Re-key stranded alias-identity AGENT_MEMORY rows to canonical (recall-continuity; extend normalizeGraphIdentities)

Context

Surfaced empirically while resolving #13190/#13821 (the FM-memory keying investigation). A renamed agent's old-handle auto-memories are RLS-invisible to its canonical-handle recall.

The Problem (empirically pinned on the live graph)

AGENT_MEMORY nodes are RLS-scoped by user_id (= the agentIdentity at write time). When an agent is renamed (an identityRoots alias, e.g. @neo-claude-opus → @neo-opus-grace), the OLD rows keep the old user_id/agentIdentity → they are invisible to the canonical-handle recall (RLS is fail-closed). Live evidence:

• @neo-claude-opus → user_id neo-claude-opus — 32 AGENT_MEMORY rows
• @neo-opus-grace → user_id neo-opus-grace — 1632 rows

So @neo-opus-grace's recall misses 32 of its own memories. MemoryService resolves canonicalIdentity on NEW writes (L463-487), but the pre-rename rows are stranded.

Why the existing tool doesn't cover it

ai/scripts/migrations/normalizeGraphIdentities.mjs merges legacy alias AgentIdentity nodes + re-points edges (source/target alias→canonical), but does NOT re-key the AGENT_MEMORY rows' user_id column + properties.agentIdentity — which is the RLS scope that gates recall.

The Fix

Extend normalizeGraphIdentities (or a sibling one-shot) to re-key stranded alias AGENT_MEMORY rows to canonical: set user_id + properties.agentIdentity to the canonical identity (via the identityRoots ALIAS_MAP), idempotent, operator-run. Same for any other alias-scoped node types (MEMORY/SESSION) carrying user_id.

Acceptance Criteria

• A one-shot migration re-keys alias-scoped AGENT_MEMORY rows' user_id + agentIdentity → canonical (per identityRoots).
• Idempotent (re-run is a no-op); dedup if a canonical row already exists.
• Post-migration: a canonical-handle recall includes the formerly-stranded rows (@neo-claude-opus 32 → @neo-opus-grace).
• Operator-gated (a script, not auto-run — prod-data mutation on the memory SSOT).
• Unit test on a stub graph (alias rows → canonical, idempotent).

Out of Scope

• The local-WAL orphan residual (#13190's domain — un-synced rows in deleted checkouts).
• The non-alias orphans (@agent-cursor/@librarian/@agent — test/fallback identities; a separate trivial cleanup).

Related

• Adjacent: #13190 (FM-memory removal-reconcile). Tool: normalizeGraphIdentities.mjs. Identity model: identityRoots.mjs (#12911). Surfaced by the #13821 empirical investigation.

Live latest-open sweep: gh issue search "identity recall agent-memory alias re-key canonical" → no equivalent at 2026-06-21T21:46.

Origin Session ID: 80932414-00dc-4d2e-96e6-d0bcf1529733

Retrieval Hint: query_raw_memories("stranded alias AGENT_MEMORY user_id RLS recall-continuity re-key canonical normalizeGraphIdentities neo-claude-opus grace")