mixdog 0.9.24 → 0.9.25

package/scripts/smoke-runtime-negative.ps1

@@ -1,106 +1,106 @@
-# smoke-runtime-negative.ps1 — Negative-path tests against released win32-x64
-# runtime tarball. Validates: download, sha256, corrupt-tarball, fresh-extract
-# boot, double-init refusal, hostile-env survival.
-#
-# Env: TAG / OS / ARCH / RUNTIME_RELEASE_REPOSITORY (default tribgames/mixdog)
-
-$ErrorActionPreference = 'Stop'
-
-$Tag         = if ($env:TAG)                { $env:TAG }  else { 'runtime-v0.4.0' }
-$Os          = if ($env:OS)                 { $env:OS }   else { 'win32' }
-$Arch        = if ($env:ARCH)               { $env:ARCH } else { 'x64' }
-$ReleaseRepo = if ($env:RUNTIME_RELEASE_REPOSITORY) { $env:RUNTIME_RELEASE_REPOSITORY } else { 'tribgames/mixdog' }
-$PgVer       = '16.4'
-$PgvectorVer = '0.8.2'
-
-$Asset = "mixdog-runtime-${Os}-${Arch}-pg${PgVer}-pgvector${PgvectorVer}.tar.gz"
-$Url   = "https://github.com/${ReleaseRepo}/releases/download/${Tag}/${Asset}"
-
-$Work = New-Item -ItemType Directory -Force -Path "$env:TEMP\smoke-$([guid]::NewGuid().ToString('N'))" | Select-Object -ExpandProperty FullName
-
-try {
-    Write-Host "==> Negative-path smoke for ${Os}-${Arch} from $Url"
-
-    Write-Host "==> Test 1: HEAD reaches release asset"
-    $resp = Invoke-WebRequest -Uri $Url -Method Head -UseBasicParsing -ErrorAction Stop
-    Write-Host "  HTTP $($resp.StatusCode)"
-
-    Write-Host "==> Test 2: full download + sha256"
-    $TarPath = Join-Path $Work $Asset
-    Invoke-WebRequest -Uri $Url -OutFile $TarPath -UseBasicParsing
-    $sha = (Get-FileHash -Algorithm SHA256 $TarPath).Hash.ToLower()
-    Write-Host "  sha256=$sha"
-
-    Write-Host "==> Test 3: corrupt tarball — flip a byte and ensure tar errors"
-    $CorruptPath = "$Work\corrupt.tar.gz"
-    Copy-Item $TarPath $CorruptPath
-    $bytes = [byte[]]::new(1); $rand = [System.Random]::new(); $rand.NextBytes($bytes)
-    $stream = [System.IO.File]::OpenWrite($CorruptPath)
-    $stream.Position = 102400
-    $stream.Write($bytes, 0, 1)
-    $stream.Close()
-    $CorruptDir = "$Work\corrupt"
-    New-Item -ItemType Directory -Force -Path $CorruptDir | Out-Null
-    $TarProc = Start-Process -FilePath tar -ArgumentList @('-xzf', $CorruptPath, '-C', $CorruptDir.Replace('\','/')) -Wait:$false -PassThru -WindowStyle Hidden
-    if (-not $TarProc.WaitForExit(15000)) {
-        Stop-Process -Id $TarProc.Id -Force -ErrorAction SilentlyContinue
-        Write-Host "  PASS: corrupted tarball extraction timed out and was stopped"
-    } elseif ($TarProc.ExitCode -eq 0) {
-        Write-Host "  WARN: corrupted tarball extracted without error (tar gzip recovery)"
-    } else {
-        Write-Host "  PASS: corrupted tarball rejected by tar (exit $($TarProc.ExitCode))"
-    }
-
-    Write-Host "==> Test 4: fresh-extract boot (extension load + distance query)"
-    $FreshDir = "$Work\fresh"
-    New-Item -ItemType Directory -Force -Path $FreshDir | Out-Null
-    & tar -xzf $TarPath -C ($FreshDir.Replace('\','/'))
-    if ($LASTEXITCODE -ne 0) { throw "fresh extract failed" }
-
-    $PgBin   = "$FreshDir\bin"
-    $Data    = "$FreshDir\pgdata"
-    $Log     = "$FreshDir\pg.log"
-    $Port    = 55897
-
-    # Hostile env: minimal PATH (System32 only), no PGROOT/PGDATA
-    $SavedPath = $env:PATH
-    $SavedPgRoot = $env:PGROOT
-    $env:PATH   = "$env:SystemRoot\System32;$env:SystemRoot"
-    $env:PGROOT = $null
-    $env:PGDATA = $null
-
-    try {
-        & "$PgBin\postgres.exe" --version
-        if ($LASTEXITCODE -ne 0) { throw "FAIL: postgres --version" }
-        & "$PgBin\initdb.exe" -D $Data --username=postgres --auth-local=trust --no-locale -E UTF8 | Out-Null
-        if ($LASTEXITCODE -ne 0) { throw "FAIL: initdb" }
-        & "$PgBin\pg_ctl.exe" -D $Data -o "-p $Port -h 127.0.0.1" -l $Log -w start
-        if ($LASTEXITCODE -ne 0) { Get-Content $Log | Select-Object -Last 30; throw "FAIL: pg_ctl start" }
-
-        try {
-            & "$PgBin\psql.exe" -h 127.0.0.1 -p $Port -U postgres -d postgres -c "CREATE EXTENSION vector;" | Out-Null
-            if ($LASTEXITCODE -ne 0) { throw "FAIL: CREATE EXTENSION" }
-            $ExtV = & "$PgBin\psql.exe" -h 127.0.0.1 -p $Port -U postgres -d postgres -tAc "SELECT extversion FROM pg_extension WHERE extname='vector';"
-            if ($ExtV.Trim() -ne $PgvectorVer) { throw "FAIL: extversion='$ExtV' expected='$PgvectorVer'" }
-            Write-Host "  PASS: fresh-extract boot + vector extension"
-        } finally {
-            & "$PgBin\pg_ctl.exe" -D $Data -m fast stop 2>$null | Out-Null
-        }
-
-        Write-Host "==> Test 5: second initdb on initialized dir refused"
-        $rc = (Start-Process -FilePath "$PgBin\initdb.exe" -ArgumentList "-D",$Data,"-U","postgres" -Wait -PassThru -NoNewWindow).ExitCode
-        if ($rc -eq 0) {
-            Write-Host "  WARN: second initdb succeeded (unexpected)"
-        } else {
-            Write-Host "  PASS: second initdb refused (exit $rc)"
-        }
-    } finally {
-        $env:PATH   = $SavedPath
-        $env:PGROOT = $SavedPgRoot
-    }
-
-    Write-Host "==> All negative-path smokes: PASS"
-}
-finally {
-    Remove-Item -Recurse -Force $Work -ErrorAction SilentlyContinue
-}
+# smoke-runtime-negative.ps1 — Negative-path tests against released win32-x64
+# runtime tarball. Validates: download, sha256, corrupt-tarball, fresh-extract
+# boot, double-init refusal, hostile-env survival.
+#
+# Env: TAG / OS / ARCH / RUNTIME_RELEASE_REPOSITORY (default tribgames/mixdog)
+
+$ErrorActionPreference = 'Stop'
+
+$Tag         = if ($env:TAG)                { $env:TAG }  else { 'runtime-v0.4.0' }
+$Os          = if ($env:OS)                 { $env:OS }   else { 'win32' }
+$Arch        = if ($env:ARCH)               { $env:ARCH } else { 'x64' }
+$ReleaseRepo = if ($env:RUNTIME_RELEASE_REPOSITORY) { $env:RUNTIME_RELEASE_REPOSITORY } else { 'tribgames/mixdog' }
+$PgVer       = '16.4'
+$PgvectorVer = '0.8.2'
+
+$Asset = "mixdog-runtime-${Os}-${Arch}-pg${PgVer}-pgvector${PgvectorVer}.tar.gz"
+$Url   = "https://github.com/${ReleaseRepo}/releases/download/${Tag}/${Asset}"
+
+$Work = New-Item -ItemType Directory -Force -Path "$env:TEMP\smoke-$([guid]::NewGuid().ToString('N'))" | Select-Object -ExpandProperty FullName
+
+try {
+    Write-Host "==> Negative-path smoke for ${Os}-${Arch} from $Url"
+
+    Write-Host "==> Test 1: HEAD reaches release asset"
+    $resp = Invoke-WebRequest -Uri $Url -Method Head -UseBasicParsing -ErrorAction Stop
+    Write-Host "  HTTP $($resp.StatusCode)"
+
+    Write-Host "==> Test 2: full download + sha256"
+    $TarPath = Join-Path $Work $Asset
+    Invoke-WebRequest -Uri $Url -OutFile $TarPath -UseBasicParsing
+    $sha = (Get-FileHash -Algorithm SHA256 $TarPath).Hash.ToLower()
+    Write-Host "  sha256=$sha"
+
+    Write-Host "==> Test 3: corrupt tarball — flip a byte and ensure tar errors"
+    $CorruptPath = "$Work\corrupt.tar.gz"
+    Copy-Item $TarPath $CorruptPath
+    $bytes = [byte[]]::new(1); $rand = [System.Random]::new(); $rand.NextBytes($bytes)
+    $stream = [System.IO.File]::OpenWrite($CorruptPath)
+    $stream.Position = 102400
+    $stream.Write($bytes, 0, 1)
+    $stream.Close()
+    $CorruptDir = "$Work\corrupt"
+    New-Item -ItemType Directory -Force -Path $CorruptDir | Out-Null
+    $TarProc = Start-Process -FilePath tar -ArgumentList @('-xzf', $CorruptPath, '-C', $CorruptDir.Replace('\','/')) -Wait:$false -PassThru -WindowStyle Hidden
+    if (-not $TarProc.WaitForExit(15000)) {
+        Stop-Process -Id $TarProc.Id -Force -ErrorAction SilentlyContinue
+        Write-Host "  PASS: corrupted tarball extraction timed out and was stopped"
+    } elseif ($TarProc.ExitCode -eq 0) {
+        Write-Host "  WARN: corrupted tarball extracted without error (tar gzip recovery)"
+    } else {
+        Write-Host "  PASS: corrupted tarball rejected by tar (exit $($TarProc.ExitCode))"
+    }
+
+    Write-Host "==> Test 4: fresh-extract boot (extension load + distance query)"
+    $FreshDir = "$Work\fresh"
+    New-Item -ItemType Directory -Force -Path $FreshDir | Out-Null
+    & tar -xzf $TarPath -C ($FreshDir.Replace('\','/'))
+    if ($LASTEXITCODE -ne 0) { throw "fresh extract failed" }
+
+    $PgBin   = "$FreshDir\bin"
+    $Data    = "$FreshDir\pgdata"
+    $Log     = "$FreshDir\pg.log"
+    $Port    = 55897
+
+    # Hostile env: minimal PATH (System32 only), no PGROOT/PGDATA
+    $SavedPath = $env:PATH
+    $SavedPgRoot = $env:PGROOT
+    $env:PATH   = "$env:SystemRoot\System32;$env:SystemRoot"
+    $env:PGROOT = $null
+    $env:PGDATA = $null
+
+    try {
+        & "$PgBin\postgres.exe" --version
+        if ($LASTEXITCODE -ne 0) { throw "FAIL: postgres --version" }
+        & "$PgBin\initdb.exe" -D $Data --username=postgres --auth-local=trust --no-locale -E UTF8 | Out-Null
+        if ($LASTEXITCODE -ne 0) { throw "FAIL: initdb" }
+        & "$PgBin\pg_ctl.exe" -D $Data -o "-p $Port -h 127.0.0.1" -l $Log -w start
+        if ($LASTEXITCODE -ne 0) { Get-Content $Log | Select-Object -Last 30; throw "FAIL: pg_ctl start" }
+
+        try {
+            & "$PgBin\psql.exe" -h 127.0.0.1 -p $Port -U postgres -d postgres -c "CREATE EXTENSION vector;" | Out-Null
+            if ($LASTEXITCODE -ne 0) { throw "FAIL: CREATE EXTENSION" }
+            $ExtV = & "$PgBin\psql.exe" -h 127.0.0.1 -p $Port -U postgres -d postgres -tAc "SELECT extversion FROM pg_extension WHERE extname='vector';"
+            if ($ExtV.Trim() -ne $PgvectorVer) { throw "FAIL: extversion='$ExtV' expected='$PgvectorVer'" }
+            Write-Host "  PASS: fresh-extract boot + vector extension"
+        } finally {
+            & "$PgBin\pg_ctl.exe" -D $Data -m fast stop 2>$null | Out-Null
+        }
+
+        Write-Host "==> Test 5: second initdb on initialized dir refused"
+        $rc = (Start-Process -FilePath "$PgBin\initdb.exe" -ArgumentList "-D",$Data,"-U","postgres" -Wait -PassThru -NoNewWindow).ExitCode
+        if ($rc -eq 0) {
+            Write-Host "  WARN: second initdb succeeded (unexpected)"
+        } else {
+            Write-Host "  PASS: second initdb refused (exit $rc)"
+        }
+    } finally {
+        $env:PATH   = $SavedPath
+        $env:PGROOT = $SavedPgRoot
+    }
+
+    Write-Host "==> All negative-path smokes: PASS"
+}
+finally {
+    Remove-Item -Recurse -Force $Work -ErrorAction SilentlyContinue
+}

package/scripts/tool-efficiency-diag.mjs

@@ -88,4 +88,4 @@ for (const target of ['heavy-worker', 'worker']) {
   console.log(`  single-call batches: ${batch1}/${batchTot} (${pct(batch1, batchTot)}%)`);
   console.log(`  content greps with -C/-A/-B: ${grepContentWithCtx}/${grepContent} (${pct(grepContentWithCtx, grepContent)}%)  grep->read follow-ups: ${grepThenRead}`);
   console.log(`  same-path re-reads >=3x: ${rereads}`);
-}
+}

package/src/defaults/cycle3-review-prompt.md

@@ -3,8 +3,10 @@
 You review user-curated CORE memory against the current project memory. Each
 entry is shown with its most-related current memory. Emit ONE verdict line per
 entry id. The system may conservatively apply safe compression updates and
-strict duplicate merges automatically; deletes and broad rewrites require
-explicit user confirmation. Extracting a lesson from a narrative is a BROAD
+strict duplicate merges automatically, and now also auto-applies deletes you
+tag as clear junk (see the delete reasons below), capped per run for safety;
+non-junk or unreasoned deletes and broad rewrites still require explicit user
+confirmation. Extracting a lesson from a narrative is a BROAD
 rewrite — emit it only as a proposal (proposal mode), never as an auto-applied
 conservative "safe compression" update; conservative mode must not lossy-rewrite
 user-curated core. The first character of your response is a digit.
@@ -64,7 +66,12 @@ or inconclusive, keep the CORE entry.
   so a CORE copy is redundant); OR is sourced from code, rules files, or skill
   docs, or is an implementation spec, constant, measurement, resolved-bug
   story, or status snapshot that fits no L1/L2/L3 layer. Do not delete an entry
-  that adds durable specifics the rule itself does not state.
+  that adds durable specifics the rule itself does not state. ALWAYS append a
+  reason tag: `<id>|delete|<reason>` where `<reason>` is one of `duplicate`,
+  `default` (restates a built-in/default rule), `restatement`, `obsolete`,
+  `implemented`, `resolved`, `stale`, `past_event`, or `log`. A bare
+  `<id>|delete` with no reason, or any reason outside that set, is treated as
+  "needs confirmation" and only removed on an explicit APPLY CYCLE3 run.
 
 A verbose durable entry is always `update`, never `keep`.
 Delete is the rarest verdict. Prefer `keep` for durable rules/preferences and
@@ -97,7 +104,7 @@ One line per entry id, any order:
 <id>|update|<element>|<summary>
 <id>|merge|<target_id>|<source_ids_csv>
 <id>|superseded|<newer_id>
-<id>|delete
+<id>|delete|<reason>
 ```
 
 `summary` ≤120 chars, one clause. No literal `|` or newline inside a field

package/src/defaults/memory-promote-prompt.md

@@ -112,6 +112,15 @@ A/B pending rows that encode lasting behavior or map anchors; transient
 When `Active > cap`, contract strictly: any active entry without a concrete
 A/B reason must archive.
 
+**Structural block (enforced, not advisory).** Pending `task`/`issue` rows and
+any row that reads as status/review churn or a benchmark/measurement result
+snapshot are blocked from promotion by the pipeline itself — an `active` verdict
+on them is dropped and the row is **held pending and re-judged on a later
+cycle** (it is neither promoted nor force-archived here). Do NOT archive such a
+row just because it cannot promote now: leave it to be re-confirmed, or promote
+the durable L2 lesson distilled from it under a durable category. Durable
+rules/preferences/constraints promote normally.
+
 If useful content is buried inside work narrative, keep only the durable L2
 behavior lesson (via `update` on an active row, or `active` for a pending row);
 archive the surrounding story.

package/src/rules/lead/02-channels.md

@@ -1,3 +1,3 @@
-# Channels
-
-- Channel features are handled by the runtime.
+# Channels
+
+- Channel features are handled by the runtime.

package/src/runtime/channels/backends/discord.mjs

@@ -435,14 +435,21 @@ class DiscordBackend {
     const msg = await ch.messages.fetch(messageId);
     if (msg.attachments.size === 0) return [];
     const results = [];
+    // Optional filter bounds what gets fetched (e.g. image/* only) so a
+    // caller after images never pulls unrelated large attachments.
+    const filter = typeof opts.filter === "function" ? opts.filter : null;
     for (const att of msg.attachments.values()) {
-      const path = await this.downloadSingleAttachment(att, opts);
-      results.push({
+      const meta = {
         id: att.id,
-        path,
         name: safeAttName(att),
         contentType: att.contentType ?? "unknown",
         size: att.size
+      };
+      if (filter && !filter(meta)) continue;
+      const path = await this.downloadSingleAttachment(att, opts);
+      results.push({
+        ...meta,
+        path
       });
     }
     return results;

package/src/runtime/channels/lib/inbound-handler.mjs

@@ -10,6 +10,9 @@ import { isNetworkError, retryOnNetwork } from "./network-retry.mjs";
 // preserving): serial inbound queue, backend.onMessage transcript (re)bind +
 // steal logic, and handleInbound voice-transcription + parent notify. Bound to
 // live runtime getters and shared primitives.
+function isImageAttachment(contentType) {
+  return typeof contentType === "string" && contentType.toLowerCase().startsWith("image/");
+}
 export function createInboundHandler({
   getBackend,
   getConfig,
@@ -283,6 +286,46 @@ async function handleInbound(msg, route, options = {}) {
     }
   }
   const hasVoiceAtt = voiceAtts.length > 0;
+  // ── Inbound image attachments → downloaded local paths (vision) ──────
+  // Mirror the voice path: download image/* attachments to the inbox and
+  // hand their local paths downstream so the agent session can attach them
+  // as real image content blocks. A short per-attempt timeout bounds the
+  // serial inboundQueue against a slow/broken image; on failure we degrade
+  // to the metadata-only marker (attMeta below) instead of dropping.
+  const imageAtts = msg.attachments.filter((a) => isImageAttachment(a.contentType));
+  let imagePaths = [];
+  if (imageAtts.length > 0) {
+    try {
+      const files = (await retryOnNetwork(
+        () => getBackend().downloadAttachment(msg.chatId, msg.messageId, {
+          timeoutMs: 20_000,
+          filter: (a) => isImageAttachment(a.contentType),
+        }),
+        { label: "image.download" }
+      )) || [];
+      imagePaths = imageAtts
+        .map((a) => files.find((df) => df.id === a.id) ?? null)
+        .filter(Boolean)
+        .map((f) => f.path)
+        .filter((p) => typeof p === "string" && p.length > 0);
+      if (imagePaths.length > 0) {
+        process.stderr.write(`mixdog: inbound images downloaded (${imagePaths.length})\n`);
+      }
+    } catch (err) {
+      const netFail = isNetworkError(err);
+      process.stderr.write(`mixdog: image.download error${netFail ? " (network, retries exhausted)" : ""}: ${err}\n`);
+      const marker = netFail
+        ? "[attachment: image download failed (network)]"
+        : "[attachment: image download failed]";
+      text = text ? `${text} ${marker}` : marker;
+    }
+  }
+  // An image-only message can arrive with empty text; channelNotificationModelContent
+  // drops empty content (runtime-core), which would strip meta.image_paths and lose
+  // the image. Give it a non-empty marker so the notification (and its images) flow.
+  if (imagePaths.length > 0 && !String(text || "").trim()) {
+    text = "[image]";
+  }
   const attMeta = msg.attachments.length > 0 && !hasVoiceAtt ? {
     attachment_count: String(msg.attachments.length),
     attachments: msg.attachments.map((a) => `${a.name} (${a.contentType}, ${(a.size / 1024).toFixed(0)}KB)`).join("; ")
@@ -300,7 +343,8 @@ async function handleInbound(msg, route, options = {}) {
       ...route.sourceLabel ? { source_label: route.sourceLabel } : {}
     } : {},
     ...attMeta,
-    ...msg.imagePath ? { image_path: msg.imagePath } : {}
+    ...msg.imagePath ? { image_path: msg.imagePath } : {},
+    ...imagePaths.length > 0 ? { image_paths: JSON.stringify(imagePaths) } : {}
   };
   const notificationContent = messageBody;
   sendNotifyToParent("notifications/claude/channel", {

package/src/runtime/memory/lib/cycle-scheduler.mjs

@@ -333,7 +333,13 @@ export function createCycleScheduler(deps) {
       try {
         let c3Options = {
           coalescedRetry: true,
-          onCoalescedSuccess: async () => { await setCycleLastRun('cycle3', Date.now()); markCycleDone('cycle3', true) },
+          onCoalescedSuccess: async (result) => {
+            // Only a real, error-free pass persists success; a run that returned
+            // an error (LLM/unparseable) must not stamp last_success_at.
+            if (result?.error) { markCycleDone('cycle3', false, result.error); return }
+            await setCycleLastRun('cycle3', Date.now())
+            markCycleDone('cycle3', true)
+          },
         }
         if (typeof c3Options?.callLlm !== 'function') {
           c3Options = { ...c3Options, callLlm: getCycle3CallLlm() }
@@ -498,6 +504,16 @@ export function createCycleScheduler(deps) {
     // so clear the marker (health/backlog reset to this process's state).
     _cycleRunning = null
     _writeCycleStateFile()
+    // Hydrate health success timestamps from the persisted per-cycle last-run
+    // meta. Without this, a restart re-inits _cycleHealth to last_success_at=0
+    // and the state file reports 0 until the next run — for cycle3 that is up
+    // to 24h later, so a genuinely-successful cycle3 looks like it never ran.
+    Promise.resolve(getCycleLastRun()).then((last) => {
+      if (last?.cycle1 > 0 && !_cycleHealth.cycle1.last_success_at) _cycleHealth.cycle1.last_success_at = last.cycle1
+      if (last?.cycle2 > 0 && !_cycleHealth.cycle2.last_success_at) _cycleHealth.cycle2.last_success_at = last.cycle2
+      if (last?.cycle3 > 0 && !_cycleHealth.cycle3.last_success_at) _cycleHealth.cycle3.last_success_at = last.cycle3
+      _writeCycleStateFile()
+    }).catch(() => {})
     _scheduleNextCheck()
     _startupTimeout = setTimeout(() => { void _runCheckCyclesGuarded() }, 30_000)
   }

package/src/runtime/memory/lib/memory-cycle2-mutations.mjs

@@ -11,6 +11,65 @@ const LLM_JUDGE_CAP = 20
 
 const TRANSIENT_PROMOTE_CATEGORIES = new Set(['task', 'issue'])
 
+// Category grades the pipeline trusts outright: user/cycle1 tagged durable
+// knowledge. These are NEVER content-scanned — a curated constraint like
+// "95% pass threshold" or a rule that cites a metric must still promote.
+const DURABLE_TRUSTED_CATEGORIES = new Set(['rule', 'constraint', 'decision', 'preference', 'goal'])
+
+// Deterministic (non-LLM) signature for transient work-state: status/review
+// churn and benchmark/measurement RESULT snapshots. Narrow on purpose — it
+// requires snapshot phrasing (a measurement verb or an explicit result-metric
+// noun), NOT a bare percentage, so SLO/threshold constraints don't trip it.
+// Applied only to non-durable categories (e.g. 'fact'), catching benchmark
+// snapshots mis-tagged as durable-ish. The gate prompt only *discourages*
+// these; this is the structural enforcement.
+const TRANSIENT_SNAPSHOT_RE = new RegExp(
+  [
+    'terminal-bench',
+    '\\bbenchmark(ed|ing|\\s+(run|result|score))\\b',
+    'pass@\\d',
+    '\\btokens?\\s?\\/\\s?s(ec)?\\b',
+    'status\\s+snapshot',
+    'review(er)?\\s+(validation\\s+)?cycles?',
+    'in[-\\s]progress',
+    '\\bWIP\\b',
+    '\\b(scored|achieved|measured|reached)\\b[^.]{0,40}\\d+(\\.\\d+)?\\s?%',
+    '\\d+(\\.\\d+)?\\s?%\\s+(pass\\s+rate|accuracy|score|throughput|latency)',
+  ].join('|'),
+  'i',
+)
+
+// Structural promotion gate: is this row transient content (task/issue chatter
+// or a status/benchmark snapshot) that must not be promoted pending→active?
+// task/issue block by category. Durable knowledge categories are trusted and
+// skip the content scan. Everything else (e.g. 'fact') is content-scanned so
+// snapshots mis-categorized as durable are still blocked.
+export function isTransientPromotion(row) {
+  if (!row) return false
+  const cat = String(row.category ?? '').toLowerCase()
+  if (TRANSIENT_PROMOTE_CATEGORIES.has(cat)) return true
+  if (DURABLE_TRUSTED_CATEGORIES.has(cat)) return false
+  return TRANSIENT_SNAPSHOT_RE.test(`${row.element ?? ''} ${row.summary ?? ''}`)
+}
+
+// Strip pending→active promotions for transient content out of the status
+// batch BEFORE the cap clamp. Blocked rows are simply dropped from the batch,
+// so they stay pending (held for re-confirmation on a later cycle) — never
+// archived here, and reviewed_at is still bumped via the caller's reviewedIds.
+export function blockTransientPromotions(statusBatch, rowsById) {
+  if (!statusBatch?.length) return { batch: statusBatch ?? [], blocked: 0 }
+  let blocked = 0
+  const batch = statusBatch.filter((item) => {
+    if (item.was_pending && item.new_status === 'active'
+        && isTransientPromotion(rowsById.get(Number(item.entry_id)))) {
+      blocked += 1
+      return false
+    }
+    return true
+  })
+  return { batch, blocked }
+}
+
 // After the gate, cap how many pending→active promotions may land in one batch.
 // Overflow stays pending (not archived). Tiebreak: durable category before
 // task/issue, then score DESC, then older last_seen_at, then id ASC.

package/src/runtime/memory/lib/memory-cycle2.mjs

@@ -11,7 +11,7 @@ import { backfillCoreEmbeddings, nominateCoreCandidates, CORE_SUMMARY_MAX } from
 import { markCycleRequest, consumeCycleRequests, resolveCoalesceMaxDrains, scheduleCoalescedCycleRetry, makeCycleRequestSignature, resolveCoalesceMaxRetries } from './memory-cycle-requests.mjs'
 import { __mixdogMemoryLog, throwIfAborted } from './memory-cycle2-shared.mjs'
 import {
-  applyBatchStatusVerdicts, clampPendingPromotions, applySimpleStatus, applyUpdate, applyMerge, runPhaseMerge,
+  applyBatchStatusVerdicts, clampPendingPromotions, blockTransientPromotions, applySimpleStatus, applyUpdate, applyMerge, runPhaseMerge,
 } from './memory-cycle2-mutations.mjs'
 import {
   CYCLE2_ACTIVE_TARGET_CAP, CYCLE2_ACTIVE_MIN_FLOOR, loadCurrentRulesDigest, runUnifiedGate, sonnetCascade,
@@ -54,6 +54,7 @@ function mergeCycle2Results(a, b) {
     rejected_verb: Number(a.rejected_verb || 0) + Number(b.rejected_verb || 0),
     merge_rejected: Number(a.merge_rejected || 0) + Number(b.merge_rejected || 0),
     missing_core_summary: Number(a.missing_core_summary || 0) + Number(b.missing_core_summary || 0),
+    promotion_blocked: Number(a.promotion_blocked || 0) + Number(b.promotion_blocked || 0),
     core_embedding_backfill: Number(a.core_embedding_backfill || 0) + Number(b.core_embedding_backfill || 0),
     core_candidates_nominated: Number(a.core_candidates_nominated || 0) + Number(b.core_candidates_nominated || 0),
     rescore: mergeNestedNumeric(a.rescore, b.rescore),
@@ -211,6 +212,7 @@ async function _runCycle2Impl(db, config = {}, options = {}, dataDir = null) {
     updated: 0, kept: 0, rejected_verb: 0,
     merge_rejected: 0,
     missing_core_summary: 0,
+    promotion_blocked: 0,
     core_embedding_backfill: 0,
     core_candidates_nominated: 0,
     rescore: { updated: 0 },
@@ -523,8 +525,13 @@ async function _runCycle2Impl(db, config = {}, options = {}, dataDir = null) {
         }
         guardedBatch.push(item)
       }
+      // Structural transient block runs BEFORE the cap clamp: task/issue chatter
+      // and status/benchmark snapshots can never promote pending→active, so they
+      // are stripped here (held pending) regardless of remaining cap slots.
+      const blockRes = blockTransientPromotions(guardedBatch, rowsById)
+      stats.promotion_blocked = blockRes.blocked
       const activeCountForClamp = Math.max(0, activeCount - reservedDemotions)
-      const clampRes = clampPendingPromotions(guardedBatch, rowsById, activeCountForClamp, activeTargetCap)
+      const clampRes = clampPendingPromotions(blockRes.batch, rowsById, activeCountForClamp, activeTargetCap)
       stats.promotion_clamped = clampRes.clamped
       const batchRes = await applyBatchStatusVerdicts(db, clampRes.batch, nowMs)
       stats.promoted += batchRes.promoted
@@ -702,7 +709,7 @@ async function _runCycle2Impl(db, config = {}, options = {}, dataDir = null) {
     ` core_backfill=${stats.core_embedding_backfill}` +
     ` active=${activeCount}/${activeTargetCap} review_active=${reviewActiveRows ? 1 : 0}` +
     ` | gate promoted=${stats.promoted} archived=${stats.archived}` +
-    ` promotion_clamped=${stats.promotion_clamped}` +
+    ` promotion_clamped=${stats.promotion_clamped} promotion_blocked=${stats.promotion_blocked}` +
     ` updated=${stats.updated} kept=${stats.kept}` +
     ` rejected_verb=${stats.rejected_verb} merge_rejected=${stats.merge_rejected}` +
     ` missing_core=${stats.missing_core_summary}` +