mirror-mind 0.39.5 → 0.40.0

package/.claude/hooks/log-assistant-reply.sh

@@ -74,8 +74,9 @@ ENTRY="$REPO_ROOT/bin/mirror-hook.js"
 # runtime spawned this hook from. Anything else is noted with its reason, in
 # the Pi extension's words, once a day, and the search goes on without it.
 # "Absolute" is the MCP locator's pattern too, and it classifies exactly as
-# path.win32.isAbsolute: under Git Bash the Windows installer writes
-# C:\Program Files\nodejs\node.exe (PR #47).
+# path.win32.isAbsolute: under Git Bash the Windows installer writes a
+# drive-letter path, C:\Users\...\AppData\Local\Programs\MirrorMind\node\node.exe
+# (PR #47).
 NODE=""
 if [ -n "${MIRROR_NODE:-}" ]; then
   refused=""

package/.claude/hooks/log-session-end.sh

@@ -74,8 +74,9 @@ ENTRY="$REPO_ROOT/bin/mirror-hook.js"
 # runtime spawned this hook from. Anything else is noted with its reason, in
 # the Pi extension's words, once a day, and the search goes on without it.
 # "Absolute" is the MCP locator's pattern too, and it classifies exactly as
-# path.win32.isAbsolute: under Git Bash the Windows installer writes
-# C:\Program Files\nodejs\node.exe (PR #47).
+# path.win32.isAbsolute: under Git Bash the Windows installer writes a
+# drive-letter path, C:\Users\...\AppData\Local\Programs\MirrorMind\node\node.exe
+# (PR #47).
 NODE=""
 if [ -n "${MIRROR_NODE:-}" ]; then
   refused=""

package/.claude/hooks/log-user-prompt.sh

@@ -74,8 +74,9 @@ ENTRY="$REPO_ROOT/bin/mirror-hook.js"
 # runtime spawned this hook from. Anything else is noted with its reason, in
 # the Pi extension's words, once a day, and the search goes on without it.
 # "Absolute" is the MCP locator's pattern too, and it classifies exactly as
-# path.win32.isAbsolute: under Git Bash the Windows installer writes
-# C:\Program Files\nodejs\node.exe (PR #47).
+# path.win32.isAbsolute: under Git Bash the Windows installer writes a
+# drive-letter path, C:\Users\...\AppData\Local\Programs\MirrorMind\node\node.exe
+# (PR #47).
 NODE=""
 if [ -n "${MIRROR_NODE:-}" ]; then
   refused=""

package/.claude/hooks/mirror-inject.sh

@@ -74,8 +74,9 @@ ENTRY="$REPO_ROOT/bin/mirror-hook.js"
 # runtime spawned this hook from. Anything else is noted with its reason, in
 # the Pi extension's words, once a day, and the search goes on without it.
 # "Absolute" is the MCP locator's pattern too, and it classifies exactly as
-# path.win32.isAbsolute: under Git Bash the Windows installer writes
-# C:\Program Files\nodejs\node.exe (PR #47).
+# path.win32.isAbsolute: under Git Bash the Windows installer writes a
+# drive-letter path, C:\Users\...\AppData\Local\Programs\MirrorMind\node\node.exe
+# (PR #47).
 NODE=""
 if [ -n "${MIRROR_NODE:-}" ]; then
   refused=""

package/.claude/hooks/session-start.sh

@@ -74,8 +74,9 @@ ENTRY="$REPO_ROOT/bin/mirror-hook.js"
 # runtime spawned this hook from. Anything else is noted with its reason, in
 # the Pi extension's words, once a day, and the search goes on without it.
 # "Absolute" is the MCP locator's pattern too, and it classifies exactly as
-# path.win32.isAbsolute: under Git Bash the Windows installer writes
-# C:\Program Files\nodejs\node.exe (PR #47).
+# path.win32.isAbsolute: under Git Bash the Windows installer writes a
+# drive-letter path, C:\Users\...\AppData\Local\Programs\MirrorMind\node\node.exe
+# (PR #47).
 NODE=""
 if [ -n "${MIRROR_NODE:-}" ]; then
   refused=""

package/docs/releases/index.md

@@ -12,6 +12,8 @@ Future release notes should use the structure defined in [Release Notes](../proc
 
 ## Releases
 
+- [v0.40.0 — A Reply Stays in Its Own Conversation, and a Journey Can Go](v0.40.0.md) — minor release closing the first release train: CR151, a session's transcript fills only the conversation that session is bound to, each reply stamped with its transcript time, where it used to fill every open reply-less conversation in the transcript's window, another session's included; a transcript no session owns backfills nothing; and CR200, previewed as v0.40.0-next.1, `mirror-mind/desktop` deletes a Journey with every record that belongs to it, by digest, behind a verified backup. Update every install that has a home. No migration.
+- [v0.40.0-next.1 — A Journey Can Go, Showing What Goes With It](v0.40.0-next.1.md) — preview under npm's `next`, read by no updater, for Nautilus for Mirror (the release train): CR200, `mirror-mind/desktop` gains `previewJourneyDeletion` and `deleteJourneyWithRecords`, deleting a Journey with every record that belongs to it after a preview that counts it, by digest, behind a verified backup; child Journeys refuse. Terminal users receive it with v0.40.0. No migration.
 - [v0.39.5 — The Node You Named, or Why Not](v0.39.5.md) — patch release of CR192, from PR #47's thread (@rodrigoimmaginario): the hook wrappers, the plugin's MCP entry, and `runtime diagnose` use `MIRROR_NODE` only as an absolute path to an executable file, as the Pi extension does; a relative value is never run, and a refused one is named with its reason, once a day in `hooks.log` and on the MCP entry's stderr; the Windows installer's drive-letter path counts as absolute, in CI under Git Bash and on the installer. No migration.
 - [v0.39.4 — The Reply Finds Its Prompt](v0.39.4.md) — patch release of PR #51 (@alannascimento1), CR166 and CR196: on Claude Code, a prompt typed while a turn runs and a journey entered in plain words no longer lose the reply; `nothing_waiting` in `hooks.log` means a lost reply again. No schema change, no migration.
 - [v0.39.3 — Windows Gets Its Hooks](v0.39.3.md) — patch release of PR #53, PR #50, and PR #54 (@rodrigoimmaginario): the plugin's hook wrappers and MCP locator run the package's own bin when npm's global entry is a shell shim, so Claude Code hooks and the MCP server work on a Windows package install; `runtime diagnose` no longer counts its own verdict as a front-door error (CR139); the docs point a Windows reader to the installer in its own repository. No migration.

package/docs/releases/v0.40.0-next.1.md

@@ -0,0 +1,103 @@
+---
+digest: >
+  v0.40.0-next.1 is the first preview of the release train: published under npm's `next`
+  dist-tag, read by no updater, for Nautilus for Mirror, which embeds this Core. It carries
+  CR200: a host can delete a Journey together with every record that belongs to it, after
+  a preview that counts what will go, what other Journeys keep with a link cleared, and
+  which extension tables lose rows. The deletion acts only on the preview the person saw,
+  in one transaction, behind a named backup verified before any write. Terminal users
+  receive it with v0.40.0, when the train leaves. No schema change, no migration, and no
+  model or prompt change.
+---
+
+# v0.40.0-next.1 — A Journey Can Go, Showing What Goes With It
+
+**Date:** 2026-11-06
+
+**A preview, not a release users receive.** It is staged under `next`, its GitHub Release is
+a prerelease, and `stable`, `latest`, `mirror update` and the release-notes reader all stay
+on v0.39.5. It exists so Nautilus for Mirror can ship the change below before the train
+leaves ([the release train](../process/versioning.md#the-release-train)).
+
+## Highlights
+
+- **A Journey and its records, deleted in one act**
+  ([CR200](../project/refinement/rs010-cv22-oracle-and-port-hygiene/cr200-delete-a-journey-with-its-records-after-showing-what-will-go.md)).
+  `mirror-mind/desktop` gains `previewJourneyDeletion` and `deleteJourneyWithRecords`.
+  `deleteJourney` still deletes only an empty leaf.
+- **The preview is the contract.** It counts the Journey's own records, its Conversations'
+  contents, other Journeys' records that only lose a link, and the `ext_*` rows that name
+  the Journey, by owning extension, and hashes all of it. The deletion takes that digest
+  and refuses any other.
+- **A backup first, verified.** `backups/pre-journey-deletion-<id>-<stamp>-<random>.db`,
+  owner-only, taken under the write lock and read back as the same digest before anything
+  is deleted. A refused deletion removes it; a committed one keeps it.
+- **One friction kept:** a Journey with child Journeys is refused, naming them.
+- No schema change, no migration, and no model or prompt change.
+
+## Where We Started
+
+CV24.DS8 gave a host five Journey calls, and its `deleteJourney` refuses a Journey that
+holds anything: conversations, memories, tasks, attachments, stories, change requests,
+cursors. Nautilus for Mirror's Journey management (its RS028) asked for the act a person
+means by "delete this Journey". Its Navigator decided on 2026-11-05 and 2026-11-06 that
+everything that belongs to the Journey goes, that the confirmation shows it first, and,
+where the Core cannot judge data it does not own, to trade refusal for transparency.
+
+A long-lived home showed why "belongs" needed rules: 956 memories sit under a Journey other
+than their conversation's, and 101 runtime sessions likewise. Deleting by reach would have
+erased other Journeys' history.
+
+## What Changed
+
+**Four rules.** A record that belongs to the Journey goes. What belongs to a deleted
+conversation or memory goes with it: messages, embeddings, provider call records, memory
+access records. A record of another Journey that only points at something deleted stays,
+with that link cleared. And an `ext_*` row goes when the table's `journey_id` or `journey`
+column names the Journey exactly; the preview names the extension from `_ext_migrations`,
+and a row an extension's own foreign key holds refuses the deletion as
+`extension_rows_held`, naming the table.
+
+**A closed inventory.** `JOURNEY_DELETION_INVENTORY` names every core table the deletion
+touches, keeps or detaches, and a test reads the schema against it: a table that names a
+Journey, or references a row the deletion removes, without a decision fails. Its first
+run found `journey_mutation_receipts`, kept as the audit trail.
+
+**Refusals.** `journey_changed` for a digest that no longer matches, `journey_has_children`,
+`extension_rows_held`, `backup_failed`, and as before an unknown Journey, a malformed
+request and a database that is not current. Every refusal writes nothing.
+
+**Validated** in `journeyDeletion.test.ts` (11 tests, ten mutations each caught), in CI on
+Ubuntu and macOS (PR #55), and end to end by Nautilus: its host drives both calls
+against a scratch home, and its Navigator deleted Journeys in the app on 2026-11-06.
+
+**Also in this preview.** [CR199](../project/refinement/rs010-cv22-oracle-and-port-hygiene/cr199-deliver-mirror-context-takes-three-to-seven-seconds-before-every-desktop-turn.md)
+is captured: `deliverMirrorContext` takes three to seven seconds before every Desktop
+turn, measured. And the release train itself (PR #56) is in
+[versioning](../process/versioning.md#the-release-train).
+
+## Conscious Exclusions
+
+- No CLI command deletes a Journey with its records; a host is the only caller.
+- No cascade through child Journeys: they are refused, by the Navigator's decision.
+- Files on disk are the host's to decide; the Core touches only the database.
+- An extension cannot yet take over its own cleanup; recorded for when the extension
+  mechanism exists (CV24.DS8).
+- The test suite, run with `MIRROR_HOME` or `DB_PATH` inherited from a real home, writes
+  into that home. Found while validating this change; worth its own Change Request.
+
+## What We Learned
+
+A preview that is also the contract keeps both honest: the person confirms a list, the
+digest makes the deletion that list and nothing more, and a home that changed in between
+is told so instead of deleted differently.
+
+## Upgrading
+
+Nothing to do in the terminal: this preview is not offered by `mirror update`. A host that
+embeds the Core pins `mirror-mind@0.40.0-next.1` from the registry.
+
+## Next Horizon
+
+v0.40.0 leaves with the next train, carrying this change to every install, with whatever
+else merges before it.

package/docs/releases/v0.40.0.md

@@ -0,0 +1,158 @@
+---
+digest: >
+  v0.40.0 closes the first release train. It carries CR151: a session's transcript is
+  written only into the conversation that session is bound to, each reply stamped with its
+  own transcript time, where before it was copied into every open, reply-less conversation
+  in the transcript's window, another session's included. It also carries CR200, previewed
+  as v0.40.0-next.1 for Nautilus for Mirror: a host can delete a Journey with every record
+  that belongs to it, after a preview that counts what will go, by digest, behind a
+  verified backup. A transcript no session owns, or a session bound to no conversation,
+  now backfills nothing. No schema change, no migration, and no model or prompt change.
+---
+
+# v0.40.0 — A Reply Stays in Its Own Conversation, and a Journey Can Go
+
+**Date:** 2026-11-06
+
+The first stable release under [the release train](../process/versioning.md#the-release-train):
+everything merged into `main` since v0.39.5, in one batch. One of its two changes users
+have never had; the other reached embedding hosts as a preview on the same day.
+
+## Highlights
+
+- **A session's replies go into its own conversation, and only there**
+  ([CR151](../project/refinement/rs010-cv22-oracle-and-port-hygiene/cr151-the-transcript-backfill-writes-a-session-s-replies-into-other-sessions-conversations.md)).
+  At `SessionEnd`, on Claude Code and the runtimes that share its hook, the transcript
+  filled every conversation in its time window that had no assistant message yet. An open
+  conversation that started earlier was always in the window: a session killed in its first
+  turn, or a concurrent session still in its own. Now the transcript fills the conversation
+  `runtime_sessions` binds to the ending session, inside that conversation's own window.
+- **A reply carries its own time.** The copy used to be stamped with the hook's clock, so
+  every reply sorted after every prompt of its conversation, and an extraction read all the
+  questions and then all the answers. A reply now carries its transcript timestamp,
+  normalized to the logger's microsecond form, so recall, extraction, and the MCP read
+  model read the turns in order.
+- **A transcript nobody owns writes nothing.** A payload with no `session_id`, and a session
+  bound to no conversation, used to backfill by window alone. Both are retired: with no
+  key there is no attribution. A "same runtime only" fallback was rejected because it would
+  not have fixed the recorded case, in which the orphan and the session that wrote into it
+  were both `claude_code`.
+- **A Journey and its records, deleted in one act**
+  ([CR200](../project/refinement/rs010-cv22-oracle-and-port-hygiene/cr200-delete-a-journey-with-its-records-after-showing-what-will-go.md),
+  previewed as [v0.40.0-next.1](v0.40.0-next.1.md)). `mirror-mind/desktop` gains
+  `previewJourneyDeletion` and `deleteJourneyWithRecords`: the preview counts the Journey's
+  records, and the deletion acts only on the preview the person saw, in one transaction,
+  behind a named backup verified before any write. Child Journeys refuse.
+- No schema change, no migration, and no model or prompt change.
+
+## Where We Started
+
+CV21.DS5.US3's live route on 2026-10-20 found three product defects and stopped at its own
+rule: capture, don't fix inside the story. One of them was CR151. A hand-run diagnostic had
+left an open `claude_code` conversation with one prompt and no Stop; the route's Claude
+session ended at 20:41, and its reply `ready` landed in its own conversation and in the
+orphan's, at the same instant. The port had inherited the behavior from the Python fallback
+it replaced, written when one session at a time was the only case, and no test pinned the
+scoping.
+
+The Navigator accepted the plan after a review through three lenses. The database
+architect's finding set the shape: the key already existed (`runtime_sessions.conversation_id`)
+and the backfill ignored it, so the fix is to use it, and no fallback survives that the
+evidence case would pass through.
+
+## What Changed
+
+**CR151.** `backfillAssistantMessages(db, transcriptPath, conversationId, deps)` takes the
+conversation as a required argument: one row, its own `[started_at, ended_at]` window, and
+skipped when it already logged a reply, so a Stop-logged one is not recorded twice.
+`handleSessionEndHook` reads the bound conversation before `endSession` closes the
+session, rather than relying on the close to preserve it. `normalizeTimestamp` pads
+Claude's millisecond `.123Z` to the logger's `.123000Z`, because as strings `.123Z` sorts
+after `.123456Z`. Both headers say the code departs from the Python port on purpose, so
+nobody fixes it back.
+
+The seven-conversation fixture that sat on every window boundary is kept, graded now by
+what it was always meant to show: naming one conversation changes it and leaves the other
+six exactly as they were. The golden that recorded Python filling all seven at once stays as
+a frozen record of the defect, since its generator and its Python source are gone.
+
+**Validated on a real session.** The Navigator ran the route against Claude Code 2.1.318:
+the orphan kept its prompt alone, and the session's reply carried the transcript's own
+timestamp. Two earlier runs failed, and told us something worth keeping: the Navigator's
+machine has Claude settings that pin `MIRROR_BIN` to the installed package over whatever the shell exports,
+and a second copy of the plugin loads from `~/.claude/skills`, so both runs executed the
+published 0.39.5. They reproduced the defect on a real session (`ready` in the orphan, after
+the conversation's close, with no `turn_id`), which is the "before" the CR now records.
+The route pins the checkout with `--settings`.
+
+**CR200** is as [v0.40.0-next.1](v0.40.0-next.1.md) describes it: four rules for what
+belongs to a Journey, a closed inventory a test holds against the schema, and refusals that
+write nothing.
+
+**Also in this release.** The Windows installer's real `MIRROR_NODE` path is named where
+docs and comments had named another. The tests and smokes read their paths through
+`fileURLToPath`, so a checkout under `Código` or `My Projects` no longer fails 113 tests
+(issue #44), and the guard that keeps the product from reading a URL's pathname as a path
+now covers them. The lifecycle smoke asserts the new session-less contract. Captured for
+later: CR198 (`runtime diagnose` does not name a refused `MIRROR_NODE`), CR199
+(`deliverMirrorContext` takes three to seven seconds before a Desktop turn), and CR201.
+
+## Conscious Exclusions
+
+- **Replies already copied stay where they are.** A home that ran an earlier version may
+  hold a reply under the wrong conversation. Nothing in the data tells it from a real one,
+  and removing one is a manual edit; the selector under Upgrading finds the candidates.
+- **A late `SessionEnd` still adds replies after the extraction.** When maintenance closed
+  and extracted a conversation first, the replies the backfill then adds are read by no
+  extraction. CR151 pins that they land in the right conversation, not what then reads them.
+  [CR201](../project/refinement/rs010-cv22-oracle-and-port-hygiene/cr201-a-reply-backfilled-after-the-close-misses-the-extraction-that-closed-the-conversation.md)
+  holds the decision.
+- **The session-less route is gone, not narrowed.** A caller that fed a transcript alone to
+  `conversation-logger session-end` now gets a no-op.
+- No CLI command deletes a Journey with its records; a host is the only caller. No cascade
+  through child Journeys; files on disk are the host's.
+
+## What We Learned
+
+A fallback written for one case does not know about the second. The Python backfill was
+right for a machine with one session at a time, and ordinary use of Mirror, a Ctrl-C in a
+first turn, was enough to make it wrong.
+
+The test that proves a fix is the one that runs the code you changed. Two of the Navigator's three live
+runs exercised the previous release, because a setting the validator did not know about decided
+which Mirror the hooks ran. The checkout's own `mirror-hook` was never in the path. Pinning
+the code under test is part of the route now, and the failed runs stay in the record as
+the defect, measured on a real session, in the published release.
+
+## Upgrading
+
+```bash
+mirror runtime update
+```
+
+Update every install that has a home: the fix lives in the core that the hooks run, and a
+machine whose Claude Code runs a global install keeps the old backfill until that install
+is updated. Plugin copies need no change.
+
+To find replies an earlier version copied into the wrong conversation, read-only:
+
+```bash
+sqlite3 ~/.mirror-minds/<user>/memory.db \
+  "SELECT substr(a.conversation_id,1,8) AS conv, a.created_at, substr(a.content,1,40)
+     FROM messages a JOIN messages b
+       ON a.content = b.content
+      AND substr(a.created_at,1,19) = substr(b.created_at,1,19)
+      AND a.conversation_id < b.conversation_id
+    WHERE a.role = 'assistant' AND b.role = 'assistant'
+    ORDER BY a.created_at"
+```
+
+A match is one reply written into two conversations within the same second, which is the
+trace of one backfill; read each row, because two identical short replies a second apart in
+different conversations are a different thing. The home's dated backups hold the rows as they
+were.
+
+## Next Horizon
+
+CR201's decision, how often the late path is taken on a real home; CR198 and CR199; CR195
+in RS010's backlog. The next train leaves when the Navigator calls it.

package/lib/desktop.js

@@ -22,6 +22,7 @@ const migration = await import("../ts/src/db/migrateHome.ts");
 const context = await import("../ts/src/mirror/deliverContext.ts");
 const learning = await import("../ts/src/conversation/learnFromConversations.ts");
 const journeys = await import("../ts/src/journey/journeyCalls.ts");
+const journeyDeletion = await import("../ts/src/journey/journeyDeletion.ts");
 
 export const DESKTOP_API_VERSION = 1;
 export const inspectMigrationState = migrationReport.inspectMigrationState;
@@ -70,3 +71,10 @@ export const setJourneyProjectPath = journeys.setJourneyProjectPath;
 export const moveJourney = journeys.moveJourney;
 export const deleteJourney = journeys.deleteJourney;
 export const JourneyCallRejectedError = journeys.JourneyCallRejectedError;
+
+// Delete a Journey with its records, after showing what will go: the preview
+// counts every record by rule and answers a digest; the deletion takes that
+// digest back, refuses a home that no longer matches it, and runs behind a
+// retained, verified backup it names. Rejections are `JourneyCallRejectedError`s.
+export const previewJourneyDeletion = journeyDeletion.previewJourneyDeletion;
+export const deleteJourneyWithRecords = journeyDeletion.deleteJourneyWithRecords;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "mirror-mind",
-  "version": "0.39.5",
+  "version": "0.40.0",
   "description": "Mirror Mind: a local-first memory and identity framework for agentic AI runtimes (Pi, Claude Code, Codex, Antigravity)",
   "license": "MIT",
   "repository": {

package/plugins/mirror-mind/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "mirror-mind",
-  "version": "0.39.5",
+  "version": "0.40.0",
   "description": "Mirror Mind — local-first memory and identity for agentic runtimes.",
   "author": {
     "name": "Mirror Mind"

package/plugins/mirror-mind/agy/pre-invocation.sh

@@ -100,8 +100,9 @@ fi
 # runtime spawned this hook from. Anything else is noted with its reason, in
 # the Pi extension's words, once a day, and the search goes on without it.
 # "Absolute" is the MCP locator's pattern too, and it classifies exactly as
-# path.win32.isAbsolute: under Git Bash the Windows installer writes
-# C:\Program Files\nodejs\node.exe (PR #47).
+# path.win32.isAbsolute: under Git Bash the Windows installer writes a
+# drive-letter path, C:\Users\...\AppData\Local\Programs\MirrorMind\node\node.exe
+# (PR #47).
 NODE=""
 if [ -n "${MIRROR_NODE:-}" ]; then
   refused=""

package/plugins/mirror-mind/agy/session-start.sh

@@ -100,8 +100,9 @@ fi
 # runtime spawned this hook from. Anything else is noted with its reason, in
 # the Pi extension's words, once a day, and the search goes on without it.
 # "Absolute" is the MCP locator's pattern too, and it classifies exactly as
-# path.win32.isAbsolute: under Git Bash the Windows installer writes
-# C:\Program Files\nodejs\node.exe (PR #47).
+# path.win32.isAbsolute: under Git Bash the Windows installer writes a
+# drive-letter path, C:\Users\...\AppData\Local\Programs\MirrorMind\node\node.exe
+# (PR #47).
 NODE=""
 if [ -n "${MIRROR_NODE:-}" ]; then
   refused=""

package/plugins/mirror-mind/agy/stop.sh

@@ -100,8 +100,9 @@ fi
 # runtime spawned this hook from. Anything else is noted with its reason, in
 # the Pi extension's words, once a day, and the search goes on without it.
 # "Absolute" is the MCP locator's pattern too, and it classifies exactly as
-# path.win32.isAbsolute: under Git Bash the Windows installer writes
-# C:\Program Files\nodejs\node.exe (PR #47).
+# path.win32.isAbsolute: under Git Bash the Windows installer writes a
+# drive-letter path, C:\Users\...\AppData\Local\Programs\MirrorMind\node\node.exe
+# (PR #47).
 NODE=""
 if [ -n "${MIRROR_NODE:-}" ]; then
   refused=""

package/plugins/mirror-mind/hooks/log-assistant-reply.sh

@@ -95,8 +95,9 @@ fi
 # runtime spawned this hook from. Anything else is noted with its reason, in
 # the Pi extension's words, once a day, and the search goes on without it.
 # "Absolute" is the MCP locator's pattern too, and it classifies exactly as
-# path.win32.isAbsolute: under Git Bash the Windows installer writes
-# C:\Program Files\nodejs\node.exe (PR #47).
+# path.win32.isAbsolute: under Git Bash the Windows installer writes a
+# drive-letter path, C:\Users\...\AppData\Local\Programs\MirrorMind\node\node.exe
+# (PR #47).
 NODE=""
 if [ -n "${MIRROR_NODE:-}" ]; then
   refused=""

package/plugins/mirror-mind/hooks/log-session-end.sh

@@ -95,8 +95,9 @@ fi
 # runtime spawned this hook from. Anything else is noted with its reason, in
 # the Pi extension's words, once a day, and the search goes on without it.
 # "Absolute" is the MCP locator's pattern too, and it classifies exactly as
-# path.win32.isAbsolute: under Git Bash the Windows installer writes
-# C:\Program Files\nodejs\node.exe (PR #47).
+# path.win32.isAbsolute: under Git Bash the Windows installer writes a
+# drive-letter path, C:\Users\...\AppData\Local\Programs\MirrorMind\node\node.exe
+# (PR #47).
 NODE=""
 if [ -n "${MIRROR_NODE:-}" ]; then
   refused=""

package/plugins/mirror-mind/hooks/log-user-prompt.sh

@@ -95,8 +95,9 @@ fi
 # runtime spawned this hook from. Anything else is noted with its reason, in
 # the Pi extension's words, once a day, and the search goes on without it.
 # "Absolute" is the MCP locator's pattern too, and it classifies exactly as
-# path.win32.isAbsolute: under Git Bash the Windows installer writes
-# C:\Program Files\nodejs\node.exe (PR #47).
+# path.win32.isAbsolute: under Git Bash the Windows installer writes a
+# drive-letter path, C:\Users\...\AppData\Local\Programs\MirrorMind\node\node.exe
+# (PR #47).
 NODE=""
 if [ -n "${MIRROR_NODE:-}" ]; then
   refused=""

package/plugins/mirror-mind/hooks/mirror-inject.sh

@@ -95,8 +95,9 @@ fi
 # runtime spawned this hook from. Anything else is noted with its reason, in
 # the Pi extension's words, once a day, and the search goes on without it.
 # "Absolute" is the MCP locator's pattern too, and it classifies exactly as
-# path.win32.isAbsolute: under Git Bash the Windows installer writes
-# C:\Program Files\nodejs\node.exe (PR #47).
+# path.win32.isAbsolute: under Git Bash the Windows installer writes a
+# drive-letter path, C:\Users\...\AppData\Local\Programs\MirrorMind\node\node.exe
+# (PR #47).
 NODE=""
 if [ -n "${MIRROR_NODE:-}" ]; then
   refused=""

package/plugins/mirror-mind/hooks/session-start.sh

@@ -95,8 +95,9 @@ fi
 # runtime spawned this hook from. Anything else is noted with its reason, in
 # the Pi extension's words, once a day, and the search goes on without it.
 # "Absolute" is the MCP locator's pattern too, and it classifies exactly as
-# path.win32.isAbsolute: under Git Bash the Windows installer writes
-# C:\Program Files\nodejs\node.exe (PR #47).
+# path.win32.isAbsolute: under Git Bash the Windows installer writes a
+# drive-letter path, C:\Users\...\AppData\Local\Programs\MirrorMind\node\node.exe
+# (PR #47).
 NODE=""
 if [ -n "${MIRROR_NODE:-}" ]; then
   refused=""

package/plugins/mirror-mind/plugin.json

@@ -1,7 +1,7 @@
 {
   "name": "mirror-mind",
   "description": "Mirror Mind — local-first memory and identity for agentic runtimes.",
-  "version": "0.39.5",
+  "version": "0.40.0",
   "mcpServers": {
     "mirror-mind": {
       "command": "/bin/sh",

package/ts/src/conversation/logger.ts

@@ -584,7 +584,6 @@ export interface HookLoggingOptions {
 export type SessionEndHookOutcome =
   | { action: "skipped"; reason: "malformed_payload" | "nothing_to_do" }
   | { action: "ended"; sessionId: string; transcriptPath: string | null; backfilled: boolean }
-  | { action: "backfilled"; transcriptPath: string }
   | { action: "failed"; error: string };
 
 const parsePayload = parseHookPayloadObject;
@@ -917,12 +916,15 @@ export function handleStopHook(
 }
 
 /**
- * Python `hook_session_end`: end the session when the payload names one, then
- * backfill assistant turns from the transcript when it exists -- in that
- * order, so the just-ended conversation's `ended_at` bounds the backfill.
+ * Python `hook_session_end`: end the session the payload names, then backfill
+ * assistant turns from its transcript when it exists -- in that order, so the
+ * just-ended conversation's `ended_at` bounds the backfill.
  *
- * The two halves are independent: an empty `session_id` with a transcript
- * still backfills (the session-less route, slice E), and a session without a
+ * The backfill fills only the conversation the session is bound to (CR151).
+ * Python's session-less route -- no `session_id`, a transcript alone, filling
+ * every conversation in the transcript's time window -- is gone: a transcript
+ * no session owns cannot be attributed, so it writes nothing. A session with no
+ * bound conversation likewise backfills nothing; a session without a
  * transcript still ends. Everything is swallowed; the hook always exits 0.
  */
 export async function handleSessionEndHook(
@@ -943,42 +945,40 @@ export async function handleSessionEndHook(
     if (!payload) return { action: "skipped", reason: "malformed_payload" };
 
     const sessionId = payloadString(payload, "session_id");
+    if (!sessionId) return { action: "skipped", reason: "nothing_to_do" };
     const transcriptPath = resolveTranscriptPath(
       payloadString(payload, "transcript_path"),
       sessionId,
       options.claudeProjectDir,
       options.homeDir,
     );
+    // Read before the close, so the attribution does not lean on the close
+    // preserving `conversation_id` when it deactivates the session.
+    const runtimeSession = getRuntimeSession(db, sessionId);
+    const conversationId = runtimeSession?.conversationId ?? null;
     let backfilled = false;
     // After the close, which bounds the backfill window, and before the tail,
-    // which should see what the backfill adds (CV21.DS4.TS2).
+    // which should see what the backfill adds (CV21.DS4.TS2). A session with no
+    // bound conversation closes nothing and backfills nothing (CR151).
     const backfill = () => {
-      backfilled = transcriptPath !== null && existsSync(transcriptPath);
-      if (backfilled && transcriptPath !== null)
-        backfillAssistantMessages(db, transcriptPath, deps);
+      if (conversationId === null || transcriptPath === null || !existsSync(transcriptPath)) return;
+      backfilled = true;
+      backfillAssistantMessages(db, transcriptPath, conversationId, deps);
     };
 
-    if (sessionId) {
-      // The label US8 stamps on every prompt; the hook's own detection only when
-      // the row carries none; today's behavior when neither names a runtime.
-      const label = getRuntimeSession(db, sessionId)?.interface || options.interface || null;
-      const finalize = sessionEndRunsLlmTail(label);
-      const closed = await endSession(
-        db,
-        sessionId,
-        { extract: finalize, finalize, beforeTail: backfill },
-        deps,
-        hooks,
-      );
-      // A session with no bound conversation closes nothing; the backfill still runs.
-      if (!closed) backfill();
-    } else {
-      backfill();
-    }
+    // The label US8 stamps on every prompt; the hook's own detection only when
+    // the row carries none; today's behavior when neither names a runtime.
+    const label = runtimeSession?.interface || options.interface || null;
+    const finalize = sessionEndRunsLlmTail(label);
+    await endSession(
+      db,
+      sessionId,
+      { extract: finalize, finalize, beforeTail: backfill },
+      deps,
+      hooks,
+    );
 
-    if (sessionId) return { action: "ended", sessionId, transcriptPath, backfilled };
-    if (backfilled && transcriptPath !== null) return { action: "backfilled", transcriptPath };
-    return { action: "skipped", reason: "nothing_to_do" };
+    return { action: "ended", sessionId, transcriptPath, backfilled };
   } catch (error) {
     return { action: "failed", error: error instanceof Error ? error.message : String(error) };
   }