@cortexkit/opencode-magic-context 0.45.0 → 0.46.1

package/src/config/schema/magic-context.test.ts

@@ -9,6 +9,25 @@ import {
 } from "./magic-context";
 
 describe("MagicContextConfigSchema", () => {
+    it("documents that Rust transform mode always keeps the shared data directory private", () => {
+        const inputSchema = MagicContextConfigSchema._def.in as unknown as {
+            shape: {
+                storage: {
+                    unwrap: () => {
+                        shape: {
+                            enforce_private_permissions: { description?: string };
+                        };
+                    };
+                };
+            };
+        };
+        const description =
+            inputSchema.shape.storage.unwrap().shape.enforce_private_permissions.description ?? "";
+        expect(description).toContain("Rust transform mode");
+        expect(description).toContain("always keeps the shared data directory owner-only 0700");
+        expect(description).toContain("regardless of this setting");
+    });
+
     describe("defaults", () => {
         it("applies defaults for an empty config", () => {
             const result = MagicContextConfigSchema.parse({});
@@ -166,7 +185,7 @@ describe("MagicContextConfigSchema", () => {
 
             const result = MagicContextConfigSchema.parse(input);
 
-            expect(result).toEqual(input);
+            expect(result).toEqual({ ...input, protected_tools: { todowrite: 1, ctx_reduce: 3 } });
         });
 
         it("accepts a boolean storage permission policy and rejects non-booleans", () => {

package/src/config/schema/magic-context.ts

@@ -8,6 +8,7 @@ import type {
 } from "../../features/magic-context/dreamer/task-registry";
 import { toolTemplateError } from "../../shared/historian-tool-template";
 import { isValidPromptSurfaceModelKey } from "../../shared/prompt-surface";
+import { DEFAULT_PROTECTED_TOOLS, mergeProtectedTools } from "../../shared/protected-tools-policy";
 import { AgentOverrideConfigSchema } from "./agent-overrides";
 
 export const DEFAULT_EXECUTE_THRESHOLD_PERCENTAGE = 65;
@@ -640,6 +641,10 @@ const AgentMetadataSchema = AgentOverrideConfigSchema.pick({
 
 /** Combined dreamer metadata plus independent strict execution blocks. */
 export const DreamerConfigSchema = AgentMetadataSchema.extend({
+    // Its own node rather than the one shared with the historian through
+    // AgentMetadataSchema: `dreamer.disable` is a live-reload key and the
+    // historian's is not, and the live marker is set on the schema node.
+    disable: z.boolean().optional().describe("Disable this agent"),
     runner: z
         .enum(["broca", "host"])
         .optional()
@@ -918,6 +923,8 @@ export interface MuralConfig {
 }
 
 export interface MagicContextConfig {
+    /** The loader sets this to distinguish an explicit `5m` from the built-in default; users do not configure it. */
+    cacheTtlConfigured?: boolean;
     enabled: boolean;
     /** User-level setting that lets a session in the canonical home directory use project memory. */
     allow_home_project: boolean;
@@ -955,6 +962,7 @@ export interface MagicContextConfig {
     execute_threshold_tokens?: { default?: number; [modelKey: string]: number | undefined };
     protected_tokens?: number;
     protected_tags?: number;
+    protected_tools: Record<string, number>;
     clear_reasoning_age: number;
     history_budget_percentage: number;
     historian_timeout_ms: number;
@@ -1038,7 +1046,8 @@ export interface MagicContextConfig {
      *  on its own; when off, the messages sent to the model are byte-identical to
      *  the age-based-only behavior. Experimental, opt-in, default off until cache
      *  stability is proven. */
-    smart_drops: boolean;
+    /** Deprecated and ignored: supersession reclaim is always on. */
+    smart_drops?: unknown;
     /**
      * Age-tier caveman compression for long user/assistant text parts.
      * Graduated from `experimental.caveman_text_compression`; opt-in, default off.
@@ -1187,7 +1196,7 @@ export const MagicContextConfigSchema = z
             .union([z.string(), z.object({ default: z.string() }).catchall(z.string())])
             .default("5m")
             .describe(
-                'How long Magic Context assumes the provider\'s cached prefix stays valid. This is MC\'s own deferral gate — it does not change the provider\'s actual cache lifetime. String (e.g. "5m", "1h", "30s") or per-model object ({ default: "5m", "provider/model": "1h", "provider/*": "never" }); keys resolve most-specific first (exact provider/model, bare model ID, shorter dash-prefixes, then the provider/* wildcard). Explicit per-model entries win; otherwise GPT-5.6 and later (including gpt-6*, through any provider prefix) use a built-in 30m lifetime before the object default or 5m fallback. An unset or global "5m" opts into built-in defaults; any other global string is an explicit policy and wins. Policy is frozen per session, including across restarts; a model switch resolves against that frozen policy. /ctx-status shows the effective value and source. OpenAI documents at least 30 minutes since the latest write or reuse: https://developers.openai.com/api/docs/guides/prompt-caching (Cache lifetime and Summary of model differences). Set to "never" to mean MC never assumes expiry (for lanes kept warm externally by a cache-keep tool) — disables the idle-TTL heuristic so MC never initiates a rebuild based on elapsed time. Provider-side extended TTL is a separate request-level concern (cache_control: { ttl } in the request body).',
+                'How long Magic Context assumes the provider\'s cached prefix stays valid. This is MC\'s own deferral gate — it does not change the provider\'s actual cache lifetime. String (e.g. "5m", "1h", "30s") or per-model object ({ default: "5m", "provider/model": "1h", "provider/*": "never" }); keys resolve most-specific first (exact provider/model, bare model ID, shorter dash-prefixes, then the provider/* wildcard, then default). User and project settings, including an explicit "5m" or object default, apply on the next pass. Only built-in defaults are frozen per session, including across restarts: when unset, GPT-5.6 and later (including gpt-6*, through any provider prefix) use 30m, other models use 5m. /ctx-status shows the effective TTL and whether it comes from your config or a frozen built-in default. Editing the TTL does not itself rewrite prompt bytes; a lowered TTL rebuilds only after normal idle expiry. OpenAI documents at least 30 minutes since the latest write or reuse: https://developers.openai.com/api/docs/guides/prompt-caching (Cache lifetime and Summary of model differences). Set to "never" to mean MC never assumes expiry (for lanes kept warm externally by a cache-keep tool) — disables the idle-TTL heuristic so MC never initiates a rebuild based on elapsed time. Provider-side extended TTL is a separate request-level concern (cache_control: { ttl } in the request body).',
             ),
         prompt_surface: PromptSurfaceConfigSchema.default({ default: "full" }).describe(
             "Prompt-surface presets: default is full; models use bare model IDs, provider/model, or provider/* routing keys. Guidance and tool-description overrides are user-level only. OpenCode 1.x, Pi, and OMP register tool descriptions once per process (they follow the default preset). OpenCode 2 rewrites the five ctx_* descriptions per request from the draft model.",
@@ -1346,12 +1355,12 @@ export const MagicContextConfigSchema = z
                     .boolean()
                     .default(true)
                     .describe(
-                        "When true (default), Magic Context creates and re-tightens its storage directories to owner-only 0700 and storage files to owner-only 0600. Set false only for a deliberate trusted-group deployment whose operator manages directory, database, WAL/SHM, cache, and RPC file permissions externally; Magic Context then never chmods or supplies restrictive creation modes. USER-LEVEL ONLY — ignored in project config for security. On Windows, POSIX chmod modes are already meaningless, so this setting is a no-op.",
+                        "When true (default), Magic Context creates and re-tightens its TypeScript-mode storage directories to owner-only 0700 and storage files to owner-only 0600. Set false only for a deliberate trusted-group deployment whose operator manages those files externally; in TypeScript mode Magic Context then skips its own creation modes and recursive tightening. In Rust transform mode, ck-mc's store library always keeps the shared data directory owner-only 0700, regardless of this setting. USER-LEVEL ONLY — ignored in project config for security. On Windows, POSIX chmod modes are already meaningless, so this setting is a no-op.",
                     ),
             })
             .default({ enforce_private_permissions: true })
             .describe(
-                "Storage permission policy. The default keeps session content and memories owner-private. Disabling enforcement is for trusted shared-group storage managed externally; every group member able to read the storage can read all stored session content and memories.",
+                "Storage permission policy. The default keeps session content and memories owner-private. Disabling enforcement is for trusted shared-group storage managed externally; TypeScript mode follows that policy, but Rust transform mode always keeps its shared data directory owner-only because ck-mc's store library enforces it.",
             ),
         embedding: EmbeddingConfigSchema.default({
             provider: "local",
@@ -1438,10 +1447,18 @@ export const MagicContextConfigSchema = z
             "Pi-only child-process extension controls. This setting is user-level only; project configuration cannot choose which extensions a user's subagent children load.",
         ),
         smart_drops: z
-            .boolean()
-            .default(false)
+            .unknown()
+            .optional()
+            .describe(
+                "Deprecated: ignored. Content-aware supersession reclaim is always on, only on passes already rebuilding the cache. Remove this key; it no longer does anything.",
+            )
+            .meta({ deprecated: true }),
+        protected_tools: z
+            .record(z.string(), z.number().int().nonnegative())
+            .default({ ...DEFAULT_PROTECTED_TOOLS })
+            .transform((map) => mergeProtectedTools(map))
             .describe(
-                "Content-aware reclaim of provably-superseded tool output, layered on the existing execute-pass auto-drop. When on: superseded todowrite (keep newest 1), spent ctx_reduce (keep newest 3), and zero-value meta (bash_status, bash_kill, ctx_note read/dismiss) outputs are dropped; older edits to a file are compressed to a filePath-preserving marker while the newest edit per file stays full. Only acts on passes already busting the cache, so it never originates a cache bust. Honors the protected-tag reserve. Experimental: opt-in, default off until cache stability is proven; when off the wire is byte-identical to the positional-only reclaim. Requires a restart.",
+                "Keep each tool's newest N still-active results in every automatic drop lane (issue 621). User and project maps merge over defaults {todowrite: 1, ctx_reduce: 3}; 0 turns protection off. Names are case-insensitive and ignore leading mcp_. Holds even at 95% pressure, with no byte cap: large protected outputs can reach refusal sooner. Queued drops, from the agent or historian publication, are held until newer calls displace the result and a later cache-rebuilding pass applies them. The historian's summary is unaffected; the raw result leaves at the next fold. Frozen strips are unaffected. Changes and rotation never originate a bust; dropped results are never restored.",
             ),
         caveman_text_compression: z
             .object({
@@ -1571,6 +1588,7 @@ export const MagicContextConfigSchema = z
 
 /** Settings whose fresh values can be used by later agent runs without changing rendered prompt bytes. */
 export const LIVE_RELOAD_CONFIG_PATHS = [
+    "cache_ttl",
     "mural.model",
     "toast_duration_ms",
     "historian.opencode.model",
@@ -1589,6 +1607,7 @@ export const LIVE_RELOAD_CONFIG_PATHS = [
     "commit_cluster_trigger.enabled",
     "commit_cluster_trigger.min_clusters",
     "memory.auto_promote",
+    "dreamer.disable",
     "dreamer.maxTokens",
     "dreamer.opencode.model",
     "dreamer.opencode.fallback_models",

package/src/shared/announcement.ts

@@ -15,10 +15,11 @@
  * Leave both empty (`""` and `[]`) to skip the dialog entirely.
  */
 
-import * as fs from "node:fs";
+import { existsSync, readFileSync } from "node:fs";
 import * as path from "node:path";
 import { compareSemverCore } from "../hooks/auto-update-checker/semver";
 import { getMagicContextStorageDir } from "./data-path";
+import { ensureStorageDirectorySync, writeStorageFileAtomicSync } from "./storage-permissions";
 
 /**
  * Bump only when there are user-visible changes worth a startup dialog.
@@ -60,8 +61,8 @@ type AnnouncementStateRead =
 function readAnnouncementState(): AnnouncementStateRead {
     try {
         const file = getStateFilePath();
-        if (!fs.existsSync(file)) return { status: "missing" };
-        const version = fs.readFileSync(file, "utf-8").trim();
+        if (!existsSync(file)) return { status: "missing" };
+        const version = readFileSync(file, "utf-8").trim();
         if (!version) return { status: "error" };
         return { status: "valid", version };
     } catch {
@@ -88,8 +89,8 @@ export function markAnnouncementSeen(version: string): void {
     if (!version) return;
     try {
         const dir = getMagicContextStorageDir();
-        fs.mkdirSync(dir, { recursive: true });
-        fs.writeFileSync(getStateFilePath(), version);
+        ensureStorageDirectorySync(dir);
+        writeStorageFileAtomicSync(getStateFilePath(), version);
     } catch {
         // best-effort
     }

package/src/shared/cache-ttl-display.test.ts

@@ -45,7 +45,7 @@ describe("resolveCacheTtlDisplay", () => {
         });
 
         expect(configured.source).toBe("config");
-        expect(session).toEqual({ value: "45m", source: "session", modelKey });
+        expect(session).toEqual({ value: "1h", source: "config", modelKey });
         expect(fallback).toEqual({ value: "5m", source: "default", modelKey });
     });
 

package/src/shared/cache-ttl-display.ts

@@ -10,7 +10,7 @@ export interface CacheTtlDisplay {
 }
 
 export interface ResolveCacheTtlDisplayArgs {
-    frozen?: ResolvedCacheTtl;
+    frozen?: ResolvedCacheTtl & { builtInDefault?: ResolvedCacheTtl };
     configured: MagicContextConfig["cache_ttl"];
     configuredExplicitly: boolean;
     modelKey: string | undefined;
@@ -20,12 +20,22 @@ export interface ResolveCacheTtlDisplayArgs {
 }
 
 /**
- * Resolve status-only TTL text without changing the scheduler's persisted truth.
- * Use the session value only when its persisted model key matches the model being
- * displayed; otherwise use live config because the session value may be for another model.
+ * Resolve the lifetime shown in status without changing the value saved for the scheduler.
+ * The next pass uses current settings; a saved built-in lifetime applies only to the same
+ * model, even after an override is removed.
  */
 export function resolveCacheTtlDisplay(args: ResolveCacheTtlDisplayArgs): CacheTtlDisplay {
-    if (args.frozen) return args.frozen;
+    const resolved = resolveModelCacheTtl(
+        args.configured,
+        args.modelKey,
+        args.configuredExplicitly,
+    );
+    if (resolved.source === "config") return resolved;
+    if (args.frozen && (!args.modelKey || args.frozen.modelKey === args.modelKey)) {
+        return args.frozen.source === "config"
+            ? (args.frozen.builtInDefault ?? resolved)
+            : args.frozen;
+    }
     if (
         (args.sessionModelKey && (!args.modelKey || args.sessionModelKey === args.modelKey)) ||
         (!args.modelKey && !args.sessionModelKey && args.sessionValue !== "5m")
@@ -37,22 +47,13 @@ export function resolveCacheTtlDisplay(args: ResolveCacheTtlDisplayArgs): CacheT
         };
     }
 
-    const resolved = resolveModelCacheTtl(args.configured, args.modelKey);
-    if (
-        resolved.source === "default" &&
-        typeof args.configured === "string" &&
-        args.configuredExplicitly
-    )
-        return { ...resolved, source: "config" };
     return resolved;
 }
 
 export function formatCacheTtlDisplay(display: CacheTtlDisplay): string {
-    if (display.source === "OpenAI GPT-5.6+ default")
-        return `Cache TTL: ${display.value} (${display.source})`;
     if (display.source === "session") return `Cache TTL: ${display.value} (session)`;
     if (display.source === "config") {
-        return `Cache TTL: ${display.value} (config for ${display.modelKey ?? "current model"})`;
+        return `Cache TTL: ${display.value} (your config)`;
     }
-    return `Cache TTL: ${display.value} (default — no cache_ttl for ${display.modelKey ?? "unknown model"})`;
+    return `Cache TTL: ${display.value} (built-in default, frozen for this session)`;
 }

package/src/shared/fold-render-lock-fence.test.ts

@@ -0,0 +1,84 @@
+import { expect, test } from "bun:test";
+import { readFileSync } from "node:fs";
+import { resolve } from "node:path";
+import ts from "typescript";
+
+const root = resolve(import.meta.dir, "../../../../");
+
+for (const [host, path, functions] of [
+    [
+        "OpenCode",
+        "packages/plugin/src/hooks/magic-context/inject-compartments.ts",
+        ["materializeM0", "softRefreshCachedM1"],
+    ],
+    [
+        "Pi",
+        "packages/pi-plugin/src/inject-compartments-pi.ts",
+        ["materializeM0Pi", "softRefreshCachedM1Pi"],
+    ],
+] as const) {
+    test(`${host} fold and refresh render m[1] inside their writer section`, () => {
+        const source = ts.createSourceFile(
+            path,
+            readFileSync(resolve(root, path), "utf8"),
+            ts.ScriptTarget.Latest,
+            true,
+        );
+        const inspected: string[] = [];
+        const violations: string[] = [];
+        function visit(node: ts.Node): void {
+            if (
+                ts.isFunctionDeclaration(node) &&
+                node.name &&
+                functions.some((name) => name === node.name?.text)
+            ) {
+                inspected.push(node.name.text);
+                const calls: ts.CallExpression[] = [];
+                function collect(child: ts.Node): void {
+                    if (ts.isCallExpression(child)) calls.push(child);
+                    ts.forEachChild(child, collect);
+                }
+                collect(node);
+                const admission = calls.find(
+                    (call) =>
+                        call.expression.getText(source).endsWith(".exec") &&
+                        call.arguments[0]?.getText(source) === '"BEGIN IMMEDIATE"',
+                );
+                expect(admission).toBeDefined();
+                const commit = calls.find(
+                    (call) =>
+                        admission &&
+                        call.pos > admission.pos &&
+                        call.expression.getText(source).endsWith(".exec") &&
+                        call.arguments[0]?.getText(source) === '"COMMIT"',
+                );
+                expect(commit).toBeDefined();
+                const renders = calls.filter((call) =>
+                    /^renderM1(?:Pi)?WithMetadata$/.test(call.expression.getText(source)),
+                );
+                expect(renders).toHaveLength(1);
+                for (const render of renders) {
+                    if (
+                        !admission ||
+                        !commit ||
+                        render.pos < admission.pos ||
+                        render.pos > commit.pos
+                    )
+                        violations.push(`${node.name.text}: m[1] render outside writer`);
+                }
+                for (const call of calls) {
+                    if (
+                        call.expression.getText(source).endsWith("onFoldPrepare") &&
+                        admission &&
+                        call.pos > admission.pos
+                    )
+                        violations.push(`${node.name.text}: wire preparation inside writer`);
+                }
+            }
+            ts.forEachChild(node, visit);
+        }
+        visit(source);
+        expect(inspected.sort()).toEqual([...functions].sort());
+        expect(violations).toEqual([]);
+    });
+}

package/src/shared/fold-render-lock-fixtures.test.ts

@@ -0,0 +1,276 @@
+import { expect, test } from "bun:test";
+import { rmSync } from "node:fs";
+import { tmpdir } from "node:os";
+import { join } from "node:path";
+import { appendCompartments } from "../features/magic-context/compartment-storage";
+import {
+    insertMemory,
+    setMemoryClassification,
+    updateMemorySeenCount,
+    updateMemoryVerification,
+} from "../features/magic-context/memory/storage-memory";
+import {
+    recordIndexedMessageTime,
+    recordMessageFtsRowid,
+} from "../features/magic-context/message-fts-rowid-map";
+import { runMigrations } from "../features/magic-context/migrations";
+import { getOrCreateSessionMeta } from "../features/magic-context/storage";
+import { initializeDatabase } from "../features/magic-context/storage-db";
+import { recoverUnresolvedCompartments } from "../features/magic-context/store-generation-rebase";
+import { renderMemoryBlockV2 } from "../hooks/magic-context/inject-compartments";
+import { estimateTokens } from "../hooks/magic-context/read-session-formatting";
+import { Database } from "./sqlite";
+import { createTestTempDirFromPath } from "./test-temp-dir";
+
+export interface LockedDeltaFixture {
+    db: Database;
+    sibling: Database;
+    directory: string;
+    sessionId: string;
+    projectPath: string;
+    close: () => void;
+}
+
+export function createLockedDeltaFixture(
+    label: string,
+    open?: (path: string) => Database,
+): LockedDeltaFixture {
+    const directory = createTestTempDirFromPath(join(tmpdir(), `mc-locked-delta-${label}-`));
+    const path = join(directory, "context.db");
+    const db = open ? open(path) : new Database(path);
+    if (!open) {
+        initializeDatabase(db);
+        runMigrations(db);
+    }
+    db.exec("PRAGMA journal_mode=WAL");
+    const sibling = new Database(path);
+    const sessionId = label;
+    const projectPath = "git:locked-delta";
+    getOrCreateSessionMeta(db, sessionId);
+    return {
+        db,
+        sibling,
+        directory,
+        sessionId,
+        projectPath,
+        close: () => {
+            sibling.close();
+            db.close();
+            rmSync(directory, { recursive: true, force: true });
+        },
+    };
+}
+export interface LockedDeltaOptions {
+    memoryBudget?: number;
+    temporalAwareness?: boolean;
+}
+interface LockedDeltaDriver<Markers> {
+    host: string;
+    create: (label: string) => LockedDeltaFixture;
+    materialize: (fixture: LockedDeltaFixture, options: LockedDeltaOptions) => Markers;
+    refresh: (
+        fixture: LockedDeltaFixture,
+        options: LockedDeltaOptions,
+        beforeAdmission: () => void,
+    ) => void;
+    render: (fixture: LockedDeltaFixture, options: LockedDeltaOptions, markers: Markers) => string;
+    temporalHeadings?: boolean;
+}
+function compartment() {
+    return {
+        sequence: 0,
+        startMessage: 1,
+        endMessage: 2,
+        startMessageId: "a",
+        endMessageId: "b",
+        title: "locked history",
+        content: "locked history",
+        p1: "locked history",
+        p2: "summary",
+        p3: "outcome",
+        p4: "anchor",
+        legacy: 0,
+    };
+}
+function persistedDelta(f: LockedDeltaFixture): string {
+    return getOrCreateSessionMeta(f.db, f.sessionId).cachedM1Bytes?.toString("utf8") ?? "";
+}
+function refreshAtAdmission<Markers>(
+    driver: LockedDeltaDriver<Markers>,
+    f: LockedDeltaFixture,
+    options: LockedDeltaOptions,
+    write: () => void,
+) {
+    let admissions = 0;
+    let hooks = 0;
+    const exec = f.db.exec.bind(f.db);
+    f.db.exec = (sql) => {
+        if (sql === "BEGIN IMMEDIATE") admissions++;
+        return exec(sql);
+    };
+    try {
+        driver.refresh(f, options, () => {
+            expect(admissions).toBe(0);
+            hooks++;
+            write();
+        });
+        expect(hooks).toBe(1);
+        expect(admissions).toBe(1);
+    } finally {
+        f.db.exec = exec;
+    }
+}
+
+/** These fixtures use real sibling writes, then compare persisted bytes to an independent live render. */
+export function registerLockedDeltaRegressions<Markers>(driver: LockedDeltaDriver<Markers>): void {
+    for (const change of ["importance", "reinforcement", "verification"] as const) {
+        test(`${driver.host} m[1] reads memory ${change} under its writer`, () => {
+            const f = driver.create(`${driver.host}-${change}`);
+            try {
+                const sample = insertMemory(f.db, {
+                    projectPath: "git:budget-only",
+                    category: "ARCHITECTURE",
+                    content: "candidate A ".repeat(40),
+                });
+                const options = {
+                    memoryBudget:
+                        4 * (estimateTokens(renderMemoryBlockV2([sample], "new-memories")) + 2),
+                };
+                const markers = driver.materialize(f, options);
+                const a = insertMemory(f.db, {
+                    projectPath: f.projectPath,
+                    category: "ARCHITECTURE",
+                    content: "candidate A ".repeat(40),
+                });
+                const b = insertMemory(f.db, {
+                    projectPath: f.projectPath,
+                    category: "ARCHITECTURE",
+                    content: "candidate B ".repeat(40),
+                });
+                setMemoryClassification(f.db, a.id, { importance: 50 });
+                setMemoryClassification(f.db, b.id, { importance: 50 });
+                f.db
+                    .prepare(
+                        "UPDATE memories SET last_seen_at = CASE WHEN id = ? THEN 1000 ELSE 0 END, verified_at = NULL WHERE id IN (?, ?)",
+                    )
+                    .run(a.id, a.id, b.id);
+                const before = driver.render(f, options, markers);
+                expect(before).toContain("candidate A");
+                expect(before).not.toContain("candidate B");
+                refreshAtAdmission(driver, f, options, () => {
+                    if (change === "importance")
+                        setMemoryClassification(f.sibling, b.id, { importance: 100 });
+                    else if (change === "reinforcement") updateMemorySeenCount(f.sibling, b.id);
+                    else updateMemoryVerification(f.sibling, b.id, "verified");
+                });
+                const fresh = driver.render(f, options, markers);
+                expect(fresh).toContain("candidate B");
+                expect(fresh).not.toContain("candidate A");
+                expect(persistedDelta(f)).toBe(fresh);
+                expect(persistedDelta(f)).not.toBe(before);
+            } finally {
+                f.close();
+            }
+        });
+    }
+
+    test(`${driver.host} m[1] reads in-place recovered compartment ranges under its writer`, () => {
+        const f = driver.create(`${driver.host}-ranges`);
+        try {
+            const options = {};
+            const markers = driver.materialize(f, options);
+            appendCompartments(f.db, f.sessionId, [compartment()]);
+            f.db
+                .prepare(
+                    "UPDATE compartments SET rebase_status = 'unresolved' WHERE session_id = ?",
+                )
+                .run(f.sessionId);
+            const before = driver.render(f, options, markers);
+            expect(before).toContain("## 1-2");
+            const revision = f.db
+                .prepare("SELECT version FROM compartment_history_versions WHERE session_id = ?")
+                .get(f.sessionId) as { version: number };
+            refreshAtAdmission(driver, f, options, () => {
+                const recovered = recoverUnresolvedCompartments({
+                    db: f.sibling,
+                    sessionId: f.sessionId,
+                    resolveOrdinal: (id) => (id === "a" ? 3 : id === "b" ? 4 : undefined),
+                    reason: "Recovered fixture anchors",
+                });
+                expect(recovered.rowsRewritten).toBe(1);
+            });
+            const updated = f.db
+                .prepare("SELECT version FROM compartment_history_versions WHERE session_id = ?")
+                .get(f.sessionId) as { version: number };
+            expect(updated.version).toBeGreaterThan(revision.version);
+            const fresh = driver.render(f, options, markers);
+            expect(fresh).toContain("## 3-4");
+            expect(fresh).not.toContain("## 1-2");
+            expect(persistedDelta(f)).toBe(fresh);
+        } finally {
+            f.close();
+        }
+    });
+
+    test(`${driver.host} m[1] uses the baseline cutoff for a newly expired additive memory`, () => {
+        const f = driver.create(`${driver.host}-expiry`);
+        const realNow = Date.now;
+        let now = 1000;
+        Date.now = () => now;
+        try {
+            const options = {};
+            const markers = driver.materialize(f, options);
+            now = 2000;
+            const before = driver.render(f, options, markers);
+            expect(before).not.toContain("eligible at the baseline cutoff");
+            refreshAtAdmission(driver, f, options, () => {
+                insertMemory(f.sibling, {
+                    projectPath: f.projectPath,
+                    category: "ARCHITECTURE",
+                    content: "Memory eligible at the baseline cutoff",
+                    expiresAt: 2500,
+                });
+                now = 3000;
+            });
+            const fresh = driver.render(f, options, markers);
+            expect(fresh).toContain("eligible at the baseline cutoff");
+            expect(persistedDelta(f)).toBe(fresh);
+        } finally {
+            Date.now = realNow;
+            f.close();
+        }
+    });
+
+    if (driver.temporalHeadings) {
+        test(`${driver.host} m[1] reads indexed temporal headings under its writer`, () => {
+            const f = driver.create(`${driver.host}-dates`);
+            const originalXdgDataHome = process.env.XDG_DATA_HOME;
+            process.env.XDG_DATA_HOME = f.directory;
+            try {
+                const options = { temporalAwareness: true };
+                const markers = driver.materialize(f, options);
+                appendCompartments(f.db, f.sessionId, [compartment()]);
+                for (const ordinal of [1, 2])
+                    recordMessageFtsRowid(f.db, f.sessionId, ordinal, ordinal);
+                const before = driver.render(f, options, markers);
+                expect(before).not.toContain("2025-01-01");
+                refreshAtAdmission(driver, f, options, () => {
+                    for (const ordinal of [1, 2])
+                        recordIndexedMessageTime(
+                            f.sibling,
+                            f.sessionId,
+                            ordinal,
+                            Date.UTC(2025, 0, 1),
+                        );
+                });
+                const fresh = driver.render(f, options, markers);
+                expect(fresh).toContain("2025-01-01");
+                expect(persistedDelta(f)).toBe(fresh);
+            } finally {
+                if (originalXdgDataHome === undefined) delete process.env.XDG_DATA_HOME;
+                else process.env.XDG_DATA_HOME = originalXdgDataHome;
+                f.close();
+            }
+        });
+    }
+}

package/src/shared/model-cache-ttl.test.ts

@@ -29,8 +29,8 @@ describe("known model cache TTL", () => {
         expect(resolveCacheTtl("5m", "openai/gpt-6")).toBe("30m");
         expect(resolveCacheTtl("10m", "openai/gpt-6")).toBe("10m");
     });
-    it("honors per-model entries before built-ins and built-ins before object defaults", () => {
-        expect(resolveCacheTtl({ default: "10m" }, "openai/gpt-6")).toBe("30m");
+    it("honors per-model entries and configured defaults before built-ins", () => {
+        expect(resolveCacheTtl({ default: "10m" }, "openai/gpt-6")).toBe("10m");
         expect(resolveCacheTtl({ default: "10m", "gpt-6": "5m" }, "openai/gpt-6")).toBe("5m");
         expect(resolveCacheTtl({ default: "10m", "openai/*": "never" }, "openai/gpt-6")).toBe(
             "never",

package/src/shared/model-cache-ttl.ts

@@ -28,6 +28,8 @@ const MODEL_CACHE_LIFETIMES = [
 export function resolveModelCacheTtl(
     config: CacheTtlConfig | undefined,
     modelKey: string | undefined,
+    configuredExplicitly = typeof config === "object" ||
+        (typeof config === "string" && config !== "5m"),
 ): ResolvedCacheTtl {
     if (config && typeof config !== "string") {
         const match =
@@ -37,11 +39,13 @@ export function resolveModelCacheTtl(
             modelKey !== "default"
                 ? config[modelKey]
                 : resolveModelConfigValue(config, modelKey)?.value;
-        if (match !== undefined) return { value: match, source: "config", modelKey };
+        const value = match ?? config.default;
+        if (value !== undefined && configuredExplicitly)
+            return { value, source: "config", modelKey };
     }
-    // A non-5m global string is an explicit policy. The generic 5m default is
-    // not evidence of provider eviction: documented lifetimes avoid paid rewrites.
-    if (typeof config === "string" && config !== "5m")
+    // The loader supplies provenance: an explicit 5m is policy too. Older callers
+    // without that bit still distinguish non-default strings from the schema's 5m.
+    if (typeof config === "string" && configuredExplicitly)
         return { value: config, source: "config", modelKey };
     const model =
         canonicalModelIdentity(modelKey ?? "")