mixdog 0.9.2 → 0.9.3

package/src/runtime/memory/index.mjs

@@ -9,7 +9,6 @@ process.removeAllListeners('warning')
 process.on('warning', () => {})
 
 import http from 'node:http'
-import crypto from 'node:crypto'
 import os from 'node:os'
 import fs from 'node:fs'
 import path from 'node:path'
@@ -17,47 +16,9 @@ import { fileURLToPath, pathToFileURL } from 'node:url'
 
 const PLUGIN_ROOT = path.resolve(path.dirname(fileURLToPath(import.meta.url)), '..', '..', '..')
 
-function readPluginVersion() {
-  try {
-    return JSON.parse(fs.readFileSync(path.join(PLUGIN_ROOT, 'package.json'), 'utf8')).version || '0.0.1'
-  } catch { return '0.0.1' }
-}
-const PLUGIN_VERSION = readPluginVersion()
-const PROMOTION_FINGERPRINT_ROOTS = ['src/memory']
-function collectPromotionFingerprintFiles() {
-  const out = []
-  const walk = (relDir) => {
-    let entries = []
-    try { entries = fs.readdirSync(path.join(PLUGIN_ROOT, relDir), { withFileTypes: true }) }
-    catch { return }
-    for (const ent of entries) {
-      const rel = `${relDir}/${ent.name}`.replace(/\\/g, '/')
-      if (ent.isDirectory()) {
-        walk(rel)
-      } else if (ent.isFile() && rel.endsWith('.mjs')) {
-        out.push(rel)
-      }
-    }
-  }
-  for (const root of PROMOTION_FINGERPRINT_ROOTS) walk(root)
-  return out.sort()
-}
-function readPromotionCodeFingerprint() {
-  const hash = crypto.createHash('sha256')
-  const files = collectPromotionFingerprintFiles()
-  for (const rel of files) {
-    hash.update(rel)
-    hash.update('\0')
-    try {
-      hash.update(fs.readFileSync(path.join(PLUGIN_ROOT, rel)))
-    } catch {
-      hash.update('missing')
-    }
-    hash.update('\0')
-  }
-  return `src/memory:${files.length}:${hash.digest('hex').slice(0, 16)}`
-}
-const BOOT_PROMOTION_CODE_FINGERPRINT = readPromotionCodeFingerprint()
+import { readPluginVersion, readPromotionCodeFingerprint } from './lib/promotion-fingerprint.mjs'
+const PLUGIN_VERSION = readPluginVersion(PLUGIN_ROOT)
+const BOOT_PROMOTION_CODE_FINGERPRINT = readPromotionCodeFingerprint(PLUGIN_ROOT)
 
 try { os.setPriority(os.constants.priority.PRIORITY_BELOW_NORMAL) } catch {}
 try {
@@ -101,18 +62,21 @@ import { initProviders } from '../agent/orchestrator/providers/registry.mjs'
 import { makeAgentDispatch } from '../agent/orchestrator/agent-runtime/agent-dispatch.mjs'
 import { getInFlightCycle1 } from './lib/memory-cycle1.mjs'
 import { drainSessionCycle1 } from '../agent/orchestrator/session/compact.mjs'
-import { claimAndMarkScheduledCycle, makeCycleRequestSignature, resolveCoalesceMaxRetries, scheduleCoalescedCycleRetry } from './lib/memory-cycle-requests.mjs'
+import { claimAndMarkScheduledCycle, resolveCoalesceMaxRetries, scheduleCoalescedCycleRetry } from './lib/memory-cycle-requests.mjs'
 import { searchRelevantHybrid } from './lib/memory-recall-store.mjs'
 import { fetchEntriesByIdsScoped } from './lib/memory-recall-id-patch.mjs'
 import { retrieveEntries } from './lib/memory-retrievers.mjs'
 import { pruneOldEntries } from './lib/memory-maintenance-store.mjs'
 import { computeEntryScore } from './lib/memory-score.mjs'
 import { runFullBackfill } from './lib/memory-ops-policy.mjs'
-import { listCore, addCore, editCore, deleteCore, compactCoreIds, CORE_SUMMARY_MAX } from './lib/core-memory-store.mjs'
+import { listCore, addCore, editCore, deleteCore, compactCoreIds, listCoreCandidates, promoteCoreCandidate, dismissCoreCandidate, CORE_SUMMARY_MAX } from './lib/core-memory-store.mjs'
 import { resolveProjectId, resolveProjectScope } from './lib/project-id-resolver.mjs'
 import { openTraceDatabase, closeTraceDatabase, insertTraceEvents, enqueueTraceEvents, insertAgentCalls, registerTraceExitDrain } from './lib/trace-store.mjs'
 import { updateJsonAtomicSync, writeJsonAtomicSync } from '../shared/atomic-file.mjs'
 import { resolvePluginData, mixdogHome } from '../shared/plugin-paths.mjs'
+import { parsePeriod, formatTs, coreRecallTerms, normalizeRecallProjectScope, sessionRecallTerms, interleaveRawRows, renderEntryLines } from './lib/recall-format.mjs'
+import { readBody, sendJson, sendError, isLocalOrigin, normalizeCoreProjectId } from './lib/http-wire.mjs'
+import { scheduledCycle1Signature, scheduledCycle2Signature, scheduledCycle3Signature } from './lib/cycle-signatures.mjs'
 const IS_MEMORY_ENTRY = !!process.argv[1] && import.meta.url === pathToFileURL(path.resolve(process.argv[1])).href
 const USE_ARG_DATA_DIR = IS_MEMORY_ENTRY || process.env.MIXDOG_WORKER_MODE === '1'
 const DATA_DIR = process.env.MIXDOG_DATA_DIR || (USE_ARG_DATA_DIR ? process.argv[2] : '') || resolvePluginData()
@@ -655,79 +619,78 @@ async function setCycleLastRun(kind, ts) {
 // Raw-row priority lookup for narrow-window queries. Raw rows (is_root=0,
 // chunk_root IS NULL) are inserted immediately by ingestTranscriptFile before
 // cycle1 runs, so they always carry the freshest turns in the DB.
-async function readRawRowsInWindow(db, tsFromMs, tsToMs, hardLimit = 10, { projectScope } = {}) {
+async function readRawRowsInWindow(db, tsFromMs, tsToMs, hardLimit = 10, { projectScope, sessionId } = {}) {
   try {
-    let sql, params
+    // Composable WHERE assembly (mirrors retrieveEntries' filter semantics so
+    // raw and chunked legs stay in filter parity: projectScope AND sessionId
+    // apply identically to both pools).
+    const where = ['chunk_root IS NULL', 'is_root = 0', 'ts >= $1', 'ts <= $2']
+    const params = [tsFromMs ?? 0, tsToMs ?? Date.now()]
     if (projectScope === 'common') {
-      sql = `SELECT id, ts, role, content, session_id, source_turn, chunk_root, is_root,
-              element, category, summary, status, score, last_seen_at, project_id
-       FROM entries
-       WHERE chunk_root IS NULL AND is_root = 0
-         AND ts >= $1 AND ts <= $2
-         AND project_id IS NULL
-       ORDER BY ts DESC
-       LIMIT $3`
-      params = [tsFromMs ?? 0, tsToMs ?? Date.now(), hardLimit]
+      where.push('project_id IS NULL')
     } else if (projectScope && projectScope !== 'all') {
-      sql = `SELECT id, ts, role, content, session_id, source_turn, chunk_root, is_root,
-              element, category, summary, status, score, last_seen_at, project_id
-       FROM entries
-       WHERE chunk_root IS NULL AND is_root = 0
-         AND ts >= $1 AND ts <= $2
-         AND (project_id IS NULL OR project_id = $3)
-       ORDER BY ts DESC
-       LIMIT $4`
-      params = [tsFromMs ?? 0, tsToMs ?? Date.now(), projectScope, hardLimit]
-    } else {
-      sql = `SELECT id, ts, role, content, session_id, source_turn, chunk_root, is_root,
+      params.push(projectScope)
+      where.push(`(project_id IS NULL OR project_id = $${params.length})`)
+    }
+    const sid = String(sessionId || '').trim()
+    if (sid) {
+      params.push(sid)
+      where.push(`session_id = $${params.length}`)
+    }
+    params.push(hardLimit)
+    const sql = `SELECT id, ts, role, content, session_id, source_turn, chunk_root, is_root,
               element, category, summary, status, score, last_seen_at, project_id
        FROM entries
-       WHERE chunk_root IS NULL AND is_root = 0
-         AND ts >= $1 AND ts <= $2
+       WHERE ${where.join(' AND ')}
        ORDER BY ts DESC
-       LIMIT $3`
-      params = [tsFromMs ?? 0, tsToMs ?? Date.now(), hardLimit]
-    }
+       LIMIT $${params.length}`
     const rows = (await db.query(sql, params)).rows
     return rows.map(r => ({ ...r, retrievalScore: 0, rrf: 0 }))
   } catch { return [] }
 }
 
-// Spread raw (unchunked) rows evenly across a hybrid-ranked list at a fixed
-// stride so every offset page draws its proportional share of raw rows,
-// instead of them all landing after the hybrid page-0 window (the old
-// append-only behaviour). Stride is derived from the ratio of hybrid:raw
-// counts so a small raw set doesn't get pushed arbitrarily deep, and a large
-// raw set doesn't crowd out every hybrid hit near the top.
-function interleaveRawRows(hybridRows, rawRows) {
-  if (!Array.isArray(rawRows) || rawRows.length === 0) return hybridRows
-  const out = []
-  const stride = Math.max(1, Math.round(hybridRows.length / (rawRows.length + 1)))
-  let rawIdx = 0
-  for (let i = 0; i < hybridRows.length; i += 1) {
-    out.push(hybridRows[i])
-    if ((i + 1) % stride === 0 && rawIdx < rawRows.length) {
-      out.push(rawRows[rawIdx])
-      rawIdx += 1
-    }
-  }
-  while (rawIdx < rawRows.length) out.push(rawRows[rawIdx++])
-  return out
-}
-
-function sessionRecallTerms(query) {
-  return [...new Set(String(query || '').toLowerCase().match(/[\p{L}\p{N}_./:-]{2,}/gu) || [])]
-    .filter((term) => !CORE_RECALL_STOPWORDS.has(term))
-    .slice(0, 12)
-}
-
 async function recallSessionRows(args = {}) {
   const sessionId = String(args.sessionId || args.session_id || '').trim()
   if (!sessionId) return { text: '(no current session)' }
   const limit = Math.max(1, Math.min(100, Number(args.limit) || 20))
   const terms = sessionRecallTerms(args.query)
   const params = [sessionId]
-  const where = ['session_id = $1']
+  // Roots + not-yet-chunked leaves only. Once cycle1 turns raw leaves into
+  // (root, members) pairs, selecting every row unfiltered emitted the root's
+  // summary AND its own member rows in the same browse — duplicate content.
+  // A committed member (is_root=0 with a chunk_root) is always reachable via
+  // its root's `members` expansion below, so it never needs to be selected
+  // directly here.
+  const where = ['session_id = $1', '(is_root = 1 OR chunk_root IS NULL OR chunk_root = id)']
+  // Current-turn cutoff: the newest unchunked row is very often the calling
+  // turn's OWN recall request/tool-args, still being written when this query
+  // runs. Exclude it from a bare (no-query) browse so the in-flight turn
+  // doesn't self-echo; a query browse (explicit search intent) keeps it.
+  // Only treat the newest unchunked turn as "in-flight" when its latest row
+  // is fresh (within FRESHNESS_MS of now) — an older newest-unchunked-turn
+  // is completed history (cycle1 just hasn't gotten to it, or drain timed
+  // out) and must stay visible, not be silently hidden every browse.
+  const IN_FLIGHT_TURN_FRESHNESS_MS = 5 * 60 * 1000
+  let excludeSourceTurnId = null
+  if (terms.length === 0) {
+    try {
+      const r = await db.query(
+        `SELECT source_turn t, MAX(ts) last_ts FROM entries
+         WHERE session_id = $1 AND chunk_root IS NULL
+         GROUP BY source_turn ORDER BY source_turn DESC LIMIT 1`,
+        [sessionId],
+      )
+      const t = r.rows?.[0]?.t
+      const lastTs = Number(r.rows?.[0]?.last_ts)
+      if (t != null && Number.isFinite(lastTs) && (Date.now() - lastTs) <= IN_FLIGHT_TURN_FRESHNESS_MS) {
+        excludeSourceTurnId = Number(t)
+      }
+    } catch {}
+  }
+  if (Number.isFinite(excludeSourceTurnId)) {
+    params.push(excludeSourceTurnId)
+    where.push(`NOT (chunk_root IS NULL AND source_turn = $${params.length})`)
+  }
   if (terms.length > 0) {
     const textExpr = `lower(coalesce(content, '') || ' ' || coalesce(element, '') || ' ' || coalesce(summary, ''))`
     const clauses = terms.map((term) => {
@@ -748,16 +711,22 @@ async function recallSessionRows(args = {}) {
   if (rows.length < limit) {
     const seen = new Set(rows.map((row) => Number(row.id)).filter((id) => Number.isFinite(id)))
     const fillLimit = Math.max(0, limit - rows.length)
+    const fillWhere = ['session_id = $1', 'id <> ALL($2::bigint[])', '(is_root = 1 OR chunk_root IS NULL OR chunk_root = id)']
+    const fillParams = [sessionId, [...seen]]
+    if (Number.isFinite(excludeSourceTurnId)) {
+      fillParams.push(excludeSourceTurnId)
+      fillWhere.push(`NOT (chunk_root IS NULL AND source_turn = $${fillParams.length})`)
+    }
+    fillParams.push(fillLimit)
     const fillRows = fillLimit > 0
       ? (await db.query(`
           SELECT id, ts, role, content, session_id, source_turn, chunk_root, is_root,
                  element, category, summary, status, score, last_seen_at, project_id
           FROM entries
-          WHERE session_id = $1
-            AND id <> ALL($2::bigint[])
+          WHERE ${fillWhere.join(' AND ')}
           ORDER BY ts DESC, id DESC
-          LIMIT $3
-        `, [sessionId, [...seen], fillLimit])).rows
+          LIMIT $${fillParams.length}
+        `, fillParams)).rows
       : []
     if (fillRows.length > 0) rows = [...rows, ...fillRows]
   }
@@ -1296,6 +1265,62 @@ async function recordCycle1Result(result) {
   if (!skipped && !coalescedNoop && !allFailed) {
     await setCycleLastRun('cycle1', now)
   }
+  if (!skipped && !coalescedNoop) markCycleDone('cycle1', !allFailed, allFailed ? 'all rows skipped' : null)
+}
+
+// ── Cycle health state (no new commands; consumed by /health + statusline) ──
+// In-memory per-cycle run ledger + a small state file the TUI statusline can
+// read without HTTP. "Silently stalled cycles" (2026-07: cycle2 poison
+// rotation sat unnoticed for months) become visible three ways: /health
+// fields, a WARN log with cooldown, and the L2 "Memory" segment.
+const CYCLE_STATE_FILE = path.join(DATA_DIR, 'memory-cycle-state.json')
+const _cycleHealth = {
+  cycle1: { last_success_at: 0, last_error_at: 0, last_error: null, consecutive_failures: 0 },
+  cycle2: { last_success_at: 0, last_error_at: 0, last_error: null, consecutive_failures: 0 },
+  cycle3: { last_success_at: 0, last_error_at: 0, last_error: null, consecutive_failures: 0 },
+}
+let _cycleRunning = null // { cycle, started_at }
+let _cycleBacklogSnapshot = { unchunked: 0, cycle2_pending: 0, at: 0 }
+let _lastBacklogWarnAt = 0
+const BACKLOG_WARN_COOLDOWN_MS = 10 * 60_000
+const BACKLOG_WARN_PENDING = 500
+const BACKLOG_WARN_FAILURES = 5
+
+function _writeCycleStateFile() {
+  try {
+    fs.writeFileSync(CYCLE_STATE_FILE, JSON.stringify({
+      running: _cycleRunning,
+      backlog: _cycleBacklogSnapshot,
+      cycles: _cycleHealth,
+      updatedAt: Date.now(),
+    }))
+  } catch { /* best-effort; statusline just shows nothing */ }
+}
+
+function markCycleRunning(cycle) {
+  _cycleRunning = { cycle, started_at: Date.now() }
+  _writeCycleStateFile()
+}
+
+function markCycleDone(cycle, ok, err = null) {
+  const h = _cycleHealth[cycle]
+  if (h) {
+    const now = Date.now()
+    if (ok) { h.last_success_at = now; h.consecutive_failures = 0; h.last_error = null }
+    else { h.last_error_at = now; h.consecutive_failures += 1; h.last_error = String(err || 'unknown').slice(0, 200) }
+    if (!ok && h.consecutive_failures >= BACKLOG_WARN_FAILURES) {
+      _warnCycleHealth(`${cycle} failing repeatedly (consecutive=${h.consecutive_failures}, last="${h.last_error}")`)
+    }
+  }
+  if (_cycleRunning?.cycle === cycle) _cycleRunning = null
+  _writeCycleStateFile()
+}
+
+function _warnCycleHealth(msg) {
+  const now = Date.now()
+  if (now - _lastBacklogWarnAt < BACKLOG_WARN_COOLDOWN_MS) return
+  _lastBacklogWarnAt = now
+  __mixdogMemoryLog(`[cycle-health] WARN ${msg}\n`)
 }
 
 function _startCycle1Run(config = {}, options = {}) {
@@ -1306,6 +1331,7 @@ function _startCycle1Run(config = {}, options = {}) {
   if (typeof options?.callLlm !== 'function') {
     options = { ...options, callLlm: getCycle1CallLlm() }
   }
+  markCycleRunning('cycle1')
   _cycle1InFlight = (async () => {
     try {
       const result = await runCycle1(db, config, options, DATA_DIR)
@@ -1318,7 +1344,11 @@ function _startCycle1Run(config = {}, options = {}) {
         await recordCycle1Result(result)
       }
       return result
+    } catch (err) {
+      markCycleDone('cycle1', false, err?.message || err)
+      throw err
     } finally {
+      if (_cycleRunning?.cycle === 'cycle1') { _cycleRunning = null; _writeCycleStateFile() }
       if (_cycle1InFlight === promise) _cycle1InFlight = null
     }
   })()
@@ -1345,7 +1375,14 @@ async function _awaitCycle1Run(config = {}, options = {}) {
   let timer
   const deadlinePromise = new Promise((resolve) => {
     timer = setTimeout(() => {
-      if (_cycle1InFlight === target) _cycle1InFlight = null
+      // Do NOT clear _cycle1InFlight here — the underlying runCycle1 is still
+      // running in the background and owns that slot; its own `finally`
+      // (_startCycle1Run above) clears it when the real work settles. Clearing
+      // it early made a later unbounded drain (deadlineMs:0, e.g. the query
+      // recall path) re-enter _startCycle1Run and spawn a SECOND concurrent
+      // cycle1 run instead of awaiting the one already in flight, defeating
+      // drain-to-zero silently. The caller here just stops WAITING at the
+      // deadline; state ownership stays with the promise itself.
       resolve({
         processed: 0,
         chunks: 0,
@@ -1381,34 +1418,6 @@ function periodicCycle1Config() {
   }
 }
 
-function scheduledCycle1Signature(config) {
-  return makeCycleRequestSignature('cycle1', config, {
-    preset: undefined,
-    concurrency: undefined,
-    maxConcurrent: undefined,
-  })
-}
-
-function scheduledCycle2Signature(config) {
-  return makeCycleRequestSignature('cycle2', config, {
-    cascadePreset: undefined,
-    concurrency: undefined,
-  })
-}
-
-function scheduledCycle3ApplyMode(config) {
-  const raw = String(config?.cycle3?.applyMode || 'conservative').trim().toLowerCase()
-  return (raw === 'proposal' || raw === 'dry-run' || raw === 'dryrun') ? 'proposal' : 'conservative'
-}
-
-function scheduledCycle3Signature(config) {
-  const retryConfig = config?.cycle3 || config
-  return makeCycleRequestSignature('cycle3', retryConfig, {
-    applyMode: scheduledCycle3ApplyMode(config),
-    apply: undefined,
-  })
-}
-
 async function enqueueScheduledCycle(kind, intervalMs, signature) {
   const claim = await claimAndMarkScheduledCycle(db, kind, intervalMs, signature, { reason: 'scheduled' })
   return claim.claimed === true
@@ -1469,6 +1478,7 @@ function scheduleScheduledCycle2(config, signature, attempt = 0) {
       return
     }
     _cycle2InFlight = true
+    markCycleRunning('cycle2')
     try {
       let c2Options = {
         coalescedRetry: true,
@@ -1487,8 +1497,10 @@ function scheduleScheduledCycle2(config, signature, attempt = 0) {
       }
     } catch (err) {
       __mixdogMemoryLog(`[cycle2] scheduled queue failed: ${err?.message || err}\n`)
+      markCycleDone('cycle2', false, err?.message || err)
     } finally {
       _cycle2InFlight = false
+      if (_cycleRunning?.cycle === 'cycle2') { _cycleRunning = null; _writeCycleStateFile() }
     }
   }, config, signature)
 }
@@ -1506,10 +1518,11 @@ function scheduleScheduledCycle3(config, signature, attempt = 0) {
       return
     }
     _cycle3InFlight = true
+    markCycleRunning('cycle3')
     try {
       let c3Options = {
         coalescedRetry: true,
-        onCoalescedSuccess: () => setCycleLastRun('cycle3', Date.now()),
+        onCoalescedSuccess: async () => { await setCycleLastRun('cycle3', Date.now()); markCycleDone('cycle3', true) },
       }
       if (typeof c3Options?.callLlm !== 'function') {
         c3Options = { ...c3Options, callLlm: getCycle3CallLlm() }
@@ -1522,8 +1535,10 @@ function scheduleScheduledCycle3(config, signature, attempt = 0) {
       }
     } catch (err) {
       __mixdogMemoryLog(`[cycle3] scheduled queue failed: ${err?.message || err}\n`)
+      markCycleDone('cycle3', false, err?.message || err)
     } finally {
       _cycle3InFlight = false
+      if (_cycleRunning?.cycle === 'cycle3') { _cycleRunning = null; _writeCycleStateFile() }
     }
   }, retryConfig, signature)
 }
@@ -1537,9 +1552,11 @@ async function _finalizeCycle2Run(result) {
     await setCycleLastRun('cycle2', Date.now())
     await setCycleLastRun('cycle2_last_error', '')
     __mixdogMemoryLog('[cycle2] completed\n')
+    markCycleDone('cycle2', true)
   } else {
     await setCycleLastRun('cycle2_last_error', result.error || 'unknown error')
     __mixdogMemoryLog(`[cycle2] failed: ${result.error}\n`)
+    markCycleDone('cycle2', false, result.error || 'unknown error')
   }
 }
 
@@ -1616,6 +1633,36 @@ async function checkCycles() {
   if (now - last.cycle3 >= cycle3Ms) {
     await enqueueScheduledCycle3(cycle3Ms, 'scheduled')
   }
+
+  // ── Backlog watch + self-kick (cycle-health) ─────────────────────────────
+  // Cheap counts each tick (60s): surface a WARN when the pipeline is
+  // building a backlog, and if a cycle has not SUCCEEDED for 2h+ while its
+  // backlog is over threshold, kick one unscheduled run now instead of
+  // waiting for the interval — a stalled cycle otherwise hides behind
+  // "the schedule ran it" (attempt != success; see 2026-07 cycle2 stall).
+  try {
+    const unchunked = Number((await db.query(
+      `SELECT COUNT(*) c FROM entries WHERE chunk_root IS NULL AND NULLIF(btrim(session_id), '') IS NOT NULL`,
+    )).rows[0]?.c ?? 0)
+    const cycle2Pending = Number((await db.query(
+      `SELECT COUNT(*) c FROM entries WHERE is_root = 1 AND status = 'pending'`,
+    )).rows[0]?.c ?? 0)
+    _cycleBacklogSnapshot = { unchunked, cycle2_pending: cycle2Pending, at: now }
+    _writeCycleStateFile()
+    if (unchunked > BACKLOG_WARN_PENDING || cycle2Pending > BACKLOG_WARN_PENDING) {
+      _warnCycleHealth(`backlog unchunked=${unchunked} cycle2_pending=${cycle2Pending}`)
+    }
+    const SELF_KICK_STALE_MS = 2 * 3600_000
+    const c1Stale = (_cycleHealth.cycle1.last_success_at || last.cycle1 || 0) < now - SELF_KICK_STALE_MS
+    const c2Stale = (_cycleHealth.cycle2.last_success_at || last.cycle2 || 0) < now - SELF_KICK_STALE_MS
+    if (c1Stale && unchunked > BACKLOG_WARN_PENDING) {
+      _warnCycleHealth(`cycle1 self-kick: no success 2h+, unchunked=${unchunked}`)
+      await enqueueScheduledCycle1(0, 'self-kick')
+    } else if (c2Stale && cycle2Pending > BACKLOG_WARN_PENDING) {
+      _warnCycleHealth(`cycle2 self-kick: no success 2h+, pending=${cycle2Pending}`)
+      await enqueueScheduledCycle2(0, 'self-kick')
+    }
+  } catch { /* counts are best-effort; never fail the tick */ }
 }
 let _cycle2InFlight = false
 let _cycle3InFlight = false
@@ -1696,114 +1743,6 @@ function _beginRuntimeInit() {
   return _initPromise
 }
 
-
-function parsePeriod(period, hasQuery) {
-  if (!period && hasQuery) period = '30d'
-  if (!period) return null
-  if (period === 'all') return null
-  if (period === 'last') return { mode: 'last' }
-  // Calendar-day windows: 'today' anchors at local midnight rather than
-  // rolling 24h. Without this, a query asking 'today' at 01:30 would silently
-  // include yesterday's last 22.5h of activity, mislabelling them as
-  // 'today's work'. 'yesterday' is the previous calendar day.
-  if (period === 'today') {
-    const start = new Date()
-    start.setHours(0, 0, 0, 0)
-    return { startMs: start.getTime(), endMs: Date.now() }
-  }
-  if (period === 'yesterday') {
-    const start = new Date()
-    start.setDate(start.getDate() - 1)
-    start.setHours(0, 0, 0, 0)
-    const end = new Date(start)
-    end.setHours(23, 59, 59, 999)
-    return { startMs: start.getTime(), endMs: end.getTime() }
-  }
-  if (period === 'this_week' || period === 'last_week') {
-    // R6 P9: calendar Mon-Sun previous/current week. Mon-start ISO
-    // convention. Replaces R5 rolling 7-14d range which was empty for
-    // sessions where "last week" decisions actually fell on Mon (4/27) of
-    // this week. Precise calendar bounds match natural-language intuition.
-    const d = new Date()
-    d.setHours(0, 0, 0, 0)
-    const dayOfWeek = d.getDay()
-    const daysSinceMon = (dayOfWeek + 6) % 7
-    const thisWeekMon = new Date(d)
-    thisWeekMon.setDate(d.getDate() - daysSinceMon)
-    if (period === 'this_week') {
-      return { startMs: thisWeekMon.getTime(), endMs: Date.now() }
-    }
-    const lastWeekMon = new Date(thisWeekMon)
-    lastWeekMon.setDate(thisWeekMon.getDate() - 7)
-    const lastWeekSunEnd = new Date(thisWeekMon.getTime() - 1)
-    return { startMs: lastWeekMon.getTime(), endMs: lastWeekSunEnd.getTime() }
-  }
-  const relMatch = period.match(/^(\d+)(m|h|d)$/)
-  if (relMatch) {
-    const n = parseInt(relMatch[1])
-    const unit = relMatch[2]
-    const now = new Date()
-    if (unit === 'm') {
-      // Minute granularity is for "resume from the previous turn / pick
-      // up where we left off" style recall — sub-hour windows where 1h
-      // is too coarse. n=0 is invalid (the regex requires \d+ which
-      // matches "0" but a zero-width window returns no rows; leave that
-      // as caller-supplied no-op).
-      const start = new Date(now.getTime() - n * 60_000)
-      return { startMs: start.getTime(), endMs: now.getTime() }
-    }
-    if (unit === 'h') {
-      const start = new Date(now.getTime() - n * 3600_000)
-      return { startMs: start.getTime(), endMs: now.getTime() }
-    }
-    const start = new Date(now)
-    start.setDate(start.getDate() - n)
-    return { startMs: start.getTime(), endMs: now.getTime() }
-  }
-  const rangeMatch = period.match(/^(\d{4}-\d{2}-\d{2})~(\d{4}-\d{2}-\d{2})$/)
-  if (rangeMatch) {
-    return {
-      startMs: Date.parse(rangeMatch[1] + 'T00:00:00'),
-      endMs:   Date.parse(rangeMatch[2] + 'T23:59:59.999'),
-    }
-  }
-  const dateMatch = period.match(/^(\d{4}-\d{2}-\d{2})$/)
-  if (dateMatch) {
-    return {
-      startMs: Date.parse(dateMatch[1] + 'T00:00:00'),
-      endMs:   Date.parse(dateMatch[1] + 'T23:59:59.999'),
-      exact: true,
-    }
-  }
-  return null
-}
-
-function formatTs(tsMs) {
-  const n = Number(tsMs)
-  if (Number.isFinite(n) && n > 1e12) {
-    return new Date(n).toLocaleString('sv-SE').slice(0, 16)
-  }
-  return String(tsMs ?? '').slice(0, 16)
-}
-
-const CORE_RECALL_STOPWORDS = new Set([
-  'about', 'after', 'again', 'before', 'check', 'color', 'decision', 'decided',
-  'earlier', 'memory', 'previous', 'routing', 'stored', 'tell', 'what',
-])
-
-function coreRecallTerms(query) {
-  return [...new Set(String(query || '').toLowerCase().match(/[\p{L}\p{N}_-]{4,}/gu) || [])]
-    .filter((term) => !CORE_RECALL_STOPWORDS.has(term))
-    .slice(0, 8)
-}
-
-function normalizeRecallProjectScope(projectScope) {
-  const raw = String(projectScope || 'common').trim()
-  if (!raw || raw.toLowerCase() === 'common') return null
-  if (raw.toLowerCase() === 'all') return '*'
-  return raw
-}
-
 async function recallCoreRows(query, { projectScope, category, limit } = {}) {
   const terms = coreRecallTerms(query)
   if (terms.length === 0) return []
@@ -1864,9 +1803,11 @@ async function recallCoreRows(query, { projectScope, category, limit } = {}) {
 // (memory-cycle1.mjs:394) — other sessions' pending rows are left for the
 // periodic cycle1 sweep. Reuses recall-fasttrack's drainSessionCycle1
 // (session/compact.mjs:504) which loops cycle1 until raw rows hit 0 or a
-// no-progress pass. Safety limits: a 2,000-row hard cap (both in the pending
+// no-progress pass. Safety limits: a 500-row hard cap (both in the pending
 // pre-check and as the per-call cycle1 batch ceiling) and cooperative
 // abort-signal propagation through handleMemoryAction — no time budget.
+// Window 20 rows per classifier prompt × concurrency 5 (haiku — cost is
+// negligible; 500 rows ≈ 25 prompts ≈ 5 waves).
 //
 // Multi-terminal safety: the memory daemon is one shared instance across
 // terminals (active-instance.json memory_port). Concurrent recall(query)
@@ -1875,8 +1816,8 @@ async function recallCoreRows(query, { projectScope, category, limit } = {}) {
 // advisory-lock/coalesce guard in memory-cycle1.mjs still serializes actual
 // DB writes). A drain only gates recall for its OWN session — every other
 // terminal's recall (different session, or no session) proceeds unblocked.
-const RECALL_DRAIN_HARD_CAP_ROWS = 2000
-async function _drainSessionForRecallQuery(sessionId, signal) {
+const RECALL_DRAIN_HARD_CAP_ROWS = 500
+async function _drainSessionForRecallQuery(sessionId, signal, deadlineMs = 0) {
   if (!sessionId || signal?.aborted) return
   const existing = _recallDrainInFlight.get(sessionId)
   if (existing) { try { await existing } catch {} return }
@@ -1897,14 +1838,15 @@ async function _drainSessionForRecallQuery(sessionId, signal) {
     action: 'dump_session_roots',
     sessionId,
     includeRaw: true,
-    limit: Math.min(RECALL_DRAIN_HARD_CAP_ROWS, Math.max(1000, pendingCount)),
+    limit: Math.min(RECALL_DRAIN_HARD_CAP_ROWS, Math.max(1, pendingCount)),
   }
   const drainPromise = (async () => {
     try {
       return await drainSessionCycle1(runTool, {
         sessionId,
         dumpArgs,
-        deadlineMs: 0, // no time budget — drive the session's backlog to 0
+        deadlineMs, // 0 = no time budget (query path); bare browse passes a
+        // short bound so a browse call never blocks minutes on LLM chunking.
         maxPasses: 20, // safety stopper; drainSessionCycle1 also self-stops on no-progress
         cycleArgs: {
           min_batch: 1,
@@ -1912,7 +1854,7 @@ async function _drainSessionForRecallQuery(sessionId, signal) {
           batch_size: RECALL_DRAIN_HARD_CAP_ROWS,
           rows_per_session: RECALL_DRAIN_HARD_CAP_ROWS,
           window_size: 20,
-          concurrency: 4,
+          concurrency: 5,
         },
       })
     } catch (err) {
@@ -1928,23 +1870,46 @@ async function _drainSessionForRecallQuery(sessionId, signal) {
   }
 }
 
+// Bare-browse drain deadline: best-effort only. A browse call ("show me
+// recent context") must never block on LLM chunking for minutes the way a
+// query recall is allowed to — the raw-row merge already covers unchunked
+// content, so the drain here is a nice-to-have upgrade to chunked/scored
+// rows, not a correctness requirement. Failures/timeouts are silently
+// tolerated; the raw fallback in the caller applies regardless.
+const RECALL_BROWSE_DRAIN_DEADLINE_MS = 1800
+
 async function handleSearch(args, signal) {
   // Cooperative abort check: throw early if the caller already aborted
   // (IPC cancel handler signals the AbortController before re-entry).
   if (signal?.aborted) throw signal.reason ?? new Error('aborted')
   // Drain this session's unchunked backlog to zero BEFORE searching, so a
-  // query recall never returns raw/unclassified transcript tail instead of
-  // the chunked summary. Only runs when both a session and a query are
-  // present; a bare recent-browsing call (no query) skips this entirely.
+  // recall never returns raw/unclassified transcript tail instead of the
+  // chunked summary. Runs whenever a session is scoped, query or not — a
+  // bare "show recent" browse hits raw unchunked rows just as often as a
+  // query recall does. Query path keeps the unbounded (deadlineMs:0) drain
+  // since chunked accuracy matters more than latency there; bare browse
+  // gets a short best-effort deadline — it must never block on LLM
+  // chunking for minutes, the raw-row merge covers the fallback either way.
   {
     const _drainSessionId = String(args?.sessionId || args?.session_id || '').trim()
     const _drainHasQuery = Array.isArray(args?.query)
       ? args.query.some((v) => String(v || '').trim())
       : String(args?.query ?? '').trim() !== ''
-    if (_drainSessionId && _drainHasQuery) {
-      await _drainSessionForRecallQuery(_drainSessionId, signal)
+    if (_drainSessionId) {
+      await _drainSessionForRecallQuery(
+        _drainSessionId,
+        signal,
+        _drainHasQuery ? 0 : RECALL_BROWSE_DRAIN_DEADLINE_MS,
+      )
     }
   }
+  // #id lookup normalization: search_memories and memory action:'search'
+  // callers pass a single `id` (or an id array under that same key), not
+  // the `ids` array below. Normalize once here so every dispatch path gets
+  // exact-id lookup, not just callers who already knew to use `ids`.
+  if (!Array.isArray(args.ids) && args.id != null) {
+    args = { ...args, ids: Array.isArray(args.id) ? args.id : [args.id] }
+  }
   if (args?.currentSession === true || args?.sessionId || args?.session_id) {
     return await recallSessionRows(args)
   }
@@ -1956,7 +1921,7 @@ async function handleSearch(args, signal) {
   if (Array.isArray(args.ids) && args.ids.length > 0) {
     const ids = args.ids
       .map(v => Number(v))
-      .filter(v => Number.isFinite(v) && v > 0)
+      .filter(v => Number.isInteger(v) && v > 0)
     if (ids.length === 0) return { text: '(no valid ids)' }
     const includeArchived = args.includeArchived !== false
     const category = args.category
@@ -2096,7 +2061,15 @@ async function handleSearch(args, signal) {
     offset = Math.min(RECALL_OFFSET_CAP, offset)
   }
   const recallCapPrefix = recallCapNotes.length ? `${recallCapNotes.join('; ')}\n` : ''
-  const sort = args.sort != null ? String(args.sort) : 'importance'
+  // Recent-browsing default: a query-less recall is a "show me the latest
+  // messages" browse, not a relevance search — chronological order is the
+  // only ordering that makes sense there, so sort defaults to 'date' when
+  // no query is present (explicit args.sort still wins). Query recalls keep
+  // the importance default.
+  const hasQueryForSort = Array.isArray(args.query)
+    ? args.query.some((v) => String(v || '').trim())
+    : String(args.query ?? '').trim() !== ''
+  const sort = args.sort != null ? String(args.sort) : (hasQueryForSort ? 'importance' : 'date')
   // Chunk content is the primary recall output. Members default to true so
   // callers receive the raw chunk leaves (the cycle1-produced semantic
   // chunks) rather than just the root's cycle2-compressed summary line.
@@ -2260,7 +2233,16 @@ async function handleSearch(args, signal) {
 
   const filters = { limit: limit + offset }
   if (temporal?.startMs != null) { filters.ts_from = temporal.startMs; filters.ts_to = temporal.endMs }
-  if (temporal?.mode === 'last' && _bootTimestamp) {
+  // period='last' used to hard-cap ts_to at _bootTimestamp-1 unconditionally,
+  // which silently hid the CURRENT session's own content from a query-less
+  // recent browse (the whole point of "what did we just talk about"). Keep
+  // the boot cap only for session-less global browsing, where 'last' means
+  // "the previously completed session" and there's no session-scoped drain
+  // above to have already surfaced the in-flight rows. When a sessionId is
+  // present the drain above already pulled that session's raw backlog to
+  // zero, so the current session's rows are safe (and wanted) to include.
+  const _hasScopedSession = Boolean(String(args?.sessionId || args?.session_id || '').trim())
+  if (temporal?.mode === 'last' && _bootTimestamp && !_hasScopedSession) {
     filters.ts_to = _bootTimestamp - 1
   }
   filters.projectScope = projectScope
@@ -2269,55 +2251,33 @@ async function handleSearch(args, signal) {
   if (!includeArchived) filters.excludeStatuses = ['archived']
   if (includeMembers) filters.includeMembers = true
   const rows = await retrieveEntries(db, filters)
-  const sliced = rows.slice(offset, offset + limit)
-  return { text: recallCapPrefix + renderEntryLines(sliced) }
-}
-
-function renderEntryLines(rows) {
-  if (!rows || rows.length === 0) return '(no results)'
-  const lines = []
-  // Bound total emitted lines (roots x members) so a many-member recall can't
-  // inject unbounded output. Per-line content is already capped at 1000 chars;
-  // this caps the line COUNT. Narrow the query (limit/period/projectScope) for more.
-  const RECALL_LINE_CAP = 200
-  let _capped = false
-  outer:
-  for (const r of rows) {
-    const hasMembers = Array.isArray(r.members) && r.members.length > 0
-    if (hasMembers) {
-      // Chunks present: emit each member as its own line. Root row is a
-      // grouping artifact for retrieval — the caller wants the chunk
-      // content (cycle1 raw), not the cycle2-compressed summary.
-      for (const m of r.members) {
-        if (lines.length >= RECALL_LINE_CAP) { _capped = true; break outer }
-        const mTs = formatTs(m.ts)
-        const role = m.role === 'user' ? 'u' : m.role === 'assistant' ? 'a' : (m.role || '?')
-        const content = cleanMemoryText(String(m.content ?? '')).slice(0, 1000)
-        lines.push(`[${mTs}] ${role}: ${content} #${m.id}`)
-      }
-    } else {
-      if (lines.length >= RECALL_LINE_CAP) { _capped = true; break }
-      // No chunks (root not yet chunked by cycle1, or orphan leaf): emit
-      // the row itself in the same shape. element/summary fall back to
-      // raw content when both are absent.
-      const ts = formatTs(r.ts)
-      const element = r.element ?? ''
-      const summary = r.summary ?? ''
-      // Standalone leaf rows (is_root=0, no parent chunks_root resolved
-      // into a `members` list) carry their u/a role just like inline
-      // chunk members — surface it so the format stays consistent across
-      // the two emission paths.
-      const rolePrefix = r.is_root === 0 && r.role
-        ? (r.role === 'user' ? 'u: ' : r.role === 'assistant' ? 'a: ' : `${r.role}: `)
-        : ''
-      const body = element || summary
-        ? `${element}${summary ? ' — ' + summary : ''}`
-        : cleanMemoryText(String(r.content ?? '')).slice(0, 1000)
-      lines.push(`[${ts}] ${rolePrefix}${body.slice(0, 1000)} #${r.id}`)
+  // Recent-browsing raw merge: a query-less recall must show the freshest
+  // turns even when cycle1 hasn't chunked them yet. Roots lag ingest by up
+  // to a cycle interval, so on sort=date pull the raw (unchunked) window
+  // too and merge chronologically — original text first, no summaries.
+  // Query-less + includeRaw:false callers keep the roots-only view.
+  let merged = rows
+  if (sort === 'date' && args.includeRaw !== false) {
+    const rawRows = await readRawRowsInWindow(
+      db,
+      temporal?.startMs ?? null,
+      temporal?.endMs ?? (filters.ts_to ?? Date.now()),
+      Math.min(500, Math.max(20, limit + offset)),
+      { projectScope },
+    )
+    const seenIds = new Set(rows.map(r => Number(r.id)))
+    // Drop raw leaves already inlined as some returned root's member.
+    for (const r of rows) {
+      if (Array.isArray(r.members)) for (const m of r.members) seenIds.add(Number(m.id))
+    }
+    const newRaw = rawRows.filter(r => !seenIds.has(Number(r.id)))
+    if (newRaw.length > 0) {
+      merged = [...rows, ...newRaw]
+      merged.sort((a, b) => (Number(b.ts) || 0) - (Number(a.ts) || 0) || (Number(b.id) || 0) - (Number(a.id) || 0))
     }
   }
-  if (_capped) lines.push(`[recall truncated — showing first ${RECALL_LINE_CAP} lines; narrow the query (limit/period/projectScope) for the rest]`)
-  return lines.join('\n')
+  const sliced = merged.slice(offset, offset + limit)
+  return { text: recallCapPrefix + renderEntryLines(sliced) }
 }
 
 async function dumpSessionRootChunks(args = {}) {
@@ -2951,11 +2911,57 @@ async function handleMemoryAction(args, signal) {
 
   if (action === 'core') {
     const op = String(args.op ?? '').trim().toLowerCase()
-    if (!['add', 'edit', 'delete', 'list'].includes(op)) {
-      return { text: 'core requires op: "add" | "edit" | "delete" | "list"', isError: true }
+    if (!['add', 'edit', 'delete', 'list', 'candidates', 'promote', 'dismiss'].includes(op)) {
+      return { text: 'core requires op: "add" | "edit" | "delete" | "list" | "candidates" | "promote" | "dismiss"', isError: true }
     }
     const dataDir = (typeof DATA_DIR === 'string' ? DATA_DIR : resolvePluginData())
     if (!dataDir) return { text: 'core: memory data dir is not initialized', isError: true }
+    // Core-candidate promotion pipeline (proposal mode). The candidate flag
+    // lives on generated `entries`, which carry a project_id, so these ops MUST
+    // be project-scoped just like add/edit/delete — an unscoped listing/promote
+    // would leak candidates across projects. project_id resolution mirrors the
+    // block below: 'common'/null → COMMON (project_id NULL), '*' → all pools
+    // (candidates op only, same escape hatch as op:'list'). UI calls exactly
+    // these op names.
+    if (op === 'candidates' || op === 'promote' || op === 'dismiss') {
+      const hasPid = Object.prototype.hasOwnProperty.call(args, 'project_id')
+      const scope = (() => {
+        if (!hasPid || args.project_id == null) return null
+        const s = String(args.project_id).trim()
+        if (s === '' || s.toLowerCase() === 'common') return null
+        if (s === '*') return '*'
+        return s
+      })()
+      try {
+        if (op === 'candidates') {
+          const list = await listCoreCandidates(dataDir, scope)
+          if (list.length === 0) return { text: 'core candidates: none' }
+          return {
+            text: list.map(c =>
+              // project=<pool> lets the UI thread project_id into the follow-up
+              // promote/dismiss call — matters under project_id:'*' listing where
+              // rows span pools. Uses the same COMMON/slug convention as op:'list'.
+              `id=${c.id} project=${c.project_id == null ? 'COMMON' : c.project_id} [${c.category}] score=${c.score == null ? '-' : c.score.toFixed(2)} ${c.element} — ${String(c.summary || '').slice(0, 200)} (${c.reason})`,
+            ).join('\n'),
+          }
+        }
+        // promote/dismiss operate on a single id but are scope-guarded: the
+        // candidate must belong to the resolved scope (or COMMON), never '*'.
+        if (scope === '*') {
+          return { text: `core ${op}: project_id "*" only valid for op="candidates"`, isError: true }
+        }
+        if (op === 'promote') {
+          const entry = await promoteCoreCandidate(dataDir, args.id, { ...args, scope })
+          const mergeNote = entry.merged_with ? ` (merged into core id=${entry.merged_with}, sim=${entry.sim})` : ''
+          return { text: `core promoted candidate id=${args.id} → core id=${entry.id}${mergeNote}: [${entry.category}] ${entry.element}` }
+        }
+        // dismiss
+        const removed = await dismissCoreCandidate(dataDir, args.id, { scope })
+        return { text: `core candidate dismissed (id=${removed.id}): [${removed.category}] ${removed.element}` }
+      } catch (e) {
+        return { text: `core ${op} failed: ${e.message}`, isError: true }
+      }
+    }
     // Local trim helper — the manage-block trimOrNull at :1807 is scoped to
     // that branch and unreachable from here.
     // Normalize project_id: 'common' (case-insensitive) or null → null (COMMON pool); non-empty string → slug.
@@ -3222,37 +3228,6 @@ function createHttpMcpServer() {
   return s
 }
 
-function readBody(req) {
-  return new Promise((resolve, reject) => {
-    const chunks = []
-    req.on('data', c => chunks.push(c))
-    req.on('end', () => {
-      const raw = Buffer.concat(chunks).toString('utf8').trim()
-      if (!raw) { resolve({}); return }
-      try { resolve(JSON.parse(raw)) }
-      catch (error) {
-        const e = new Error(`invalid JSON body: ${error.message}`)
-        e.statusCode = 400
-        reject(e)
-      }
-    })
-    req.on('error', reject)
-  })
-}
-
-function sendJson(res, data, status = 200) {
-  const body = JSON.stringify(data)
-  res.writeHead(status, {
-    'Content-Type': 'application/json; charset=utf-8',
-    'Content-Length': Buffer.byteLength(body),
-  })
-  res.end(body)
-}
-
-function sendError(res, msg, status = 500) {
-  sendJson(res, { error: msg }, status)
-}
-
 async function awaitRuntimeReadyForHttp(res) {
   if (_initialized) return true
   if (!_initPromise) {
@@ -3268,29 +3243,6 @@ async function awaitRuntimeReadyForHttp(res) {
   }
 }
 
-// Origin/Referer guard for /admin/* mutation routes. Memory-service binds
-// 127.0.0.1, but browser DNS-rebinding or a stray cross-origin fetch could
-// still reach destructive endpoints (purge, backfill, entry mutations).
-// Server-to-server callers (setup-server, hooks) issue raw http.request
-// without a browser Origin/Referer, so absent headers pass; any non-loopback
-// Origin/Referer is rejected. Mirrors setup-server.mjs isAllowedOrigin.
-function isLocalOrigin(req) {
-  const LOOP = /^https?:\/\/(localhost|127\.0\.0\.1|\[::1\])(:\d+)?(\/|$)/i
-  const origin = req.headers.origin || ''
-  const referer = req.headers.referer || ''
-  if (origin && !LOOP.test(origin)) return false
-  if (referer && !LOOP.test(referer)) return false
-  return true
-}
-
-function normalizeCoreProjectId(value, { allowStar = false } = {}) {
-  if (value == null) return null
-  const s = String(value).trim()
-  if (!s || s.toLowerCase() === 'common') return null
-  if (allowStar && s === '*') return '*'
-  return s
-}
-
 async function buildSessionCoreMemoryPayload(cwd) {
   const projectId = resolveProjectScope(typeof cwd === 'string' && cwd ? cwd : null)
   const generatedScopeClause = projectId !== null
@@ -3373,6 +3325,9 @@ const httpServer = http.createServer(async (req, res) => {
         active_core_summaries: stats.active_core_summaries,
         active_core_summary_missing: stats.active_core_summary_missing,
         mv_hot_active_populated: stats.mv_hot_active_populated,
+        cycle_running: _cycleRunning,
+        cycle_health: _cycleHealth,
+        cycle_backlog: _cycleBacklogSnapshot,
       })
     } catch (e) { sendError(res, e.message) }
     return