brain: recall-quality, multi-agent isolation, and storage hardening

A single coherent pass over the read path, the extractor, multi-agent
scoping, and table initialization. Pre-release; breaking changes made
in place with no compat shims.

storage / metadata
- Eager table materialization: open_or_init_schema now materializes
  every catalog table on open, so read paths can trust a table exists
  rather than each guarding TableDoesNotExist. Removes ~50 dead guards
  across metadata/ops/planner/workers; a fresh shard no longer logs
  "entity HNSW startup rebuild: metadata scan failed".
- Drop version suffixes from 6 table names (edges_v2 -> edges, etc.)
  and all 28 rkyv type tags (::vN). No migrations: wipe data/.

retrieval
- Graph lane: keep the memory-anchor walk at depth 1 (depth 2 floods
  fusion with entity-dense memories on a diverse corpus).
- Semantic soft-timeout 50ms -> 1000ms (CPU BGE embed needs headroom);
  log per-call embed/search split.
- Rerank: combine fused_score + alpha*normalize(rerank) instead of
  letting the cross-encoder logit replace the fused order, so a
  confident multi-retriever consensus survives a noisy single-pair
  logit while close ties still flip.

extractor
- Drop the brain:fact wildcard sink: predicates outside the active
  schema are now dropped (with a metric), not collapsed onto
  (subject, brain:fact) where they tripped spurious supersession.
- system schema prompt: omit a statement when no declared predicate
  fits, rather than coercing to brain:fact.
- Entity-name normalization: strip a leading determiner; reject
  over-long / pure-quantity surfaces before resolution.
- Delete the now-unused original_predicate_qname field stack-wide
  (core, metadata row, ops payload, wire view, sdk, explore, shell).

multi-agent
- RECALL isolates to the calling agent by default; agent_filter scopes
  to an explicit set and include_other_agents opts out. Wired through
  QueryRequest, the wire RecallRequest, both retrievers' filters
  (now Vec<AgentId>), the recall handler, sdk builder, and shell flags.
- MemoryResult carries agent_id so callers see per-hit provenance.

Author: nirajgeorgian

crates/brain-core/src/nodes/statement.rs

@@ -358,19 +358,9 @@ pub struct Statement {
     /// date X" without resurrecting tombstones.
     pub record_invalidated_at_unix_nanos: Option<u64>,
 
-    /// LLM-coined predicate qname when this row landed on the
-    /// `brain:fact` wildcard sink. `None` for statements whose
-    /// `predicate` resolves to a schema-declared row — the wildcard
-    /// sink preserves the model's original intent so a later schema
-    /// upload can promote `(brain:fact, original_predicate_qname)` rows
-    /// into typed predicates without re-extraction.
-    pub original_predicate_qname: Option<String>,
-
     /// Per-statement statefulness flag. Copied from
     /// `PredicateDefinition.is_stateful` at write time for schema-
-    /// declared predicates; carries the LLM's per-extraction signal
-    /// for `brain:fact` wildcard rows (where the predicate registry
-    /// row is generic and can't speak for the individual fact).
+    /// declared predicates.
     pub is_stateful: bool,
 }
 
@@ -417,7 +407,6 @@ impl Statement {
             tombstoned_at_unix_nanos: None,
             tombstone_reason: None,
             record_invalidated_at_unix_nanos: None,
-            original_predicate_qname: None,
             is_stateful: false,
         }
     }

crates/brain-explore/src/render/memory.rs

@@ -10,7 +10,7 @@ use std::io::{self, Write};
 use brain_protocol::envelope::response::MemoryResult;
 use serde_json::{json, Value};
 
-use crate::render::{fmt_hex_16, fmt_id, fmt_kind, fmt_short_id};
+use crate::render::{fmt_hex_16, fmt_hex_16_bare, fmt_id, fmt_kind, fmt_short_id, fmt_uuid};
 use crate::table::middle_truncate;
 use crate::theme::Token;
 use crate::{Render, RenderCtx};
@@ -72,6 +72,14 @@ impl Render for RecallResults {
                 score_painted,
                 format!("sem={:.4}", r.similarity_score),
             ];
+            // Owning agent — first 8 hex of the agent uuid. Only shown
+            // when known (non-zero); on a cross-agent recall this is
+            // how the reader tells whose memory each hit is. The zero
+            // agent is the anonymous owner and adds only noise.
+            if r.agent_id != [0u8; 16] {
+                let short_agent: String = fmt_hex_16_bare(&r.agent_id).chars().take(8).collect();
+                meta.push(format!("agent={short_agent}"));
+            }
             // Cross-encoder relevance, only present when rerank scored
             // this hit. Surfacing it makes the re-sort auditable.
             if let Some(rr) = r.rerank_score {
@@ -232,6 +240,7 @@ impl Render for RecallResults {
                     "lsn": r.lsn,
                     "flags": r.flags,
                     "kind": fmt_kind(r.kind),
+                    "agent_id": fmt_uuid(&r.agent_id),
                     "context_id": r.context_id,
                     "created_at_unix_nanos": r.created_at_unix_nanos,
                     "last_accessed_at_unix_nanos": r.last_accessed_at_unix_nanos,
@@ -289,6 +298,7 @@ mod tests {
             confidence: score,
             salience: 0.5,
             kind: MemoryKindWire::Episodic,
+            agent_id: [0u8; 16],
             context_id: 0,
             created_at_unix_nanos: 0,
             last_accessed_at_unix_nanos: 0,
@@ -359,6 +369,25 @@ mod tests {
         assert!(s.contains("rr=7.2500"), "rerank column: {s}");
     }
 
+    #[test]
+    fn shows_agent_token_only_when_known() {
+        // Zero agent (anonymous) → no agent= token.
+        let r = RecallResults(vec![make_hit("anon", 0.9)]);
+        let mut buf = Vec::new();
+        r.render_table(&ctx(), &mut buf).unwrap();
+        let s = String::from_utf8(buf).unwrap();
+        assert!(!s.contains("agent="), "zero agent should not render token: {s}");
+
+        // Known agent → first 8 hex of the uuid rides on the line.
+        let mut hit = make_hit("owned", 0.9);
+        hit.agent_id = [0xab, 0xcd, 0xef, 0x01, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0];
+        let r = RecallResults(vec![hit]);
+        let mut buf = Vec::new();
+        r.render_table(&ctx(), &mut buf).unwrap();
+        let s = String::from_utf8(buf).unwrap();
+        assert!(s.contains("agent=abcdef01"), "expected agent token: {s}");
+    }
+
     #[test]
     fn flags_clustered_scores() {
         // Two hits with identical scores → footer warns about ranking.

crates/brain-explore/src/render/statement_card.rs

@@ -45,11 +45,6 @@ pub struct StatementCard {
     pub object: ObjectRef,
     pub confidence: f32,
     pub evidence_memories: Vec<MemorySummary>,
-    /// Set when the statement landed on the `brain:fact` wildcard
-    /// sink: the renderer displays this in place of `predicate_qname`
-    /// and appends an "(auto-coined)" hint so the user knows the
-    /// predicate isn't in the schema yet.
-    pub original_predicate_qname: Option<String>,
     /// Record-time invalidation. When set, the substrate no longer
     /// believes this statement (superseded / tombstoned / FORGET
     /// cascade). The renderer surfaces this with a warning line so the
@@ -65,26 +60,14 @@ impl Render for StatementCard {
         let body_width = policy.width.saturating_sub(2);
 
         let subject = theme.paint(Token::Accent, &self.subject_canonical, policy);
-        // Auto-coined rows surface the LLM's original predicate name
-        // instead of the literal `brain:fact` so the user sees the
-        // intent; the suffix tells them the predicate isn't declared
-        // in the schema yet (a declare-this hint).
-        let (predicate_label, auto_coined) = match &self.original_predicate_qname {
-            Some(orig) => (orig.clone(), true),
-            None => (self.predicate_qname.clone(), false),
-        };
+        let predicate_label = self.predicate_qname.clone();
         let predicate = theme.paint(Token::Predicate, &predicate_label, policy);
         let object = match &self.object {
             ObjectRef::Entity { name, .. } => theme.paint(Token::EntityId, name, policy),
             ObjectRef::Literal(s) => theme.paint(Token::Value, s, policy),
         };
         let kind = theme.paint(Token::Muted, &self.kind, policy);
-        if auto_coined {
-            let hint = theme.paint(Token::Muted, "(auto-coined)", policy);
-            writeln!(w, "[{kind}] {subject} {predicate} {object}  {hint}")?;
-        } else {
-            writeln!(w, "[{kind}] {subject} {predicate} {object}")?;
-        }
+        writeln!(w, "[{kind}] {subject} {predicate} {object}")?;
 
         let id_painted = theme.paint(Token::StatementId, &self.id, policy);
         let conf_str = format!("{:.2}", self.confidence);
@@ -128,8 +111,6 @@ impl Render for StatementCard {
             "statement_kind": self.kind,
             "subject_canonical": self.subject_canonical,
             "predicate": self.predicate_qname,
-            "original_predicate_qname": self.original_predicate_qname,
-            "auto_coined": self.original_predicate_qname.is_some(),
             "object": object,
             "confidence": self.confidence,
             "evidence_memories": self.evidence_memories.iter().map(|m| json!({
@@ -178,7 +159,6 @@ mod tests {
                 short_id: "s2/m17/v1".into(),
                 text: "Priya works at Acme Corp".into(),
             }],
-            original_predicate_qname: None,
             record_invalidated_at_unix_nanos: None,
         }
     }
@@ -215,30 +195,6 @@ mod tests {
         assert_eq!(v["object"]["value"], "Senior Engineer");
     }
 
-    #[test]
-    fn auto_coined_predicate_shows_original_and_hint() {
-        let mut c = sample();
-        c.predicate_qname = "brain:fact".into();
-        c.original_predicate_qname = Some("works_at".into());
-        c.object = ObjectRef::Literal("billing rewrite".into());
-
-        let mut buf = Vec::new();
-        c.render_table(&ctx(), &mut buf).unwrap();
-        let s = String::from_utf8(buf).unwrap();
-        // Renderer shows the LLM's qname, not the literal sink name.
-        assert!(s.contains("works_at"));
-        assert!(!s.contains("brain:fact"));
-        assert!(s.contains("(auto-coined)"));
-    }
-
-    #[test]
-    fn declared_predicate_omits_auto_coined_hint() {
-        let mut buf = Vec::new();
-        sample().render_table(&ctx(), &mut buf).unwrap();
-        let s = String::from_utf8(buf).unwrap();
-        assert!(!s.contains("(auto-coined)"));
-    }
-
     #[test]
     fn record_invalidated_renders_warning_line() {
         let mut c = sample();
@@ -274,17 +230,4 @@ mod tests {
         let v2 = sample().render_json(&ctx());
         assert_eq!(v2["record_invalidated"], false);
     }
-
-    #[test]
-    fn json_carries_auto_coined_metadata() {
-        let mut c = sample();
-        c.predicate_qname = "brain:fact".into();
-        c.original_predicate_qname = Some("works_at".into());
-        let v = c.render_json(&ctx());
-        assert_eq!(v["original_predicate_qname"], "works_at");
-        assert_eq!(v["auto_coined"], true);
-
-        let v2 = sample().render_json(&ctx());
-        assert_eq!(v2["auto_coined"], false);
-    }
 }