mixdog 0.9.14 → 0.9.16

package/src/runtime/memory/lib/memory-cycle2.mjs

@@ -65,6 +65,7 @@ export async function runCycle2(db, config = {}, options = {}, dataDir = null) {
   const signal = options?.signal
   throwIfAborted(signal)
   const coalescedRetry = options?.coalescedRetry === true
+  const catchUpDrainPass = options?.catchUpDrainPass === true
   const retryAttempt = Math.max(0, Number(options?.coalescedRetryAttempt || 0))
   const maxRetries = resolveCoalesceMaxRetries(config, 3)
   const requestSignature = makeCycleRequestSignature('cycle2', config, {
@@ -74,7 +75,13 @@ export async function runCycle2(db, config = {}, options = {}, dataDir = null) {
   const scheduleRetry = () => scheduleCoalescedCycleRetry(
     db,
     'cycle2',
-    () => runCycle2(db, config, { ...options, signal: undefined, coalescedRetry: true, coalescedRetryAttempt: retryAttempt + 1 }, dataDir),
+    () => runCycle2(db, config, {
+      ...options,
+      signal: undefined,
+      catchUpDrainPass: false,
+      coalescedRetry: true,
+      coalescedRetryAttempt: retryAttempt + 1,
+    }, dataDir),
     config,
     requestSignature,
   )
@@ -119,12 +126,15 @@ export async function runCycle2(db, config = {}, options = {}, dataDir = null) {
       let result = null
       let coalescedRuns = 0
       let coalescedRequests = 0
-      if (coalescedRetry) {
+      if (coalescedRetry && !catchUpDrainPass) {
         const pending = await consumeCycleRequests(db, 'cycle2', requestSignature)
         if (pending <= 0) return { ok: true, ...partial, skippedInFlight: false, coalescedRetryNoop: true }
         coalescedRuns += 1
         coalescedRequests += pending
         __mixdogMemoryLog(`[cycle2] retrying coalesced requests=${pending}\n`)
+      } else if (coalescedRetry && catchUpDrainPass) {
+        coalescedRuns += 1
+        __mixdogMemoryLog('[cycle2] catch-up drain pass (direct)\n')
       }
       try {
         result = await _runCycle2Impl(db, config, options, dataDir)
@@ -135,7 +145,7 @@ export async function runCycle2(db, config = {}, options = {}, dataDir = null) {
         }
         throw err
       }
-      const maxDrains = resolveCoalesceMaxDrains(config, 1)
+      const maxDrains = catchUpDrainPass ? 0 : resolveCoalesceMaxDrains(config, 1)
       let drainLoops = 0
       while (drainLoops < maxDrains) {
         throwIfAborted(signal)
@@ -251,7 +261,7 @@ async function _runCycle2Impl(db, config = {}, options = {}, dataDir = null) {
   // below. Cleanup of duplicates/stale user-core overlap also runs via
   // phase_merge / cycle3.
   const rowsRes = await db.query(`
-    SELECT id, element, category, summary, score, last_seen_at, project_id, status
+    SELECT id, element, category, summary, score, last_seen_at, project_id, status, reviewed_at
     FROM entries
     WHERE is_root = 1
       AND (status = 'pending' OR ($2::boolean AND status = 'active'))
@@ -275,7 +285,7 @@ async function _runCycle2Impl(db, config = {}, options = {}, dataDir = null) {
   if (activeRecheckQuota > 0 && activeCount > 0) {
     const seen = new Set(rows.map(r => Number(r.id)))
     const recheckRes = await db.query(`
-      SELECT id, element, category, summary, score, last_seen_at, project_id, status
+      SELECT id, element, category, summary, score, last_seen_at, project_id, status, reviewed_at
       FROM entries
       WHERE is_root = 1 AND status = 'active'
       ORDER BY reviewed_at ASC NULLS FIRST, score ASC, id ASC
@@ -402,17 +412,20 @@ async function _runCycle2Impl(db, config = {}, options = {}, dataDir = null) {
 
         if (a.action === 'active') {
           if (row.status === 'pending') {
-            statusBatch.push({ entry_id: id, new_status: 'active', was_pending: true })
+            statusBatch.push({ entry_id: id, new_status: 'active', was_pending: true, expected: { status: row.status, reviewedAt: row.reviewed_at } })
           } else if (row.status === 'active') {
             stats.kept += 1
           }
           await setCoreSummary(id, explicitCore)
           accepted = true
         } else if (a.action === 'archived') {
-          statusBatch.push({ entry_id: id, new_status: 'archived', was_pending: row.status === 'pending' })
+          statusBatch.push({ entry_id: id, new_status: 'archived', was_pending: row.status === 'pending', expected: { status: row.status, reviewedAt: row.reviewed_at } })
           accepted = true
         } else if (a.action === 'update') {
-          if (await applyUpdate(db, id, a.element, a.summary, { signal })) stats.updated += 1
+          // Optimistic guard: skip if the row moved since the gate read it
+          // (concurrent cycle/recall write). row is the snapshot the verdict
+          // was computed against.
+          if (await applyUpdate(db, id, a.element, a.summary, { signal, expected: { status: row.status, reviewedAt: row.reviewed_at } })) stats.updated += 1
           await setCoreSummary(id, explicitCore)
           accepted = true
         } else if (a.action === 'merge') {

package/src/runtime/memory/lib/memory-embed.mjs

@@ -14,6 +14,52 @@ import { createHash } from 'crypto'
 // flag set by a different DB.
 const _embCacheReady = new WeakSet()
 
+// Opportunistic retention for embedding_cache. Unbounded growth otherwise:
+// every distinct embedded text leaves a permanent row. Prune by row-count cap
+// (oldest inserted rows first) so the working set of hot vectors survives while
+// the tail is reclaimed. Applied opportunistically after cache writes, rate-
+// limited per db handle so it never runs on the hot path more than once/interval.
+const EMB_CACHE_MAX_ROWS = (() => {
+  const n = Number(process.env.MIXDOG_EMBED_CACHE_MAX_ROWS)
+  return Number.isFinite(n) && n > 0 ? Math.floor(n) : 200_000
+})()
+const EMB_CACHE_PRUNE_INTERVAL_MS = 10 * 60_000
+const _embCachePruneAt = new WeakMap() // db → next-allowed prune epoch ms
+
+async function maybePruneEmbCache(db) {
+  const now = Date.now()
+  const next = _embCachePruneAt.get(db) ?? 0
+  if (now < next) return
+  _embCachePruneAt.set(db, now + EMB_CACHE_PRUNE_INTERVAL_MS)
+  try {
+    // Only prune when actually over the cap.
+    const { rows } = await db.query(`SELECT count(*)::bigint AS n FROM memory.embedding_cache`)
+    let over = Number(rows?.[0]?.n ?? 0) - EMB_CACHE_MAX_ROWS
+    if (over <= 0) return
+    // Delete OLDEST rows first (ctid ascending ≈ insertion age) in bounded
+    // batches so a large backlog never takes one long ACCESS-heavy DELETE that
+    // locks the table. Each batch caps at PRUNE_BATCH; loop until under cap.
+    const PRUNE_BATCH = 5000
+    let guard = 0
+    while (over > 0 && guard++ < 1000) {
+      const del = await db.query(
+        `DELETE FROM memory.embedding_cache
+         WHERE ctid IN (
+           SELECT ctid FROM memory.embedding_cache
+           ORDER BY ctid ASC
+           LIMIT $1
+         )`,
+        [Math.min(PRUNE_BATCH, over)],
+      )
+      const n = Number(del?.rowCount ?? 0)
+      if (n === 0) break
+      over -= n
+    }
+  } catch (err) {
+    __mixdogMemoryLog(`[embed] cache prune skipped: ${err?.message || err}\n`)
+  }
+}
+
 export function inferChunkProjectId(members) {
   const storedIds = new Set()
   for (const m of members) {
@@ -103,6 +149,8 @@ export async function cachedEmbedTextBatch(db, texts, options = {}) {
     throwIfAborted(signal)
     for (const e of misses) hitMap.set(e.hash.toString('hex'), e.vector)
   }
+  // Opportunistic retention cap (rate-limited per db).
+  await maybePruneEmbCache(db)
 
   return entries.map(e => hitMap.get(e.hash.toString('hex')) ?? null)
 }

package/src/runtime/memory/lib/memory-recall-store.mjs

@@ -15,6 +15,16 @@ import { recallReadQuery } from './memory-recall-read-query.mjs'
 const _MV_HOT_ACTIVE_TTL_MS = 60_000
 const _mvHotActiveCache = new WeakMap() // db → { populated: boolean, ts: number }
 const SEMANTIC_ONLY_MIN_SIM = 0.72
+// Member-hit time gate: a chunk MEMBER whose own ts falls inside the requested
+// [ts_from, ts_to] window is an in-window match even when its ROOT's ts sits
+// outside it. Returns true when the member ts is within the (open-ended) window.
+function memberTsInWindow(row, tsFrom, tsTo) {
+  const ts = Number(row?.ts)
+  if (!Number.isFinite(ts)) return true // undated member: don't drop on window
+  if (tsFrom != null && ts < tsFrom) return false
+  if (tsTo != null && ts > tsTo) return false
+  return true
+}
 // Cross-language semantic rescue: a query in one language against rows in
 // another rarely clears SEMANTIC_ONLY_MIN_SIM on a small (384-dim) embedding
 // model, yet the TOP dense ranks are still overwhelmingly relevant. Accept
@@ -209,10 +219,10 @@ export async function searchRelevantHybrid(db, query, options = {}) {
   // buildFilterClause: pushes ts/status/scope filters INTO candidate SELECTs.
   // offset = 1-based index of the first bind param it may consume.
   // Returns { clause: string, params: any[] }; clause begins with AND or is ''.
-  function buildFilterClause(offset) {
+  function buildFilterClause(offset, opts = {}) {
     return buildRecallScopeFilter(offset, {
-      ts_from: tsFrom,
-      ts_to: tsTo,
+      ts_from: opts.skipTsWindow ? null : tsFrom,
+      ts_to: opts.skipTsWindow ? null : tsTo,
       excludeStatuses,
       category: categories,
       projectScope,
@@ -602,6 +612,12 @@ LEFT JOIN exact  x ON x.id = c.id`
     } else if (row.chunk_root != null && row.chunk_root !== row.id) {
       const r = rootById.get(Number(row.chunk_root))
       if (!r) continue
+      // Time-filter on the MEMBER's own ts before resolving to the root. A
+      // member match that falls inside the requested [ts_from, ts_to] window
+      // was previously dropped when its ROOT's ts sat outside the window (the
+      // final fetch filters on root ts). Gate the member here on its own ts so
+      // in-window member hits survive root resolution.
+      if (!memberTsInWindow(row, tsFrom, tsTo)) continue
       memberHitRootIds.add(r.id)
       targetRow = r
     } else {
@@ -642,16 +658,44 @@ LEFT JOIN exact  x ON x.id = c.id`
 
   // ── Final fetch: full row for each root by id = ANY(bigint[]) ────────────
   const topIds = rootIdsForReturn.map(x => Number(x.root.id))
-  const { clause: finalFilter, params: finalFilterParams } = buildFilterClause(2)
-  const { rows: finalRows } = await recallReadQuery(
-    db,
-    `SELECT id, ts, role, content, session_id, source_turn, chunk_root, is_root,
-            element, category, summary, project_id, status, score, last_seen_at
-     FROM entries
-     WHERE id = ANY($1::bigint[])
-       ${finalFilter}`,
-    [topIds, ...finalFilterParams],
-  )
+  // Roots reached via an in-window MEMBER hit must NOT be re-dropped by the
+  // final ts window filter: the root's own ts can legitimately sit outside the
+  // window even though a member matched inside it (member ts already gated
+  // above). Fetch member-hit roots with a status/scope-only filter (no ts
+  // window); fetch the rest with the full window filter; merge.
+  const memberHitExemptIds = [...memberHitRootIds].map(Number)
+  let finalRows
+  if (memberHitExemptIds.length > 0) {
+    const exemptSet = new Set(memberHitExemptIds)
+    const nonExempt = topIds.filter(id => !exemptSet.has(id))
+    // Window+status filter for non-member-hit roots.
+    const { clause: winFilter, params: winParams } = buildFilterClause(2)
+    // Status/scope-only filter (no ts window) for member-hit roots.
+    const { clause: statusFilter, params: statusParams } = buildFilterClause(2, { skipTsWindow: true })
+    const [a, b] = await Promise.all([
+      nonExempt.length > 0
+        ? recallReadQuery(db,
+            `SELECT id, ts, role, content, session_id, source_turn, chunk_root, is_root,
+                    element, category, summary, project_id, status, score, last_seen_at
+             FROM entries WHERE id = ANY($1::bigint[]) ${winFilter}`,
+            [nonExempt, ...winParams])
+        : Promise.resolve({ rows: [] }),
+      recallReadQuery(db,
+        `SELECT id, ts, role, content, session_id, source_turn, chunk_root, is_root,
+                element, category, summary, project_id, status, score, last_seen_at
+         FROM entries WHERE id = ANY($1::bigint[]) ${statusFilter}`,
+        [memberHitExemptIds, ...statusParams]),
+    ])
+    finalRows = [...a.rows, ...b.rows]
+  } else {
+    const { clause: winFilter, params: winParams } = buildFilterClause(2)
+    const r = await recallReadQuery(db,
+      `SELECT id, ts, role, content, session_id, source_turn, chunk_root, is_root,
+              element, category, summary, project_id, status, score, last_seen_at
+       FROM entries WHERE id = ANY($1::bigint[]) ${winFilter}`,
+      [topIds, ...winParams])
+    finalRows = r.rows
+  }
   const finalById = new Map(finalRows.map(r => [Number(r.id), r]))
 
   // Members: single batch fetch keyed by chunk_root = ANY($1) — one

package/src/runtime/memory/lib/memory.mjs

@@ -10,6 +10,8 @@ import { ensurePgInstance, closePgInstance, withSchemaBootstrapLock } from './pg
 import { mkdirSync } from 'fs'
 import { resolve } from 'path'
 import { cleanMemoryText } from './memory-extraction.mjs'
+import { isInternalRuntimeNotificationText, isModelVisibleToolCompletionWrapper } from '../../shared/tool-execution-contract.mjs'
+import { isUnquotedToolCompletionHead } from './session-ingest.mjs'
 
 const dbs = new Map()
 const opening = new Map()
@@ -421,6 +423,61 @@ export async function ensureCurrentSchemaExtensions(db, dims) {
   } catch (err) {
     __mixdogMemoryLog(`[memory] attachment-placeholder cleanup failed: ${err?.message || err}\n`)
   }
+  // One-time cleanup: runtime tool-completion notification rows ("The async
+  // shell/agent task ... has finished ... - review this result in your next
+  // step." followed by an unquoted or `> `-quoted Result body, and
+  // "[mixdog-runtime] ..." nudges) that were persisted by the transcript
+  // watcher before it gained the shouldExcludeIngestMessage exclusion
+  // (transcript-ingest.mjs). Gated by a meta flag so this DELETE runs at
+  // most once ever, not on every boot (mirrors boot.schema_bootstrap_complete).
+  // SQL prefilter narrows candidates to role='user' rows only; the DELETE
+  // itself only fires for rows the SAME JS predicates ingest applies confirm
+  // as internal-runtime text — a row that merely starts with "background
+  // task" prose is never deleted unless isInternalRuntimeNotificationText
+  // (or the instruction-head match) itself confirms it. Best-effort so a
+  // failure never blocks boot.
+  const NOTIFICATION_CLEANUP_META_KEY = 'cleanup.notification_rows_v1'
+  try {
+    const already = await db.query(`SELECT 1 FROM meta WHERE key = $1`, [NOTIFICATION_CLEANUP_META_KEY])
+    if (!already?.rows?.length) {
+      const candidates = await db.query(
+        `SELECT id, content FROM entries
+         WHERE role = 'user' AND (
+           content LIKE 'The async % task % has finished%'
+           OR content LIKE '[mixdog-runtime]%'
+           OR content LIKE 'background task%'
+         )`,
+      )
+      const rows = Array.isArray(candidates?.rows) ? candidates.rows : []
+      const idsToDelete = rows
+        .filter((row) => {
+          const text = String(row?.content ?? '')
+          return /^\[mixdog-runtime\]/.test(text.trimStart())
+            || isInternalRuntimeNotificationText(text)
+            || isModelVisibleToolCompletionWrapper(text)
+            || isUnquotedToolCompletionHead(text)
+        })
+        .map((row) => row.id)
+        .filter((id) => id != null)
+      if (idsToDelete.length > 0) {
+        const deleted = await db.query(
+          `DELETE FROM entries WHERE id = ANY($1::bigint[])`,
+          [idsToDelete],
+        )
+        const n = Number(deleted?.rowCount ?? idsToDelete.length)
+        if (n > 0) {
+          __mixdogMemoryLog(`[memory] ensureCurrentSchemaExtensions: removed ${n} runtime notification rows\n`)
+        }
+      }
+      await db.query(
+        `INSERT INTO meta(key, value) VALUES ($1, $2::jsonb)
+         ON CONFLICT(key) DO UPDATE SET value = EXCLUDED.value`,
+        [NOTIFICATION_CLEANUP_META_KEY, JSON.stringify('1')],
+      )
+    }
+  } catch (err) {
+    __mixdogMemoryLog(`[memory] notification-row cleanup failed: ${err?.message || err}\n`)
+  }
   // core_entries gained an embedding column for cross-table semantic dedup
   // between user-curated rows and cycle2-promoted entries. ALTER + index are
   // idempotent and define the current runtime schema.
@@ -575,7 +632,37 @@ export async function closeDatabase(dataDir) {
 export async function isBootstrapComplete(db) {
   try {
     const r = await db.query(`SELECT 1 FROM meta WHERE key = 'boot.schema_bootstrap_complete'`)
-    return r.rows.length > 0
+    if (r.rows.length === 0) return false
+    // The meta flag alone is not proof the schema is CURRENT: an older cluster
+    // whose pgdata predates a column/type addition can carry the flag while the
+    // physical schema has drifted, and trusting the flag would skip init() and
+    // leave inserts failing forever. Verify the critical objects init() creates
+    // actually exist; on drift return false so the caller re-runs init() (all
+    // DDL there is IF NOT EXISTS / additive, so re-running is a safe no-op on a
+    // healthy DB and self-heals a drifted one — no destructive change).
+    const drift = await db.query(`
+      SELECT
+        EXISTS (SELECT 1 FROM pg_type t JOIN pg_namespace n ON n.oid = t.typnamespace
+                WHERE t.typname = 'entry_status' AND n.nspname = 'memory') AS has_status_type,
+        EXISTS (SELECT 1 FROM information_schema.tables
+                WHERE table_schema = 'memory' AND table_name = 'entries') AS has_entries,
+        EXISTS (SELECT 1 FROM information_schema.columns
+                WHERE table_schema = 'memory' AND table_name = 'entries'
+                  AND column_name = 'status') AS has_status_col,
+        EXISTS (SELECT 1 FROM information_schema.columns
+                WHERE table_schema = 'memory' AND table_name = 'entries'
+                  AND column_name = 'chunk_root') AS has_chunk_root,
+        EXISTS (SELECT 1 FROM information_schema.tables
+                WHERE table_schema = 'memory' AND table_name = 'meta') AS has_meta
+    `)
+    const d = drift.rows?.[0] ?? {}
+    const healthy = d.has_status_type && d.has_entries && d.has_status_col
+      && d.has_chunk_root && d.has_meta
+    if (!healthy) {
+      __mixdogMemoryLog(`[memory] bootstrap flag present but schema drifted (${JSON.stringify(d)}); re-running init()\n`)
+      return false
+    }
+    return true
   } catch {
     return false
   }

package/src/runtime/memory/lib/session-ingest.mjs

@@ -1,5 +1,5 @@
 import crypto from 'node:crypto'
-import { isInternalRuntimeNotificationText } from '../../shared/tool-execution-contract.mjs'
+import { isInternalRuntimeNotificationText, isModelVisibleToolCompletionWrapper } from '../../shared/tool-execution-contract.mjs'
 
 // Side-effect-free helpers for ingest_session (recall fast-track hydration).
 // Extracted from memory/index.mjs so the pure logic (stable identity, sensitive
@@ -52,14 +52,20 @@ function toolIdentityIds(m) {
 // regardless of its position after compaction shrinks/reindexes the transcript.
 // Two textually identical untimestamped plain messages intentionally dedupe to
 // one row (stable dedupe preferred over positional separation).
-export function stableSessionSourceRef(sessionId, m, role, content) {
+export function stableSessionSourceRef(sessionId, m, role, content, ordinal) {
   const toolIds = toolIdentityIds(m)
   // Only an ORIGINAL, caller-supplied timestamp counts as durable identity.
   const rawTs = m?.ts ?? m?.timestamp
   const originalTs = (typeof rawTs === 'number' && Number.isFinite(rawTs)) || (typeof rawTs === 'string' && rawTs.trim())
     ? String(rawTs)
     : ''
-  const identity = [role, originalTs, toolIds.join(','), content].join('\u0000')
+  // Untimestamped, textually-identical turns previously collapsed to one row
+  // (same hash). Fold a stable ORDINAL (caller-supplied turn/index) into the
+  // identity so genuine repeats persist as distinct rows. The ordinal is only
+  // used when no durable original ts exists — a timestamped turn keeps its
+  // compaction-stable identity independent of array position.
+  const ordinalPart = originalTs ? '' : (Number.isFinite(Number(ordinal)) ? String(Math.floor(Number(ordinal))) : '')
+  const identity = [role, originalTs, ordinalPart, toolIds.join(','), content].join('\u0000')
   const hash = crypto.createHash('sha256').update(identity).digest('hex').slice(0, 24)
   return `session:${sessionId}:${hash}`
 }
@@ -262,6 +268,24 @@ export function sessionMessageContentForIngest(m) {
   return base
 }
 
+// Head-line shape of toolCompletionInstruction() (tool-execution-contract.mjs)
+// as it is ACTUALLY persisted by mgr.enqueuePendingMessage — UNQUOTED, no
+// `> ` prefix on the Result body (real DB rows look like:
+// "The async shell task <id> has finished (completed, exit 0) - review this
+// result in your next step.\nResult:\nbackground task\ntask_id: ...").
+// isModelVisibleToolCompletionWrapper only matches the QUOTED (`> `) shape
+// mirrored via the notify-wrapper's own quoting, so it misses this unquoted
+// persisted form. The instruction head alone is a sufficient, unambiguous
+// fingerprint (only the runtime ever emits this exact phrase).
+const UNQUOTED_TOOL_COMPLETION_HEAD_RE = /^The async (?:shell task|agent task|\S+ execution|\S+) .*has finished\b.*review this result in your next step/i
+
+// Exported so memory.mjs's one-time cleanup (ensureCurrentSchemaExtensions)
+// can confirm SQL-prefiltered candidate rows with the SAME predicate the live
+// ingest filter uses, rather than re-deriving the regex.
+export function isUnquotedToolCompletionHead(text) {
+  return UNQUOTED_TOOL_COMPLETION_HEAD_RE.test(String(text ?? '').trimStart())
+}
+
 // Row-exclusion predicate for ingest_session. Synthetic / non-conversation
 // rows (reference-files injections, compaction summaries, protected-context
 // `.` acks, internal runtime nudges) are dropped ENTIRELY — they are noise,
@@ -298,6 +322,13 @@ export function shouldExcludeIngestMessage(m) {
     const text = typeof raw === 'string' ? raw : ''
     if (/^\[mixdog-runtime\]/.test(text.trimStart())) return true
     if (isInternalRuntimeNotificationText(text)) return true
+    // Model-visible tool-completion mirror rows (mgr.enqueuePendingMessage of
+    // modelVisibleToolCompletionMessage — "The async shell/agent task ... has
+    // finished ... - review this result in your next step.\n\nResult:\n> ...").
+    // These are runtime notifications, not conversation, on both ingest paths.
+    if (isModelVisibleToolCompletionWrapper(text)) return true
+    // Unquoted persisted form of the same wrapper (see comment above).
+    if (isUnquotedToolCompletionHead(text)) return true
   }
   return false
 }

package/src/runtime/memory/lib/trace-store.mjs

@@ -146,12 +146,23 @@ async function migrateSchemaDrift(client) {
   // readers/writers indefinitely and wedge boot (reviewer Medium). 5s is
   // generous for a metadata change; on timeout we leave the drift in place
   // (inserts keep failing as before — no worse) instead of hanging startup.
-  await client.query(`SET LOCAL lock_timeout = '5s'`).catch(() => {})
+  //
+  // SET LOCAL only affects the enclosing transaction; with pg autocommit each
+  // stray statement was its own transaction, so `SET LOCAL lock_timeout` was a
+  // no-op that ended immediately and the ALTERs ran with the default (0 =
+  // unbounded) timeout — the exact wedge this was meant to prevent. Wrap the
+  // whole thing in an explicit transaction so SET LOCAL actually scopes the
+  // ALTERs; on any error roll back (leaving drift in place, inserts fail as
+  // before — no worse).
   try {
+    await client.query('BEGIN')
+    await client.query(`SET LOCAL lock_timeout = '5s'`)
     await client.query(`ALTER TABLE IF EXISTS trace_events   ADD COLUMN IF NOT EXISTS agent TEXT`)
     await client.query(`ALTER TABLE IF EXISTS agent_sessions ADD COLUMN IF NOT EXISTS agent TEXT`)
-  } finally {
-    await client.query(`SET LOCAL lock_timeout = DEFAULT`).catch(() => {})
+    await client.query('COMMIT')
+  } catch (err) {
+    try { await client.query('ROLLBACK') } catch {}
+    __mixdogMemoryLog(`[trace-store] schema-drift migrate skipped: ${err?.message ?? err}\n`)
   }
 }
 
@@ -455,6 +466,43 @@ async function ensureCurrentAndNextMonthPartitions(client) {
   `)
 }
 
+// Trace retention: drop named monthly partitions older than the configured
+// window. Trace is regenerable observability data, so aging out old months is
+// non-destructive to durable state. Config via MIXDOG_TRACE_RETENTION_MONTHS
+// (default 6); set to 0 to disable. Only DROPs partitions strictly older than
+// the cutoff month; the default catch-all partition is never dropped.
+const TRACE_RETENTION_MONTHS = (() => {
+  const raw = process.env.MIXDOG_TRACE_RETENTION_MONTHS
+  if (raw == null || raw === '') return 6
+  const n = Number(raw)
+  return Number.isFinite(n) && n >= 0 ? Math.floor(n) : 6
+})()
+
+async function dropAgedTracePartitions(client) {
+  if (TRACE_RETENTION_MONTHS <= 0) return
+  // DO blocks take no bind params, so compute the cutoff month in SQL and pass
+  // the retention count as a literal (validated integer above — no injection).
+  const months = TRACE_RETENTION_MONTHS
+  await client.query(`
+    DO $$
+    DECLARE
+      cutoff   TEXT := to_char(now() - interval '${months} months', 'YYYY_MM');
+      part     RECORD;
+    BEGIN
+      FOR part IN
+        SELECT c.relname
+        FROM   pg_class c
+        JOIN   pg_namespace n ON n.oid = c.relnamespace
+        WHERE  n.nspname = 'trace'
+          AND  c.relname ~ '^trace_events_[0-9]{4}_[0-9]{2}$'
+          AND  substring(c.relname from 'trace_events_(.*)') < cutoff
+      LOOP
+        EXECUTE format('DROP TABLE IF EXISTS trace.%I', part.relname);
+      END LOOP;
+    END $$
+  `)
+}
+
 async function isBootstrapComplete(client) {
   try {
     // Harden the check: require (a) root is partitioned, (b) schema-version
@@ -579,6 +627,7 @@ export async function openTraceDatabase(dataDir) {
       try {
         await c.query(`SET search_path = trace, public`)
         await ensureCurrentAndNextMonthPartitions(c)
+        await dropAgedTracePartitions(c)
       } catch (err) {
         __mixdogMemoryLog(`[trace-store] periodic partition ensure failed: ${err?.message ?? err}\n`)
       } finally {

package/src/runtime/memory/lib/transcript-ingest.mjs

@@ -9,6 +9,7 @@
 // this module stays a pure factory with no import-time side effects.
 import fs from 'node:fs'
 import path from 'node:path'
+import { normalizeIngestRole, sessionMessageContentForIngest, shouldExcludeIngestMessage } from './session-ingest.mjs'
 
 // Pure: coerce a transcript timestamp (seconds, ms, or ISO string) to ms.
 export function parseTsToMs(value) {
@@ -107,8 +108,8 @@ export function createTranscriptIngest({
 
   function snapshotTranscriptOffset(transcriptPath) {
     const stored = _transcriptOffsets.get(transcriptPath)
-    if (!stored) return { bytes: 0, lineIndex: 0 }
-    return { bytes: Number(stored.bytes) || 0, lineIndex: Number(stored.lineIndex) || 0 }
+    if (!stored) return { bytes: 0, lineIndex: 0, generation: 0 }
+    return { bytes: Number(stored.bytes) || 0, lineIndex: Number(stored.lineIndex) || 0, generation: Number(stored.generation) || 0 }
   }
 
   async function ingestTranscriptFileImpl(transcriptPath, { cwd } = {}) {
@@ -117,9 +118,18 @@ export function createTranscriptIngest({
     try { stat = await fs.promises.stat(transcriptPath) } catch { return 0 }
     const sessionUuid = path.basename(transcriptPath, '.jsonl')
     const prev = snapshotTranscriptOffset(transcriptPath)
+    // Generation counter: a truncate/rewrite of the transcript (size shrank
+    // below the persisted byte offset) resets bytes/lineIndex to 0, so the
+    // rewritten lines reuse the SAME transcript:${uuid}#${index} refs as the
+    // pre-truncate content. With ON CONFLICT DO NOTHING the rewritten rows were
+    // silently dropped. Bump a persisted per-file generation on each detected
+    // reset and fold it into source_ref so rewritten lines get fresh identities
+    // and persist. Existing rows (gen 0, no suffix) are unaffected.
+    let generation = Number(prev.generation) || 0
     if (stat.size < prev.bytes) {
       prev.bytes = 0
       prev.lineIndex = 0
+      generation += 1
     }
     if (stat.size <= prev.bytes) return 0
 
@@ -180,7 +190,17 @@ export function createTranscriptIngest({
         lastGoodLineIndex = index
         continue
       }
-      const content = firstTextContent(parsed.message?.content)
+      // Reuse the ingest_session shape/exclude predicates so the transcript
+      // watcher stores ONLY pure conversation rows — same purity as
+      // ingest_session (strips manager.mjs prefix envelopes, drops synthetic
+      // reference-files/compaction/ack/internal-notification rows).
+      const shaped = { role, content: parsed.message?.content }
+      if (shouldExcludeIngestMessage(shaped)) {
+        lastGoodBytes += consumedBytes
+        lastGoodLineIndex = index
+        continue
+      }
+      const content = sessionMessageContentForIngest(shaped)
       if (!content || !content.trim()) {
         lastGoodBytes += consumedBytes
         lastGoodLineIndex = index
@@ -193,7 +213,9 @@ export function createTranscriptIngest({
         continue
       }
       const tsMs = parseTsToMs(parsed.timestamp ?? parsed.ts ?? Date.now())
-      const sourceRef = `transcript:${sessionUuid}#${index}`
+      const sourceRef = generation > 0
+        ? `transcript:${sessionUuid}#${index}@g${generation}`
+        : `transcript:${sessionUuid}#${index}`
       try {
         const result = await db.query(
           `INSERT INTO entries(ts, role, content, source_ref, session_id, source_turn, project_id)
@@ -215,6 +237,7 @@ export function createTranscriptIngest({
     _transcriptOffsets.set(transcriptPath, {
       bytes: lastGoodBytes,
       lineIndex: lastGoodLineIndex,
+      generation,
     })
     await persistTranscriptOffsets()
     return count

package/src/runtime/shared/child-guardian.mjs

@@ -24,11 +24,13 @@ function alive(pid) {
 }
 function killTarget(force) {
   if (platform === 'win32') {
+    const systemRoot = process.env.SystemRoot || process.env.WINDIR || 'C:\\\\Windows';
+    const taskkill = systemRoot + '\\\\System32\\\\taskkill.exe';
     if (force) {
-      try { spawnSync('taskkill.exe', ['/PID', String(childPid), '/T', '/F'], { stdio: 'ignore', windowsHide: true }); } catch {}
+      try { spawnSync(taskkill, ['/PID', String(childPid), '/T', '/F'], { stdio: 'ignore', windowsHide: true }); } catch {}
     } else {
       try { process.kill(childPid, 'SIGTERM'); } catch {}
-      try { spawnSync('taskkill.exe', ['/PID', String(childPid), '/T'], { stdio: 'ignore', windowsHide: true }); } catch {}
+      try { spawnSync(taskkill, ['/PID', String(childPid), '/T'], { stdio: 'ignore', windowsHide: true }); } catch {}
     }
     return;
   }

package/src/runtime/shared/open-url.mjs

@@ -9,7 +9,8 @@ export function openInBrowser(url) {
   const u = String(url);
   let candidates;
   if (process.platform === 'win32') {
-    candidates = [['rundll32', ['url.dll,FileProtocolHandler', u]]];
+    const systemRoot = process.env.SystemRoot || process.env.WINDIR || 'C:\\Windows';
+    candidates = [[`${systemRoot}\\System32\\rundll32.exe`, ['url.dll,FileProtocolHandler', u]]];
   } else if (process.platform === 'darwin') {
     candidates = [['open', [u]]];
   } else if (isWSL()) {

package/src/runtime/shared/singleton-owner.mjs

@@ -102,3 +102,29 @@ export function releaseSingletonOwner(path, pid = process.pid) {
     return false;
   }
 }
+
+// Atomic ownership handoff: replace the owner record from fromPid to toOwner
+// under the SAME claim lock, so a concurrent claimSingletonOwner() cannot slip
+// between a release() and a re-claim() and fork a competing daemon. Verifies
+// the current on-disk pid is still fromPid before writing; if it drifted
+// (someone else won), the handoff is refused (owned:false) and the caller
+// should fall back to the winner rather than overwrite it.
+export function handoffSingletonOwner(path, fromPid, toOwner = {}) {
+  const lockPath = acquireClaimLock(path);
+  if (!lockPath) return { owned: false, owner: readJson(path) };
+  try {
+    const current = readJson(path);
+    if (current?.pid && Number(current.pid) !== Number(fromPid)) {
+      return { owned: false, owner: current };
+    }
+    const owner = {
+      kind: 'runtime',
+      claimedAt: new Date().toISOString(),
+      ...toOwner,
+    };
+    writeJsonAtomic(path, owner);
+    return { owned: true, owner };
+  } finally {
+    rmSync(lockPath, { recursive: true, force: true });
+  }
+}