+  startClientSweep()
+  return true
+}
+
+function deregisterClient(clientPid) {
+  const pid = parsePositivePid(clientPid)
+  if (pid) _connectedClients.delete(pid)
+  pruneDeadClients()
+  if (_everHadClient && _connectedClients.size === 0) armClientGrace('last client deregistered')
+}
+
 function advertiseMemoryPort(boundPort, attempt = 0) {
   if (!Number.isFinite(boundPort) || boundPort <= 0) return
   _currentAdvertisedPort = boundPort
@@ -255,52 +340,6 @@ let _initialized = false
 let _initPromise = null
 let _stopPromise = null
 let _bootTimestamp = null
-// Post-ingest raw-embedding flush chain (facade-local). The checkCycles tick
-// keeps its OWN independent guard inside the scheduler; this chain serializes
-// flushes kicked from ingestSessionMessages so ingest bursts never stack
-// embedding work, while still guaranteeing every ingest's rows get their own
-// flush pass (the old boolean guard silently SKIPPED bursts, leaving rows
-// embedding-less until the ~60s tick — a recall (no results) window).
-let _rawEmbedFlushChain = Promise.resolve()
-// Per-session ingest serialization. Concurrent ingest_session calls for the
-// SAME session raced on MAX(source_turn) → duplicate turn allocation. Chain
-// same-session ingests so the MAX read + insert loop for one session never
-// overlaps another for the same session. Different sessions stay parallel.
-const _ingestSessionChains = new Map()
-// Cache of (role, cleaned content) per session message OBJECT, keyed by
-// identity (WeakMap — entries vanish once the message is GC'd, e.g. after
-// compaction drops the array). The subset-reingest ordinal fix below must
-// replay cleanMemoryText/shouldExcludeIngestMessage over messages[0, start)
-// on every call; without caching that turned an O(limit)-bounded ingest into
-// an O(full transcript) regex pass on every hydrate. Message objects are
-// immutable transcript entries reused by reference across calls (recall-
-// fasttrack re-ingests the same in-memory array as the session grows), so
-// once a message's identity fields are computed they never change — caching
-// makes every call after the first pay only for genuinely NEW messages,
-// restoring the limit-bounded cost in steady state.
-const _ingestIdentityFieldsCache = new WeakMap()
-// Return { role, content } for a session message's dedup identity, or null if
-// the message would be skipped by ingest (no role / excluded / empty content
-// after cleaning). Cached per message object so repeated calls over the same
-// (unchanged) transcript prefix never re-run the expensive clean/normalize
-// regex pipeline.
-function _ingestIdentityFields(m) {
-  if (_ingestIdentityFieldsCache.has(m)) return _ingestIdentityFieldsCache.get(m)
-  let fields = null
-  const role = normalizeIngestRole(m.role)
-  if (role && !shouldExcludeIngestMessage(m)) {
-    const content = cleanMemoryText(sessionMessageContentForIngest(m))
-    if (content && content.trim()) fields = { role, content }
-  }
-  _ingestIdentityFieldsCache.set(m, fields)
-  return fields
-}
-
-// Ingest now WAITS for its embedding flush (bounded) so freshly ingested rows
-// are dense-searchable the moment ingest_session returns. On a cold ONNX
-// model the flush can stall on warmup; the race below caps the wait and lets
-// the flush finish in the background (tick fallback still sweeps stragglers).
-const INGEST_EMBED_WAIT_MS = 15_000
 // Boot-edge background warmup. ONNX session creation on the embedding worker
 // thread is CPU-heavy, so it must not overlap the worker's own init (DB open,
 // schema, cycle wiring). Previously this was gated behind a fixed setTimeout —
@@ -311,6 +350,10 @@ const INGEST_EMBED_WAIT_MS = 15_000
 
 const TRANSCRIPT_OFFSETS_KEY = 'state.transcript_offsets'
 const CYCLE_LAST_RUN_KEY = 'state.cycle_last_run'
+// Per-session durable high-water for untimestamped-repeat ordinals (one small
+// hash→next-ordinal map per session, only for identities that reached a
+// duplicate). Stored in the `meta` kv (entries schema untouched).
+const SESSION_INGEST_ORDINALS_KEY_PREFIX = 'state.session_ingest_ordinals.'
 
 // Transcript ingest cluster (extracted to lib/transcript-ingest.mjs). Live
 // db/config coupling is injected so index.mjs keeps lifecycle ownership.
@@ -331,6 +374,22 @@ const {
   parseTsToMs,
 } = _transcriptIngest
 
+// Session ingest runtime (extracted to lib/session-ingest-runtime.mjs). Owns
+// the per-session chains, identity cache, and post-ingest raw-embedding flush
+// chain; live db + parseTsToMs are injected so the facade keeps db ownership.
+const _sessionIngest = createSessionIngestRuntime({
+  getDb: () => db,
+  log: __mixdogMemoryLog,
+  parseTsToMs,
+  loadOrdinalHighWater: async (sessionId) => {
+    const raw = await getMetaValue(db, `${SESSION_INGEST_ORDINALS_KEY_PREFIX}${sessionId}`, 'null')
+    try { return JSON.parse(raw) } catch { return null }
+  },
+  saveOrdinalHighWater: (sessionId, obj) =>
+    setMetaValue(db, `${SESSION_INGEST_ORDINALS_KEY_PREFIX}${sessionId}`, JSON.stringify(obj)),
+})
+const { ingestSessionMessages } = _sessionIngest
+
 // Boot-edge embedding warmup queue (extracted to lib/embedding-warmup.mjs).
 const _embeddingWarmup = createEmbeddingWarmup({
   canStart: embeddingWarmupCanStart,
@@ -499,155 +558,6 @@ async function setCycleLastRun(kind, ts) {
   await mergeMetaValue(db, CYCLE_LAST_RUN_KEY, { [kind]: ts })
 }
 
-async function ingestSessionMessages(args = {}) {
-  const sessionId = String(args.sessionId || args.session_id || `session-${Date.now()}`).trim()
-  // Serialize per-session so the MAX(source_turn) read + insert loop for one
-  // session never overlaps a concurrent ingest for the SAME session (they
-  // otherwise race the turn allocator and double-allocate). Distinct sessions
-  // run in parallel.
-  const prev = _ingestSessionChains.get(sessionId) ?? Promise.resolve()
-  const run = prev.catch(() => {}).then(() => _ingestSessionMessagesImpl(sessionId, args))
-  _ingestSessionChains.set(sessionId, run.catch(() => {}))
-  const tail = _ingestSessionChains.get(sessionId)
-  try {
-    return await run
-  } finally {
-    // Best-effort GC: drop the map entry only if no later call chained after us.
-    if (_ingestSessionChains.get(sessionId) === tail) _ingestSessionChains.delete(sessionId)
-  }
-}
-
-async function _ingestSessionMessagesImpl(sessionId, args = {}) {
-  const messages = Array.isArray(args.messages) ? args.messages : []
-  // Recall fast-track hydrates the current session before compaction; allow
-  // callers to ingest the full in-memory transcript instead of silently
-  // clipping long sessions at 500 turns. Default remains conservative.
-  const limit = Math.max(1, Math.min(5000, Number(args.limit) || 200))
-  const start = Math.max(0, messages.length - limit)
-  const projectId = resolveProjectScope(typeof args.cwd === 'string' && args.cwd ? args.cwd : null)
-  let considered = 0
-  let inserted = 0
-  // Monotonic ingest order, independent of the current (post-compaction)
-  // array index. source_turn used to be `i+1`, but after compaction shrinks /
-  // reindexes session.messages a NEWLY appended turn gets a LOW i and thus a
-  // LOW source_turn — and since dump_session_roots / recall order by
-  // source_turn first, it would sort BEFORE older pre-compaction rows. Seed a
-  // running counter from the current max source_turn for this session so every
-  // new row is assigned a turn strictly greater than all previously-ingested
-  // ones (true continuation order). Re-ingested (ON CONFLICT) rows keep their
-  // original turn and do not consume a new one.
-  let prevMaxTurn = 0
-  try {
-    const maxRow = await db.query(
-      `SELECT COALESCE(MAX(source_turn), 0) AS max_turn FROM entries WHERE session_id = $1`,
-      [sessionId],
-    )
-    prevMaxTurn = Number(maxRow.rows?.[0]?.max_turn) || 0
-  } catch { prevMaxTurn = 0 }
-  const turnAllocator = createIngestTurnAllocator(prevMaxTurn)
-  const _identityOccurrence = new Map()
-  // Per-session-stable ordinal for untimestamped, textually-identical repeats.
-  // Must NOT use the global next source_turn (differs every run → re-ingest
-  // duplicates). The Nth identical (role,content) untimestamped turn gets
-  // ordinal N based on its POSITION IN THE FULL messages ARRAY (0..i), not
-  // merely within this call's [start, len) window. Seed the counter by
-  // replaying the SAME identity/exclude logic over messages[0, start) below
-  // (no DB writes, no query — the full array is already in memory) so a
-  // SUBSET re-ingest (e.g. only a session's later half) reproduces the exact
-  // ordinal a full re-ingest would assign at that array position. Appended
-  // genuine repeats therefore never collide with earlier persisted rows of
-  // the same identity, while a full identical re-ingest still reproduces the
-  // same ordinals/source_refs and ON CONFLICT dedupes exactly.
-  for (let i = 0; i < start; i += 1) {
-    const m = messages[i]
-    if (!m || typeof m !== 'object') continue
-    // Cached (WeakMap-keyed) so a repeated hydrate over the SAME prefix
-    // objects only pays the clean/normalize cost once per message, keeping
-    // this seed pass effectively free after the first ingest call.
-    const fields = _ingestIdentityFields(m)
-    if (!fields) continue
-    const occKey = `${fields.role}\u0000${fields.content}`
-    _identityOccurrence.set(occKey, (_identityOccurrence.get(occKey) ?? 0) + 1)
-  }
-  for (let i = start; i < messages.length; i += 1) {
-    const m = messages[i]
-    if (!m || typeof m !== 'object') continue
-    const role = normalizeIngestRole(m.role)
-    // ingest_session persists user/assistant only; system/developer/tool rows
-    // are dropped so recall-fasttrack summaries stay conversation-focused and
-    // do not re-inject content already in the protected system prefix.
-    if (!role) continue
-    // Exclude synthetic / non-conversation rows entirely (reference-files
-    // injections, compaction summaries, protected-context `.` acks, internal
-    // runtime nudges). These are mechanical noise, not conversation.
-    if (shouldExcludeIngestMessage(m)) continue
-    // Pure-conversation shaping: only the human/model prose text. The ingest
-    // shaper NEVER inlines tool_call / tool_result traces and strips the
-    // deterministic manager.mjs user-turn prefix envelopes (# Session /
-    // # Additional context / # Prefetch / # Task) so only the real human
-    // prompt remains. cleanMemoryText then removes the <system-reminder> block
-    // and residual transcript noise.
-    const content = cleanMemoryText(sessionMessageContentForIngest(m))
-    if (!content || !content.trim()) continue
-    considered += 1
-    const tsMs = parseTsToMs(m.ts ?? m.timestamp ?? (Date.now() - (messages.length - i)))
-    // Assign the next monotonic turn BEFORE building the source_ref so identical
-    // untimestamped repeats get distinct identities (peekNext is stable until a
-    // row is actually inserted → next()).
-    const assignedTurn = turnAllocator.peekNext()
-    // Stable occurrence index for this identity (pre-hash; role+content is a
-    // sufficient discriminator for the duplicate case the ordinal disambiguates),
-    // seeded above from messages[0, start) so it reflects full-array position
-    // regardless of where this call's window starts.
-    const occKey = `${role}\u0000${content}`
-    const occurrence = (_identityOccurrence.get(occKey) ?? 0)
-    _identityOccurrence.set(occKey, occurrence + 1)
-    // Stable per-message identity. The previous `session:${id}#${i+1}` key was
-    // positional, so after compaction shrinks/reindexes session.messages a
-    // later turn could reuse an old index and be silently skipped by
-    // ON CONFLICT DO NOTHING. stableSessionSourceRef hashes only durable
-    // fields (role, original ts if present, tool ids, content) — never the
-    // synthesized tsMs fallback or the loop index. For untimestamped turns the
-    // monotonic ordinal is folded in so genuine repeats persist (not collapsed).
-    const sourceRef = stableSessionSourceRef(sessionId, m, role, content, occurrence)
-    const result = await db.query(`
-      INSERT INTO entries(ts, role, content, source_ref, session_id, source_turn, project_id)
-      VALUES ($1, $2, $3, $4, $5, $6, $7)
-      ON CONFLICT DO NOTHING
-    `, [tsMs, role, content, sourceRef, sessionId, assignedTurn, projectId])
-    const rowInserted = Number(result.rowCount ?? result.affectedRows ?? 0) || 0
-    if (rowInserted > 0) {
-      inserted += rowInserted
-      turnAllocator.next()
-    }
-  }
-  // Always-on post-ingest raw embedding: freshly ingested rows become
-  // dense-searchable immediately (autoclear/recall-fasttrack hydration,
-  // recall empty-fallback), without waiting for cycle1 chunking or the
-  // ~60s background tick. Local ONNX only — no LLM cost, so it runs
-  // regardless of the recap toggle. SYNCHRONOUS (bounded): ingest_session
-  // resolves only after this session's rows are embedded, so an immediately
-  // following recall sees them in the dense leg. Bursts serialize on
-  // _rawEmbedFlushChain instead of being skipped; a 15s cap keeps a cold
-  // ONNX warmup from wedging ingest (tick fallback sweeps what's left).
-  if (inserted > 0) {
-    const run = _rawEmbedFlushChain
-      .catch(() => {}) // never let a previous flush failure poison the chain
-      .then(() => flushRawEmbeddings(db, { limit: 200 }))
-      .then((r) => {
-        if (r.attempted > 0) __mixdogMemoryLog(`[embed] post-ingest raw flush attempted=${r.attempted} embedded=${r.embedded}\n`)
-        return r
-      })
-      .catch((err) => __mixdogMemoryLog(`[embed] post-ingest raw flush failed: ${err?.message || err}\n`))
-    _rawEmbedFlushChain = run
-    let timer
-    await Promise.race([
-      run,
-      new Promise((resolve) => { timer = setTimeout(resolve, INGEST_EMBED_WAIT_MS) }),
-    ]).finally(() => clearTimeout(timer))
-  }
-  return { text: `ingest_session: considered=${considered} inserted=${inserted} session=${sessionId}` }
-}
 
 // ── Cycle scheduling cluster (extracted to lib/cycle-scheduler.mjs) ────────
 // The mutually-referential cycle machinery (health ledger, cycle1 outer
@@ -782,828 +692,30 @@ const {
   entryStats,
 } = __queryHandlers
 
-async function _handleMemCycle1(args, config, signal) {
-  const minBatchOverride = Number(args?.min_batch)
-  const sessionCapOverride = Number(args?.session_cap)
-  const batchSizeOverride = Number(args?.batch_size)
-  const windowSizeOverride = Number(args?.window_size ?? args?.windowSize)
-  const rowsPerSessionOverride = Number(args?.rows_per_session ?? args?.rowsPerSession ?? args?.max_rows_per_session ?? args?.maxRowsPerSession)
-  const concurrencyOverride = Number(args?.concurrency)
-  const sessionIdOverride = String(args?.sessionId ?? args?.session_id ?? '').trim()
-  const baseCycle1 = config?.cycle1 || {}
-  let cycle1Config = baseCycle1
-  // _runCycle1Impl reads `config?.min_batch ?? config?.cycle1?.min_batch ??
-  // default` — top-level wins, so pin the override at top-level only.
-  if (Number.isFinite(minBatchOverride) && minBatchOverride > 0) {
-    cycle1Config = { ...cycle1Config, min_batch: minBatchOverride }
-  }
-  if (Number.isFinite(sessionCapOverride) && sessionCapOverride > 0) {
-    cycle1Config = { ...cycle1Config, session_cap: sessionCapOverride }
-  }
-  if (Number.isFinite(batchSizeOverride) && batchSizeOverride > 0) {
-    cycle1Config = { ...cycle1Config, batch_size: batchSizeOverride }
-  }
-  if (Number.isFinite(windowSizeOverride) && windowSizeOverride > 0) {
-    cycle1Config = { ...cycle1Config, window_size: windowSizeOverride }
-  }
-  if (Number.isFinite(rowsPerSessionOverride) && rowsPerSessionOverride > 0) {
-    cycle1Config = { ...cycle1Config, rows_per_session: rowsPerSessionOverride }
-  }
-  if (sessionIdOverride) {
-    cycle1Config = { ...cycle1Config, session_id: sessionIdOverride }
-  }
-  if (Number.isFinite(concurrencyOverride) && concurrencyOverride > 0) {
-    cycle1Config = { ...cycle1Config, concurrency: Math.min(8, Math.floor(concurrencyOverride)) }
-  }
-  const callerDeadlineMs = Number(args?._callerDeadlineMs) || 0
-  if (signal?.aborted) throw signal.reason ?? new Error('aborted')
-  const cycle1Options = callerDeadlineMs > 0 ? { callerDeadlineMs, signal } : { signal }
-  if (typeof args?._callLlm === 'function') {
-    cycle1Options.callLlm = args._callLlm
-  }
-  const result = await _awaitCycle1Run(
-    cycle1Config,
-    cycle1Options,
-  )
-  if (signal?.aborted) throw signal.reason ?? new Error('aborted')
-  const pendingStr = result?.pendingRows != null ? result.pendingRows : 0
-  const inFlightStr = result?.skippedInFlight === true ? 'true' : 'false'
-  const timedOutPart = result?.timedOutWaiting === true ? ' timedOut=true' : ''
-  const omitted = Array.isArray(result?.omitted_row_ids) ? result.omitted_row_ids.length : Number(result?.quality?.omitted_rows || 0)
-  const prefiltered = Array.isArray(result?.prefiltered_row_ids) ? result.prefiltered_row_ids.length : Number(result?.quality?.prefiltered_rows || 0)
-  const failedRows = Array.isArray(result?.failed_row_ids) ? result.failed_row_ids.length : Number(result?.quality?.failed_rows || 0)
-  const invalidChunks = Array.isArray(result?.invalid_chunks) ? result.invalid_chunks.length : Number(result?.quality?.invalid_chunks || 0)
-  return {
-    ...result,
-    text: `cycle1: chunks=${result.chunks} processed=${result.processed} skipped_chunks=${result.skipped}` +
-      ` omitted=${omitted} prefiltered=${prefiltered} failed_rows=${failedRows} invalid_chunks=${invalidChunks}` +
-      ` pending=${pendingStr} inFlight=${inFlightStr}${timedOutPart}`,
-  }
-}
-
-async function _handleMemCycle2(args, config, signal) {
-  if (signal?.aborted) throw signal.reason ?? new Error('aborted')
-  let c2Options = { signal }
-  if (typeof c2Options?.callLlm !== 'function') {
-    c2Options = { ...c2Options, callLlm: getCycle2CallLlm() }
-  }
-  const result = await runCycle2(db, config?.cycle2 || {}, c2Options, DATA_DIR)
-  if (signal?.aborted) throw signal.reason ?? new Error('aborted')
-  await _finalizeCycle2Run(result)
-  const counts = {
-    promoted: result?.promoted || 0,
-    archived: result?.archived || 0,
-    merged: result?.merged || 0,
-    updated: result?.updated || 0,
-    kept: result?.kept || 0,
-    rejected_verb: result?.rejected_verb || 0,
-    merge_rejected: result?.merge_rejected || 0,
-    missing_core: result?.missing_core_summary || 0,
-    core_backfill: result?.core_embedding_backfill || 0,
-    cascade_drop: result?.cascade?.dropped || 0,
-    phase_merge: result?.phase_merge?.merged || 0,
-    core_overlap: result?.phase_merge?.core_overlap || 0,
-  }
-  const parts = Object.entries(counts).filter(([, v]) => v > 0).map(([k, v]) => `${k}=${v}`)
-  if (parts.length) return { text: `cycle2 ${parts.join(' ')}` }
-  // No applied counts — disambiguate the "noop" so a broken gate is visible
-  // instead of looking like a clean, nothing-to-do run.
-  let cause = ''
-  if (result?.skippedInFlight) cause = ' (skipped: in-flight)'
-  else if (result?.ok === false) cause = ` (error: ${result.error || 'unknown'})`
-  else if (result?.gate_failed) cause = ' (gate_failed)'
-  return { text: `cycle2 noop${cause}` }
-}
-
-async function _handleMemCycle3(args, config, signal) {
-  if (signal?.aborted) throw signal.reason ?? new Error('aborted')
-  const confirmed = args?.confirm === 'APPLY CYCLE3'
-  const requestedMode = typeof args?.cycle3Mode === 'string' ? args.cycle3Mode : null
-  const applyMode = confirmed
-    ? 'confirmed'
-    : (requestedMode === 'proposal' || requestedMode === 'dry-run' || requestedMode === 'dryrun')
-      ? 'proposal'
-      : 'conservative'
-  let c3Options = { signal, apply: confirmed ? true : undefined, applyMode }
-  if (typeof c3Options?.callLlm !== 'function') {
-    c3Options = { ...c3Options, callLlm: getCycle3CallLlm() }
-  }
-  const result = await runCycle3(db, config || {}, DATA_DIR, c3Options)
-  if (signal?.aborted) throw signal.reason ?? new Error('aborted')
-  // Stamp cycle3 success: the MCP path bypasses the scheduler's coalesced
-  // onCoalescedSuccess, so without this last_success_at stayed 0 despite
-  // successful runs.
-  await _finalizeCycle3Run(result)
-  const parts = ['reviewed', 'kept', 'updated', 'merged', 'deleted']
-    .map(k => `${k}=${result?.[k] || 0}`)
-  if (result?.proposed) {
-    parts.push(`proposal_update=${result.proposed.updated || 0}`)
-    parts.push(`proposal_merge=${result.proposed.merged || 0}`)
-    parts.push(`proposal_delete=${result.proposed.deleted || 0}`)
-  }
-  if (result?.held) {
-    parts.push(`held_update=${result.held.updated || 0}`)
-    parts.push(`held_merge=${result.held.merged || 0}`)
-    parts.push(`held_delete=${result.held.deleted || 0}`)
-  }
-  parts.push(`mode=${result?.applyMode || applyMode}`)
-  parts.push(`applied=${result?.applied === true ? 'true' : 'false'}`)
-  if (result?.skippedInFlight) parts.push('inFlight=true')
-  const errPart = result?.error ? ` error=${result.error}` : ''
-  return { text: `cycle3 ${parts.join(' ')}${errPart}` }
-}
-
-async function _handleMemFlush(args, config, signal) {
-  if (signal?.aborted) throw signal.reason ?? new Error('aborted')
-  const r1 = await _awaitCycle1Run(config?.cycle1 || {}, { signal })
-  if (signal?.aborted) throw signal.reason ?? new Error('aborted')
-  let flushC2Options = { signal }
-  if (typeof flushC2Options?.callLlm !== 'function') {
-    flushC2Options = { ...flushC2Options, callLlm: getCycle2CallLlm() }
-  }
-  const r2 = await runCycle2(db, config?.cycle2 || {}, flushC2Options, DATA_DIR)
-  if (signal?.aborted) throw signal.reason ?? new Error('aborted')
-  await _finalizeCycle2Run(r2)
-  return { text: `flush: cycle1 chunks=${r1.chunks} processed=${r1.processed}, cycle2 ${JSON.stringify(r2)}` }
-}
-
-async function _handleMemStatus(args, config) {
-  const stats = await entryStats()
-  const last = await getCycleLastRun()
-  let dims = 0
-  let dimsErr = null
-  try {
-    const raw = await getMetaValue(db, 'embedding.current_dims', null)
-    if (raw != null) dims = Number(JSON.parse(raw))
-    if (!Number.isFinite(dims)) dims = 0
-  } catch (e) {
-    // Surface the error in the status line instead of masquerading a meta
-    // read failure as dims=0 (which is indistinguishable from a fresh,
-    // pre-bootstrap DB). Keep status callable so other lines still render.
-    dims = 0
-    dimsErr = e?.message || String(e)
-  }
-  const bootstrapComplete = await isBootstrapComplete(db)
-  const lastCycle1Ago = last.cycle1 ? `${Math.round((Date.now() - last.cycle1) / 60000)}m ago` : 'never'
-  const lastCycle2Ago = last.cycle2 ? `${Math.round((Date.now() - last.cycle2) / 60000)}m ago` : 'never'
-  const activeTargetCap = Number.isFinite(Number(config?.cycle2?.active_target_cap))
-    ? Number(config?.cycle2?.active_target_cap)
-    : CYCLE2_ACTIVE_TARGET_CAP
-  const mvState = stats.mv_hot_active_populated === null
-    ? 'missing'
-    : stats.mv_hot_active_populated ? 'populated' : 'unpopulated'
-  const lines = [
-    `entries: total=${stats.total} roots=${stats.roots} cycle1_raw=${stats.unchunked_leaves} (unchunked leaves) cycle2_pending=${stats.cycle2_pending_roots} (awaiting cycle2 review)`,
-    `status: ${stats.byStatus.map(r => `${r.status ?? '?'}:${r.c}`).join(', ') || 'empty'}`,
-    `categories(active): ${stats.byCategory.map(r => `${r.category ?? 'NULL'}:${r.c}`).join(', ') || 'empty'} active_target_cap=${activeTargetCap}`,
-    `core_memory: user=${stats.core_entries} embed_null=${stats.core_embed_null} active_core=${stats.active_core_summaries} active_missing_core=${stats.active_core_summary_missing}`,
-    `embedding_index: ready dims=${dims}${dimsErr ? ` (meta_read_error: ${dimsErr})` : ''}`,
-    `recall_index: mv_hot_active=${mvState}`,
-    `bootstrap: ${bootstrapComplete ? 'complete' : 'incomplete'}`,
-    `last_cycle1: ${lastCycle1Ago}`,
-    `last_cycle2: ${lastCycle2Ago}`,
-    ...(last.cycle2_last_error ? [`last_cycle2_error: ${last.cycle2_last_error}`] : []),
-  ]
-  return { text: lines.join('\n') }
-}
-
-async function _handleMemRebuild(args, config, signal) {
-  if (args.confirm !== 'REBUILD MEMORY') {
-    return { text: 'rebuild requires confirm: "REBUILD MEMORY" (truncates classification columns and re-runs cycles)', isError: true }
-  }
-  // Drain any pre-reset cycle1 BEFORE the destructive truncation so the
-  // post-reset run is not started concurrently against the same DB.
-  // _awaitCycle1Run() may release the outer handle on a caller deadline while
-  // the inner runCycle1 promise still owns the DB writes. Drain both layers,
-  // then loop once more if one layer exposed another promise while awaiting.
-  const drainedCycle1Promises = new Set()
-  for (;;) {
-    const pendingCycle1Promises = [_cycleScheduler.getCycle1InFlight(), getInFlightCycle1(db)]
-      .filter(p => p && !drainedCycle1Promises.has(p))
-    if (pendingCycle1Promises.length === 0) break
-    for (const pendingCycle1 of pendingCycle1Promises) {
-      drainedCycle1Promises.add(pendingCycle1)
-      try { await pendingCycle1 } catch {}
-    }
-  }
-  if (signal?.aborted) throw signal.reason ?? new Error('aborted')
-  // Cleanup must run BEFORE demotion: the original order demoted normal
-  // roots (chunk_root = id) to is_root = 0 first, then ran the cleanup
-  // WHERE is_root = 1 — which missed exactly those demoted rows, leaving
-  // stale element/category/summary/score/embedding/summary_hash on rows that
-  // had just become raw leaves. Reorder so all roots get their classification
-  // columns cleared while is_root = 1 still selects them, then demote.
-  // Wrap the whole destructive sequence in one transaction so a mid-step
-  // failure rolls back rather than leaving a mixed state.
-  await db.transaction(async (tx) => {
-    await tx.query(`
-      UPDATE entries
-      SET element = NULL, category = NULL, summary = NULL,
-          status = 'pending', score = NULL, last_seen_at = NULL,
-          embedding = NULL, summary_hash = NULL,
-          core_summary = NULL, reviewed_at = NULL, promoted_at = NULL,
-          error_count = 0
-      WHERE is_root = 1
-    `)
-    await tx.query(`UPDATE entries SET chunk_root = NULL, is_root = 0 WHERE chunk_root = id`)
-    await tx.query(`UPDATE entries SET chunk_root = NULL WHERE is_root = 0`)
-    await tx.query(`
-      UPDATE entries
-      SET status = NULL,
-          element = NULL, category = NULL, summary = NULL,
-          score = NULL, last_seen_at = NULL,
-          embedding = NULL, summary_hash = NULL,
-          core_summary = NULL, reviewed_at = NULL, promoted_at = NULL,
-          error_count = 0
-      WHERE is_root = 0
-    `)
-  })
-  if (signal?.aborted) throw signal.reason ?? new Error('aborted')
-  // Force a fresh post-reset cycle1: _cycle1InFlight is guaranteed null
-  // here (we drained above and have not awaited any cycle1-starting call
-  // since), so calling _startCycle1Run directly skips the coalesce branch
-  // inside _awaitCycle1Run and guarantees the newly demoted rows are read.
-  const r1 = await _startCycle1Run(config?.cycle1 || {}, { signal })
-  if (signal?.aborted) throw signal.reason ?? new Error('aborted')
-  let rebuildC2Options = { signal }
-  if (typeof rebuildC2Options?.callLlm !== 'function') {
-    rebuildC2Options = { ...rebuildC2Options, callLlm: getCycle2CallLlm() }
-  }
-  const r2 = await runCycle2(db, config?.cycle2 || {}, rebuildC2Options, DATA_DIR)
-  await _finalizeCycle2Run(r2)
-  return { text: `rebuild: cycle1 chunks=${r1.chunks} processed=${r1.processed}, cycle2 ${JSON.stringify(r2)}` }
-}
-
-async function _handleMemPrune(args, _config) {
-  if (args.confirm !== 'PRUNE OLD ENTRIES') {
-    return { text: 'prune requires confirm: "PRUNE OLD ENTRIES" (permanently deletes unclassified entries older than maxDays)', isError: true }
-  }
-  const days = Math.max(1, Number(args.maxDays ?? 30))
-  const result = await pruneOldEntries(db, days)
-  return { text: `prune: deleted ${result.deleted} unclassified entries older than ${days} days` }
-}
-
-async function _handleMemBackfill(args, config, signal) {
-  // Whole-action mutex (transport-agnostic). _cycle1InFlight only protects
-  // cycle1; ingest workers + cycle2 can still overlap if a second backfill
-  // kicks in (timeout-retry, parallel callers, /api/tool vs /mcp vs
-  // /admin/backfill). Sentinel is set synchronously before any await so a
-  // burst of concurrent calls cannot all pass the check.
-  if (_backfillInFlight) {
-    return { text: 'backfill already in progress', isError: true }
-  }
-  if (signal?.aborted) throw signal.reason ?? new Error('aborted')
-  const window = args.window != null ? String(args.window) : '7d'
-  const scope = args.scope != null ? String(args.scope) : 'all'
-  const limit = args.limit != null ? Math.max(1, Number(args.limit)) : null
-  // Capture the cycle2 envelope so we can route through _finalizeCycle2Run
-  // (which records cycle2_last_error and clears scheduler delay only on
-  // ok:true) rather than stamping cycle2 unconditionally afterward.
-  let _capturedCycle2
-  const promise = runFullBackfill(db, {
-    window,
-    scope,
-    limit,
-    config,
-    dataDir: DATA_DIR,
-    ingestTranscriptFile,
-    cwdFromTranscriptPath,
-    // Re-check the IPC cancel signal at every cycle1/cycle2 iteration the
-    // backfill driver dispatches. handleMemoryAction only checks once
-    // before dispatch; without per-iteration checkpoints a long-running
-    // backfill keeps spinning through ingest + cycle1 + cycle2 batches
-    // after the proxy has already responded "cancelled" to the caller.
-    runCycle1: (dbArg, cycle1Config = {}, options = {}, _dir) => {
-      if (signal?.aborted) throw signal.reason ?? new Error('aborted')
-      return _awaitCycle1Run(cycle1Config, { ...options, signal })
-    },
-    runCycle2: async (dbArg, c2Config, c2Options, c2DataDir) => {
-      if (signal?.aborted) throw signal.reason ?? new Error('aborted')
-      let backfillC2Options = { ...c2Options, signal }
-      if (typeof backfillC2Options?.callLlm !== 'function') {
-        backfillC2Options = { ...backfillC2Options, callLlm: getCycle2CallLlm() }
-      }
-      const r2 = await runCycle2(dbArg, c2Config, backfillC2Options, c2DataDir)
-      _capturedCycle2 = r2
-      return r2
-    },
-  })
-  _backfillInFlight = promise
-  let result
-  try {
-    result = await promise
-  } finally {
-    if (_backfillInFlight === promise) _backfillInFlight = null
-  }
-  if (signal?.aborted) throw signal.reason ?? new Error('aborted')
-  if (_capturedCycle2) {
-    await _finalizeCycle2Run(_capturedCycle2)
-  }
-  return {
-    text: `backfill: window=${result.window} scope=${result.scope} files=${result.files} ingested=${result.ingested} cycle1_iters=${result.cycle1_iters} promoted=${result.promoted} unclassified=${result.unclassified}`,
-  }
-}
-
-async function handleMemoryAction(args, signal) {
-  // Cooperative abort check: surfaces caller-cancel (IPC cancel handler)
-  // before any long DB work begins on the worker side.
-  if (signal?.aborted) throw signal.reason ?? new Error('aborted')
-  const action = String(args.action ?? '')
-  const config = readMainConfig()
-
-  if (action === 'status') {
-    return _handleMemStatus(args, config)
-  }
-
-  if (action === 'cycle1') {
-    return _handleMemCycle1(args, config, signal)
-  }
-
-  if (action === 'cycle2' || action === 'sleep') {
-    return _handleMemCycle2(args, config, signal)
-  }
-
-  if (action === 'cycle3') {
-    return _handleMemCycle3(args, config, signal)
-  }
-
-  // Direct semantic-search surface for callers that want raw ranked rows
-  // without going through the Lead-side recall synthesizer. The
-  // handleSearch executor is exposed through the public `memory` tool action
-  // `search` so callers can hit the hybrid CTE directly.
-  if (action === 'search') {
-    return handleSearch(args, signal)
-  }
-
-  if (action === 'flush') {
-    return _handleMemFlush(args, config, signal)
-  }
-
-  if (action === 'rebuild') {
-    return _handleMemRebuild(args, config, signal)
-  }
-
-  if (action === 'prune') {
-    return _handleMemPrune(args, config)
-  }
-
-  if (action === 'backfill') {
-    return _handleMemBackfill(args, config, signal)
-  }
-
-  if (action === 'ingest_session') {
-    return ingestSessionMessages(args)
-  }
-
-  if (action === 'dump_session_roots') {
-    return dumpSessionRootChunks(args)
-  }
-
-  if (action === 'manage') {
-    const op = String(args.op ?? '').trim().toLowerCase()
-    if (!['add', 'edit', 'delete'].includes(op)) {
-      return { text: 'manage requires op: "add" | "edit" | "delete"', isError: true }
-    }
-    const VALID_CAT = new Set(['rule', 'constraint', 'decision', 'fact', 'goal', 'preference', 'task', 'issue'])
-    const VALID_STATUS = new Set(['pending', 'active', 'archived'])
-
-    if (op === 'add') {
-      const element = String(args.element ?? '').trim()
-      const summary = String(args.summary ?? args.element ?? '').trim()
-      const category = String(args.category ?? 'fact').trim().toLowerCase()
-      if (!element || !summary) {
-        return { text: 'manage add requires element and summary', isError: true }
-      }
-      if (!VALID_CAT.has(category)) {
-        return { text: `manage add: invalid category "${category}". Valid: ${[...VALID_CAT].join(', ')}`, isError: true }
-      }
-      const nowMs = Date.now()
-      const sourceRef = `manual:${nowMs}-${process.pid}`
-      const manageProjectId = resolveProjectScope(typeof args.cwd === 'string' && args.cwd ? args.cwd : null)
-      try {
-        let newId
-        await db.transaction(async (tx) => {
-          const result = await tx.query(`
-            INSERT INTO entries(ts, role, content, source_ref, session_id, project_id)
-            VALUES ($1, 'system', $2, $3, NULL, $4)
-            RETURNING id
-          `, [nowMs, element + ' — ' + summary, sourceRef, manageProjectId])
-          newId = Number(result.rows[0].id)
-          const score = computeEntryScore(category, nowMs, nowMs)
-          await tx.query(`
-            UPDATE entries
-            SET chunk_root = $1, is_root = 1, element = $2, category = $3, summary = $4,
-                status = 'active', score = $5, last_seen_at = $6
-            WHERE id = $7
-          `, [newId, element, category, summary, score, nowMs, newId])
-        })
-        await syncRootEmbedding(db, newId)
-        return { text: `added (id=${newId}): [${category}] ${element} — ${summary.slice(0, 200)}` }
-      } catch (e) {
-        return { text: `manage add failed: ${e.message}`, isError: true }
-      }
-    }
-
-    if (op === 'edit') {
-      const id = Number(args.id)
-      if (!Number.isFinite(id) || id <= 0) {
-        return { text: 'manage edit requires numeric id', isError: true }
-      }
-      const existing = (await db.query(
-        `SELECT id, element, summary, category, status, ts, is_root FROM entries WHERE id = $1`,
-        [id]
-      )).rows[0]
-      if (!existing) return { text: `manage edit: no entry with id=${id}`, isError: true }
-      if (existing.is_root !== 1) return { text: `manage edit: id=${id} is not a root`, isError: true }
-
-      const trimOrNull = v => {
-        if (v == null) return null
-        const s = String(v).trim()
-        return s === '' ? null : s
-      }
-      const newElement = trimOrNull(args.element)
-      const newSummary = trimOrNull(args.summary)
-      const newCategory = trimOrNull(args.category)?.toLowerCase() ?? null
-      const newStatus = trimOrNull(args.status)?.toLowerCase() ?? null
-
-      if (!newElement && !newSummary && !newCategory && !newStatus) {
-        return { text: 'manage edit requires at least one field: element, summary, category, status', isError: true }
-      }
-      if (newCategory && !VALID_CAT.has(newCategory)) {
-        return { text: `manage edit: invalid category "${newCategory}". Valid: ${[...VALID_CAT].join(', ')}`, isError: true }
-      }
-      if (newStatus && !VALID_STATUS.has(newStatus)) {
-        return { text: `manage edit: invalid status "${newStatus}". Valid: ${[...VALID_STATUS].join(', ')}`, isError: true }
-      }
-
-      const finalElement = newElement ?? existing.element
-      const finalSummary = newSummary ?? existing.summary
-      const finalCategory = newCategory ?? existing.category
-      const finalStatus = newStatus ?? existing.status
-      const nowMs = Date.now()
-      const score = computeEntryScore(finalCategory, nowMs, nowMs)
-      const textChanged = newElement != null || newSummary != null
-      // Guard null element/summary: a category/status-only edit on a root
-      // whose element or summary is NULL would otherwise persist literal
-      // 'null — null' content and explode on finalSummary.slice() below.
-      // Use empty-string sentinels for the content composition + render so
-      // the row stays consistent with what's actually stored.
-      const elementStr = finalElement == null ? '' : String(finalElement)
-      const summaryStr = finalSummary == null ? '' : String(finalSummary)
-      const composedContent = elementStr || summaryStr
-        ? `${elementStr}${summaryStr ? ' — ' + summaryStr : ''}`
-        : ''
-
-      try {
-        await db.query(`
-          UPDATE entries
-          SET element = $1, summary = $2, category = $3, status = $4, score = $5,
-              last_seen_at = $6, content = $7
-          WHERE id = $8
-        `, [finalElement, finalSummary, finalCategory, finalStatus, score,
-            nowMs, composedContent, id])
-      } catch (e) {
-        return { text: `manage edit failed: ${e.message}`, isError: true }
-      }
-      if (textChanged) {
-        try { await syncRootEmbedding(db, id) } catch (e) {
-          __mixdogMemoryLog(`[memory.manage] embedding resync failed (id=${id}): ${e.message}\n`)
-        }
-      }
-      return { text: `edited (id=${id}): [${finalCategory}/${finalStatus}] ${elementStr}${summaryStr ? ' — ' + summaryStr.slice(0, 200) : ''}` }
-    }
-
-    if (op === 'delete') {
-      const id = Number(args.id)
-      if (!Number.isFinite(id) || id <= 0) {
-        return { text: 'manage delete requires numeric id', isError: true }
-      }
-      const info = (await db.query(
-        `SELECT id, category, element, is_root FROM entries WHERE id = $1`,
-        [id]
-      )).rows[0]
-      if (!info) return { text: `manage delete: no entry with id=${id}`, isError: true }
-      try {
-        const result = info.is_root === 1
-          ? await db.query(`DELETE FROM entries WHERE id = $1 OR chunk_root = $2`, [id, id])
-          : await db.query(`DELETE FROM entries WHERE id = $1`, [id])
-        return { text: `deleted (id=${id}, rows=${Number(result.rowCount ?? result.affectedRows ?? 0)}): [${info.category ?? '-'}] ${info.element ?? ''}` }
-      } catch (e) {
-        return { text: `manage delete failed: ${e.message}`, isError: true }
-      }
-    }
-
-    return { text: `manage: unhandled op "${op}"`, isError: true }
-  }
-
-  if (action === 'core') {
-    const op = String(args.op ?? '').trim().toLowerCase()
-    if (!['add', 'edit', 'delete', 'list', 'candidates', 'promote', 'dismiss'].includes(op)) {
-      return { text: 'core requires op: "add" | "edit" | "delete" | "list" | "candidates" | "promote" | "dismiss"', isError: true }
-    }
-    const dataDir = (typeof DATA_DIR === 'string' ? DATA_DIR : resolvePluginData())
-    if (!dataDir) return { text: 'core: memory data dir is not initialized', isError: true }
-    // Core-candidate promotion pipeline (proposal mode). The candidate flag
-    // lives on generated `entries`, which carry a project_id, so these ops MUST
-    // be project-scoped just like add/edit/delete — an unscoped listing/promote
-    // would leak candidates across projects. project_id resolution mirrors the
-    // block below: 'common'/null → COMMON (project_id NULL), '*' → all pools
-    // (candidates op only, same escape hatch as op:'list'). UI calls exactly
-    // these op names.
-    if (op === 'candidates' || op === 'promote' || op === 'dismiss') {
-      const hasPid = Object.prototype.hasOwnProperty.call(args, 'project_id')
-      const scope = (() => {
-        if (!hasPid || args.project_id == null) return null
-        const s = String(args.project_id).trim()
-        if (s === '' || s.toLowerCase() === 'common') return null
-        if (s === '*') return '*'
-        return s
-      })()
-      try {
-        if (op === 'candidates') {
-          const list = await listCoreCandidates(dataDir, scope)
-          if (list.length === 0) return { text: 'core candidates: none' }
-          return {
-            text: list.map(c =>
-              // project=<pool> lets the UI thread project_id into the follow-up
-              // promote/dismiss call — matters under project_id:'*' listing where
-              // rows span pools. Uses the same COMMON/slug convention as op:'list'.
-              `id=${c.id} project=${c.project_id == null ? 'COMMON' : c.project_id} [${c.category}] score=${c.score == null ? '-' : c.score.toFixed(2)} ${c.element} — ${String(c.summary || '').slice(0, 200)} (${c.reason})`,
-            ).join('\n'),
-          }
-        }
-        // promote/dismiss operate on a single id but are scope-guarded: the
-        // candidate must belong to the resolved scope (or COMMON), never '*'.
-        if (scope === '*') {
-          return { text: `core ${op}: project_id "*" only valid for op="candidates"`, isError: true }
-        }
-        if (op === 'promote') {
-          const entry = await promoteCoreCandidate(dataDir, args.id, { ...args, scope })
-          const mergeNote = entry.merged_with ? ` (merged into core id=${entry.merged_with}, sim=${entry.sim})` : ''
-          return { text: `core promoted candidate id=${args.id} → core id=${entry.id}${mergeNote}: [${entry.category}] ${entry.element}` }
-        }
-        // dismiss
-        const removed = await dismissCoreCandidate(dataDir, args.id, { scope })
-        return { text: `core candidate dismissed (id=${removed.id}): [${removed.category}] ${removed.element}` }
-      } catch (e) {
-        return { text: `core ${op} failed: ${e.message}`, isError: true }
-      }
-    }
-    // Local trim helper — the manage-block trimOrNull at :1807 is scoped to
-    // that branch and unreachable from here.
-    // Normalize project_id: 'common' (case-insensitive) or null → null (COMMON pool); non-empty string → slug.
-    const hasProjectIdKey = Object.prototype.hasOwnProperty.call(args, 'project_id')
-    const projectId = (() => {
-      if (!hasProjectIdKey || args.project_id == null) return null
-      const s = String(args.project_id).trim()
-      if (s === '' || s.toLowerCase() === 'common') return null
-      if (s === '*') return '*'
-      return s
-    })()
-    try {
-      if (projectId === '*' && op !== 'list') {
-        return { text: `core ${op}: project_id "*" only valid for op="list"`, isError: true }
-      }
-      if (op === 'list') {
-        if (projectId !== '*') {
-          const entries = await listCore(dataDir, projectId)
-          if (entries.length === 0) return { text: 'core: empty' }
-          return { text: entries.map(e => `id=${e.id} [${e.category}] ${e.element} — ${String(e.summary || '').slice(0, 200)}`).join('\n') }
-        }
-        // Cross-pool listing — group by project_id, COMMON first
-        const entries = await listCore(dataDir, '*')
-        if (entries.length === 0) return { text: 'core: empty' }
-        const groups = new Map()
-        for (const e of entries) {
-          const key = e.project_id ?? null
-          if (!groups.has(key)) groups.set(key, [])
-          groups.get(key).push(e)
-        }
-        const lines = []
-        for (const [key, rows] of groups) {
-          lines.push(`${key === null ? 'COMMON' : key}:`)
-          for (const e of rows) {
-            lines.push(`  id=${e.id} [${e.category}] ${e.element} — ${String(e.summary || '').slice(0, 200)}`)
-          }
-        }
-        return { text: lines.join('\n') }
-      }
-      if (op === 'add') {
-        if (!hasProjectIdKey) {
-          return { text: 'core add: project_id required — pass "common" for COMMON pool, or project slug like "owner/repo" for scoped pool', isError: true }
-        }
-        const entry = await addCore(dataDir, args, projectId)
-        return { text: `core added (id=${entry.id}): [${entry.category}] ${entry.element} — ${entry.summary.slice(0, 200)}` }
-      }
-      if (op === 'edit') {
-        const entry = await editCore(dataDir, args.id, args)
-        return { text: `core edited (id=${entry.id}): [${entry.category}] ${entry.element} — ${entry.summary.slice(0, 200)}` }
-      }
-      if (op === 'delete') {
-        const removed = await deleteCore(dataDir, args.id)
-        return { text: `core deleted (id=${removed.id}): [${removed.category}] ${removed.element}` }
-      }
-    } catch (e) {
-      return { text: `core ${op} failed: ${e.message}`, isError: true }
-    }
-    return { text: `core: unhandled op "${op}"`, isError: true }
-  }
-
-  if (action === 'purge') {
-    if (args.confirm !== 'DELETE ALL MEMORY') {
-      return { text: 'purge requires confirm: "DELETE ALL MEMORY"', isError: true }
-    }
-    const preCount = (await db.query(`SELECT COUNT(*) c FROM entries`)).rows[0].c
-    const coreCount = (await db.query(`SELECT COUNT(*) c FROM core_entries`)).rows[0].c
-    try {
-      await db.query(`DELETE FROM entries`)
-    } catch (e) {
-      return { text: `purge failed: ${e.message}`, isError: true }
-    }
-    return { text: `purged generated memory entries (count=${preCount}); user core preserved (core_entries=${coreCount})` }
-  }
-
-  if (action === 'retro_eval_active') {
-    if (args.confirm !== 'REEVAL ACTIVE') {
-      return { text: 'retro_eval_active requires confirm: "REEVAL ACTIVE" (heavy LLM batch op — reviews all active roots through the unified gate)', isError: true }
-    }
-    const RETRO_BATCH = 50
-    const cycle2Config = config?.cycle2 || {}
-    const allActive = (await db.query(
-      `SELECT id, element, category, summary, score, last_seen_at, project_id, status, reviewed_at
-       FROM entries WHERE is_root = 1 AND status = 'active'
-       ORDER BY reviewed_at ASC, id ASC`
-    )).rows
-    const total = allActive.length
-    let archived = 0, kept = 0, updated = 0, merged = 0, errors = 0
-    const nowMs = Date.now()
-    for (let offset = 0; offset < total; offset += RETRO_BATCH) {
-      const batch = allActive.slice(offset, offset + RETRO_BATCH)
-      const batchIds = batch.map(r => Number(r.id))
-      const activeContext = (await db.query(
-        `SELECT id, element, category, summary, score, last_seen_at, project_id, status
-         FROM entries WHERE is_root = 1 AND status = 'active'
-         ORDER BY score DESC, last_seen_at DESC, id ASC LIMIT 200`
-      )).rows
-      let gateResult
-      try {
-        gateResult = await runUnifiedGate(db, batch, activeContext, cycle2Config, { activeCap: 200 })
-      } catch (err) {
-        __mixdogMemoryLog(`[retro_eval_active] runUnifiedGate failed (offset=${offset}): ${err.message}\n`)
-        errors += batch.length
-        continue
-      }
-      if (gateResult?.parseOk === false || gateResult?.actions === null) {
-        errors += batch.length
-        continue
-      }
-      const actions = gateResult?.actions ?? []
-      // Separate explicit `core` summary lines from primary verbs so an
-      // update/merge/active also refreshes the injected core_summary — mirrors
-      // the cycle2 apply path (memory-cycle2.mjs). Without this, retro could
-      // rewrite a root's summary while leaving its core_summary stale.
-      const coreSummaryById = new Map()
-      const primaryActions = []
-      for (const a of actions) {
-        if (a?.action === 'core') {
-          const cid = Number(a.entry_id)
-          const core = String(a.core_summary ?? '').replace(/\s+/g, ' ').trim().slice(0, CORE_SUMMARY_MAX)
-          if (Number.isFinite(cid) && core) coreSummaryById.set(cid, core)
-        } else {
-          primaryActions.push(a)
-        }
-      }
-      const allowed = new Set(batchIds)
-      const rejected = gateResult?.rejected ?? new Set()
-      // Partial-apply contract: rows the gate never returned a verdict for
-      // (missingIds) must NOT be marked reviewed — they are left for a later
-      // run. Exclude both rejected and missing ids from the reviewed set.
-      const missing = new Set((gateResult?.missingIds ?? []).map(Number))
-      const successIds = new Set(batchIds.filter(id => !rejected.has(id) && !missing.has(id)))
-      for (const id of successIds) {
-        try { await db.query(`UPDATE entries SET reviewed_at = $1 WHERE id = $2`, [nowMs, id]) } catch {}
-      }
-      const setCoreSummary = async (entryId, core) => {
-        if (!core) return
-        try { await db.query(`UPDATE entries SET core_summary = $1 WHERE id = $2 AND is_root = 1`, [core, Number(entryId)]) }
-        catch (err) { __mixdogMemoryLog(`[retro_eval_active] core_summary update failed (id=${entryId}): ${err.message}\n`) }
-      }
-      if (!primaryActions.length) { kept += batch.filter(r => successIds.has(Number(r.id))).length; continue }
-      const acted = new Set()
-      const rowById = new Map(batch.map(r => [Number(r.id), r]))
-      for (const act of primaryActions) {
-        try {
-          const eid = Number(act?.entry_id)
-          if (!Number.isFinite(eid) || !allowed.has(eid)) continue
-          acted.add(eid)
-          // Optimistic guard: skip if the row moved since this batch was read.
-          const snap = rowById.get(eid)
-          const expected = snap ? { status: snap.status, reviewedAt: snap.reviewed_at } : null
-          if (act.action === 'archived') {
-            if (await applySimpleStatus(db, eid, 'archived', expected)) archived += 1
-          } else if (act.action === 'active') {
-            // active → active is a keep verdict from the gate.
-            kept += 1
-            await setCoreSummary(eid, coreSummaryById.get(eid))
-          } else if (act.action === 'update') {
-            if (await applyUpdate(db, eid, act.element, act.summary, { expected })) updated += 1
-            await setCoreSummary(eid, coreSummaryById.get(eid))
-          } else if (act.action === 'merge') {
-            const targetId = Number(act?.target_id)
-            const sourceIds = Array.isArray(act?.source_ids) ? act.source_ids : []
-            if (!Number.isFinite(targetId) || !allowed.has(targetId)) {
-              __mixdogMemoryLog(`[retro_eval_active] merge target outside batch (id=${targetId})\n`)
-              acted.delete(eid)
-              continue
-            }
-            const filteredSources = sourceIds.filter(s => allowed.has(Number(s)))
-            if (filteredSources.length !== sourceIds.length) {
-              __mixdogMemoryLog(
-                `[retro_eval_active] merge sources filtered: ${JSON.stringify(sourceIds)} -> ${JSON.stringify(filteredSources)}\n`,
-              )
-            }
-            acted.add(targetId)
-            filteredSources.forEach(s => acted.add(Number(s)))
-            const moved = await applyMerge(db, targetId, filteredSources)
-            if (moved > 0) {
-              merged += moved
-              if (typeof act.element === 'string' || typeof act.summary === 'string') {
-                try {
-                  if (await applyUpdate(db, targetId, act.element, act.summary)) updated += 1
-                } catch (err) {
-                  __mixdogMemoryLog(`[retro_eval_active] merge target update failed (target=${targetId}): ${err.message}\n`)
-                }
-              }
-              await setCoreSummary(targetId, coreSummaryById.get(targetId) || coreSummaryById.get(eid))
-            }
-          }
-        } catch (err) {
-          __mixdogMemoryLog(`[retro_eval_active] action error (id=${act?.entry_id}): ${err.message}\n`)
-          errors += 1
-        }
-      }
-      // Entries in successIds but not acted-upon (omit / no-op) are kept.
-      kept += batch.filter(r => successIds.has(Number(r.id)) && !acted.has(Number(r.id))).length
-    }
-    return { text: `retro_eval_active: total=${total} archived=${archived} kept=${kept} updated=${updated} merged=${merged} errors=${errors}` }
-  }
-
-  return { text: `unknown memory action: ${action}`, isError: true }
-}
-
-async function handleToolCall(name, args, signal) {
-  try {
-    if (name === 'search_memories') {
-      const result = await handleSearch(args || {}, signal)
-      return { ...result, content: [{ type: 'text', text: result.text }], isError: result.isError || false }
-    }
-    if (name === 'recall') {
-      // recall is aiWrapped in the unified build; in standalone mode map it to
-      // search_memories so the advertised tool name actually works. Forward
-      // every advertised arg so id/limit/offset/sort/includeArchived/
-      // includeMembers/includeRaw reach handleSearch instead of being dropped.
-      const a = args || {}
-      const hasQuery = Array.isArray(a.query)
-        ? a.query.some((value) => String(value || '').trim())
-        : String(a.query ?? '').trim() !== ''
-      const recallIds = hasQuery
-        ? []
-        : (Array.isArray(a.id) ? a.id : [a.id])
-            .map((value) => Number(value))
-            .filter((value) => Number.isInteger(value) && value > 0)
-      const searchArgs = {
-        ...(a.query !== undefined ? { query: a.query } : {}),
-        ...(recallIds.length > 0 ? { ids: recallIds } : {}),
-        ...(a.period ? { period: a.period } : {}),
-        ...(a.limit !== undefined ? { limit: a.limit } : {}),
-        ...(a.offset !== undefined ? { offset: a.offset } : {}),
-        ...(a.sort !== undefined ? { sort: a.sort } : {}),
-        ...(a.category !== undefined ? { category: a.category } : {}),
-        ...(a.includeArchived !== undefined ? { includeArchived: a.includeArchived } : {}),
-        ...(a.includeMembers !== undefined ? { includeMembers: a.includeMembers } : {}),
-        ...(a.includeRaw !== undefined ? { includeRaw: a.includeRaw } : {}),
-        ...(a.cwd ? { cwd: a.cwd } : {}),
-        ...(a.projectScope ? { projectScope: a.projectScope } : {}),
-        ...(a.sessionId ? { sessionId: a.sessionId } : {}),
-        ...(a.session_id ? { session_id: a.session_id } : {}),
-        ...(a.currentSession !== undefined ? { currentSession: a.currentSession } : {}),
-        // Hint only — never a filter. Marks the caller's own session as
-        // "(current)" in the multi-session grouped browse output.
-        ...(a.currentSessionId ? { currentSessionId: a.currentSessionId } : {}),
-      }
-      const result = await handleSearch(searchArgs, signal)
-      return { ...result, content: [{ type: 'text', text: result.text }], isError: result.isError || false }
-    }
-    if (name === 'memory') {
-      const result = await handleMemoryAction(args || {}, signal)
-      return { ...result, content: [{ type: 'text', text: result.text }], isError: result.isError || false }
-    }
-    return { content: [{ type: 'text', text: `unknown tool: ${name}` }], isError: true }
-  } catch (err) {
-    const msg = err instanceof Error ? err.message : String(err)
-    return { content: [{ type: 'text', text: `${name} failed: ${msg}` }], isError: true }
-  }
-}
+// ── Memory action + tool-call handlers (extracted to
+// lib/memory-action-handlers.mjs). The facade keeps db/scheduler ownership and
+// injects live getters plus the query/ingest/cycle primitives.
+const _actionHandlers = createMemoryActionHandlers({
+  getDb: () => db,
+  dataDir: DATA_DIR,
+  log: __mixdogMemoryLog,
+  readMainConfig,
+  getCycleLastRun,
+  ingestSessionMessages,
+  entryStats,
+  handleSearch,
+  dumpSessionRootChunks,
+  awaitCycle1Run: _awaitCycle1Run,
+  startCycle1Run: _startCycle1Run,
+  finalizeCycle2Run: _finalizeCycle2Run,
+  finalizeCycle3Run: _finalizeCycle3Run,
+  getSchedulerCycle1InFlight: () => _cycleScheduler.getCycle1InFlight(),
+  getCycle2CallLlm,
+  getCycle3CallLlm,
+  ingestTranscriptFile,
+  cwdFromTranscriptPath,
+})
+const { handleMemoryAction, handleToolCall } = _actionHandlers
 
 const mcp = new Server(
   { name: 'mixdog-memory', version: PLUGIN_VERSION },
@@ -1612,715 +724,36 @@ const mcp = new Server(
 mcp.setRequestHandler(ListToolsRequestSchema, async () => ({ tools: TOOL_DEFS }))
 mcp.setRequestHandler(CallToolRequestSchema, (req) => handleToolCall(req.params.name, req.params.arguments ?? {}))
 
-function createHttpMcpServer() {
-  const s = new Server(
-    { name: 'mixdog-memory', version: PLUGIN_VERSION },
-    { capabilities: { tools: {} }, instructions: MEMORY_INSTRUCTIONS_TEXT },
-  )
-  s.setRequestHandler(ListToolsRequestSchema, async () => ({ tools: TOOL_DEFS }))
-  s.setRequestHandler(CallToolRequestSchema, (req) => handleToolCall(req.params.name, req.params.arguments ?? {}))
-  return s
-}
-
-async function awaitRuntimeReadyForHttp(res) {
-  if (_initialized) return true
-  if (!_initPromise) {
-    sendJson(res, { error: 'memory runtime is starting' }, 503)
-    return false
-  }
-  try {
-    await _initPromise
-    return true
-  } catch (e) {
-    sendJson(res, { error: `memory runtime failed: ${e?.message || e}` }, 503)
-    return false
-  }
-}
-
-async function buildSessionCoreMemoryPayload(cwd) {
-  const projectId = resolveProjectScope(typeof cwd === 'string' && cwd ? cwd : null)
-  const generatedScopeClause = projectId !== null
-    ? `project_id IS NULL OR project_id = $1`
-    : `project_id IS NULL`
-  const dbRows = (await db.query(`
-    SELECT core_summary
-    FROM entries
-    WHERE is_root = 1
-      AND status = 'active'
-      AND core_summary IS NOT NULL
-      AND (${generatedScopeClause})
-    ORDER BY score DESC, last_seen_at DESC
-  `, projectId !== null ? [projectId] : [])).rows
-  const commonRows = (await db.query(
-    `SELECT summary FROM core_entries WHERE project_id IS NULL AND (status IS NULL OR status = 'active') ORDER BY id ASC`
-  )).rows
-  const scopedRows = projectId !== null
-    ? (await db.query(
-        `SELECT summary FROM core_entries WHERE project_id = $1 AND (status IS NULL OR status = 'active') ORDER BY id ASC`,
-        [projectId]
-      )).rows
-    : []
-  return {
-    projectId,
-    dbLines: dbRows.map(r => String(r.core_summary || '').trim()).filter(Boolean),
-    userLines: [
-      ...commonRows.map(r => String(r.summary || '').trim()).filter(Boolean),
-      ...scopedRows.map(r => String(r.summary || '').trim()).filter(Boolean),
-    ],
-  }
-}
-
-// Whole-action backfill mutex. memory-cycle1's _cycle1InFlight only protects
-// cycle1; ingest workers (memory-ops-policy.mjs) and cycle2 can still overlap
-// if a second backfill kicks in (e.g. setup-server timeout + retry). Track the
-// in-flight promise here and reject overlaps with 409.
-let _backfillInFlight = null
-
-// Owner-side /api/tool in-flight controllers keyed by caller-supplied
-// X-Mixdog-Call-Id. /api/cancel aborts the matching AbortSignal so the
-// upstream handleToolCall actually stops when the fork-proxy parent cancels.
-const _ownerInFlightHttpCalls = new Map()
-
-const httpServer = http.createServer(async (req, res) => {
-  touchDaemonIdleTimer(`${req.method || 'HTTP'} ${req.url || '/'}`)
-  if (req.method === 'POST' && req.url === '/session-reset') {
-    _bootTimestamp = Date.now()
-    sendJson(res, { ok: true, bootTimestamp: _bootTimestamp })
-    return
-  }
-  if (req.method === 'POST' && req.url === '/rebind') {
-    _bootTimestamp = Date.now()
-    sendJson(res, { ok: true })
-    return
-  }
-
-  if (req.method === 'GET' && req.url === '/health') {
-    if (!_initialized) {
-      sendJson(res, { status: 'starting' }, 503)
-      return
-    }
-    try {
-      const stats = await entryStats()
-      sendJson(res, {
-        status: 'ok',
-        worker_pid: process.pid,
-        server_pid: Number(process.env.MIXDOG_SERVER_PID) || null,
-        owner_lead_pid: Number(process.env.MIXDOG_OWNER_LEAD_PID) || null,
-        code_fingerprint: BOOT_PROMOTION_CODE_FINGERPRINT,
-        bootstrap: await isBootstrapComplete(db),
-        entries: stats.total,
-        roots: stats.roots,
-        active_roots: stats.active_roots,
-        archived_roots: stats.archived_roots,
-        unchunked_leaves: stats.unchunked_leaves,
-        cycle2_pending_roots: stats.cycle2_pending_roots,
-        core_entries: stats.core_entries,
-        core_embed_null: stats.core_embed_null,
-        active_core_summaries: stats.active_core_summaries,
-        active_core_summary_missing: stats.active_core_summary_missing,
-        mv_hot_active_populated: stats.mv_hot_active_populated,
-        cycle_running: _cycleScheduler.getCycleRunning(),
-        cycle_health: _cycleScheduler.getCycleHealth(),
-        cycle_backlog: _cycleScheduler.getCycleBacklogSnapshot(),
-      })
-    } catch (e) { sendError(res, e.message) }
-    return
-  }
-
-  if (!await awaitRuntimeReadyForHttp(res)) return
-
-  if (req.method === 'GET' && req.url === '/admin/entries/active') {
-    try {
-      const { rows } = await db.query(`
-        SELECT id, element, category, summary, score, last_seen_at
-        FROM entries
-        WHERE is_root = 1 AND status = 'active'
-        ORDER BY score DESC
-      `)
-      sendJson(res, { ok: true, items: rows })
-    } catch (e) { sendJson(res, { ok: false, error: e.message }, 500) }
-    return
-  }
-
-  if (req.method === 'GET' && req.url === '/admin/core/entries') {
-    try {
-      const rows = await listCore(DATA_DIR, '*')
-      sendJson(res, { ok: true, items: rows })
-    } catch (e) { sendJson(res, { ok: false, error: e.message }, 500) }
-    return
-  }
-
-  if (req.method === 'POST' && req.url === '/admin/core/entries') {
-    if (!isLocalOrigin(req)) {
-      sendJson(res, { ok: false, error: 'forbidden: cross-origin' }, 403)
-      return
-    }
-    try {
-      const body = await readBody(req)
-      const projectId = normalizeCoreProjectId(body.project_id)
-      const entry = await addCore(DATA_DIR, body, projectId)
-      sendJson(res, { ok: true, item: entry })
-    } catch (e) { sendJson(res, { ok: false, error: e.message }, 500) }
-    return
-  }
-
-  if (req.method === 'POST' && req.url === '/admin/core/entries/delete') {
-    if (!isLocalOrigin(req)) {
-      sendJson(res, { ok: false, error: 'forbidden: cross-origin' }, 403)
-      return
-    }
-    try {
-      const body = await readBody(req)
-      const removed = await deleteCore(DATA_DIR, body.id)
-      sendJson(res, { ok: true, item: removed })
-    } catch (e) { sendJson(res, { ok: false, error: e.message }, 500) }
-    return
-  }
-
-  if (req.method === 'POST' && req.url === '/admin/entries/status') {
-    if (!isLocalOrigin(req)) {
-      sendJson(res, { ok: false, error: 'forbidden: cross-origin' }, 403)
-      return
-    }
-    try {
-      const body = await readBody(req)
-      const id = Number(body.id)
-      const status = String(body.status ?? '').trim().toLowerCase()
-      const VALID = ['pending', 'active', 'archived']
-      if (!Number.isInteger(id) || id <= 0 || !VALID.includes(status)) {
-        sendJson(res, { ok: false, error: 'valid id and status required' }, 400)
-        return
-      }
-      const result = await db.query(
-        `UPDATE entries SET status = $1 WHERE id = $2 AND is_root = 1`,
-        [status, id]
-      )
-      sendJson(res, { ok: true, changes: Number(result.rowCount ?? result.affectedRows ?? 0) })
-    } catch (e) { sendJson(res, { ok: false, error: e.message }, 500) }
-    return
-  }
-
-  if (req.method === 'POST' && req.url === '/admin/entries/add') {
-    if (!isLocalOrigin(req)) {
-      sendJson(res, { ok: false, error: 'forbidden: cross-origin' }, 403)
-      return
-    }
-    try {
-      const body = await readBody(req)
-      const result = await handleMemoryAction({
-        action: 'manage',
-        op: 'add',
-        element: body.element,
-        summary: body.summary,
-        category: body.category,
-        cwd: body.cwd,
-      })
-      if (result.isError) {
-        sendJson(res, { ok: false, error: result.text }, 400)
-        return
-      }
-      const idMatch = String(result.text || '').match(/id=(\d+)/)
-      const newId = idMatch ? Number(idMatch[1]) : null
-      sendJson(res, { ok: true, id: newId, text: result.text })
-    } catch (e) { sendJson(res, { ok: false, error: e.message }, 500) }
-    return
-  }
-
-  if (req.method === 'POST' && req.url === '/admin/backfill') {
-    if (!isLocalOrigin(req)) {
-      sendJson(res, { ok: false, error: 'forbidden: cross-origin' }, 403)
-      return
-    }
-    let body
-    try { body = await readBody(req) }
-    catch (e) { sendJson(res, { ok: false, error: e.message }, Number(e?.statusCode) || 500); return }
-    try {
-      const result = await handleMemoryAction({
-        action: 'backfill',
-        window: body.window,
-        scope: body.scope,
-        limit: body.limit,
-      })
-      if (result.isError) {
-        // 'backfill already in progress' → 409, other failures → 500
-        const status = result.text === 'backfill already in progress' ? 409 : 500
-        sendJson(res, { ok: false, error: result.text }, status)
-        return
-      }
-      sendJson(res, { ok: true, text: result.text })
-    } catch (e) {
-      sendJson(res, { ok: false, error: e.message }, 500)
-    }
-    return
-  }
-
-  if (req.method === 'POST' && req.url === '/admin/purge') {
-    if (!isLocalOrigin(req)) {
-      sendJson(res, { ok: false, error: 'forbidden: cross-origin' }, 403)
-      return
-    }
-    try {
-      const body = await readBody(req)
-      if (body?.confirm !== 'DELETE ALL MEMORY') {
-        sendJson(res, { ok: false, error: 'confirm must be exactly "DELETE ALL MEMORY"' }, 400)
-        return
-      }
-      const { rows: countRows } = await db.query(`SELECT COUNT(*) AS c FROM entries`)
-      const preCount = Number(countRows[0].c)
-      const { rows: coreCountRows } = await db.query(`SELECT COUNT(*) AS c FROM core_entries`)
-      const coreCount = Number(coreCountRows[0].c)
-      await db.transaction(async (tx) => {
-        await tx.query(`DELETE FROM entries`)
-      })
-      sendJson(res, { ok: true, deleted: preCount, core_preserved: coreCount })
-    } catch (e) { sendJson(res, { ok: false, error: e.message }, 500) }
-    return
-  }
-
-  if (req.method === 'POST' && req.url === '/admin/trace-record') {
-    if (!isLocalOrigin(req)) {
-      sendJson(res, { ok: false, error: 'forbidden: cross-origin' }, 403)
-      return
-    }
-    let body
-    try { body = await readBody(req) }
-    catch (e) { sendJson(res, { ok: false, error: e.message }, 400); return }
-    if (!Array.isArray(body?.events)) {
-      sendJson(res, { ok: false, error: 'body.events must be an array' }, 400)
-      return
-    }
-    if (body.events.length > 500) {
-      sendJson(res, { ok: false, error: 'too many events (max 500)' }, 413)
-      return
-    }
-    if (!_traceDb) {
-      try {
-        _traceDb = await openTraceDatabase(DATA_DIR)
-        registerTraceExitDrain(_traceDb)
-      } catch (e) {
-        sendJson(res, { ok: false, error: `trace DB unavailable: ${e.message}` }, 503)
-        return
-      }
-    }
-    try {
-      // Enqueue for async batched flush (100ms / 500-row window).
-      enqueueTraceEvents(_traceDb, body.events)
-      // Use `queued` — events are async; `inserted` would imply durability.
-      sendJson(res, { ok: true, queued: body.events.length })
-      // Fire-and-forget into focused agent analytic tables.
-      insertAgentCalls(_traceDb, body.events).catch(e =>
-        __mixdogMemoryLog(`[trace] insertAgentCalls error: ${e?.message}\n`)
-      )
-    } catch (e) {
-      sendJson(res, { ok: false, error: e.message }, 500)
-    }
-    return
-  }
-
-  if (req.method === 'POST' && req.url === '/session-start/core-memory') {
-    try {
-      const body = await readBody(req)
-      const { projectId, dbLines, userLines } = await buildSessionCoreMemoryPayload(body.cwd)
-      sendJson(res, { ok: true, projectId, dbLines, userLines })
-    } catch (e) { sendError(res, e.message) }
-    return
-  }
-
-  if (req.method === 'POST' && req.url === '/admin/shutdown') {
-    if (!isLocalOrigin(req)) {
-      sendJson(res, { ok: false, error: 'forbidden: cross-origin' }, 403)
-      return
-    }
-    sendJson(res, { shutting_down: true }, 202)
-    setImmediate(() => {
-      const watchdog = setTimeout(() => {
-        __mixdogMemoryLog('[shutdown] watchdog fired — forcing exit after 8s\n')
-        process.exit(1)
-      }, 8000)
-      watchdog.unref?.()
-      stop()
-        .then(() => { clearTimeout(watchdog); process.exit(0) })
-        .catch(e => {
-          __mixdogMemoryLog(`[shutdown] error ${e.message}\n`)
-          clearTimeout(watchdog)
-          process.exit(1)
-        })
-    })
-    return
-  }
-
-  // DEV-ONLY cycle1 chunking bench. Gated by env MIXDOG_DEV_BENCH=1 so
-   // production is untouched (route returns 404 when unset). Mirrors cycle1's
-   // exact fetch query + per-session windowing, then runs each window through
-   // buildCycle1ChunkPrompt + callAgentDispatch + parseCycle1LineFormat. STRICT
-   // read-only — no UPDATE, no transaction, no commit.
-  if (req.method === 'POST' && req.url === '/dev/cycle1-bench') {
-    // Gate: env MIXDOG_DEV_BENCH=1 OR a runtime flag file, so it can be
-    // toggled without restarting the host agent (env only reaches the worker
-    // on a full CC restart, not via dev-sync full-restart).
-    const _devBenchOn = process.env.MIXDOG_DEV_BENCH === '1'
-      || (DATA_DIR && fs.existsSync(path.join(DATA_DIR, '.dev-bench-enabled')))
-    if (!_devBenchOn) {
-      sendJson(res, { error: 'not found' }, 404)
-      return
-    }
-    if (!isLocalOrigin(req)) {
-      sendJson(res, { ok: false, error: 'forbidden: cross-origin' }, 403)
-      return
-    }
-    try {
-      const body = await readBody(req)
-      const sets = Math.max(1, Number(body?.sets ?? 5))
-      const repeat = Math.max(1, Number(body?.repeat ?? 1))
-      // Optional variant matrix. Each variant: {name, rules}. rules=null → default prompt.
-      const rawVariants = Array.isArray(body?.variants) ? body.variants : null
-      const variants = rawVariants && rawVariants.length > 0
-        ? rawVariants.map((v, i) => ({
-            name: typeof v?.name === 'string' && v.name ? v.name : `variant-${i + 1}`,
-            rules: Array.isArray(v?.rules) ? v.rules : null,
-          }))
-        : null
-
-      // Lazy-load LLM + chunking helpers so production boot pays nothing.
-      // Use the same in-process agent dispatch adapter as real cycle1 — the legacy
-      // agent-ipc callAgentDispatch() path is dead in the detached standalone
-      // memory daemon (no connected IPC), so the dev bench must mirror prod.
-      const [{ buildCycle1ChunkPrompt, parseCycle1LineFormat }, { resolveMaintenancePreset }] = await Promise.all([
-        import('./lib/memory-cycle1.mjs'),
-        import('../shared/llm/index.mjs'),
-      ])
-      const benchCallLlm = getCycle1CallLlm()
-
-      const CYCLE1_MIN_BATCH = 3
-      const CYCLE1_SESSION_CAP = 10
-      const BATCH_SIZE = 100
-      const TIMEOUT_MS = 180_000
-      const fetchLimit = CYCLE1_SESSION_CAP * BATCH_SIZE
-
-      const fetchResult = await db.query(
-        `SELECT id, ts, role, content, session_id, source_ref, project_id
-         FROM entries
-         WHERE chunk_root IS NULL AND session_id IS NOT NULL
-         ORDER BY ts DESC, id DESC
-         LIMIT $1`,
-        [fetchLimit],
-      )
-      const rowsDesc = fetchResult.rows
-
-      if (rowsDesc.length < CYCLE1_MIN_BATCH) {
-        sendJson(res, {
-          ok: true,
-          sets, repeat,
-          windowsAvailable: 0,
-          note: `not enough pending rows (need >= ${CYCLE1_MIN_BATCH}, got ${rowsDesc.length})`,
-          results: [],
-        })
-        return
-      }
-
-      // Partition by session_id — same as memory-cycle1.mjs _runCycle1Impl L207-233.
-      const sessionMap = new Map()
-      for (const row of rowsDesc.slice().reverse()) {
-        const sid = row.session_id
-        if (!sessionMap.has(sid)) sessionMap.set(sid, [])
-        sessionMap.get(sid).push(row)
-      }
-      const windows = []
-      for (const [sid, sessionRows] of sessionMap) {
-        if (sessionRows.length < CYCLE1_MIN_BATCH) continue
-        const windowCount = Math.max(1, Math.ceil(sessionRows.length / BATCH_SIZE))
-        const baseSize = Math.floor(sessionRows.length / windowCount)
-        const remainder = sessionRows.length % windowCount
-        let _offset = 0
-        for (let i = 0; i < windowCount; i++) {
-          const size = baseSize + (i < remainder ? 1 : 0)
-          windows.push({ sid, rows: sessionRows.slice(_offset, _offset + size) })
-          _offset += size
-        }
-      }
-      const chosen = windows.slice(0, sets)
-
-      const preset = resolveMaintenancePreset('memory')
-
-      function summariseChunks(chunks, totalEntries) {
-        const usedIdx = new Set()
-        for (const c of chunks) for (const i of (c._idxList || [])) usedIdx.add(i)
-        const omitted = []
-        for (let i = 1; i <= totalEntries; i++) if (!usedIdx.has(i)) omitted.push(i)
-        return { covered: usedIdx.size, omitted }
-      }
-
-      // When variants are absent, fall back to a single implicit baseline so the
-      // pre-variant call shape (single rows × repeat) keeps producing the same
-      // {runs:[…]} payload the trigger already knows how to print.
-      const variantList = variants ?? [{ name: 'baseline', rules: null }]
-
-      async function runOnce(rows, customRules) {
-        const userMessage = buildCycle1ChunkPrompt(rows, customRules)
-        const t0 = Date.now()
-        let raw, error
-        try {
-          raw = await benchCallLlm({
-            preset,
-            timeout: TIMEOUT_MS,
-          }, userMessage)
-        } catch (e) {
-          error = e?.message ?? String(e)
-        }
-        const llmMs = Date.now() - t0
-        if (error) return { ok: false, llmMs, error }
-        const parsed = parseCycle1LineFormat(raw)
-        const chunks = Array.isArray(parsed?.chunks) ? parsed.chunks : []
-        const { covered, omitted } = summariseChunks(chunks, rows.length)
-        const ratio = chunks.length > 0
-          ? parseFloat((rows.length / chunks.length).toFixed(2))
-          : null
-        return {
-          ok: true,
-          llmMs,
-          entries: rows.length,
-          chunks: chunks.length,
-          ratio,
-          covered,
-          omitted,
-          chunkList: chunks.map(c => ({
-            idx: c._idxList,
-            element: c.element,
-            category: c.category,
-            summary: c.summary,
-          })),
-        }
-      }
-
-      const results = []
-      for (let s = 0; s < chosen.length; s++) {
-        const { sid, rows } = chosen[s]
-        const sidShort = String(sid).slice(0, 8)
-        if (variants) {
-          // Variant mode: same rows, one run per variant per repeat.
-          const variantResults = []
-          for (const v of variantList) {
-            const runs = []
-            for (let r = 0; r < repeat; r++) {
-              const run = await runOnce(rows, v.rules)
-              runs.push({ repIdx: r + 1, ...run })
-            }
-            variantResults.push({ name: v.name, runs })
-          }
-          results.push({
-            setIdx: s + 1,
-            sessionIdShort: sidShort,
-            entries: rows.length,
-            variants: variantResults,
-          })
-        } else {
-          // Legacy single-baseline payload shape.
-          const runs = []
-          for (let r = 0; r < repeat; r++) {
-            const run = await runOnce(rows, null)
-            runs.push({ repIdx: r + 1, ...run })
-          }
-          results.push({
-            setIdx: s + 1,
-            sessionIdShort: sidShort,
-            entries: rows.length,
-            runs,
-          })
-        }
-      }
-      sendJson(res, {
-        ok: true,
-        sets, repeat,
-        windowsAvailable: windows.length,
-        variants: variants ? variantList.map(v => v.name) : null,
-        results,
-      })
-    } catch (e) {
-      sendError(res, e?.message || String(e))
-    }
-    return
-  }
-
-  if (req.method === 'POST' && req.url === '/api/tool') {
-    if (!isLocalOrigin(req)) {
-      sendJson(res, { content: [{ type: 'text', text: 'forbidden: cross-origin' }], isError: true }, 403)
-      return
-    }
-    // Owner-side cancel plumbing: the fork-proxy worker forwards parent
-    // 'cancel' IPC by issuing POST /api/cancel with the same callId. Track
-    // each in-flight /api/tool by its caller-supplied X-Mixdog-Call-Id so
-    // the cancel endpoint can abort the AbortSignal threaded into
-    // handleToolCall. Without this the proxy-side fetch aborts but the
-    // owner keeps running the upstream tool to completion.
-    const callId = String(req.headers['x-mixdog-call-id'] || '').trim() || null
-    const ac = new AbortController()
-    // Abort only on a genuine mid-flight client disconnect. The req 'close'
-    // event fires on every normal request once the request body is consumed
-    // (before handleToolCall resolves), so gating on it would mark normal
-    // completions as aborted. Use the response side instead: when the
-    // socket closes, res.writableFinished is true iff the response was
-    // fully written — a real client disconnect closes the socket before
-    // the response finishes, leaving writableFinished===false.
-    res.on('close', () => {
-      if (res.writableFinished) return
-      try { ac.abort() } catch {}
-    })
-    if (callId) _ownerInFlightHttpCalls.set(callId, ac)
-    try {
-      const body = await readBody(req)
-      const result = await handleToolCall(body.name, body.arguments ?? {}, ac.signal)
-      sendJson(res, result)
-    } catch (e) {
-      sendJson(res, { content: [{ type: 'text', text: `api/tool error: ${e.message}` }], isError: true }, Number(e?.statusCode) || 500)
-    } finally {
-      if (callId) _ownerInFlightHttpCalls.delete(callId)
-    }
-    return
-  }
-
-  if (req.method === 'POST' && req.url === '/api/cancel') {
-    if (!isLocalOrigin(req)) {
-      sendJson(res, { ok: false, error: 'forbidden: cross-origin' }, 403)
-      return
-    }
-    try {
-      const body = await readBody(req)
-      const id = String(body.callId || '').trim()
-      if (!id) { sendJson(res, { ok: false, error: 'callId required' }, 400); return }
-      const ac = _ownerInFlightHttpCalls.get(id)
-      if (ac) {
-        try { ac.abort() } catch {}
-        _ownerInFlightHttpCalls.delete(id)
-        sendJson(res, { ok: true, cancelled: true })
-      } else {
-        sendJson(res, { ok: true, cancelled: false })
-      }
-    } catch (e) {
-      sendJson(res, { ok: false, error: e.message }, Number(e?.statusCode) || 500)
-    }
-    return
-  }
-
-  if (req.url === '/mcp') {
-    if (!isLocalOrigin(req)) {
-      sendJson(res, { error: 'forbidden: cross-origin' }, 403)
-      return
-    }
-    try {
-      if (req.method === 'POST') {
-        const httpMcp = createHttpMcpServer()
-        const httpTransport = new StreamableHTTPServerTransport({
-          sessionIdGenerator: undefined,
-          enableJsonResponse: true,
-        })
-        res.on('close', () => {
-          httpTransport.close()
-          void httpMcp.close()
-        })
-        await httpMcp.connect(httpTransport)
-        const body = await readBody(req)
-        await httpTransport.handleRequest(req, res, body)
-      } else {
-        sendJson(res, { error: 'Method not allowed' }, 405)
-      }
-    } catch (e) {
-      __mixdogMemoryLog(`[memory-service] /mcp error: ${e.stack || e.message}\n`)
-      if (!res.headersSent) sendError(res, e.message, Number(e?.statusCode) || 500)
-    }
-    return
-  }
-
-  if (req.method !== 'POST') {
-    sendJson(res, { error: 'Method not allowed' }, 405)
-    return
-  }
-
-  // Tail block handles /entry and /ingest-transcript — both mutate the DB,
-  // so apply the same cross-origin guard as /admin/* routes.
-  if (!isLocalOrigin(req)) {
-    sendError(res, 'forbidden: cross-origin', 403)
-    return
-  }
-
-  let body
-  try { body = await readBody(req) }
-  catch (e) { sendError(res, e.message, Number(e?.statusCode) || 500); return }
-
-  try {
-    if (req.url === '/entry') {
-      const role = String(body.role ?? 'user')
-      const content = String(body.content ?? '')
-      const sourceRef = String(body.sourceRef ?? `manual:${Date.now()}-${process.pid}`)
-      const sessionId = body.sessionId ?? null
-      const tsMs = parseTsToMs(body.ts ?? Date.now())
-      if (!content) { sendJson(res, { error: 'content required' }, 400); return }
-      // Run the same scrubber used by ingestTranscriptFile so noise markers
-      // like "[Request interrupted by user]" and whitespace-only payloads
-      // are rejected before they reach the entries table. Match the
-      // existing 400 / { error } convention for invalid payloads.
-      const cleaned = cleanMemoryText(content)
-      if (!cleaned || !cleaned.trim()) {
-        sendJson(res, { error: 'empty after clean' }, 400)
-        return
-      }
-      const entryProjectId = resolveProjectScope(typeof body.cwd === 'string' && body.cwd ? body.cwd : null)
-      try {
-        const result = await db.query(`
-          INSERT INTO entries(ts, role, content, source_ref, session_id, project_id)
-          VALUES ($1, $2, $3, $4, $5, $6)
-          ON CONFLICT DO NOTHING
-          RETURNING id
-        `, [tsMs, role, cleaned, sourceRef, sessionId, entryProjectId])
-        const insertedId = result.rows[0]?.id ?? null
-        sendJson(res, { ok: true, id: insertedId !== null ? Number(insertedId) : null, changes: Number(result.rowCount ?? result.affectedRows ?? 0) })
-      } catch (e) {
-        sendJson(res, { error: e.message }, 500)
-      }
-      return
-    }
-
-    if (req.url === '/ingest-transcript') {
-      const filePath = body.filePath
-      if (!filePath) { sendJson(res, { error: 'filePath required' }, 400); return }
-      try {
-        const n = await ingestTranscriptFile(filePath, { cwd: body.cwd })
-        sendJson(res, { ok: true, ingested: n })
-      } catch (e) {
-        sendJson(res, { error: e.message }, 500)
-      }
-      return
-    }
-
-    if (req.url === '/transcript/ingest-sync') {
-      const filePath = body.path
-      if (!filePath || typeof filePath !== 'string') {
-        sendJson(res, { error: 'path required' }, 400)
-        return
-      }
-      try {
-        let stat
-        try { stat = await fs.promises.stat(filePath) } catch {
-          sendJson(res, { ok: true, complete: true, fileSize: 0, offsetBytes: 0 })
-          return
-        }
-        const fileSize = stat.size
-        await ingestTranscriptFile(filePath, { cwd: body.cwd })
-        const off = _transcriptIngest.getOffset(filePath)
-        const offsetBytes = off && Number.isFinite(off.bytes) ? off.bytes : 0
-        const complete = offsetBytes >= fileSize
-        sendJson(res, { ok: true, offsetBytes, fileSize, complete })
-      } catch (e) {
-        sendJson(res, { error: e.message }, 500)
-      }
-      return
-    }
-
-    sendJson(res, { error: 'Not found' }, 404)
-  } catch (e) {
-    __mixdogMemoryLog(`[memory-service] ${req.url} error: ${e.stack || e.message}\n`)
-    sendError(res, e.message)
-  }
+// ── HTTP request router (extracted to lib/http-router.mjs). The facade owns
+// the http.Server + listen/stop lifecycle; the router builds the request
+// handler and buildSessionCoreMemoryPayload from injected live state.
+const _httpRouter = createHttpRouter({
+  getDb: () => db,
+  dataDir: DATA_DIR,
+  log: __mixdogMemoryLog,
+  pluginVersion: PLUGIN_VERSION,
+  bootPromotionCodeFingerprint: BOOT_PROMOTION_CODE_FINGERPRINT,
+  touchDaemonIdleTimer,
+  entryStats,
+  cycleScheduler: _cycleScheduler,
+  getInitialized: () => _initialized,
+  getInitPromise: () => _initPromise,
+  setBootTimestamp: (v) => { _bootTimestamp = v },
+  handleMemoryAction,
+  handleToolCall,
+  stop,
+  registerClient,
+  deregisterClient,
+  getDraining: () => _stopPromise != null,
+  getCycle1CallLlm,
+  getTraceDb: () => _traceDb,
+  setTraceDb: (v) => { _traceDb = v },
+  ingestTranscriptFile,
+  getTranscriptOffset: (fp) => _transcriptIngest.getOffset(fp),
+  parseTsToMs,
 })
+const buildSessionCoreMemoryPayload = _httpRouter.buildSessionCoreMemoryPayload
+const httpServer = http.createServer(_httpRouter.requestHandler)
 
 export { TOOL_DEFS, handleToolCall, buildSessionCoreMemoryPayload }
 export { MEMORY_INSTRUCTIONS_TEXT as instructions }
@@ -2372,6 +805,11 @@ export async function stop() {
       try { clearTimeout(_idleShutdownTimer) } catch {}
       _idleShutdownTimer = null
     }
+    cancelClientGrace()
+    if (_clientSweepTimer) {
+      try { clearInterval(_clientSweepTimer) } catch {}
+      _clientSweepTimer = null
+    }
     await stopLlmWorker()
     resetHttpListenErrorHandler()
     if (_httpBoundPort != null || _httpReadyPromise) {