draken 0.7.0 → 0.8.0

package/CHANGELOG.md

@@ -1,5 +1,27 @@
 # Changelog
 
+## 0.8.0
+
+### Live history without rewriting the sync
+
+- Active text and voice conversations adopt newly **prepared original history** between user turns as dated H evidence. Each answer pins one history cutoff; updates do not interrupt an ongoing reply or disable already-prepared chat. The initial snapshot, E/C references, briefing, saved transcript and notes are not rewritten by updates. Initial briefing and history preparation are still required once.
+- Fix readiness invalidation from ordinary source appends and background scan cursor changes. Damaged, missing or excluded captured originals still fail closed. If additional archive lookup is unavailable during an update, replies must qualify that limitation rather than guess or silently substitute old context.
+- With **Automatically index history** enabled, active conversations check once a minute for any positive source changes, without waiting for 64. Connected, idle voice can allow local background work between turns, never during a pending response or context delivery; a user turn preempts and drains owned indexing. With no active conversation, the 64-record threshold and no timed small-tail flush remain.
+- Live H updates are local-only, not per-minute provider calls. **Prepare summaries ahead** remains a separate default-off paid permission with its independent 64-record threshold. Neither background path creates syncs, final briefings, recaps, saved decisions or review. Settings/status GETs remain metadata-only.
+
+### Sessions end without marking work reviewed
+
+- End a conversation after 30 minutes without a real user chat message or voice turn; initial creation counts as initial intent. Polling, background updates, assistant responses and connection heartbeats do not extend it. An ongoing reply finishes before idle expiry.
+- Show **Session ended**, not reviewed or completed. Keep the transcript readable and explicit notes/review available for the old snapshot. Return home and **Start new sync** to chat again; replay, polling and reopening cannot revive an ended session.
+- Persist last user activity and the ended marker across restarts, separately from existing open/completed/discarded review status. Idle ending releases unreviewed reservations for the next explicit sync, without deleting history, changing notes or generating an automatic recap/review. Migration derives activity from stored real user turns; inactive older sessions may end and their unreviewed entries become available again.
+- Simple live status is **Up to date**, **Preparing new info…** or **New info ready**, with honest off/unavailable states where applicable. Voice's separate 30-minute connection limit, 60-turn cap and 90-second disconnect lease remain resource bounds, not unlimited calling or spending guarantees.
+
+### Upgrading and qualification
+
+Back up original agent logs and Draken state, finish active work, stop the server (including any tray-owned server), install 0.8.0 and restart with the same data directory and environment. Node.js 22.19+ remains required. The conversation lifecycle migration is additive; existing review statuses and historical data remain intact. No dependency changes. See [SETUP.md](SETUP.md#upgrade-to-080) and [MEMORY.md](MEMORY.md#live-conversations-and-idle-ending).
+
+Focused coverage includes conversation lifecycle, append-safe readiness and between-turn voice updates, alongside existing activity/indexing regressions. Package and static-site checks protect release copy and fresh paid opt-out. Synthetic checks do not establish real-provider answer quality, latency, quota or physical-device audio acceptance.
+
 ## 0.7.0
 
 ### Optional paid summary preparation, without automatic syncs

package/MEMORY.md

@@ -8,7 +8,7 @@ There is no memory-enable switch, search-mode selector or wider-history checkbox
 
 The first request with eligible retained history downloads approximately **136 MB** of pinned model/tokenizer files from Hugging Face, verifies their SHA-256 checksums and prepares local embeddings. Later requests reuse them and automatically embed new or changed records. Empty history does not require a model download.
 
-Search combines meaning and exact keywords every time. It waits for both indexes rather than quietly returning keyword-only results while semantic work is incomplete. First use or a large amount of newly collected history can take minutes. Search, text-reply preparation and pre-call preparation show the current phase, model-download bytes or completed/total **new or changed unique passages**, unchanged cached work separately, elapsed time and an approximate remaining time once enough passages have been measured. The estimate can change with passage length. Progress is read-only metadata; polling it does not start indexing. **Call Draken stays disabled until both the briefing and searchable history are ready.** Sync preparation includes history preparation; an older or changed sync offers **Prepare history**, with progress and cancellation on the sync page, not inside a call. Call creation checks readiness again and rejects unprepared history without starting a call or building an index. Cancelling or failing preparation leaves the microphone off. Ordinary concurrent requests queue behind one history process, within a fixed bound. Its embedding lanes run bounded batches in parallel; they do not run concurrent database writers. An unchanged index shows **History is up to date**, not a full-archive progress bar.
+Search combines meaning and exact keywords every time. It waits for both indexes rather than quietly returning keyword-only results while semantic work is incomplete. First use or a large amount of newly collected history can take minutes. Search, text-reply preparation and pre-call preparation show the current phase, model-download bytes or completed/total **new or changed unique passages**, unchanged cached work separately, elapsed time and an approximate remaining time once enough passages have been measured. The estimate can change with passage length. Progress is read-only metadata; polling it does not start indexing. **Initial calling/chat requires both the briefing and searchable history to be ready.** Later append-only updates do not disable an already-prepared conversation. Sync preparation includes history preparation; an older or changed sync offers **Prepare history**, with progress and cancellation on the sync page, not inside a call. Call creation checks readiness again and rejects unprepared history without starting a call or building an index. Cancelling or failing preparation leaves the microphone off. Ordinary concurrent requests queue behind one history process, within a fixed bound. Its embedding lanes run bounded batches in parallel; they do not run concurrent database writers. An unchanged index shows **History is up to date**, not a full-archive progress bar.
 
 No session text or queries are uploaded for embedding. Text discussion and ChatGPT voice do receive the relevant historical excerpts, just as they receive frozen snapshot context. Those excerpts are dated background—not newly reviewed progress, agreement or permission to execute work.
 
@@ -18,21 +18,40 @@ Opening/reloading a page does not itself download the model, compute embeddings
 
 **Settings → Automatically index history** controls scanning and local search indexing only. It is on by default for new installations and works while the server runs, even without a browser. Existing installations retain their saved indexing choice, including off; reads and restarts never reset it. On upgrade, an existing `auto_index` choice wins; only when it is absent is the legacy combined preference copied. A missing preference on an existing installation remains off. Retired automatic-briefing consent and job markers are removed, not resumed or migrated into the new paid `auto_summary` opt-in. Indexing may download the pinned local embedding model on first use and consumes local CPU, memory and disk, but makes no provider model calls. It never creates syncs, summaries, recaps or briefings, starts audio, or advances review. Existing snapshots (including past automatically created ones), cached summaries, conversations and notes remain ordinary retained history, not resumable automatic jobs.
 
-The app's single scheduler checks once a minute when no sync, call or foreground history work is active. A background indexing batch requires at least 64 changed source records, regardless of elapsed time. Entries accumulate for the next explicit sync; an already indexed backlog does not trigger a briefing. There is no timed flush. Smaller pending batches wait for a sync, **Prepare history**, or search; that foreground path has no minimum batch size. Background indexing records the same history readiness used by calls. If anything still needs preparation, Call remains disabled—clicking it cannot start a hidden indexing job. Metadata hashes detect additions, edits and removals once per original source entry (or discussion/note record). Session/file bookkeeping does not add records, and frozen aliases coalesce with the original rather than multiplying the count. Actual indexing still reconstructs and verifies admitted source bytes. Unchanged checks do not start an embedding request. Source records and embedding passages are different counts. New sessions from enabled agents retain the collector's included-by-default behavior; per-agent/per-session exclusions and the existing baseline remain respected. Codex and Claude sources require separate explicit opt-in in **Settings → Agents & sessions**, even if background indexing is already enabled. Explicit summarization continues to use pi. See [SOURCES.md](SOURCES.md).
+The app's single scheduler checks once a minute. With an active, non-ended conversation, **any positive source-change count** can trigger local indexing; there is no 64-record wait. Without an active conversation, a background batch still requires **at least 64 changed source records**, regardless of elapsed time, and there is **no timed small-tail flush**. Smaller inactive tails wait for a sync, **Prepare history**, or search; foreground preparation has no minimum batch size. Connected idle voice permits local background work between turns, but never during a pending response or context delivery. User turns and foreground jobs preempt and drain owned indexing before proceeding. Entries accumulate for the next explicit sync; an indexed backlog never triggers a briefing. Background indexing publishes prepared history for between-turn adoption, not new snapshot membership. Initial preparation remains required; an append or scan cursor advance cannot revoke an already-captured valid receipt or disable prepared chat. Metadata hashes detect additions, edits and removals once per original source entry (or discussion/note record). Session/file bookkeeping does not add records, and frozen aliases coalesce with the original rather than multiplying the count. Actual indexing still reconstructs and verifies admitted source bytes. Unchanged checks do not start an embedding request. Source records and embedding passages are different counts. New sessions from enabled agents retain the collector's included-by-default behavior; per-agent/per-session exclusions and the existing baseline remain respected. Codex and Claude sources require separate explicit opt-in in **Settings → Agents & sessions**, even if background indexing is already enabled. Explicit summarization continues to use pi. See [SOURCES.md](SOURCES.md).
 
 Foreground requests preempt and await the owned automatic indexing job. Disabling cancels local indexing and also stops any separately opted-in paid background preparation, since paid work requires indexing enabled. Completed vectors and valid summary cache remain reusable. Local preparation failures retry no sooner than five minutes; foreground preemption waits at least one minute. **Retry automatic indexing** permits an explicit retry in Settings. Shutdown awaits owned work. Settings/progress GETs remain metadata-only. Home and Settings show local indexing status, pending source changes, entries available for the next sync and the last completed indexing batch—not ownership of a prepared briefing. The separate paid-preparation status does not turn local indexing into provider work. The saved preference and last completion survive restart.
 
-Only an explicit **Sync with Draken** or **Chat instead** action creates a new snapshot and starts its briefing. It includes all eligible accumulated entries not held by another open sync, preserving request-ID idempotency and explicit retry. No old automatic snapshot is claimed or resumed by a new request. Preparation usage history still includes past automatic work, retries and failures; indexing does not erase those costs. The hash-only search checkpoint still advances only after successful global preparation. Missing older checkpoints can be established by local preparation, reusing compatible vectors. No source-text copy, provider substitution, vector conversion or timed small-batch flush is introduced.
+Only an explicit **Sync with Draken** or **Chat instead** action creates a new snapshot and starts its briefing. It includes all eligible accumulated entries not reserved by another open, non-ended sync, preserving request-ID idempotency and explicit retry. No old automatic snapshot is claimed or resumed by a new request. Preparation usage history still includes past automatic work, retries and failures; indexing does not erase those costs. The hash-only search checkpoint still advances only after successful global preparation. Missing older checkpoints can be established by local preparation, reusing compatible vectors. No source-text copy, provider substitution or vector conversion is introduced. The no-timed-small-tail policy still applies when there is no active conversation.
 
-A failed preparation/search reports an error. If a session file changed, moved or disappeared, scan sessions again before retrying; stale derived text is not a substitute for a verified source. Otherwise retry the question or **Prepare history**; completed embeddings are reused automatically. Cancel preparation on the sync page to stop that work. Cancelling a search or text reply stops its owned work too. Reloading does not start a call. An older cache without a call-readiness record needs one preparation pass, which reuses its compatible vectors. A completed index over a partial import is not sufficient: foreground call preparation first drains bounded import chunks to captured file ends. Missing, changed or incomplete originals block readiness. Later appends do not force preparation to chase a live stream forever; the call uses its displayed cutoff, and new work waits for another preparation. A ready sync offers **Refresh history** for an explicit local-only update without regenerating its briefing. See [SOURCES.md](SOURCES.md).
+A failed preparation/search reports an error. If a session file changed, moved or disappeared, scan sessions again before retrying; stale derived text is not a substitute for a verified source. Otherwise retry the question or **Prepare history**; completed embeddings are reused automatically. Cancel preparation on the sync page to stop that work. Cancelling a search or text reply stops its owned work too. Reloading does not start a call. An older cache without a call-readiness record needs one preparation pass, which reuses its compatible vectors. A completed index over a partial import is not sufficient for initial readiness: foreground preparation first drains bounded import chunks to captured file ends. Missing, damaged or incomplete captured originals block readiness. Later appends do not force preparation to chase a live stream forever or invalidate its verified prefix. Each answer uses one prepared cutoff; a newer successfully prepared cutoff becomes eligible between user turns. A ready sync also offers **Refresh history** for an explicit local-only update without regenerating its briefing. See [SOURCES.md](SOURCES.md).
+
+### Live conversations and idle ending
+
+The initial briefing and searchable history must be prepared once. Thereafter, an active text or voice conversation can adopt **newly prepared original history as dated H evidence between user turns**. This is not a moving snapshot: initial membership, E/C references, briefing, already saved transcript and explicit notes are never rewritten by history updates. New H context is not review coverage. Explicit **Mark reviewed** covers only the initial snapshot, subject to its existing evidence/preparation checks.
+
+Each answer/voice turn pins one history cutoff for all its lookups, context parts and any text correction. A completed background pass cannot replace context mid-answer or interrupt a reply. Adoption happens only between turns, never from partially indexed data. Ordinary source appends and background scan/import cursor advances must not invalidate already captured context: the 0.7 file-cursor identity coupling is not a source-integrity check. Keep receipt identity tied to admitted captured records, not mutable tail bookkeeping. Actual damage, missing originals, exclusions or incompatible captured projections still fail closed; reads continue verifying original bytes. If additional archive lookup is unavailable during an update, explicitly qualify unavailable context rather than guess, serve stale derived text or silently fall back to an old conversation. An update alone must not disable already-prepared chat.
+
+Local live updates use only `auto_index`, with once-minute checks for **any positive source changes** while a conversation is active. They do not run per-minute provider calls. `auto_summary` remains separately authorized, default off, with its own 64-record threshold and paid-failure policy below. Neither background path creates syncs, final briefings, recaps, decisions or review. A connected idle voice call is not itself a reason to block local indexing; pending response/context delivery is. A user turn preempts and awaits owned indexing cleanup before retrieval. Settings/status GETs read metadata only: no source-body reads, scans, embeddings or provider inference.
+
+The simple status vocabulary is **Up to date**, **Preparing new info…**, **New info ready**, with **Live updates off** / **Updates unavailable** when applicable. It describes preparation/adoption, not independent verification or guaranteed exhaustive recall. No extra live-update control is required.
+
+Conversation lifetime is separate from review status and native connection limits:
+
+- End after **30 minutes since the last real user chat message or voice turn**. Initial creation counts as initial intent. Assistant responses, polling, indexing, preparation updates and connection heartbeats never extend the deadline. An ongoing reply is allowed to finish before idle expiry; its completion does not reset user activity.
+- Persist last activity and an ended marker across restarts using additive conversation fields or a related table. Preserve the existing `open` / `completed` / `discarded` review-status constraint; do not recast idle ending as completed/reviewed. Show **Session ended**.
+- An ended conversation cannot accept new chat/voice turns or be revived by request replay, polling, page reopening or restart. Return home and **Start new sync**. Its transcript remains readable, and explicit notes/review can remain available for its old snapshot under existing checks.
+- Idle ending releases that conversation's unreviewed reservations for the **next explicit new sync**. It does not delete snapshot rows, create a sync, change notes, generate a recap or advance coverage. Snapshot membership remains historical even after its reservation ends.
+- Migration derives activity from real stored user turns (creation when none exist), never generated replies or updated-at bookkeeping. Inactive older conversations may end and their unreviewed entries become available again; no history is deleted.
+- Voice's separate **30-minute connection limit, 60-turn cap and 90-second disconnect lease** may still end a connection earlier. The user-idle policy is not removal of resource bounds or a promise of unlimited calls.
 
 ### Optional paid summary preparation
 
-**Draken 0.7.0 adds Settings → Prepare summaries ahead (`auto_summary`).** This is a NEW explicit paid opt-in, default **off** on fresh installations and upgrades, even when `auto_index=true` or the retired 0.5 paid setting was enabled. It requires **Automatically index history** to be enabled. Local indexing retains its defaults/preferences and makes no provider calls by itself. Opening `GET /api/settings/auto-summary` returns metadata (`enabled=false` on a fresh installation); neither this GET nor other settings/progress reads scan history, start inference or grant consent.
+**Settings → Prepare summaries ahead (`auto_summary`), introduced in 0.7.0, remains separate paid consent.** It defaults **off** on fresh installations and upgrades without this explicit consent, even when `auto_index=true` or the retired 0.5 paid setting was enabled. An already-saved explicit choice is preserved. It requires **Automatically index history** to be enabled. Local indexing retains its defaults/preferences and makes no provider calls by itself. Opening `GET /api/settings/auto-summary` returns metadata (`enabled=false` on a fresh installation); neither this GET nor other settings/progress reads scan history, start inference or grant consent.
 
 #### Read-only eligibility, shared summary cache
 
-Paid preparation reads the accumulated entries eligible for the next explicit snapshot, respecting enabled agents, session selection, baseline, active-branch projection, verified originals, existing coverage and entries already held by open syncs. It does not reserve those entries or create/own `syncs`, `sync_items`, `sync_coverage`, `sync_messages`, `sync_runs` or `sync_tree_nodes` rows. It never runs the final model, generates a briefing or recap, starts a call, saves user notes or advances review. Existing histories, notes, coverage and frozen snapshots are unchanged.
+Paid preparation reads the accumulated entries eligible for the next explicit snapshot, respecting enabled agents, session selection, baseline, active-branch projection, verified originals, existing coverage and entries reserved by open, non-ended syncs. It does not reserve those entries or create/own `syncs`, `sync_items`, `sync_coverage`, `sync_messages`, `sync_runs` or `sync_tree_nodes` rows. It never runs the final model, generates a briefing or recap, starts a call, saves user notes or advances review. Existing histories, notes, coverage and frozen snapshots are unchanged.
 
 The work warms the **same validated `summary_cache` leaves plus reconciliation/compact final input used by explicit sync**, with the same model/prompt/content identity and citation validation—not a separate rolling-memory summary or an unvalidated text shortcut. An explicit sync freezes all then-eligible accumulated evidence and consumes matching cache; warming cache is neither inclusion nor review. Completed closed chunks remain reusable across appends. Changed unfinished per-session tails and aggregate reconciliation may need on-demand work at **Start chat**; the final briefing and any prior-conversation recaps always remain explicit. Cache preparation can reduce repeated work, but does not promise zero latency.
 
@@ -59,7 +78,8 @@ Ordinary existing batch keys and validated historical leaf caches remain compati
 - `tests/background-tree.test.cjs` covers snapshot-free shared-cache preparation, validated leaves/reconciliation/compact input, unchanged reuse and append/tail behavior.
 - `tests/background-preparation.test.cjs` covers new paid consent, exact edit/removal thresholds, lost/corrupt cache recovery, ownership/cancellation, durable invocation spending, content-free ledger fields, pause-until-retry failures and preparation accounting without sync/review writes.
 - `tests/summary-preparation-http.test.cjs` checks separate consent validation, cross-origin rejection and metadata-only status reads; `tests/ui/summary-preparation.spec.ts` checks opt-in, error recovery and explicit retry.
-- `tests/source-batch.test.cjs` and `tests/automatic-index.test.cjs` cover accumulation across batches/restarts, committed checkpoints, small tails and cancellation without automatic snapshots or provider work.
+- `tests/source-batch.test.cjs` and `tests/automatic-index.test.cjs` cover accumulation across batches/restarts, committed checkpoints, inactive small tails and cancellation without automatic snapshots or provider work.
+- `tests/conversation.test.cjs` covers real-user idle timing, restart/migration persistence, ended-session rejection and reservation release without review. `tests/live-history-readiness.test.cjs` covers append-safe receipts and between-turn adoption without masking original damage. `tests/voice-live-updates.test.cjs` and existing activity tests cover voice ownership/cutoffs; `tests/ui/live-conversation.spec.ts` covers status and return-home/new-sync recovery. These are synthetic regressions, not real-provider or physical-device qualification.
 - `tests/automatic-briefing.test.cjs` protects user-only generation, request-ID idempotency and preservation of old snapshots, notes, caches and coverage. Its name describes the behavior that must not return.
 - `tests/automatic-defaults.test.cjs` covers preference migration; `tests/package-smoke.cjs` checks fresh `auto_index=true`, `auto_summary=false`, the disabled metadata-only auto-summary GET and zero background/provider activity in a production-only installation.
 
@@ -85,7 +105,7 @@ Packets retain contiguous excerpts and, when clipped, separately labelled ending
 
 Final answers use a stable per-request `R1`, `R2`, … label catalog, mapped by Draken to the admitted E/C/H source references before validation and persistence. Source excerpts, earlier briefings and discussion are quoted data: their embedded citation syntax does not create labels. Explicit source requests are mapped into the same catalog. Unknown labels are neither guessed nor dropped. If a text answer has missing/out-of-catalog citations or cites a linked old checkpoint while ignoring supplied later reports (including E/C aliases), Draken permits **one combined correction using the same final model and invocation/cancellation budget**. The rejected draft is never saved or shown. A second failure is visible and retains the user question without an assistant answer. **Checking source references** or **Checking later updates** identifies the actual correction stage. It can consume one additional final-model request; chat/repair usage remains outside the preparation-only estimate. This citation-consistency check is not proof that every claim is true. Native voice shares the larger evidence selection and deterministic later-report checking, but **not the pi answer-repair pass**: already-streamed speech cannot be retracted or certified by this citation guard. Its prompt keeps the same concise delivery target, including necessary caveats. Shared evidence does not establish identical generated answers or exhaustive recall.
 
-Chat readiness checks the prepared receipt at its captured cutoff. New chat messages beyond that cutoff are passed directly as recent conversation and do not force an index rebuild on every turn. Original-file identity/import cursors, selection changes, missing originals and edits to already captured records still invalidate readiness. Fresh native-call readiness keeps its stricter current-record check. Both readiness endpoints only read metadata. Refresh is explicit; chat does not silently refresh the corpus, regenerate a briefing or switch providers.
+Chat and voice pin a prepared receipt/cutoff per turn and adopt newer prepared original history only between turns. New chat messages are passed directly as recent conversation and do not force an index rebuild on every turn. Ordinary appends and import cursor changes do not invalidate the captured prefix; selection changes, missing originals and damage to already captured records still fail closed. Readiness/status endpoints only read metadata. Local background preparation or an explicit refresh can publish a newer cutoff; neither regenerates the briefing or switches providers.
 
 ## How it works
 
@@ -130,13 +150,13 @@ Back up both current databases before deployment and qualify migration on privat
 
 Source inclusion, missing-session state, active branches for unsnapshotted entries and the existing history baseline are respected. Frozen evidence remains historical, including superseded branch material. Reviewed records remain searchable. Discarded sync discussion/notes are excluded, while discarded work can still be eligible through an active selected session.
 
-Ordinary search and text discussion prepare the candidates observed at their start. Voice instead uses the history cutoff prepared before the call: it verifies original bytes and queries existing passages, but does not build missing corpus embeddings or download a missing model. Newer records wait for a later preparation and call. Query embeddings still run locally during a call. Exclusions and edits are rechecked after inference; stale or unprepared history fails visibly rather than being quietly rebuilt during the call. This avoids mixing fresh keyword-only records into results described as fully hybrid.
+Ordinary search and legacy text discussion can prepare candidates observed at their start. Active chat and voice instead pin a prepared history cutoff for each answer/turn: retrieval verifies original bytes and queries existing passages, but does not build missing corpus embeddings or download a missing model in a pending reply. Newer records wait for successful local preparation and a between-turn boundary, not necessarily a new call. Query embeddings still run locally during a call. Exclusions and edits are rechecked after inference; damaged or unprepared history is not silently substituted or rebuilt inside the answer. If extra archive lookup is unavailable during an update, disclose the limitation. This avoids mixing fresh keyword-only records into results described as fully hybrid.
 
 Sync discussion is its own retained record: excluding a session does not erase text previously discussed in a sync. Recaps/current briefings are not separately indexed as primary evidence, though preserved discussion can contain historical assistant summaries; attribution remains visible.
 
 Search covers admitted normalized source projections and retained Draken discussion—not every byte of the original JSONL files. Excerpt, ranking and packet limits can omit important information. No match is not proof something never happened. Similarity is not proof a source supports an answer. The local multilingual qualification is not a comprehensive relevance benchmark.
 
-Open-sync notes have no retained edit timestamp and are not backdated. Date filters exclude undated notes. Calls use their start time as the historical cutoff so the active call does not retrieve its new questions as old history. A date filter does not reconstruct an earlier database state: context edits may change retained text without supplying a separate edit date.
+Open-sync notes have no retained edit timestamp and are not backdated. Date filters exclude undated notes. Each voice turn pins its adopted prepared-history cutoff; work questions continue preferring original agent records rather than retrieving the active conversation's own questions as evidence. A date filter does not reconstruct an earlier database state: context edits may change retained text without supplying a separate edit date.
 
 Generated/interrupted speech stays qualified as generated/interrupted. Historical requests are data, not instructions. Prompts distinguish plans, reported work, observed validation and uncertainty. Models can still make semantic mistakes; inspect supporting records. Retrieval cannot save decisions, execute tools, complete syncs or advance coverage.
 

package/README.md

@@ -10,9 +10,9 @@ A local-first engineering sync across your **pi, Codex CLI and Claude Code sessi
 
 **Sync with Draken → call or chat → keep a short recap.**
 
-**Draken 0.7.0** adds optional paid summary preparation without automatic syncs. The NEW **Settings → Prepare summaries ahead** switch is **off by default**, including upgrades with local indexing already enabled. See [the release notes](CHANGELOG.md#070).
+**Draken 0.8.0** keeps active conversations current with newly prepared original history between turns, without rewriting the initial snapshot or briefing. After 30 minutes without a real user turn, the **Session ended** state preserves the transcript and releases unreviewed entries for your next explicit sync. Paid summary preparation remains separate and off by default. See [the release notes](CHANGELOG.md#080).
 
-**Automatic local indexing:** new installations accumulate searchable history automatically while the server runs. Change this in **Settings → Automatically index history**. Existing installations keep their saved indexing choice, including off. Local indexing alone never creates syncs, summaries or briefings and makes no provider model calls. Only an explicit **Sync with Draken** or **Chat instead** action creates a new snapshot and starts its briefing. Original agent logs, existing snapshots, cached summaries, conversations and notes remain untouched. Nothing is marked reviewed automatically.
+**Automatic local indexing:** new installations accumulate searchable history automatically while the server runs. Change this in **Settings → Automatically index history**. Existing installations keep their saved indexing choice, including off. Local indexing alone never creates syncs, summaries or briefings and makes no provider model calls. Only an explicit **Sync with Draken** or **Chat instead** action creates a new snapshot and starts its briefing. Original agent logs, existing snapshots, cached summaries, conversations and notes are not rewritten by indexing. Active conversations check once a minute for any positive source changes; without an active conversation, indexing retains 64-record batching with no timed small-tail flush. Nothing is marked reviewed automatically.
 
 **Optional paid preparation:** enable **Prepare summaries ahead** explicitly, with **Automatically index history** also enabled, to warm cached summaries using your configured summary model and its quota/API billing. Once-minute idle checks start at 64 new/changed eligible records, independently of the embedding checkpoint. This prepares validated leaves, reconciliation and compact final input—not snapshots, final briefings, recaps or review. Unchanged prepared input makes no further calls; closed chunks survive appends, but changed per-session tails and reconciliation may still need work at **Start chat**. The final briefing always runs explicitly; preparation ahead is not an instant-chat guarantee. Disabling either switch stops paid background work and preserves valid cache. Paid failures pause until explicit retry; local indexing retains its five-minute retry delay. No retired paid setting is migrated into this new consent.
 
@@ -28,7 +28,7 @@ Draken remembers which evidence a finished sync covered, what you decided, and w
 
 Requires Node.js **22.19+** and npm. Session-log indexing and evidence review do not require a model or pi executable. Generated briefings and discussion use **pi 1.4+**. Existing configured pi works unchanged; otherwise **`draken setup`** installs a pinned private runtime and **`draken login`** opens pi’s own authentication interface. See [SETUP.md](SETUP.md) for the full first-run flow, private directories and recovery.
 
-> **Upgrading?** Back up your original agent logs and Draken data first. Versions **0.1.6 and earlier** are the old task dashboard, not this application. See [what changed in 0.7.0](CHANGELOG.md#070) and [upgrade instructions](SETUP.md#upgrade-to-070), including the new opt-in.
+> **Upgrading?** Back up your original agent logs and Draken data first. Versions **0.1.6 and earlier** are the old task dashboard, not this application. See [what changed in 0.8.0](CHANGELOG.md#080) and [upgrade instructions](SETUP.md#upgrade-to-080), including idle ending of older inactive sessions.
 
 ```sh
 npm install -g draken
@@ -56,8 +56,8 @@ Run setup/login as the server’s user with the same environment. `draken status
 
 1. Set up [ChatGPT voice](VOICE.md) once. Use localhost or trusted HTTPS.
 2. Click **Sync with Draken**. Draken scans, freezes all available entries, summarizes earlier conversations, prepares the briefing, then starts the call on the same visible page. Browser microphone permission may still be required. This is one explicit action, not an automatic call on page load.
-3. Talk. Ending the call requests a short, cached recap; it never saves decisions or marks evidence reviewed.
-4. Return home for compact cards, or open any `/syncs/:id` independently. Reopening/reloading a URL never starts capture. **Call Draken** resumes discussion of that frozen snapshot without collecting later activity.
+3. Talk. Explicitly ending the call requests a short, cached recap; it never saves decisions or marks evidence reviewed.
+4. Return home for compact cards, or open any `/syncs/:id` independently. Reopening/reloading a URL never starts capture. **Call Draken** continues an active conversation with the same frozen snapshot; newly prepared history can supplement later turns without changing that snapshot.
 5. Use **Chat instead** for a separate text conversation, or expand the detail sections to inspect the briefing/evidence and explicitly save **Decisions** and **Carry into the next sync**. **Mark reviewed** is separate and optional before starting another sync; only that explicit action advances coverage.
 
 **Settings → Automatically index history** controls local-only background work. Entries remain available until you explicitly create a sync; old automatically created snapshots remain readable and are not silently resumed. Indexing uses local resources and may download pinned model files, but makes no provider calls. The separate **Prepare summaries ahead** switch authorizes paid cache preparation only when indexing is enabled; an old `auto_index=true` does not enable it. See [background indexing](MEMORY.md#optional-background-indexing) and [paid preparation](MEMORY.md#optional-paid-summary-preparation) for batching, cancellation, saved preferences and upgrade behavior.
@@ -76,7 +76,11 @@ A square Draken portrait accompanies replies. **Searching your prepared history*
 
 Chat replies default to one short paragraph or at most three short bullets, usually 60–100 words plus citations; simple questions can be shorter. Ask for a detailed breakdown when you want one. The model still reads the same evidence and checks later reports: brevity does not mean weaker retrieval or dropped qualifications. This is a response-style instruction, not a hard word limit or an extra shortening-model pass. Opening briefings keep their separate format.
 
-Replies use the sync's configured final text model through pi, with the briefing, recent conversation and project-aware original-history retrieval. The prepared archive has a displayed cutoff; new chat messages are supplied directly without rebuilding corpus embeddings after every turn. **Refresh history** admits later work. Changed, excluded or unavailable original sources still block readiness. Chat never opens a native call, implicitly regenerates a ready briefing, saves decisions or marks evidence reviewed. Chat quota/cost is separate from the preparation-only **Est. cost**.
+Replies use the sync's configured final text model through pi, with the briefing, recent conversation and project-aware original-history retrieval. Initial briefing and history preparation are required once. Each answer pins one prepared history cutoff; newer prepared originals become dated H evidence between user turns, never changes to the initial E/C references, briefing, saved transcript or notes. Ordinary appends and background scans do not invalidate already captured context or disable prepared chat. True damage, exclusion or loss of captured originals still fails closed. If extra archive lookup is temporarily unavailable during an update, the answer must say so rather than guess or silently fall back. **Refresh history** remains an explicit local update. Chat never opens a native call, implicitly regenerates a ready briefing, saves decisions or marks evidence reviewed. Chat quota/cost is separate from the preparation-only **Est. cost**.
+
+Live status is **Up to date**, **Preparing new info…** or **New info ready**; off/unavailable states are labelled when applicable. Updates do not interrupt an ongoing reply. With automatic indexing enabled, local updates run once a minute for any positive source changes during an active conversation—no 64-record wait and no per-minute paid calls. Voice permits this work while connected and idle between turns, never during a pending reply or context delivery; a user turn preempts and drains owned indexing.
+
+After **30 minutes without a real user chat message or voice turn**, the conversation shows **Session ended**. Creation counts as initial intent; polling, background work, assistant responses and connection heartbeats do not extend it. An ongoing reply finishes first. The ended marker survives restart; reopening or replaying a request cannot revive it. Read the transcript or explicitly edit notes/review the old snapshot, or return home and **Start new sync** to chat again. Idle ending releases unreviewed reservations without deleting history, changing notes, making a recap or marking anything reviewed. Only explicit review covers the initial snapshot, never later H context. See [the lifecycle policy](MEMORY.md#live-conversations-and-idle-ending).
 
 For status questions, chat and native voice use the same bounded original-evidence selection and check later related reports before repeating old blockers, including follow-ups to a report that was itself superseded. New calls inherit project focus from actual saved user turns. Voice delivers the larger evidence packet through bounded native context parts while keeping spoken answers concise; it does not add a pi generation step. The following answer-repair check remains text-only; streamed speech is not post-validated. Client implementation, backend foundations, delivery enablement and device acceptance are kept distinct. The final model uses short per-answer reference labels, which Draken maps back to admitted original links; quoted historical citations never authorize new references. Bad/missing citations and ignored later follow-ups share one bounded same-model correction, with the same label catalog in both calls. A second validation failure remains visible without saving an unsupported draft. Retrieval and citation consistency do not independently verify the agent's claims; see [MEMORY.md](MEMORY.md#separate-text-chat) for bounds and voice differences.
 
@@ -119,7 +123,7 @@ Each sync card and detail page shows **Est. cost** for its preparation: chunk su
 
 Settings includes a **Preparation usage** dashboard with 6-hour, 1-day, 7-day and 14-day lookbacks, and 1-hour, 6-hour or 24-hour UTC buckets. It shows completed briefing batches, model requests and their recorded API-price estimate, across preparation history, including paid background summaries, past automatic work, retries, failed work and discarded snapshots. Metadata-only `background_runs` retains input hashes, counters and metrics, with no source text. `preparationUsage` includes its spend, requests and failures; `completed_batches` does not count cache preparation. A batch is an explicit snapshot's first successful briefing preparation; rebuilds add cost without counting it again. It is not proof of review or current call readiness. Request costs are placed at their start time, and completed batches at their completion time. New requests have durable timestamps, including pending/interrupted requests; older metrics use the run start and are explicitly approximate. Missing usage/pricing is unavailable or a partial subtotal, never a fabricated zero or a backfill from today's prices. These are estimates, not invoices or subscription/quota balances. Chat, native voice, post-conversation recaps and local machine/network costs are excluded. Opening Settings and changing the time range only read accounting metadata; polling stops when it closes.
 
-The final model receives bounded summaries, raw verification excerpts, saved decisions, and recent conversation—not the entire transcript. Questions additionally retrieve up to 16 raw snapshot entries and automatically receive a bounded hybrid-search packet from retained earlier history, with separate global H citations. The separate chat surface requires prepared history and uses its captured cutoff; ordinary standalone search and the older discussion API can prepare the local index as needed. Wider history is not added to the frozen snapshot. Final citation validation checks reference existence and, for text status replies, whether cited checkpoints address their supplied follow-ups. Neither check proves that every claim is actually supported.
+The final model receives bounded summaries, raw verification excerpts, saved decisions, and recent conversation—not the entire transcript. Questions additionally retrieve up to 16 raw snapshot entries and automatically receive a bounded hybrid-search packet from retained earlier history, with separate global H citations. The separate chat surface requires prepared history and pins its cutoff per answer; ordinary standalone search and the older discussion API can prepare the local index as needed. Wider history is not added to the frozen snapshot. Final citation validation checks reference existence and, for text status replies, whether cited checkpoints address their supplied follow-ups. Neither check proves that every claim is actually supported.
 
 The manager is a **read-only conversation**, not a worker. Its responses distinguish intent, attempts, agent-reported implementation, and observed validation, with clickable evidence references. Model-generated claims still need human review. Draken does not independently run tests or verify Git/CI/deployment state.
 
@@ -127,19 +131,19 @@ The manager is a **read-only conversation**, not a worker. Its responses disting
 
 The new workflow freezes the three most recent non-discarded syncs' briefing, discussion and explicit notes at snapshot creation. Their full supplied text passes through cached bounded map/reduce recap jobs; it does not silently select only the final messages. This remains **lossy summarization**, not exhaustive recall or independent verification. Recaps are 1–5 short lines (at most 600 characters), labelled historical summaries rather than agreement. Overlong prose lines can be reflowed at existing spaces without dropping words or qualifications, provided the same five-line/600-character limits still hold. Other invalid responses get one correction, not an unlimited retry. Preparation metrics record content-free validation reasons and line lengths, never rejected recap text. Old source IDs are not treated as this snapshot's citations. Original histories remain available at their own URLs.
 
-The card shows a short recap, or an explicitly labelled briefing preview until one exists, with its body clamped to three visual lines. A changed conversation marks an older recap as stale. Closing the call UI requests an asynchronous recap using the cheap model (maximum 32 invocations, also bounded by the sync's saved ceiling); interrupted browser exits cannot guarantee that request. **Make recap / Refresh recap** retries explicitly, and the next sync recomputes changed prior inputs from cache. Recaps never change notes, source snapshots or coverage. Neither automatic local indexing nor paid background summary preparation runs these recap or briefing model calls; merely browsing does not start them either. Native recall can reuse these prior-sync recaps, but cannot quote original words from them; historical lookup automatically retrieves retained original excerpts across sessions and syncs through the local hybrid index, separately from frozen discussion and recaps; see [MEMORY.md](MEMORY.md).
+The card shows a short recap, or an explicitly labelled briefing preview until one exists, with its body clamped to three visual lines. A changed conversation marks an older recap as stale. Explicitly closing the call UI requests an asynchronous recap using the cheap model (maximum 32 invocations, also bounded by the sync's saved ceiling); interrupted browser exits cannot guarantee that request. **Make recap / Refresh recap** retries explicitly, and the next sync recomputes changed prior inputs from cache. Recaps never change notes, source snapshots or coverage. Neither automatic local indexing nor paid background summary preparation runs these recap or briefing model calls; merely browsing does not start them either. Native recall can reuse these prior-sync recaps, but cannot quote original words from them; historical lookup automatically retrieves retained original excerpts across sessions and syncs through the local hybrid index, separately from frozen discussion and recaps; see [MEMORY.md](MEMORY.md).
 
 The migration adds presentation/recap-cache tables and removes the single-open-sync index without rewriting original rows. Once multiple open snapshots exist, do not blindly downgrade to the old one-open-sync schema. ChatGPT is the only voice engine. Removing the old engine does not remove its historical records, and updating the app does not require restoring an old database.
 
 ## What “since last sync” means
 
 - **Indexed** means a complete JSONL entry has been read locally.
-- **Included** means that entry is already held by an open snapshot. A new sync skips it, even though it is not reviewed. Multiple independently open syncs are allowed; discarding one releases its unreviewed entries.
+- **Included** means that entry belongs to the initial snapshot. An open snapshot reserves its unreviewed entries while its conversation has not ended; a new sync skips those reservations. Multiple independently open syncs are allowed. Discarding or idle-ending one releases its unreviewed reservations, not its saved history.
 - **Covered** means that entry was in a snapshot you explicitly finished reviewing.
 - Indexing, model calls, saving notes, and cancelled/failed calls never mark evidence covered.
-- A sync is immutable with respect to source activity: later arrivals cannot slip behind its checkpoint.
+- The initial snapshot is immutable with respect to source activity: later arrivals cannot slip behind its review checkpoint. Newly prepared H history can inform later turns but never expands that coverage.
 - A fresh one-click workflow initializes the baseline to all history; existing baselines are preserved. Entries older than that baseline are excluded from new activity, not falsely marked reviewed; they may still provide background context. The baseline does not move on subsequent syncs. There is no baseline-reset UI yet.
-- A new snapshot includes **all eligible, unreviewed indexed entries not held by another open sync** from the selected sources/history baseline, with no count or character cutoff. The UI paginates evidence without omitting it from processing. Scanner safety limits and excerpt truncation still apply.
+- A new snapshot includes **all eligible, unreviewed indexed entries not reserved by another open, non-ended sync** from the selected sources/history baseline, with no count or character cutoff. The UI paginates evidence without omitting it from processing. Scanner safety limits and excerpt truncation still apply.
 - If tree generation was started, finishing is blocked until compression and a valid final reply succeed. Failed/unprocessed evidence remains pending; you do not finish a partial tree as though it represented the whole snapshot.
 - Earlier branch context is included separately (up to roughly 24,000 characters) and never counted as new progress.
 - New one-click snapshots receive the **three most recent non-discarded syncs** as frozen recaps and saved notes, including unfinished conversations labelled unreviewed. The legacy API retains its last-10-completed-sync decision memory. The latest carry-forward list persists until edited; older lists are historical. Full conversations remain in SQLite; ordinary text questions include the latest 12 current-sync messages, with bounded excerpts.
@@ -165,7 +169,7 @@ Current limits: discovery is eight directories deep; each scan reads up to 32 Mi
 
 Session logs can contain private source code, prompts, command output, and credentials.
 
-- **Provider-model use starts through explicit conversation/preparation interactions or the NEW paid summary opt-in, never local indexing alone.** The Sync action prepares previous recaps and a new briefing before calling; closing the call UI requests a derived recap. Voice turns do not invoke pi. Calls open a persistent OpenAI audio session at call start; idle/quota accounting is not established. Those explicit actions need no additional checkbox; unattended summary preparation requires **Prepare summaries ahead**, off by default. Scanning and reading evidence stay local. History lookup automatically prepares/updates a local embedding index when needed; first use downloads pinned public weights. Text questions and calls receive relevant historical excerpts by default through their existing model. Merely opening a page performs no embedding inference; the saved automatic-indexing schedule runs independently of browsing but never uses provider summary/final models by itself. Separately opted-in background summaries send eligible content through the configured summary model, never the final model.
+- **Provider-model use starts through explicit conversation/preparation interactions or the NEW paid summary opt-in, never local indexing alone.** The Sync action prepares previous recaps and a new briefing before calling; explicitly closing the call UI requests a derived recap (idle expiry does not). Voice turns do not invoke pi. Calls open a persistent OpenAI audio session at call start; idle/quota accounting is not established. Those explicit actions need no additional checkbox; unattended summary preparation requires **Prepare summaries ahead**, off by default. Scanning and reading evidence stay local. History lookup automatically prepares/updates a local embedding index when needed; first use downloads pinned public weights. Text questions and calls receive relevant historical excerpts by default through their existing model. Merely opening a page performs no embedding inference; the saved automatic-indexing schedule runs independently of browsing but never uses provider summary/final models by itself. Separately opted-in background summaries send eligible content through the configured summary model, never the final model.
 - Thinking blocks, system prompts, images, and opaque signatures are not indexed. Tool-call arguments are minimized; common secret patterns are redacted. **This is best-effort, not a guarantee that the remaining text is safe to share.** Inspect evidence and exclude sensitive sessions before calling a provider.
 - SQLite contains verified live-session and frozen-snapshot pointers, cached summaries, run metadata, decisions and conversations—not copies of original agent entry bodies. It lives outside the checkout in `~/.draken/draken.db` by default. **Original agent JSONL files are the authoritative archive, including for old snapshots.** Back up both those files and Draken's private state. Missing/changed originals are labelled unavailable; discussion and notes remain accessible, but generating replies, calling or reviewing that snapshot requires restoring its evidence. Search stores passage hashes, unique vectors, source links and contentless keyword postings, not passage bodies. See [MEMORY.md](MEMORY.md) for migration and storage details. There is no in-app retention/purge UI yet.
 - The server defaults to loopback with **no dashboard login**. Explicitly configured credentials (or `DRAKEN_NO_AUTH=false`) retain authentication even on loopback. Local API access still rejects cross-origin requests and unexpected Host headers.
@@ -209,7 +213,7 @@ This is not a drop-in replacement for the old Docker/Claude task dashboard or it
 
 Source builds, development commands, test/probe instructions and the code map live in [CONTRIBUTING.md](CONTRIBUTING.md). They are not needed for normal npm installation.
 
-See [ACCEPTANCE.md](ACCEPTANCE.md) for automated gates, a short human product checklist and focused high-risk review areas. The public landing page lives in `site/`; changes there on `master`/`main` trigger the existing website deployment workflow. Its `scripts/site-release.cjs` gate validates the version copy and withholds deployment until npm `latest` matches the root package version. Release copy describes 0.7.0 after release, not evidence of a live deployment. Qualify and publish npm separately before allowing the gated website deployment; this documentation change does not merge, publish or deploy anything. Focused cache/consent regressions are `tests/background-tree.test.cjs`, `tests/background-preparation.test.cjs` and `tests/automatic-index.test.cjs`.
+See [ACCEPTANCE.md](ACCEPTANCE.md) for automated gates, a short human product checklist and focused high-risk review areas. The public landing page lives in `site/`; changes there on `master`/`main` trigger the existing website deployment workflow. Its `scripts/site-release.cjs` gate validates the version copy and withholds deployment until npm `latest` matches the root package version. Release copy describes 0.8.0 after release, not evidence of a live deployment. Qualify and publish npm separately before allowing the gated website deployment; this documentation change does not merge, publish or deploy anything. Focused lifecycle/readiness regressions are `tests/conversation.test.cjs`, `tests/live-history-readiness.test.cjs` and `tests/voice-live-updates.test.cjs`; browser coverage is `tests/ui/live-conversation.spec.ts`. Existing cache/consent regressions remain required.
 
 ## License
 

package/SETUP.md

@@ -2,7 +2,7 @@
 
 Draken uses **pi for summaries, preparation recaps and text discussion**, regardless of which coding agent produced the imported history. It does not implement provider OAuth, translate another agent's credentials, or run Claude/Codex to summarize.
 
-> This guide is for **Draken 0.7.0**. Versions **0.1.6 and earlier** are the old task dashboard. Before upgrading, back up your original agent logs and Draken data; see [what changed](CHANGELOG.md#070).
+> This guide is for **Draken 0.8.0**. Versions **0.1.6 and earlier** are the old task dashboard. Before upgrading, back up your original agent logs and Draken data; see [what changed](CHANGELOG.md#080).
 
 ## Install and start
 
@@ -21,7 +21,7 @@ Installation does not launch a server or register a background service. `draken`
 - `draken doctor`: checks the selected pi executable, version and configured model credentials. It does not create the application database, generate text or verify provider access/billing. A non-ready result exits nonzero.
 - A duplicate launch on an occupied HTTP/HTTPS port exits **before opening the database or recovering interrupted runs**.
 
-**Automatic local indexing is on by default for new installations.** While the server runs, it checks enabled sources once a minute and indexes batches at 64 source changes. Smaller tails wait for explicit foreground preparation, with no timed flush. It accumulates searchable history without creating syncs, summaries or briefings and makes no provider model calls. Local embeddings use CPU, memory and disk; first use may download about 136 MB of pinned search model files. Change this in **Settings → Automatically index history**. Existing installations keep their saved indexing choice, including off. Calls and foreground work take priority; disabling cancels automatic indexing and retains completed embeddings. Local failures back off for at least five minutes, with **Retry automatic indexing** available in Settings. Source/session exclusions still apply, and Codex and Claude remain separately opt-in. Only your explicit **Sync with Draken** or **Chat instead** action starts a new snapshot and briefing using configured models and their quota or API billing. Existing snapshots and notes remain untouched; no call, microphone or review starts automatically. **Settings → Preparation usage** retains preparation-only cost estimates, including paid background summaries and past automatic work, not total spending or quota. Completed batches count explicit snapshots' first successful briefings, not cached preparation.
+**Automatic local indexing is on by default for new installations.** While the server runs, it checks enabled sources once a minute. Active conversations index any positive source changes; without an active conversation, batches still require 64 source changes and smaller tails wait for explicit foreground preparation, with no timed flush. It accumulates searchable history without creating syncs, summaries or briefings and makes no provider model calls. Local embeddings use CPU, memory and disk; first use may download about 136 MB of pinned search model files. Change this in **Settings → Automatically index history**. Existing installations keep their saved indexing choice, including off. User turns and foreground work take priority and drain owned indexing; connected idle voice permits local work between turns, never during a pending response or context delivery. Disabling cancels automatic indexing and retains completed embeddings. Local failures back off for at least five minutes, with **Retry automatic indexing** available in Settings. Source/session exclusions still apply, and Codex and Claude remain separately opt-in. Only your explicit **Sync with Draken** or **Chat instead** action starts a new snapshot and briefing using configured models and their quota or API billing. Existing snapshots and notes remain untouched; no call, microphone or review starts automatically. **Settings → Preparation usage** retains preparation-only cost estimates, including paid background summaries and past automatic work, not total spending or quota. Completed batches count explicit snapshots' first successful briefings, not cached preparation.
 
 **Paid summaries are a separate, default-off choice.** To prepare ahead, explicitly enable the NEW **Settings → Prepare summaries ahead** switch while **Automatically index history** is enabled. Old `auto_index=true` and retired 0.5 paid consent do not enable it. This sends eligible accumulated entries to the configured summary model within the same `max_invocations` allowance, with no provider/model fallback. Once-minute idle checks require at least 64 new/changed eligible records, independently of the embedding checkpoint. It warms validated summary leaves, reconciliation and compact final input, not a snapshot, final briefing, recap or review. Unchanged prepared input makes no further calls; closed chunks are reusable across appends. Changed unfinished per-session tails and aggregate reconciliation may still need work at **Start chat**, and the final briefing is always explicit—not a zero-wait promise.
 
@@ -29,21 +29,24 @@ Foreground work cancels and awaits owned background provider work. Valid cache s
 
 Loopback (`http://127.0.0.1:40333`) needs no dashboard login by default. LAN exposure still requires configured dashboard authentication and trusted HTTPS for microphone access. There is no automatic firewall change or certificate trust installation.
 
-## Upgrade to 0.7.0
+## Upgrade to 0.8.0
+
+<a id="upgrade-to-070"></a><!-- Preserve links from historical release notes. -->
 
 1. Back up original agent logs and the private Draken data directory. Preserve existing histories, conversations, notes, review coverage and frozen snapshots; do not replace them with an old database.
-2. Finish active calls/preparation, stop the server, and quit any tray that owns it. Install the released version with `npm install -g draken@0.7.0`, then restart using the same user, environment and `DRAKEN_DATA_DIR`.
+2. Finish active calls/preparation, stop the server, and quit any tray that owns it. Install the released version with `npm install -g draken@0.8.0`, then restart using the same user, environment and `DRAKEN_DATA_DIR`.
 3. Check **Settings → Runtime & sign-in**. Existing pi/voice accounts and selected runtimes are unchanged; upgrading does not silently install or sign into a replacement runtime.
-4. Keep or change **Automatically index history** as desired. Its existing preference is preserved. To get paid preparation ahead, explicitly enable the NEW **Prepare summaries ahead** switch. It defaults off on upgrades as well as fresh installations; no local-to-paid or retired-consent migration occurs.
-5. Start a sync/chat explicitly for the final briefing. Warm cache is not a completed sync or review. If paid preparation fails, resolve the error and retry explicitly; disabling either setting stops paid work but preserves valid cache.
+4. Keep or change **Automatically index history** as desired. Its existing preference is preserved. **Prepare summaries ahead** remains separate and default off unless you already explicitly enabled it; this update grants no new paid consent. Live history updates need only local indexing, not paid summaries.
+5. Start a sync/chat explicitly for the initial briefing and history preparation. Active conversations then adopt newly prepared H history between turns. Their initial snapshot, E/C references, briefing, existing transcript and notes are not rewritten. Updates neither interrupt replies nor disable already-prepared chat; damaged captured originals still fail closed, and unavailable extra archive context must be disclosed.
+6. Expect **Session ended** after 30 minutes without a real user chat message or voice turn (creation is initial intent; an ongoing reply finishes first). Polling, background updates, assistant responses and connection heartbeats do not extend it. The transcript remains readable; notes/review remain explicit. Return home and **Start new sync** to chat again. Idle ending is not review and creates no recap.
 
-The additive `background_runs` table stores input hashes, counters and accounting metrics, not source text. No dependencies change in this release. Do not run an older binary to undo schema changes.
+The additive conversation lifecycle migration persists last user activity and the ended marker separately from open/completed/discarded review status. Existing activity is derived from stored real user turns; inactive older sessions may end and release unreviewed reservations for the next explicit sync. No histories, notes, snapshots or review records are deleted. No dependencies change in this release. Do not run an older binary to undo schema changes.
 
 ### Release qualification and website ordering
 
-For a source release, build and test sequentially once the backend/client changes are ready. Run `tests/background-tree.test.cjs`, `tests/background-preparation.test.cjs` and `tests/automatic-index.test.cjs` against the new server build, then `node --test tests/site-browser.cjs` and `node tests/package-smoke.cjs` with the complete package build. The site check serves static files and needs Playwright/Chromium, not an application build or provider. The package smoke requires built `dist/` and `public/` and installs an isolated production-only tarball; it must observe `auto_summary=false`, a metadata-only disabled auto-summary GET, and no background runs/provider activity by default. Synthetic tests do not establish provider latency, quality or account billing.
+For a source release, build and test sequentially once the backend/client changes are ready. Run conversation lifecycle and append-safe readiness tests (`tests/conversation.test.cjs`, `tests/live-history-readiness.test.cjs`), voice live-update/activity coverage (`tests/voice-live-updates.test.cjs` and existing activity tests), and the existing local-indexing/paid-cache suites against the new server build. Run `tests/ui/live-conversation.spec.ts` after the complete build, then `node --test tests/site-browser.cjs` and `node tests/package-smoke.cjs` with the complete package build. The site check serves static files and needs Playwright/Chromium, not an application build or provider. The package smoke requires built `dist/` and `public/` and installs an isolated production-only tarball; it must observe `auto_summary=false`, a metadata-only disabled auto-summary GET, and no background runs/provider activity by default. Synthetic tests do not establish provider latency, quality or account billing.
 
-Publish npm only through the separately authorized release process. The existing website workflow checks `scripts/site-release.cjs`: copy must match the package version and npm `latest` must be 0.7.0 before the site is deployed. Do not bypass this gate to publish release copy early. Updating docs/version/site files is not a merge, npm publication or live deployment.
+Publish npm only through the separately authorized release process. The existing website workflow checks `scripts/site-release.cjs`: copy must match the package version and npm `latest` must be 0.8.0 before the site is deployed. Do not bypass this gate to publish release copy early. Updating docs/version/site files is not a merge, npm publication or live deployment.
 
 ## When pi is not installed
 

package/TRAY.md

@@ -33,7 +33,7 @@ An already-running server is observed, not adopted. Stop is disabled for it, and
 
 `draken tray` starts a detached Node companion and waits for native UI readiness before reporting success. One heartbeat lock per data directory prevents duplicate companions. After an unclean companion exit, stale-lock recovery takes approximately 30 seconds; there is no unconditional lock deletion or PID-based kill. This is not the server's exclusion mechanism: every server independently acquires non-expiring, kernel-backed data-directory ownership before database initialization/recovery. See [server ownership and shutdown](ARCHITECTURE.md#languages-and-build-output).
 
-The companion polls only the bounded `/api/auth/status` identity endpoint. The native UI receives a bounded private presentation file and heartbeat, not server credentials, provider environment variables, source text, or tokens. Menu clicks return only fixed action identifiers. If the companion stops updating, the helper closes itself after 15 seconds.
+The companion polls only the bounded `/api/auth/status` identity endpoint. Tray polling and connection heartbeats do not count as real user turns or extend the conversation's 30-minute idle lifetime; ended sessions stay ended across server restarts. See [the lifecycle policy](MEMORY.md#live-conversations-and-idle-ending). The native UI receives a bounded private presentation file and heartbeat, not server credentials, provider environment variables, source text, or tokens. Menu clicks return only fixed action identifiers. If the companion stops updating, the helper closes itself after 15 seconds.
 
 An owned server reports its actual bound addresses and instance over a private parent/child IPC channel. Stop requests and parent disconnect use that channel, including on Windows, where `kill(SIGTERM)` would be an abrupt termination. There is no new HTTP shutdown endpoint. Server shutdown retains directory ownership until resource exit is confirmed; an unconfirmed stop leaves the server in a failed stopping state and the tray cannot replace it. Lost helpers cause shutdown of the tray's owned server only; existing external servers are unaffected.
 

package/VOICE.md

@@ -32,8 +32,8 @@ Choosing chat while a one-click call is still preparing consumes that browser ca
 ## Start and use a call
 
 1. Open Draken on **localhost or trusted HTTPS**. Plain LAN HTTP normally cannot access the microphone.
-2. **Sync with Draken** finishes importing each discovered file's captured prefix, prepares the briefing and searchable history, then opens its call. Import errors stop preparation instead of silently freezing an old prefix. On an existing sync, **Call Draken** stays disabled until both are ready. If imported history has changed, use **Prepare history** first. An already-ready sync also offers **Refresh history** to capture later work without rebuilding its frozen briefing.
-3. Any needed history download/indexing happens on the sync page, before a call can start. Progress and **Cancel preparation** are available there; the microphone remains off. Once ready, start the call and allow microphone access. A failed or cancelled preparation does not request permission, and if the page is hidden when preparation finishes, start the call again explicitly. You can also type if microphone permission is unavailable.
+2. **Sync with Draken** finishes importing each discovered file's captured prefix, prepares the briefing and searchable history, then opens its call. Import errors stop preparation instead of silently freezing an old prefix. On an existing non-ended sync, **Call Draken** stays disabled until both have initially been prepared. Use **Prepare history** if that initial preparation is missing. Ordinary appends and scans do not invalidate already captured context; an already-ready sync also offers **Refresh history** without rebuilding its frozen briefing.
+3. Initial history download/indexing happens on the sync page, before a call can start. Progress and **Cancel preparation** are available there; the microphone remains off. Once ready, start the call and allow microphone access. A failed or cancelled preparation does not request permission, and if the page is hidden when preparation finishes, start the call again explicitly. You can also type if microphone permission is unavailable.
 4. Speaker-safe mode pauses input during replies. Use **Stop reply** to speak, or enable **Headphone mode** to allow spoken interruption. Headphones are recommended.
 5. **Mute** releases the microphone tracks. **Stop reply** cuts playback locally and asks the provider to stop; it does not prove immediate remote cancellation. **End call** stops capture/playback and keeps the text history.
 
@@ -41,22 +41,24 @@ Capture follows a transient browser action, never a URL flag. Reloading or openi
 
 Reply waiting is owned by the server's identified user transcript and pending-answer events. Unkeyed WebRTC user events can arrive late and must not switch an already pending reply back to listening, erase its waiting caption, or restart a settled reply. A lookup acknowledgement such as “I’ll check what’s recorded” is not meant to end the answer. Draken keeps the question pending and can automatically resume ChatGPT speech when its context arrives; you should not need to ask “have you checked?” Quiet captions in the dragon scene show **[Thinking...]**, **[Hmmm...]** and **[Hmmmmmm...]** during a pending reply, including silence after an acknowledgement. They change every five seconds without animation. **[Checking...]** and **[Looking that up...]** are used only while the local history worker reports fresh lookup activity; these labels are not proof of a match or exhaustive search. These are visual waiting cues—not the model’s private thoughts, spoken messages, a percentage or an ETA. They are never saved in the transcript or sent to the model. The separate waiting banner and elapsed-wait timer have been removed. Stop, a newer question, interruption, or ending the call cancels the old pending continuation. There is at most one automatic completion cue per question—not a retry loop or a fabricated user message. A failed lookup must be disclosed; a failed or silent continuation produces a visible notice instead of silently retrying.
 
-Work questions use the same original-project evidence selection and deterministic later-report checking as chat: up to sixteen sources in a 32,000-byte historical packet per lookup. A new call inherits project focus from actual saved user turns, not generated answers; explicit switches and follow-ups retain the same scope rules as chat. Old conversation recall remains available when requested. History is captured at the displayed preparation cutoff, not observed live.
+Work questions use the same original-project evidence selection and deterministic later-report checking as chat: up to sixteen sources in a 32,000-byte historical packet per lookup. A new call inherits project focus from actual saved user turns, not generated answers; explicit switches and follow-ups retain the same scope rules as chat. Old conversation recall remains available when requested. Each voice turn pins one prepared-history cutoff. Newly prepared original history can be adopted between turns as dated H evidence; it is not an unprepared live feed and does not rewrite the initial snapshot, E/C references, briefing, saved transcript or notes.
 
 The native context envelope remains bounded to 8 KiB. Larger evidence is delivered losslessly in ordered, JSON-quoted parts with a final completion record; the helper's small handoff returns a receipt rather than truncating evidence. Interrupted/failed transfers are not marked complete, and old-turn parts cannot restart speech after Stop. Three distinct archive lookups per turn and duplicate-result/delivery reuse remain. This sends more evidence without another pi call, changing voice engine or raising the concise speaking target. Native quota use is not guaranteed unchanged.
 
 Supplied IDs and later-report candidates do not prove that each spoken claim was verified, heard or agreed with. The bounded pi answer-repair pass remains text-only; streamed speech is not post-validated or retractable. Protocol tests and evidence-packet comparisons are not physical-audio or exhaustive answer-quality acceptance. See [MEMORY.md](MEMORY.md) for retrieval limits.
 
-One call may be active at a time, with a 30-minute limit, at most 60 user messages and a 90-second disconnect timeout. These are resource limits, not spending guarantees. A new call cannot start until helper cleanup is confirmed. The browser chooses its reservation UUID before sending creation, so End can release a reservation even if the create response is lost. If End overtakes creation, the server retains a bounded cancellation marker for five minutes; an already-created ID can never be reused. Network loss can still require the disconnect timeout or explicit End previous call.
+A conversation shows **Session ended** after 30 minutes without a real user chat message or voice turn; creation counts as initial intent and an ongoing reply finishes first. Background updates, assistant responses, polling and connection heartbeats do not extend that deadline. Last activity and ending persist across restart. The transcript remains readable and explicit notes/review remain available for the initial snapshot; idle ending neither reviews work nor requests a recap. It releases unreviewed reservations for the next explicit sync. Return home and **Start new sync** to talk again; reopening or replay cannot revive an ended session.
+
+One call may be active at a time, with a separate 30-minute connection limit, at most 60 user messages and a 90-second disconnect timeout. These resource limits remain in addition to conversation idle expiry; they are not spending guarantees or unlimited calling. A new call cannot start until helper cleanup is confirmed. The browser chooses its reservation UUID before sending creation, so End can release a reservation even if the create response is lost. If End overtakes creation, the server retains a bounded cancellation marker for five minutes; an already-created ID can never be reused. Network loss can still require the disconnect timeout or explicit End previous call.
 
 ## Evidence, records and recap
 
-- Voice questions do **not** start pi, local transcription or local synthesis. The call receives a bounded briefing, saved notes and source excerpts. Explicit source/history questions can request more data from the same frozen snapshot. Calls use bounded semantic + keyword retrieval across retained older records, using the local index described in [MEMORY.md](MEMORY.md). The local model/index must be prepared before calling is enabled; first preparation may take minutes. During the call, retrieval uses that prepared cutoff and verifies original sources without building new corpus embeddings. Expand **Conversation & details** for the full transcript, sources and any later history progress. Optional **Settings → Automatically index history** accumulates searchable history locally in idle batches of at least 64 source changes. Local indexing alone never creates syncs, summaries or briefings and makes no provider model calls. The NEW **Prepare summaries ahead** switch is a separate paid opt-in, default off even on upgrades with indexing enabled, and requires local indexing. It warms validated summary leaves plus reconciliation/compact final input using the configured summary model, not a final briefing or recap. Creating a sync and generating its final briefing always require an explicit user action; neither background path starts capture, calls or review. Changed unfinished per-session tails and reconciliation can still need work at **Start chat**; cached preparation is not an instant-call promise. Foreground work cancels and awaits owned background provider work. Disabling either setting stops paid work and preserves cache; paid failures pause until explicit retry, while local indexing retains its five-minute retry delay. See [paid preparation](MEMORY.md#optional-paid-summary-preparation) for independent 64-record batching, durable spending and accounting. Smaller batches wait for explicit preparation, and keep Call disabled if history is not ready. This block starts collapsed for every call; its progress polling reads metadata only. Those dated excerpts also go to ChatGPT; they are not new snapshot evidence. The embedding runtime is text-only and is not a replacement speech engine.
+- Voice questions do **not** start pi, local transcription or local synthesis. The call receives a bounded briefing, saved notes and source excerpts. Explicit source/history questions can request more data from the same frozen snapshot. Calls use bounded semantic + keyword retrieval across retained older records, using the local index described in [MEMORY.md](MEMORY.md). The local model/index must be prepared before calling is enabled; first preparation may take minutes. During each turn, retrieval uses its pinned prepared cutoff and verifies originals without building new corpus embeddings in the reply. New prepared H history can be adopted only between turns. Missing/damaged captured originals still fail closed; if extra archive lookup is unavailable during an update, disclose that limitation rather than guess or silently fall back. Expand **Conversation & details** for the full transcript, sources and any later history progress. With **Settings → Automatically index history** enabled, active conversations check once a minute and index any positive source changes. Without an active conversation, local indexing retains 64-record batching with no timed small-tail flush. A connected idle call permits local background work between turns, never during a pending response or context delivery; a user turn preempts and drains owned indexing. Updates do not interrupt replies or disable prepared chat. Status is **Up to date**, **Preparing new info…** or **New info ready**, with honest off/unavailable states when applicable. Local indexing alone never creates syncs, summaries or briefings and makes no provider model calls. The NEW **Prepare summaries ahead** switch is a separate paid opt-in, default off even on upgrades with indexing enabled, and requires local indexing. It warms validated summary leaves plus reconciliation/compact final input using the configured summary model, not a final briefing or recap. Creating a sync and generating its final briefing always require an explicit user action; neither background path starts capture, calls or review. Changed unfinished per-session tails and reconciliation can still need work at **Start chat**; cached preparation is not an instant-call promise. Foreground work cancels and awaits owned background provider work. Disabling either setting stops paid work and preserves cache; paid failures pause until explicit retry, while local indexing retains its five-minute retry delay. See [paid preparation](MEMORY.md#optional-paid-summary-preparation) for independent 64-record batching, durable spending and accounting. Only inactive local tails and separately paid batches retain the 64-record wait; live H updates are local-only, not per-minute paid calls. Initial history and briefing preparation remain required once. This block starts collapsed for every call; its progress polling reads metadata only. Those dated excerpts also go to ChatGPT; they are not new snapshot membership or review coverage. The embedding runtime is text-only and is not a replacement speech engine.
 - The read-only lookup service is not a coding model or a general web search. Tool-execution and approval requests are denied. Calls cannot edit files, deploy work, save decisions by model instruction, finish syncs or advance coverage.
 - Speech may paraphrase. **Sources supplied** means context was given to the model, not that every spoken claim was verified. Responses are not held for whole-answer JSON validation before playback.
 - History stores ordered user/assistant messages with generated/interrupted labels. It does not invent question–answer pairs, exact played words, human hearing or agreement. Historical records from the retired engine retain their original playback reports and are labelled separately.
 - No raw microphone recording is persisted locally. Text, source references and call status are stored in the private SQLite database. There is no retention/purge UI yet.
-- Ending the call does not mark the sync reviewed. Closing the call UI requests a short text recap through pi using the sync's cheaper summary model. This is separate from live audio; a browser exit cannot guarantee the request is sent or completes. You can explicitly refresh the recap later.
+- Ending the call does not mark the sync reviewed; idle session expiry does not request a recap. Explicitly closing the call UI requests a short text recap through pi using the sync's cheaper summary model. This is separate from live audio; a browser exit cannot guarantee the request is sent or completes. You can explicitly refresh the recap later.
 
 See [the native implementation guide](voice/realtime/README.md) for packet limits, helper restrictions, recall rules and verification details. Provider retention and exact subscription accounting are not promised by Draken.
 

package/dist/db/schema.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"schema.d.ts","sourceRoot":"","sources":["../../src/db/schema.ts"],"names":[],"mappings":"AAAA,OAAO,QAAQ,MAAM,gBAAgB,CAAC;AAUtC,wBAAgB,KAAK,IAAI,QAAQ,CAAC,QAAQ,CAazC;AAED,wBAAgB,UAAU,CAAC,QAAQ,EAAE,QAAQ,CAAC,QAAQ,GAAG,IAAI,CA4N5D;AAED,wBAAgB,OAAO,IAAI,IAAI,CAG9B"}
+{"version":3,"file":"schema.d.ts","sourceRoot":"","sources":["../../src/db/schema.ts"],"names":[],"mappings":"AAAA,OAAO,QAAQ,MAAM,gBAAgB,CAAC;AAUtC,wBAAgB,KAAK,IAAI,QAAQ,CAAC,QAAQ,CAazC;AAED,wBAAgB,UAAU,CAAC,QAAQ,EAAE,QAAQ,CAAC,QAAQ,GAAG,IAAI,CAkQ5D;AAED,wBAAgB,OAAO,IAAI,IAAI,CAG9B"}

package/dist/db/schema.js

@@ -232,6 +232,9 @@ function initSchema(database) {
             snapshot_at: 'TEXT',
             model_config_json: "TEXT NOT NULL DEFAULT '{}'",
             compression_complete: 'INTEGER NOT NULL DEFAULT 0',
+            conversation_last_user_at: 'TEXT',
+            conversation_ended_at: 'TEXT',
+            conversation_before: 'TEXT',
         })) {
             if (!columns.has(name))
                 database.exec(`ALTER TABLE syncs ADD COLUMN ${name} ${definition}`);
@@ -243,6 +246,44 @@ function initSchema(database) {
             database.exec('ALTER TABLE sync_runs ADD COLUMN request_id TEXT');
         database.exec('CREATE UNIQUE INDEX IF NOT EXISTS sync_run_request ON sync_runs(request_id) WHERE request_id IS NOT NULL');
         database.prepare('UPDATE syncs SET snapshot_at = created_at WHERE snapshot_at IS NULL').run();
+        if (!columns.has('conversation_last_user_at')) {
+            // Only real user activity seeds the idle clock. Generated replies, polls,
+            // receipts and background runs are deliberately absent from this migration.
+            database.exec(`UPDATE syncs SET conversation_last_user_at=MAX(created_at,
+      COALESCE((SELECT MAX(created_at) FROM sync_messages WHERE sync_id=syncs.id AND role='user'),created_at),
+      COALESCE((SELECT MAX(m.started_at) FROM live_messages m JOIN live_calls c ON c.id=m.call_id
+        WHERE c.sync_id=syncs.id AND m.role='user' AND TRIM(m.text)!=''),created_at)) WHERE status='open'`);
+            // An already used v0.7 chat/call passed explicit history preparation. Retain
+            // a conservative cutoff even when a newer receipt format needs refreshing.
+            database.exec(`UPDATE syncs SET conversation_before=snapshot_at WHERE status='open'
+      AND briefing!='' AND compression_complete=1 AND (
+        EXISTS(SELECT 1 FROM sync_runs WHERE sync_id=syncs.id AND request_id IS NOT NULL)
+        OR EXISTS(SELECT 1 FROM live_calls WHERE sync_id=syncs.id))`);
+            // Also preserve prepared-but-not-yet-used chats from the old read-only
+            // receipt. This is historical preparation, NOT validation of current inputs.
+            const file = path_1.default.join((0, data_dir_1.getDataDir)(), 'memory', 'index.sqlite');
+            let memory;
+            try {
+                if (fs_1.default.existsSync(file)) {
+                    memory = new better_sqlite3_1.default(file, { readonly: true, fileMustExist: true });
+                    const raw = memory.prepare("SELECT value FROM meta WHERE key='call-history-ready-v1'").get();
+                    const marker = raw && raw.value.length <= 1024 ? JSON.parse(raw.value) : null;
+                    if (marker && typeof marker.before === 'string' && Number.isFinite(Date.parse(marker.before))
+                        && new Date(marker.before).toISOString() === marker.before && marker.before <= new Date().toISOString()
+                        && typeof marker.stamp === 'string' && /^[a-f0-9]{64}$/.test(marker.stamp)
+                        && typeof marker.model === 'string' && marker.model.length > 0
+                        && marker.model === memory.prepare("SELECT value FROM meta WHERE key='model'").get()?.value
+                        && memory.prepare("SELECT value FROM meta WHERE key='schema'").get()?.value === 'history-index-v3-contentless') {
+                        database.prepare(`UPDATE syncs SET conversation_before=? WHERE status='open' AND conversation_before IS NULL
+            AND briefing!='' AND compression_complete=1 AND snapshot_at<=?`).run(marker.before, marker.before);
+                    }
+                }
+            }
+            catch { /* Missing/old caches do not prevent opening the original database. */ }
+            finally {
+                memory?.close();
+            }
+        }
         (0, pointer_migration_1.migratePointers)(database);
         (0, snapshot_pointers_1.migrateSnapshotPointers)(database);
         (0, agent_migration_1.migrateAgents)(database);

package/dist/db/schema.js.map

@@ -1 +1 @@
-{"version":3,"file":"schema.js","sourceRoot":"","sources":["../../src/db/schema.ts"],"names":[],"mappings":";;;;;AAUA,sBAaC;AAED,gCA4NC;AAED,0BAGC;AA1PD,oEAAsC;AACtC,gDAAwB;AACxB,0CAAyC;AACzC,4CAAoB;AACpB,2DAAkE;AAClE,2DAA8D;AAC9D,uDAAqE;AAErE,IAAI,EAAE,GAA6B,IAAI,CAAC;AAExC,SAAgB,KAAK;IACnB,IAAI,CAAC,EAAE,EAAE,CAAC;QACR,MAAM,GAAG,GAAG,IAAA,qBAAU,GAAE,CAAC;QACzB,YAAE,CAAC,SAAS,CAAC,GAAG,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;QACpD,EAAE,GAAG,IAAI,wBAAQ,CAAC,cAAI,CAAC,IAAI,CAAC,GAAG,EAAE,WAAW,CAAC,CAAC,CAAC;QAC/C,uFAAuF;QACvF,YAAE,CAAC,SAAS,CAAC,cAAI,CAAC,IAAI,CAAC,GAAG,EAAE,WAAW,CAAC,EAAE,KAAK,CAAC,CAAC;QACjD,EAAE,CAAC,MAAM,CAAC,oBAAoB,CAAC,CAAC;QAChC,EAAE,CAAC,MAAM,CAAC,mBAAmB,CAAC,CAAC;QAC/B,EAAE,CAAC,MAAM,CAAC,qBAAqB,CAAC,CAAC;QACjC,IAAI,CAAC;YAAC,UAAU,CAAC,EAAE,CAAC,CAAC;QAAC,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YAAC,EAAE,CAAC,KAAK,EAAE,CAAC;YAAC,EAAE,GAAG,IAAI,CAAC;YAAC,MAAM,KAAK,CAAC;QAAC,CAAC;IAC/E,CAAC;IACD,OAAO,EAAE,CAAC;AACZ,CAAC;AAED,SAAgB,UAAU,CAAC,QAA2B;IACpD,QAAQ,CAAC,WAAW,CAAC,GAAG,EAAE;QAC1B,2EAA2E;QAC3E,0EAA0E;QAC1E,6EAA6E;QAC7E,MAAM,KAAK,GAAG,CAAC,QAAQ,CAAC,OAAO,CAAC,oEAAoE,CAAC,CAAC,GAAG,EAAE,CAAC;QAC5G,IAAA,mCAAiB,EAAC,QAAQ,CAAC,CAAC;QAC5B,MAAM,WAAW,GAAG,QAAQ,CAAC,OAAO,CAAC,wDAAwD,CAAC,CAAC,GAAG,EAAE;eAC9F,QAAQ,CAAC,OAAO,CAAC,4DAA4D,CAAC,CAAC,GAAG,EAAU,EAAE,KAAK,KAAK,YAAY,CAAC;QAC3H,6EAA6E;QAC7E,yEAAyE;QACzE,QAAQ,CAAC,IAAI,CAAC;;;;;;;;;;;;;;;;;;;MAmBV,WAAW,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,sFAAsF;MACzG,IAAA,8BAAU,EAAC,eAAe,EAAE,CAAC,WAAW,CAAC;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA+J5C,CAAC,CAAC;QACH,MAAM,OAAO,GAAG,IAAI,GAAG,CAAE,QAAQ,CAAC,OAAO,CAAC,0BAA0B,CAAC,CAAC,GAAG,EAAyB,CAAC,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC;QAC/H,KAAK,MAAM,CAAC,IAAI,EAAE,UAAU,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC;YAC9C,gBAAgB,EAAE,4BAA4B;YAC9C,WAAW,EAAE,MAAM;YACnB,iBAAiB,EAAE,4BAA4B;YAC/C,oBAAoB,EAAE,4BAA4B;SACnD,CAAC,EAAE,CAAC;YACH,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC;gBAAE,QAAQ,CAAC,IAAI,CAAC,gCAAgC,IAAI,IAAI,UAAU,EAAE,CAAC,CAAC;QAC9F,CAAC;QACD,MAAM,UAAU,GAAG,IAAI,GAAG,CAAE,QAAQ,CAAC,OAAO,CAAC,8BAA8B,CAAC,CAAC,GAAG,EAAyB,CAAC,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC;QACtI,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,cAAc,CAAC;YAAE,QAAQ,CAAC,IAAI,CAAC,0EAA0E,CAAC,CAAC;QAC/H,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,YAAY,CAAC;YAAE,QAAQ,CAAC,IAAI,CAAC,kDAAkD,CAAC,CAAC;QACrG,QAAQ,CAAC,IAAI,CAAC,0GAA0G,CAAC,CAAC;QAC1H,QAAQ,CAAC,OAAO,CAAC,qEAAqE,CAAC,CAAC,GAAG,EAAE,CAAC;QAC9F,IAAA,mCAAe,EAAC,QAAQ,CAAC,CAAC;QAAC,IAAA,2CAAuB,EAAC,QAAQ,CAAC,CAAC;QAAC,IAAA,+BAAa,EAAC,QAAQ,CAAC,CAAC;QACtF,MAAM,cAAc,GAAG,IAAI,GAAG,CAAE,QAAQ,CAAC,OAAO,CAAC,mCAAmC,CAAC,CAAC,GAAG,EAAyB,CAAC,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC;QAC/I,IAAI,CAAC,cAAc,CAAC,GAAG,CAAC,eAAe,CAAC;YAAE,QAAQ,CAAC,IAAI,CAAC,iFAAiF,CAAC,CAAC;QAC3I,IAAI,KAAK,EAAE,CAAC;YACV,MAAM,IAAI,GAAG,QAAQ,CAAC,OAAO,CAAC,mDAAmD,CAAC,CAAC;YACnF,IAAI,CAAC,GAAG,CAAC,YAAY,EAAE,MAAM,CAAC,CAAC;QACjC,CAAC;QACD,8EAA8E;QAC9E,2EAA2E;QAC3E,8EAA8E;QAC9E,kEAAkE;QAClE,QAAQ,CAAC,IAAI,CAAC;;wHAEwG,CAAC,CAAC;IACxH,CAAC,CAAC,EAAE,CAAC;AACP,CAAC;AAED,SAAgB,OAAO;IACrB,EAAE,EAAE,KAAK,EAAE,CAAC;IACZ,EAAE,GAAG,IAAI,CAAC;AACZ,CAAC"}
+{"version":3,"file":"schema.js","sourceRoot":"","sources":["../../src/db/schema.ts"],"names":[],"mappings":";;;;;AAUA,sBAaC;AAED,gCAkQC;AAED,0BAGC;AAhSD,oEAAsC;AACtC,gDAAwB;AACxB,0CAAyC;AACzC,4CAAoB;AACpB,2DAAkE;AAClE,2DAA8D;AAC9D,uDAAqE;AAErE,IAAI,EAAE,GAA6B,IAAI,CAAC;AAExC,SAAgB,KAAK;IACnB,IAAI,CAAC,EAAE,EAAE,CAAC;QACR,MAAM,GAAG,GAAG,IAAA,qBAAU,GAAE,CAAC;QACzB,YAAE,CAAC,SAAS,CAAC,GAAG,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;QACpD,EAAE,GAAG,IAAI,wBAAQ,CAAC,cAAI,CAAC,IAAI,CAAC,GAAG,EAAE,WAAW,CAAC,CAAC,CAAC;QAC/C,uFAAuF;QACvF,YAAE,CAAC,SAAS,CAAC,cAAI,CAAC,IAAI,CAAC,GAAG,EAAE,WAAW,CAAC,EAAE,KAAK,CAAC,CAAC;QACjD,EAAE,CAAC,MAAM,CAAC,oBAAoB,CAAC,CAAC;QAChC,EAAE,CAAC,MAAM,CAAC,mBAAmB,CAAC,CAAC;QAC/B,EAAE,CAAC,MAAM,CAAC,qBAAqB,CAAC,CAAC;QACjC,IAAI,CAAC;YAAC,UAAU,CAAC,EAAE,CAAC,CAAC;QAAC,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YAAC,EAAE,CAAC,KAAK,EAAE,CAAC;YAAC,EAAE,GAAG,IAAI,CAAC;YAAC,MAAM,KAAK,CAAC;QAAC,CAAC;IAC/E,CAAC;IACD,OAAO,EAAE,CAAC;AACZ,CAAC;AAED,SAAgB,UAAU,CAAC,QAA2B;IACpD,QAAQ,CAAC,WAAW,CAAC,GAAG,EAAE;QAC1B,2EAA2E;QAC3E,0EAA0E;QAC1E,6EAA6E;QAC7E,MAAM,KAAK,GAAG,CAAC,QAAQ,CAAC,OAAO,CAAC,oEAAoE,CAAC,CAAC,GAAG,EAAE,CAAC;QAC5G,IAAA,mCAAiB,EAAC,QAAQ,CAAC,CAAC;QAC5B,MAAM,WAAW,GAAG,QAAQ,CAAC,OAAO,CAAC,wDAAwD,CAAC,CAAC,GAAG,EAAE;eAC9F,QAAQ,CAAC,OAAO,CAAC,4DAA4D,CAAC,CAAC,GAAG,EAAU,EAAE,KAAK,KAAK,YAAY,CAAC;QAC3H,6EAA6E;QAC7E,yEAAyE;QACzE,QAAQ,CAAC,IAAI,CAAC;;;;;;;;;;;;;;;;;;;MAmBV,WAAW,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,sFAAsF;MACzG,IAAA,8BAAU,EAAC,eAAe,EAAE,CAAC,WAAW,CAAC;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA+J5C,CAAC,CAAC;QACH,MAAM,OAAO,GAAG,IAAI,GAAG,CAAE,QAAQ,CAAC,OAAO,CAAC,0BAA0B,CAAC,CAAC,GAAG,EAAyB,CAAC,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC;QAC/H,KAAK,MAAM,CAAC,IAAI,EAAE,UAAU,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC;YAC9C,gBAAgB,EAAE,4BAA4B;YAC9C,WAAW,EAAE,MAAM;YACnB,iBAAiB,EAAE,4BAA4B;YAC/C,oBAAoB,EAAE,4BAA4B;YAClD,yBAAyB,EAAE,MAAM;YACjC,qBAAqB,EAAE,MAAM;YAC7B,mBAAmB,EAAE,MAAM;SAC5B,CAAC,EAAE,CAAC;YACH,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC;gBAAE,QAAQ,CAAC,IAAI,CAAC,gCAAgC,IAAI,IAAI,UAAU,EAAE,CAAC,CAAC;QAC9F,CAAC;QACD,MAAM,UAAU,GAAG,IAAI,GAAG,CAAE,QAAQ,CAAC,OAAO,CAAC,8BAA8B,CAAC,CAAC,GAAG,EAAyB,CAAC,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC;QACtI,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,cAAc,CAAC;YAAE,QAAQ,CAAC,IAAI,CAAC,0EAA0E,CAAC,CAAC;QAC/H,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,YAAY,CAAC;YAAE,QAAQ,CAAC,IAAI,CAAC,kDAAkD,CAAC,CAAC;QACrG,QAAQ,CAAC,IAAI,CAAC,0GAA0G,CAAC,CAAC;QAC1H,QAAQ,CAAC,OAAO,CAAC,qEAAqE,CAAC,CAAC,GAAG,EAAE,CAAC;QAC9F,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,2BAA2B,CAAC,EAAE,CAAC;YAC9C,0EAA0E;YAC1E,4EAA4E;YAC5E,QAAQ,CAAC,IAAI,CAAC;;;0GAGwF,CAAC,CAAC;YACxG,6EAA6E;YAC7E,2EAA2E;YAC3E,QAAQ,CAAC,IAAI,CAAC;;;oEAGkD,CAAC,CAAC;YAClE,uEAAuE;YACvE,6EAA6E;YAC7E,MAAM,IAAI,GAAG,cAAI,CAAC,IAAI,CAAC,IAAA,qBAAU,GAAE,EAAE,QAAQ,EAAE,cAAc,CAAC,CAAC;YAC/D,IAAI,MAAqC,CAAC;YAC1C,IAAI,CAAC;gBACH,IAAI,YAAE,CAAC,UAAU,CAAC,IAAI,CAAC,EAAE,CAAC;oBACxB,MAAM,GAAG,IAAI,wBAAQ,CAAC,IAAI,EAAE,EAAE,QAAQ,EAAE,IAAI,EAAE,aAAa,EAAE,IAAI,EAAE,CAAC,CAAC;oBACrE,MAAM,GAAG,GAAG,MAAM,CAAC,OAAO,CAAC,0DAA0D,CAAC,CAAC,GAAG,EAAmC,CAAC;oBAC9H,MAAM,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,KAAK,CAAC,MAAM,IAAI,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;oBAC9E,IAAI,MAAM,IAAI,OAAO,MAAM,CAAC,MAAM,KAAK,QAAQ,IAAI,MAAM,CAAC,QAAQ,CAAC,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;2BACxF,IAAI,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,WAAW,EAAE,KAAK,MAAM,CAAC,MAAM,IAAI,MAAM,CAAC,MAAM,IAAI,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;2BACpG,OAAO,MAAM,CAAC,KAAK,KAAK,QAAQ,IAAI,gBAAgB,CAAC,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC;2BACvE,OAAO,MAAM,CAAC,KAAK,KAAK,QAAQ,IAAI,MAAM,CAAC,KAAK,CAAC,MAAM,GAAG,CAAC;2BAC3D,MAAM,CAAC,KAAK,KAAM,MAAM,CAAC,OAAO,CAAC,0CAA0C,CAAC,CAAC,GAAG,EAAoC,EAAE,KAAK;2BAC1H,MAAM,CAAC,OAAO,CAAC,2CAA2C,CAAC,CAAC,GAAG,EAAoC,EAAE,KAAK,KAAK,8BAA8B,EAAE,CAAC;wBACpJ,QAAQ,CAAC,OAAO,CAAC;2EACgD,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,MAAM,CAAC,CAAC;oBACvG,CAAC;gBACH,CAAC;YACH,CAAC;YAAC,MAAM,CAAC,CAAC,sEAAsE,CAAC,CAAC;oBAC1E,CAAC;gBAAC,MAAM,EAAE,KAAK,EAAE,CAAC;YAAC,CAAC;QAC9B,CAAC;QACD,IAAA,mCAAe,EAAC,QAAQ,CAAC,CAAC;QAAC,IAAA,2CAAuB,EAAC,QAAQ,CAAC,CAAC;QAAC,IAAA,+BAAa,EAAC,QAAQ,CAAC,CAAC;QACtF,MAAM,cAAc,GAAG,IAAI,GAAG,CAAE,QAAQ,CAAC,OAAO,CAAC,mCAAmC,CAAC,CAAC,GAAG,EAAyB,CAAC,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC;QAC/I,IAAI,CAAC,cAAc,CAAC,GAAG,CAAC,eAAe,CAAC;YAAE,QAAQ,CAAC,IAAI,CAAC,iFAAiF,CAAC,CAAC;QAC3I,IAAI,KAAK,EAAE,CAAC;YACV,MAAM,IAAI,GAAG,QAAQ,CAAC,OAAO,CAAC,mDAAmD,CAAC,CAAC;YACnF,IAAI,CAAC,GAAG,CAAC,YAAY,EAAE,MAAM,CAAC,CAAC;QACjC,CAAC;QACD,8EAA8E;QAC9E,2EAA2E;QAC3E,8EAA8E;QAC9E,kEAAkE;QAClE,QAAQ,CAAC,IAAI,CAAC;;wHAEwG,CAAC,CAAC;IACxH,CAAC,CAAC,EAAE,CAAC;AACP,CAAC;AAED,SAAgB,OAAO;IACrB,EAAE,EAAE,KAAK,EAAE,CAAC;IACZ,EAAE,GAAG,IAAI,CAAC;AACZ,CAAC"}

package/dist/memory/readiness.d.ts

@@ -5,9 +5,10 @@ export interface HistoryReadiness {
     before: string | null;
 }
 /** A scheduling/readiness hint, not evidence. Original bytes are still verified
- * when preparing and retrieving. Include frozen aliases here: unlike the
- * strict64 counter, readiness must cover their search links too. */
-export declare function historyStamp(source: Database.Database, before?: string, roots?: RootInput): string;
+ * when preparing and retrieving. Identity covers admitted records, not mutable
+ * import cursors: an append followed by a scan must preserve a prepared prefix.
+ * Frozen aliases need their own links even when sourceStamps coalesces them. */
+export declare function historyStamp(source: Database.Database, before?: string, roots?: RootInput, capturedOnly?: boolean): string;
 export declare function saveHistoryReadiness(db: Database.Database, source: Database.Database, before: string, stamp: string, model: string, roots?: RootInput): void;
 export declare function indexReadiness(db: Database.Database, source: Database.Database, capturedOnly?: boolean): HistoryReadiness;
 /** Read-only metadata. Never creates a cache, scans source logs, starts a worker,

package/dist/memory/readiness.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"readiness.d.ts","sourceRoot":"","sources":["../../src/memory/readiness.ts"],"names":[],"mappings":"AAGA,OAAO,QAAQ,MAAM,gBAAgB,CAAC;AAEtC,OAAO,EAAe,KAAK,SAAS,EAAE,MAAM,qBAAqB,CAAC;AAKlE,MAAM,WAAW,gBAAgB;IAAG,KAAK,EAAE,OAAO,CAAC;IAAC,MAAM,EAAE,MAAM,GAAG,IAAI,CAAA;CAAE;AAG3E;;oEAEoE;AACpE,wBAAgB,YAAY,CAAC,MAAM,EAAE,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC,EAAE,MAAM,EAAE,KAAK,CAAC,EAAE,SAAS,GAAG,MAAM,CA6BlG;AAED,wBAAgB,oBAAoB,CAAC,EAAE,EAAE,QAAQ,CAAC,QAAQ,EAAE,MAAM,EAAE,QAAQ,CAAC,QAAQ,EAAE,MAAM,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,KAAK,CAAC,EAAE,SAAS,GAAG,IAAI,CAY5J;AAED,wBAAgB,cAAc,CAAC,EAAE,EAAE,QAAQ,CAAC,QAAQ,EAAE,MAAM,EAAE,QAAQ,CAAC,QAAQ,EAAE,YAAY,UAAQ,GAAG,gBAAgB,CAgBvH;AAED;oFACoF;AACpF,wBAAgB,sBAAsB,CAAC,SAAS,EAAE,MAAM,EAAE,MAAM,EAAE,QAAQ,CAAC,QAAQ,EAAE,YAAY,UAAQ,GAAG,gBAAgB,CAa3H"}
+{"version":3,"file":"readiness.d.ts","sourceRoot":"","sources":["../../src/memory/readiness.ts"],"names":[],"mappings":"AAGA,OAAO,QAAQ,MAAM,gBAAgB,CAAC;AAEtC,OAAO,EAAe,KAAK,SAAS,EAAE,MAAM,qBAAqB,CAAC;AAQlE,MAAM,WAAW,gBAAgB;IAAG,KAAK,EAAE,OAAO,CAAC;IAAC,MAAM,EAAE,MAAM,GAAG,IAAI,CAAA;CAAE;AA0B3E;;;gFAGgF;AAChF,wBAAgB,YAAY,CAAC,MAAM,EAAE,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC,EAAE,MAAM,EAAE,KAAK,CAAC,EAAE,SAAS,EAAE,YAAY,UAAQ,GAAG,MAAM,CA4FxH;AAED,wBAAgB,oBAAoB,CAAC,EAAE,EAAE,QAAQ,CAAC,QAAQ,EAAE,MAAM,EAAE,QAAQ,CAAC,QAAQ,EAAE,MAAM,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,KAAK,CAAC,EAAE,SAAS,GAAG,IAAI,CAY5J;AAED,wBAAgB,cAAc,CAAC,EAAE,EAAE,QAAQ,CAAC,QAAQ,EAAE,MAAM,EAAE,QAAQ,CAAC,QAAQ,EAAE,YAAY,UAAQ,GAAG,gBAAgB,CAqBvH;AAED;oFACoF;AACpF,wBAAgB,sBAAsB,CAAC,SAAS,EAAE,MAAM,EAAE,MAAM,EAAE,QAAQ,CAAC,QAAQ,EAAE,YAAY,UAAQ,GAAG,gBAAgB,CAa3H"}