talon-agent 5.26.1 → 5.26.3

package/src/frontend/presentation/model-commands.ts

@@ -32,7 +32,6 @@ import {
   resolveChatBackend,
 } from "../../core/engine/backend-controller/index.js";
 import { resetSession } from "../../storage/sessions.js";
-import { clearHistory } from "../../storage/history.js";
 import { resetPulseCheckpoint } from "../../core/background/pulse/pulse.js";
 import { logWarn } from "../../util/log.js";
 import {
@@ -240,18 +239,18 @@ export function matchBackendArg(
 
 /**
  * Drop the session state a backend switch invalidates. Session ids are
- * not portable across backends; each backend's remembered model pick IS
- * kept, so switching back restores it. `keepHistory` is for frontends
- * whose local history store is the only record of the chat.
+ * not portable across backends (the replaced id is archived by
+ * resetSession); each backend's remembered model pick IS kept, so
+ * switching back restores it. Chat history is never touched: a switch
+ * changes who answers, not what was said, and the new backend reads the
+ * same stored conversation through its history tools.
  */
 function handOffChatSession(
   chatId: string,
   previous: Backend | null,
   deps: ModelCommandDeps,
-  keepHistory: boolean,
 ): void {
-  resetSession(chatId);
-  if (!keepHistory) clearHistory(chatId);
+  resetSession(chatId, "backend-switch");
   resetPulseCheckpoint(chatId);
   previous?.sessions?.resetChat?.(chatId);
   const next = resolveChatBackend(chatId, deps.gateway?.backend ?? null);
@@ -290,7 +289,6 @@ export async function switchChatBackend(
   chatId: string,
   target: { id: string; label: string },
   deps: ModelCommandDeps,
-  opts: { keepHistory?: boolean } = {},
 ): Promise<CommandOutcome> {
   const { backend: previous, backendId: previousId } = resolveChatBackendPair(
     chatId,
@@ -311,7 +309,7 @@ export async function switchChatBackend(
     };
   }
   setChatBackend(chatId, target.id);
-  handOffChatSession(chatId, previous, deps, opts.keepHistory === true);
+  handOffChatSession(chatId, previous, deps);
   return {
     ok: true,
     text: `Backend: ${target.label} (${await describeModelAfterSwitch(chatId, target.id, deps)}). Session started fresh.`,
@@ -322,12 +320,11 @@ export async function switchChatBackend(
 export async function resetChatBackend(
   chatId: string,
   deps: ModelCommandDeps,
-  opts: { keepHistory?: boolean } = {},
 ): Promise<CommandOutcome> {
   const { backend: previous } = resolveChatBackendPair(chatId, deps);
   await releaseChat(chatId);
   setChatBackend(chatId, undefined);
-  handOffChatSession(chatId, previous, deps, opts.keepHistory === true);
+  handOffChatSession(chatId, previous, deps);
   const { backendId } = resolveChatBackendPair(chatId, deps);
   return {
     ok: true,

package/src/frontend/presentation/session-status.ts

@@ -12,7 +12,7 @@ import {
   getSessionInfo,
   getActiveSessionCount,
 } from "../../storage/sessions.js";
-import { clearHistory } from "../../storage/history.js";
+import { markContextCleared } from "../../storage/history.js";
 import { getChatSettings } from "../../storage/chat-settings.js";
 import { resetPulseCheckpoint } from "../../core/background/pulse/pulse.js";
 import { isPulseEnabled } from "../../core/background/pulse/pulse.js";
@@ -37,16 +37,16 @@ import { formatDuration } from "./format.js";
 import { talonVersionLabel } from "../../util/version.js";
 
 /**
- * Clear a chat's session state everywhere it lives: Talon's session +
- * history stores, the pulse checkpoint, and any in-process backend memory
- * (e.g. openai-agents' MemorySession — stateless backends ignore this).
- * Ends by warming the new session so the next turn (and /status) doesn't
- * pay cold-start latency.
+ * Clear a chat's session state everywhere it lives: Talon's session store
+ * (the replaced backend session id is archived), the chat's context (a
+ * soft reset — see below), the pulse checkpoint, and any in-process
+ * backend memory (e.g. openai-agents' MemorySession — stateless backends
+ * ignore this). Ends by warming the new session so the next turn (and
+ * /status) doesn't pay cold-start latency.
  */
 export async function performSessionReset(
   chatId: string,
   backend: Backend | null | undefined,
-  opts: { keepHistory?: boolean } = {},
 ): Promise<void> {
   const info = getSessionInfo(chatId);
   if (info.turns > 0) {
@@ -62,12 +62,11 @@ export async function performSessionReset(
     );
   }
   resetSession(chatId);
-  // Frontends whose platform keeps the real chat record (Telegram,
-  // Discord) clear the local mirror too — the platform still has
-  // everything. WhatsApp passes keepHistory: the local store is the ONLY
-  // record there, and wiping it on /reset would destroy exactly what the
-  // continuity tools (read/search_chat_history) exist to recover.
-  if (!opts.keepHistory) clearHistory(chatId);
+  // Soft reset, on every frontend: the bot's context starts fresh after
+  // this point, but no history row is deleted — the old conversation stays
+  // searchable (search_history labels it) and recoverable. Hard-deleting
+  // here once wiped weeks of history; only `talon history purge` deletes.
+  markContextCleared(chatId);
   resetPulseCheckpoint(chatId);
   backend?.sessions?.resetChat?.(chatId);
   await backend?.sessions?.warmSession?.(chatId);

package/src/frontend/presentation/text-commands.ts

@@ -161,13 +161,12 @@ function renderStatus(s: SessionStatusData): string {
 // ── Replies ─────────────────────────────────────────────────────────────────
 
 /**
- * How a frontend changes backend. By default the shared switch runs, with
- * `keepHistory` deciding whether the local chat log survives it; a
- * frontend that owns more per-chat state than the shared stores (the
- * native bridge's turn meta and cached readouts) supplies its own.
+ * How a frontend changes backend. By default the shared switch runs (it
+ * never touches chat history); a frontend that owns more per-chat state
+ * than the shared stores (the native bridge's cached readouts) supplies
+ * its own.
  */
 export type BackendSwitchHooks = {
-  keepHistory?: boolean;
   switchBackend?: (target: { id: string; label: string }) => Promise<string>;
   resetBackend?: () => Promise<string>;
 };
@@ -181,10 +180,9 @@ export async function modelCommandReply(
 ): Promise<string> {
   if (!arg) return renderModelOverview(await describeChatModels(chatId, deps));
   const lower = arg.toLowerCase();
-  const keepHistory = hooks.keepHistory === true;
   if (lower === "backend default" || lower === "backend reset") {
     if (hooks.resetBackend) return hooks.resetBackend();
-    return (await resetChatBackend(chatId, deps, { keepHistory })).text;
+    return (await resetChatBackend(chatId, deps)).text;
   }
   if (lower === "reset" || lower === "default") {
     return (await resetChatModel(chatId, deps)).text;
@@ -192,8 +190,7 @@ export async function modelCommandReply(
   const backend = matchBackendArg(arg, deps.config);
   if (backend) {
     if (hooks.switchBackend) return hooks.switchBackend(backend);
-    return (await switchChatBackend(chatId, backend, deps, { keepHistory }))
-      .text;
+    return (await switchChatBackend(chatId, backend, deps)).text;
   }
   return (await selectChatModel(chatId, arg, deps)).text;
 }

package/src/frontend/telegram/admin/sessions.ts

@@ -100,7 +100,8 @@ export type AdminGateway = { backend: Backend | null };
 
 /**
  * `/admin kill <chatId>` — the same reset /reset performs in that chat:
- * session + history stores, pulse checkpoint, and the backend's own
+ * session store, a soft context reset (history rows are kept), pulse
+ * checkpoint, and the backend's own
  * per-chat session (resolved through the chat's backend override).
  */
 export async function killSession(

package/src/frontend/telegram/callbacks/model/backend.ts

@@ -7,7 +7,6 @@
 import type { Context } from "grammy";
 import { setChatBackend } from "../../../../storage/chat-settings.js";
 import { resetSession } from "../../../../storage/sessions.js";
-import { clearHistory } from "../../../../storage/history.js";
 import {
   getBackendIdForChat,
   listAvailableBackends,
@@ -96,9 +95,9 @@ export async function handleBackendSelect(
   // NOT clear `modelByBackend` — keeping each backend's prior
   // pick means switching back-and-forth restores each side's
   // last choice automatically (Codex chat keeps gpt-5.5,
-  // OpenRouter chat keeps owl-alpha, etc).
-  resetSession(cid);
-  clearHistory(cid);
+  // OpenRouter chat keeps owl-alpha, etc). Chat history is never
+  // touched: a switch changes who answers, not what was said.
+  resetSession(cid, "backend-switch");
   resetPulseCheckpoint(cid);
   handOffBackendSession(cid, previousBackend, gateway);
   const label =
@@ -134,8 +133,8 @@ export async function handleBackendDefault(
   const previousBackend = resolveBackendForChat(cid, gateway);
   await releaseChat(cid);
   setChatBackend(cid, undefined);
-  resetSession(cid);
-  clearHistory(cid);
+  // History stays — see handleBackendSelect.
+  resetSession(cid, "backend-switch");
   resetPulseCheckpoint(cid);
   handOffBackendSession(cid, previousBackend, gateway);
   // Resolve the now-default backend's model for the toast.

package/src/frontend/telegram/commands/admin.ts

@@ -11,8 +11,10 @@ import type { TalonConfig } from "../../../core/config/index.js";
 import { respawnSelf } from "../../../core/daemon/respawn.js";
 import { isStaleCommand } from "../polling/stale-command.js";
 import {
+  describeCheckpoint,
   getRepoRoot,
   runSelfUpdate,
+  wantsForce,
 } from "../../../core/update/self-update.js";
 import { forceDream } from "../../../core/background/dream/index.js";
 import { escapeHtml } from "../formatting.js";
@@ -169,7 +171,8 @@ function registerRestartCommand(bot: Bot): void {
   });
 }
 
-// /update — pull latest, reinstall, run setup, restart. Only wired
+// /update [force] — pull latest, reinstall, run setup, restart. Refused
+// when the pre-update checkpoint fails unless "force" is given. Only wired
 // up for developer builds running from a git checkout; packaged
 // binaries have no source tree (getRepoRoot() === null) so the
 // command stays absent entirely.
@@ -187,8 +190,11 @@ function registerUpdateCommand(
     if (isStaleCommand(ctx.message?.date, "/update")) return;
     const remote = config.update?.remote ?? "origin";
     const branch = config.update?.branch ?? "main";
+    const force = wantsForce(typeof ctx.match === "string" ? ctx.match : "");
     const sent = await ctx.reply(
-      `⏳ Updating from <code>${escapeHtml(remote)}/${escapeHtml(branch)}</code>…`,
+      `⏳ Updating from <code>${escapeHtml(remote)}/${escapeHtml(branch)}</code>` +
+        (force ? " (forced: a failed checkpoint will not stop it)" : "") +
+        "…",
       { parse_mode: "HTML" },
     );
     const edit = (text: string) =>
@@ -204,12 +210,24 @@ function registerUpdateCommand(
       branch,
       setup: config.update?.setup,
       repoRoot: updateRepoRoot,
+      force,
     })
       .then(async (res) => {
+        if (res.checkpointRefused) {
+          await edit(
+            `🛑 Update refused: ${escapeHtml(res.error ?? "the pre-update checkpoint failed")}\n\n` +
+              `Send <code>/update force</code> to update without a checkpoint.`,
+          );
+          return;
+        }
+        const note = res.checkpoint
+          ? `\n${escapeHtml(describeCheckpoint(res.checkpoint))}`
+          : "";
         if (!res.ok) {
           const tail = res.steps[res.steps.length - 1]?.output ?? "";
           await edit(
             `⚠️ Update failed: ${escapeHtml(res.error ?? "unknown error")}` +
+              note +
               (tail ? `\n\n<pre>${escapeHtml(tail.slice(-1500))}</pre>` : ""),
           );
           return;
@@ -221,7 +239,7 @@ function registerUpdateCommand(
           return;
         }
         await edit(
-          `✅ Updated <code>${escapeHtml(res.before ?? "?")}</code> → <code>${escapeHtml(res.after ?? "?")}</code>. ♻️ Restarting…`,
+          `✅ Updated <code>${escapeHtml(res.before ?? "?")}</code> → <code>${escapeHtml(res.after ?? "?")}</code>.${note}\n♻️ Restarting…`,
         );
         // The successor documents any provisioning changes (plugin
         // runtime upgrades, migrations) back to this chat once it's up.

package/src/frontend/whatsapp/commands.ts

@@ -106,14 +106,11 @@ async function runResetCommand(
   senderName: string,
   deps: ModelCommandDeps,
 ): Promise<string> {
-  // The local history store is WhatsApp's only chat record — a reset
-  // clears the model's session, not the conversation log.
+  // A soft reset: the conversation log is kept (it is WhatsApp's only chat
+  // record), only the bot's context starts fresh.
   await performSessionReset(
     chatId,
     resolveChatBackendPair(chatId, deps).backend,
-    {
-      keepHistory: true,
-    },
   );
   log("whatsapp", `Session reset by ${senderName}`);
   return "Session cleared.";
@@ -135,9 +132,9 @@ export async function executeWhatsAppCommand(
   }
   switch (cmd.name) {
     case "model":
-      // `/reset` keeps history on WhatsApp because the local store is the
-      // only chat record; a backend switch keeps it for the same reason.
-      return modelCommandReply(chatId, cmd.arg, deps, { keepHistory: true });
+      // A backend switch never touches history (the local store is also
+      // WhatsApp's only chat record).
+      return modelCommandReply(chatId, cmd.arg, deps);
     case "effort":
       return effortCommandReply(chatId, cmd.arg, deps);
     case "settings":

package/src/storage/backup/index.ts

@@ -22,7 +22,7 @@ import * as repo from "./repo.js";
  * handle stays inside storage/ (`db-handle-stays-in-storage`), and a
  * snapshot of the database is a storage concern with a storage API.
  */
-export { snapshotDatabase, snapshotSqliteFile } from "../db.js";
+export { databasePath, snapshotDatabase, snapshotSqliteFile } from "../db.js";
 
 export type { BackupRecord, BackupRemoteRecord } from "./repo.js";
 import type { BackupRecord, BackupRemoteRecord } from "./repo.js";

package/src/storage/chat-settings.ts

@@ -313,6 +313,19 @@ export function clearAllChatModels(chatId: string): void {
   persist(chatId);
 }
 
+/**
+ * Drop only the legacy single-slot `model` field, keeping every
+ * per-backend pick. The boot reconcile uses it: a stale legacy value must
+ * go, but the picks the chat made on other backends are still good.
+ */
+export function clearLegacyChatModel(chatId: string): void {
+  const entry = cache.get(chatId);
+  if (!entry || entry.model === undefined) return;
+  delete entry.model;
+  cleanupEmpty(chatId);
+  persist(chatId);
+}
+
 /**
  * @deprecated Prefer `setChatModelForBackend(chatId, backendId, model)`
  * which is explicit about which backend's slot is being mutated.

package/src/storage/db.ts

@@ -145,6 +145,11 @@ function defaultPath(): string {
   return process.env.TALON_DB_PATH || files.database;
 }
 
+/** Where the process-wide database lives (or will, once opened). */
+export function databasePath(): string {
+  return defaultPath();
+}
+
 /**
  * Open (or return) the process-wide database. The first call wins the
  * path; tests pass an explicit tmp path and call closeDatabase() in

package/src/storage/history.ts

@@ -13,6 +13,16 @@
  *     `includes()` scan over the tail
  *   - writes are transactional rows, not rewrite-the-file-on-flush
  *
+ * Rows are never deleted by normal operation. A /reset (or admin kill,
+ * or a native chat reset) records a per-chat context floor
+ * ({@link markContextCleared}); a native chat delete hides the chat
+ * ({@link hideChatHistory}). Readers that build the bot's context —
+ * getRecentHistory, the read_history tool, the pulse, the native
+ * transcript — start after the floor; explicit search sees every row,
+ * labelling the ones from before the reset. {@link purgeChatHistory},
+ * reached only from the operator's `talon history purge`, is the one
+ * path that deletes rows.
+ *
  * The legacy ~/.talon/data/history.json (JsonStore envelope or bare
  * pre-envelope shape) is imported once on first load, then renamed to
  * history.json.imported.
@@ -94,21 +104,133 @@ export function maxMsgIdForChatPrefix(prefix: string): number | undefined {
   return repo.maxMsgIdForPrefix(prefix);
 }
 
-export function getRecentHistory(chatId: string, limit = 50): HistoryMessage[] {
-  return repo.recent(chatId, limit);
+// ── Soft reset / soft delete ────────────────────────────────────────────────
+
+/** Reader options: `includeCleared` also returns rows from before a reset. */
+export type HistoryReadOptions = { includeCleared?: boolean };
+
+/** The chat's reset/hidden state, or undefined when it has none. */
+export function getChatHistoryState(
+  chatId: string,
+): repo.ChatHistoryState | undefined {
+  try {
+    return repo.chatState(chatId);
+  } catch (err) {
+    logError("history", `Failed to read history state chat=${chatId}`, err);
+    return undefined;
+  }
+}
+
+/** Row-id floor for context readers: 0 when the chat was never reset. */
+function contextFloor(chatId: string, opts: HistoryReadOptions = {}): number {
+  if (opts.includeCleared) return 0;
+  return getChatHistoryState(chatId)?.clearedThroughId ?? 0;
+}
+
+/**
+ * Soft reset: the chat's context starts fresh from here. Every stored row
+ * stays — searchable, recoverable — but context readers skip rows stored
+ * before this call. Replaces the old hard delete on /reset, /new and
+ * admin kill. Never throws.
+ */
+export function markContextCleared(chatId: string, at = Date.now()): void {
+  try {
+    repo.markCleared(chatId, at);
+  } catch (err) {
+    logError("history", `Failed to mark context reset chat=${chatId}`, err);
+  }
+}
+
+/**
+ * Soft delete: the user deleted this chat in a client. The rows stay (the
+ * operator can still recover or purge them); the chat is flagged hidden
+ * and its context floor moves, so it no longer restores and a chat that
+ * reappears under the same id starts fresh. Never throws.
+ */
+export function hideChatHistory(chatId: string, at = Date.now()): void {
+  try {
+    repo.markHidden(chatId, at);
+  } catch (err) {
+    logError("history", `Failed to hide chat history chat=${chatId}`, err);
+  }
+}
+
+/** True when the chat was deleted in a client (its rows are kept). */
+export function isChatHistoryHidden(chatId: string): boolean {
+  return getChatHistoryState(chatId)?.hiddenAt !== undefined;
+}
+
+/** Chats deleted in a client, newest first, with their kept row counts. */
+export function listHiddenChats(): repo.HiddenChat[] {
+  return repo.hiddenChats();
+}
+
+/**
+ * Permanently delete a chat's history rows and state. The ONLY hard delete
+ * of history: reached solely from the operator's `talon history purge`
+ * (which confirms first). Returns the number of rows deleted.
+ */
+export function purgeChatHistory(chatId: string): number {
+  const deleted = repo.purgeChat(chatId);
+  log("history", `Purged ${deleted} history row(s) for chat=${chatId}`);
+  return deleted;
+}
+
+// ── Reads ───────────────────────────────────────────────────────────────────
+
+/**
+ * The chat's current conversation: its most recent `limit` messages after
+ * the last context reset, chronological. `includeCleared` reads across it.
+ */
+export function getRecentHistory(
+  chatId: string,
+  limit = 50,
+  opts: HistoryReadOptions = {},
+): HistoryMessage[] {
+  return repo.recent(chatId, limit, contextFloor(chatId, opts));
 }
 
 /**
  * Scroll-back pagination: the `limit` messages strictly older than
  * `beforeMsgId`, chronological. Used by the bridge's /history endpoint so
  * clients can walk long histories page by page instead of one giant fetch.
+ * Stops at the context-reset floor unless `includeCleared`.
  */
 export function getHistoryBefore(
   chatId: string,
   beforeMsgId: number,
   limit = 50,
+  opts: HistoryReadOptions = {},
 ): HistoryMessage[] {
-  return repo.recentBefore(chatId, beforeMsgId, limit);
+  return repo.recentBefore(
+    chatId,
+    beforeMsgId,
+    limit,
+    contextFloor(chatId, opts),
+  );
+}
+
+/**
+ * A note for the read_history tool when the chat's context was reset: the
+ * older rows are kept, only out of the default view. Empty when there is
+ * nothing hidden behind the floor.
+ */
+function clearedNote(chatId: string): string {
+  const state = getChatHistoryState(chatId);
+  if (!state || state.clearedThroughId <= 0) return "";
+  const when = state.clearedAt
+    ? ` on ${new Date(state.clearedAt).toISOString()}`
+    : "";
+  return (
+    `[Context was reset${when}. Messages from before the reset are kept ` +
+    "but not shown here; search_history can still find them.]"
+  );
+}
+
+function withClearedNote(chatId: string, body: string, empty: string): string {
+  const note = clearedNote(chatId);
+  if (!note) return body || empty;
+  return body ? `${note}\n${body}` : `${empty}\n${note}`;
 }
 
 /** Formatted page of the messages strictly older than `beforeMsgId`. */
@@ -117,9 +239,13 @@ export function getFormattedBefore(
   beforeMsgId: number,
   limit = 30,
 ): string {
-  const messages = repo.recentBefore(chatId, beforeMsgId, limit);
-  if (messages.length === 0) return "No messages before that point.";
-  return messages.map(formatMessage).join("\n");
+  const floor = contextFloor(chatId);
+  const messages = repo.recentBefore(chatId, beforeMsgId, limit, floor);
+  const body = messages.map(formatMessage).join("\n");
+  if (floor > 0 && messages.length < limit) {
+    return withClearedNote(chatId, body, "No messages before that point.");
+  }
+  return body || "No messages before that point.";
 }
 
 /** Formatted page of the messages strictly older than a timestamp (ms). */
@@ -128,9 +254,13 @@ export function getFormattedBeforeTime(
   beforeTs: number,
   limit = 30,
 ): string {
-  const messages = repo.recentBeforeTime(chatId, beforeTs, limit);
-  if (messages.length === 0) return "No messages before that date.";
-  return messages.map(formatMessage).join("\n");
+  const floor = contextFloor(chatId);
+  const messages = repo.recentBeforeTime(chatId, beforeTs, limit, floor);
+  const body = messages.map(formatMessage).join("\n");
+  if (floor > 0 && messages.length < limit) {
+    return withClearedNote(chatId, body, "No messages before that date.");
+  }
+  return body || "No messages before that date.";
 }
 
 /**
@@ -163,10 +293,6 @@ export function setMessageFilePath(
   repo.setFilePath(chatId, msgId, filePath);
 }
 
-export function clearHistory(chatId: string): void {
-  repo.deleteChat(chatId);
-}
-
 // ── Formatted queries ───────────────────────────────────────────────────────
 
 function formatMessage(m: HistoryMessage): string {
@@ -186,10 +312,34 @@ function formatMessage(m: HistoryMessage): string {
   return `[msg:${m.msgId} ${time}] ${who}${replyTag}${mediaTag}${stickerTag}${fileTag}: ${m.text}`;
 }
 
+/**
+ * The read_history tool's default view: the conversation since the last
+ * context reset, with a note saying older rows exist when the page reaches
+ * the reset.
+ */
 export function getRecentFormatted(chatId: string, limit = 20): string {
   const messages = getRecentHistory(chatId, limit);
-  if (messages.length === 0) return "No messages in history.";
-  return messages.map(formatMessage).join("\n");
+  const body = messages.map(formatMessage).join("\n");
+  if (messages.length < limit) {
+    return withClearedNote(chatId, body, "No messages in history.");
+  }
+  return body || "No messages in history.";
+}
+
+/**
+ * Formatter for explicit lookups that read across a context reset (search,
+ * by-user): rows from before the reset carry a label so the reader knows
+ * they are no longer part of the current conversation. The label is by
+ * timestamp — rows have no id on the domain type — so a message stamped
+ * just before the reset but stored after it reads as older.
+ */
+function labelledFormatter(chatId: string): (m: HistoryMessage) => string {
+  const clearedAt = getChatHistoryState(chatId)?.clearedAt;
+  if (clearedAt === undefined) return formatMessage;
+  return (m) =>
+    m.timestamp <= clearedAt
+      ? `[before context reset] ${formatMessage(m)}`
+      : formatMessage(m);
 }
 
 /**
@@ -236,7 +386,7 @@ export function searchHistory(
     return `No messages matching "${query}".`;
   }
   if (messages.length === 0) return `No messages matching "${query}".`;
-  return messages.map(formatMessage).join("\n");
+  return messages.map(labelledFormatter(chatId)).join("\n");
 }
 
 export function getMessagesByUser(
@@ -247,7 +397,7 @@ export function getMessagesByUser(
   if (chatIsEmpty(chatId)) return "No messages in history.";
   const messages = repo.bySenderName(chatId, userName, limit);
   if (messages.length === 0) return `No messages from "${userName}".`;
-  return messages.map(formatMessage).join("\n");
+  return messages.map(labelledFormatter(chatId)).join("\n");
 }
 
 /** The stored row for one message, or undefined. */

package/src/storage/media-index.ts

@@ -48,15 +48,16 @@ function isMediaEntry(value: unknown): value is MediaEntry {
 
 /**
  * Run the one-time import of the legacy JSON store, then sweep
- * expired entries. Idempotent; called once at boot.
+ * expired entries (unless `purgeExpired: false` — a boot with no safety
+ * checkpoint deletes nothing). Idempotent; called once at boot.
  */
-export function loadMediaIndex(): void {
+export function loadMediaIndex(options: { purgeExpired?: boolean } = {}): void {
   try {
     importLegacyMediaIndex();
   } catch (err) {
     logError("media", "Media index load failed", err);
   }
-  purgeExpired();
+  if (options.purgeExpired !== false) purgeExpired();
 }
 
 /** Legacy shape: bare MediaEntry[]. */