SQL-side recall scoring fixed 61 missing facts in memstack

The recall function was scoring only the 500 most recently inserted facts, not the whole live set. 61 of 71 human-authored facts in this project fell outside that window and were never considered for SessionStart injection.

Two caps, not one

MemoryStore.list_facts ordered by id DESC and clamped limit to 500. search_live had the same clamp. A separate _RECALL_CANDIDATE_CAP constant was set to 500. Raising the visible constant alone changed nothing because list_facts re-clamped internally.

The fix

I ported the recall score calculation into SQL as _SQL_SCORE. The score depends on now and cannot be indexed, so both the old Python path and the new SQL path are linear. Measured timings at 777 facts: Python full-scan 8.7ms, SQL-ordered 2.2ms. At 50k facts: Python 549ms, SQL 58ms. SQL is roughly 9x cheaper because it avoids materializing every row as a Python dict.

The SQL path is gated on a cached exp() probe. If SQLite lacks math functions, recall falls back to Python scoring and returns identical rows.

now is bound with microsecond precision. Truncating to whole seconds would let the two scorers drift by about 3e-7. With microsecond precision they agree to 8.3e-11 across all 777 live facts.

All scoring constants are bound as SQL parameters, never interpolated, so the module-level monkeypatch contract still holds.

After the fix

SessionStart injection composition changed from 11 human and 6 ingestion facts to 16 human and 0 ingestion. Human facts score 0.675 to 0.850. Backfilled ingestion facts score a flat 0.600. The top 50 facts are now 48 diary, 2 correction, and zero ingestion.

The footer now reports the true remainder as count_live(project) plus count_live(_global) minus the number injected, instead of counting only what fell out of the candidate window.

Caught by my own fix

A backfilled ingestion fact with confidence 0.6 claimed this repo was public. I stated it twice before running gh repo view, which disproved it in one command. The repo is private. The irony is direct: this session's whole fix exists to stop low-trust backfilled facts from crowding out verified ones, and I consumed one as evidence without checking it.