mixdog 0.9.23 → 0.9.25

package/src/runtime/memory/lib/memory-cycle2-mutations.mjs

@@ -11,6 +11,65 @@ const LLM_JUDGE_CAP = 20
 
 const TRANSIENT_PROMOTE_CATEGORIES = new Set(['task', 'issue'])
 
+// Category grades the pipeline trusts outright: user/cycle1 tagged durable
+// knowledge. These are NEVER content-scanned — a curated constraint like
+// "95% pass threshold" or a rule that cites a metric must still promote.
+const DURABLE_TRUSTED_CATEGORIES = new Set(['rule', 'constraint', 'decision', 'preference', 'goal'])
+
+// Deterministic (non-LLM) signature for transient work-state: status/review
+// churn and benchmark/measurement RESULT snapshots. Narrow on purpose — it
+// requires snapshot phrasing (a measurement verb or an explicit result-metric
+// noun), NOT a bare percentage, so SLO/threshold constraints don't trip it.
+// Applied only to non-durable categories (e.g. 'fact'), catching benchmark
+// snapshots mis-tagged as durable-ish. The gate prompt only *discourages*
+// these; this is the structural enforcement.
+const TRANSIENT_SNAPSHOT_RE = new RegExp(
+  [
+    'terminal-bench',
+    '\\bbenchmark(ed|ing|\\s+(run|result|score))\\b',
+    'pass@\\d',
+    '\\btokens?\\s?\\/\\s?s(ec)?\\b',
+    'status\\s+snapshot',
+    'review(er)?\\s+(validation\\s+)?cycles?',
+    'in[-\\s]progress',
+    '\\bWIP\\b',
+    '\\b(scored|achieved|measured|reached)\\b[^.]{0,40}\\d+(\\.\\d+)?\\s?%',
+    '\\d+(\\.\\d+)?\\s?%\\s+(pass\\s+rate|accuracy|score|throughput|latency)',
+  ].join('|'),
+  'i',
+)
+
+// Structural promotion gate: is this row transient content (task/issue chatter
+// or a status/benchmark snapshot) that must not be promoted pending→active?
+// task/issue block by category. Durable knowledge categories are trusted and
+// skip the content scan. Everything else (e.g. 'fact') is content-scanned so
+// snapshots mis-categorized as durable are still blocked.
+export function isTransientPromotion(row) {
+  if (!row) return false
+  const cat = String(row.category ?? '').toLowerCase()
+  if (TRANSIENT_PROMOTE_CATEGORIES.has(cat)) return true
+  if (DURABLE_TRUSTED_CATEGORIES.has(cat)) return false
+  return TRANSIENT_SNAPSHOT_RE.test(`${row.element ?? ''} ${row.summary ?? ''}`)
+}
+
+// Strip pending→active promotions for transient content out of the status
+// batch BEFORE the cap clamp. Blocked rows are simply dropped from the batch,
+// so they stay pending (held for re-confirmation on a later cycle) — never
+// archived here, and reviewed_at is still bumped via the caller's reviewedIds.
+export function blockTransientPromotions(statusBatch, rowsById) {
+  if (!statusBatch?.length) return { batch: statusBatch ?? [], blocked: 0 }
+  let blocked = 0
+  const batch = statusBatch.filter((item) => {
+    if (item.was_pending && item.new_status === 'active'
+        && isTransientPromotion(rowsById.get(Number(item.entry_id)))) {
+      blocked += 1
+      return false
+    }
+    return true
+  })
+  return { batch, blocked }
+}
+
 // After the gate, cap how many pending→active promotions may land in one batch.
 // Overflow stays pending (not archived). Tiebreak: durable category before
 // task/issue, then score DESC, then older last_seen_at, then id ASC.

package/src/runtime/memory/lib/memory-cycle2.mjs

@@ -11,7 +11,7 @@ import { backfillCoreEmbeddings, nominateCoreCandidates, CORE_SUMMARY_MAX } from
 import { markCycleRequest, consumeCycleRequests, resolveCoalesceMaxDrains, scheduleCoalescedCycleRetry, makeCycleRequestSignature, resolveCoalesceMaxRetries } from './memory-cycle-requests.mjs'
 import { __mixdogMemoryLog, throwIfAborted } from './memory-cycle2-shared.mjs'
 import {
-  applyBatchStatusVerdicts, clampPendingPromotions, applySimpleStatus, applyUpdate, applyMerge, runPhaseMerge,
+  applyBatchStatusVerdicts, clampPendingPromotions, blockTransientPromotions, applySimpleStatus, applyUpdate, applyMerge, runPhaseMerge,
 } from './memory-cycle2-mutations.mjs'
 import {
   CYCLE2_ACTIVE_TARGET_CAP, CYCLE2_ACTIVE_MIN_FLOOR, loadCurrentRulesDigest, runUnifiedGate, sonnetCascade,
@@ -54,6 +54,7 @@ function mergeCycle2Results(a, b) {
     rejected_verb: Number(a.rejected_verb || 0) + Number(b.rejected_verb || 0),
     merge_rejected: Number(a.merge_rejected || 0) + Number(b.merge_rejected || 0),
     missing_core_summary: Number(a.missing_core_summary || 0) + Number(b.missing_core_summary || 0),
+    promotion_blocked: Number(a.promotion_blocked || 0) + Number(b.promotion_blocked || 0),
     core_embedding_backfill: Number(a.core_embedding_backfill || 0) + Number(b.core_embedding_backfill || 0),
     core_candidates_nominated: Number(a.core_candidates_nominated || 0) + Number(b.core_candidates_nominated || 0),
     rescore: mergeNestedNumeric(a.rescore, b.rescore),
@@ -211,6 +212,7 @@ async function _runCycle2Impl(db, config = {}, options = {}, dataDir = null) {
     updated: 0, kept: 0, rejected_verb: 0,
     merge_rejected: 0,
     missing_core_summary: 0,
+    promotion_blocked: 0,
     core_embedding_backfill: 0,
     core_candidates_nominated: 0,
     rescore: { updated: 0 },
@@ -523,8 +525,13 @@ async function _runCycle2Impl(db, config = {}, options = {}, dataDir = null) {
         }
         guardedBatch.push(item)
       }
+      // Structural transient block runs BEFORE the cap clamp: task/issue chatter
+      // and status/benchmark snapshots can never promote pending→active, so they
+      // are stripped here (held pending) regardless of remaining cap slots.
+      const blockRes = blockTransientPromotions(guardedBatch, rowsById)
+      stats.promotion_blocked = blockRes.blocked
       const activeCountForClamp = Math.max(0, activeCount - reservedDemotions)
-      const clampRes = clampPendingPromotions(guardedBatch, rowsById, activeCountForClamp, activeTargetCap)
+      const clampRes = clampPendingPromotions(blockRes.batch, rowsById, activeCountForClamp, activeTargetCap)
       stats.promotion_clamped = clampRes.clamped
       const batchRes = await applyBatchStatusVerdicts(db, clampRes.batch, nowMs)
       stats.promoted += batchRes.promoted
@@ -702,7 +709,7 @@ async function _runCycle2Impl(db, config = {}, options = {}, dataDir = null) {
     ` core_backfill=${stats.core_embedding_backfill}` +
     ` active=${activeCount}/${activeTargetCap} review_active=${reviewActiveRows ? 1 : 0}` +
     ` | gate promoted=${stats.promoted} archived=${stats.archived}` +
-    ` promotion_clamped=${stats.promotion_clamped}` +
+    ` promotion_clamped=${stats.promotion_clamped} promotion_blocked=${stats.promotion_blocked}` +
     ` updated=${stats.updated} kept=${stats.kept}` +
     ` rejected_verb=${stats.rejected_verb} merge_rejected=${stats.merge_rejected}` +
     ` missing_core=${stats.missing_core_summary}` +

package/src/runtime/memory/lib/memory-cycle3.mjs

@@ -11,13 +11,17 @@ function __mixdogMemoryLog(...args) {
 // {{CORE_REVIEW}} block for defaults/cycle3-review-prompt.md, then asks the
 // maintenance-preset LLM for one verdict per id. By default Cycle3 performs
 // conservative cleanup: safe compression updates and strict duplicate merges
-// are applied, while deletes stay proposals unless explicitly confirmed.
+// are applied. Deletes now also apply in conservative mode when the model
+// tags the entry as clear junk (a whitelisted junk reason) and — for
+// redundant-with-default reasons — the text actually echoes a current rule,
+// bounded by a per-run delete cap so a run keeps a safety margin instead of
+// nuking the whole set. Unreasoned / non-junk deletes still require APPLY.
 //
 // Verdict line grammar (mirrors parseUnifiedFormat in memory-cycle2.mjs):
 //   <id>|keep
 //   <id>|update|<element>|<summary>
 //   <id>|merge|<target_id>|<source_ids_csv>
-//   <id>|delete
+//   <id>|delete|<reason>
 
 import { existsSync, readFileSync } from 'fs'
 import { join } from 'path'
@@ -136,6 +140,58 @@ function isStrictDuplicate(a, b) {
   return sim >= 0.78
 }
 
+// Whitelisted delete reasons that conservative mode may auto-apply. These are
+// the "clear junk" classes: a copy of a built-in/default rule, a bare
+// restatement, an obsolete/already-implemented decision, or a past-event log.
+// Anything outside this set (or a bare `delete` with no reason) stays held for
+// APPLY CYCLE3 so genuinely durable rules are never removed unattended.
+const SAFE_DELETE_REASONS = new Set([
+  'duplicate', 'dup', 'duplicate_of_default', 'default', 'redundant',
+  'restatement', 'restate', 'restates_default',
+  'obsolete', 'implemented', 'done', 'completed', 'resolved',
+  'superseded_decision', 'stale', 'past_event', 'event_log', 'log',
+])
+// Reasons that claim redundancy with a built-in/default rule — these demand
+// corroboration (the core text must actually echo the current rules digest)
+// before a conservative auto-delete, so a mislabelled durable rule survives.
+const DEFAULT_ECHO_REASONS = new Set([
+  'duplicate', 'dup', 'duplicate_of_default', 'default', 'redundant',
+  'restatement', 'restate', 'restates_default',
+])
+
+function normalizeDeleteReason(reason) {
+  return String(reason ?? '')
+    .toLowerCase()
+    .trim()
+    .replace(/[^a-z0-9]+/g, '_')
+    .replace(/^_+|_+$/g, '')
+}
+
+// Max trigram similarity of `text` against any substantive line of the current
+// rules digest — how strongly a core entry echoes a built-in rule.
+function digestRedundancy(text, rulesDigest) {
+  if (!text || !rulesDigest) return 0
+  const lines = String(rulesDigest).split('\n').map(l => l.trim()).filter(l => l.length >= 12)
+  let best = 0
+  for (const line of lines) {
+    const d = charDice(text, line)
+    if (d > best) best = d
+    if (best >= 0.9) break
+  }
+  return best
+}
+
+function isSafeConservativeDelete(core, action, rulesDigest) {
+  const reason = normalizeDeleteReason(action?.reason)
+  if (!reason) return { ok: false, reason: 'delete needs a junk reason → APPLY CYCLE3' }
+  if (!SAFE_DELETE_REASONS.has(reason)) return { ok: false, reason: `delete reason "${reason}" not in safe set → APPLY CYCLE3` }
+  if (DEFAULT_ECHO_REASONS.has(reason)) {
+    const red = digestRedundancy(coreText(core), rulesDigest)
+    if (red < 0.5) return { ok: false, reason: `not redundant with defaults (sim=${red.toFixed(2)})` }
+  }
+  return { ok: true, reason }
+}
+
 function formatRelatedRow(r) {
   const tag = r.project_id ? r.project_id : 'COMMON'
   const stat = r.status ? `[${r.status}]` : '[?]'
@@ -206,7 +262,8 @@ function parseVerdicts(raw, idSet) {
       }
       actions.push({ id, verb: 'merge', targetId, sourceIds })
     } else if (verb === 'delete') {
-      actions.push({ id, verb: 'delete' })
+      const reason = (parts[2] ?? '').trim()
+      actions.push({ id, verb: 'delete', reason: reason || null })
     } else if (verb === 'superseded' || verb === 'supersede') {
       // Require newer-id proof: `id|superseded|<newer_id>`. Without a valid
       // newer active core id the supersession has no evidence → drop to keep.
@@ -553,6 +610,10 @@ async function _runCycle3Impl(db, config, dataDir, options = {}) {
   const held = { updated: 0, merged: 0, deleted: 0, superseded: 0 }
   const details = []
   const touched = new Set() // ids already acted on this cycle — avoid double action
+  // Safety margin: even when every junk verdict is legitimate, a single
+  // conservative run applies at most this many outright deletes and holds the
+  // rest for the next pass. Prevents an over-eager model from clearing the set.
+  const conservativeDeleteCap = Math.max(1, Math.ceil(cores.length * 0.35))
 
   // Core-store edit/delete calls are the mutation unit; checkpoints sit before
   // each action/source and after each awaited unit, not inside one file-store write.
@@ -596,19 +657,28 @@ async function _runCycle3Impl(db, config, dataDir, options = {}) {
     }
     if (a.verb === 'delete') {
       proposed.deleted++
-      if (!confirmed) {
+      // confirmed → always delete. conservative → delete only clear junk (safe
+      // reason, corroborated for redundant-with-default), capped per run.
+      // proposal → always hold.
+      let applyDelete = confirmed
+      let holdReason = 'proposal mode'
+      let safeReason = null
+      if (!confirmed && conservative) {
+        const safeDel = isSafeConservativeDelete(coreById.get(a.id), a, rulesDigest)
+        if (!safeDel.ok) holdReason = safeDel.reason
+        else if (deleted >= conservativeDeleteCap) holdReason = `conservative delete cap ${conservativeDeleteCap} reached`
+        else { applyDelete = true; safeReason = safeDel.reason }
+      }
+      if (!applyDelete) {
         held.deleted++
-        details.push({
-          id: a.id, verb: 'delete', applied: false, held: true,
-          reason: conservative ? 'delete requires APPLY CYCLE3' : 'proposal mode',
-        })
+        details.push({ id: a.id, verb: 'delete', applied: false, held: true, reason: holdReason })
         touched.add(a.id)
         continue
       }
       try {
         await deleteCore(dataDir, a.id)
         deleted++
-        details.push({ id: a.id, verb: 'delete', applied: true })
+        details.push({ id: a.id, verb: 'delete', applied: true, reason: safeReason || 'confirmed' })
         touched.add(a.id)
       } catch (err) {
         if (signal?.aborted) throw signal.reason ?? err

package/src/runtime/memory/lib/query-handlers.mjs

@@ -700,7 +700,10 @@ export function createQueryHandlers({
     // caller's own session marked "(current)" via the currentSessionId hint.
     // Falls through to the flat list when everything is one session.
     const _currentSessionHint = String(args?.currentSessionId || '').trim()
-    return { text: recallCapPrefix + renderSessionGroupedLines(sliced, { currentSessionId: _currentSessionHint }) }
+    // recencyOrder on the date path: without it, chunk members (stored ts-ASC
+    // per root) interleave out of order with raw rows inside each session
+    // group (e.g. 04:33 rendered above 04:41).
+    return { text: recallCapPrefix + renderSessionGroupedLines(sliced, { currentSessionId: _currentSessionHint, recencyOrder: sort === 'date' }) }
   }
 
   async function dumpSessionRootChunks(args = {}) {

package/src/runtime/memory/lib/recall-format.mjs

@@ -316,7 +316,11 @@ function shortSessionLabel(sid) {
 // The caller's own session (currentSessionId hint) is marked "(current)".
 // Single-session (or session-less) result sets fall through to the flat
 // renderer — no headers when grouping adds nothing.
-export function renderSessionGroupedLines(rows, { currentSessionId } = {}) {
+// recencyOrder (date-sorted browse) is forwarded to renderEntryLines so each
+// group's lines are globally ts-desc: without it a chunk root's members (stored
+// ts-ASC) interleave with raw rows and invert the visible timeline within a
+// session (e.g. 04:33 rendered above 04:41).
+export function renderSessionGroupedLines(rows, { currentSessionId, recencyOrder = false } = {}) {
   if (!rows || rows.length === 0) return '(no results)'
   const groups = new Map()
   for (const r of rows) {
@@ -325,14 +329,14 @@ export function renderSessionGroupedLines(rows, { currentSessionId } = {}) {
     if (!groups.has(key)) groups.set(key, [])
     groups.get(key).push(r)
   }
-  if (groups.size <= 1) return renderEntryLines(rows)
+  if (groups.size <= 1) return renderEntryLines(rows, { recencyOrder })
   const current = String(currentSessionId || '').trim()
   const parts = []
   for (const [sid, groupRows] of groups) {
     const mark = current && sid === current ? ' (current)' : ''
     const label = sid === '(no session)' ? sid : `session ${shortSessionLabel(sid)}`
     parts.push(`## ${label}${mark}`)
-    parts.push(renderEntryLines(groupRows))
+    parts.push(renderEntryLines(groupRows, { recencyOrder }))
   }
   return parts.join('\n')
 }

package/src/runtime/memory/tool-defs.mjs

@@ -21,7 +21,7 @@ export const TOOL_DEFS = [
         status: { type: 'string', enum: ['pending','active','archived'], description: 'Lifecycle status.' },
         limit: { type: 'number', description: 'Max rows/items.' },
         confirm: { type: 'string', description: 'Exact confirmation phrase for destructive actions.' },
-        project_id: { type: 'string', description: 'Core pool: common, slug, or *.' },
+        project_id: { type: 'string', description: 'Core pool: common, slug, or *. Required for core add/edit; there is no default pool.' },
       },
       required: ['action'],
     },

package/src/runtime/shared/atomic-file.mjs

@@ -13,7 +13,10 @@ import {
 } from 'fs';
 import { dirname, basename, join } from 'path';
 import { randomBytes } from 'crypto';
-import { execFileSync } from 'child_process';
+import { execFile, execFileSync } from 'child_process';
+import { promisify } from 'util';
+
+const _execFileAsync = promisify(execFile);
 
 const RETRY_CODES = new Set(['EPERM', 'EACCES', 'EBUSY', 'EEXIST']);
 const LOCK_WAIT_CODES = new Set(['EEXIST', 'EPERM', 'EACCES', 'EBUSY']);
@@ -419,7 +422,10 @@ export async function withFileLock(lockPath, fn, opts = {}) {
     }
     try { writeFileSync(fd, `${process.pid} ${Date.now()} ${_OWNER_TOKEN}\n`, 'utf8'); } catch {}
     try {
-      if (opts.secret === true) _enforceOwnerOnlyAclWin32(lockPath);
+      // Async ACL enforcement (promisified execFile) so a secret-bearing
+      // async holder never blocks the event loop on icacls; identical
+      // fail-closed semantics to the sync variant.
+      if (opts.secret === true) await _enforceOwnerOnlyAclWin32Async(lockPath);
       return await fn();
     } finally {
       try { closeSync(fd); } catch {}
@@ -523,6 +529,59 @@ function _enforceOwnerOnlyAclWin32(targetPath) {
   }
 }
 
+// ── Async owner-only ACL enforcement (non-blocking, fail-closed) ─────
+// Byte-for-byte the same policy as `_enforceOwnerOnlyAclWin32`, but the two
+// icacls invocations (and the one-time whoami SID resolution) run through
+// promisified execFile so the event loop is never blocked on a subprocess.
+// Shares the `_cachedUserSid` cache with the sync variant, and throws the
+// same EACL* codes so callers keep their fail-closed guarantees.
+async function _resolveCurrentUserPrincipalAsync() {
+  const systemRoot = process.env.SystemRoot || process.env.windir;
+  if (systemRoot) {
+    const whoami = join(systemRoot, 'System32', 'whoami.exe');
+    if (existsSync(whoami)) {
+      try {
+        const { stdout } = await _execFileAsync(whoami, ['/user', '/fo', 'csv', '/nh'], {
+          encoding: 'utf8',
+          windowsHide: true,
+        });
+        const m = String(stdout).match(/S-1-5-[0-9-]+/);
+        if (m) return m[0];
+      } catch {}
+    }
+  }
+  const err = new Error('cannot resolve current Windows user for owner-only ACL enforcement');
+  err.code = 'EACLNOUSER';
+  throw err;
+}
+
+async function _enforceOwnerOnlyAclWin32Async(targetPath) {
+  if (process.platform !== 'win32') return;
+  const systemRoot = process.env.SystemRoot || process.env.windir;
+  if (!systemRoot) {
+    const err = new Error('SystemRoot not set; cannot locate icacls.exe for owner-only ACL enforcement');
+    err.code = 'EACLNOROOT';
+    throw err;
+  }
+  const icacls = join(systemRoot, 'System32', 'icacls.exe');
+  if (!existsSync(icacls)) {
+    const err = new Error(`icacls.exe not found at ${icacls}; refusing to leave secret world-readable`);
+    err.code = 'EACLNOICACLS';
+    throw err;
+  }
+  if (_cachedUserSid === null) _cachedUserSid = await _resolveCurrentUserPrincipalAsync();
+  const principal = _icaclsPrincipal(_cachedUserSid);
+  try {
+    await _execFileAsync(icacls, [targetPath, '/reset'], { windowsHide: true });
+    await _execFileAsync(icacls, [targetPath, '/inheritance:r', '/grant:r', `${principal}:(F)`], { windowsHide: true });
+  } catch (err) {
+    const e = new Error(`icacls failed to apply owner-only ACL to ${targetPath}: ${err?.message || err}`);
+    e.code = 'EACLFAIL';
+    e.cause = err;
+    throw e;
+  }
+}
+
 export function writeFileAtomicSync(filePath, data, opts = {}) {
   const run = () => {
     const dir = dirname(filePath);
@@ -648,6 +707,75 @@ export function updateJsonAtomicSync(filePath, mutator, opts = {}) {
   }, opts);
 }
 
+// ── Async atomic file write (non-blocking secret ACL) ───────────────
+// Mirror of writeFileAtomicSync, but the owner-only ACL enforcement on the
+// temp and final path runs through the async icacls variant so a debounced
+// timer flush never blocks the event loop on a subprocess. The tiny
+// writeFileSync/renameSync of a small JSON payload stay synchronous (they are
+// not the hitch); only the icacls calls — the actual blockers — are awaited.
+// The truncate renameFallback branch is intentionally omitted: it only ever
+// applied to non-secret writes (opts.secret !== true), and every async caller
+// here is a secret config write, so behavior is identical.
+export async function writeFileAtomicAsync(filePath, data, opts = {}) {
+  const run = async () => {
+    const dir = dirname(filePath);
+    mkdirSync(dir, { recursive: true });
+    const tmp = join(dir, `.${basename(filePath)}.${randomBytes(12).toString('hex')}.tmp`);
+    try {
+      const writeOpts = { encoding: opts.encoding || 'utf8', flag: 'wx', mode: opts.mode !== undefined ? opts.mode : 0o600 };
+      writeFileSync(tmp, data, writeOpts);
+      if (opts.secret === true) await _enforceOwnerOnlyAclWin32Async(tmp);
+      if (opts.fsync !== false) {
+        let fd = null;
+        try {
+          fd = openSync(tmp, 'r');
+          fsyncSync(fd);
+        } catch (err) {
+          if (!['EPERM', 'ENOTSUP', 'EINVAL'].includes(err?.code)) throw err;
+        } finally {
+          try { if (fd !== null) closeSync(fd); } catch {}
+        }
+      }
+      if (opts.createOnly === true) {
+        try {
+          linkSync(tmp, filePath);
+        } catch (err) {
+          try { unlinkSync(tmp); } catch {}
+          if (err?.code === 'EEXIST') return false;
+          throw err;
+        }
+        try { unlinkSync(tmp); } catch {}
+      } else {
+        renameWithRetrySync(tmp, filePath, opts);
+      }
+      if (opts.secret === true) await _enforceOwnerOnlyAclWin32Async(filePath);
+      if (opts.fsyncDir === true) {
+        let dfd = null;
+        try {
+          dfd = openSync(dir, 'r');
+          fsyncSync(dfd);
+        } catch (err) {
+          if (!['EPERM', 'ENOTSUP', 'EINVAL', 'EACCES'].includes(err?.code)) throw err;
+        } finally {
+          try { if (dfd !== null) closeSync(dfd); } catch {}
+        }
+      }
+      return true;
+    } catch (err) {
+      try { if (existsSync(tmp)) unlinkSync(tmp); } catch {}
+      throw err;
+    }
+  };
+  if (opts.lock === true) {
+    return withFileLock(`${filePath}.lock`, run, opts);
+  }
+  return run();
+}
+
+export function writeJsonAtomicAsync(filePath, value, opts = {}) {
+  return writeFileAtomicAsync(filePath, JSON.stringify(value, null, opts.compact ? 0 : 2) + '\n', opts);
+}
+
 // Async read-modify-write. Same lock path (`${filePath}.lock`) and protocol
 // as updateJsonAtomicSync, so it is mutually exclusive with the sync variant.
 // The critical section itself is synchronous (readFileSync + writeJsonAtomicSync);

package/src/runtime/shared/background-tasks.mjs

@@ -51,7 +51,7 @@ export function executionModeSchemaDescription(defaultMode = 'sync') {
   if (defaultMode === 'async') {
     return 'sync = inline result; async = task_id + completion notification. Default async.';
   }
-  return 'Runs sync; long-running auto-promotes to a background task_id + completion notification. async forces background.';
+  return 'Runs sync (inline result); no default auto-background. async forces a background task_id + completion notification.';
 }
 
 export function taskIdFromArgs(args = {}) {

package/src/runtime/shared/config.mjs

@@ -6,9 +6,10 @@ import { readFileSync, mkdirSync, existsSync } from 'fs'
 import { join, dirname } from 'path'
 import { createRequire } from 'module'
 import { resolvePluginData } from './plugin-paths.mjs'
-import { renameWithRetrySync, writeJsonAtomicSync, withFileLockSync } from './atomic-file.mjs'
+import { renameWithRetrySync, writeJsonAtomicSync, writeJsonAtomicAsync, withFileLockSync, withFileLock } from './atomic-file.mjs'
 import {
   backupUserData,
+  backupUserDataAsync,
   markUserDataInitialized,
   loadLatestMixdogConfigFromBackup,
   hasUserDataInitMarker,
@@ -210,6 +211,57 @@ export function updateSection(section, updater) {
   })
 }
 
+// ── Async write path (non-blocking) ─────────────────────────────────
+// Parity with the sync RMW above, but every heavy blocker (cross-process
+// lock wait, owner-only icacls ACL, user-data backup copy tree) is awaited
+// off the event loop. Reuses the SAME lock file (`${CONFIG_PATH}.lock`) and
+// secret:true ACL protocol, so an async writer and a sync writer are mutually
+// exclusive against one another AND against other processes — cross-process
+// RMW linearizability is preserved. The in-lock read (readAllForRmW) stays
+// synchronous: it is a small local read, not the hitch source.
+async function writeJsonFileAsync(path, data) {
+  mkdirSync(dirname(path), { recursive: true, mode: 0o700 })
+  if (path === CONFIG_PATH) {
+    try { await backupUserDataAsync(DATA_DIR, 'pre-config-write') } catch {}
+  }
+  await writeJsonAtomicAsync(path, data, { lock: false, fsyncDir: true, mode: 0o600, secret: true })
+  if (path === CONFIG_PATH) {
+    try { markUserDataInitialized(DATA_DIR) } catch {}
+    try { await backupUserDataAsync(DATA_DIR, 'post-config-write') } catch {}
+  }
+}
+
+async function writeAllAsync(data) {
+  await writeJsonFileAsync(CONFIG_PATH, data)
+}
+
+// secret:true clamps the shared-home lock file owner-only on win32 via the
+// ASYNC icacls variant inside withFileLock (fail-closed, non-blocking).
+function withConfigLockAsync(fn) {
+  return withFileLock(`${CONFIG_PATH}.lock`, fn, { secret: true })
+}
+
+export async function updateConfigAsync(updater) {
+  let saved = null
+  await withConfigLockAsync(async () => {
+    const current = stripGeneratedMarker(readAllForRmW()) || {}
+    const next = typeof updater === 'function' ? updater({ ...current }) : updater
+    if (!isPlainObject(next)) throw new Error('[config] updateConfigAsync updater must return an object')
+    saved = stripGeneratedMarker(next) || {}
+    await writeAllAsync(saved)
+  })
+  return saved
+}
+
+export async function updateSectionAsync(section, updater) {
+  await withConfigLockAsync(async () => {
+    const all = readAllForRmW()
+    const current = stripGeneratedMarker(all[section] || {})
+    all[section] = stripGeneratedMarker(typeof updater === 'function' ? updater(current) : updater)
+    await writeAllAsync(all)
+  })
+}
+
 // ── Capabilities (B2 central path policy) ───────────────────────────
 // Top-level `capabilities` section in mixdog-config.json. Safe defaults
 // win on missing/malformed input — every cap is OFF unless explicitly

package/src/runtime/shared/tool-execution-contract.mjs

@@ -2,7 +2,7 @@ export const TOOL_SYNC_EXECUTION_CONTRACT =
   'Runs synchronously in this tool call.';
 
 export const TOOL_ASYNC_EXECUTION_CONTRACT =
-  'Runs sync; long-running auto-promotes to a task_id + completion notification. async forces background. status/read/wait are recovery/blocking only.';
+  'Runs sync inline; no default auto-background. async forces a background task_id + completion notification. status/read/wait are recovery/blocking only.';
 
 export const TOOL_MANUAL_CONTROL_CONTRACT =
   'wait/read/status/cancel are for explicit blocking or recovery only.';

package/src/runtime/shared/tool-surface.mjs

@@ -583,6 +583,25 @@ export function aggregateToolCategoryEntry(name, args = {}, category = '') {
   };
 }
 
+/**
+ * Rebuild the per-category count map for the DONE state, excluding calls that
+ * terminated in an error (rec.isError). Mirrors the call-time accumulation in
+ * turn.mjs (sum aggregateToolCategoryEntry(...).count per key) but drops failed
+ * calls so the completed label counts only successful work — across ALL
+ * categories, not just Memory. The active/in-flight header keeps using the raw
+ * `categories` map, so in-flight counting is unchanged.
+ */
+export function aggregateDoneCategories(calls = []) {
+  const map = new Map();
+  for (const rec of calls || []) {
+    if (!rec || rec.isError) continue;
+    const entry = aggregateToolCategoryEntry(rec.name, rec.args, rec.category);
+    const prev = map.get(entry.key);
+    map.set(entry.key, { ...entry, count: Number(prev?.count || 0) + Number(entry.count || 1) });
+  }
+  return Object.fromEntries(map);
+}
+
 function aggregateCount(value) {
   if (value && typeof value === 'object') return Math.max(0, Number(value.count || 0));
   return Math.max(0, Number(value || 0));

package/src/runtime/shared/update-checker.mjs

@@ -188,6 +188,9 @@ export function runGlobalUpdate() {
       child = spawn(npmCmd, ['install', '-g', `${PACKAGE_NAME}@latest`], {
         stdio: 'ignore',
         windowsHide: true,
+        // detached: survive parent exit — quitting the TUI mid-install must
+        // not kill npm halfway and leave the global install corrupted.
+        detached: true,
         shell: process.platform === 'win32',
       });
     } catch (err) {