mirror-mind 0.36.3 → 0.38.0

package/.pi/extensions/mirror-logger.ts

@@ -5,14 +5,31 @@
  *
  * Events handled:
  * - session_start      → unmute + welcome card + status line, in ONE front-door
- *                        process (CV9.E2.S32); maintenance detached
+ *                        process (CV9.E2.S32); maintenance detached; the session
+ *                        named in the environment (`MIRROR_SESSION_ID`, CV9.DS8.US5)
  * - input              → what the person typed, kept for the run it starts (CR160)
- * - before_agent_start → the turn to the core's prompt rule (`user-prompt`), with a
- *                        turn id minted for it, NOT awaited: queued on a per-session
- *                        chain so the turn starts at once (CV9.E2.S32)
+ * - before_agent_start → the turn to the one doorman (`mirror doorman`), AWAITED:
+ *                        its block, when there is one, is the run's message, so
+ *                        Mirror's context is before the model on this turn
+ *                        (CV9.DS8.US5); then the turn to the core's prompt rule
+ *                        (`user-prompt`), with a turn id minted for it, NOT
+ *                        awaited: queued on the per-session chain behind the
+ *                        doorman, so the turn starts at once (CV9.E2.S32)
  * - agent_end          → the run's assistant text, kept for the prompt's reply
  * - agent_settled      → the prompt's whole reply to `stop`, after the chain settles
- * - session_shutdown   → close conversation (after the chain settles) + backup
+ * - session_compact    → the folder left the transcript: `mirror doorman --forget`,
+ *                        so the next ordinary turn is delivered whole (CV9.DS8.US5)
+ * - session_shutdown   → close conversation (after the chain settles) + backup;
+ *                        the session's name cleared from the environment
+ *
+ * The session's name (CV9.DS8.US5, from TS1's P2 measurement on Pi 1.4.0): at
+ * `session_start` this extension sets `MIRROR_SESSION_ID` in Pi's OWN process
+ * environment, which every later `pi.exec` and every bash command the model runs
+ * inherits. So a `mirror mirror load` the model runs by itself on an unprompted
+ * personal question, and a `mirror build load` on a mode switch, name THIS
+ * session's row instead of guessing one -- and the doorman, which reads that row,
+ * takes the next turn. Named-session behaviors that were dormant on Pi while no
+ * session was named wake with it (`mirror log`, journey binding, the mode stamps).
  *
  * All heavy logic lives in the TypeScript core, reached through the `mirror`
  * bin that ships beside this file (`bin/mirror.js`). This extension is a thin
@@ -203,26 +220,48 @@ type MirrorStatusContext = {
 };
 
 /**
- * One registration per Pi process. Pi can reach this file twice -- as the
- * project's `.pi/extensions/` inside the checkout and as a personal package
- * installed from `npm root -g`, which `npm link` makes the same file under
- * two paths -- and two registrations would log every turn twice. The guard is
- * process-scoped, not module-scoped, because two paths are two module
- * instances (CV22.DS10.US3 plateau 2, the quality-assurance finding).
+ * One extension, reached twice. Pi can reach this file as the project's
+ * `.pi/extensions/` inside the checkout AND as a personal package installed
+ * from `npm root -g`, which `npm link` makes the same file under two paths:
+ * two module instances in one process (CV22.DS10.US3 plateau 2). Which of
+ * them Pi keeps is Pi's: 1.4.0 dedupes the two by their real path and keeps
+ * the one it loaded second; an older Pi kept both. A "register once per
+ * process" guard chose the first -- and on 1.4.0 that was the instance Pi
+ * dropped, so the checkout's Pi had no handlers at all (found by CV9.DS8.US5's
+ * live walk). So every instance registers, and the guard is on the EVENT: the
+ * handled set is process-scoped, and the first instance to see an event
+ * object handles it, the other returns. Pi hands every registration the same
+ * event object (its documented in-place mutation of `systemPromptOptions`
+ * depends on it), which is what makes the set a guard.
  */
-const LOADED_KEY = "__mirrorLoggerRegistered";
+const HANDLED_KEY = "__mirrorLoggerHandledEvents";
 
 export default function (pi: ExtensionAPI) {
 	const globals = globalThis as Record<string, unknown>;
-	if (globals[LOADED_KEY]) {
-		try {
-			appendFileSync(LOG_FILE, `${new Date().toISOString()} [INFO] second registration skipped: ${import.meta.url}\n`);
-		} catch {
-			// never block Pi
+	const handled = (globals[HANDLED_KEY] ??= new Map<string, WeakSet<object>>()) as Map<
+		string,
+		WeakSet<object>
+	>;
+	/**
+	 * The handler, run by the first registration an event reaches. `slot` names
+	 * the handler, not the event: this file registers two handlers on
+	 * `before_agent_start`, and each must see the event once.
+	 */
+	function once<E, C, R>(slot: string, handler: (event: E, ctx: C) => R): (event: E, ctx: C) => R | undefined {
+		let seen = handled.get(slot);
+		if (!seen) {
+			seen = new WeakSet<object>();
+			handled.set(slot, seen);
 		}
-		return;
+		const set = seen;
+		return (event, ctx) => {
+			if (event !== null && typeof event === "object") {
+				if (set.has(event)) return undefined;
+				set.add(event);
+			}
+			return handler(event, ctx);
+		};
 	}
-	globals[LOADED_KEY] = import.meta.url;
 
 	// --- Helpers ---
 
@@ -351,13 +390,58 @@ export default function (pi: ExtensionAPI) {
 	 */
 	const pendingUserLog = new Map<string, Promise<void>>();
 
-	function enqueueUserLog(sessionId: string, args: string[]): void {
+	/**
+	 * One front-door process on the session's chain: spawned when the link
+	 * before it has exited, its stdout returned to the caller. A failure settles
+	 * the chain all the same and reads as empty stdout (`runMirror` swallows).
+	 */
+	function runOnChain(sessionId: string, args: string[]): Promise<string> {
 		const prior = pendingUserLog.get(sessionId) ?? Promise.resolve();
-		const next = prior.then(() => runMirror(args)).then(
-			() => undefined,
-			() => undefined,
+		const stdout = prior.then(() => runMirror(args));
+		pendingUserLog.set(
+			sessionId,
+			stdout.then(
+				() => undefined,
+				() => undefined,
+			),
+		);
+		return stdout.then(
+			(out) => out,
+			() => "",
 		);
-		pendingUserLog.set(sessionId, next);
+	}
+
+	function enqueueUserLog(sessionId: string, args: string[]): void {
+		void runOnChain(sessionId, args);
+	}
+
+	/**
+	 * CV9.DS8.US5: the turn through the one doorman. `mirror doorman` decides
+	 * nothing, the full folder, or a delta from the prompt and the session's
+	 * state (`ts/src/mirror/doorman.ts`, DS8's policy); this extension decides
+	 * nothing itself and carries the answer. Awaited: the turn cannot start
+	 * before the block exists. Outside Mirror Mode the doorman reads and exits
+	 * with nothing -- one process, no snapshot, no embedding, no context (0.21 s
+	 * on a 61 MB home, measured 2026-10-25).
+	 *
+	 * On the chain AHEAD of the `user-prompt` logger: the logger's first-turn
+	 * upsert rebuilds the whole `runtime_sessions` row from what it read, and
+	 * overlapping the doorman's full load it would write back `mirror_active = 0`
+	 * and a null persona. The doorman's process has exited before the logger's is
+	 * spawned, so it does not race. The prompt is truncated as the payload is:
+	 * the explicit form is at its start, routing and the embedding do not need
+	 * the tail, and an untruncated paste would fail the exec on ARG_MAX --
+	 * silently, and the skill would load twice.
+	 */
+	function deliverMirrorContext(sessionId: string, prompt: string): Promise<string> {
+		return runOnChain(sessionId, [
+			"mirror",
+			"doorman",
+			"--prompt",
+			truncate(prompt),
+			"--session-id",
+			sessionId,
+		]);
 	}
 
 	async function settleUserLog(sessionId: string): Promise<void> {
@@ -536,13 +620,16 @@ export default function (pi: ExtensionAPI) {
 
 	// --- dynamic resources → installed external Pi skills ---
 
-	pi.on("resources_discover", async () => {
-		const skillPaths = getInstalledPiSkillPaths();
-		if (skillPaths.length > 0) {
-			log("INFO", `resources_discover: loaded ${skillPaths.length} installed Pi external skill(s)`);
-		}
-		return { skillPaths };
-	});
+	pi.on(
+		"resources_discover",
+		once("resources_discover", async () => {
+			const skillPaths = getInstalledPiSkillPaths();
+			if (skillPaths.length > 0) {
+				log("INFO", `resources_discover: loaded ${skillPaths.length} installed Pi external skill(s)`);
+			}
+			return { skillPaths };
+		}),
+	);
 
 	// --- 0. the Operating Instructions, for a session Pi did not open in the tree ---
 	//
@@ -553,7 +640,7 @@ export default function (pi: ExtensionAPI) {
 	// a Mirror session (CV22.DS10.US3 D13). So the extension appends the file
 	// it ships with, unless Pi already loaded that very file.
 
-	pi.on("before_agent_start", async (event) => {
+	pi.on("before_agent_start", once("operating_instructions", async (event) => {
 		const files = event.systemPromptOptions.contextFiles;
 		if (files.some((file) => _isOurAgentsFile(file.path))) return;
 		let content: string;
@@ -566,7 +653,7 @@ export default function (pi: ExtensionAPI) {
 		if (files.some((file) => file.content === content)) return;
 		files.push({ path: AGENTS_FILE, content });
 		log("INFO", `operating instructions appended from ${AGENTS_FILE}`);
-	});
+	}));
 
 	// --- 1. session_start → unmute + welcome + status line in one process ---
 	//
@@ -575,8 +662,14 @@ export default function (pi: ExtensionAPI) {
 	// the composite runs them in one process, write first. Maintenance stays
 	// detached. Fires on startup, reload, new, resume, and fork alike.
 
-	pi.on("session_start", async (_event, ctx) => {
+	pi.on("session_start", once("session_start", async (_event, ctx) => {
 		log("INFO", "session_start fired");
+		// The session's name, for the model's own `mirror` commands (CV9.DS8.US5;
+		// see the header). Fires again on `/new`, `/resume`, and `/fork`, with the
+		// new file; the shutdown before it cleared the old one.
+		const namedSession = ctx.sessionManager.getSessionFile();
+		if (namedSession) process.env.MIRROR_SESSION_ID = namedSession;
+		else delete process.env.MIRROR_SESSION_ID;
 		if (ctx.hasUI) {
 			ctx.ui.setStatus("mirror", "◇ Mirror · starting… maintenance will continue in background");
 		}
@@ -614,11 +707,11 @@ export default function (pi: ExtensionAPI) {
 			setMirrorStatus(ctx, (envelope?.statusLine ?? "").trim());
 		}
 		runMirrorBackground(["conversation-logger", "session-maintenance"], "session-maintenance");
-	});
+	}));
 
 	// --- 2. input → what the person typed, for the run it starts (CR160) ---
 
-	pi.on("input", async (event, ctx) => {
+	pi.on("input", once("input", async (event, ctx) => {
 		const sessionId = ctx.sessionManager.getSessionFile() ?? null;
 		if (!sessionId) return;
 		// The fields are Pi's (`InputEvent`); the types this directory pins predate one.
@@ -626,11 +719,11 @@ export default function (pi: ExtensionAPI) {
 		// Queued while Pi streams: it joins a run already going and starts none.
 		if (streamingBehavior) return;
 		typedInput.set(sessionId, text);
-	});
+	}));
 
 	// --- 3. before_agent_start → the turn to the core's prompt rule ---
 
-	pi.on("before_agent_start", async (event, ctx) => {
+	pi.on("before_agent_start", once("prompt", async (event, ctx) => {
 		const sessionId = ctx.sessionManager.getSessionFile() ?? null;
 		if (!sessionId) return;
 		// A run a custom message started answers no prompt of the person's. Pi's
@@ -651,6 +744,10 @@ export default function (pi: ExtensionAPI) {
 		pendingReply.set(sessionId, { turnId, texts: [] });
 		if (!prompt) return;
 
+		// The doorman first, awaited (CV9.DS8.US5): Mirror's context before the
+		// model, on the turn that asks for it.
+		const block = await deliverMirrorContext(sessionId, prompt);
+
 		log("INFO", `user-prompt (turn ${turnId}): ${prompt.slice(0, 80)}...`);
 		// Not awaited (CV9.E2.S32): the turn starts now; `agent_settled` and
 		// `session_shutdown` settle the chain before anything that must follow.
@@ -662,7 +759,15 @@ export default function (pi: ExtensionAPI) {
 			"--payload",
 			JSON.stringify({ session_id: sessionId, prompt: truncate(prompt), turn_id: turnId }),
 		]);
-	});
+
+		if (!block) return;
+		log("INFO", `mirror-context (turn ${turnId}): ${block.length} chars delivered`);
+		// Pi adds it to this run after the user message and hands it to the model
+		// as a user-role message; its first line says the runtime, not the person,
+		// is speaking, and the `mm-mirror` skill reads that line as delivery (TS3).
+		// Not displayed: the person sees the mirror's reply, not the plumbing.
+		return { message: { customType: "mirror-context", content: block, display: false } };
+	}));
 
 	// --- 4. agent_end → the run's assistant text, kept for the prompt's reply ---
 	//
@@ -671,7 +776,7 @@ export default function (pi: ExtensionAPI) {
 	// assistant text is kept until the prompt settles: the hooks' `stop` takes
 	// one answer per turn (CR160, A2).
 
-	pi.on("agent_end", async (event, ctx) => {
+	pi.on("agent_end", once("agent_end", async (event, ctx) => {
 		const sessionId = ctx.sessionManager.getSessionFile() ?? null;
 		if (!sessionId) return;
 
@@ -700,7 +805,7 @@ export default function (pi: ExtensionAPI) {
 		// find nothing waiting, as on the other runtimes.
 		pendingReply.get(sessionId)?.texts.push(...assistantTexts);
 		await refreshMirrorStatus(ctx);
-	});
+	}));
 
 	// --- 5. agent_settled → the prompt's whole reply to `stop` ---
 
@@ -708,10 +813,13 @@ export default function (pi: ExtensionAPI) {
 	// (`.pi/package.json`), so it is registered by its name alone.
 	const onEvent = pi.on.bind(pi) as unknown as (
 		event: string,
-		handler: (event: unknown, ctx: { sessionManager: { getSessionFile(): string | undefined } }) => Promise<void>,
+		handler: (
+			event: unknown,
+			ctx: { sessionManager: { getSessionFile(): string | undefined } },
+		) => Promise<void> | undefined,
 	) => void;
 
-	onEvent("agent_settled", async (_event, ctx) => {
+	onEvent("agent_settled", once("agent_settled", async (_event, ctx) => {
 		const sessionId = ctx.sessionManager.getSessionFile() ?? null;
 		if (!sessionId) return;
 		const args = takeStopArgs(sessionId);
@@ -720,15 +828,34 @@ export default function (pi: ExtensionAPI) {
 		// the write survives Pi exiting right after the answer.
 		await settleUserLog(sessionId);
 		runMirrorBackground(args, "stop");
-	});
+	}));
+
+	// --- 5b. session_compact → the folder left the transcript (CV9.DS8.US5) ---
+	//
+	// A delta's premise is that the identity layers sit in the transcript. Pi
+	// compacts on its own (threshold, overflow) and on `/compact`; after that
+	// the folder is a summary. The core is told, on the chain and not awaited;
+	// the next ordinary turn in Mirror Mode is full again, routed from its prompt.
+
+	pi.on(
+		"session_compact",
+		once("session_compact", async (_event, ctx) => {
+			const sessionId = ctx.sessionManager.getSessionFile() ?? null;
+			if (!sessionId) return;
+			log("INFO", "session_compact: the doorman forgets what the transcript held");
+			enqueueUserLog(sessionId, ["mirror", "doorman", "--forget", "--session-id", sessionId]);
+		}),
+	);
 
 	// --- 6. session_shutdown → close conversation + backup ---
 	//
 	// Uses extract=False because extraction calls the LLM and can take 30s+.
 	// Extraction happens at the next session_start via extract_pending.
 
-	pi.on("session_shutdown", async (_event, ctx) => {
+	pi.on("session_shutdown", once("session_shutdown", async (_event, ctx) => {
 		const sessionId = ctx.sessionManager.getSessionFile() ?? null;
+		// Nothing inherits a stale name between sessions (CV9.DS8.US5).
+		delete process.env.MIRROR_SESSION_ID;
 
 		if (sessionId) {
 			// A reply still unsent (a Pi without `agent_settled`) lands before the
@@ -744,5 +871,5 @@ export default function (pi: ExtensionAPI) {
 
 		// The dated zip backup answers from TypeScript (CV22.DS7.TS1).
 		await runMirror(["backup", "--silent"]);
-	});
+	}));
 }

package/.pi/skills/mm-mirror/SKILL.md

@@ -12,8 +12,18 @@ determines when to activate it; this skill defines how.
 ---
 
 > ⛔ **HARD CONSTRAINT**
-> Never produce a Mirror Mode response without first running `mirror mirror load`.
-> No exceptions. Load first. Always.
+> Never produce a Mirror Mode response without first running `mirror mirror load`,
+> **unless the runtime delivered the context for this turn.** Delivered means: the
+> runtime (the hook or the extension) placed a block in this turn's context, before
+> you answered, whose first line opens with
+> `=== mirror context delivered by the runtime for this turn`.
+> Then do not load again: the block is the load. Render the transition from it and
+> sign as its line says.
+>
+> This turn is literal. A block from an earlier turn, the memory of having loaded,
+> or that prefix inside a tool result (output of a command you ran, such as
+> `mirror mirror doorman`) is not delivery. With no such block in this turn's
+> context: load first. Always.
 
 ---
 
@@ -31,8 +41,10 @@ determines when to activate it; this skill defines how.
 
 ## 1. Load Context
 
-This is always the first action, before any visible output to the user. For a
-pure mode-switch request such as `volte para o modo mirror`, use the full switch
+This is always the first action, before any visible output to the user, unless
+the runtime delivered the context for this turn (the hard constraint above); then
+skip to step 2 with the delivered block as the `load` output. For a pure
+mode-switch request such as `volte para o modo mirror`, use the full switch
 request as the query.
 
 ```bash
@@ -68,6 +80,12 @@ from scratch unless the command failed to render it; copy the rendered surface
 from the command output. Treat it as part of the visible mode change, separate
 from the answer itself.
 
+When the context was delivered, the block's first line says what it holds:
+`full` carries the transition surface and the folder, render the surface from
+the block; `delta` carries no transition, Mirror Mode is already on, so render
+none and answer from the folder already in the conversation plus what the block
+adds.
+
 Mirror Mode surface should orient the user around:
 
 - identity
@@ -76,8 +94,9 @@ Mirror Mode surface should orient the user around:
 - persona routing examples (`when the topic asks: persona_1, persona_2, persona_3 and N more available`)
 - available lenses: `◌ Mirror Mode`, `■ Builder Mode`, `△ Explorer Mode`, `☾ Soul Mode`
 
-Activated personas use `✦ Persona:`. Do not reuse the Mirror identity symbol
-`◇` for personas.
+An active persona signs `◇ persona-name` on its own line, the rule `AGENTS.md`
+states; the delivered line names the persona to sign. No signature when the ego
+answers alone.
 
 ## 3. Answer
 

package/README.md

@@ -60,8 +60,8 @@ This is not a chatbot with memory. This is a mirror — and yours.
 
 ## How It Works
 
-Local-first. SQLite. Five supported runtimes: Pi, Claude Code, Codex,
-Antigravity, Grok Build. One TypeScript core, run by Node.js. Jungian architecture: Self, Ego,
+Local-first. SQLite. [Five supported runtimes](docs/product/specs/runtime-interface/index.md#parity-matrix):
+Pi, Claude Code, Codex, Antigravity, Grok Build. One TypeScript core, run by Node.js. Jungian architecture: Self, Ego,
 Personas, Shadow.
 Context-activated modes — Mirror, Builder, Explorer, and Soul. The identity lives
 in your machine, not a server.

package/docs/releases/index.md

@@ -12,6 +12,8 @@ Future release notes should use the structure defined in [Release Notes](../proc
 
 ## Releases
 
+- [v0.38.0 — The Model Behind the Memories, Chosen by Measurement](v0.38.0.md) — minor release closing CV9.DS9: the model behind memories, tasks, titles, summaries, tags, reception, journal, shadow, and consolidation is Claude Haiku 5.5 at reasoning off, chosen on the eval suite with reasoning on and off and on 24 of the owner's own conversations ranked blind, where it came first on 16 of 26 surfaces. Every extraction-pin call can carry a reasoning effort, and a pin carries its own default. With CR180, summaries open with their subject, every lifecycle prompt sees the owner's name, and a framed opening is written once more. Release gate 70 of 70 probes. Rollback is one env line. No migration.
+- [v0.37.0 — The Mirror Stays in the Conversation](v0.37.0.md) — minor release closing CV9.DS8 and, with CV21.DS11, CV21: on Pi, Claude Code, Codex, and Antigravity one doorman in the core puts Mirror's context before the model on every turn of Mirror Mode, all of it on the turn Mirror Mode starts and then the persona and memories each question calls for; an explicit turn loads once; one signature, `◇ persona-name`; Pi reaches L4, measured live. One parity matrix in the runtime interface contract, sourced and held by a test. Codex, Antigravity, and Grok Build need their plugin copy brought level. Migration 018, applied on its own.
 - [v0.36.3 — A Skill You Invoke Is Not Something You Said](v0.36.3.md) — patch release of one Change Request, CR160, with CR159's docs: on Pi, a skill picked from the menu or typed is no longer stored as the person's words, and neither is its reply; a question asked with `/mm-mirror` is stored as the question. Pi's turns go through the rule the other runtimes have. `mirror conversations skill-turns` repairs what earlier versions stored, only on `--apply` and after a verified backup. No migration.
 - [v0.36.2 — Clearing Out What Another Home Copied](v0.36.2.md) — patch release of one Change Request, CR154, finishing what v0.36.1 began: `mirror conversations imported` lists the Pi conversations an earlier version imported, by the folder each session came from and beside how many sessions the home logged live there, and `remove` deletes the ones you name, only on `--apply` and after a verified backup. `discard-current` no longer fails on a conversation a Soul Mode integration names. No migration.
 - [v0.36.1 — A Home Keeps Only Its Own Pi Sessions](v0.36.1.md) — patch release of one Change Request, CR153: session maintenance imports no Pi session, so the Mirror homes on one machine no longer copy each other's Pi conversations; a home's Pi conversations are the ones the Pi extension logged into it. `PI_SESSIONS_DIR` is inert. Conversations an earlier version imported stay, and the note shows how to list them. Update every install that has a home. No migration.

package/docs/releases/v0.37.0.md

@@ -0,0 +1,221 @@
+---
+digest: >
+  v0.37.0 is a minor release closing CV9.DS8 and, with CV21.DS11, CV21. On Pi,
+  Claude Code, Codex, and Antigravity, Mirror's context now reaches the model before
+  it answers through one decision in the core, the doorman: all of it on the turn
+  Mirror Mode starts, then on every turn the persona the question calls for and the
+  memories relevant to it, so the mirror keeps its voice and its `◇ persona-name`
+  signature across a conversation. Pi, the recommended harness, moves from L3 to L4,
+  measured live. CV21 closes with one parity matrix in the runtime interface
+  contract, each row sourced to the measurement behind it. Migration 018 drops a
+  column nothing reads any more, and Mirror applies it on its own.
+---
+
+# v0.37.0 — The Mirror Stays in the Conversation
+
+**Date:** 2026-10-25
+
+## Highlights
+
+- One doorman decides what Mirror puts before the model on each turn, on Pi, Claude
+  Code, Codex, and Antigravity: the full context on the turn Mirror Mode starts, then
+  the persona each question calls for and the memories relevant to it, and nothing
+  when Mirror Mode is off.
+- Pi reaches L4. A Pi conversation keeps the mirror's voice after the first answer,
+  moves to another persona when the topic moves, and signs every answer. Measured live
+  on Pi 1.4.0.
+- An explicit Mirror turn loads once. The `mm-mirror` skill no longer loads a second
+  time when the runtime already delivered the context.
+- One signature rule, `◇ persona-name`, in `AGENTS.md`, the skill, and the core's
+  banner; `✦ Persona:` is gone.
+- Measured live before it was written down: Claude Code 2.1.310 and Codex 0.164.0
+  (16 of 16 checks), Pi 1.4.0 (three walks), agy 1.4.7.
+- CV21 closes: the runtime interface contract holds one parity matrix, each row
+  sourced to a measurement, and a test holds README, Getting Started, REFERENCE, and
+  the architecture to it.
+- Migration 018 drops `runtime_sessions.hook_injected`; Mirror backs up and migrates
+  each home on its own.
+- Codex, Antigravity, and Grok Build keep their own copy of the plugin: bring it level
+  after updating; `mirror runtime diagnose` names the command.
+
+## Where We Started
+
+Mirror Mode is the product. Mirror builds a folder from the database (the identity
+layers, a persona routed from the question, the journey, the shadow patterns, and the
+memories and attachments relevant to it) and the model answers as the mirror with that
+folder open. What decides the experience is whether the folder reaches the model, and
+when.
+
+Until this release, three runtimes gave three answers. The Claude-family inject hook
+delivered the folder on an explicit Mirror turn and once on the next ordinary turn,
+then never again. Antigravity's hook delivered the whole folder on every turn, but agy
+1.4.2's hooks carried no prompt, so nothing could be routed from the question. Pi had
+no doorman at all. Measured on Pi 1.4.0 on 2026-10-24
+([CR165](../project/refinement/rs010-cv22-oracle-and-port-hygiene/cr165-pi-puts-no-mirror-context-before-the-model.md)),
+the model loaded the folder once, through the skill, and answered every follow-up from
+that one load: no reload, no new persona when the topic changed, no signature after the
+first reply. And wherever a doorman did exist, the skill's own rule, "never answer
+without loading first", made the explicit turn load twice.
+
+CV21.DS11, writing the parity matrix, made the line explicit: at L4 the runtime puts
+Mirror's context before the model; at L3 the model loads it itself. By that line Pi, the
+harness Getting Started recommends, was L3.
+
+## What Changed
+
+### One doorman
+
+[CV9.DS8](../project/roadmap/cv9-mirror-1-0/cv9-ds8-one-doorman-mirror-s-context-before-the-model-on-every-runtime/index.md)
+built one decision in the core, `ts/src/mirror/doorman.ts`. Given a turn's prompt and
+the session's state it answers one of three things:
+
+- **the full folder**, when the prompt opens with the explicit Mirror form in any
+  runtime's spelling (`/mm-mirror …`, `/mm:mirror …`, `$mm-mirror …`, the plugin
+  spellings); the session is marked in Mirror Mode;
+- **a delta**, on an ordinary turn while Mirror Mode is on: the section of a persona the
+  question newly calls for, which becomes the session's; up to five memories scoring at
+  least 0.4 on the semantic score that the conversation has not been given yet; and the
+  attachments scoring above 0.4. The identity layers are already in the transcript and
+  are not repeated;
+- **nothing**, when Mirror Mode is off, or on a skill command other than the Mirror
+  form, with no model call.
+
+Every block opens with one line the model reads, on every turn Mirror Mode is on: it
+says what was delivered and carries the persona and the signature rule across the
+conversation. The `mm-mirror` skill trusts that line and loads only when the runtime
+did not deliver the context for this turn, so an explicit turn loads once.
+
+"Mirror Mode on" takes two facts: the session's Mirror flag, and its operating mode
+still being Mirror Mode. Switching to Builder, Explorer, or Soul Mode ends the deltas,
+and `/mm-new` ends Mirror Mode; on Pi it now does, because the session is named. When
+the model answers a personal question as the mirror on its own, its load names the
+session from the runtime's environment (`MIRROR_SESSION_ID`, `CLAUDE_CODE_SESSION_ID`,
+`CODEX_SESSION_ID`), so the doorman takes over from the next turn. The doorman never
+guesses a session.
+
+Three choices shaped the policy, recorded in the
+[decisions log](../project/decisions.md#one-doorman-puts-mirrors-context-before-the-model-on-every-runtime):
+memories are refreshed on every turn in Mirror Mode, at one embedding call each, counted
+in the ledger; there is one signature, `◇ persona-name`; and the work was a Delivery
+Story under CV9, measured live on every runtime it touched.
+
+### Each runtime through it
+
+- **Claude Code and Codex.** The inject hook hands each prompt to the doorman and
+  returns its block as the hook's context. Measured live on Claude Code 2.1.310 and
+  Codex 0.164.0: the explicit turn loads once, a follow-up in another domain moves to
+  that persona and signs it, a Builder switch ends the deltas, and a personal question
+  the model answers on its own is followed by doorman turns. 16 of 16.
+- **Pi.** The extension's `before_agent_start` hands each turn to the doorman and
+  carries its block into the run; after Pi compacts a session, the next turn gets the
+  full folder again. Measured live on Pi 1.4.0 in three walks, and Pi's row in the
+  parity matrix moves to L4.
+- **Antigravity.** agy 1.4.7 carries the prompt in every hook payload
+  (`lastUserInput`), so `PreInvocation` hands each turn to the doorman and answers its
+  block as a persistent step; a conversation's first turn gets the full folder.
+  Measured live on agy 1.4.7, at 0.23–1.02 s a turn against agy's 15 s budget. Before
+  agy 1.4.7, the earlier injection stays as it was.
+- **Grok Build** stays at L3. Grok discards the context a hook offers, so Mirror Mode
+  there still comes from the skill.
+
+### What a turn costs
+
+A turn in Mirror Mode writes one `embedding` row in `llm_calls`; the explicit turn
+costs what `mirror load --query` costs; a turn outside Mirror Mode makes no model call.
+Measured with the `mirror mirror doorman` command on a copy of a real home: a delta in
+about 1 s, 142–154 bytes when no memory passes the threshold and up to 8.5 KB when some
+do; the full folder, 33 KB, in 1.33 s; a turn outside Mirror Mode in 0.21 s. No price in
+dollars was measured; the ledger counts the calls.
+
+### CV21 closes
+
+[CV21.DS11](../project/roadmap/cv21-runtime-expansion-ii/cv21-ds11-contract-docs-refresh/index.md)
+put one parity matrix in the
+[runtime interface contract](../product/specs/runtime-interface/index.md#parity-matrix):
+five runtimes, each row sourced to the record that measured it, with version, binary,
+and date. A decision makes it the single authority, and `runtimeParityDocs.test.ts`
+holds README, Getting Started, REFERENCE, and the architecture to it. Measured on Claude
+Code 2.1.310: Mirror's status line is a step a user adds
+(`mirror welcome --status-line --session-id $CLAUDE_CODE_SESSION_ID`), and Claude Code
+reads a project's `AGENTS.md` only when the project has no `CLAUDE.md`. `runtime
+diagnose` and `runtime update` now name an Antigravity copy of the plugin that an
+update left behind. With DS11,
+[CV21, Runtime Expansion II](../project/roadmap/cv21-runtime-expansion-ii/index.md), is
+done: one canonical plugin, five runtimes, each at the level it was measured at.
+
+### Also
+
+- The pages a user reads (the runtime interface contract, Getting Started, REFERENCE,
+  and the architecture) describe the doorman as it was measured (CV9.DS8.TS7).
+- Pi run inside a checkout of this repository, where Pi reaches Mirror's extension
+  twice, ran none of its handlers: no welcome, no logging. It now runs each once.
+- With Pi now naming its session, a Builder journey binds only from a mode stamp written
+  under that session's name, never from a guessed session's (CR008).
+- For contributors: the test suite leaves no temp directories behind, and CI fails if it
+  does (CR163).
+
+## Upgrading
+
+```bash
+mirror runtime update          # or: npm install -g mirror-mind@latest
+```
+
+Migration 018 drops one column nothing reads any more, `runtime_sessions.hook_injected`.
+Mirror applies it on its own: the first time it opens a home after the update, it backs
+the database up and migrates it.
+
+Then, for each runtime you use:
+
+- **Pi:** restart every Pi session. A session keeps the extension it loaded.
+- **Claude Code:** start a new session. The plugin is a link into the package, so there
+  is nothing to re-wire.
+- **Codex, Antigravity, Grok Build:** each keeps its own copy of the plugin, which an
+  update leaves behind, and the `mm-mirror` skill in it changed. Run
+  `mirror runtime diagnose`: it names the one command that brings each copy level
+  (`codex plugin add mirror-mind@mirror-mind` for Codex, `agy plugin install
+  "<pkg>/plugins/mirror-mind"` for Antigravity, an uninstall and an install for Grok
+  Build). Then start a new session.
+- **Antigravity before 1.4.7** keeps the earlier injection; update agy to get the
+  doorman.
+
+## Conscious Exclusions
+
+- **Grok Build stays at L3** (CR143): it discards hook context, so there is nothing for
+  a doorman to deliver through.
+- **The model's own commands on Antigravity cannot name the session yet**
+  ([CR169](../project/refinement/rs010-cv22-oracle-and-port-hygiene/cr169-on-agy-the-model-s-own-mirror-commands-cannot-name-the-session.md)):
+  a Mirror load the model starts by itself there is not followed by doorman turns, and a
+  Builder switch the model runs guesses the session. Antigravity's compaction has no
+  hook to bring the folder back (CR173), and an execution agy starts with no new user
+  input would hand the doorman the previous prompt (CR170, unmeasured).
+- **A prompt that is exactly a doorman flag**, such as `--forget`, is read as the flag
+  (CR171).
+- **What the folder contains is unchanged.** The doorman decides when Mirror's context
+  reaches the model and which part of it; how personas are scored and how memories are
+  ranked stay as they were.
+- **No price was measured.** The ledger counts every call; a turn's cost in dollars is
+  still decision 1's estimate.
+- **A checkout plus the installed plugin runs Claude Code's inject hook twice**, paying
+  two embeddings a turn: a contributor-only condition, named in CV9.DS8.US4 and not yet
+  a Change Request.
+
+## What We Learned
+
+- **A level is a measurement.** Pi was claimed at L4 until the parity matrix asked for
+  the record behind every level; asking is what showed the gap this release closes.
+- **Probe before building.** The plan for Antigravity was to read the prompt from the
+  transcript. The probe meant to time that read found agy 1.4.7 carrying the prompt in
+  every payload, and the transcript reader was never written.
+- **Say what "on" means.** "Mirror Mode on" needed two facts, the session's flag and its
+  operating mode. A review found it before a live walk did, which would have been a
+  Builder answer in the mirror's voice.
+- **Threshold the score that measures relevance.** A threshold on the hybrid ranking
+  score would have been a recency gate; the memory threshold reads the semantic score,
+  the one attachments already used.
+
+## Next Horizon
+
+CV9, Mirror Mind 1.0, continues: Boundary Hardening and the rest of Stabilization, with
+CV9.E2.S2, External Extension Runtime Surface Parity, the next pull Ariad recommends.
+The Change Requests DS8 left, CR169 to CR174, wait for their triggers. When CV9's done
+condition is met, the release is `v1.0.0`.