draken 0.6.0 → 0.8.0

package/CHANGELOG.md

@@ -1,5 +1,48 @@
 # Changelog
 
+## 0.8.0
+
+### Live history without rewriting the sync
+
+- Active text and voice conversations adopt newly **prepared original history** between user turns as dated H evidence. Each answer pins one history cutoff; updates do not interrupt an ongoing reply or disable already-prepared chat. The initial snapshot, E/C references, briefing, saved transcript and notes are not rewritten by updates. Initial briefing and history preparation are still required once.
+- Fix readiness invalidation from ordinary source appends and background scan cursor changes. Damaged, missing or excluded captured originals still fail closed. If additional archive lookup is unavailable during an update, replies must qualify that limitation rather than guess or silently substitute old context.
+- With **Automatically index history** enabled, active conversations check once a minute for any positive source changes, without waiting for 64. Connected, idle voice can allow local background work between turns, never during a pending response or context delivery; a user turn preempts and drains owned indexing. With no active conversation, the 64-record threshold and no timed small-tail flush remain.
+- Live H updates are local-only, not per-minute provider calls. **Prepare summaries ahead** remains a separate default-off paid permission with its independent 64-record threshold. Neither background path creates syncs, final briefings, recaps, saved decisions or review. Settings/status GETs remain metadata-only.
+
+### Sessions end without marking work reviewed
+
+- End a conversation after 30 minutes without a real user chat message or voice turn; initial creation counts as initial intent. Polling, background updates, assistant responses and connection heartbeats do not extend it. An ongoing reply finishes before idle expiry.
+- Show **Session ended**, not reviewed or completed. Keep the transcript readable and explicit notes/review available for the old snapshot. Return home and **Start new sync** to chat again; replay, polling and reopening cannot revive an ended session.
+- Persist last user activity and the ended marker across restarts, separately from existing open/completed/discarded review status. Idle ending releases unreviewed reservations for the next explicit sync, without deleting history, changing notes or generating an automatic recap/review. Migration derives activity from stored real user turns; inactive older sessions may end and their unreviewed entries become available again.
+- Simple live status is **Up to date**, **Preparing new info…** or **New info ready**, with honest off/unavailable states where applicable. Voice's separate 30-minute connection limit, 60-turn cap and 90-second disconnect lease remain resource bounds, not unlimited calling or spending guarantees.
+
+### Upgrading and qualification
+
+Back up original agent logs and Draken state, finish active work, stop the server (including any tray-owned server), install 0.8.0 and restart with the same data directory and environment. Node.js 22.19+ remains required. The conversation lifecycle migration is additive; existing review statuses and historical data remain intact. No dependency changes. See [SETUP.md](SETUP.md#upgrade-to-080) and [MEMORY.md](MEMORY.md#live-conversations-and-idle-ending).
+
+Focused coverage includes conversation lifecycle, append-safe readiness and between-turn voice updates, alongside existing activity/indexing regressions. Package and static-site checks protect release copy and fresh paid opt-out. Synthetic checks do not establish real-provider answer quality, latency, quota or physical-device audio acceptance.
+
+## 0.7.0
+
+### Optional paid summary preparation, without automatic syncs
+
+- Add **Settings → Prepare summaries ahead**, a NEW explicit paid opt-in (`auto_summary`), default **off** on fresh installs and upgrades—even when `auto_index=true` or the retired 0.5 paid setting was enabled. It requires **Automatically index history** to be enabled. Local indexing keeps its existing defaults/preferences and makes no provider calls by itself.
+- While idle, check once a minute and prepare at least 64 new/changed eligible accumulated records, independently of the local embedding checkpoint. Warm the same validated `summary_cache` leaves, reconciliation and compact final input used by explicit syncs. Background preparation does not own or create syncs, snapshots, coverage, messages or tree rows, and never runs the final model, briefings or recaps.
+- Reuse completed closed chunks across appends and make no further calls for unchanged prepared input while its validated cache remains intact. Lost or corrupt cache outputs trigger a bounded rebuild rather than postponing recovery until Start chat. Changed unfinished per-session tails and aggregate reconciliation may still need on-demand work at **Start chat**; the final briefing is always explicit. This reduces repeated preparation, not a promise of instant chat.
+- Bound paid work by the configured summary model and the same `max_invocations` allowance, without provider/model fallback. Foreground work cancels and awaits owned background provider work. Valid cache survives cancellation/restarts; spending is retained when resuming the same interrupted input. Paid failures pause retries until an explicit retry; local indexing failures retain their five-minute retry delay. Disabling either setting stops paid background work without deleting cache.
+
+### Durable accounting and preservation
+
+- Add metadata-only `background_runs` for durable input hashes, invocation counters and metrics, not source text. **Preparation usage** includes background spend, requests and failures. `completed_batches` remains the count of explicit snapshots' first successful briefings; a warm cache is neither a sync nor review.
+- Settings/progress GETs only read metadata. Existing histories, conversations, notes, coverage, frozen snapshots and compatible caches are preserved. No dependency changes.
+- Focused regressions: `tests/background-tree.test.cjs`, `tests/background-preparation.test.cjs` and `tests/automatic-index.test.cjs`; production-package and static-site checks protect default-off consent and release copy. Synthetic checks do not establish real-provider quality, latency, quota or physical-audio acceptance.
+
+### Upgrading
+
+Back up original agent logs and Draken state, finish active work, stop the server (including any tray-owned server), install 0.7.0 and restart with the same data directory and environment. Node.js 22.19+ remains required. To get preparation ahead, keep **Automatically index history** enabled and explicitly enable the NEW **Prepare summaries ahead** switch; upgrading never converts local indexing or retired paid consent into this permission. Leaving it off keeps provider use tied to explicit preparation/conversation actions. Do not use an older binary to undo the additive schema change. See [SETUP.md](SETUP.md#upgrade-to-070) and [MEMORY.md](MEMORY.md#optional-paid-summary-preparation).
+
+Previously oversized summary batches split at a moving midpoint may need one-time recomputation. The new stable-prefix planner preserves completed boundaries on future appends; ordinary batch keys and compatible historical leaf caches are retained.
+
 ## 0.6.0
 
 ### User-triggered syncs, automatic local indexing

package/MEMORY.md

@@ -4,11 +4,11 @@
 
 There is no memory-enable switch, search-mode selector or wider-history checkbox. An existing sync offers **Prepare history** when its call history is not ready. Historical retrieval does not replace the complete-snapshot summary tree or advance review coverage.
 
-## Automatic preparation
+## Automatic local search preparation
 
 The first request with eligible retained history downloads approximately **136 MB** of pinned model/tokenizer files from Hugging Face, verifies their SHA-256 checksums and prepares local embeddings. Later requests reuse them and automatically embed new or changed records. Empty history does not require a model download.
 
-Search combines meaning and exact keywords every time. It waits for both indexes rather than quietly returning keyword-only results while semantic work is incomplete. First use or a large amount of newly collected history can take minutes. Search, text-reply preparation and pre-call preparation show the current phase, model-download bytes or completed/total **new or changed unique passages**, unchanged cached work separately, elapsed time and an approximate remaining time once enough passages have been measured. The estimate can change with passage length. Progress is read-only metadata; polling it does not start indexing. **Call Draken stays disabled until both the briefing and searchable history are ready.** Sync preparation includes history preparation; an older or changed sync offers **Prepare history**, with progress and cancellation on the sync page, not inside a call. Call creation checks readiness again and rejects unprepared history without starting a call or building an index. Cancelling or failing preparation leaves the microphone off. Ordinary concurrent requests queue behind one history process, within a fixed bound. Its embedding lanes run bounded batches in parallel; they do not run concurrent database writers. An unchanged index shows **History is up to date**, not a full-archive progress bar.
+Search combines meaning and exact keywords every time. It waits for both indexes rather than quietly returning keyword-only results while semantic work is incomplete. First use or a large amount of newly collected history can take minutes. Search, text-reply preparation and pre-call preparation show the current phase, model-download bytes or completed/total **new or changed unique passages**, unchanged cached work separately, elapsed time and an approximate remaining time once enough passages have been measured. The estimate can change with passage length. Progress is read-only metadata; polling it does not start indexing. **Initial calling/chat requires both the briefing and searchable history to be ready.** Later append-only updates do not disable an already-prepared conversation. Sync preparation includes history preparation; an older or changed sync offers **Prepare history**, with progress and cancellation on the sync page, not inside a call. Call creation checks readiness again and rejects unprepared history without starting a call or building an index. Cancelling or failing preparation leaves the microphone off. Ordinary concurrent requests queue behind one history process, within a fixed bound. Its embedding lanes run bounded batches in parallel; they do not run concurrent database writers. An unchanged index shows **History is up to date**, not a full-archive progress bar.
 
 No session text or queries are uploaded for embedding. Text discussion and ChatGPT voice do receive the relevant historical excerpts, just as they receive frozen snapshot context. Those excerpts are dated background—not newly reviewed progress, agreement or permission to execute work.
 
@@ -16,21 +16,72 @@ Opening/reloading a page does not itself download the model, compute embeddings
 
 ### Optional background indexing
 
-**Settings → Automatically index history** controls scanning and local search indexing only. It is on by default for new installations and works while the server runs, even without a browser. Existing installations retain their saved indexing choice, including off; reads and restarts never reset it. On upgrade, an existing `auto_index` choice wins; only when it is absent is the legacy combined preference copied. A missing preference on an existing installation remains off. Retired automatic-briefing consent and job markers are removed, not resumed. Indexing may download the pinned local embedding model on first use and consumes local CPU, memory and disk, but makes no provider model calls. It never creates syncs, summaries, recaps or briefings, starts audio, or advances review. Existing snapshots (including past automatically created ones), cached summaries, conversations and notes remain ordinary retained history, not resumable automatic jobs.
+**Settings → Automatically index history** controls scanning and local search indexing only. It is on by default for new installations and works while the server runs, even without a browser. Existing installations retain their saved indexing choice, including off; reads and restarts never reset it. On upgrade, an existing `auto_index` choice wins; only when it is absent is the legacy combined preference copied. A missing preference on an existing installation remains off. Retired automatic-briefing consent and job markers are removed, not resumed or migrated into the new paid `auto_summary` opt-in. Indexing may download the pinned local embedding model on first use and consumes local CPU, memory and disk, but makes no provider model calls. It never creates syncs, summaries, recaps or briefings, starts audio, or advances review. Existing snapshots (including past automatically created ones), cached summaries, conversations and notes remain ordinary retained history, not resumable automatic jobs.
 
-The app's single scheduler checks once a minute when no sync, call or foreground history work is active. A background indexing batch requires at least 64 changed source records, regardless of elapsed time. Entries accumulate for the next explicit sync; an already indexed backlog does not trigger a briefing. There is no timed flush. Smaller pending batches wait for a sync, **Prepare history**, or search; that foreground path has no minimum batch size. Background indexing records the same history readiness used by calls. If anything still needs preparation, Call remains disabled—clicking it cannot start a hidden indexing job. Metadata hashes detect additions, edits and removals once per original source entry (or discussion/note record). Session/file bookkeeping does not add records, and frozen aliases coalesce with the original rather than multiplying the count. Actual indexing still reconstructs and verifies admitted source bytes. Unchanged checks do not start an embedding request. Source records and embedding passages are different counts. New sessions from enabled agents retain the collector's included-by-default behavior; per-agent/per-session exclusions and the existing baseline remain respected. Codex and Claude sources require separate explicit opt-in in **Settings → Agents & sessions**, even if background indexing is already enabled. Explicit summarization continues to use pi. See [SOURCES.md](SOURCES.md).
+The app's single scheduler checks once a minute. With an active, non-ended conversation, **any positive source-change count** can trigger local indexing; there is no 64-record wait. Without an active conversation, a background batch still requires **at least 64 changed source records**, regardless of elapsed time, and there is **no timed small-tail flush**. Smaller inactive tails wait for a sync, **Prepare history**, or search; foreground preparation has no minimum batch size. Connected idle voice permits local background work between turns, but never during a pending response or context delivery. User turns and foreground jobs preempt and drain owned indexing before proceeding. Entries accumulate for the next explicit sync; an indexed backlog never triggers a briefing. Background indexing publishes prepared history for between-turn adoption, not new snapshot membership. Initial preparation remains required; an append or scan cursor advance cannot revoke an already-captured valid receipt or disable prepared chat. Metadata hashes detect additions, edits and removals once per original source entry (or discussion/note record). Session/file bookkeeping does not add records, and frozen aliases coalesce with the original rather than multiplying the count. Actual indexing still reconstructs and verifies admitted source bytes. Unchanged checks do not start an embedding request. Source records and embedding passages are different counts. New sessions from enabled agents retain the collector's included-by-default behavior; per-agent/per-session exclusions and the existing baseline remain respected. Codex and Claude sources require separate explicit opt-in in **Settings → Agents & sessions**, even if background indexing is already enabled. Explicit summarization continues to use pi. See [SOURCES.md](SOURCES.md).
 
-Foreground requests preempt and await the owned automatic indexing job. Disabling cancels only that job; completed vectors remain reusable. Local preparation failures retry no sooner than five minutes; foreground preemption waits at least one minute. **Retry automatic indexing** permits an explicit retry in Settings. Shutdown awaits owned work. Settings/progress GETs remain metadata-only. Home and Settings show local indexing status, pending source changes, entries available for the next sync and the last completed indexing batch—not summary progress, model-call budgets or prepared-briefing links. The saved preference and last completion survive restart.
+Foreground requests preempt and await the owned automatic indexing job. Disabling cancels local indexing and also stops any separately opted-in paid background preparation, since paid work requires indexing enabled. Completed vectors and valid summary cache remain reusable. Local preparation failures retry no sooner than five minutes; foreground preemption waits at least one minute. **Retry automatic indexing** permits an explicit retry in Settings. Shutdown awaits owned work. Settings/progress GETs remain metadata-only. Home and Settings show local indexing status, pending source changes, entries available for the next sync and the last completed indexing batch—not ownership of a prepared briefing. The separate paid-preparation status does not turn local indexing into provider work. The saved preference and last completion survive restart.
 
-Only an explicit **Sync with Draken** or **Chat instead** action creates a new snapshot and starts its briefing. It includes all eligible accumulated entries not held by another open sync, preserving request-ID idempotency and explicit retry. No old automatic snapshot is claimed or resumed by a new request. Preparation usage history still includes past automatic work, retries and failures; indexing does not erase those costs. The hash-only search checkpoint still advances only after successful global preparation. Missing older checkpoints can be established by local preparation, reusing compatible vectors. No source-text copy, provider substitution, vector conversion or timed small-batch flush is introduced.
+Only an explicit **Sync with Draken** or **Chat instead** action creates a new snapshot and starts its briefing. It includes all eligible accumulated entries not reserved by another open, non-ended sync, preserving request-ID idempotency and explicit retry. No old automatic snapshot is claimed or resumed by a new request. Preparation usage history still includes past automatic work, retries and failures; indexing does not erase those costs. The hash-only search checkpoint still advances only after successful global preparation. Missing older checkpoints can be established by local preparation, reusing compatible vectors. No source-text copy, provider substitution or vector conversion is introduced. The no-timed-small-tail policy still applies when there is no active conversation.
 
-A failed preparation/search reports an error. If a session file changed, moved or disappeared, scan sessions again before retrying; stale derived text is not a substitute for a verified source. Otherwise retry the question or **Prepare history**; completed embeddings are reused automatically. Cancel preparation on the sync page to stop that work. Cancelling a search or text reply stops its owned work too. Reloading does not start a call. An older cache without a call-readiness record needs one preparation pass, which reuses its compatible vectors. A completed index over a partial import is not sufficient: foreground call preparation first drains bounded import chunks to captured file ends. Missing, changed or incomplete originals block readiness. Later appends do not force preparation to chase a live stream forever; the call uses its displayed cutoff, and new work waits for another preparation. A ready sync offers **Refresh history** for an explicit local-only update without regenerating its briefing. See [SOURCES.md](SOURCES.md).
+A failed preparation/search reports an error. If a session file changed, moved or disappeared, scan sessions again before retrying; stale derived text is not a substitute for a verified source. Otherwise retry the question or **Prepare history**; completed embeddings are reused automatically. Cancel preparation on the sync page to stop that work. Cancelling a search or text reply stops its owned work too. Reloading does not start a call. An older cache without a call-readiness record needs one preparation pass, which reuses its compatible vectors. A completed index over a partial import is not sufficient for initial readiness: foreground preparation first drains bounded import chunks to captured file ends. Missing, damaged or incomplete captured originals block readiness. Later appends do not force preparation to chase a live stream forever or invalidate its verified prefix. Each answer uses one prepared cutoff; a newer successfully prepared cutoff becomes eligible between user turns. A ready sync also offers **Refresh history** for an explicit local-only update without regenerating its briefing. See [SOURCES.md](SOURCES.md).
+
+### Live conversations and idle ending
+
+The initial briefing and searchable history must be prepared once. Thereafter, an active text or voice conversation can adopt **newly prepared original history as dated H evidence between user turns**. This is not a moving snapshot: initial membership, E/C references, briefing, already saved transcript and explicit notes are never rewritten by history updates. New H context is not review coverage. Explicit **Mark reviewed** covers only the initial snapshot, subject to its existing evidence/preparation checks.
+
+Each answer/voice turn pins one history cutoff for all its lookups, context parts and any text correction. A completed background pass cannot replace context mid-answer or interrupt a reply. Adoption happens only between turns, never from partially indexed data. Ordinary source appends and background scan/import cursor advances must not invalidate already captured context: the 0.7 file-cursor identity coupling is not a source-integrity check. Keep receipt identity tied to admitted captured records, not mutable tail bookkeeping. Actual damage, missing originals, exclusions or incompatible captured projections still fail closed; reads continue verifying original bytes. If additional archive lookup is unavailable during an update, explicitly qualify unavailable context rather than guess, serve stale derived text or silently fall back to an old conversation. An update alone must not disable already-prepared chat.
+
+Local live updates use only `auto_index`, with once-minute checks for **any positive source changes** while a conversation is active. They do not run per-minute provider calls. `auto_summary` remains separately authorized, default off, with its own 64-record threshold and paid-failure policy below. Neither background path creates syncs, final briefings, recaps, decisions or review. A connected idle voice call is not itself a reason to block local indexing; pending response/context delivery is. A user turn preempts and awaits owned indexing cleanup before retrieval. Settings/status GETs read metadata only: no source-body reads, scans, embeddings or provider inference.
+
+The simple status vocabulary is **Up to date**, **Preparing new info…**, **New info ready**, with **Live updates off** / **Updates unavailable** when applicable. It describes preparation/adoption, not independent verification or guaranteed exhaustive recall. No extra live-update control is required.
+
+Conversation lifetime is separate from review status and native connection limits:
+
+- End after **30 minutes since the last real user chat message or voice turn**. Initial creation counts as initial intent. Assistant responses, polling, indexing, preparation updates and connection heartbeats never extend the deadline. An ongoing reply is allowed to finish before idle expiry; its completion does not reset user activity.
+- Persist last activity and an ended marker across restarts using additive conversation fields or a related table. Preserve the existing `open` / `completed` / `discarded` review-status constraint; do not recast idle ending as completed/reviewed. Show **Session ended**.
+- An ended conversation cannot accept new chat/voice turns or be revived by request replay, polling, page reopening or restart. Return home and **Start new sync**. Its transcript remains readable, and explicit notes/review can remain available for its old snapshot under existing checks.
+- Idle ending releases that conversation's unreviewed reservations for the **next explicit new sync**. It does not delete snapshot rows, create a sync, change notes, generate a recap or advance coverage. Snapshot membership remains historical even after its reservation ends.
+- Migration derives activity from real stored user turns (creation when none exist), never generated replies or updated-at bookkeeping. Inactive older conversations may end and their unreviewed entries become available again; no history is deleted.
+- Voice's separate **30-minute connection limit, 60-turn cap and 90-second disconnect lease** may still end a connection earlier. The user-idle policy is not removal of resource bounds or a promise of unlimited calls.
+
+### Optional paid summary preparation
+
+**Settings → Prepare summaries ahead (`auto_summary`), introduced in 0.7.0, remains separate paid consent.** It defaults **off** on fresh installations and upgrades without this explicit consent, even when `auto_index=true` or the retired 0.5 paid setting was enabled. An already-saved explicit choice is preserved. It requires **Automatically index history** to be enabled. Local indexing retains its defaults/preferences and makes no provider calls by itself. Opening `GET /api/settings/auto-summary` returns metadata (`enabled=false` on a fresh installation); neither this GET nor other settings/progress reads scan history, start inference or grant consent.
+
+#### Read-only eligibility, shared summary cache
+
+Paid preparation reads the accumulated entries eligible for the next explicit snapshot, respecting enabled agents, session selection, baseline, active-branch projection, verified originals, existing coverage and entries reserved by open, non-ended syncs. It does not reserve those entries or create/own `syncs`, `sync_items`, `sync_coverage`, `sync_messages`, `sync_runs` or `sync_tree_nodes` rows. It never runs the final model, generates a briefing or recap, starts a call, saves user notes or advances review. Existing histories, notes, coverage and frozen snapshots are unchanged.
+
+The work warms the **same validated `summary_cache` leaves plus reconciliation/compact final input used by explicit sync**, with the same model/prompt/content identity and citation validation—not a separate rolling-memory summary or an unvalidated text shortcut. An explicit sync freezes all then-eligible accumulated evidence and consumes matching cache; warming cache is neither inclusion nor review. Completed closed chunks remain reusable across appends. Changed unfinished per-session tails and aggregate reconciliation may need on-demand work at **Start chat**; the final briefing and any prior-conversation recaps always remain explicit. Cache preparation can reduce repeated work, but does not promise zero latency.
+
+#### Scheduling, ownership and recovery
+
+- The scheduler checks **once a minute while idle**, requiring **at least 64 new/changed eligible records** for a new paid batch. This count is independent of the successful embedding checkpoint: local indexing cannot consume the paid backlog. Smaller tails wait for explicit foreground preparation or sufficient new changes; there is no timed small-tail flush.
+- An unchanged successfully prepared input with intact cached outputs causes **no further provider calls**. Receipts include hashes of every validated leaf and parent used by the build. Lost or corrupt outputs invalidate the receipt and permit a bounded rebuild; failures still pause paid retries. Eligibility/input hashes, rather than elapsed time or embedding progress, identify paid work and reuse. Edits count once per stable agent/session/entry identity; removals count too. Derived session titles are presentation metadata, not a change to every record in the session. Model, recipe or context changes can invalidate preparation even without new entries.
+- Use only the configured summary model and the same configured **`max_invocations`** allowance. Repairs consume that allowance. There is no provider/model fallback and no final-model call. This is an invocation bound, not a token/dollar or subscription-quota guarantee.
+- Foreground work **cancels and awaits owned background provider work** before proceeding. Shutdown also drains owned work. A cancellation request is not confirmation that the child/provider process exited.
+- Valid completed cache survives cancellation and restart. Resuming the same interrupted input retains spent invocations rather than resetting the allowance. An interrupted request may have incurred provider usage even if no reusable result was saved.
+- **Paid failures pause retries until explicit retry.** A timer, restart or additional source activity must not turn failure into an unattended paid retry loop. Local indexing failures retain their independent delay of at least **five minutes**.
+- Disabling **either** setting stops paid background work; completed cache is preserved. Re-enabling is not permission to erase spending or treat cached work as a successful briefing/review.
+
+#### Durable metadata and usage
+
+The additive **`background_runs`** table stores durable input/cache hashes, invocation counters, state, content-free request metrics and timestamped failed-attempt events. Cancellation between successful provider calls still counts as an interrupted attempt; resuming the same run must not erase it or count it twice. It stores **no source text**, prompts or source excerpts; validated derived summaries belong in `summary_cache`. Persistence distinguishes prepared, interrupted and failed work across restarts without manufacturing a snapshot. Original logs remain authoritative. Status reports the **last successful background pass**, not live readiness: it reads only counters/timestamps and never reopens transcripts or validates the cache during polling. Actual preparation and explicit syncs verify originals and cached outputs.
+
+Ordinary existing batch keys and validated historical leaf caches remain compatible. Previously oversized batches split at a moving midpoint may need one-time recomputation: 0.7 uses stable prefixes so future appends do not move completed boundaries. No old cache or snapshot is deleted as part of this change.
+
+**`preparationUsage` includes background spend, requests and failures**, alongside explicit preparation and retained historical accounting. Missing/interrupted pricing remains unavailable or partial, never fabricated zero. **`completed_batches` still counts explicit snapshots' first successful briefings**, not warmed chunks or background runs; repeated preparation does not make another reviewed/completed sync. Background cost must not be silently assigned to a later snapshot as though its cache hit made a new request. Opening the usage dashboard only reads metadata. Chat, voice, standalone post-conversation recaps and local resource costs remain outside this preparation-only estimate.
 
 ### Regression boundaries
 
-- `tests/source-batch.test.cjs` and `tests/automatic-index.test.cjs` cover accumulation across batches/restarts, committed checkpoints, small tails and cancellation without automatic snapshots or provider work.
+- `tests/background-tree.test.cjs` covers snapshot-free shared-cache preparation, validated leaves/reconciliation/compact input, unchanged reuse and append/tail behavior.
+- `tests/background-preparation.test.cjs` covers new paid consent, exact edit/removal thresholds, lost/corrupt cache recovery, ownership/cancellation, durable invocation spending, content-free ledger fields, pause-until-retry failures and preparation accounting without sync/review writes.
+- `tests/summary-preparation-http.test.cjs` checks separate consent validation, cross-origin rejection and metadata-only status reads; `tests/ui/summary-preparation.spec.ts` checks opt-in, error recovery and explicit retry.
+- `tests/source-batch.test.cjs` and `tests/automatic-index.test.cjs` cover accumulation across batches/restarts, committed checkpoints, inactive small tails and cancellation without automatic snapshots or provider work.
+- `tests/conversation.test.cjs` covers real-user idle timing, restart/migration persistence, ended-session rejection and reservation release without review. `tests/live-history-readiness.test.cjs` covers append-safe receipts and between-turn adoption without masking original damage. `tests/voice-live-updates.test.cjs` and existing activity tests cover voice ownership/cutoffs; `tests/ui/live-conversation.spec.ts` covers status and return-home/new-sync recovery. These are synthetic regressions, not real-provider or physical-device qualification.
 - `tests/automatic-briefing.test.cjs` protects user-only generation, request-ID idempotency and preservation of old snapshots, notes, caches and coverage. Its name describes the behavior that must not return.
-- `tests/automatic-defaults.test.cjs` covers preference migration; `tests/package-smoke.cjs` checks the same boundary in a fresh production-only installation.
+- `tests/automatic-defaults.test.cjs` covers preference migration; `tests/package-smoke.cjs` checks fresh `auto_index=true`, `auto_summary=false`, the disabled metadata-only auto-summary GET and zero background/provider activity in a production-only installation.
 
 ## Work questions and follow-ups
 
@@ -54,7 +105,7 @@ Packets retain contiguous excerpts and, when clipped, separately labelled ending
 
 Final answers use a stable per-request `R1`, `R2`, … label catalog, mapped by Draken to the admitted E/C/H source references before validation and persistence. Source excerpts, earlier briefings and discussion are quoted data: their embedded citation syntax does not create labels. Explicit source requests are mapped into the same catalog. Unknown labels are neither guessed nor dropped. If a text answer has missing/out-of-catalog citations or cites a linked old checkpoint while ignoring supplied later reports (including E/C aliases), Draken permits **one combined correction using the same final model and invocation/cancellation budget**. The rejected draft is never saved or shown. A second failure is visible and retains the user question without an assistant answer. **Checking source references** or **Checking later updates** identifies the actual correction stage. It can consume one additional final-model request; chat/repair usage remains outside the preparation-only estimate. This citation-consistency check is not proof that every claim is true. Native voice shares the larger evidence selection and deterministic later-report checking, but **not the pi answer-repair pass**: already-streamed speech cannot be retracted or certified by this citation guard. Its prompt keeps the same concise delivery target, including necessary caveats. Shared evidence does not establish identical generated answers or exhaustive recall.
 
-Chat readiness checks the prepared receipt at its captured cutoff. New chat messages beyond that cutoff are passed directly as recent conversation and do not force an index rebuild on every turn. Original-file identity/import cursors, selection changes, missing originals and edits to already captured records still invalidate readiness. Fresh native-call readiness keeps its stricter current-record check. Both readiness endpoints only read metadata. Refresh is explicit; chat does not silently refresh the corpus, regenerate a briefing or switch providers.
+Chat and voice pin a prepared receipt/cutoff per turn and adopt newer prepared original history only between turns. New chat messages are passed directly as recent conversation and do not force an index rebuild on every turn. Ordinary appends and import cursor changes do not invalidate the captured prefix; selection changes, missing originals and damage to already captured records still fail closed. Readiness/status endpoints only read metadata. Local background preparation or an explicit refresh can publish a newer cutoff; neither regenerates the briefing or switches providers.
 
 ## How it works
 
@@ -99,13 +150,13 @@ Back up both current databases before deployment and qualify migration on privat
 
 Source inclusion, missing-session state, active branches for unsnapshotted entries and the existing history baseline are respected. Frozen evidence remains historical, including superseded branch material. Reviewed records remain searchable. Discarded sync discussion/notes are excluded, while discarded work can still be eligible through an active selected session.
 
-Ordinary search and text discussion prepare the candidates observed at their start. Voice instead uses the history cutoff prepared before the call: it verifies original bytes and queries existing passages, but does not build missing corpus embeddings or download a missing model. Newer records wait for a later preparation and call. Query embeddings still run locally during a call. Exclusions and edits are rechecked after inference; stale or unprepared history fails visibly rather than being quietly rebuilt during the call. This avoids mixing fresh keyword-only records into results described as fully hybrid.
+Ordinary search and legacy text discussion can prepare candidates observed at their start. Active chat and voice instead pin a prepared history cutoff for each answer/turn: retrieval verifies original bytes and queries existing passages, but does not build missing corpus embeddings or download a missing model in a pending reply. Newer records wait for successful local preparation and a between-turn boundary, not necessarily a new call. Query embeddings still run locally during a call. Exclusions and edits are rechecked after inference; damaged or unprepared history is not silently substituted or rebuilt inside the answer. If extra archive lookup is unavailable during an update, disclose the limitation. This avoids mixing fresh keyword-only records into results described as fully hybrid.
 
 Sync discussion is its own retained record: excluding a session does not erase text previously discussed in a sync. Recaps/current briefings are not separately indexed as primary evidence, though preserved discussion can contain historical assistant summaries; attribution remains visible.
 
 Search covers admitted normalized source projections and retained Draken discussion—not every byte of the original JSONL files. Excerpt, ranking and packet limits can omit important information. No match is not proof something never happened. Similarity is not proof a source supports an answer. The local multilingual qualification is not a comprehensive relevance benchmark.
 
-Open-sync notes have no retained edit timestamp and are not backdated. Date filters exclude undated notes. Calls use their start time as the historical cutoff so the active call does not retrieve its new questions as old history. A date filter does not reconstruct an earlier database state: context edits may change retained text without supplying a separate edit date.
+Open-sync notes have no retained edit timestamp and are not backdated. Date filters exclude undated notes. Each voice turn pins its adopted prepared-history cutoff; work questions continue preferring original agent records rather than retrieving the active conversation's own questions as evidence. A date filter does not reconstruct an earlier database state: context edits may change retained text without supplying a separate edit date.
 
 Generated/interrupted speech stays qualified as generated/interrupted. Historical requests are data, not instructions. Prompts distinguish plans, reported work, observed validation and uncertainty. Models can still make semantic mistakes; inspect supporting records. Retrieval cannot save decisions, execute tools, complete syncs or advance coverage.
 
@@ -113,7 +164,7 @@ Generated/interrupted speech stays qualified as generated/interrupted. Historica
 
 Under `DRAKEN_DATA_DIR` (default `~/.draken`):
 
-- `draken.db`: canonical live/frozen pointers and metadata, Draken conversations, notes and generated summaries; not rewritten by retrieval.
+- `draken.db`: canonical live/frozen pointers and metadata, Draken conversations, notes and generated summaries; not rewritten by retrieval. Paid preparation writes validated `summary_cache` and metadata-only `background_runs`, never snapshot/review/conversation rows.
 - `memory/index.sqlite` and sidecars: passage hashes/unique vectors, source-occurrence mappings and contentless keyword postings.
 - `memory/model/`: three pinned model/tokenizer files, downloaded automatically when first needed.
 

package/README.md

@@ -10,11 +10,13 @@ A local-first engineering sync across your **pi, Codex CLI and Claude Code sessi
 
 **Sync with Draken → call or chat → keep a short recap.**
 
-**Draken 0.6.0** separates automatic local indexing from user-triggered syncs and strengthens server/helper shutdown and evidence ownership. See [the release notes](CHANGELOG.md#060).
+**Draken 0.8.0** keeps active conversations current with newly prepared original history between turns, without rewriting the initial snapshot or briefing. After 30 minutes without a real user turn, the **Session ended** state preserves the transcript and releases unreviewed entries for your next explicit sync. Paid summary preparation remains separate and off by default. See [the release notes](CHANGELOG.md#080).
 
-**Automatic local indexing:** new installations accumulate searchable history automatically while the server runs. Change this in **Settings → Automatically index history**. Existing installations keep their saved indexing choice, including off. Automatic work never creates syncs, summaries or briefings and makes no provider model calls. Only an explicit **Sync with Draken** or **Chat instead** action creates a new snapshot and starts its briefing. Original agent logs, existing snapshots, cached summaries, conversations and notes remain untouched. Nothing is marked reviewed automatically.
+**Automatic local indexing:** new installations accumulate searchable history automatically while the server runs. Change this in **Settings → Automatically index history**. Existing installations keep their saved indexing choice, including off. Local indexing alone never creates syncs, summaries or briefings and makes no provider model calls. Only an explicit **Sync with Draken** or **Chat instead** action creates a new snapshot and starts its briefing. Original agent logs, existing snapshots, cached summaries, conversations and notes are not rewritten by indexing. Active conversations check once a minute for any positive source changes; without an active conversation, indexing retains 64-record batching with no timed small-tail flush. Nothing is marked reviewed automatically.
 
-**Track preparation spending estimates:** **Settings → Preparation usage** shows estimated USD cost, completed batches and model requests over time, with labelled cost/batch axes and exact bucket details. It retains preparation history, including past automatic work, retries and failed work. Missing prices stay unavailable or partial. This is **not total spending, a provider invoice or account quota**: chat, voice, standalone post-conversation recaps and local machine/network costs are excluded. Opening the dashboard only reads metadata.
+**Optional paid preparation:** enable **Prepare summaries ahead** explicitly, with **Automatically index history** also enabled, to warm cached summaries using your configured summary model and its quota/API billing. Once-minute idle checks start at 64 new/changed eligible records, independently of the embedding checkpoint. This prepares validated leaves, reconciliation and compact final input—not snapshots, final briefings, recaps or review. Unchanged prepared input makes no further calls; closed chunks survive appends, but changed per-session tails and reconciliation may still need work at **Start chat**. The final briefing always runs explicitly; preparation ahead is not an instant-chat guarantee. Disabling either switch stops paid background work and preserves valid cache. Paid failures pause until explicit retry; local indexing retains its five-minute retry delay. No retired paid setting is migrated into this new consent.
+
+**Track preparation spending estimates:** **Settings → Preparation usage** shows estimated USD cost, completed batches and model requests over time, with labelled cost/batch axes and exact bucket details. It retains preparation history, including background summary spend/requests/failures, past automatic work and retries. Completed batches still count only explicit snapshots' first successful briefings—not warm cache. Missing prices stay unavailable or partial. This is **not total spending, a provider invoice or account quota**: chat, voice, standalone post-conversation recaps and local machine/network costs are excluded. Opening the dashboard only reads metadata.
 
 The home page is compact history cards. Each sync has its own `/syncs/:id` URL, with the full briefing, conversations, notes and evidence behind it. **Search history** (`/history`) adds local semantic + keyword retrieval across retained older records, with dated source links. It prepares itself automatically—no enable/update buttons or search-mode choices. Progress counts only new or changed passages, with cached history shown separately and a measured time estimate. Local indexing reuses existing vectors and uses up to two embedding lanes/six CPU threads on sufficiently capable machines; smaller machines stay single-lane. Text questions and calls use it by default. See [MEMORY.md](MEMORY.md) for source scope, first-use download and limitations.
 
@@ -26,7 +28,7 @@ Draken remembers which evidence a finished sync covered, what you decided, and w
 
 Requires Node.js **22.19+** and npm. Session-log indexing and evidence review do not require a model or pi executable. Generated briefings and discussion use **pi 1.4+**. Existing configured pi works unchanged; otherwise **`draken setup`** installs a pinned private runtime and **`draken login`** opens pi’s own authentication interface. See [SETUP.md](SETUP.md) for the full first-run flow, private directories and recovery.
 
-> **Upgrading?** Back up your original agent logs and Draken data first. Versions **0.1.6 and earlier** are the old task dashboard, not this application. See [what changed in 0.6.0](CHANGELOG.md#060).
+> **Upgrading?** Back up your original agent logs and Draken data first. Versions **0.1.6 and earlier** are the old task dashboard, not this application. See [what changed in 0.8.0](CHANGELOG.md#080) and [upgrade instructions](SETUP.md#upgrade-to-080), including idle ending of older inactive sessions.
 
 ```sh
 npm install -g draken
@@ -54,13 +56,13 @@ Run setup/login as the server’s user with the same environment. `draken status
 
 1. Set up [ChatGPT voice](VOICE.md) once. Use localhost or trusted HTTPS.
 2. Click **Sync with Draken**. Draken scans, freezes all available entries, summarizes earlier conversations, prepares the briefing, then starts the call on the same visible page. Browser microphone permission may still be required. This is one explicit action, not an automatic call on page load.
-3. Talk. Ending the call requests a short, cached recap; it never saves decisions or marks evidence reviewed.
-4. Return home for compact cards, or open any `/syncs/:id` independently. Reopening/reloading a URL never starts capture. **Call Draken** resumes discussion of that frozen snapshot without collecting later activity.
+3. Talk. Explicitly ending the call requests a short, cached recap; it never saves decisions or marks evidence reviewed.
+4. Return home for compact cards, or open any `/syncs/:id` independently. Reopening/reloading a URL never starts capture. **Call Draken** continues an active conversation with the same frozen snapshot; newly prepared history can supplement later turns without changing that snapshot.
 5. Use **Chat instead** for a separate text conversation, or expand the detail sections to inspect the briefing/evidence and explicitly save **Decisions** and **Carry into the next sync**. **Mark reviewed** is separate and optional before starting another sync; only that explicit action advances coverage.
 
-**Settings → Automatically index history** controls local-only background work. Entries remain available until you explicitly create a sync; old automatically created snapshots remain readable and are not silently resumed. Indexing uses local resources and may download pinned model files, but makes no provider calls. See [background indexing](MEMORY.md#optional-background-indexing) for batching, cancellation, saved preferences and upgrade behavior.
+**Settings → Automatically index history** controls local-only background work. Entries remain available until you explicitly create a sync; old automatically created snapshots remain readable and are not silently resumed. Indexing uses local resources and may download pinned model files, but makes no provider calls. The separate **Prepare summaries ahead** switch authorizes paid cache preparation only when indexing is enabled; an old `auto_index=true` does not enable it. See [background indexing](MEMORY.md#optional-background-indexing) and [paid preparation](MEMORY.md#optional-paid-summary-preparation) for batching, cancellation, saved preferences and upgrade behavior.
 
-**Settings → Agents & sessions** shows each supported agent’s configured directories, recorded sessions, workspace/file paths, last recorded changes, unreviewed counts, inclusion choices and missing-source status. **Scan enabled agents** explicitly refreshes this inventory; opening Settings only reads recorded metadata and directory presence. Readers support **pi v3 JSONL, self-contained Codex CLI rollouts and Claude Code transcripts**. Codex and Claude history require explicit per-agent opt-in; existing pi choices are preserved. The panel shows directory presence separately from recorded sessions, not an installation claim. Summaries still use pi. See [SOURCES.md](SOURCES.md) for paths, supported layouts, migration and limitations. Source selection/scanning lives in this settings panel. A fresh installation includes all indexed history; an existing fixed baseline is preserved. There are no ordinary model/budget controls or extra inference permission checkboxes. Failed preparation keeps its snapshot and cached work; retry explicitly. Opening a link after preparation requires an explicit call click.
+**Settings → Agents & sessions** shows each supported agent’s configured directories, recorded sessions, workspace/file paths, last recorded changes, unreviewed counts, inclusion choices and missing-source status. **Scan enabled agents** explicitly refreshes this inventory; opening Settings only reads recorded metadata and directory presence. Readers support **pi v3 JSONL, self-contained Codex CLI rollouts and Claude Code transcripts**. Codex and Claude history require explicit per-agent opt-in; existing pi choices are preserved. The panel shows directory presence separately from recorded sessions, not an installation claim. Summaries still use pi. See [SOURCES.md](SOURCES.md) for paths, supported layouts, migration and limitations. Source selection/scanning lives in this settings panel. A fresh installation includes all indexed history; an existing fixed baseline is preserved. There are no ordinary model/budget controls. Explicit sync/chat actions authorize their own preparation; only optional paid background summaries require the separate new switch. Failed preparation keeps its snapshot and cached work; retry explicitly. Opening a link after preparation requires an explicit call click.
 
 Closing the browser preserves the running job; reloading reconnects to progress. Restarting the server preserves the snapshot and completed summary nodes, but interrupts an active model call; retry to resume from cache. Discarding a sync leaves its evidence uncovered and retains the conversation in history. Chat retains the sent question even if its reply fails or is stopped; it never fabricates a completed assistant answer or marks anything reviewed. The older discussion API still saves only completed exchanges. Records from the retired local engine retain their original playback qualifications. Live calls retain ordered generated/interrupted transcripts and supplied context sources, without claiming exact playback or agreement. Reload ends the call and never resumes microphone capture automatically.
 
@@ -74,7 +76,11 @@ A square Draken portrait accompanies replies. **Searching your prepared history*
 
 Chat replies default to one short paragraph or at most three short bullets, usually 60–100 words plus citations; simple questions can be shorter. Ask for a detailed breakdown when you want one. The model still reads the same evidence and checks later reports: brevity does not mean weaker retrieval or dropped qualifications. This is a response-style instruction, not a hard word limit or an extra shortening-model pass. Opening briefings keep their separate format.
 
-Replies use the sync's configured final text model through pi, with the briefing, recent conversation and project-aware original-history retrieval. The prepared archive has a displayed cutoff; new chat messages are supplied directly without rebuilding corpus embeddings after every turn. **Refresh history** admits later work. Changed, excluded or unavailable original sources still block readiness. Chat never opens a native call, implicitly regenerates a ready briefing, saves decisions or marks evidence reviewed. Chat quota/cost is separate from the preparation-only **Est. cost**.
+Replies use the sync's configured final text model through pi, with the briefing, recent conversation and project-aware original-history retrieval. Initial briefing and history preparation are required once. Each answer pins one prepared history cutoff; newer prepared originals become dated H evidence between user turns, never changes to the initial E/C references, briefing, saved transcript or notes. Ordinary appends and background scans do not invalidate already captured context or disable prepared chat. True damage, exclusion or loss of captured originals still fails closed. If extra archive lookup is temporarily unavailable during an update, the answer must say so rather than guess or silently fall back. **Refresh history** remains an explicit local update. Chat never opens a native call, implicitly regenerates a ready briefing, saves decisions or marks evidence reviewed. Chat quota/cost is separate from the preparation-only **Est. cost**.
+
+Live status is **Up to date**, **Preparing new info…** or **New info ready**; off/unavailable states are labelled when applicable. Updates do not interrupt an ongoing reply. With automatic indexing enabled, local updates run once a minute for any positive source changes during an active conversation—no 64-record wait and no per-minute paid calls. Voice permits this work while connected and idle between turns, never during a pending reply or context delivery; a user turn preempts and drains owned indexing.
+
+After **30 minutes without a real user chat message or voice turn**, the conversation shows **Session ended**. Creation counts as initial intent; polling, background work, assistant responses and connection heartbeats do not extend it. An ongoing reply finishes first. The ended marker survives restart; reopening or replaying a request cannot revive it. Read the transcript or explicitly edit notes/review the old snapshot, or return home and **Start new sync** to chat again. Idle ending releases unreviewed reservations without deleting history, changing notes, making a recap or marking anything reviewed. Only explicit review covers the initial snapshot, never later H context. See [the lifecycle policy](MEMORY.md#live-conversations-and-idle-ending).
 
 For status questions, chat and native voice use the same bounded original-evidence selection and check later related reports before repeating old blockers, including follow-ups to a report that was itself superseded. New calls inherit project focus from actual saved user turns. Voice delivers the larger evidence packet through bounded native context parts while keeping spoken answers concise; it does not add a pi generation step. The following answer-repair check remains text-only; streamed speech is not post-validated. Client implementation, backend foundations, delivery enablement and device acceptance are kept distinct. The final model uses short per-answer reference labels, which Draken maps back to admitted original links; quoted historical citations never authorize new references. Bad/missing citations and ignored later follow-ups share one bounded same-model correction, with the same label catalog in both calls. A second validation failure remains visible without saving an unsupported draft. Retrieval and citation consistency do not independently verify the agent's claims; see [MEMORY.md](MEMORY.md#separate-text-chat) for bounds and voice differences.
 
@@ -86,7 +92,7 @@ For briefings, conversation recaps and text discussion, Draken invokes `pi --pri
 - **Final model:** defaults to `openai/gpt-6-astra`. Override with `DRAKEN_PI_FINAL_MODEL` or the legacy `DRAKEN_PI_MODEL`.
 - Model and budget controls are intentionally absent from the UI for now. Existing syncs retain their saved settings; the advanced `/api/syncs/:id/models` PATCH endpoint remains available for changing an open sync.
 - Selectors use pi's `provider/model` syntax. Catalog presence does not guarantee your subscription/API credential can access that model. Both models must support ordinary text generation; the summary model must reliably emit JSON.
-- **Invocation ceiling:** `DRAKEN_PI_MAX_INVOCATIONS` defaults to 120 per briefing/question, including prior-conversation recaps, schema-repair attempts and the final verdict. This limits model-generating pi subprocess invocations, not local setup/status checks, provider-internal retries, tokens, or dollars. Exhaustion stops the run without losing cached work.
+- **Invocation ceiling:** `DRAKEN_PI_MAX_INVOCATIONS` defaults to 120 per briefing/question, including prior-conversation recaps, schema-repair attempts and the final verdict. Paid background preparation uses the same configured `max_invocations` allowance for summary-model work, retaining spent invocations when resuming the same interrupted input. This limits model-generating pi subprocess invocations, not local setup/status checks, provider-internal retries, tokens, or dollars. Exhaustion stops the run without losing cached work. Neither path falls back to another provider/model.
 
 ### Summary tree
 
@@ -109,15 +115,15 @@ Summaries carry structured states, source IDs, and limitations. Models receive s
 
 A schema failure gets one repair attempt containing a bounded prefix of the rejected response, the specific validation error, and the allowed labels. Empty evidence, unknown IDs, and excess distinct citations are separate errors. When citation count is the only problem, the retry selects references only for the overfull observations instead of rewriting the whole summary. Claims, states, limitations and already-valid citation lists remain unchanged. Selections must come from each observation's original candidates and still pass the 16-reference limit; nothing is blindly truncated, guessed or silently accepted. Citation-only repair preserves those fields and the two-invocation ceiling. Large-batch citation repair supplies complete candidate observations rather than duplicating the rejected response. If repair still fails, generation **stops**—it is not an ongoing job. The UI offers **Resume generation**, which directly continues using valid cached work. The short-label upgrade can reuse previously validated v1 leaf summaries.
 
-Nodes are cached by content fingerprints, model selector, prompt text/version, and node type. Source IDs are independent of sync-local E/C citations, so identical inputs can reuse cache across retries and discarded snapshots. The new planner reuses validated v1/v2 leaf-cache islands and only repacks contiguous uncached ranges; existing cache rows are not wiped. Unchanged closed batches reuse their keys when history is appended; an unfinished tail and affected reconciliation are recomputed. Changed selection/background can still move boundaries. There is no endlessly rewritten project-memory summary.
+Nodes are cached by content fingerprints, model selector, prompt text/version, and node type. Source IDs are independent of sync-local E/C citations, so identical inputs can reuse cache across retries and discarded snapshots. The new planner reuses validated v1/v2 leaf-cache islands and only repacks contiguous uncached ranges; existing cache rows are not wiped. Unchanged closed batches reuse their keys when history is appended; an unfinished tail and affected reconciliation are recomputed. Changed selection/background can still move boundaries. There is no endlessly rewritten project-memory summary. Optional paid background preparation reads eligible accumulated entries without reserving them, and warms these same validated cache keys, reconciliation and compact final input. It owns no sync, snapshot, coverage, message or tree rows. Foreground work cancels and awaits its owned provider work before proceeding; valid cache survives cancellation and restart.
 
 Each run also retains metadata-only request timings, model/task/stage and repair status, input/output sizes, local token estimates, and completion/failure/cancellation state. No prompts or source excerpts go into this telemetry. **Model request timing** in the tree expands these details. Elapsed time includes pi startup, provider waiting and generation; these are not separately measured, and a completed subprocess result can still fail validation. Planning token estimates are not billed usage; real-history speed/quality comparisons remain unqualified. Existing runs acquire an empty metrics array through an additive migration; no histories, notes, coverage or embeddings are reset.
 
 Each sync card and detail page shows **Est. cost** for its preparation: chunk summaries, consolidation, preparation-time prior recaps, final briefing, and retries/rebuilds for that sync. Later questions, voice calls, standalone conversation recaps and local embeddings are excluded. Preparation consumes pi's bounded JSON event stream and saves only numeric usage, returned model names and the catalog-based USD estimate alongside existing metrics—not raw events, prompts, thinking or signatures. Reasoning is a subset of output, not an extra charge; provider cache reads/writes are distinct from Draken cache hits (which make no new request). The total uses prices reported at call time, never today's prices applied to old calls. **This is an API-equivalent estimate, not a subscription charge, quota measurement or provider invoice.** Missing/zero-filled usage or unavailable catalog pricing stays unavailable; mixed or interrupted records show a partial subtotal. Older syncs cannot be honestly backfilled from the padded planning estimates.
 
-Settings includes a **Preparation usage** dashboard with 6-hour, 1-day, 7-day and 14-day lookbacks, and 1-hour, 6-hour or 24-hour UTC buckets. It shows completed briefing batches, model requests and their recorded API-price estimate, across preparation history, including past automatic work, retries, failed work and discarded snapshots. A batch is a snapshot's first successful briefing preparation; rebuilds add cost without counting it again. It is not proof of review or current call readiness. Request costs are placed at their start time, and completed batches at their completion time. New requests have durable timestamps, including pending/interrupted requests; older metrics use the run start and are explicitly approximate. Missing usage/pricing is unavailable or a partial subtotal, never a fabricated zero or a backfill from today's prices. These are estimates, not invoices or subscription/quota balances. Chat, native voice, post-conversation recaps and local machine/network costs are excluded. Opening Settings and changing the time range only read accounting metadata; polling stops when it closes.
+Settings includes a **Preparation usage** dashboard with 6-hour, 1-day, 7-day and 14-day lookbacks, and 1-hour, 6-hour or 24-hour UTC buckets. It shows completed briefing batches, model requests and their recorded API-price estimate, across preparation history, including paid background summaries, past automatic work, retries, failed work and discarded snapshots. Metadata-only `background_runs` retains input hashes, counters and metrics, with no source text. `preparationUsage` includes its spend, requests and failures; `completed_batches` does not count cache preparation. A batch is an explicit snapshot's first successful briefing preparation; rebuilds add cost without counting it again. It is not proof of review or current call readiness. Request costs are placed at their start time, and completed batches at their completion time. New requests have durable timestamps, including pending/interrupted requests; older metrics use the run start and are explicitly approximate. Missing usage/pricing is unavailable or a partial subtotal, never a fabricated zero or a backfill from today's prices. These are estimates, not invoices or subscription/quota balances. Chat, native voice, post-conversation recaps and local machine/network costs are excluded. Opening Settings and changing the time range only read accounting metadata; polling stops when it closes.
 
-The final model receives bounded summaries, raw verification excerpts, saved decisions, and recent conversation—not the entire transcript. Questions additionally retrieve up to 16 raw snapshot entries and automatically receive a bounded hybrid-search packet from retained earlier history, with separate global H citations. The separate chat surface requires prepared history and uses its captured cutoff; ordinary standalone search and the older discussion API can prepare the local index as needed. Wider history is not added to the frozen snapshot. Final citation validation checks reference existence and, for text status replies, whether cited checkpoints address their supplied follow-ups. Neither check proves that every claim is actually supported.
+The final model receives bounded summaries, raw verification excerpts, saved decisions, and recent conversation—not the entire transcript. Questions additionally retrieve up to 16 raw snapshot entries and automatically receive a bounded hybrid-search packet from retained earlier history, with separate global H citations. The separate chat surface requires prepared history and pins its cutoff per answer; ordinary standalone search and the older discussion API can prepare the local index as needed. Wider history is not added to the frozen snapshot. Final citation validation checks reference existence and, for text status replies, whether cited checkpoints address their supplied follow-ups. Neither check proves that every claim is actually supported.
 
 The manager is a **read-only conversation**, not a worker. Its responses distinguish intent, attempts, agent-reported implementation, and observed validation, with clickable evidence references. Model-generated claims still need human review. Draken does not independently run tests or verify Git/CI/deployment state.
 
@@ -125,19 +131,19 @@ The manager is a **read-only conversation**, not a worker. Its responses disting
 
 The new workflow freezes the three most recent non-discarded syncs' briefing, discussion and explicit notes at snapshot creation. Their full supplied text passes through cached bounded map/reduce recap jobs; it does not silently select only the final messages. This remains **lossy summarization**, not exhaustive recall or independent verification. Recaps are 1–5 short lines (at most 600 characters), labelled historical summaries rather than agreement. Overlong prose lines can be reflowed at existing spaces without dropping words or qualifications, provided the same five-line/600-character limits still hold. Other invalid responses get one correction, not an unlimited retry. Preparation metrics record content-free validation reasons and line lengths, never rejected recap text. Old source IDs are not treated as this snapshot's citations. Original histories remain available at their own URLs.
 
-The card shows a short recap, or an explicitly labelled briefing preview until one exists, with its body clamped to three visual lines. A changed conversation marks an older recap as stale. Closing the call UI requests an asynchronous recap using the cheap model (maximum 32 invocations, also bounded by the sync's saved ceiling); interrupted browser exits cannot guarantee that request. **Make recap / Refresh recap** retries explicitly, and the next sync recomputes changed prior inputs from cache. Recaps never change notes, source snapshots or coverage. Automatic indexing never runs these recap or briefing model calls; merely browsing does not start them either. Native recall can reuse these prior-sync recaps, but cannot quote original words from them; historical lookup automatically retrieves retained original excerpts across sessions and syncs through the local hybrid index, separately from frozen discussion and recaps; see [MEMORY.md](MEMORY.md).
+The card shows a short recap, or an explicitly labelled briefing preview until one exists, with its body clamped to three visual lines. A changed conversation marks an older recap as stale. Explicitly closing the call UI requests an asynchronous recap using the cheap model (maximum 32 invocations, also bounded by the sync's saved ceiling); interrupted browser exits cannot guarantee that request. **Make recap / Refresh recap** retries explicitly, and the next sync recomputes changed prior inputs from cache. Recaps never change notes, source snapshots or coverage. Neither automatic local indexing nor paid background summary preparation runs these recap or briefing model calls; merely browsing does not start them either. Native recall can reuse these prior-sync recaps, but cannot quote original words from them; historical lookup automatically retrieves retained original excerpts across sessions and syncs through the local hybrid index, separately from frozen discussion and recaps; see [MEMORY.md](MEMORY.md).
 
 The migration adds presentation/recap-cache tables and removes the single-open-sync index without rewriting original rows. Once multiple open snapshots exist, do not blindly downgrade to the old one-open-sync schema. ChatGPT is the only voice engine. Removing the old engine does not remove its historical records, and updating the app does not require restoring an old database.
 
 ## What “since last sync” means
 
 - **Indexed** means a complete JSONL entry has been read locally.
-- **Included** means that entry is already held by an open snapshot. A new sync skips it, even though it is not reviewed. Multiple independently open syncs are allowed; discarding one releases its unreviewed entries.
+- **Included** means that entry belongs to the initial snapshot. An open snapshot reserves its unreviewed entries while its conversation has not ended; a new sync skips those reservations. Multiple independently open syncs are allowed. Discarding or idle-ending one releases its unreviewed reservations, not its saved history.
 - **Covered** means that entry was in a snapshot you explicitly finished reviewing.
 - Indexing, model calls, saving notes, and cancelled/failed calls never mark evidence covered.
-- A sync is immutable with respect to source activity: later arrivals cannot slip behind its checkpoint.
+- The initial snapshot is immutable with respect to source activity: later arrivals cannot slip behind its review checkpoint. Newly prepared H history can inform later turns but never expands that coverage.
 - A fresh one-click workflow initializes the baseline to all history; existing baselines are preserved. Entries older than that baseline are excluded from new activity, not falsely marked reviewed; they may still provide background context. The baseline does not move on subsequent syncs. There is no baseline-reset UI yet.
-- A new snapshot includes **all eligible, unreviewed indexed entries not held by another open sync** from the selected sources/history baseline, with no count or character cutoff. The UI paginates evidence without omitting it from processing. Scanner safety limits and excerpt truncation still apply.
+- A new snapshot includes **all eligible, unreviewed indexed entries not reserved by another open, non-ended sync** from the selected sources/history baseline, with no count or character cutoff. The UI paginates evidence without omitting it from processing. Scanner safety limits and excerpt truncation still apply.
 - If tree generation was started, finishing is blocked until compression and a valid final reply succeed. Failed/unprocessed evidence remains pending; you do not finish a partial tree as though it represented the whole snapshot.
 - Earlier branch context is included separately (up to roughly 24,000 characters) and never counted as new progress.
 - New one-click snapshots receive the **three most recent non-discarded syncs** as frozen recaps and saved notes, including unfinished conversations labelled unreviewed. The legacy API retains its last-10-completed-sync decision memory. The latest carry-forward list persists until edited; older lists are historical. Full conversations remain in SQLite; ordinary text questions include the latest 12 current-sync messages, with bounded excerpts.
@@ -163,7 +169,7 @@ Current limits: discovery is eight directories deep; each scan reads up to 32 Mi
 
 Session logs can contain private source code, prompts, command output, and credentials.
 
-- **Provider-model use starts through explicit conversation/preparation interactions, never automatic indexing.** The Sync action prepares previous recaps and a new briefing before calling; closing the call UI requests a derived recap. Voice turns do not invoke pi. Calls open a persistent OpenAI audio session at call start; idle/quota accounting is not established. There is no separate permission checkbox. Scanning and reading evidence stay local. History lookup automatically prepares/updates a local embedding index when needed; first use downloads pinned public weights. Text questions and calls receive relevant historical excerpts by default through their existing model. Merely opening a page performs no embedding inference; the saved automatic-indexing schedule runs independently of browsing but never uses provider summary/final models.
+- **Provider-model use starts through explicit conversation/preparation interactions or the NEW paid summary opt-in, never local indexing alone.** The Sync action prepares previous recaps and a new briefing before calling; explicitly closing the call UI requests a derived recap (idle expiry does not). Voice turns do not invoke pi. Calls open a persistent OpenAI audio session at call start; idle/quota accounting is not established. Those explicit actions need no additional checkbox; unattended summary preparation requires **Prepare summaries ahead**, off by default. Scanning and reading evidence stay local. History lookup automatically prepares/updates a local embedding index when needed; first use downloads pinned public weights. Text questions and calls receive relevant historical excerpts by default through their existing model. Merely opening a page performs no embedding inference; the saved automatic-indexing schedule runs independently of browsing but never uses provider summary/final models by itself. Separately opted-in background summaries send eligible content through the configured summary model, never the final model.
 - Thinking blocks, system prompts, images, and opaque signatures are not indexed. Tool-call arguments are minimized; common secret patterns are redacted. **This is best-effort, not a guarantee that the remaining text is safe to share.** Inspect evidence and exclude sensitive sessions before calling a provider.
 - SQLite contains verified live-session and frozen-snapshot pointers, cached summaries, run metadata, decisions and conversations—not copies of original agent entry bodies. It lives outside the checkout in `~/.draken/draken.db` by default. **Original agent JSONL files are the authoritative archive, including for old snapshots.** Back up both those files and Draken's private state. Missing/changed originals are labelled unavailable; discussion and notes remain accessible, but generating replies, calling or reviewing that snapshot requires restoring its evidence. Search stores passage hashes, unique vectors, source links and contentless keyword postings, not passage bodies. See [MEMORY.md](MEMORY.md) for migration and storage details. There is no in-app retention/purge UI yet.
 - The server defaults to loopback with **no dashboard login**. Explicitly configured credentials (or `DRAKEN_NO_AUTH=false`) retain authentication even on loopback. Local API access still rejects cross-origin requests and unexpected Host headers.
@@ -207,7 +213,7 @@ This is not a drop-in replacement for the old Docker/Claude task dashboard or it
 
 Source builds, development commands, test/probe instructions and the code map live in [CONTRIBUTING.md](CONTRIBUTING.md). They are not needed for normal npm installation.
 
-See [ACCEPTANCE.md](ACCEPTANCE.md) for automated gates, a short human product checklist and focused high-risk review areas. The public landing page lives in `site/`; merging changes there to `master` triggers the existing website deployment workflow. npm publication and application deployment are separate steps.
+See [ACCEPTANCE.md](ACCEPTANCE.md) for automated gates, a short human product checklist and focused high-risk review areas. The public landing page lives in `site/`; changes there on `master`/`main` trigger the existing website deployment workflow. Its `scripts/site-release.cjs` gate validates the version copy and withholds deployment until npm `latest` matches the root package version. Release copy describes 0.8.0 after release, not evidence of a live deployment. Qualify and publish npm separately before allowing the gated website deployment; this documentation change does not merge, publish or deploy anything. Focused lifecycle/readiness regressions are `tests/conversation.test.cjs`, `tests/live-history-readiness.test.cjs` and `tests/voice-live-updates.test.cjs`; browser coverage is `tests/ui/live-conversation.spec.ts`. Existing cache/consent regressions remain required.
 
 ## License
 

package/SETUP.md

@@ -2,7 +2,7 @@
 
 Draken uses **pi for summaries, preparation recaps and text discussion**, regardless of which coding agent produced the imported history. It does not implement provider OAuth, translate another agent's credentials, or run Claude/Codex to summarize.
 
-> This guide is for **Draken 0.6.0**. Versions **0.1.6 and earlier** are the old task dashboard. Before upgrading, back up your original agent logs and Draken data; see [what changed](CHANGELOG.md#060).
+> This guide is for **Draken 0.8.0**. Versions **0.1.6 and earlier** are the old task dashboard. Before upgrading, back up your original agent logs and Draken data; see [what changed](CHANGELOG.md#080).
 
 ## Install and start
 
@@ -21,10 +21,33 @@ Installation does not launch a server or register a background service. `draken`
 - `draken doctor`: checks the selected pi executable, version and configured model credentials. It does not create the application database, generate text or verify provider access/billing. A non-ready result exits nonzero.
 - A duplicate launch on an occupied HTTP/HTTPS port exits **before opening the database or recovering interrupted runs**.
 
-**Automatic local indexing is on by default for new installations.** While the server runs, it checks enabled sources once a minute and indexes batches at 64 source changes. Smaller tails wait for explicit foreground preparation, with no timed flush. It accumulates searchable history without creating syncs, summaries or briefings and makes no provider model calls. Local embeddings use CPU, memory and disk; first use may download about 136 MB of pinned search model files. Change this in **Settings → Automatically index history**. Existing installations keep their saved indexing choice, including off. Calls and foreground work take priority; disabling cancels automatic indexing and retains completed embeddings. Local failures back off for at least five minutes, with **Retry automatic indexing** available in Settings. Source/session exclusions still apply, and Codex and Claude remain separately opt-in. Only your explicit **Sync with Draken** or **Chat instead** action starts a new snapshot and briefing using configured models and their quota or API billing. Existing snapshots and notes remain untouched; no call, microphone or review starts automatically. **Settings → Preparation usage** retains preparation-only cost estimates, including past automatic work, not total spending or quota.
+**Automatic local indexing is on by default for new installations.** While the server runs, it checks enabled sources once a minute. Active conversations index any positive source changes; without an active conversation, batches still require 64 source changes and smaller tails wait for explicit foreground preparation, with no timed flush. It accumulates searchable history without creating syncs, summaries or briefings and makes no provider model calls. Local embeddings use CPU, memory and disk; first use may download about 136 MB of pinned search model files. Change this in **Settings → Automatically index history**. Existing installations keep their saved indexing choice, including off. User turns and foreground work take priority and drain owned indexing; connected idle voice permits local work between turns, never during a pending response or context delivery. Disabling cancels automatic indexing and retains completed embeddings. Local failures back off for at least five minutes, with **Retry automatic indexing** available in Settings. Source/session exclusions still apply, and Codex and Claude remain separately opt-in. Only your explicit **Sync with Draken** or **Chat instead** action starts a new snapshot and briefing using configured models and their quota or API billing. Existing snapshots and notes remain untouched; no call, microphone or review starts automatically. **Settings → Preparation usage** retains preparation-only cost estimates, including paid background summaries and past automatic work, not total spending or quota. Completed batches count explicit snapshots' first successful briefings, not cached preparation.
+
+**Paid summaries are a separate, default-off choice.** To prepare ahead, explicitly enable the NEW **Settings → Prepare summaries ahead** switch while **Automatically index history** is enabled. Old `auto_index=true` and retired 0.5 paid consent do not enable it. This sends eligible accumulated entries to the configured summary model within the same `max_invocations` allowance, with no provider/model fallback. Once-minute idle checks require at least 64 new/changed eligible records, independently of the embedding checkpoint. It warms validated summary leaves, reconciliation and compact final input, not a snapshot, final briefing, recap or review. Unchanged prepared input makes no further calls; closed chunks are reusable across appends. Changed unfinished per-session tails and aggregate reconciliation may still need work at **Start chat**, and the final briefing is always explicit—not a zero-wait promise.
+
+Foreground work cancels and awaits owned background provider work. Valid cache survives cancellation/restarts, with invocation spending retained for the same interrupted input. Paid failures pause until explicit retry, unlike local indexing's five-minute retry delay. Disabling either switch stops paid background work without deleting cache. See [the durable preparation policy](MEMORY.md#optional-paid-summary-preparation).
 
 Loopback (`http://127.0.0.1:40333`) needs no dashboard login by default. LAN exposure still requires configured dashboard authentication and trusted HTTPS for microphone access. There is no automatic firewall change or certificate trust installation.
 
+## Upgrade to 0.8.0
+
+<a id="upgrade-to-070"></a><!-- Preserve links from historical release notes. -->
+
+1. Back up original agent logs and the private Draken data directory. Preserve existing histories, conversations, notes, review coverage and frozen snapshots; do not replace them with an old database.
+2. Finish active calls/preparation, stop the server, and quit any tray that owns it. Install the released version with `npm install -g draken@0.8.0`, then restart using the same user, environment and `DRAKEN_DATA_DIR`.
+3. Check **Settings → Runtime & sign-in**. Existing pi/voice accounts and selected runtimes are unchanged; upgrading does not silently install or sign into a replacement runtime.
+4. Keep or change **Automatically index history** as desired. Its existing preference is preserved. **Prepare summaries ahead** remains separate and default off unless you already explicitly enabled it; this update grants no new paid consent. Live history updates need only local indexing, not paid summaries.
+5. Start a sync/chat explicitly for the initial briefing and history preparation. Active conversations then adopt newly prepared H history between turns. Their initial snapshot, E/C references, briefing, existing transcript and notes are not rewritten. Updates neither interrupt replies nor disable already-prepared chat; damaged captured originals still fail closed, and unavailable extra archive context must be disclosed.
+6. Expect **Session ended** after 30 minutes without a real user chat message or voice turn (creation is initial intent; an ongoing reply finishes first). Polling, background updates, assistant responses and connection heartbeats do not extend it. The transcript remains readable; notes/review remain explicit. Return home and **Start new sync** to chat again. Idle ending is not review and creates no recap.
+
+The additive conversation lifecycle migration persists last user activity and the ended marker separately from open/completed/discarded review status. Existing activity is derived from stored real user turns; inactive older sessions may end and release unreviewed reservations for the next explicit sync. No histories, notes, snapshots or review records are deleted. No dependencies change in this release. Do not run an older binary to undo schema changes.
+
+### Release qualification and website ordering
+
+For a source release, build and test sequentially once the backend/client changes are ready. Run conversation lifecycle and append-safe readiness tests (`tests/conversation.test.cjs`, `tests/live-history-readiness.test.cjs`), voice live-update/activity coverage (`tests/voice-live-updates.test.cjs` and existing activity tests), and the existing local-indexing/paid-cache suites against the new server build. Run `tests/ui/live-conversation.spec.ts` after the complete build, then `node --test tests/site-browser.cjs` and `node tests/package-smoke.cjs` with the complete package build. The site check serves static files and needs Playwright/Chromium, not an application build or provider. The package smoke requires built `dist/` and `public/` and installs an isolated production-only tarball; it must observe `auto_summary=false`, a metadata-only disabled auto-summary GET, and no background runs/provider activity by default. Synthetic tests do not establish provider latency, quality or account billing.
+
+Publish npm only through the separately authorized release process. The existing website workflow checks `scripts/site-release.cjs`: copy must match the package version and npm `latest` must be 0.8.0 before the site is deployed. Do not bypass this gate to publish release copy early. Updating docs/version/site files is not a merge, npm publication or live deployment.
+
 ## When pi is not installed
 
 Run these **on the server, as its operating-system user, with the same environment**—especially `DRAKEN_DATA_DIR`, `DRAKEN_PI_BIN` and model settings:
@@ -101,7 +124,7 @@ Home shows first-run guidance when no syncs exist, and a setup notice whenever s
 
 Choose **Settings → Agents & sessions**. Enable the history sources you want and use **Scan enabled agents**, or let the next explicit sync scan them. Source roots and permissions are independent of the private summarization runtime: installing pi does not enable Codex/Claude histories or change the original pi archive. See [SOURCES.md](SOURCES.md).
 
-Opening these instructions checks local metadata only. It does not install packages, refresh OAuth tokens, download embeddings, generate a summary, create a snapshot, acquire a microphone, or mark work reviewed. Enabled automatic local indexing runs independently of these instructions; it is on by default for new installations and can be turned off in Settings. It never creates snapshots or runs summary/briefing models.
+Opening these instructions checks local metadata only. It does not install packages, refresh OAuth tokens, download embeddings, generate a summary, create a snapshot, acquire a microphone, or mark work reviewed. Enabled automatic local indexing runs independently of these instructions; it is on by default for new installations and can be turned off in Settings. Local indexing alone never creates snapshots or runs summary/briefing models. If separately enabled, paid summary preparation also runs independently of browsing, but never creates snapshots or final briefings. Opening these instructions or settings GETs cannot grant that consent.
 
 ## Recovery and maintenance
 

package/TRAY.md

@@ -26,14 +26,14 @@ An already-running server is observed, not adopted. Stop is disabled for it, and
 - No Electron/browser bundle, downloaded native tray binary, development compiler, global PATH change, administrator access, or paid code-signing certificate is required by this tray implementation.
 - The packaged native scripts use OS frameworks. Draken does **not** change PowerShell execution policy, application-control policy, Gatekeeper, the firewall, or certificate trust. Managed/restricted desktops may refuse the helper; failure is reported rather than bypassed. Signing a future standalone installer is a separate concern.
 - No Linux tray, SSH/headless tray, Windows service integration, start-at-login registration, background updater, daemon supervisor, embedded terminal, or new login implementation is included in this first version.
-- Setup/login remain the existing explicit pi and native voice commands and browser guidance. The tray never installs pi, copies credentials, downloads a model, scans history, creates a sync, or captures audio itself. A server it starts retains the user's existing automatic-indexing preference and normal server behavior.
-- Stop/Quit can interrupt generation and active calls. Existing server shutdown preserves completed work and retains its normal recovery behavior; unfinished generation must be retried explicitly. No review coverage is advanced.
+- Setup/login remain the existing explicit pi and native voice commands and browser guidance. The tray never installs pi, copies credentials, downloads a model, scans history, creates a sync, or captures audio itself. A server it starts retains the user's existing automatic-indexing preference and the separate **Prepare summaries ahead** paid opt-in. The new paid switch defaults off even when indexing was already enabled; the tray cannot grant that consent. Enabled server-side paid preparation requires local indexing and follows the [cache-only policy](MEMORY.md#optional-paid-summary-preparation), never creating snapshots, final briefings or review.
+- Stop/Quit can interrupt generation and active calls. Existing server shutdown preserves completed work and retains its normal recovery behavior; unfinished foreground generation must be retried explicitly. Opted-in interrupted background cache work retains valid cache and spent invocations for the same input; paid failures remain paused until explicit retry. No review coverage is advanced.
 
 ## How it works
 
 `draken tray` starts a detached Node companion and waits for native UI readiness before reporting success. One heartbeat lock per data directory prevents duplicate companions. After an unclean companion exit, stale-lock recovery takes approximately 30 seconds; there is no unconditional lock deletion or PID-based kill. This is not the server's exclusion mechanism: every server independently acquires non-expiring, kernel-backed data-directory ownership before database initialization/recovery. See [server ownership and shutdown](ARCHITECTURE.md#languages-and-build-output).
 
-The companion polls only the bounded `/api/auth/status` identity endpoint. The native UI receives a bounded private presentation file and heartbeat, not server credentials, provider environment variables, source text, or tokens. Menu clicks return only fixed action identifiers. If the companion stops updating, the helper closes itself after 15 seconds.
+The companion polls only the bounded `/api/auth/status` identity endpoint. Tray polling and connection heartbeats do not count as real user turns or extend the conversation's 30-minute idle lifetime; ended sessions stay ended across server restarts. See [the lifecycle policy](MEMORY.md#live-conversations-and-idle-ending). The native UI receives a bounded private presentation file and heartbeat, not server credentials, provider environment variables, source text, or tokens. Menu clicks return only fixed action identifiers. If the companion stops updating, the helper closes itself after 15 seconds.
 
 An owned server reports its actual bound addresses and instance over a private parent/child IPC channel. Stop requests and parent disconnect use that channel, including on Windows, where `kill(SIGTERM)` would be an abrupt termination. There is no new HTTP shutdown endpoint. Server shutdown retains directory ownership until resource exit is confirmed; an unconfirmed stop leaves the server in a failed stopping state and the tray cannot replace it. Lost helpers cause shutdown of the tray's owned server only; existing external servers are unaffected.