moflo 4.12.11 → 4.13.0

package/dist/src/cli/memory/daemon-backend.js

@@ -165,6 +165,150 @@ function wrapStatement(stmt) {
  * both the daemon adapter and a bin/ writer on the same path only logs once.
  */
 const _networkFsWarnedPaths = new Set();
+/**
+ * Shared parking buffer for the journal-mode retry sleep. `Atomics.wait` is
+ * the only synchronous sleep that works identically on Linux, macOS and
+ * Windows without shelling out (Rule #1) — and this open path is synchronous,
+ * so there is no `await` to hand the thread back with.
+ */
+const WAL_SLEEP_BUF = new Int32Array(new SharedArrayBuffer(4));
+function sleepMs(ms) {
+    Atomics.wait(WAL_SLEEP_BUF, 0, 0, ms);
+}
+/**
+ * The open-path `busy_timeout`. Named because two places depend on it being
+ * the same number: the pragma below sets it, and `readJournalModeBounded`
+ * restores it after narrowing it for a probe.
+ */
+const OPEN_BUSY_TIMEOUT_MS = 15_000;
+/**
+ * Budget for the post-exhaustion probe. The query form of `PRAGMA
+ * journal_mode` takes a SHARED lock and IS covered by the busy handler, so it
+ * would otherwise inherit the full `OPEN_BUSY_TIMEOUT_MS` — doubling the
+ * worst case to ~30s before we report anything on the one path where we have
+ * already decided to give up. A few short attempts distinguish "genuinely not
+ * WAL" from "probe lost one more race" without reopening that window.
+ */
+const WAL_PROBE_BUSY_TIMEOUT_MS = 500;
+const WAL_PROBE_ATTEMPTS = 3;
+/**
+ * Total time `setWalWithRetry` will spend losing the conversion race before it
+ * gives up. Matched to `busy_timeout` (15000ms) on purpose: the two cover the
+ * same worst case — a background indexer holding a write lock through its
+ * whole first full-tree pass — and diverging budgets would mean the pragma
+ * that needs the wait most gets the shortest one. Being wrong-high costs one
+ * slow open in a rare race; being wrong-low kills the process outright.
+ */
+const WAL_RETRY_BUDGET_MS = OPEN_BUSY_TIMEOUT_MS;
+/** Backoff bounds: start tight (most races clear in a few ms), cap so a long
+ *  hold is still polled often enough to return promptly once it releases. */
+const WAL_RETRY_MIN_DELAY_MS = 5;
+const WAL_RETRY_MAX_DELAY_MS = 250;
+/**
+ * SQLITE_BUSY (5) and SQLITE_LOCKED (6) — the two contention codes. The
+ * message test is a fallback for wrappers that don't propagate `errcode`.
+ */
+function isBusyError(err) {
+    const e = err;
+    if (e?.errcode === 5 || e?.errcode === 6)
+        return true;
+    return /database( table)? is locked/i.test(String(e?.message ?? ''));
+}
+/** Current journal mode, lowercased. `''` when the probe itself fails. */
+function readJournalMode(db) {
+    try {
+        const row = db.prepare('PRAGMA journal_mode').get();
+        return String(row?.journal_mode ?? '').toLowerCase();
+    }
+    catch {
+        return '';
+    }
+}
+/**
+ * `readJournalMode` under a deliberately narrow busy budget, restoring the
+ * open-path budget afterwards so a caller that survives keeps the connection
+ * it asked for. Only ever called once the retry budget is already spent.
+ */
+function readJournalModeBounded(db) {
+    try {
+        try {
+            db.exec(`PRAGMA busy_timeout = ${WAL_PROBE_BUSY_TIMEOUT_MS}`);
+        }
+        catch {
+            // Non-fatal: we still probe, just without the narrower budget.
+        }
+        for (let attempt = 0; attempt < WAL_PROBE_ATTEMPTS; attempt++) {
+            const mode = readJournalMode(db);
+            if (mode)
+                return mode;
+        }
+        return '';
+    }
+    finally {
+        try {
+            db.exec(`PRAGMA busy_timeout = ${OPEN_BUSY_TIMEOUT_MS}`);
+        }
+        catch {
+            // Non-fatal: the handle is still usable, and every path out of here
+            // either throws or hands back a database that is already in WAL.
+        }
+    }
+}
+/**
+ * Run `PRAGMA journal_mode = WAL`, retrying on contention (#1471).
+ *
+ * `busy_timeout` is set first and covers every other statement, but SQLite
+ * does **not** invoke the busy handler for a journal-mode change — so the one
+ * pragma the budget was put there for never gets it. Concurrent first-opens
+ * of a fresh database therefore threw `SQLITE_BUSY` immediately and killed
+ * whichever process lost the race: the daemon, the MCP server and a
+ * foreground `flo` command starting together is the ordinary consumer
+ * configuration, not a test artifact.
+ *
+ * Note the common path pays nothing: on a database already in WAL the pragma
+ * is a no-op that takes no exclusive lock, so the first attempt succeeds with
+ * no sleep and the loop below never runs.
+ *
+ * Twin: `bin/lib/get-backend.mjs:setWalWithRetry`. Must stay in lockstep until
+ * Phase 5 (#1084) extracts a shared module.
+ *
+ * @internal exported for tests — `budgetMs` lets them exercise exhaustion
+ *           without spending the real 15s.
+ */
+export function setWalWithRetry(db, dbPath, budgetMs = WAL_RETRY_BUDGET_MS) {
+    let lastErr = null;
+    let waited = 0;
+    let delay = WAL_RETRY_MIN_DELAY_MS;
+    for (;;) {
+        try {
+            db.exec('PRAGMA journal_mode = WAL');
+            return;
+        }
+        catch (err) {
+            lastErr = err;
+            // Anything that isn't contention — a corrupt file, a read-only mount —
+            // will not clear by waiting. Surface it now rather than after 15s.
+            if (!isBusyError(err))
+                throw err;
+        }
+        if (waited >= budgetMs)
+            break;
+        const nap = Math.min(delay, budgetMs - waited);
+        sleepMs(nap);
+        waited += nap;
+        delay = Math.min(delay * 2, WAL_RETRY_MAX_DELAY_MS);
+    }
+    // Budget spent. Another opener may have completed the conversion while we
+    // were losing races — the database being in WAL is the outcome we wanted,
+    // whichever process got it there.
+    const mode = readJournalModeBounded(db);
+    if (mode === 'wal')
+        return;
+    throw new Error(`[moflo] PRAGMA journal_mode = WAL stayed busy for ${waited}ms on ${dbPath} ` +
+        `(journal_mode is still "${mode || 'unreadable'}"). Another process is holding an ` +
+        `exclusive lock on the database. Original error: ` +
+        `${String(lastErr?.message ?? lastErr)}`, { cause: lastErr });
+}
 /**
  * Read `journal_mode` back after we requested WAL. If the engine returned a
  * different mode (`delete`, `truncate`, `persist`, `memory`, `off`), the
@@ -179,15 +323,10 @@ const _networkFsWarnedPaths = new Set();
 function warnIfNotWal(db, dbPath) {
     if (_networkFsWarnedPaths.has(dbPath))
         return;
-    let mode;
-    try {
-        const stmt = db.prepare('PRAGMA journal_mode');
-        const row = stmt.get();
-        mode = String(row?.journal_mode ?? '').toLowerCase();
-    }
-    catch {
-        return;
-    }
+    // A probe that throws yields '' and falls through the guard below without
+    // warning — the WAL pragma above either took effect or didn't, and a failed
+    // read is not evidence either way.
+    const mode = readJournalMode(db);
     if (mode && mode !== 'wal') {
         _networkFsWarnedPaths.add(dbPath);
         process.stderr.write(`[moflo] WARNING: SQLite journal_mode=${mode} on ${dbPath} (WAL not active). ` +
@@ -290,8 +429,10 @@ export function openDaemonDatabase(dbPath) {
             // (#1098); 15000ms gives the indexer's full first-pass time to finish
             // before doctor's probe gives up. The price of being wrong-high here
             // is one slow probe per session, not lost data.
-            db.exec('PRAGMA busy_timeout = 15000');
-            db.exec('PRAGMA journal_mode = WAL');
+            db.exec(`PRAGMA busy_timeout = ${OPEN_BUSY_TIMEOUT_MS}`);
+            // Not `db.exec` directly: SQLite skips the busy handler for a
+            // journal-mode change, so this one pragma needs its own retry (#1471).
+            setWalWithRetry(db, dbPath);
             db.exec('PRAGMA synchronous = NORMAL');
             // The daemon is the process most exposed to network-FS edge cases
             // (long-lived MCP server, ~30s of writes per indexer pass). NFS/SMB

package/dist/src/cli/memory/entries-read.js

@@ -77,9 +77,32 @@ export async function searchEntries(options) {
         // Generate query embedding
         const queryEmb = await generateEmbedding(query);
         const queryEmbedding = queryEmb.embedding;
-        // Try HNSW search first (approximate-nearest-neighbor)
+        // Try HNSW search first (approximate-nearest-neighbor).
+        //
+        // #1468 — the short-circuit used to be `length > 0`, which made recall
+        // non-deterministic. Whenever the index could serve only part of the store —
+        // a truncated metadata map, or an index merely stale between rebuilds — a
+        // query that found ONE in-index hit suppressed the complete scan below,
+        // while a query that found zero got correct and complete results. Both
+        // shapes returned `success: true`, so the caller could not tell them apart.
+        //
+        // The ANN is now trusted only when it FILLED the request. Short of that we
+        // fall through and merge, so a partial fast path can add to the answer but
+        // never replace it. The test is on the raw count, before the threshold
+        // filter: what matters is whether the index could supply the candidates at
+        // all, not how similar they turned out to be.
+        //
+        // A namespace holding fewer than `limit` entries therefore falls through on
+        // every query, permanently. That is intended and its cost is proportionate:
+        // the scan below filters by the same namespace, so it parses that
+        // namespace's handful of embeddings, not the whole cap. The expensive scan
+        // is reserved for `all` and for namespaces large enough to fill the request
+        // in the first place — which do not reach it. `searchHNSWIndex` widens its
+        // retrieval before answering short (#1468), so a shortfall here means the
+        // entries genuinely are not in the index rather than that the namespace
+        // filter starved a global top-k.
         const hnswResults = await searchHNSWIndex(queryEmbedding, { k: limit, namespace });
-        if (hnswResults && hnswResults.length > 0) {
+        if (hnswResults && hnswResults.length >= limit) {
             // Filter by threshold
             const filtered = hnswResults.filter(r => r.score >= threshold);
             return {
@@ -135,6 +158,28 @@ export async function searchEntries(options) {
             }
         }
         db.close();
+        // #1468 — merge the partial ANN hits in rather than discarding them. The
+        // scan is capped at `searchCandidateCap()` and the index is not, so each
+        // side can hold something the other misses; keeping only one of them would
+        // trade the old non-determinism for a different gap. Same id from both keeps
+        // the higher score — the scan's is exact, the ANN's approximate, and
+        // `Math.max` picks the exact one whenever they disagree in its favour.
+        if (hnswResults) {
+            const byId = new Map(results.map(r => [r.id, r]));
+            for (const hit of hnswResults) {
+                if (hit.score < threshold)
+                    continue;
+                const existing = byId.get(hit.id);
+                if (!existing) {
+                    byId.set(hit.id, hit);
+                }
+                else if (hit.score > existing.score) {
+                    existing.score = hit.score;
+                }
+            }
+            results.length = 0;
+            results.push(...byId.values());
+        }
         // Sort by score
         results.sort((a, b) => b.score - a.score);
         return {

package/dist/src/cli/memory/entries-write.js

@@ -17,7 +17,7 @@ import { findProjectRoot } from '../services/project-root.js';
 import { openDaemonDatabase } from './daemon-backend.js';
 import { ensureSchemaColumns } from './schema.js';
 import { generateEmbedding } from './embedding-model.js';
-import { addToHNSWIndex } from './hnsw-singleton.js';
+import { addToHNSWIndex, removeFromHNSWIndex } from './hnsw-singleton.js';
 import { getBridge } from './bridge-loader.js';
 import { tryDaemonStore, tryDaemonDelete } from './daemon-write-client.js';
 import { EMBEDDING_MODEL_OPT_OUT, getBridgeEmbedder, isEphemeralNamespace } from './bridge-embedder.js';
@@ -25,8 +25,10 @@ import { toFloat32 } from './controllers/_shared.js';
 import { serialiseMetadata } from './bridge-entries.js';
 import { logRoutingFault, writeVectorStatsCache } from './entries-shared.js';
 import { writeThroughDurable } from '../services/durable-sync.js';
+import { archiveDurableRow, isDurableNamespace } from '../services/durable-store-io.js';
 import { resolveStateRoot } from '../services/project-root.js';
 import { generateId } from '../shared/utils/id.js';
+import { detectToolCallMarkup, markupCheckDisabled, toolCallMarkupError } from './tool-call-markup.js';
 /**
  * Propagate a just-persisted durable write to the shared store (#1232). The
  * caller passes the project root the row actually landed under so the flush
@@ -37,8 +39,8 @@ import { generateId } from '../shared/utils/id.js';
  * reaches the shared store. `writeThroughDurable` swallows its own errors and
  * is a no-op unless `memory.durable_path` is set, so this is safe either way.
  */
-async function propagateDurable(namespace, projectRoot) {
-    const flush = writeThroughDurable(namespace, { projectRoot });
+async function propagateDurable(namespace, projectRoot, key) {
+    const flush = writeThroughDurable(namespace, { projectRoot, key });
     if (process.env.MOFLO_IS_DAEMON === '1') {
         void flush;
         return;
@@ -50,6 +52,31 @@ async function propagateDurable(namespace, projectRoot) {
  * This bypasses MCP and writes directly to the database.
  */
 export async function storeEntry(options) {
+    // #1467 — reject a value that carries captured tool-call markup. Every
+    // model-authored write lands here: the CLI (`flo memory store`), the MCP tool
+    // (`memory_store`), and the daemon's own RPC handler. The check runs before
+    // the routing preamble below and before any embedding, so a rejected value
+    // never crosses the wire, produces a vector, or reaches disk.
+    //
+    // `storeEntries` (bulk) is deliberately NOT checked on its bridge path. Its
+    // one production caller is the pattern pre-trainer, whose content is derived
+    // from code rather than written by a model — so it cannot carry this
+    // corruption, and it is exactly where a truncated XML snippet ending on
+    // `</value>` would legitimately arrive. See the blind-spot note in
+    // tool-call-markup.ts.
+    if (!markupCheckDisabled()) {
+        const hit = detectToolCallMarkup(options.value);
+        if (hit) {
+            // Returned, not logged: every caller surfaces `error` in its own idiom
+            // (the CLI prints it, MCP returns it), and a console.error here would
+            // print the same refusal twice on the path users actually see.
+            return {
+                success: false,
+                id: '',
+                error: toolCallMarkupError(hit, options.value, options.namespace ?? 'default', options.key),
+            };
+        }
+    }
     // Soft-redirect: `knowledge` is a deprecated alias for `learnings`. Writes
     // are accepted but routed to learnings with provenance tags so future
     // decay/prune treats user-forced entries as locked. Old consumer DBs that
@@ -135,7 +162,7 @@ export async function storeEntry(options) {
             // process actually persisted the row). The bridge resolves its DB via
             // findProjectRoot(), so source the flush from the same root.
             if (bridgeResult.success)
-                await propagateDurable(options.namespace ?? 'default', findProjectRoot());
+                await propagateDurable(options.namespace ?? 'default', findProjectRoot(), options.key);
             return bridgeResult;
         }
     }
@@ -275,7 +302,7 @@ export async function storeEntry(options) {
         // fallback. Source the flush from the root the row actually landed under
         // (`dbPath` = <root>/.moflo/moflo.db) rather than process.cwd(), which can
         // differ from the project root.
-        await propagateDurable(namespace, path.dirname(path.dirname(dbPath)));
+        await propagateDurable(namespace, path.dirname(path.dirname(dbPath)), key);
         return {
             success: true,
             id,
@@ -328,6 +355,15 @@ export async function deleteEntry(options) {
                 key: options.key,
             });
             if (routed.routed && routed.ok) {
+                // #1468 — the row left the daemon's DB; drop it from any index THIS
+                // process holds too. Usually nothing (a CLI invocation loads no index
+                // before routing), but a long-lived client that routes its writes and
+                // still searches locally would otherwise keep serving the deleted entry.
+                // Gated on `deleted` for the same reason the bridge branch below is: a
+                // daemon can report success for a key that was already gone.
+                if (routed.deleted ?? true) {
+                    removeFromHNSWIndex(options.namespace ?? 'default', options.key);
+                }
                 return {
                     success: true,
                     deleted: routed.deleted ?? true,
@@ -359,8 +395,13 @@ export async function deleteEntry(options) {
     const bridge = await getBridge();
     if (bridge) {
         const bridgeResult = await bridge.bridgeDeleteEntry(options);
-        if (bridgeResult)
+        if (bridgeResult) {
+            // #1468 — see the note on the direct path below.
+            if (bridgeResult.deleted) {
+                removeFromHNSWIndex(options.namespace ?? 'default', options.key);
+            }
             return bridgeResult;
+        }
     }
     // Fallback: direct node:sqlite write via the unified factory.
     const { key, namespace = 'default', dbPath: customPath } = options;
@@ -401,15 +442,37 @@ export async function deleteEntry(options) {
                 error: `Key '${key}' not found in namespace '${namespace}'`
             };
         }
-        // Hard-delete the entry. Soft-delete was retired in story #728: tombstones
-        // were write-only (no code ever restored from status='deleted') and bloated
-        // the DB indefinitely.
-        db.run(`DELETE FROM memory_entries WHERE key = ? AND namespace = ? AND status = 'active'`, [key, namespace]);
+        // Durable namespaces ARCHIVE instead of hard-deleting (#1463). A hard
+        // delete cannot propagate — it is indistinguishable from a row that never
+        // existed — so the entry returned at the next session-start import or
+        // worktree seed, and the operator saw a clean local store with no signal
+        // that the purge would be undone.
+        //
+        // This narrows story #728's hard-delete rather than reverting it: #728
+        // retired a soft-delete that nothing read and nothing bounded. The archived
+        // row is read by every sync direction and by a later re-creation that has
+        // to beat its timestamp, and `pruneExpiredArchives` bounds it at the same
+        // 90-day window the artifact tombstones use. Non-durable namespaces are
+        // unchanged — they are never shared, so a tombstone there would be the
+        // write-only kind #728 removed.
+        if (isDurableNamespace(namespace)) {
+            archiveDurableRow(db, namespace, key, Date.now());
+        }
+        else {
+            db.run(`DELETE FROM memory_entries WHERE key = ? AND namespace = ? AND status = 'active'`, [key, namespace]);
+        }
         // Get remaining count
         const countResult = db.exec(`SELECT COUNT(*) FROM memory_entries WHERE status = 'active'`);
         const remainingEntries = countResult[0]?.values?.[0]?.[0] || 0;
         // WAL persisted the DELETE incrementally — no whole-file dump needed.
         db.close();
+        // #1468 — keep the in-process index in step with the row. The store path
+        // has always called `addToHNSWIndex`; the delete path called nothing, so a
+        // deleted entry's metadata outlived it in `hnswIndex.entries` and the local
+        // HNSW path kept returning it until the process restarted. Archived rows
+        // count: the index loads `status = 'active'`, so an archived entry has to
+        // leave it exactly as a hard-deleted one does.
+        removeFromHNSWIndex(namespace, key);
         return {
             success: true,
             deleted: true,

package/dist/src/cli/memory/hnsw-singleton.js

@@ -20,6 +20,7 @@ import { parseEmbeddingJson } from './controllers/_shared.js';
 import { memoryDbPath } from '../services/moflo-paths.js';
 import { openDaemonDatabase } from './daemon-backend.js';
 import { getBridge, isBridgeLoaded } from './bridge-loader.js';
+import { searchCandidateCap } from './bridge-core.js';
 import { resolveStateRoot } from '../services/project-root.js';
 let hnswIndex = null;
 let hnswInitializing = false;
@@ -65,6 +66,7 @@ export async function getHNSWIndex(options) {
                 return hnsw.search(query.vector, query.k);
             },
             len: async () => hnsw.size,
+            remove: (id) => hnsw.remove(id),
         };
         const entries = new Map();
         hnswIndex = {
@@ -84,11 +86,17 @@ export async function getHNSWIndex(options) {
             try {
                 const sqlDb = openDaemonDatabase(dbPath);
                 const cols = sidecarLoaded ? SELECT_METADATA_ONLY : SELECT_WITH_EMBEDDING;
+                // #1468 — recency-ordered candidate cap, the same one `entries-read.ts`
+                // and `memory-bridge.ts` already use. This load was a bare `LIMIT 10000`,
+                // so which rows survived was b-tree order under `idx_memory_status` —
+                // arbitrary with respect to both recency and namespace. That is #1201
+                // recurring here; the sibling paths got the fix and this loader did not.
                 const result = sqlDb.exec(`
           SELECT ${cols}
           FROM memory_entries
           WHERE status = 'active' AND embedding IS NOT NULL
-          LIMIT 10000
+          ORDER BY created_at DESC
+          LIMIT ${searchCandidateCap()}
         `);
                 let parseSkipped = 0;
                 if (result[0]?.values) {
@@ -116,6 +124,36 @@ export async function getHNSWIndex(options) {
                 if (parseSkipped > 0) {
                     console.warn(`[memory-initializer] skipped ${parseSkipped} rows with malformed embeddings`);
                 }
+                // #1468 — drop graph vectors the metadata load did not cover, so the two
+                // structures agree.
+                //
+                // Only the sidecar path can disagree. When the sidecar is absent the loop
+                // above inserts each vector alongside its metadata row, so the cap bounds
+                // both together. `hnsw-persistence` builds the sidecar over every embedded
+                // row with no LIMIT, so a store past the cap pairs a complete graph with a
+                // truncated map — and `searchHNSWIndex` silently skips a hit it cannot
+                // resolve (`if (!entry) continue`). Those vectors are unreachable by
+                // construction: they consume graph space and ANN slots that would
+                // otherwise hold a result the caller can actually receive. Rows past the
+                // cap stay reachable through the complete brute-force scan in
+                // `entries-read.ts`, which now runs whenever the ANN under-fills.
+                //
+                // Guarded on a non-empty map, which covers the SELECT that succeeds and
+                // returns nothing: far more likely a read that went wrong than a store
+                // whose rows all vanished, and emptying the graph on that reading is
+                // unrecoverable until the next rebuild. A read that *throws* needs no
+                // guard — it exits to the catch below and never reaches here, leaving the
+                // graph exactly as the sidecar supplied it. Both ways out leave a stale
+                // graph rather than an empty one, which is the cheaper mistake.
+                if (sidecarLoaded && hnswIndex.entries.size > 0) {
+                    const orphaned = [];
+                    for (const id of hnsw.ids()) {
+                        if (!hnswIndex.entries.has(id))
+                            orphaned.push(id);
+                    }
+                    for (const id of orphaned)
+                        hnsw.remove(id);
+                }
                 sqlDb.close();
             }
             catch (err) {
@@ -162,6 +200,47 @@ export async function addToHNSWIndex(id, embedding, entry) {
         return false;
     }
 }
+/**
+ * Remove an entry from the in-process HNSW index — graph vector and metadata
+ * row both (#1468).
+ *
+ * `deleteEntry` used to delete the row and stop there. The store path maintains
+ * the index (`addToHNSWIndex`); the delete path had no counterpart and there was
+ * no removal function to call, even though `HnswLite.remove` has always existed.
+ * `entries` is an in-process map rebuilt from SQL, so the consequence was not
+ * merely an orphaned vector: the deleted entry's metadata outlived the row and
+ * the local HNSW path could keep **returning deleted content** until the process
+ * restarted. A curation pass had no way to see that.
+ *
+ * Addressed by (namespace, key) rather than id because that is what every caller
+ * of `deleteEntry` has. The scan is linear, which is fine — deletes are rare and
+ * searches are not, so the cost belongs here rather than in a second index.
+ *
+ * Never forces a load. When this process holds no initialized index there is
+ * nothing stale to correct, and the next load reads a DB the row is already gone
+ * from. Returns the number of entries removed.
+ */
+export function removeFromHNSWIndex(namespace, key) {
+    const index = hnswIndex;
+    if (!index?.initialized)
+        return 0;
+    const ids = [];
+    for (const [id, entry] of index.entries) {
+        if (entry.key === key && entry.namespace === namespace)
+            ids.push(id);
+    }
+    for (const id of ids) {
+        index.entries.delete(id);
+        try {
+            index.db.remove?.(id);
+        }
+        catch {
+            // A graph that refuses the removal leaves an unreachable vector, which is
+            // the pre-#1468 state and strictly better than the metadata row surviving.
+        }
+    }
+    return ids.length;
+}
 /**
  * Search HNSW index (approximate-nearest-neighbor; scales sub-linearly vs. brute-force)
  * Returns results sorted by similarity (highest first)
@@ -177,12 +256,10 @@ export async function searchHNSWIndex(queryEmbedding, options) {
     const index = await getHNSWIndex({ dimensions: queryEmbedding.length });
     if (!index)
         return null;
-    try {
-        const vector = new Float32Array(queryEmbedding);
-        const k = options?.k ?? 10;
-        // HNSW search returns results with cosine distance (lower = more similar)
-        const results = await index.db.search({ vector, k: k * 2 }); // Get extra for filtering
-        const filtered = [];
+    const k = options?.k ?? 10;
+    /** Resolve raw graph hits through the metadata map, applying the namespace filter. */
+    const collect = (results) => {
+        const hits = [];
         for (const result of results) {
             const entry = index.entries.get(result.id);
             if (!entry)
@@ -194,7 +271,7 @@ export async function searchHNSWIndex(queryEmbedding, options) {
             // Convert cosine distance to similarity score (1 - distance)
             // Cosine distance: 0 = identical, 2 = opposite
             const score = 1 - (result.score / 2);
-            filtered.push({
+            hits.push({
                 id: entry.id.substring(0, 12),
                 key: entry.key || entry.id.substring(0, 15),
                 content: entry.content.substring(0, 60) + (entry.content.length > 60 ? '...' : ''),
@@ -202,9 +279,35 @@ export async function searchHNSWIndex(queryEmbedding, options) {
                 namespace: entry.namespace,
                 metadata: entry.metadata
             });
-            if (filtered.length >= k)
+            if (hits.length >= k)
                 break;
         }
+        return hits;
+    };
+    try {
+        const vector = new Float32Array(queryEmbedding);
+        // HNSW search returns results with cosine distance (lower = more similar)
+        let filtered = collect(await index.db.search({ vector, k: k * 2 })); // Get extra for filtering
+        // #1468 — widen once when a namespace filter starved the result.
+        //
+        // The graph is one shared structure and the namespace filter runs AFTER
+        // retrieval, so a namespace holding a small share of the store routinely
+        // loses most of its `k * 2` candidates to rows in other namespaces and comes
+        // back short. That shortfall is not a signal about the store — those entries
+        // exist and a full scan would find them — and `searchEntries` reads a short
+        // result as "the index could not serve this", which would send every
+        // namespaced query on to a SQL scan that JSON.parses thousands of embeddings.
+        //
+        // `HnswLite.search` brute-forces whenever `k * 2` reaches the graph size, so
+        // passing the size guarantees complete coverage. It is a cosine pass over
+        // Float32Arrays already resident in memory — far cheaper than the SQL
+        // fallback it replaces. Skipped when the first search already covered the
+        // whole graph, since a second identical pass would add nothing.
+        const graphSize = await index.db.len();
+        const namespaced = Boolean(options?.namespace && options.namespace !== 'all');
+        if (namespaced && filtered.length < k && graphSize > k * 2) {
+            filtered = collect(await index.db.search({ vector, k: graphSize }));
+        }
         // Sort by score descending (highest similarity first)
         filtered.sort((a, b) => b.score - a.score);
         return filtered;