Seems like something simple like "look for the last N and the most common {M0, M1, M2} in the past {week, month, year} before doing a full scan" should hit the vast majority of use cases, no?