mixdog 0.9.2 → 0.9.3

package/src/runtime/memory/lib/core-memory-store.mjs

@@ -333,4 +333,354 @@ export async function deleteCore(dataDir, id) {
   const r = await db.query(`DELETE FROM core_entries WHERE id = $1 RETURNING *`, [numId])
   if (r.rows.length === 0) throw new Error(`no entry with id=${numId}`)
   return r.rows[0]
-}
+}
+
+// ─── Core-candidate promotion pipeline (proposal mode) ───────────────────────
+//
+// nominateCoreCandidates flags strong active entries as core-memory
+// candidates. NEVER auto-inserts into core_entries — a user approves each via
+// listCoreCandidates → promoteCoreCandidate. Durable-signal driven:
+//   - category grade: only durable knowledge types (rule/constraint/decision/
+//     preference/goal/fact) — transient task/issue never nominated.
+//   - score >= CANDIDATE_MIN_SCORE: survived age-decay / repeated gate reviews.
+//   - reviewed_at survival: entry has been through >= 1 gate review (reviewed_at
+//     set) so freshly-promoted noise is excluded.
+//   - core_overlap skip: entries whose embedding sits near an existing
+//     core_entries row (sim >= CANDIDATE_OVERLAP_SIM) are already covered by a
+//     user rule — skip to avoid duplicate promotion. Reuses the same cosine
+//     recall shape as cycle2 phase_merge core_overlap.
+// Terminal states ('promoted'/'dismissed') are never re-nominated. Caps at
+// CANDIDATE_CAP total live candidates.
+
+const CANDIDATE_CAP = 10
+// Durable categories worth surfacing for user-curated core memory. Mirrors the
+// high end of CATEGORY_GRADE (memory-score.mjs) — task/issue excluded.
+const CANDIDATE_CATEGORIES = new Set(['rule', 'constraint', 'decision', 'preference', 'goal', 'fact'])
+// Score floor: preference grade is 1.4, fact 1.6 — require the entry to still
+// be near its grade ceiling (i.e. survived decay), not a stale low-score root.
+const CANDIDATE_MIN_SCORE = 1.3
+// Embedding sim at/above which the active entry is considered already covered
+// by an existing core row → skip nomination. Matches cycle2 TIER1_THRESHOLD.
+const CANDIDATE_OVERLAP_SIM = 0.78
+// A promote left mid-flight ('promoting') longer than this is treated as a
+// crashed promotion and reverted to a live candidate by recoverStalePromotions.
+// Worst-case addCore duration bounds this: it runs up to CORE_DEDUP_TOP_K (5)
+// sequential LLM merge-judge calls at 30s timeout each (~150s) plus embedding
+// generation — call it ~3min worst case. 15min gives >5x margin so a slow-but-
+// live promote is never mistaken for a crash, while still recovering a genuine
+// crash within one hourly cycle2 pass. The finalize path ALSO tolerates a
+// racing recovery (rowCount=0 → re-claim, see promoteCoreCandidate) so an
+// over-tight cutoff can't corrupt state — this margin is defense-in-depth.
+const PROMOTING_STALE_MS = 15 * 60_000
+
+function _candidateReason(row) {
+  return `${row.category} grade, score ${Number(row.score).toFixed(2)}, survived gate review`
+}
+
+// Post-gate nomination pass. Cheap: one scan over durable high-score active
+// roots not already candidate/promoted/dismissed, one core-overlap cosine
+// probe per row, capped at CANDIDATE_CAP net-new. Returns count nominated.
+export async function nominateCoreCandidates(dataDir, options = {}) {
+  const signal = options?.signal
+  const db = _getDb(dataDir)
+  throwIfAborted(signal)
+  // Recover crashed promotions first: a root stuck in 'promoting' past
+  // PROMOTING_STALE_MS (claim tx committed but the process died before finalize)
+  // is reverted to a live candidate here, so it re-enters the pool below.
+  try {
+    await recoverStalePromotions(dataDir, { signal })
+    throwIfAborted(signal)
+  } catch (err) {
+    if (signal?.aborted) throw signal.reason ?? err
+    __mixdogMemoryLog(`[core-memory] stale-promotion recovery failed: ${err.message}\n`)
+  }
+  // Live candidate headroom: never exceed CANDIDATE_CAP total pending. Count
+  // only ACTIVE candidate roots — a candidate archived by cycle2 core_overlap
+  // between nomination and now must not eat headroom (it is also excluded from
+  // listCoreCandidates by the same status='active' guard).
+  const liveRes = await db.query(
+    `SELECT COUNT(*)::int AS n FROM entries WHERE is_root = 1 AND status = 'active' AND core_candidate_status = 'candidate'`,
+  )
+  const live = Number(liveRes.rows[0]?.n ?? 0)
+  const headroom = CANDIDATE_CAP - live
+  if (headroom <= 0) return 0
+
+  // Pull the strongest eligible roots that have never been nominated (status
+  // NULL) and have been through a gate review (reviewed_at set). Terminal
+  // 'promoted'/'dismissed' rows are excluded by the NULL predicate.
+  const cats = [...CANDIDATE_CATEGORIES]
+  const eligibleRes = await db.query(
+    `SELECT id, element, summary, category, score, project_id,
+            (embedding IS NOT NULL) AS has_embedding
+     FROM entries
+     WHERE is_root = 1 AND status = 'active'
+       AND core_candidate_status IS NULL
+       AND reviewed_at IS NOT NULL
+       AND category = ANY($1::text[])
+       AND score >= $2
+     ORDER BY score DESC, last_seen_at DESC, id ASC
+     LIMIT $3`,
+    [cats, CANDIDATE_MIN_SCORE, headroom * 3],
+  )
+  throwIfAborted(signal)
+
+  const now = Date.now()
+  let nominated = 0
+  for (const row of eligibleRes.rows) {
+    throwIfAborted(signal)
+    if (nominated >= headroom) break
+    // core_overlap skip: is this entry already covered by an existing core row?
+    // Compute similarity fully in SQL against the entry's own embedding
+    // (referenced by id) so no halfvec value round-trips through JS — mirrors
+    // the cycle2 phase_merge core_overlap probe shape. Same-pool + COMMON core
+    // are eligible matches.
+    if (row.has_embedding) {
+      const ov = await db.query(
+        `SELECT 1 - (e.embedding <=> c.embedding) AS sim
+         FROM entries e
+         CROSS JOIN LATERAL (
+           SELECT inner_c.embedding
+           FROM core_entries inner_c
+           WHERE inner_c.embedding IS NOT NULL
+             AND (inner_c.project_id IS NULL OR inner_c.project_id IS NOT DISTINCT FROM e.project_id)
+           ORDER BY inner_c.embedding <=> e.embedding
+           LIMIT 1
+         ) c
+         WHERE e.id = $1 AND e.embedding IS NOT NULL`,
+        [Number(row.id)],
+      )
+      throwIfAborted(signal)
+      if (ov.rows.length > 0 && Number(ov.rows[0].sim) >= CANDIDATE_OVERLAP_SIM) continue
+    }
+    const r = await db.query(
+      `UPDATE entries SET core_candidate_status = 'candidate', core_candidate_at = $1
+       WHERE id = $2 AND is_root = 1 AND core_candidate_status IS NULL`,
+      [now, Number(row.id)],
+    )
+    if (Number(r.rowCount ?? r.affectedRows ?? 0) > 0) nominated++
+  }
+  if (nominated > 0) {
+    __mixdogMemoryLog(`[core-memory] nominated ${nominated} core candidate(s)\n`)
+  }
+  return nominated
+}
+
+// List live candidates for the UI. Shape matches the deliver spec:
+// {id, element, summary, category, score, reason}.
+// `scope`: null → COMMON pool only (project_id NULL); '*' → all pools;
+// slug → that project's pool + COMMON. Mirrors the add/edit/delete + list
+// project isolation so an unscoped call can't leak another project's
+// candidates. status='active' guard: a candidate root archived by cycle2
+// core_overlap between nomination and listing must NOT stay listed (it also
+// no longer counts against CANDIDATE_CAP — see nominateCoreCandidates).
+export async function listCoreCandidates(dataDir, scope = null) {
+  const db = _getDb(dataDir)
+  let scopeClause = ''
+  const params = []
+  if (scope === '*') {
+    scopeClause = ''
+  } else if (scope == null) {
+    scopeClause = 'AND project_id IS NULL'
+  } else {
+    scopeClause = 'AND (project_id IS NULL OR project_id = $1)'
+    params.push(scope)
+  }
+  const r = await db.query(
+    `SELECT id, element, summary, category, score, project_id
+     FROM entries
+     WHERE is_root = 1 AND status = 'active' AND core_candidate_status = 'candidate'
+       ${scopeClause}
+     ORDER BY score DESC, core_candidate_at DESC, id ASC`,
+    params,
+  )
+  return r.rows.map(row => ({
+    id: Number(row.id),
+    element: row.element,
+    summary: row.summary,
+    category: row.category,
+    score: row.score == null ? null : Number(row.score),
+    project_id: row.project_id ?? null,
+    reason: _candidateReason(row),
+  }))
+}
+
+// Promote a candidate via a two-phase claim → insert → finalize with a
+// recoverable intermediate state ('promoting'), so a process crash at ANY point
+// is recoverable by the cycle2 recovery sweep (recoverStalePromotions).
+//
+// Phase 1 (claim tx): status='archived', core_candidate_status='promoting'.
+//   The embedding is NOT nulled here — deferred to finalize — so recovery can
+//   restore the row to active WITHOUT needing to re-embed. Archived-with-
+//   embedding for the brief promoting window is harmless: the recall scope
+//   filter excludes BOTH 'promoted' AND 'promoting' rows (and their members).
+// Phase 2: addCore (its own tx — advisory locks can't join an outer tx).
+// Phase 3 (finalize tx): core_candidate_status='promoted', embedding=NULL.
+//
+// Crash matrix:
+//   - crash after phase 1, before addCore commits → row is archived+'promoting'
+//     with NO core row → recovery sweep (stale > PROMOTING_STALE_MS) reverts it
+//     to active+'candidate' (embedding intact) → clean retry.
+//   - addCore threw → synchronous compensation reverts immediately (same shape).
+//   - crash after addCore commits, before finalize → core row exists + row is
+//     'promoting' → recovery reverts the ROOT to candidate, but the core row now
+//     exists, so the retry's addCore merge-judge/unique-index folds back into the
+//     same core row (element unchanged) → converges (no duplicate).  This is the
+//     one window where a retry relies on addCore dedup, but it is bounded and
+//     self-healing rather than a permanent orphan+stuck-root.
+//   - finalize committed → terminal 'promoted', embedding NULL → done.
+//
+// `scope` (from the index handler) enforces project isolation: the candidate
+// must belong to the resolved scope or COMMON — never another project's pool.
+export async function promoteCoreCandidate(dataDir, id, options = {}) {
+  const numId = Number(id)
+  if (!Number.isInteger(numId) || numId <= 0) throw new Error('integer id > 0 required')
+  const db = _getDb(dataDir)
+  // Require BOTH active status and a live candidate flag (finding #2): a stale
+  // archived/merged root must not be promotable by direct id.
+  const cur = (await db.query(
+    `SELECT id, element, summary, category, project_id, core_candidate_status
+     FROM entries WHERE id = $1 AND is_root = 1 AND status = 'active'`,
+    [numId],
+  )).rows[0]
+  if (!cur) throw new Error(`no active root entry with id=${numId} (already archived, merged, or deleted)`)
+  if (cur.core_candidate_status !== 'candidate') {
+    throw new Error(`entry id=${numId} is not a live core candidate (status=${cur.core_candidate_status ?? 'none'})`)
+  }
+  // Project-scope guard: reject cross-project promotion. scope null == COMMON;
+  // a scoped candidate is only promotable within its own pool (or if it is a
+  // COMMON candidate). Mirrors add/edit/delete project isolation.
+  const scope = options?.scope ?? null
+  const rowPid = cur.project_id ?? null
+  if (rowPid != null && rowPid !== scope) {
+    throw new Error(`candidate id=${numId} belongs to project "${rowPid}", not the resolved scope "${scope ?? 'common'}"`)
+  }
+  // Core summary cap: candidate summaries may exceed CORE_SUMMARY_MAX. Prefer
+  // the explicit override, else compress by truncation so addCore accepts it.
+  const summary = options?.summary ?? cur.summary
+  const cappedSummary = summary && String(summary).length > CORE_SUMMARY_MAX
+    ? String(summary).slice(0, CORE_SUMMARY_MAX)
+    : summary
+  const now = Date.now()
+  // Phase 1 — claim (active+candidate guarded so a concurrent archive/promote
+  // loses the race → 0 rows → nothing to promote). Embedding NOT nulled here
+  // (deferred to finalize) so recovery needs no re-embed.
+  const claim = await db.transaction(async (tx) => {
+    const r = await tx.query(
+      `UPDATE entries SET core_candidate_status = 'promoting', core_candidate_at = $1, status = 'archived'
+       WHERE id = $2 AND is_root = 1 AND status = 'active' AND core_candidate_status = 'candidate'`,
+      [now, numId],
+    )
+    return Number(r.rowCount ?? r.affectedRows ?? 0)
+  })
+  if (claim === 0) {
+    throw new Error(`candidate id=${numId} was concurrently promoted/archived — nothing to do`)
+  }
+  // Phase 2 — insert into core_entries. addCore's own tx commits independently.
+  let entry
+  try {
+    entry = await addCore(
+      dataDir,
+      { element: cur.element, summary: cappedSummary, category: cur.category },
+      rowPid,
+    )
+  } catch (err) {
+    // Synchronous compensation: revert the 'promoting' claim to the live-
+    // candidate state so a retry is clean and no core row was created. Embedding
+    // is intact (never nulled), so no re-embed needed.
+    try {
+      await db.transaction(async (tx) => {
+        await tx.query(
+          `UPDATE entries SET core_candidate_status = 'candidate', core_candidate_at = $1, status = 'active'
+           WHERE id = $2 AND is_root = 1 AND core_candidate_status = 'promoting' AND status = 'archived'`,
+          [Date.now(), numId],
+        )
+      })
+    } catch (compErr) {
+      __mixdogMemoryLog(`[core-memory] promote compensation failed id=${numId}: ${compErr.message} (root left 'promoting' — recovery sweep will revert)\n`)
+    }
+    throw err
+  }
+  // Phase 3 — finalize: terminal 'promoted' + null the embedding (now safe: the
+  // core row is committed, so nulling can't strand a recoverable row without its
+  // fact). Guarded on 'promoting'. If a racing recoverStalePromotions (slow
+  // addCore that overran PROMOTING_STALE_MS) already reverted the row to
+  // 'candidate'+active, this affects 0 rows — but the core row IS committed, so
+  // we must NOT return success while the root is still a live candidate (user
+  // would see success + the candidate re-listed). Re-claim from the recovered
+  // 'candidate' state (finding #2). If THAT also affects 0 rows, another actor
+  // changed the row (genuine re-promote, dismiss, archive) — don't clobber;
+  // log and still return the entry (the core row exists either way).
+  const finalize = await db.transaction(async (tx) => {
+    const r1 = await tx.query(
+      `UPDATE entries SET core_candidate_status = 'promoted', core_candidate_at = $1, embedding = NULL
+       WHERE id = $2 AND is_root = 1 AND core_candidate_status = 'promoting'`,
+      [Date.now(), numId],
+    )
+    if (Number(r1.rowCount ?? r1.affectedRows ?? 0) > 0) return 'finalized'
+    // Row was recovered back to candidate mid-flight — re-claim it (core row
+    // already committed). Guard on the exact recovery state (active+candidate).
+    const r2 = await tx.query(
+      `UPDATE entries SET core_candidate_status = 'promoted', core_candidate_at = $1, status = 'archived', embedding = NULL
+       WHERE id = $2 AND is_root = 1 AND status = 'active' AND core_candidate_status = 'candidate'`,
+      [Date.now(), numId],
+    )
+    return Number(r2.rowCount ?? r2.affectedRows ?? 0) > 0 ? 'reclaimed' : 'unchanged'
+  })
+  if (finalize === 'reclaimed') {
+    __mixdogMemoryLog(`[core-memory] promote id=${numId} finalized after a racing recovery revert (re-claimed)\n`)
+  } else if (finalize === 'unchanged') {
+    __mixdogMemoryLog(`[core-memory] promote id=${numId}: root changed by another actor before finalize; core row committed, root state left as-is\n`)
+  }
+  return entry
+}
+
+// Recovery sweep for crashed promotions: a root left in 'promoting' (claim tx
+// committed but the process died before finalize) is reverted to the live
+// candidate state (status='active', core_candidate_status='candidate') once it
+// is older than PROMOTING_STALE_MS. Embedding was never nulled in the claim, so
+// no re-embed is required. Runs from nominateCoreCandidates (hourly cycle2).
+// Idempotent: 0 stale rows → fast no-op. Returns count recovered.
+export async function recoverStalePromotions(dataDir, options = {}) {
+  const signal = options?.signal
+  const db = _getDb(dataDir)
+  throwIfAborted(signal)
+  const cutoff = Date.now() - PROMOTING_STALE_MS
+  const r = await db.query(
+    `UPDATE entries SET core_candidate_status = 'candidate', core_candidate_at = $1, status = 'active'
+     WHERE is_root = 1 AND core_candidate_status = 'promoting'
+       AND core_candidate_at IS NOT NULL AND core_candidate_at < $2`,
+    [Date.now(), cutoff],
+  )
+  const n = Number(r.rowCount ?? r.affectedRows ?? 0)
+  if (n > 0) __mixdogMemoryLog(`[core-memory] recovered ${n} stale 'promoting' root(s) → candidate\n`)
+  return n
+}
+
+// Dismiss a candidate: mark terminal so the nomination pass never re-nominates
+// the same root. Leaves status/score untouched — the entry stays active in
+// generated memory, it just won't be re-surfaced as a core candidate.
+// `scope` enforces project isolation (mirrors promote): a scoped caller can
+// only dismiss candidates in its own pool or COMMON.
+export async function dismissCoreCandidate(dataDir, id, options = {}) {
+  const numId = Number(id)
+  if (!Number.isInteger(numId) || numId <= 0) throw new Error('integer id > 0 required')
+  const db = _getDb(dataDir)
+  const scope = options?.scope ?? null
+  const cur = (await db.query(
+    `SELECT project_id, core_candidate_status FROM entries WHERE id = $1 AND is_root = 1`,
+    [numId],
+  )).rows[0]
+  if (!cur) throw new Error(`no root entry with id=${numId}`)
+  const rowPid = cur.project_id ?? null
+  if (rowPid != null && rowPid !== scope) {
+    throw new Error(`candidate id=${numId} belongs to project "${rowPid}", not the resolved scope "${scope ?? 'common'}"`)
+  }
+  const r = await db.query(
+    `UPDATE entries SET core_candidate_status = 'dismissed', core_candidate_at = $1
+     WHERE id = $2 AND is_root = 1 AND core_candidate_status = 'candidate'
+     RETURNING id, element, category`,
+    [Date.now(), numId],
+  )
+  if (r.rows.length === 0) throw new Error(`no live core candidate with id=${numId}`)
+  return r.rows[0]
+}

package/src/runtime/memory/lib/cycle-signatures.mjs

@@ -0,0 +1,34 @@
+// Scheduled-cycle request-signature helpers extracted from index.mjs.
+// Pure functions of the passed `config` object; they call the imported
+// makeCycleRequestSignature and touch no module state (no db/timers).
+// index.mjs imports these; signatures and behavior are unchanged.
+
+import { makeCycleRequestSignature } from './memory-cycle-requests.mjs'
+
+export function scheduledCycle1Signature(config) {
+  return makeCycleRequestSignature('cycle1', config, {
+    preset: undefined,
+    concurrency: undefined,
+    maxConcurrent: undefined,
+  })
+}
+
+export function scheduledCycle2Signature(config) {
+  return makeCycleRequestSignature('cycle2', config, {
+    cascadePreset: undefined,
+    concurrency: undefined,
+  })
+}
+
+export function scheduledCycle3ApplyMode(config) {
+  const raw = String(config?.cycle3?.applyMode || 'conservative').trim().toLowerCase()
+  return (raw === 'proposal' || raw === 'dry-run' || raw === 'dryrun') ? 'proposal' : 'conservative'
+}
+
+export function scheduledCycle3Signature(config) {
+  const retryConfig = config?.cycle3 || config
+  return makeCycleRequestSignature('cycle3', retryConfig, {
+    applyMode: scheduledCycle3ApplyMode(config),
+    apply: undefined,
+  })
+}

package/src/runtime/memory/lib/http-wire.mjs

@@ -0,0 +1,57 @@
+// HTTP wire helpers extracted from index.mjs. All pure request/response
+// utilities with no module state — no db, _traceDb, or timer dependencies.
+// index.mjs imports these; behavior and signatures are unchanged.
+
+export function readBody(req) {
+  return new Promise((resolve, reject) => {
+    const chunks = []
+    req.on('data', c => chunks.push(c))
+    req.on('end', () => {
+      const raw = Buffer.concat(chunks).toString('utf8').trim()
+      if (!raw) { resolve({}); return }
+      try { resolve(JSON.parse(raw)) }
+      catch (error) {
+        const e = new Error(`invalid JSON body: ${error.message}`)
+        e.statusCode = 400
+        reject(e)
+      }
+    })
+    req.on('error', reject)
+  })
+}
+
+export function sendJson(res, data, status = 200) {
+  const body = JSON.stringify(data)
+  res.writeHead(status, {
+    'Content-Type': 'application/json; charset=utf-8',
+    'Content-Length': Buffer.byteLength(body),
+  })
+  res.end(body)
+}
+
+export function sendError(res, msg, status = 500) {
+  sendJson(res, { error: msg }, status)
+}
+
+// Origin/Referer guard for /admin/* mutation routes. Memory-service binds
+// 127.0.0.1, but browser DNS-rebinding or a stray cross-origin fetch could
+// still reach destructive endpoints (purge, backfill, entry mutations).
+// Server-to-server callers (setup-server, hooks) issue raw http.request
+// without a browser Origin/Referer, so absent headers pass; any non-loopback
+// Origin/Referer is rejected. Mirrors setup-server.mjs isAllowedOrigin.
+export function isLocalOrigin(req) {
+  const LOOP = /^https?:\/\/(localhost|127\.0\.0\.1|\[::1\])(:\d+)?(\/|$)/i
+  const origin = req.headers.origin || ''
+  const referer = req.headers.referer || ''
+  if (origin && !LOOP.test(origin)) return false
+  if (referer && !LOOP.test(referer)) return false
+  return true
+}
+
+export function normalizeCoreProjectId(value, { allowStar = false } = {}) {
+  if (value == null) return null
+  const s = String(value).trim()
+  if (!s || s.toLowerCase() === 'common') return null
+  if (allowStar && s === '*') return '*'
+  return s
+}

package/src/runtime/memory/lib/memory-cycle2.mjs

@@ -12,7 +12,7 @@ import { callAgentDispatch } from './agent-ipc.mjs'
 import {
   syncRootEmbedding, deleteRootEmbedding, flushEmbeddingDirty,
 } from './memory-embed.mjs'
-import { listCore, backfillCoreEmbeddings, CORE_SUMMARY_MAX } from './core-memory-store.mjs'
+import { listCore, backfillCoreEmbeddings, nominateCoreCandidates, CORE_SUMMARY_MAX } from './core-memory-store.mjs'
 import { markCycleRequest, consumeCycleRequests, resolveCoalesceMaxDrains, scheduleCoalescedCycleRetry, makeCycleRequestSignature, resolveCoalesceMaxRetries } from './memory-cycle-requests.mjs'
 
 export const CYCLE2_ACTIVE_TARGET_CAP = 100
@@ -490,7 +490,13 @@ export async function runPhaseMerge(db, options = {}) {
     // Archiving one overlap and deleting its embedding is one mutation unit;
     // cancellation resumes at the next row boundary.
     const r = await db.query(
-      `UPDATE entries SET status = 'archived' WHERE id = $1 AND is_root = 1 AND status = 'active'`,
+      // Clear a live core-candidate flag on the same UPDATE: an archived root
+      // must not stay listed as a candidate or keep eating CANDIDATE_CAP. Set
+      // it to 'dismissed' (terminal) since the fact already restates a core row.
+      `UPDATE entries
+       SET status = 'archived',
+           core_candidate_status = CASE WHEN core_candidate_status = 'candidate' THEN 'dismissed' ELSE core_candidate_status END
+       WHERE id = $1 AND is_root = 1 AND status = 'active'`,
       [Number(row.entry_id)],
     )
     if (Number(r.rowCount ?? r.affectedRows ?? 0) > 0) {
@@ -865,6 +871,7 @@ function mergeCycle2Results(a, b) {
     merge_rejected: Number(a.merge_rejected || 0) + Number(b.merge_rejected || 0),
     missing_core_summary: Number(a.missing_core_summary || 0) + Number(b.missing_core_summary || 0),
     core_embedding_backfill: Number(a.core_embedding_backfill || 0) + Number(b.core_embedding_backfill || 0),
+    core_candidates_nominated: Number(a.core_candidates_nominated || 0) + Number(b.core_candidates_nominated || 0),
     rescore: mergeNestedNumeric(a.rescore, b.rescore),
     phase_merge: mergeNestedNumeric(a.phase_merge, b.phase_merge),
     cascade: mergeNestedNumeric(a.cascade, b.cascade),
@@ -1007,6 +1014,7 @@ async function _runCycle2Impl(db, config = {}, options = {}, dataDir = null) {
     merge_rejected: 0,
     missing_core_summary: 0,
     core_embedding_backfill: 0,
+    core_candidates_nominated: 0,
     rescore: { updated: 0 },
     phase_merge: { merged: 0, llm_calls: 0, tier1_pairs: 0, tier2_pairs: 0, core_overlap: 0 },
     cascade: { evaluated: 0, dropped: 0 },
@@ -1360,11 +1368,55 @@ async function _runCycle2Impl(db, config = {}, options = {}, dataDir = null) {
   throwIfAborted(signal)
   stats.phase_merge = phaseMergeStats
 
+  // Core-candidate nomination (proposal mode): flag strong durable active
+  // roots as core-memory candidates for user approval. Runs AFTER phase_merge
+  // so its core_overlap sweep has already archived active entries that restate
+  // an existing core row — nomination never re-surfaces those. NEVER
+  // auto-inserts into core_entries; the user promotes via action:'core'
+  // op:'promote'. Best-effort: a failure here must not fail the cycle.
+  if (dataDir) {
+    try {
+      throwIfAborted(signal)
+      stats.core_candidates_nominated = await nominateCoreCandidates(dataDir, { signal })
+      throwIfAborted(signal)
+    } catch (err) {
+      if (signal?.aborted) throw signal.reason ?? err
+      __mixdogMemoryLog(`[cycle2] core-candidate nomination failed: ${err.message}\n`)
+    }
+  }
+
   // Active-cap enforcement is delegated to the gate (phases 1-3): the prompt
   // exposes Active/cap counts and instructs aggressive `archived` verdicts on
   // overflow. No deterministic safety net here — if the gate ever fails to
   // contain growth, fix the prompt, not bolt a fallback back on.
 
+  // Chronic gate-failure sweep: pending roots that have failed the gate 5+
+  // times AND are 30+ days old will realistically never pass (their content
+  // keeps breaking the parse — 2026-07 drain left 154 such rows cycling as
+  // permanent noop batches). Terminal-archive them (status only, no data
+  // deletion) so they stop occupying gate batches. Same cooldown semantics
+  // as the parse-failure reviewed_at advance above.
+  try {
+    throwIfAborted(signal)
+    const sweepRes = await db.query(
+      `UPDATE entries
+       SET status = 'archived', reviewed_at = $1
+       WHERE is_root = 1 AND status = 'pending'
+         AND COALESCE(error_count, 0) >= 5
+         AND ts < $2
+       RETURNING id`,
+      [Date.now(), Date.now() - 30 * 86_400_000],
+    )
+    const swept = sweepRes?.rows?.length ?? 0
+    if (swept > 0) {
+      stats.chronic_swept = swept
+      __mixdogMemoryLog(`[cycle2] chronic gate-failure sweep archived=${swept}\n`)
+    }
+  } catch (err) {
+    if (signal?.aborted) throw signal.reason ?? err
+    __mixdogMemoryLog(`[cycle2] chronic sweep failed: ${err.message}\n`)
+  }
+
   __mixdogMemoryLog(
     `[cycle2] rescore=${stats.rescore.updated}` +
     ` core_backfill=${stats.core_embedding_backfill}` +
@@ -1375,7 +1427,8 @@ async function _runCycle2Impl(db, config = {}, options = {}, dataDir = null) {
     ` missing_core=${stats.missing_core_summary}` +
     ` | cascade eval=${stats.cascade.evaluated} drop=${stats.cascade.dropped}` +
     ` | phase_merge merged=${stats.phase_merge.merged} core_overlap=${stats.phase_merge.core_overlap || 0}` +
-    ` llm=${stats.phase_merge.llm_calls}\n`,
+    ` llm=${stats.phase_merge.llm_calls}` +
+    ` | core_candidates=${stats.core_candidates_nominated || 0}\n`,
   )
 
   return stats

package/src/runtime/memory/lib/memory-recall-scope-filter.mjs

@@ -18,11 +18,35 @@ export function buildCategoryFilterClause(offset, categories, { tableAlias = ''
   return { clause: `AND (${inner})`, params: [...cats] }
 }
 
+// Shared, param-less predicate excluding promoted/promoting core-candidate
+// roots AND member rows under such a root. Single source of truth so the hybrid
+// recall path (buildRecallScopeFilter) and the query-less browse path
+// (retrieveEntries) can't diverge. tableAlias='' → bare `entries` column refs.
+export function buildPromotedExclusionClauses(tableAlias = '') {
+  const p = `${tableAlias || 'entries'}.`
+  return [
+    // Promoted core-candidate roots have been absorbed into user-curated
+    // core_entries and archived by promoteCoreCandidate. Their content now
+    // lives in the {{USER_CORE}} slot, so surfacing the stale generated root
+    // would double-serve the same fact. 'promoting' (mid-flight or crashed
+    // promote awaiting recovery) is excluded too — its root is already archived
+    // and finalizes to 'promoted'. Member rows whose chunk_root points at a
+    // promoted/promoting root are excluded via EXISTS-on-root (the flag lives
+    // only on the root; members keep NULL). Constant predicates — no bind param.
+    `(${p}core_candidate_status IS NULL OR ${p}core_candidate_status NOT IN ('promoted', 'promoting'))`,
+    `NOT (${p}is_root = 0 AND ${p}chunk_root IS NOT NULL AND ${p}chunk_root <> ${p}id AND EXISTS (
+      SELECT 1 FROM entries r WHERE r.id = ${p}chunk_root AND r.is_root = 1 AND r.core_candidate_status IN ('promoted', 'promoting')
+    ))`,
+  ]
+}
+
 export function buildRecallScopeFilter(offset, options = {}, tableAlias = '') {
   const outerRef = tableAlias || 'entries'
   const p = `${outerRef}.`
   const clauses = [
     `NOT (${p}is_root = 0 AND ${p}chunk_root IS NOT DISTINCT FROM ${p}id AND ${p}status IS NOT DISTINCT FROM 'archived')`,
+    // Exclude promoted/promoting roots + their members (shared predicate).
+    ...buildPromotedExclusionClauses(tableAlias),
   ]
   const params = []
   let next = offset

package/src/runtime/memory/lib/memory-retrievers.mjs

@@ -1,5 +1,7 @@
 import { recallReadQuery } from './memory-recall-read-query.mjs'
 
+import { buildPromotedExclusionClauses } from './memory-recall-scope-filter.mjs'
+
 const VALID_CATEGORIES_SET = new Set([
   'rule', 'constraint', 'decision', 'fact', 'goal', 'preference', 'task', 'issue',
 ])
@@ -72,6 +74,12 @@ export async function retrieveEntries(db, filters = {}) {
     where.push(`chunk_root IS NULL`)
   }
 
+  // Exclude promoted/promoting core-candidate roots AND members under such a
+  // root — the query-less browse path (includeArchived) would otherwise surface
+  // rows the hybrid recall path already filters. Shared predicate (param-less)
+  // keeps this in lock-step with buildRecallScopeFilter.
+  where.push(...buildPromotedExclusionClauses())
+
   const limit = Math.max(1, Math.min(500, Number(filters.limit ?? 50)))
   const offset = Math.max(0, Number(filters.offset ?? 0))
   const sort = String(filters.sort ?? 'importance').trim().toLowerCase()

package/src/runtime/memory/lib/memory.mjs

@@ -443,6 +443,26 @@ export async function ensureCurrentSchemaExtensions(db, dims) {
 
 
 
+  // Core-candidate promotion pipeline (proposal mode): active entries the
+  // cycle2 nomination pass flags as strong core-memory candidates. Never
+  // auto-inserted into core_entries — a user approves each via the
+  // action:'core' op:'promote' handler. Columns are nullable and the ALTERs
+  // are idempotent (ADD COLUMN IF NOT EXISTS), safe to re-run every boot.
+  //   core_candidate_status: NULL (not a candidate) | 'candidate' | 'promoting'
+  //     (mid-flight promote, recoverable) | 'promoted' | 'dismissed'
+  //   core_candidate_at:     ms timestamp of last nomination/state change
+  // 'dismissed'/'promoted' are terminal for a given root so the pass never
+  // re-nominates the same entry.
+  await db.exec(`ALTER TABLE entries ADD COLUMN IF NOT EXISTS core_candidate_status text`)
+  await db.exec(`ALTER TABLE entries ADD COLUMN IF NOT EXISTS core_candidate_at bigint`)
+  // No index on core_candidate_status by design (round-2 finding #4): the only
+  // readers are listCoreCandidates (user picker, on-demand) and
+  // nominateCoreCandidates (once per cycle2, hourly). Both are rare and the
+  // entries table is small enough that a seq scan is fine — an index isn't
+  // worth the boot-time AccessExclusive build lock on the hot entries table.
+  // Drop it if a previous deploy created it (idempotent no-op otherwise).
+  await db.exec(`DROP INDEX IF EXISTS idx_entries_core_candidate`)
+
   // Dedupe core_entries before creating the unique index — keeps the row with
   // the most recent updated_at (id breaks ties), drops the rest.
   const dedupe = await db.query(`