…#259)

* feat(#251 Layer 2 + companion fields): tier-weighted gbrain retrieval

Ships the second slice of #251 on top of PR #252's Layer 1 work. With this
landing, gbrain can rank user-authored content above received noise on
semantic-search results — gated behind a per-user toggle that's off by
default until labeled-retrieval evals confirm recall@5 improvement.

Engine:
- Migration 043 adds `tier_weighting` (bool, default false) and
  `tier_calibration` (sparse/normal/dense, default normal) to
  `brain_settings`. `parseSettingsRow` defaults the new columns so a
  pre-043 install reads safely.
- `tier-weights.ts` (new) — multiplier table with three calibration
  bands. Composes orthogonally with `metadata.userOverride` (pinned
  doubles, hidden drops the row from results) and includes a brief-reply
  downweight: short authored pages get `inbox_personal` weight so "k"
  replies can't outrank strategy emails.
- `rrf.ts` takes an optional `tierWeight(metadata) => number` callback.
  Identity by default; multiplies into rrfScore pre-sort when set.
  `textRank`/`vectorRank` preserved for observability.
- `embedded-port.searchInternal` reads `brain_settings.tier_weighting`
  per query, builds the weight fn from the calibration band, and passes
  it through to `hybridSearch`. Best-effort: DB error falls back to
  pure RRF, never blocks the search.
- `buildPageMetadata` stamps `bodyLen` on every page so the brief-reply
  downweight has something to read.
- `countUserSentPages` (new): SQL count for the calibration auto-recompute.
- `getRecentPages` (new): newest-first page listing for the dashboard.

API:
- `GET /api/memory-config` surfaces `tierWeighting` + `tierCalibration`.
- `POST /api/memory-config/tier-weighting` toggles the flag and
  auto-computes the calibration band from sent volume in the last 90d.
  Body accepts explicit `calibration` to override.
- `GET /api/memory-config/dashboard` returns `pages.recent[]` with tier
  + override projected from metadata. Embeddings stripped from the wire.

Web:
- New "Weight what you wrote (Layer 2 — beta)" card on Settings →
  Memory backend. Single toggle, status + calibration readout, link to
  #251 for the rationale.
- "What your twin remembers" gains a Recent pages table with a
  tier-badge column (`you wrote` / `personal` / `newsletter` / etc.)
  plus pinned/hidden override badges.

Tests:
- 16 unit cases in `tier-weights.test.ts` — multipliers, override
  composition, brief-reply downweight, calibration thresholds.
- 3 new rrf.test.ts branches — flips ranking, drops hidden, preserves
  raw ranks under weighting.
- 5 e2e cases in `tier-weighted-retrieval.test.ts` — baseline,
  weighting flips order, hidden disappears, brief-reply downweight,
  per-user isolation.
- 5 new memory-config-routes.test.ts cases for the new POST endpoint.

Deferred (separate sub-issues):
- `relationshipTier` axis (bidirectional-thread-count based).
- Backfill of `authoringTier` for pre-Layer-1 pages.
- Tier-aware exclude UI (privacy sub-issue; will block default-on).
- Layer 2 default-on rollout — eval-gated.

Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>

* fix(#251 post-/review): address Copilot findings on PR #259

Three findings from Copilot's review of the Layer 2 PR, all real:

1. **rrf.ts:88** — tierWeight was trusted to return a finite, sane number.
   A misbehaving callback returning NaN/Infinity could poison rrfScore;
   undefined would propagate through; negative would survive the >0 filter
   only by accident. Coerce non-numbers and non-finite values to 1.0
   (identity); clamp negatives to 0 (matches the userOverride:'hidden'
   "drop the page" semantics). New rrf.test.ts case covers the path.

2. **memory-settings.js:128** — the tier-weighting toggle handler caught
   non-ok responses but didn't catch network exceptions thrown by
   fetch()/api(). Offline / DNS / similar would silently re-enable the
   button with no user feedback. Added the same `showErrorToast` catch
   the dismiss-notification path uses.

3. **tier-weighted-retrieval.test.ts:46** — makeSignal accepted a
   `bodyLen` parameter that was passed through to RawSignal.data, but
   the embedded port derives bodyLen from the summarised content, not
   from data. The parameter was misleading — implied an unused input
   influenced weighting. Removed the parameter; tests now vary the
   actual body string to exercise the brief-reply downweight.

All four affected files build and test green.

Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>

---------

Co-authored-by: Claude Opus 4.7 <noreply@anthropic.com>

* feat(#251 follow-up): authoring-tier backfill worker

Pages indexed before Layer 1 of #251 had no `authoringTier` on metadata,
which silently disabled Layer 2 for their corpora. This adds a worker
that fills in the tier retroactively, plus the connector now persists
the raw classification headers so reclassification works going forward.

Engine:
- New adapter helper `findPagesMissingAuthoringTier(userId|null, limit)`
  joins brain_pages ↔ brain_signals via `source_ref = id`, filters on
  pages where `metadata->>'authoringTier' IS NULL`, optional user scope.
- `apps/worker/src/jobs/tier-backfill.ts`: the job. Two reclassification
  paths:
    1. Trust the signal — copy `signal.data.authoringTier` to page
       metadata when it exists (post-#252 paths that bypassed the
       metadata projection for any reason).
    2. Reclassify — run the classifier locally on the raw `to` / `cc` /
       `inReplyTo` / `listUnsubscribe` / `listId` / `labels` headers.
  Pages whose signal carries neither path are counted as
  "unreclassifiable" and left alone — pre-Layer-1 signals that don't
  preserve classification headers need a Gmail re-fetch (separate
  sub-issue, lower priority).
- Gmail connector `messageToSignal` now also stamps `to`, `cc`,
  `inReplyTo`, `listUnsubscribe` on `signal.data` so future
  reclassification has source data. No behavior change to the existing
  classifier path; just preserves raw inputs.
- In-memory adapter mirror for tests.

Scheduling:
- Worker runs the job hourly (`TIER_BACKFILL_INTERVAL_MS = 60 * 60 *
  1000`). Idempotent: once a corpus is fully tagged the find query
  returns 0 rows and the pass becomes a no-op.
- Batch size 200 per pass, plenty for any reasonable mailbox to
  converge over a few hours.

Tests: 9 worker, 4 adapter. All green. 70/70 turbo tasks.

Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>

* fix(#251 post-/review): address Copilot findings on PR #271

Three findings on the backfill worker, all valid:

1. findPagesMissingAuthoringTier did a bare `JSON.parse(row.signal_data)`
   when the driver returned JSONB as a string. One malformed signal row
   would have thrown and tanked the whole worker pass. Switched to the
   file-local `parseJson` helper (the same one parsePageRow / parseSettingsRow
   / etc. use) — returns null on parse failure; coerce to {} so the
   worker logs the row as "unreclassifiable" and keeps going.

2. Doc comment claimed "a thousand pages per cycle is the default in the
   worker" but the actual default is 200. Updated.

3. The worker was discarding updatePageMetadata's affected-row count.
   A 0 return (page disappeared between find + update, or ownership
   mismatch) was getting counted as a successful copy/reclass — silent
   data lie. Now treated as failed: incremented `summary.failed`,
   logged with pageId/userId, no copiedFromSignal/reclassified bump.
   New unit test covers the race path.

Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>

---------

Co-authored-by: Claude Opus 4.7 <noreply@anthropic.com>