mixdog 0.9.25 → 0.9.27

package/src/runtime/memory/lib/pg/process.mjs

@@ -290,7 +290,12 @@ export async function startPg({ runtimeDir, pgdataDir, port: preferredPort = 554
   // so we return the instant pg_isready succeeds rather than waiting on pg_ctl.
   // Only the long-lived child handle is unref'd; poll timers stay ref'd.
   async function startAndWaitReady() {
-    const child = spawn(pgctl, startArgs, { env, stdio: ['ignore', 'pipe', 'pipe'], windowsHide: true })
+    // detached on win32: give pg_ctl (and the postmaster it spawns) its own
+    // process group / console so an ancestor `taskkill /F /T` cannot enumerate
+    // it via the Node process tree. The orphaned postmaster survives and is
+    // re-adopted next boot via supervisor tryReusePgInstance (postmaster.pid).
+    const detached = process.platform === 'win32'
+    const child = spawn(pgctl, startArgs, { env, stdio: ['ignore', 'pipe', 'pipe'], windowsHide: true, detached })
     child.unref?.()
     let stdout = '', stderr = '', closed = false, exitCode = null
     child.stdout?.on('data', d => { stdout += d.toString() })
@@ -375,6 +380,19 @@ export async function stopPg({ runtimeDir, pgdataDir }) {
   }
 }
 
+// Synchronous best-effort variant for a process 'exit' hook (only sync work is
+// possible there). One bounded `pg_ctl stop -m fast`; never throws. On Windows
+// a force-kill of the daemon can orphan the postmaster mid-write, so this is
+// the last-ditch graceful attempt before the process goes away.
+export function stopPgSync({ runtimeDir, pgdataDir }) {
+  try {
+    spawnSync(pgBin(runtimeDir, 'pg_ctl'), ['stop', '-m', 'fast', '-D', pgdataDir], {
+      env: libEnv(runtimeDir), stdio: 'ignore', timeout: 8_000, windowsHide: true,
+    })
+    __mixdogMemoryLog('[pg-process] stopPgSync: pg_ctl stop -m fast issued on exit\n')
+  } catch {}
+}
+
 // ---------------------------------------------------------------------------
 // healthcheckPg
 // ---------------------------------------------------------------------------

package/src/runtime/memory/lib/pg/supervisor.mjs

@@ -28,7 +28,12 @@ import {
 }                                             from 'node:fs';
 import { join, resolve }                      from 'node:path';
 import { tmpdir }                             from 'node:os';
-import { updateJsonAtomicSync }               from '../../../shared/atomic-file.mjs';
+import {
+  discoveryPath as _pgDiscoveryPath,
+  readServiceAdvert as _readPgServiceAdvert,
+  writeServiceAdvert as _writePgServiceAdvert,
+} from '../../../shared/service-discovery.mjs';
+import { withFileLockSync } from '../../../shared/atomic-file.mjs';
 
 // ── pg-process interface (Track A) ───────────────────────────────────────────
 // Dynamic import so this module loads even before Track A's file exists.
@@ -42,6 +47,7 @@ async function _getPgProc() {
     stopPg:           mod.stopPg,
     healthcheckPg:    mod.healthcheckPg,
     reconcileConfV2:  mod.reconcileConfV2,
+    stopPgSync:       mod.stopPgSync,
   };
   return _pgProc;
 }
@@ -181,23 +187,95 @@ const _RUNTIME_ROOT = process.env.MIXDOG_RUNTIME_ROOT
   ? resolve(process.env.MIXDOG_RUNTIME_ROOT)
   : join(tmpdir(), 'mixdog');
 const _ACTIVE_FILE = join(_RUNTIME_ROOT, 'active-instance.json');
+// Single-writer PG advert. Port discovery (pg_port et al.) moved OUT of the
+// shared, lock-guarded active-instance.json into discovery/pg.json, written by
+// this supervisor via a plain atomic rename (NO .lock) so it can never be
+// starved by active-instance lock contention.
+const _PG_DISCOVERY = 'pg';
+
+// Read the PG advert, preferring the single-writer discovery file
+// (discovery/pg.json) and falling back to the legacy active-instance.json pg_*
+// fields for cross-version compat. Field names are identical in both sources.
+function _readPgAdvert() {
+  const advert = _readPgServiceAdvert(_PG_DISCOVERY);
+  if (advert && Number(advert.pg_port) > 0) return advert;
+  try {
+    const ai = JSON.parse(readFileSync(_ACTIVE_FILE, 'utf8'));
+    if (ai && Number(ai.pg_port) > 0) return ai;
+  } catch {}
+  return advert ?? null;
+}
 
-// Lock contention codes thrown by withFileLockSync when the active-instance
-// lock cannot be acquired within timeoutMs (or try-once contention).
-const _LOCK_CONTENTION_CODES = new Set(['ELOCKTIMEOUT', 'ELOCKCONTENDED']);
+// Transient write-contention codes. ELOCK* survive from the old locked path;
+// EPERM/EBUSY/EACCES cover Windows atomic-rename hiccups on the plain-rename
+// discovery write so it backs off and retries rather than dropping the advert.
+const _LOCK_CONTENTION_CODES = new Set(['ELOCKTIMEOUT', 'ELOCKCONTENDED', 'EPERM', 'EBUSY', 'EACCES']);
+
+// Is the current on-disk advert owned by a DIFFERENT, still-live supervisor?
+// A clear (pg_port → null) must never unlink a NEWER supervisor's fresh advert:
+// re-read under the lock and, if pg_owner_pid names another live process, leave
+// it. Our own pid, a dead owner, or a missing/legacy owner → safe to unlink.
+function _pgAdvertIsForeignLive(adv) {
+  const owner = Number(adv?.pg_owner_pid);
+  if (!Number.isInteger(owner) || owner <= 0) return false;
+  if (owner === process.pid) return false;
+  return isPidAlive(owner);
+}
 
 function _applyActiveInstancePatch(fields, timeoutMs) {
-  updateJsonAtomicSync(_ACTIVE_FILE, (curRaw) => {
-    // Drop stale fields (pid/startedAt) written by older server versions.
-    const { pid: _legacyPid, startedAt: _legacyStartedAt, ...cur } = curRaw ?? {};
-    // Omit null-valued fields (clean removal when pg is stopped).
-    const merged = { ...cur, updatedAt: Date.now() };
+  // pg.json is NOT single-writer: start/attach/stop paths write it across
+  // separate supervisor processes, so the unlocked read-merge-write raced and
+  // lost cross-process updates. Guard it with pg.json's OWN private lock —
+  // supervisor-only contention, so it never recreates the shared
+  // active-instance.json bottleneck (memory.json stays lock-free).
+  const file = _pgDiscoveryPath(_PG_DISCOVERY);
+  withFileLockSync(`${file}.lock`, () => {
+    const cur = _readPgServiceAdvert(_PG_DISCOVERY) ?? {};
+    // Drop stale fields (pid/startedAt/updatedAt) written by older versions.
+    const { pid: _legacyPid, startedAt: _legacyStartedAt, updatedAt: _prevUpdatedAt, ...merged } = cur;
     for (const [k, v] of Object.entries(fields)) {
       if (v == null) delete merged[k];
       else merged[k] = v;
     }
-    return merged;
-  }, { compact: true, fsyncDir: true, renameFallback: 'truncate', timeoutMs });
+    const port = Number(merged.pg_port);
+    if (!Number.isInteger(port) || port <= 0) {
+      // No live port left → drop the advert (clean pg shutdown). But a late
+      // clear from an old shutdown/recovery path must NOT delete a fresh advert
+      // a newer supervisor just published — unlink only when it is ours or a
+      // dead corpse, never another live owner's.
+      if (_pgAdvertIsForeignLive(cur)) return;
+      try { unlinkSync(file); } catch {}
+      return;
+    }
+    // Stamp our supervisor pid so a later clear can prove advert ownership.
+    merged.pg_owner_pid = process.pid;
+    _writePgServiceAdvert(_PG_DISCOVERY, merged);
+  }, { timeoutMs });
+}
+
+// Re-stamp advert ownership on REUSE without clobbering a concurrently-updated
+// advert. Unlike patchActiveInstance (which blindly overwrites pg_port/pg_pgdata
+// /pg_runtime_dir from the reuse-time snapshot — already stale by the time the
+// lock is acquired, so a restart or a different live owner that landed meanwhile
+// gets clobbered), this RE-READS under the lock and only stamps our pid when the
+// advert STILL describes the same instance we reused (same pgdata + port) and no
+// DIFFERENT live owner has since taken it. It touches only pg_owner_pid — never
+// rewriting other fields from the stale snapshot.
+function _restampReuseOwner({ pgdata, port }) {
+  const file = _pgDiscoveryPath(_PG_DISCOVERY);
+  try {
+    withFileLockSync(`${file}.lock`, () => {
+      const cur = _readPgServiceAdvert(_PG_DISCOVERY);
+      if (!cur) return;                                   // advert gone — nothing to re-stamp
+      if (Number(cur.pg_port) !== Number(port)) return;   // restarted on a new port
+      if (!cur.pg_pgdata || resolve(cur.pg_pgdata) !== resolve(pgdata)) return; // different instance
+      if (_pgAdvertIsForeignLive(cur)) return;            // a different live owner holds it
+      if (Number(cur.pg_owner_pid) === process.pid) return; // already ours
+      const { pid: _legacyPid, startedAt: _legacyStartedAt, updatedAt: _prevUpdatedAt, ...merged } = cur;
+      merged.pg_owner_pid = process.pid;                  // minimal: owner pid only (updatedAt re-stamped on write)
+      _writePgServiceAdvert(_PG_DISCOVERY, merged);
+    }, { timeoutMs: 1000 });
+  } catch { /* best-effort: lock contention → skip re-stamp (guard reverts to prior owner) */ }
 }
 
 // Single module-level background-retry slot: a delayed retry must NEVER replay
@@ -347,7 +425,7 @@ async function tryReusePgInstance({ pgdata, runtimeDir, healthcheckPg, source =
   let existingPort = null;
   let existingRtDir = runtimeDir;
   try {
-    ai = JSON.parse(readFileSync(_ACTIVE_FILE, 'utf8'));
+    ai = _readPgAdvert();
     if (ai?.pg_port && ai?.pg_pgdata && resolve(ai.pg_pgdata) === resolve(pgdata)) {
       existingPort = ai.pg_port;
       existingRtDir = ai?.pg_runtime_dir ?? runtimeDir;
@@ -359,6 +437,14 @@ async function tryReusePgInstance({ pgdata, runtimeDir, healthcheckPg, source =
       if (await healthcheckPg({ port: existingPort })) {
         __mixdogMemoryLog(`[supervisor-pg] reusing PG on port ${existingPort} (${source}:active-instance)\n`);
         _live = { port: existingPort, pgdata, runtimeDir: existingRtDir, proc: null };
+        // Re-stamp advert ownership: this process is now a live owner of the
+        // reused postmaster. Without it the advert keeps the previous (possibly
+        // dead) owner pid, and a later sync exit hook's _pgAdvertIsForeignLive
+        // guard would judge it "not foreign-live" and wrongly sync-stop a
+        // postmaster this reuser still uses. Use the revalidating re-stamp (not
+        // patchActiveInstance) so a concurrent restart/owner change is not
+        // clobbered by this reuse-time snapshot.
+        _restampReuseOwner({ pgdata, port: existingPort });
         return { host: '127.0.0.1', port: existingPort, runtimeDir: existingRtDir, pgdataDir: pgdata };
       }
     } catch {}
@@ -452,7 +538,7 @@ async function _doEnsure(dataDir) {
     let existingPort = null;
     let ai = null;
     try {
-      ai = JSON.parse(readFileSync(_ACTIVE_FILE, 'utf8'));
+      ai = _readPgAdvert();
       // Only reuse a recorded instance when it was started for THIS pgdata.
       // active-instance.json is process-global; without matching pg_pgdata a
       // healthy PG serving a different data directory would be reused, binding
@@ -536,7 +622,7 @@ export async function stopPgForShutdown() {
     // _live may be null if PG was started by another process or adapter call.
     // Attempt graceful stop via active-instance.json.
     let ai = null;
-    try { ai = JSON.parse(readFileSync(_ACTIVE_FILE, 'utf8')); } catch {}
+    try { ai = _readPgAdvert(); } catch {}
     if (!ai?.pg_port || !ai?.pg_pgdata) return;
     const pgdataDir2  = ai.pg_pgdata;
     const runtimeDir2 = ai.pg_runtime_dir;
@@ -570,3 +656,28 @@ export async function stopPgForShutdown() {
   // tolerated — readers healthcheck-verify the port before reuse.
   patchActiveInstance({ pg_port: null, pg_started_at: null, pg_pgdata: null, pg_runtime_dir: null }, { timeoutMs: 2000, syncRetries: 1 });
 }
+
+/**
+ * Synchronous last-ditch PG stop for a process 'exit' hook. Covers the paths
+ * where the async stopPgForShutdown() above never runs/completes — a Windows
+ * force-kill, or stop() hitting its exit timeout — which otherwise kill the
+ * postmaster mid-write and force WAL crash recovery on next boot. No-op once
+ * the async path has cleared _live + active-instance (its record is gone), so
+ * a graceful shutdown is never double-stopped.
+ */
+export function stopPgForShutdownSync() {
+  // Mirror the async clear's ownership guard (_pgAdvertIsForeignLive) and apply
+  // it UNCONDITIONALLY — even when _live is set. Async shutdown or a
+  // cross-process reuse may have handed this postmaster to a different, still-
+  // live owner that re-stamped pg_owner_pid; that owner will stop it itself, so
+  // the exit hook must never sync-stop it out from under them.
+  let ai = null;
+  try { ai = _readPgAdvert(); } catch {}
+  if (_pgAdvertIsForeignLive(ai)) return;
+  let runtimeDir = _live?.runtimeDir, pgdataDir = _live?.pgdata;
+  if (!runtimeDir || !pgdataDir) {
+    runtimeDir = ai?.pg_runtime_dir; pgdataDir = ai?.pg_pgdata;
+  }
+  if (!runtimeDir || !pgdataDir || !_pgProc?.stopPgSync) return;
+  try { _pgProc.stopPgSync({ runtimeDir, pgdataDir }); } catch {}
+}

package/src/runtime/memory/lib/query-handlers.mjs

@@ -23,6 +23,7 @@ import {
 import { searchRelevantHybrid } from './memory-recall-store.mjs'
 import { fetchEntriesByIdsScoped } from './memory-recall-id-patch.mjs'
 import { retrieveEntries } from './memory-retrievers.mjs'
+import { buildPromotedExclusionClauses } from './memory-recall-scope-filter.mjs'
 import { cleanMemoryText } from './memory.mjs'
 import { insertTraceEvents } from './trace-store.mjs'
 import {
@@ -661,6 +662,107 @@ export function createQueryHandlers({
       return out
     }
 
+    // period='last': session-grouped browse. Pick the N most-recently-active
+    // sessions (limit = session count, default 5; offset = session-level
+    // paging) ranked by MAX(ts) DESC, then fill each with its newest rows
+    // under a per-session row cap. Session selection and per-session fetch
+    // reuse the same projectScope / excludeStatuses filters as the generic
+    // browse below; the grouped renderer adds activity-span headers. Output
+    // size is bounded by session count x per-session row cap plus the
+    // orchestrator-level tool-output KB cap — no recall-local line budget.
+    if (temporal?.mode === 'last') {
+      const sessionCount = Number.isFinite(requestedLimit) ? limit : 5
+      const PER_SESSION_ROW_CAP = 10
+      const excludeStatuses = includeArchived ? [] : ['archived']
+      const VALID_LAST_CATS = new Set(['rule', 'constraint', 'decision', 'fact', 'goal', 'preference', 'task', 'issue'])
+      const catList = category == null
+        ? []
+        : (Array.isArray(category) ? category : [category])
+            .map((c) => String(c).trim().toLowerCase())
+            .filter((c) => VALID_LAST_CATS.has(c))
+      // 1) rank sessions by most-recent activity (MAX(ts)) over the SAME pool
+      //    the fill draws from — roots (status-filtered) + unchunked raw
+      //    leaves, member rows excluded — so a session ranked here can never
+      //    fill empty (e.g. an archived-root session whose only surviving rows
+      //    are members). projectScope + excludeStatuses + category + promoted
+      //    exclusion all match the fill filters below.
+      const selWhere = [
+        'session_id IS NOT NULL',
+        "btrim(session_id) <> ''",
+        '(is_root = 1 OR chunk_root IS NULL OR chunk_root = id)',
+      ]
+      const selParams = []
+      if (projectScope === 'common') {
+        selWhere.push('project_id IS NULL')
+      } else if (typeof projectScope === 'string' && projectScope && projectScope !== 'all') {
+        selParams.push(projectScope)
+        selWhere.push(`(project_id IS NULL OR project_id = $${selParams.length})`)
+      }
+      if (excludeStatuses.length > 0) {
+        const ph = excludeStatuses.map((s) => { selParams.push(s); return `$${selParams.length}` }).join(',')
+        selWhere.push(`(status IS NULL OR status NOT IN (${ph}))`)
+      }
+      if (catList.length > 0) {
+        const ph = catList.map((c) => { selParams.push(c); return `$${selParams.length}` }).join(',')
+        selWhere.push(`category IN (${ph})`)
+      }
+      for (const c of buildPromotedExclusionClauses()) selWhere.push(c)
+      selParams.push(sessionCount, offset)
+      // Deterministic tie-breaker: equal MAX(ts) across sessions would let the
+      // LIMIT/OFFSET window skip or duplicate a session between offset pages
+      // without a stable secondary sort.
+      const sessSql = `SELECT session_id, MAX(ts) AS last_ts
+                       FROM entries
+                       WHERE ${selWhere.join(' AND ')}
+                       GROUP BY session_id
+                       ORDER BY last_ts DESC, session_id DESC
+                       LIMIT $${selParams.length - 1} OFFSET $${selParams.length}`
+      const sessRows = (await db.query(sessSql, selParams)).rows
+      // 2) per selected session, fetch its newest rows (roots+members, sort by
+      //    date) plus the fresh raw window, capped at PER_SESSION_ROW_CAP.
+      const allRows = []
+      for (const s of sessRows) {
+        const sid = String(s?.session_id || '').trim()
+        if (!sid) continue
+        const sf = { limit: PER_SESSION_ROW_CAP, session_id: sid, projectScope, sort: 'date' }
+        if (includeMembers) sf.includeMembers = true
+        if (excludeStatuses.length > 0) sf.excludeStatuses = excludeStatuses
+        if (catList.length > 0) sf.category = catList
+        const sRows = await retrieveEntries(db, sf)
+        let merged = sRows
+        if (includeRaw) {
+          const rawRows = await readRawRowsInWindow(db, null, Date.now(), PER_SESSION_ROW_CAP, { projectScope, sessionId: sid })
+          const seenIds = new Set(sRows.map((r) => Number(r.id)))
+          for (const r of sRows) if (Array.isArray(r.members)) for (const m of r.members) seenIds.add(Number(m.id))
+          // readRawRowsInWindow carries no category filter, so a category-
+          // scoped last must gate raw rows here to match the ranking/fill
+          // category predicate (unclassified raw rows have no category and
+          // are correctly dropped when a category is requested).
+          let newRaw = rawRows.filter((r) => !seenIds.has(Number(r.id)))
+          if (catList.length > 0) {
+            newRaw = newRaw.filter((r) => catList.includes(String(r.category || '').trim().toLowerCase()))
+          }
+          // readRawRowsInWindow carries no status filter either, so an
+          // includeArchived:false browse must drop archived raw rows here to
+          // match the ranking/root-fill excludeStatuses predicate.
+          if (excludeStatuses.length > 0) {
+            newRaw = newRaw.filter((r) => {
+              const st = String(r.status || '').trim().toLowerCase()
+              return !st || !excludeStatuses.includes(st)
+            })
+          }
+          if (newRaw.length > 0) {
+            merged = [...sRows, ...newRaw]
+            merged.sort((a, b) => (Number(b.ts) || 0) - (Number(a.ts) || 0) || (Number(b.id) || 0) - (Number(a.id) || 0))
+            merged = merged.slice(0, PER_SESSION_ROW_CAP)
+          }
+        }
+        for (const r of merged) allRows.push(r)
+      }
+      const _currentSessionHint = String(args?.currentSessionId || '').trim()
+      return { text: recallCapPrefix + renderSessionGroupedLines(allRows, { currentSessionId: _currentSessionHint, recencyOrder: true, spanHeaders: true }) }
+    }
+
     const filters = { limit: limit + offset }
     if (temporal?.startMs != null) { filters.ts_from = temporal.startMs; filters.ts_to = temporal.endMs }
     filters.projectScope = projectScope

package/src/runtime/memory/lib/recall-format.mjs

@@ -157,22 +157,18 @@ export function renderEntryLines(rows, { recencyOrder = false } = {}) {
   // this global re-sort a multi-member chunk would emit oldest-first lines and
   // break a strict newest-first contract (bench: recency-today).
   const units = []
-  // Bound total emitted lines (roots x members) so a many-member recall can't
-  // inject unbounded output. Per-line content is already capped at 1000 chars;
-  // this caps the line COUNT. Narrow the query (limit/period/projectScope) for more.
-  const RECALL_LINE_CAP = 200
-  // recencyOrder collects every unit first (so the ts sort sees the full set)
-  // and caps AFTER sorting; the default path keeps the original cap-as-we-go.
-  const COLLECT_CAP = recencyOrder ? Infinity : RECALL_LINE_CAP
-  let _capped = false
-  outer:
+  // No line-count cap here: the orchestrator enforces a global tool-output KB
+  // cap (builtin.mjs tool_output_token_limit), so recall need not self-truncate.
+  // recencyOrder still collects every unit first so the ts sort sees the full
+  // set; the default path emits in row order. Per-line body is bounded by a
+  // loose 8000-char safety cap so one giant pasted-log row can't monopolize
+  // the envelope.
   for (const r of rows) {
     // Collapsed near-duplicate (search path only — set by
     // collapseNearDuplicateRows). Emit a one-line stub carrying its #id so an
     // id-lookup follow-up can still fetch the full body; never rendered for
     // id-lookup output (those rows never carry _dupStub).
     if (r && r._dupStub) {
-      if (units.length >= COLLECT_CAP) { _capped = true; break }
       units.push({ ts: Number(r.ts) || 0, text: `[${formatTs(r.ts)}] (near-duplicate of #${r._dupOf} — collapsed) #${r.id}` })
       continue
     }
@@ -182,14 +178,12 @@ export function renderEntryLines(rows, { recencyOrder = false } = {}) {
       // grouping artifact for retrieval — the caller wants the chunk
       // content (cycle1 raw), not the cycle2-compressed summary.
       for (const m of r.members) {
-        if (units.length >= COLLECT_CAP) { _capped = true; break outer }
         const mTs = formatTs(m.ts)
         const role = m.role === 'user' ? 'u' : m.role === 'assistant' ? 'a' : (m.role || '?')
-        const content = cleanMemoryText(String(m.content ?? '')).slice(0, 1000)
+        const content = cleanMemoryText(String(m.content ?? '')).slice(0, 8000)
         units.push({ ts: Number(m.ts) || 0, text: `[${mTs}] ${role}: ${content} #${m.id}` })
       }
     } else {
-      if (units.length >= COLLECT_CAP) { _capped = true; break }
       // No chunks (root not yet chunked by cycle1, or orphan leaf): emit
       // the row itself in the same shape. element/summary fall back to
       // raw content when both are absent.
@@ -205,28 +199,25 @@ export function renderEntryLines(rows, { recencyOrder = false } = {}) {
         : ''
       const body = element || summary
         ? `${element}${summary ? ' — ' + summary : ''}`
-        : cleanMemoryText(String(r.content ?? '')).slice(0, 1000)
+        : cleanMemoryText(String(r.content ?? '')).slice(0, 8000)
       // Unchunked raw leaf (cycle1 hasn't classified it yet): mark it so
       // callers can tell fresh-but-unprocessed rows from chunked memory.
       const pendingMark = (r.is_root === 0 && r.chunk_root == null) ? ' [pending]' : ''
-      units.push({ ts: Number(r.ts) || 0, text: `[${ts}] ${rolePrefix}${body.slice(0, 1000)}${pendingMark} #${r.id}` })
+      units.push({ ts: Number(r.ts) || 0, text: `[${ts}] ${rolePrefix}${body.slice(0, 8000)}${pendingMark} #${r.id}` })
     }
   }
   if (recencyOrder) {
     // Array.sort is stable in V8, so units sharing the same ts keep their
     // insertion (root/member) order; only cross-unit ts breaks are corrected.
     units.sort((a, b) => b.ts - a.ts)
-    if (units.length > RECALL_LINE_CAP) { units.length = RECALL_LINE_CAP; _capped = true }
   }
-  const lines = units.map((u) => u.text)
-  if (_capped) lines.push(`[recall truncated — showing first ${RECALL_LINE_CAP} lines; narrow the query (limit/period/projectScope) for the rest]`)
-  return lines.join('\n')
+  return units.map((u) => u.text).join('\n')
 }
 
 // Search-result de-duplication. Within a SINGLE formatted result set, hybrid
 // recall frequently returns several long rows that restate the same design in
 // slightly different words (e.g. a root summary plus a chunk that paraphrases
-// it). They each spend the ~1000-char line budget on near-identical text.
+// it). They each spend a large slice of the envelope on near-identical text.
 // Cheap heuristic (no embeddings): normalize each row's body to word tokens,
 // build 3-gram shingle sets, and measure containment overlap = |A∩B| /
 // min(|A|,|B|) against already-kept rows. Rows arrive rank/date-ordered, so the
@@ -308,6 +299,31 @@ function shortSessionLabel(sid) {
   return `…${s.slice(-16)}`
 }
 
+// Collect every ts in a session group (roots + their inline members) so the
+// span header reflects the true activity window, not just the root ts.
+function collectGroupTs(groupRows) {
+  const all = []
+  for (const r of groupRows) {
+    const t = Number(r?.ts)
+    if (Number.isFinite(t)) all.push(t)
+    if (Array.isArray(r?.members)) for (const m of r.members) {
+      const mt = Number(m?.ts)
+      if (Number.isFinite(mt)) all.push(mt)
+    }
+  }
+  return all
+}
+
+// Activity-span header suffix: `(MM-DD HH:mm ~ HH:mm, n건)`; the end keeps the
+// MM-DD prefix only when it falls on a different calendar day than the start.
+function spanHeaderSuffix(minTs, maxTs, n) {
+  const min = formatTs(minTs) // "YYYY-MM-DD HH:mm"
+  const max = formatTs(maxTs)
+  const startPart = min.slice(5) // "MM-DD HH:mm"
+  const endPart = min.slice(0, 10) === max.slice(0, 10) ? max.slice(11) : max.slice(5)
+  return `(${startPart} ~ ${endPart}, ${n}건)`
+}
+
 // Session-grouped rendering for the GLOBAL query-less browse ("what did we
 // work on recently") when the window spans multiple sessions. A flat ts-desc
 // list interleaves sessions into one indistinguishable stream and lets one
@@ -320,7 +336,7 @@ function shortSessionLabel(sid) {
 // group's lines are globally ts-desc: without it a chunk root's members (stored
 // ts-ASC) interleave with raw rows and invert the visible timeline within a
 // session (e.g. 04:33 rendered above 04:41).
-export function renderSessionGroupedLines(rows, { currentSessionId, recencyOrder = false } = {}) {
+export function renderSessionGroupedLines(rows, { currentSessionId, recencyOrder = false, spanHeaders = false } = {}) {
   if (!rows || rows.length === 0) return '(no results)'
   const groups = new Map()
   for (const r of rows) {
@@ -329,8 +345,30 @@ export function renderSessionGroupedLines(rows, { currentSessionId, recencyOrder
     if (!groups.has(key)) groups.set(key, [])
     groups.get(key).push(r)
   }
-  if (groups.size <= 1) return renderEntryLines(rows, { recencyOrder })
+  if (!spanHeaders && groups.size <= 1) return renderEntryLines(rows, { recencyOrder })
   const current = String(currentSessionId || '').trim()
+  // period='last' session-grouped browse: activity-span headers over each
+  // group's body. No line budget — the orchestrator's global tool-output KB
+  // cap bounds total size; each group's body is already row-capped by the
+  // caller.
+  if (spanHeaders) {
+    const parts = []
+    for (const [sid, groupRows] of groups) {
+      const mark = current && sid === current ? ' (current)' : ''
+      const label = sid === '(no session)' ? sid : `session ${shortSessionLabel(sid)}`
+      const tsAll = collectGroupTs(groupRows)
+      const suffix = tsAll.length
+        ? ` ${spanHeaderSuffix(Math.min(...tsAll), Math.max(...tsAll), groupRows.length)}`
+        : ` (${groupRows.length}건)`
+      parts.push(`## ${label}${mark}${suffix}`)
+      const bodyStr = renderEntryLines(groupRows, { recencyOrder })
+      const bodyLines = bodyStr === '(no results)'
+        ? []
+        : bodyStr.split('\n')
+      for (const l of bodyLines) parts.push(l)
+    }
+    return parts.join('\n')
+  }
   const parts = []
   for (const [sid, groupRows] of groups) {
     const mark = current && sid === current ? ' (current)' : ''

package/src/runtime/memory/lib/session-ingest-runtime.mjs

@@ -371,17 +371,31 @@ export function createSessionIngestRuntime({
     //     cap). Serialized on _rawEmbedFlushChain so bursts don't stack full
     //     backlog scans; the ~60s tick still sweeps whatever this misses.
     if (insertedIds.length > 0) {
-      const run = flushRawEmbeddings(db, { limit: 200, ids: insertedIds })
+      const runOwnFlush = () => flushRawEmbeddings(db, { limit: 200, ids: insertedIds })
         .then((r) => {
           if (r.attempted > 0) log(`[embed] post-ingest raw flush (own) attempted=${r.attempted} embedded=${r.embedded}\n`)
           return r
         })
         .catch((err) => log(`[embed] post-ingest raw flush failed: ${err?.message || err}\n`))
-      let timer
-      await Promise.race([
-        run,
-        new Promise((resolve) => { timer = setTimeout(resolve, INGEST_EMBED_WAIT_MS) }),
-      ]).finally(() => clearTimeout(timer))
+      // Clear/manual-compact path opts out (embedWait:false): those rows are
+      // about to be summarized away, so dense-search immediacy is pointless and
+      // the bounded wait would only delay compaction. Enqueue the flush onto
+      // _rawEmbedFlushChain (append, don't await) so clear-path ingest bursts
+      // stay serialized like the backlog sweep — never running concurrent raw
+      // flushes. All other callers keep the awaited (bounded) wait so a
+      // following recall sees the rows.
+      if (args.embedWait === false) {
+        _rawEmbedFlushChain = _rawEmbedFlushChain
+          .catch(() => {})
+          .then(runOwnFlush)
+          .catch(() => {})
+      } else {
+        let timer
+        await Promise.race([
+          runOwnFlush(),
+          new Promise((resolve) => { timer = setTimeout(resolve, INGEST_EMBED_WAIT_MS) }),
+        ]).finally(() => clearTimeout(timer))
+      }
     }
     // Background backlog sweep — kicked, never awaited. Runs even when THIS
     // call inserted 0 rows, so pre-existing backlog is not left waiting for

package/src/runtime/memory/tool-defs.mjs

@@ -15,8 +15,8 @@ export const TOOL_DEFS = [
         action: { type: 'string', enum: ['core','status'], description: 'Operation.' },
         op: { type: 'string', enum: ['add','edit','delete','list','candidates','promote','dismiss'], description: 'Mutation op. candidates/promote/dismiss drive core-memory proposal approval.' },
         id: { type: 'number', description: 'Exact memory id.' },
-        element: { type: 'string', description: 'Memory key/title.' },
-        summary: { type: 'string', description: 'Memory content.' },
+        element: { type: 'string', description: 'Memory key/title. Max 40 chars.' },
+        summary: { type: 'string', description: 'Memory content: 1 fact, 1-2 sentences, max 100 chars.' },
         category: { type: 'string', enum: ['rule','constraint','decision','fact','goal','preference','task','issue'], description: 'Category.' },
         status: { type: 'string', enum: ['pending','active','archived'], description: 'Lifecycle status.' },
         limit: { type: 'number', description: 'Max rows/items.' },
@@ -36,7 +36,7 @@ export const TOOL_DEFS = [
       properties: {
         query: { anyOf: [{ type: 'string' }, { type: 'array', items: { type: 'string' }, minItems: 1 }], description: 'Search text, or array for independent fan-out queries.' },
         id: { anyOf: [{ type: 'number' }, { type: 'array', items: { type: 'number' }, minItems: 1 }], description: 'Exact #id(s) from recall. Do not invent ids.' },
-        period: { type: 'string', description: "last (all history newest-first), Nm/Nh/Nd (rolling), today/yesterday/this_week/last_week, all, YYYY-MM-DD, YYYY-MM-DD~YYYY-MM-DD, HH:MM~HH:MM (today), or 'YYYY-MM-DD HH:MM~HH:MM'." },
+        period: { type: 'string', description: "last (recent sessions grouped, newest-active first; limit=session count [default 5], offset=session paging), Nm/Nh/Nd (rolling), today/yesterday/this_week/last_week, all, YYYY-MM-DD, YYYY-MM-DD~YYYY-MM-DD, HH:MM~HH:MM (today), or 'YYYY-MM-DD HH:MM~HH:MM'." },
         limit: { type: 'number', description: 'Max entries.' },
         offset: { type: 'number', description: 'Skip entries.' },
         sort: { type: 'string', enum: ['importance', 'date'], description: 'importance or date.' },

package/src/runtime/shared/child-guardian.mjs

@@ -1,6 +1,7 @@
 'use strict';
 
 import { spawn, spawnSync } from 'node:child_process';
+import { detachedSpawnOpts } from './spawn-flags.mjs';
 
 function positiveInt(value) {
   const n = Number(value);
@@ -141,14 +142,13 @@ export function startChildGuardian({
         forceGraceMs: Math.max(100, Math.floor(Number(forceGraceMs) || Number(graceMs) || 3000)),
       }),
     ], {
-      detached: true,
       stdio: 'ignore',
-      windowsHide: true,
       env: {
         PATH: process.env.PATH || '',
         SystemRoot: process.env.SystemRoot || process.env.WINDIR || '',
         WINDIR: process.env.WINDIR || process.env.SystemRoot || '',
       },
+      ...detachedSpawnOpts,
     });
     guardian.unref?.();
     return { pid: guardian.pid || null, label, childPid: child };

package/src/runtime/shared/open-url.mjs

@@ -1,5 +1,6 @@
 import { spawn } from 'child_process';
 import { isWSL } from './wsl.mjs';
+import { detachedSpawnOpts } from './spawn-flags.mjs';
 
 /**
  * Open a URL in the user's default browser. Best-effort and non-blocking.
@@ -29,7 +30,7 @@ function tryOpenCandidates(candidates, index) {
   if (index >= candidates.length) return;
   const [cmd, args] = candidates[index];
   try {
-    const child = spawn(cmd, args, { stdio: 'ignore', detached: true, windowsHide: true });
+    const child = spawn(cmd, args, { stdio: 'ignore', ...detachedSpawnOpts });
     child.on('error', () => { tryOpenCandidates(candidates, index + 1); });
     child.unref();
   } catch {