[Git-on-my-level]

Summary

Retain two unsuperseded structural Firestore query optimizations from orphan #23442; merge current main into the existing lane history. The public-catalog and request-cohort cache changes are removed. No query policy, transcription, speaker labels, Free benefits, legacy price, raw-audio custody or authority checks change.

• Smart merge: use the declared device composite only for explicit-device, unbounded discarded-barrier lookups. Keep the global finite six-row predecessor window, missing/empty-device behavior, deleted barriers, transaction snapshot and unrelated-error propagation. Missing-index errors fall back to the original query. Device or citation IDs exceeding 1,500 UTF-8 bytes keep their original scans because Firestore truncates indexed field values; no new identifier input restriction is introduced.
• KG pruning: query native memory_ids reverse citations for at most 30 distinct IDs before mutations. Larger retractions keep one original full scan so overlapping chunks cannot amplify billed reads. Retain the full surviving-node and orphan-edge cleanup, including unrelated dangling edges. No side collection, backfill or new application writes.
• Independent switches default on; FSR_SMART_MERGE_PARTITION=off and FSR_KG_CITATION_INDEX=off restore their original paths.
• Main's new donor rebasing, open-loop/retirement behavior, config: repair Firestore read train scopes and start people dedupe at 5% #23797's scoped literals, perf(backend): prevent maintenance scan storms on lever rollback #23801's maintenance guard and perf(observability): right-size desktop metrics collector CPU #23803's collector changes are preserved.

Four-part decision / economics

10-26 fleet caller data already captured in the fsown report; $0.43–0.47 per million reads × 30 days. These are opportunity ceilings, not forecasts or booked savings.

Original part	Observed caller reads/day	Monthly evidence	Result
Smart-merge device barrier	16,749,388	Entire pool $216.07–236.17; upside capped at $236.17, eligible barrier fraction/off-device selectivity unknown	KEEP; main still scans broadly then filters device in Python
KG reverse citations	8,915,616	Entire pool $115.01–125.71; first-scan-only upside capped at $62.86. Fixture-equivalent $55.83–61.02 only if its graph shape holds fleet-wide	KEEP; main still performs the first full node scan; bulk traffic remains legacy
Public catalog single-flight	1,538,759	Entire pool only $19.85–21.70; incremental miss coalescing unmeasured; $0 assigned	DROP; main already has 30s list single-flight and 600s Redis backing; limited upside does not justify extending shared-cache dependency
Request cohort snapshot	2,616,546 (old + renamed callers)	Entire pool $33.75–36.89; $0 additional assigned	DROP; main already shares observations and clamps their original 60s deadline, while this request memo did not recheck expiry

Retained gross upside cap $299.03/month, not a point forecast. Composite storage, empty-query floors, fallback overhead and the actual request/graph mix remain unmeasured; net savings may be zero or negative. New verified/realized savings: $0, until lead serving plus D+1 net billing against the 10-24/25 baseline.

Track old and new callers together: smart_merge:find_preceding_conversations → smart_merge:collect (including unchanged finite reads); knowledge_graph:prune_memory_citations_from_kg plus knowledge_graph:_citation_nodes. New origins are task:smart_merge_partition_lookup and task:kg_citation_prune. Caller renaming is not saving.

Integration and validation

• Merge commit f923e4862f1240b52c429f5705f091558f2a90f3 parents: existing PR head 789db126e73be7c01465af90e4f7f5277c3fce56 and main 5f2caea10a67fcd2dbc52347aff08c9f0ac5fdab. Follow-up f240ea8dbe01b2f061fbbb9aa5ce56be6f75070c caps bulk KG reads. Final source 4174839ab5f0c0bc06eda0a4e81b96b66931980a preserves scans for identifiers beyond index bounds, with ASCII and multibyte boundary tests. No rebase/force-push/stash. Original divergent local lane work is preserved.
• 1,019 passed, one standard slow deselection, across an explicit 14-file list through backend/test.sh, BACKEND_UNIT_TEST_FILE_LIST, BACKEND_PYTEST_WORKERS=4, nice -n10 and omi-heavy. Includes all seven Firestore guards, offline SDK query serialization, global-window/deleted-barrier/transaction fallback, finalizer/donor integration, identical KG cleanup, and bulk read non-amplification.
• Synthetic mechanisms: indexed barrier 121→1 returned rows with the same relevant barrier; KG 206→106 reads with identical final graph; bulk KG remains 4→4 reads. None establishes fleet savings.
• Own Luna review: SHIP on f240; final index-bound delta review and normal pre-push/CI receipts are tracked at the top of reports/fsown-owner-1027.md before MERGE READY.

Lead-owned index / ship gate

A ro-prod metadata-only check found 221 composites and no matching device index. The lead must clear the standard additive index prebuild auth/environment approvals and verify conversations_smart_merge_device_preceding READY before serving this source. Production prebuild approval is a lead gate, not lane authority. Do not ship through the missing-index fallback to bypass the readiness gate. Native KG array-index availability also retains the standard guard/fallback contract.

Once readiness and source CI are clean, the lead merges and ships through its normal source train, watches missing-index/fallback/query latency, smart-merge barrier equivalence, KG cleanup, 5xx and live p95, and rolls either switch off on a regression. Compare matched caller windows and D+1 total reads/writes/storage before booking dollars. This lane performs no deploy/apply, prod write, approval or access change, and does not close the PR.

Product invariants affected

• INV-MEM-4 — graph pruning remains derived cleanup; privacy/deletion authority and authoritative promotion/funding checks retain their existing paths.

Line-Count-Exception: backend/database/firestore_index_registry.py | 2247 -> 2266 | Declare the partition query beside the original query in the single index authority; preserve generated manifest ownership.

Failure-Class: FC-merge-across-discarded-rows

[chatgpt-codex-connector]

Codex Review Summary

This comment shows the latest Codex review activity on this pull request.

Review	Status	Commit	Review trigger
📝 Code Review	✅ Completed 2026-10-27T20:42:58.586763Z	0358b67	New commits

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.