mixdog 0.9.24 → 0.9.26

package/scripts/smoke-runtime-negative.ps1

@@ -1,106 +1,106 @@
-# smoke-runtime-negative.ps1 — Negative-path tests against released win32-x64
-# runtime tarball. Validates: download, sha256, corrupt-tarball, fresh-extract
-# boot, double-init refusal, hostile-env survival.
-#
-# Env: TAG / OS / ARCH / RUNTIME_RELEASE_REPOSITORY (default tribgames/mixdog)
-
-$ErrorActionPreference = 'Stop'
-
-$Tag         = if ($env:TAG)                { $env:TAG }  else { 'runtime-v0.4.0' }
-$Os          = if ($env:OS)                 { $env:OS }   else { 'win32' }
-$Arch        = if ($env:ARCH)               { $env:ARCH } else { 'x64' }
-$ReleaseRepo = if ($env:RUNTIME_RELEASE_REPOSITORY) { $env:RUNTIME_RELEASE_REPOSITORY } else { 'tribgames/mixdog' }
-$PgVer       = '16.4'
-$PgvectorVer = '0.8.2'
-
-$Asset = "mixdog-runtime-${Os}-${Arch}-pg${PgVer}-pgvector${PgvectorVer}.tar.gz"
-$Url   = "https://github.com/${ReleaseRepo}/releases/download/${Tag}/${Asset}"
-
-$Work = New-Item -ItemType Directory -Force -Path "$env:TEMP\smoke-$([guid]::NewGuid().ToString('N'))" | Select-Object -ExpandProperty FullName
-
-try {
-    Write-Host "==> Negative-path smoke for ${Os}-${Arch} from $Url"
-
-    Write-Host "==> Test 1: HEAD reaches release asset"
-    $resp = Invoke-WebRequest -Uri $Url -Method Head -UseBasicParsing -ErrorAction Stop
-    Write-Host "  HTTP $($resp.StatusCode)"
-
-    Write-Host "==> Test 2: full download + sha256"
-    $TarPath = Join-Path $Work $Asset
-    Invoke-WebRequest -Uri $Url -OutFile $TarPath -UseBasicParsing
-    $sha = (Get-FileHash -Algorithm SHA256 $TarPath).Hash.ToLower()
-    Write-Host "  sha256=$sha"
-
-    Write-Host "==> Test 3: corrupt tarball — flip a byte and ensure tar errors"
-    $CorruptPath = "$Work\corrupt.tar.gz"
-    Copy-Item $TarPath $CorruptPath
-    $bytes = [byte[]]::new(1); $rand = [System.Random]::new(); $rand.NextBytes($bytes)
-    $stream = [System.IO.File]::OpenWrite($CorruptPath)
-    $stream.Position = 102400
-    $stream.Write($bytes, 0, 1)
-    $stream.Close()
-    $CorruptDir = "$Work\corrupt"
-    New-Item -ItemType Directory -Force -Path $CorruptDir | Out-Null
-    $TarProc = Start-Process -FilePath tar -ArgumentList @('-xzf', $CorruptPath, '-C', $CorruptDir.Replace('\','/')) -Wait:$false -PassThru -WindowStyle Hidden
-    if (-not $TarProc.WaitForExit(15000)) {
-        Stop-Process -Id $TarProc.Id -Force -ErrorAction SilentlyContinue
-        Write-Host "  PASS: corrupted tarball extraction timed out and was stopped"
-    } elseif ($TarProc.ExitCode -eq 0) {
-        Write-Host "  WARN: corrupted tarball extracted without error (tar gzip recovery)"
-    } else {
-        Write-Host "  PASS: corrupted tarball rejected by tar (exit $($TarProc.ExitCode))"
-    }
-
-    Write-Host "==> Test 4: fresh-extract boot (extension load + distance query)"
-    $FreshDir = "$Work\fresh"
-    New-Item -ItemType Directory -Force -Path $FreshDir | Out-Null
-    & tar -xzf $TarPath -C ($FreshDir.Replace('\','/'))
-    if ($LASTEXITCODE -ne 0) { throw "fresh extract failed" }
-
-    $PgBin   = "$FreshDir\bin"
-    $Data    = "$FreshDir\pgdata"
-    $Log     = "$FreshDir\pg.log"
-    $Port    = 55897
-
-    # Hostile env: minimal PATH (System32 only), no PGROOT/PGDATA
-    $SavedPath = $env:PATH
-    $SavedPgRoot = $env:PGROOT
-    $env:PATH   = "$env:SystemRoot\System32;$env:SystemRoot"
-    $env:PGROOT = $null
-    $env:PGDATA = $null
-
-    try {
-        & "$PgBin\postgres.exe" --version
-        if ($LASTEXITCODE -ne 0) { throw "FAIL: postgres --version" }
-        & "$PgBin\initdb.exe" -D $Data --username=postgres --auth-local=trust --no-locale -E UTF8 | Out-Null
-        if ($LASTEXITCODE -ne 0) { throw "FAIL: initdb" }
-        & "$PgBin\pg_ctl.exe" -D $Data -o "-p $Port -h 127.0.0.1" -l $Log -w start
-        if ($LASTEXITCODE -ne 0) { Get-Content $Log | Select-Object -Last 30; throw "FAIL: pg_ctl start" }
-
-        try {
-            & "$PgBin\psql.exe" -h 127.0.0.1 -p $Port -U postgres -d postgres -c "CREATE EXTENSION vector;" | Out-Null
-            if ($LASTEXITCODE -ne 0) { throw "FAIL: CREATE EXTENSION" }
-            $ExtV = & "$PgBin\psql.exe" -h 127.0.0.1 -p $Port -U postgres -d postgres -tAc "SELECT extversion FROM pg_extension WHERE extname='vector';"
-            if ($ExtV.Trim() -ne $PgvectorVer) { throw "FAIL: extversion='$ExtV' expected='$PgvectorVer'" }
-            Write-Host "  PASS: fresh-extract boot + vector extension"
-        } finally {
-            & "$PgBin\pg_ctl.exe" -D $Data -m fast stop 2>$null | Out-Null
-        }
-
-        Write-Host "==> Test 5: second initdb on initialized dir refused"
-        $rc = (Start-Process -FilePath "$PgBin\initdb.exe" -ArgumentList "-D",$Data,"-U","postgres" -Wait -PassThru -NoNewWindow).ExitCode
-        if ($rc -eq 0) {
-            Write-Host "  WARN: second initdb succeeded (unexpected)"
-        } else {
-            Write-Host "  PASS: second initdb refused (exit $rc)"
-        }
-    } finally {
-        $env:PATH   = $SavedPath
-        $env:PGROOT = $SavedPgRoot
-    }
-
-    Write-Host "==> All negative-path smokes: PASS"
-}
-finally {
-    Remove-Item -Recurse -Force $Work -ErrorAction SilentlyContinue
-}
+# smoke-runtime-negative.ps1 — Negative-path tests against released win32-x64
+# runtime tarball. Validates: download, sha256, corrupt-tarball, fresh-extract
+# boot, double-init refusal, hostile-env survival.
+#
+# Env: TAG / OS / ARCH / RUNTIME_RELEASE_REPOSITORY (default tribgames/mixdog)
+
+$ErrorActionPreference = 'Stop'
+
+$Tag         = if ($env:TAG)                { $env:TAG }  else { 'runtime-v0.4.0' }
+$Os          = if ($env:OS)                 { $env:OS }   else { 'win32' }
+$Arch        = if ($env:ARCH)               { $env:ARCH } else { 'x64' }
+$ReleaseRepo = if ($env:RUNTIME_RELEASE_REPOSITORY) { $env:RUNTIME_RELEASE_REPOSITORY } else { 'tribgames/mixdog' }
+$PgVer       = '16.4'
+$PgvectorVer = '0.8.2'
+
+$Asset = "mixdog-runtime-${Os}-${Arch}-pg${PgVer}-pgvector${PgvectorVer}.tar.gz"
+$Url   = "https://github.com/${ReleaseRepo}/releases/download/${Tag}/${Asset}"
+
+$Work = New-Item -ItemType Directory -Force -Path "$env:TEMP\smoke-$([guid]::NewGuid().ToString('N'))" | Select-Object -ExpandProperty FullName
+
+try {
+    Write-Host "==> Negative-path smoke for ${Os}-${Arch} from $Url"
+
+    Write-Host "==> Test 1: HEAD reaches release asset"
+    $resp = Invoke-WebRequest -Uri $Url -Method Head -UseBasicParsing -ErrorAction Stop
+    Write-Host "  HTTP $($resp.StatusCode)"
+
+    Write-Host "==> Test 2: full download + sha256"
+    $TarPath = Join-Path $Work $Asset
+    Invoke-WebRequest -Uri $Url -OutFile $TarPath -UseBasicParsing
+    $sha = (Get-FileHash -Algorithm SHA256 $TarPath).Hash.ToLower()
+    Write-Host "  sha256=$sha"
+
+    Write-Host "==> Test 3: corrupt tarball — flip a byte and ensure tar errors"
+    $CorruptPath = "$Work\corrupt.tar.gz"
+    Copy-Item $TarPath $CorruptPath
+    $bytes = [byte[]]::new(1); $rand = [System.Random]::new(); $rand.NextBytes($bytes)
+    $stream = [System.IO.File]::OpenWrite($CorruptPath)
+    $stream.Position = 102400
+    $stream.Write($bytes, 0, 1)
+    $stream.Close()
+    $CorruptDir = "$Work\corrupt"
+    New-Item -ItemType Directory -Force -Path $CorruptDir | Out-Null
+    $TarProc = Start-Process -FilePath tar -ArgumentList @('-xzf', $CorruptPath, '-C', $CorruptDir.Replace('\','/')) -Wait:$false -PassThru -WindowStyle Hidden
+    if (-not $TarProc.WaitForExit(15000)) {
+        Stop-Process -Id $TarProc.Id -Force -ErrorAction SilentlyContinue
+        Write-Host "  PASS: corrupted tarball extraction timed out and was stopped"
+    } elseif ($TarProc.ExitCode -eq 0) {
+        Write-Host "  WARN: corrupted tarball extracted without error (tar gzip recovery)"
+    } else {
+        Write-Host "  PASS: corrupted tarball rejected by tar (exit $($TarProc.ExitCode))"
+    }
+
+    Write-Host "==> Test 4: fresh-extract boot (extension load + distance query)"
+    $FreshDir = "$Work\fresh"
+    New-Item -ItemType Directory -Force -Path $FreshDir | Out-Null
+    & tar -xzf $TarPath -C ($FreshDir.Replace('\','/'))
+    if ($LASTEXITCODE -ne 0) { throw "fresh extract failed" }
+
+    $PgBin   = "$FreshDir\bin"
+    $Data    = "$FreshDir\pgdata"
+    $Log     = "$FreshDir\pg.log"
+    $Port    = 55897
+
+    # Hostile env: minimal PATH (System32 only), no PGROOT/PGDATA
+    $SavedPath = $env:PATH
+    $SavedPgRoot = $env:PGROOT
+    $env:PATH   = "$env:SystemRoot\System32;$env:SystemRoot"
+    $env:PGROOT = $null
+    $env:PGDATA = $null
+
+    try {
+        & "$PgBin\postgres.exe" --version
+        if ($LASTEXITCODE -ne 0) { throw "FAIL: postgres --version" }
+        & "$PgBin\initdb.exe" -D $Data --username=postgres --auth-local=trust --no-locale -E UTF8 | Out-Null
+        if ($LASTEXITCODE -ne 0) { throw "FAIL: initdb" }
+        & "$PgBin\pg_ctl.exe" -D $Data -o "-p $Port -h 127.0.0.1" -l $Log -w start
+        if ($LASTEXITCODE -ne 0) { Get-Content $Log | Select-Object -Last 30; throw "FAIL: pg_ctl start" }
+
+        try {
+            & "$PgBin\psql.exe" -h 127.0.0.1 -p $Port -U postgres -d postgres -c "CREATE EXTENSION vector;" | Out-Null
+            if ($LASTEXITCODE -ne 0) { throw "FAIL: CREATE EXTENSION" }
+            $ExtV = & "$PgBin\psql.exe" -h 127.0.0.1 -p $Port -U postgres -d postgres -tAc "SELECT extversion FROM pg_extension WHERE extname='vector';"
+            if ($ExtV.Trim() -ne $PgvectorVer) { throw "FAIL: extversion='$ExtV' expected='$PgvectorVer'" }
+            Write-Host "  PASS: fresh-extract boot + vector extension"
+        } finally {
+            & "$PgBin\pg_ctl.exe" -D $Data -m fast stop 2>$null | Out-Null
+        }
+
+        Write-Host "==> Test 5: second initdb on initialized dir refused"
+        $rc = (Start-Process -FilePath "$PgBin\initdb.exe" -ArgumentList "-D",$Data,"-U","postgres" -Wait -PassThru -NoNewWindow).ExitCode
+        if ($rc -eq 0) {
+            Write-Host "  WARN: second initdb succeeded (unexpected)"
+        } else {
+            Write-Host "  PASS: second initdb refused (exit $rc)"
+        }
+    } finally {
+        $env:PATH   = $SavedPath
+        $env:PGROOT = $SavedPgRoot
+    }
+
+    Write-Host "==> All negative-path smokes: PASS"
+}
+finally {
+    Remove-Item -Recurse -Force $Work -ErrorAction SilentlyContinue
+}

package/scripts/steering-fold-provenance-test.mjs

@@ -0,0 +1,71 @@
+import test from 'node:test';
+import assert from 'node:assert/strict';
+import { foldUserTextIntoToolResultTail } from '../src/runtime/agent/orchestrator/session/context-utils.mjs';
+import { _buildRequestBodyForCacheSmoke } from '../src/runtime/agent/orchestrator/providers/anthropic-oauth.mjs';
+
+// A tool_result turn followed by a plain user text turn.
+function baseTranscript(userMeta) {
+    return [
+        { role: 'user', content: 'do the thing' },
+        { role: 'assistant', content: '', toolCalls: [{ id: 't1', name: 'read', arguments: {} }] },
+        { role: 'tool', toolCallId: 't1', content: 'file contents here' },
+        { role: 'user', content: 'actually stop and do X instead', ...(userMeta ? { meta: userMeta } : {}) },
+    ];
+}
+
+test('plain user text after tool_result is folded into the tool_result turn', () => {
+    const body = _buildRequestBodyForCacheSmoke(baseTranscript(null), 'claude-sonnet-4');
+    const msgs = body.messages;
+    const lastUser = msgs[msgs.length - 1];
+    assert.equal(lastUser.role, 'user');
+    const hasToolResult = lastUser.content.some((b) => b.type === 'tool_result');
+    assert.ok(hasToolResult, 'trailing user turn carries the tool_result');
+    assert.ok(JSON.stringify(lastUser.content).includes('do X instead'), 'plain text folded into tool_result');
+});
+
+test('steering-tagged user text after tool_result stays a separate user turn', () => {
+    const body = _buildRequestBodyForCacheSmoke(baseTranscript({ source: 'steering' }), 'claude-sonnet-4');
+    const msgs = body.messages;
+    const lastUser = msgs[msgs.length - 1];
+    assert.equal(lastUser.role, 'user', 'steering message is its own user turn');
+    const isToolResultTurn = Array.isArray(lastUser.content)
+        && lastUser.content.some((b) => b.type === 'tool_result');
+    assert.equal(isToolResultTurn, false, 'steering turn is not a tool_result turn');
+    assert.ok(JSON.stringify(lastUser.content).includes('do X instead'), 'steering text preserved as user input');
+    const prev = msgs[msgs.length - 2];
+    assert.ok(
+        Array.isArray(prev.content) && prev.content.some((b) => b.type === 'tool_result'),
+        'tool_result stays on its own preceding turn',
+    );
+});
+
+test('foldUserTextIntoToolResultTail unit: folds plain text tail', () => {
+    const result = [{ role: 'user', content: [{ type: 'tool_result', tool_use_id: 't1', content: 'r' }] }];
+    assert.equal(foldUserTextIntoToolResultTail(result, 'hi'), true);
+});
+
+// --- API-key Anthropic provider (anthropic.mjs) path ---
+import { _toAnthropicMessagesForTest } from '../src/runtime/agent/orchestrator/providers/anthropic.mjs';
+
+test('anthropic.mjs: plain user text after tool_result is folded', () => {
+    const msgs = _toAnthropicMessagesForTest(baseTranscript(null));
+    const lastUser = msgs[msgs.length - 1];
+    assert.equal(lastUser.role, 'user');
+    assert.ok(lastUser.content.some((b) => b.type === 'tool_result'), 'trailing turn carries tool_result');
+    assert.ok(JSON.stringify(lastUser.content).includes('do X instead'), 'plain text folded into tool_result');
+});
+
+test('anthropic.mjs: steering-tagged user text stays a separate user turn', () => {
+    const msgs = _toAnthropicMessagesForTest(baseTranscript({ source: 'steering' }));
+    const lastUser = msgs[msgs.length - 1];
+    assert.equal(lastUser.role, 'user', 'steering message is its own user turn');
+    const isToolResultTurn = Array.isArray(lastUser.content)
+        && lastUser.content.some((b) => b.type === 'tool_result');
+    assert.equal(isToolResultTurn, false, 'steering turn is not a tool_result turn');
+    assert.ok(JSON.stringify(lastUser.content).includes('do X instead'), 'steering text preserved as user input');
+    const prev = msgs[msgs.length - 2];
+    assert.ok(
+        Array.isArray(prev.content) && prev.content.some((b) => b.type === 'tool_result'),
+        'tool_result stays on its own preceding turn',
+    );
+});

package/scripts/tool-efficiency-diag.mjs

@@ -88,4 +88,4 @@ for (const target of ['heavy-worker', 'worker']) {
   console.log(`  single-call batches: ${batch1}/${batchTot} (${pct(batch1, batchTot)}%)`);
   console.log(`  content greps with -C/-A/-B: ${grepContentWithCtx}/${grepContent} (${pct(grepContentWithCtx, grepContent)}%)  grep->read follow-ups: ${grepThenRead}`);
   console.log(`  same-path re-reads >=3x: ${rereads}`);
-}
+}

package/scripts/webhook-smoke.mjs

@@ -1,23 +1,27 @@
 import test from 'node:test';
 import assert from 'node:assert/strict';
 import * as crypto from 'node:crypto';
-import { mkdirSync, mkdtempSync, writeFileSync } from 'node:fs';
+import { mkdtempSync } from 'node:fs';
 import { tmpdir } from 'node:os';
 import { join } from 'node:path';
 import { readMarkdownDocument } from '../src/runtime/shared/markdown-frontmatter.mjs';
 
 // DATA_DIR resolves from MIXDOG_DATA_DIR at module import time (via
 // ./config.mjs -> resolvePluginData), so the env var MUST be set before
-// the first dynamic import of webhook.mjs.
+// the first dynamic import of webhook.mjs. Endpoint defs + delivery dedup now
+// live in PG; this smoke suite deliberately exercises ONLY the pure,
+// PG-free surface (signature verify + header helpers) so it needs no live DB.
 const dataDir = mkdtempSync(join(tmpdir(), 'mixdog-webhook-test-'));
 process.env.MIXDOG_DATA_DIR = dataDir;
 
 const {
   extractSignature,
   verifySignature,
-  loadEndpointConfig,
   STRIPE_TOLERANCE_MS,
 } = await import('../src/runtime/channels/lib/webhook.mjs');
+const { extractDeliveryId, buildHeadersSummary } = await import(
+  '../src/runtime/channels/lib/webhook/deliveries.mjs'
+);
 
 function hmacHex(secret, payload) {
   return crypto.createHmac('sha256', secret).update(payload).digest('hex');
@@ -141,56 +145,45 @@ test('extractSignature: returns null when no known signature header is present',
   assert.equal(extractSignature(headers, 'github'), null);
 });
 
-// ── endpoint config loader: WEBHOOK.md frontmatter + secret side file ─
-
-test('loadEndpointConfig: loads frontmatter + reads secret from side file', () => {
-  const name = 'my-endpoint';
-  const dir = join(dataDir, 'webhooks', name);
-  mkdirSync(dir, { recursive: true });
-  writeFileSync(
-    join(dir, 'WEBHOOK.md'),
-    [
-      '---',
-      'channel: main',
-      'parser: github',
-      'enabled: true',
-      '---',
-      '',
-      'Handle this webhook by summarizing the payload.',
-      '',
-    ].join('\n'),
-    'utf8',
-  );
-  writeFileSync(join(dir, 'secret'), 'my-webhook-secret\n', 'utf8');
-
-  const cfg = loadEndpointConfig(name);
-  assert.equal(cfg.channel, 'main');
-  assert.equal(cfg.parser, 'github');
-  assert.equal(cfg.enabled, true);
-});
-
-test('loadEndpointConfig: enabled: false frontmatter casts to boolean false', () => {
-  const name = 'disabled-endpoint';
-  const dir = join(dataDir, 'webhooks', name);
-  mkdirSync(dir, { recursive: true });
-  writeFileSync(
-    join(dir, 'WEBHOOK.md'),
-    ['---', 'channel: main', 'enabled: false', '---', '', 'body text', ''].join('\n'),
-    'utf8',
-  );
-  const cfg = loadEndpointConfig(name);
-  assert.equal(cfg.enabled, false);
-});
-
-test('loadEndpointConfig: returns null for a name with no WEBHOOK.md', () => {
-  assert.equal(loadEndpointConfig('never-registered'), null);
-});
-
-// loadEndpointConfig only surfaces the frontmatter (by design — see
-// webhook.mjs comment above loadEndpointConfig); confirm the underlying
-// shared parser it delegates to also recovers the markdown body, since
-// the loader's frontmatter/body split is not independently exercised
-// through the exported loadEndpointConfig surface.
+// ── delivery-id extraction: header precedence + null fallback ─────────
+
+test('extractDeliveryId: prefers x-github-delivery over other id headers', () => {
+  const headers = { 'x-github-delivery': 'gh-1', 'x-delivery-id': 'dl-1', 'x-request-id': 'rq-1' };
+  assert.equal(extractDeliveryId(headers), 'gh-1');
+});
+
+test('extractDeliveryId: falls back to x-delivery-id then x-request-id', () => {
+  assert.equal(extractDeliveryId({ 'x-delivery-id': 'dl-1', 'x-request-id': 'rq-1' }), 'dl-1');
+  assert.equal(extractDeliveryId({ 'x-request-id': 'rq-1' }), 'rq-1');
+});
+
+test('extractDeliveryId: returns null when no id header is present', () => {
+  assert.equal(extractDeliveryId({ 'content-type': 'application/json' }), null);
+});
+
+// ── headers summary: event/delivery/content-type + signature presence ─
+
+test('buildHeadersSummary: captures event, delivery, content-type and signature presence', () => {
+  const summary = buildHeadersSummary({
+    'x-github-event': 'issues',
+    'x-github-delivery': 'gh-1',
+    'x-hub-signature-256': 'sha256=abc',
+    'content-type': 'application/json',
+  });
+  assert.equal(summary.event_type, 'issues');
+  assert.equal(summary.delivery_id, 'gh-1');
+  assert.equal(summary.signature_present, true);
+  assert.equal(summary.content_type, 'application/json');
+});
+
+test('buildHeadersSummary: signature_present is false when no signature header is present', () => {
+  const summary = buildHeadersSummary({ 'x-github-event': 'push' });
+  assert.equal(summary.signature_present, false);
+  assert.equal(summary.event_type, 'push');
+});
+
+// The webhook body/instructions still round-trip through the shared markdown
+// parser (frontmatter + body split); confirm that pure surface directly.
 test('readMarkdownDocument: WEBHOOK.md-shaped input yields frontmatter + body', () => {
   const raw = [
     '---',

package/src/defaults/cycle3-review-prompt.md

@@ -3,8 +3,10 @@
 You review user-curated CORE memory against the current project memory. Each
 entry is shown with its most-related current memory. Emit ONE verdict line per
 entry id. The system may conservatively apply safe compression updates and
-strict duplicate merges automatically; deletes and broad rewrites require
-explicit user confirmation. Extracting a lesson from a narrative is a BROAD
+strict duplicate merges automatically, and now also auto-applies deletes you
+tag as clear junk (see the delete reasons below), capped per run for safety;
+non-junk or unreasoned deletes and broad rewrites still require explicit user
+confirmation. Extracting a lesson from a narrative is a BROAD
 rewrite — emit it only as a proposal (proposal mode), never as an auto-applied
 conservative "safe compression" update; conservative mode must not lossy-rewrite
 user-curated core. The first character of your response is a digit.
@@ -64,7 +66,12 @@ or inconclusive, keep the CORE entry.
   so a CORE copy is redundant); OR is sourced from code, rules files, or skill
   docs, or is an implementation spec, constant, measurement, resolved-bug
   story, or status snapshot that fits no L1/L2/L3 layer. Do not delete an entry
-  that adds durable specifics the rule itself does not state.
+  that adds durable specifics the rule itself does not state. ALWAYS append a
+  reason tag: `<id>|delete|<reason>` where `<reason>` is one of `duplicate`,
+  `default` (restates a built-in/default rule), `restatement`, `obsolete`,
+  `implemented`, `resolved`, `stale`, `past_event`, or `log`. A bare
+  `<id>|delete` with no reason, or any reason outside that set, is treated as
+  "needs confirmation" and only removed on an explicit APPLY CYCLE3 run.
 
 A verbose durable entry is always `update`, never `keep`.
 Delete is the rarest verdict. Prefer `keep` for durable rules/preferences and
@@ -97,7 +104,7 @@ One line per entry id, any order:
 <id>|update|<element>|<summary>
 <id>|merge|<target_id>|<source_ids_csv>
 <id>|superseded|<newer_id>
-<id>|delete
+<id>|delete|<reason>
 ```
 
 `summary` ≤120 chars, one clause. No literal `|` or newline inside a field

package/src/defaults/memory-promote-prompt.md

@@ -112,6 +112,15 @@ A/B pending rows that encode lasting behavior or map anchors; transient
 When `Active > cap`, contract strictly: any active entry without a concrete
 A/B reason must archive.
 
+**Structural block (enforced, not advisory).** Pending `task`/`issue` rows and
+any row that reads as status/review churn or a benchmark/measurement result
+snapshot are blocked from promotion by the pipeline itself — an `active` verdict
+on them is dropped and the row is **held pending and re-judged on a later
+cycle** (it is neither promoted nor force-archived here). Do NOT archive such a
+row just because it cannot promote now: leave it to be re-confirmed, or promote
+the durable L2 lesson distilled from it under a durable category. Durable
+rules/preferences/constraints promote normally.
+
 If useful content is buried inside work narrative, keep only the durable L2
 behavior lesson (via `update` on an active row, or `active` for a pending row);
 archive the surrounding story.

package/src/defaults/skills/setup/SKILL.md

@@ -261,7 +261,12 @@ TUI 피커 없음 (settings-api `setSystemShell`만 존재).
 ### 스케줄 / 웹훅 ("스케줄 추가", "웹훅")
 
 1. **확인**: `/schedules` / `/webhooks` (둘 다 `/channels` 허브의 섹션 딥링크).  
-2. **변경**: 해당 피커에서 추가/편집 — 채널 모듈 설정에 저장.  
+2. **변경**: 해당 피커에서 추가/편집.  
+   - **스케줄 저장소 = PG 테이블 `scheduler.schedules`** (더 이상 `<mixdogData>/schedules/<n>/SCHEDULE.md` 파일 아님). 관리 API `saveSchedule/deleteSchedule/setScheduleEnabled/listSchedules` (`channel-admin.mjs`) → 스토어 `schedules-db.mjs`.  
+   - **필드**: 반복형은 `time`(5·6필드 cron) + 선택 `days`(cron 요일필드로 접힘: daily→`*`, weekday→`1-5`, weekend→`0,6`, `mon,wed,fri`/`1,3,5`→숫자; 못 매핑하면 에러) → `when_cron`. 1회성은 `at`(datetime) → `when_at`. `time`·`at`은 **택1**(스토어 XOR). `channel` 지정 시 `target=channel`+`channel_id`(이때 `model` 필수), 없으면 `target=session`. 본문(instructions)=`prompt`.  
+   - **레거시 마이그레이션**: 기존 `schedules/` 디렉터리는 스토어 첫 init 시 SCHEDULE.md들을 테이블로 1회 자동 임포트(같은 days→cron 접힘) 후 디렉터리를 `schedules.migrated`로 rename(삭제 안 함). 한 줄 요약 로그.  
+   - **웹훅 저장소 = PG 테이블 `webhooks.endpoints`** (더 이상 `<mixdogData>/webhooks/<n>/WEBHOOK.md` + `secret` 파일 아님). 관리 API `saveWebhook/deleteWebhook/setWebhookEnabled/listWebhooks` (`channel-admin.mjs`) → 스토어 `webhooks-db.mjs`(`upsertEndpoint/deleteEndpoint/setEndpointEnabled/listEndpoints`). 필드: `parser`(github·generic·stripe·sentry), 선택 `channel`(지정 시 `model` 필수)→`channel_id`, `secret`(미지정 시 랜덤 생성, 컬럼에 저장), 본문(instructions), `enabled`.  
+   - **웹훅 레거시 마이그레이션**: 기존 `webhooks/` 디렉터리는 스토어 첫 init 시 각 `WEBHOOK.md`+`secret`을 `upsertEndpoint`로 1회 자동 임포트 후 디렉터리를 **삭제**(rename 아님 — 사용자 선택). 부분 실패 시 디렉터리 보존·로그·다음 부팅 재시도. 옛 per-endpoint deliveries(중복제거 이력)는 임포트 안 함(리셋 허용).  
 3. **검증**: 피커 목록 반영; 스케줄은 다음 발동 시각 표시.
 
 ### 원격 세션 ("리모트 가져와")

package/src/rules/lead/02-channels.md

@@ -1,3 +1,3 @@
-# Channels
-
-- Channel features are handled by the runtime.
+# Channels
+
+- Channel features are handled by the runtime.

package/src/rules/shared/01-tool.md

@@ -1,8 +1,10 @@
 # Tool Use
 
-- Batch independent calls in one turn; serialize only when a call needs a
-  prior result. Merge equivalent variants/scopes into ONE call wherever the
-  schema accepts arrays (`pattern[]`, `path[]`, `symbols[]`, `query[]`).
+- Every turn carries ALL independent calls you can already specify — a
+  second consecutive single-lookup turn is a defect, not a style choice;
+  serialize only on real data dependency. Merge variants/scopes into ONE
+  call wherever the schema accepts arrays (`pattern[]`, `path[]`,
+  `symbols[]`, `query[]`).
 - Route by what is already known: known symbol/relation → `code_graph`;
   exact text in a known scope → `grep`; unknown location, machine-wide/
   out-of-repo whereabouts, or concept-level question → `explore` (which uses
@@ -31,4 +33,6 @@
   unit (function/section) — over-read once instead of paging the same file
   in small windows across turns; a 3rd window into one file means the first
   should have been wider.
-- Don't mix `apply_patch` with shell or other state-changing calls in one turn.
+- Don't mix `apply_patch` with shell or other state-changing calls in one
+  turn; batch independent-file patches in one turn, then verify them all in
+  ONE shell call the next.

package/src/runtime/agent/orchestrator/agent-trace-io.mjs

@@ -3,6 +3,7 @@ import { appendFile } from 'fs/promises';
 import { dirname, join } from 'path';
 import os from 'os';
 import { getPluginData } from './config.mjs';
+import { readServicePort, markServiceUnreachable, isConnRefuseError } from '../../shared/service-discovery.mjs';
 
 const WARNED_KEYS = new Set();
 
@@ -15,6 +16,10 @@ const _FLUSH_INTERVAL_MS = 5000;
 const _FLUSH_BATCH_SIZE = 500;
 let _flushTimer = null;
 let _serviceUrl = null;
+// Port of the discovery advert `_serviceUrl` was resolved from (null when it
+// came from legacy active-instance.json). Lets a flush connect-failure distrust
+// a recycled-pid corpse advert so the next resolve falls back to legacy/buffer.
+let _serviceAdvertPort = null;
 let _flushInFlight = false;
 let _localTracePath = null;
 let _localTraceBuffer = [];
@@ -197,6 +202,11 @@ try {
 function _resolveServiceUrl() {
     if (_serviceUrl) return _serviceUrl;
     try {
+        // Prefer the single-writer discovery advert (discovery/memory.json),
+        // pid-validated; fall back to legacy active-instance.json memory_port.
+        const advertPort = readServicePort('memory', { requirePid: false });
+        if (advertPort) { _serviceAdvertPort = advertPort; _serviceUrl = `http://127.0.0.1:${advertPort}`; return _serviceUrl; }
+        _serviceAdvertPort = null;
         const runtimeRoot = process.env.MIXDOG_RUNTIME_ROOT
             ? join(process.env.MIXDOG_RUNTIME_ROOT)
             : join(os.tmpdir(), 'mixdog');
@@ -245,6 +255,13 @@ async function _flush() {
             }
         } catch (err) {
             _serviceUrl = null;
+            // Discovery-first consumer with no health probe: a connect failure
+            // means the pid-validated advert points at a dead (recycled-pid)
+            // port. Distrust it (connection-level errors ONLY — a timeout is a
+            // slow-but-alive daemon, not a corpse) so the next resolve falls back
+            // to legacy/buffer instead of re-trusting the same advert.
+            if (_serviceAdvertPort && isConnRefuseError(err)) markServiceUnreachable('memory', _serviceAdvertPort);
+            _serviceAdvertPort = null;
             warnAgentOnce('agent-trace:flush-fetch', `[agent-trace] flush fetch failed (${err?.message}) — dropping batch`);
         }
         if (_buffer.length >= _FLUSH_BATCH_SIZE) {

package/src/runtime/agent/orchestrator/mcp/child-tree.mjs

@@ -9,6 +9,7 @@
 // tree (taskkill /T /F on Windows, SIGTERM->SIGKILL of every descendant on
 // POSIX). No external dependencies.
 import { spawn } from 'node:child_process';
+import { detachedSpawnOpts } from '../../../shared/spawn-flags.mjs';
 
 const isWin = process.platform === 'win32';
 
@@ -107,9 +108,8 @@ export function killStdioChildTreeFast(transport) {
     if (isWin) {
         try {
             const cp = spawn('taskkill', ['/PID', String(pid), '/T', '/F'], {
-                windowsHide: true,
-                detached: true,
                 stdio: 'ignore',
+                ...detachedSpawnOpts,
             });
             cp.unref();
         } catch { /* ignore */ }