mixdog 0.9.174 → 1.0.0

package/src/runtime/memory/lib/memory-ops-policy.mjs

@@ -38,7 +38,7 @@ async function countUnclassified(db) {
   return Number(row?.c ?? 0);
 }
 
-function selectBackfillTranscripts({ sinceMs = null, limit = null, projectsRoot = null } = {}) {
+function selectBackfillTranscripts({ sinceMs = null, limit = null, projectsRoot = null, accept = null } = {}) {
   const root = projectsRoot || path.join(mixdogHome(), 'projects');
   if (!fs.existsSync(root)) return [];
   const files = [];
@@ -56,6 +56,7 @@ function selectBackfillTranscripts({ sinceMs = null, limit = null, projectsRoot
           continue;
         }
         if (sinceMs != null && mtime < sinceMs) continue;
+        if (accept && !accept(fp)) continue;
         files.push({ path: fp, mtime });
       }
     } catch {}
@@ -82,6 +83,7 @@ export async function runFullBackfill(
     runCycle2,
     now = Date.now(),
     projectsRoot = null,
+    workspaceCwd = null,
     signal,
   } = {}
 ) {
@@ -96,7 +98,21 @@ export async function runFullBackfill(
   const normalizedWindow = normalizeBackfillWindow(window);
   const normalizedScope = normalizeBackfillScope(scope);
   const sinceMs = resolveBackfillSinceMs(normalizedWindow, now);
-  const selected = selectBackfillTranscripts({ sinceMs, limit, projectsRoot });
+  const normPath = (p) => {
+    const r = path.resolve(String(p));
+    return process.platform === 'win32' ? r.toLowerCase() : r;
+  };
+  const workspaceRoot = normPath(workspaceCwd || process.cwd());
+  const accept =
+    normalizedScope === 'workspace' && typeof cwdFromTranscriptPath === 'function'
+      ? (fp) => {
+          const c = cwdFromTranscriptPath(fp);
+          if (!c) return false;
+          const rel = path.relative(workspaceRoot, normPath(c));
+          return rel === '' || (!rel.startsWith('..') && !path.isAbsolute(rel));
+        }
+      : null;
+  const selected = selectBackfillTranscripts({ sinceMs, limit, projectsRoot, accept });
 
   let ingested = 0;
   const errors = [];

package/src/runtime/memory/lib/memory-retrievers.mjs

@@ -60,7 +60,7 @@ export async function retrieveEntries(db, filters = {}) {
     }
   }
 
-  // R11 reviewer H2: exclude archived leakage in temporal augment paths.
+  // Exclude archived leakage in temporal augment paths.
   if (Array.isArray(filters.excludeStatuses) && filters.excludeStatuses.length > 0) {
     const exc = filters.excludeStatuses
       .map((s) => String(s).trim().toLowerCase())
@@ -72,7 +72,7 @@ export async function retrieveEntries(db, filters = {}) {
     }
   }
 
-  // R11 reviewer M3: orphan raw chunks (chunk_root IS NULL) for narrow-window
+  // Orphan raw chunks (chunk_root IS NULL) for narrow-window
   // raw merging — prevents classified-member chunks from duplicating their root.
   if (filters.chunkRootNull === true) {
     where.push(`chunk_root IS NULL`);

package/src/runtime/memory/lib/memory-text-utils.mjs

@@ -102,7 +102,7 @@ function isEntityConcept(token) {
   return !/\p{Script=Hangul}/u.test(token) || isIdentifierToken(token);
 }
 
-function isStructuralTimeToken(token) {
+export function isStructuralTimeToken(token) {
   return /^\d{4}-\d{2}-\d{2}(?:~\d{4}-\d{2}-\d{2})?$/u.test(token) || /^\d{1,2}:\d{2}(?:~\d{1,2}:\d{2})?$/u.test(token);
 }
 

package/src/runtime/memory/lib/pg/adapter.mjs

@@ -76,9 +76,9 @@ function installPoolErrorHandler(pool, label, { onConnectionLoss } = {}) {
   return pool;
 }
 
-// pg-adapter.mjs — PG connection manager for mixdog 0.4.0
-// Single owner: supervisor-pg.ensurePgInstance(dataDir) starts PG.
-// pg-adapter calls supervisor-pg — never pg-process directly.
+// adapter.mjs — PG connection manager.
+// Single owner: supervisor.mjs ensurePgInstance(dataDir) starts PG.
+// This adapter calls the supervisor — never process.mjs directly.
 //
 // Public API:
 //   ensurePgInstance(dataDir, { schema? }) → { db, pool, host, port, runtimeDir, pgdataDir }

package/src/runtime/memory/lib/pg/process.mjs

@@ -1,7 +1,7 @@
 import { __mixdogMemoryLog } from '../memory-log.mjs';
 import { sleep as delay } from '../../../shared/sleep.mjs';
 
-// pg-process.mjs — lower-level PG lifecycle helpers for mixdog 0.4.0
+// process.mjs — lower-level PG lifecycle helpers
 //
 // Public API:
 //   startPg({ runtimeDir, pgdataDir, port?, logPath? }) → { pid, port }
@@ -83,7 +83,7 @@ async function awaitExistingPostmaster({ pgdataDir, waitMs }) {
 }
 
 async function findFreePort(preferred) {
-  // I2: clamp out-of-range callers to the valid window.
+  // Clamp out-of-range callers to the valid window.
   if (preferred < PG_PORT_MIN || preferred > PG_PORT_MAX) preferred = PG_PORT_MIN;
   if (await isTcpPortFree(preferred)) return preferred;
   for (let p = preferred + 1; p <= PG_PORT_MAX; p++) {

package/src/runtime/memory/lib/pg/supervisor.mjs

@@ -7,8 +7,7 @@ import { __mixdogMemoryLog } from '../memory-log.mjs';
  *   ensurePgInstance(dataDir) → Promise<{ host, port, runtimeDir, pgdataDir }>
  *   stopPgForShutdown()       → Promise<void>  — call from server-main.mjs shutdown()
  *
- * Depends on Track A's pg-process.mjs for startPg / stopPg / healthcheckPg.
- * Lazy-imported so this module loads cleanly before Track A lands.
+ * Uses process.mjs for startPg / stopPg / healthcheckPg (lazy-imported).
  *
  * active-instance.json additions:
  *   pg_port?        number  — TCP port PG is listening on

package/src/runtime/memory/lib/query-ranking.mjs

@@ -1,5 +1,6 @@
 import { sessionRecallTerms } from './recall-format.mjs';
 import { compareRecallNewestFirst } from './recall-order.mjs';
+import { isStructuralTimeToken } from './memory-text-utils.mjs';
 
 const LATEST_RECALL_CONTEXT_TERMS = new Set([
   'latest',
@@ -49,8 +50,7 @@ export function hasVagueLatestWorkIntent(text) {
 export function latestRecallTopicTerms(text) {
   return sessionRecallTerms(text)
     .filter((term) => !LATEST_RECALL_CONTEXT_TERMS.has(term))
-    .filter((term) => !/^\d{4}-\d{2}-\d{2}(?:~\d{4}-\d{2}-\d{2})?$/u.test(term))
-    .filter((term) => !/^\d{1,2}:\d{2}(?:~\d{1,2}:\d{2})?$/u.test(term))
+    .filter((term) => !isStructuralTimeToken(term))
     .filter((term) => !/^\d{1,4}(?:년|월|일|시|분)$/u.test(term));
 }
 

package/src/runtime/memory/lib/query-search-plan.mjs

@@ -87,7 +87,7 @@ export function resolveSearchPlan(args, resolveProjectScope) {
   // query-less browsing stays newest-first through the default above.
   // Callers asking for a timeline can pin sort:'date' explicitly.
 
-  // Derive projectScope from caller cwd (falls back to process.cwd()).
+  // Derive projectScope from caller cwd (no cwd → the explicit session cwd, else COMMON).
   // Explicit args.projectScope (string) takes priority so callers can
   // override to 'all', 'common', or a specific slug.
   const projectScope = resolveQueryProjectScope(args, resolveProjectScope);

package/src/runtime/memory/lib/recall-format.mjs

@@ -25,10 +25,9 @@ function calendarDayWindow(period) {
   return { startMs: start.getTime(), endMs: end.getTime() };
 }
 
-// R6 P9: calendar Mon-Sun previous/current week. Mon-start ISO convention.
-// Replaces R5 rolling 7-14d range which was empty for sessions where "last
-// week" decisions actually fell on Mon (4/27) of this week. Precise calendar
-// bounds match natural-language intuition.
+// Calendar Mon-Sun previous/current week (Mon-start ISO convention). Precise
+// calendar bounds match natural-language intuition; a rolling 7-14d range
+// missed "last week" decisions that fell on this week's Monday.
 function calendarWeekWindow(period) {
   if (period !== 'this_week' && period !== 'last_week') return null;
   const d = new Date();

package/src/runtime/memory/lib/runtime-fetcher.mjs

@@ -7,9 +7,12 @@ import { __mixdogMemoryLog } from './memory-log.mjs';
 // Downloads and verifies a prebuilt native PG runtime from the mixdog GitHub
 // release manifest.
 //
-// Layout: <dataDir>/runtime/runtime-{ver}/  +  <dataDir>/runtime/active-version
+// Layout: <dataDir>/runtime/runtime-{key}/  +  <dataDir>/runtime/active-version
+// holding {key}. New installs key the directory by version plus asset digest;
+// installs from before that keep their bare-version key and stay valid.
 // Atomic swap: write active-version.tmp then rename → active-version.
-// GC: removes stale runtime-* dirs and staging-* dirs on every ensureRuntime call.
+// GC: removes stale runtime-* dirs and staging-* dirs on every ensureRuntime
+// call, but only a dir that can be moved aside whole (never one in use).
 //
 // Public API: ensureRuntime(dataDir) → { runtimeDir, pgBinDir, libDir, sharePath, version }
 
@@ -21,6 +24,7 @@ import {
   openSync,
   readFileSync,
   readdirSync,
+  renameSync,
   rmSync,
   statSync,
   unlinkSync,
@@ -109,6 +113,38 @@ function runtimeVerDir(runtimeDir, ver) {
   return join(runtimeDir, `runtime-${ver}`);
 }
 
+// A rebuilt asset of the same version gets its own directory, so installing it
+// never touches the tree a still-running PostgreSQL may hold open.
+function runtimeInstallKey(version, sha256) {
+  return `${version}-${String(sha256).slice(0, 12)}`;
+}
+
+// True while a PostgreSQL from this runtime is running: a running executable
+// cannot be opened for writing (EBUSY on Windows, ETXTBSY on Linux).
+function runtimeDirInUse(dir) {
+  const exe = join(dir, 'bin', process.platform === 'win32' ? 'postgres.exe' : 'postgres');
+  try {
+    closeSync(openSync(exe, 'r+'));
+    return false;
+  } catch (error) {
+    return error?.code === 'EBUSY' || error?.code === 'ETXTBSY';
+  }
+}
+
+// Remove a runtime dir only when nothing runs from it, moving it aside whole
+// first. Deleting in place could strip a running PostgreSQL's files and the
+// sha stamp while the locked binaries survive, leaving a tree that looks
+// installed but is not; an in-use dir makes this throw and stays intact.
+function discardRuntimeDir(runtimeDir, dir) {
+  if (runtimeDirInUse(dir)) throw new Error(`[runtime-fetcher] runtime dir is in use: ${dir}`);
+  const trash = join(
+    runtimeDir,
+    `staging-discard-${Date.now()}-${process.pid}-${Math.random().toString(36).slice(2, 8)}`
+  );
+  renameSync(dir, trash);
+  rmSync(trash, { recursive: true, force: true });
+}
+
 function runtimePaths(verDir) {
   return {
     pgBinDir: join(verDir, 'bin'),
@@ -370,9 +406,11 @@ function gcRuntimeDir(runtimeDir, keepVer) {
           continue;
         }
         const dir = join(runtimeDir, name);
-        const lockPath = stagingLockPath(dir);
-        // Never wipe a staging dir guarded by a LIVE lock — that is a sibling
-        // process mid-extract/swap.
+        // A download (staging-{tag}.tar.gz) is guarded by its staging dir's lock.
+        const guardName = name.endsWith('.tar.gz') ? name.slice(0, -'.tar.gz'.length) : name;
+        const lockPath = stagingLockPath(join(runtimeDir, guardName));
+        // Never wipe a staging dir or download guarded by a LIVE lock — that is
+        // a sibling process mid-download/extract/swap.
         if (_stagingLockIsLive(lockPath)) continue;
         try {
           rmSync(dir, { recursive: true, force: true });
@@ -382,8 +420,10 @@ function gcRuntimeDir(runtimeDir, keepVer) {
           if (existsSync(lockPath)) unlinkSync(lockPath);
         } catch {}
       } else if (name.startsWith('runtime-') && name !== `runtime-${keepVer}`) {
+        const path = join(runtimeDir, name);
         try {
-          rmSync(join(runtimeDir, name), { recursive: true, force: true });
+          if (statSync(path).isDirectory()) discardRuntimeDir(runtimeDir, path);
+          else rmSync(path, { force: true });
         } catch {}
       }
     }
@@ -451,11 +491,36 @@ function selectRuntimeAsset(manifest, pkey) {
 /** Fast path: the active-version pointer names this version and the extracted
  *  tree carries the expected sha256. Returns the reusable dir, else null. */
 function cachedRuntimeDir(runtimeBaseDir, version, sha256) {
-  if (readActiveVersion(runtimeBaseDir) !== version) return null;
-  const verDir = runtimeVerDir(runtimeBaseDir, version);
-  if (!existsSync(join(verDir, '.version-sha256'))) return null;
-  const stored = readFileSync(join(verDir, '.version-sha256'), 'utf8').trim();
-  return stored === sha256 ? verDir : null;
+  const key = readActiveVersion(runtimeBaseDir);
+  if (key !== version && key !== runtimeInstallKey(version, sha256)) return null;
+  const verDir = runtimeVerDir(runtimeBaseDir, key);
+  return readRuntimeStamp(verDir) === sha256 ? verDir : null;
+}
+
+// The asset digest stamped into a complete runtime tree, '' when absent.
+function readRuntimeStamp(verDir) {
+  try {
+    return readFileSync(join(verDir, '.version-sha256'), 'utf8').trim();
+  } catch {
+    return '';
+  }
+}
+
+// Publish an extracted, stamped staging tree as runtime-{key} and point
+// active-version at it. A sibling that raced this install may already have
+// published the same asset: that tree is kept (it may be running) and this
+// copy dropped. Any other runtime-{key} tree is an interrupted install of this
+// asset; it is moved aside whole, and an in-use one fails the publish intact.
+function publishRuntimeDir(runtimeBaseDir, stagingDir, key, sha256) {
+  const verDir = runtimeVerDir(runtimeBaseDir, key);
+  if (readRuntimeStamp(verDir) === sha256) {
+    rmSync(stagingDir, { recursive: true, force: true });
+  } else {
+    if (existsSync(verDir)) discardRuntimeDir(runtimeBaseDir, verDir);
+    renameWithRetrySync(stagingDir, verDir);
+  }
+  writeFileAtomicSync(activeVersionPath(runtimeBaseDir), key, { fsyncDir: true });
+  return verDir;
 }
 
 /**
@@ -476,10 +541,11 @@ async function installRuntimeVersion({ runtimeBaseDir, url, sha256, size, versio
   // process fail to obtain the lock for its own staging dir).
   const stagingTag = `${Date.now()}-${process.pid}-${Math.random().toString(36).slice(2, 8)}`;
   const stagingDir = join(runtimeBaseDir, `staging-${stagingTag}`);
-  const tarPath = join(runtimeBaseDir, `runtime-${pkey}-${stagingTag}.tar.gz`);
+  // Named after the staging dir so the same live lock guards it from GC.
+  const tarPath = `${stagingDir}.tar.gz`;
 
-  const verDir = runtimeVerDir(runtimeBaseDir, version);
-  const avPath = activeVersionPath(runtimeBaseDir);
+  const key = runtimeInstallKey(version, sha256);
+  const verDir = runtimeVerDir(runtimeBaseDir, key);
 
   // Cross-process lock: hold the staging lockfile (O_EXCL) for the WHOLE
   // download → extract → swap lifetime. GC in any concurrently-booting sibling
@@ -527,16 +593,11 @@ async function installRuntimeVersion({ runtimeBaseDir, url, sha256, size, versio
     normalizeBinExecBit(stagingDir);
 
     // Atomic swap:
-    // 1. Rename staging → runtime-{ver}
+    // 1. Rename staging → runtime-{key} (or reuse a sibling's identical publish)
     // 2. Write active-version.tmp → rename to active-version
     // Stale dirs cleaned up by GC after.
     try {
-      // If a prior runtime-{ver} dir exists (interrupted earlier run), remove it.
-      if (existsSync(verDir)) {
-        rmSync(verDir, { recursive: true, force: true });
-      }
-      renameWithRetrySync(stagingDir, verDir);
-      writeFileAtomicSync(avPath, version, { fsyncDir: true });
+      publishRuntimeDir(runtimeBaseDir, stagingDir, key, sha256);
     } catch (swapErr) {
       __mixdogMemoryLog(`[runtime-fetcher] atomic swap failed: ${swapErr.message}\n`);
       // Attempt to leave things in a recoverable state: if verDir landed but
@@ -544,10 +605,10 @@ async function installRuntimeVersion({ runtimeBaseDir, url, sha256, size, versio
       throw swapErr;
     }
 
-    // GC: remove stale runtime-* dirs (anything that isn't runtime-{version}).
+    // GC: remove stale runtime-* dirs (anything that isn't runtime-{key}).
     // Still under the lock so the just-swapped staging lockfile reap below sees
     // a consistent view.
-    gcRuntimeDir(runtimeBaseDir, version);
+    gcRuntimeDir(runtimeBaseDir, key);
   } finally {
     releaseStagingLock(stagingLock);
   }
@@ -556,6 +617,16 @@ async function installRuntimeVersion({ runtimeBaseDir, url, sha256, size, versio
   return verDir;
 }
 
+export const _runtimeLayoutInternals = {
+  acquireStagingLock,
+  cachedRuntimeDir,
+  discardRuntimeDir,
+  gcRuntimeDir,
+  publishRuntimeDir,
+  releaseStagingLock,
+  runtimeInstallKey,
+};
+
 export async function ensureRuntime(dataDir) {
   const key = resolve(dataDir);
   if (runtimeCache.has(key)) return runtimeCache.get(key);

package/src/runtime/memory/lib/session-ingest-runtime.mjs

@@ -58,7 +58,7 @@ export function createSessionIngestRuntime({
     const limit =
       args.fullTranscript === true ? messages.length : Math.max(1, Math.min(5000, Number(args.limit) || 200));
     const start = Math.max(0, messages.length - limit);
-    const projectId = resolveProjectScope(typeof args.cwd === 'string' && args.cwd ? args.cwd : null);
+    const projectId = resolveProjectScope(args.cwd);
     const turnAllocator = createIngestTurnAllocator(await readMaxSourceTurn(db, sessionId));
     const ordinalState = ordinals.touch(sessionId);
     await ordinals.ensureDurableLoaded(ordinalState, sessionId);

package/src/runtime/memory/lib/trace-store.mjs

@@ -720,7 +720,7 @@ function _scheduleFlush(db, q) {
 
 // ---------------------------------------------------------------------------
 // Exit drain — flush pending trace events before process exit.
-// Issue 4: timer is unref()'d so it won't prevent exit; register drain handlers.
+// The flush timer is unref()'d so it won't prevent exit; register drain handlers.
 // ---------------------------------------------------------------------------
 
 const _registeredExitDbs = new WeakMap();
@@ -773,7 +773,11 @@ export function registerTraceExitDrain(db) {
   };
   const onSigterm = async () => {
     await drainOnExit();
-    process.exit(0);
+    // Registering a SIGTERM listener suppresses Node's default termination.
+    // Restore it only when this was the sole listener; otherwise leave the
+    // remaining handlers to finish their own graceful shutdown.
+    process.off('SIGTERM', onSigterm);
+    if (process.listenerCount('SIGTERM') === 0) process.kill(process.pid, 'SIGTERM');
   };
 
   process.on('exit', onExit);

package/src/runtime/office/authoring/pptx-author-action.mjs

@@ -91,7 +91,7 @@ function factsGateResult(target, brief, gate, run) {
 
 // The HTML's own geometry, read in the browser before anything lands: a declared relation that does not
 // hold, or a near miss no declaration covers (pptx-html-geometry.mjs).
-export function geometryGateResult(target, run) {
+function geometryGateResult(target, run) {
   const listed = run.geometry
     .map((page) => `slide ${page.slide}: ${page.findings.map((finding) => finding.message).join('; ')}`)
     .join(' | ');
@@ -163,11 +163,16 @@ async function finishAuthoredDeck(session, { args, cwd, target, run, signal, rep
     result.render.compare = await writeHtmlComparisons(target, run.htmlShots, result.render.images);
     const drift = await measureHtmlDrift(run.htmlShots, run.htmlText, result.render.images);
     result.render.drift = drift;
-    const moved = drift.pages.map((entry) => `slide ${entry.page}: ${entry.items.map((item) => `"${item.text}" dy ${item.dy} dx ${item.dx}`).join(', ')}`);
+    const moved = drift.pages.map(
+      (entry) =>
+        `slide ${entry.page}: ${entry.items.map((item) => `"${item.text}" dy ${item.dy} dx ${item.dx}`).join(', ')}`
+    );
     const drifted = moved.length
       ? ` html_render_drift: text PowerPoint drew more than ${drift.threshold}px from where the HTML put it (${moved.join('; ')}); open those pages' compare pairs and fix the HTML or report the residue.`
       : '';
-    const unread = drift.unreadPages?.length ? ` Pages ${drift.unreadPages.join(', ')} were rendered in shared images, so their drift was not read; render them in batches of 12 or fewer to read it.` : '';
+    const unread = drift.unreadPages?.length
+      ? ` Pages ${drift.unreadPages.join(', ')} were rendered in shared images, so their drift was not read; render them in batches of 12 or fewer to read it.`
+      : '';
     result.nextAction = `${result.nextAction} render.compare holds one image per page, the HTML (left) beside the PPTX render (right): open a page's pair when its render differs from what the HTML drew.${drifted}${unread}`;
   }
   return result;

package/src/runtime/office/authoring/pptx-brief.mjs

@@ -6,6 +6,7 @@
 // writes before any geometry exists, and `planGate` holds the deck to it.
 
 import { isPictureShape } from '../design/design-discipline.mjs';
+import { issue as sharedIssue } from '../quality/assurance-issue.mjs';
 
 const PLAN_KEYS = ['job', 'relationship', 'move', 'composition', 'carriers', 'texture', 'rhythm'];
 
@@ -170,9 +171,8 @@ function slideFacts(slide) {
   return { geometry, charts, tables, pictures, drawn, text };
 }
 
-function issue(code, path, message, severity = 'warning') {
-  return { severity, code, path, message, source: 'design-review' };
-}
+const issue = (code, path, message, severity = 'warning') =>
+  sharedIssue(code, path, message, 'design-review', severity);
 
 // Plan lines whose named carriers the saved slide does not show. A
 // geometry-based promise (gauge, diagram) is only checked when the snapshot