talon-agent 5.26.2 → 5.26.3

package/README.md

@@ -468,6 +468,7 @@ talon kill      Abort a killable task by id
 talon events    Tail the event bus (-f follows, --history [N] reads the journal)
 talon plugin    Manage plugins (install / enable / disable / remove)
 talon skill     Manage skills (install / enable / disable / remove)
+talon history   Chat history kept by Talon (show / hidden / purge — docs/chat-history.md)
 talon config    View or edit configuration
 talon logs      Tail structured log file
 talon doctor    Validate environment and dependencies

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "talon-agent",
-  "version": "5.26.2",
+  "version": "5.26.3",
   "description": "Multi-frontend AI agent with full tool access, streaming, cron jobs, and plugin system",
   "author": "The Falconry",
   "license": "Apache-2.0",

package/src/cli/commands/history.ts

@@ -0,0 +1,152 @@
+/**
+ * `talon history` — the operator's view of chat history the daemon keeps.
+ *
+ * Talon never deletes chat history on its own: /reset is a soft reset
+ * (a context marker), backend switches leave history alone, and deleting a
+ * chat in the app only hides it. `purge` is the one way to delete rows for
+ * real — host access only (it is not reachable from any chat), and it asks
+ * for the chat id to be typed back before touching anything.
+ */
+
+import { createInterface } from "node:readline/promises";
+import pc from "picocolors";
+import {
+  getChatHistoryState,
+  getHistoryStats,
+  listHiddenChats,
+  purgeChatHistory,
+} from "../../storage/history.js";
+import { clearTurnMeta } from "../../storage/turn-meta.js";
+
+const USAGE = [
+  `  Usage: ${pc.cyan("talon history <command>")}`,
+  "",
+  "  Commands:",
+  `    ${pc.cyan("show <chatId>")}           Row count, date range, reset/hidden state`,
+  `    ${pc.cyan("hidden")}                  Chats deleted in a client (rows kept)`,
+  `    ${pc.cyan("purge <chatId> [--yes]")}  PERMANENTLY delete a chat's history`,
+  "",
+  "  Resets, backend switches and chat deletion never delete history;",
+  `  ${pc.cyan("purge")} is the only command that does. Take a checkpoint first:`,
+  `  ${pc.cyan('talon backup now --checkpoint "before purge"')}`,
+  "",
+].join("\n");
+
+/** Reads one line from stdin; injectable so tests can answer the prompt. */
+export type HistoryCliIo = {
+  ask: (question: string) => Promise<string>;
+  print: (line: string) => void;
+};
+
+const defaultIo: HistoryCliIo = {
+  ask: async (question) => {
+    const rl = createInterface({
+      input: process.stdin,
+      output: process.stdout,
+    });
+    try {
+      return await rl.question(question);
+    } finally {
+      rl.close();
+    }
+  },
+  print: (line) => console.log(line),
+};
+
+function date(ms: number | undefined): string {
+  return ms ? new Date(ms).toISOString() : "—";
+}
+
+function cmdShow(chatId: string, io: HistoryCliIo): void {
+  const stats = getHistoryStats(chatId);
+  const state = getChatHistoryState(chatId);
+  io.print(`  ${pc.bold(chatId)}`);
+  io.print(
+    `    ${stats.totalMessages} message(s), ${stats.uniqueUsers} sender(s), ` +
+      `${date(stats.oldestTimestamp || undefined)} → ${date(stats.newestTimestamp || undefined)}`,
+  );
+  if (state?.clearedAt !== undefined) {
+    io.print(`    context reset at ${date(state.clearedAt)} (rows kept)`);
+  }
+  if (state?.hiddenAt !== undefined) {
+    io.print(`    deleted in a client at ${date(state.hiddenAt)} (rows kept)`);
+  }
+  io.print("");
+}
+
+function cmdHidden(io: HistoryCliIo): void {
+  const chats = listHiddenChats();
+  if (chats.length === 0) {
+    io.print(`  ${pc.dim("No hidden chats.")}\n`);
+    return;
+  }
+  for (const chat of chats) {
+    io.print(
+      `  ${pc.bold(chat.chatId)}  ${chat.total} message(s)  ${pc.dim(`hidden ${date(chat.hiddenAt)}`)}`,
+    );
+  }
+  io.print("");
+}
+
+/**
+ * Delete a chat's history for good. Without `--yes` the operator must type
+ * the chat id back; anything else aborts. Returns rows deleted (0 when
+ * aborted or empty).
+ */
+async function cmdPurge(
+  chatId: string,
+  yes: boolean,
+  io: HistoryCliIo,
+): Promise<number> {
+  const { totalMessages } = getHistoryStats(chatId);
+  if (totalMessages === 0 && getChatHistoryState(chatId) === undefined) {
+    io.print(`  ${pc.dim(`No history stored for ${chatId}.`)}\n`);
+    return 0;
+  }
+  if (!yes) {
+    io.print(
+      `\n  This PERMANENTLY deletes ${pc.bold(String(totalMessages))} message(s) of chat ${pc.bold(chatId)}.\n` +
+        `  It cannot be undone except from a backup. Take a checkpoint first:\n` +
+        `    ${pc.cyan('talon backup now --checkpoint "before purge"')}\n`,
+    );
+    const answer = (await io.ask(`  Type the chat id to confirm: `)).trim();
+    if (answer !== chatId) {
+      io.print(`  ${pc.yellow("●")} Aborted — nothing deleted.\n`);
+      return 0;
+    }
+  }
+  const deleted = purgeChatHistory(chatId);
+  clearTurnMeta(chatId);
+  io.print(`  ${pc.green("●")} Purged ${deleted} message(s) from ${chatId}.\n`);
+  return deleted;
+}
+
+/** Route a `talon history <command>` invocation. */
+export async function runHistoryCommand(
+  args: readonly string[],
+  io: HistoryCliIo = defaultIo,
+): Promise<void> {
+  const positional = args.filter((a) => !a.startsWith("--"));
+  const yes = args.includes("--yes");
+  const chatId = positional[1];
+  try {
+    switch (positional[0]) {
+      case "show":
+        if (!chatId) io.print(`  ${pc.red("✖")} show needs a chat id\n`);
+        else cmdShow(chatId, io);
+        break;
+      case "hidden":
+        cmdHidden(io);
+        break;
+      case "purge":
+        if (!chatId) io.print(`  ${pc.red("✖")} purge needs a chat id\n`);
+        else await cmdPurge(chatId, yes, io);
+        break;
+      default:
+        io.print(USAGE);
+    }
+  } catch (err) {
+    io.print(`  ${pc.red("✖")} ${err instanceof Error ? err.message : err}`);
+    process.exitCode = 1;
+  }
+}

package/src/cli/index.ts

@@ -37,6 +37,7 @@ import { showEvents } from "./events.js";
 import { runPluginCommand } from "./plugin.js";
 import { runSkillCommand } from "./skill.js";
 import { runMemoryCommand } from "./memory.js";
+import { runHistoryCommand } from "./commands/history.js";
 import { mainMenu } from "./menu.js";
 import { runBackupCommand } from "./commands/backup.js";
 import { runMeshCommand } from "./commands/mesh.js";
@@ -62,6 +63,7 @@ const CLI_COMMANDS = [
   "plugin",
   "skill",
   "memory",
+  "history",
   "backup",
   "mesh",
 ];
@@ -109,6 +111,9 @@ function printHelp(): void {
   console.log(
     `    ${pc.cyan("memory")}     Read/edit the memory store (list/search/import/render)`,
   );
+  console.log(
+    `    ${pc.cyan("history")}    Chat history kept by Talon (show/hidden/purge)`,
+  );
   console.log(
     `    ${pc.cyan("backup")}     Snapshots and checkpoints (now/list/show/pin/restore)`,
   );
@@ -180,6 +185,7 @@ const COMMANDS: Record<string, CommandHandler> = {
   plugin: (args) => runPluginCommand(args),
   skill: (args) => runSkillCommand(args),
   memory: (args) => runMemoryCommand(args),
+  history: (args) => runHistoryCommand(args),
   "--version": () => console.log(pkg.version),
   "-v": () => console.log(pkg.version),
   "--help": () => printHelp(),

package/src/frontend/discord/admin.ts

@@ -12,7 +12,7 @@ import { tailFile } from "../../util/tail-file.js";
 import type { TalonConfig } from "../../core/config/index.js";
 import type { Gateway } from "../../core/engine/gateway.js";
 import { resetSession, getAllSessions } from "../../storage/sessions.js";
-import { clearHistory } from "../../storage/history.js";
+import { markContextCleared } from "../../storage/history.js";
 import { todayLogDate } from "../../storage/daily-log.js";
 import { getChatSettings } from "../../storage/chat-settings.js";
 import {
@@ -87,7 +87,7 @@ export async function handleAdminSubcommand(
       const target = rest[0];
       if (!target) return send("Usage: /admin kill <chatId>");
       resetSession(target);
-      clearHistory(target);
+      markContextCleared(target); // soft reset: history rows are kept
       gateway?.backend?.sessions?.resetChat?.(target);
       return send(`Session ${target} reset.`);
     }

package/src/frontend/discord/callbacks/components/backend-select.ts

@@ -20,7 +20,6 @@ import {
   rebindChat,
 } from "../../../../core/engine/backend-controller/index.js";
 import { resetSession } from "../../../../storage/sessions.js";
-import { clearHistory } from "../../../../storage/history.js";
 import { resetPulseCheckpoint } from "../../../../core/background/pulse/pulse.js";
 import { resolveActiveModelForChat } from "../../../../core/models/active-model.js";
 import { logError } from "../../../../util/log.js";
@@ -109,12 +108,13 @@ export async function handleBackendSelect(
   }
 
   // Only now is the switch known to hold. Session state doesn't port across
-  // backends, so it goes — but each backend's remembered model pick stays.
+  // backends, so it goes — but each backend's remembered model pick stays,
+  // and chat history is never touched (a switch changes who answers, not
+  // what was said).
   // A re-pick of the backend already in use clears nothing: the retry after
   // a timed-out interaction must not cost the session a second time.
   if (!alreadyThere) {
-    resetSession(chatId);
-    clearHistory(chatId);
+    resetSession(chatId, "backend-switch");
     resetPulseCheckpoint(chatId);
     previous?.sessions?.resetChat?.(chatId);
   }

package/src/frontend/native/chats/chat-lifecycle.ts

@@ -6,7 +6,6 @@
 import { toClientChat } from "./chat-wire.js";
 import type { ClientChat } from "../protocol.js";
 import type { NativeRuntime } from "../runtime.js";
-import { clearTurnMeta } from "../turn/turn-meta.js";
 
 export function createChat(runtime: NativeRuntime, title?: string): ClientChat {
   const entry = runtime.chats.create(title);
@@ -27,10 +26,14 @@ export function renameChat(
   return chat;
 }
 
+/**
+ * Soft delete (see NativeChats.remove): the chat disappears from every
+ * client, but its history rows and their turn meta are kept for the
+ * operator — `talon history purge` is the only hard delete.
+ */
 export function deleteChat(runtime: NativeRuntime, chatId: string): boolean {
   const ok = runtime.chats.remove(chatId);
   if (ok) {
-    clearTurnMeta(chatId);
     runtime.contextByChat.delete(chatId);
     runtime.queuedByChat.delete(chatId);
     runtime.broadcast({ kind: "chat_deleted", chatId });

package/src/frontend/native/chats/chats.ts

@@ -17,7 +17,11 @@ import {
   setSessionName,
   deleteSession,
 } from "../../../storage/sessions.js";
-import { getRecentHistory, clearHistory } from "../../../storage/history.js";
+import {
+  getRecentHistory,
+  hideChatHistory,
+  isChatHistoryHidden,
+} from "../../../storage/history.js";
 import { previewOf } from "../protocol.js";
 
 export type ChatEntry = {
@@ -55,6 +59,8 @@ export class NativeChats {
   restore(): void {
     for (const { chatId, info } of getAllSessions()) {
       if (!isNativeChatId(chatId)) continue;
+      // Deleted by the user: its rows are kept, the chat stays gone.
+      if (isChatHistoryHidden(chatId)) continue;
       const recent = getRecentHistory(chatId, 1);
       const entry: ChatEntry = {
         id: chatId,
@@ -133,13 +139,19 @@ export class NativeChats {
     return entry;
   }
 
+  /**
+   * Delete the chat from the app. A soft delete: the chat leaves every list
+   * and its session goes, but its history rows are only hidden, never
+   * deleted — the operator can still find them, and only an explicit
+   * `talon history purge` removes them for good.
+   */
   remove(id: string): boolean {
     const entry = this.byId.get(id);
     if (!entry) return false;
     this.byId.delete(id);
     this.byNum.delete(entry.numericId);
     deleteSession(id);
-    clearHistory(id);
+    hideChatHistory(id);
     return true;
   }
 

package/src/frontend/native/chats/empty-chat-sweep.ts

@@ -28,7 +28,10 @@ function sweepEmptyChats(runtime: NativeRuntime): void {
   for (const entry of runtime.chats.unused(EMPTY_CHAT_MIN_AGE_MS)) {
     if (isBusy(runtime, entry.id) || runtime.queuedByChat.has(entry.id))
       continue;
-    if (getRecentHistory(entry.id, 1).length > 0) continue;
+    // Any stored row at all — even from before a reset — means the chat
+    // was used; never sweep it.
+    if (getRecentHistory(entry.id, 1, { includeCleared: true }).length > 0)
+      continue;
     if (deleteChat(runtime, entry.id)) {
       log("native", `Swept empty chat ${entry.id}`);
     }

package/src/frontend/native/chats/reset.ts

@@ -1,41 +1,63 @@
 /**
- * Chat reset — drop a chat's conversation (session, history, turn meta,
- * cached readouts, pulse checkpoint) while keeping the chat itself.
+ * Chat reset and backend hand-off — what a native chat forgets when its
+ * conversation restarts. Neither path deletes chat history: a reset is a
+ * soft reset (the context floor moves, the rows stay searchable), and a
+ * backend switch leaves history and the transcript exactly as they were.
  */
 
 import { resetSession } from "../../../storage/sessions.js";
-import { clearHistory } from "../../../storage/history.js";
+import { markContextCleared } from "../../../storage/history.js";
 import { resetPulseCheckpoint } from "../../../core/background/pulse/pulse.js";
 import { getBackendForChat } from "../../../core/engine/backend-controller/index.js";
 import { broadcastChatUpdated } from "./chat-wire.js";
 import { emitSystem } from "../turn/emit.js";
 import type { NativeRuntime } from "../runtime.js";
-import { clearTurnMeta } from "../turn/turn-meta.js";
 
-/**
- * Forget everything the conversation accumulated. Shared by the explicit
- * reset and a backend switch (sessions aren't portable across backends).
- */
-export function wipeChatConversation(
+/** Drop the per-process state tied to the chat's backend session. */
+function dropSessionState(
   runtime: NativeRuntime,
   chatId: string,
+  reason: string,
 ): void {
-  resetSession(chatId);
-  clearHistory(chatId);
-  clearTurnMeta(chatId);
+  resetSession(chatId, reason);
   runtime.contextByChat.delete(chatId);
   runtime.queuedByChat.delete(chatId);
   resetPulseCheckpoint(chatId);
 }
 
+/**
+ * A backend switch: session ids aren't portable across backends, so the
+ * session goes (its id is archived by resetSession). History, turn meta
+ * and the transcript stay — a switch changes who answers, not what was
+ * said.
+ */
+export function handOffChatBackend(
+  runtime: NativeRuntime,
+  chatId: string,
+): void {
+  dropSessionState(runtime, chatId, "backend-switch");
+}
+
+/**
+ * An explicit reset: the session goes and the chat's context starts fresh
+ * (a soft reset — every history row and its turn meta is kept, searchable
+ * and recoverable; the transcript and the bot's history tools start after
+ * the reset point).
+ */
+function resetChatContext(runtime: NativeRuntime, chatId: string): void {
+  dropSessionState(runtime, chatId, "reset");
+  markContextCleared(chatId);
+}
+
 export function resetChat(runtime: NativeRuntime, chatId: string): boolean {
   const entry = runtime.chats.get(chatId);
   if (!entry) return false;
-  // Full reset, matching /reset on the other frontends: session,
-  // history (the app re-fetches its transcript from us), pulse
-  // checkpoint, and any in-process backend memory. Warm the fresh
-  // session in the background — the bridge handler is sync.
-  wipeChatConversation(runtime, chatId);
+  // Full reset, matching /reset on the other frontends: session, the
+  // chat's context (soft — the app re-fetches a transcript that starts
+  // after the reset; nothing is deleted), pulse checkpoint, and any
+  // in-process backend memory. Warm the fresh session in the background —
+  // the bridge handler is sync.
+  resetChatContext(runtime, chatId);
   let backend = null;
   try {
     backend = getBackendForChat(chatId);

package/src/frontend/native/commands/session.ts

@@ -28,7 +28,7 @@ import {
   statusCommandReply,
 } from "../../presentation/text-commands.js";
 import { broadcastChatUpdated } from "../chats/chat-wire.js";
-import { resetChat, wipeChatConversation } from "../chats/reset.js";
+import { resetChat, handOffChatBackend } from "../chats/reset.js";
 import { setBackend } from "../surface/models.js";
 import { broadcastStatus } from "../surface/status.js";
 import { interruptTurn } from "../turn/turn.js";
@@ -48,7 +48,7 @@ async function model(ctx: NativeCommandContext): Promise<void> {
     },
     resetBackend: async () => {
       const outcome = await resetChatBackend(entry.id, deps);
-      wipeChatConversation(runtime, entry.id);
+      handOffChatBackend(runtime, entry.id);
       broadcastStatus(runtime);
       return outcome.text;
     },

package/src/frontend/native/surface/models.ts

@@ -25,7 +25,7 @@ import { getActiveReasoningLevels } from "../../presentation/reasoning-levels.js
 import { broadcastChatUpdated } from "../chats/chat-wire.js";
 import { emitSystem } from "../turn/emit.js";
 import type { BackendOption, ModelOption } from "../protocol.js";
-import { wipeChatConversation } from "../chats/reset.js";
+import { handOffChatBackend } from "../chats/reset.js";
 import type { NativeRuntime } from "../runtime.js";
 import { broadcastStatus } from "./status.js";
 
@@ -182,11 +182,11 @@ export async function setBackend(
   }
 
   setChatBackend(chatId, target);
-  wipeChatConversation(runtime, chatId);
+  handOffChatBackend(runtime, chatId);
   emitSystem(
     runtime,
     entry,
-    `Switched to ${target} — starting a fresh conversation.`,
+    `Switched to ${target} — new session, chat history kept.`,
   );
   broadcastChatUpdated(runtime, entry);
   broadcastStatus(runtime);

package/src/frontend/native/turn/turn-meta.ts

@@ -9,7 +9,6 @@
 import {
   recordTurnMeta as storeRecordTurnMeta,
   getTurnMeta as storeGetTurnMeta,
-  clearTurnMeta as storeClearTurnMeta,
 } from "../../../storage/turn-meta.js";
 import type { ClientToolCall } from "../protocol.js";
 
@@ -33,8 +32,3 @@ export function recordTurnMeta(
 export function getTurnMeta(chatId: string, msgId: string): TurnMeta | null {
   return storeGetTurnMeta<TurnMeta>(chatId, msgId);
 }
-
-/** Forget a chat entirely (chat deleted / history cleared). */
-export function clearTurnMeta(chatId: string): void {
-  storeClearTurnMeta(chatId);
-}

package/src/frontend/presentation/model-commands.ts

@@ -32,7 +32,6 @@ import {
   resolveChatBackend,
 } from "../../core/engine/backend-controller/index.js";
 import { resetSession } from "../../storage/sessions.js";
-import { clearHistory } from "../../storage/history.js";
 import { resetPulseCheckpoint } from "../../core/background/pulse/pulse.js";
 import { logWarn } from "../../util/log.js";
 import {
@@ -240,18 +239,18 @@ export function matchBackendArg(
 
 /**
  * Drop the session state a backend switch invalidates. Session ids are
- * not portable across backends; each backend's remembered model pick IS
- * kept, so switching back restores it. `keepHistory` is for frontends
- * whose local history store is the only record of the chat.
+ * not portable across backends (the replaced id is archived by
+ * resetSession); each backend's remembered model pick IS kept, so
+ * switching back restores it. Chat history is never touched: a switch
+ * changes who answers, not what was said, and the new backend reads the
+ * same stored conversation through its history tools.
  */
 function handOffChatSession(
   chatId: string,
   previous: Backend | null,
   deps: ModelCommandDeps,
-  keepHistory: boolean,
 ): void {
-  resetSession(chatId);
-  if (!keepHistory) clearHistory(chatId);
+  resetSession(chatId, "backend-switch");
   resetPulseCheckpoint(chatId);
   previous?.sessions?.resetChat?.(chatId);
   const next = resolveChatBackend(chatId, deps.gateway?.backend ?? null);
@@ -290,7 +289,6 @@ export async function switchChatBackend(
   chatId: string,
   target: { id: string; label: string },
   deps: ModelCommandDeps,
-  opts: { keepHistory?: boolean } = {},
 ): Promise<CommandOutcome> {
   const { backend: previous, backendId: previousId } = resolveChatBackendPair(
     chatId,
@@ -311,7 +309,7 @@ export async function switchChatBackend(
     };
   }
   setChatBackend(chatId, target.id);
-  handOffChatSession(chatId, previous, deps, opts.keepHistory === true);
+  handOffChatSession(chatId, previous, deps);
   return {
     ok: true,
     text: `Backend: ${target.label} (${await describeModelAfterSwitch(chatId, target.id, deps)}). Session started fresh.`,
@@ -322,12 +320,11 @@ export async function switchChatBackend(
 export async function resetChatBackend(
   chatId: string,
   deps: ModelCommandDeps,
-  opts: { keepHistory?: boolean } = {},
 ): Promise<CommandOutcome> {
   const { backend: previous } = resolveChatBackendPair(chatId, deps);
   await releaseChat(chatId);
   setChatBackend(chatId, undefined);
-  handOffChatSession(chatId, previous, deps, opts.keepHistory === true);
+  handOffChatSession(chatId, previous, deps);
   const { backendId } = resolveChatBackendPair(chatId, deps);
   return {
     ok: true,

package/src/frontend/presentation/session-status.ts

@@ -12,7 +12,7 @@ import {
   getSessionInfo,
   getActiveSessionCount,
 } from "../../storage/sessions.js";
-import { clearHistory } from "../../storage/history.js";
+import { markContextCleared } from "../../storage/history.js";
 import { getChatSettings } from "../../storage/chat-settings.js";
 import { resetPulseCheckpoint } from "../../core/background/pulse/pulse.js";
 import { isPulseEnabled } from "../../core/background/pulse/pulse.js";
@@ -37,16 +37,16 @@ import { formatDuration } from "./format.js";
 import { talonVersionLabel } from "../../util/version.js";
 
 /**
- * Clear a chat's session state everywhere it lives: Talon's session +
- * history stores, the pulse checkpoint, and any in-process backend memory
- * (e.g. openai-agents' MemorySession — stateless backends ignore this).
- * Ends by warming the new session so the next turn (and /status) doesn't
- * pay cold-start latency.
+ * Clear a chat's session state everywhere it lives: Talon's session store
+ * (the replaced backend session id is archived), the chat's context (a
+ * soft reset — see below), the pulse checkpoint, and any in-process
+ * backend memory (e.g. openai-agents' MemorySession — stateless backends
+ * ignore this). Ends by warming the new session so the next turn (and
+ * /status) doesn't pay cold-start latency.
  */
 export async function performSessionReset(
   chatId: string,
   backend: Backend | null | undefined,
-  opts: { keepHistory?: boolean } = {},
 ): Promise<void> {
   const info = getSessionInfo(chatId);
   if (info.turns > 0) {
@@ -62,12 +62,11 @@ export async function performSessionReset(
     );
   }
   resetSession(chatId);
-  // Frontends whose platform keeps the real chat record (Telegram,
-  // Discord) clear the local mirror too — the platform still has
-  // everything. WhatsApp passes keepHistory: the local store is the ONLY
-  // record there, and wiping it on /reset would destroy exactly what the
-  // continuity tools (read/search_chat_history) exist to recover.
-  if (!opts.keepHistory) clearHistory(chatId);
+  // Soft reset, on every frontend: the bot's context starts fresh after
+  // this point, but no history row is deleted — the old conversation stays
+  // searchable (search_history labels it) and recoverable. Hard-deleting
+  // here once wiped weeks of history; only `talon history purge` deletes.
+  markContextCleared(chatId);
   resetPulseCheckpoint(chatId);
   backend?.sessions?.resetChat?.(chatId);
   await backend?.sessions?.warmSession?.(chatId);

package/src/frontend/presentation/text-commands.ts

@@ -161,13 +161,12 @@ function renderStatus(s: SessionStatusData): string {
 // ── Replies ─────────────────────────────────────────────────────────────────
 
 /**
- * How a frontend changes backend. By default the shared switch runs, with
- * `keepHistory` deciding whether the local chat log survives it; a
- * frontend that owns more per-chat state than the shared stores (the
- * native bridge's turn meta and cached readouts) supplies its own.
+ * How a frontend changes backend. By default the shared switch runs (it
+ * never touches chat history); a frontend that owns more per-chat state
+ * than the shared stores (the native bridge's cached readouts) supplies
+ * its own.
  */
 export type BackendSwitchHooks = {
-  keepHistory?: boolean;
   switchBackend?: (target: { id: string; label: string }) => Promise<string>;
   resetBackend?: () => Promise<string>;
 };
@@ -181,10 +180,9 @@ export async function modelCommandReply(
 ): Promise<string> {
   if (!arg) return renderModelOverview(await describeChatModels(chatId, deps));
   const lower = arg.toLowerCase();
-  const keepHistory = hooks.keepHistory === true;
   if (lower === "backend default" || lower === "backend reset") {
     if (hooks.resetBackend) return hooks.resetBackend();
-    return (await resetChatBackend(chatId, deps, { keepHistory })).text;
+    return (await resetChatBackend(chatId, deps)).text;
   }
   if (lower === "reset" || lower === "default") {
     return (await resetChatModel(chatId, deps)).text;
@@ -192,8 +190,7 @@ export async function modelCommandReply(
   const backend = matchBackendArg(arg, deps.config);
   if (backend) {
     if (hooks.switchBackend) return hooks.switchBackend(backend);
-    return (await switchChatBackend(chatId, backend, deps, { keepHistory }))
-      .text;
+    return (await switchChatBackend(chatId, backend, deps)).text;
   }
   return (await selectChatModel(chatId, arg, deps)).text;
 }

package/src/frontend/telegram/admin/sessions.ts

@@ -100,7 +100,8 @@ export type AdminGateway = { backend: Backend | null };
 
 /**
  * `/admin kill <chatId>` — the same reset /reset performs in that chat:
- * session + history stores, pulse checkpoint, and the backend's own
+ * session store, a soft context reset (history rows are kept), pulse
+ * checkpoint, and the backend's own
  * per-chat session (resolved through the chat's backend override).
  */
 export async function killSession(

package/src/frontend/telegram/callbacks/model/backend.ts

@@ -7,7 +7,6 @@
 import type { Context } from "grammy";
 import { setChatBackend } from "../../../../storage/chat-settings.js";
 import { resetSession } from "../../../../storage/sessions.js";
-import { clearHistory } from "../../../../storage/history.js";
 import {
   getBackendIdForChat,
   listAvailableBackends,
@@ -96,9 +95,9 @@ export async function handleBackendSelect(
   // NOT clear `modelByBackend` — keeping each backend's prior
   // pick means switching back-and-forth restores each side's
   // last choice automatically (Codex chat keeps gpt-5.5,
-  // OpenRouter chat keeps owl-alpha, etc).
-  resetSession(cid);
-  clearHistory(cid);
+  // OpenRouter chat keeps owl-alpha, etc). Chat history is never
+  // touched: a switch changes who answers, not what was said.
+  resetSession(cid, "backend-switch");
   resetPulseCheckpoint(cid);
   handOffBackendSession(cid, previousBackend, gateway);
   const label =
@@ -134,8 +133,8 @@ export async function handleBackendDefault(
   const previousBackend = resolveBackendForChat(cid, gateway);
   await releaseChat(cid);
   setChatBackend(cid, undefined);
-  resetSession(cid);
-  clearHistory(cid);
+  // History stays — see handleBackendSelect.
+  resetSession(cid, "backend-switch");
   resetPulseCheckpoint(cid);
   handOffBackendSession(cid, previousBackend, gateway);
   // Resolve the now-default backend's model for the toast.

package/src/frontend/whatsapp/commands.ts

@@ -106,14 +106,11 @@ async function runResetCommand(
   senderName: string,
   deps: ModelCommandDeps,
 ): Promise<string> {
-  // The local history store is WhatsApp's only chat record — a reset
-  // clears the model's session, not the conversation log.
+  // A soft reset: the conversation log is kept (it is WhatsApp's only chat
+  // record), only the bot's context starts fresh.
   await performSessionReset(
     chatId,
     resolveChatBackendPair(chatId, deps).backend,
-    {
-      keepHistory: true,
-    },
   );
   log("whatsapp", `Session reset by ${senderName}`);
   return "Session cleared.";
@@ -135,9 +132,9 @@ export async function executeWhatsAppCommand(
   }
   switch (cmd.name) {
     case "model":
-      // `/reset` keeps history on WhatsApp because the local store is the
-      // only chat record; a backend switch keeps it for the same reason.
-      return modelCommandReply(chatId, cmd.arg, deps, { keepHistory: true });
+      // A backend switch never touches history (the local store is also
+      // WhatsApp's only chat record).
+      return modelCommandReply(chatId, cmd.arg, deps);
     case "effort":
       return effortCommandReply(chatId, cmd.arg, deps);
     case "settings":

package/src/storage/history.ts

@@ -13,6 +13,16 @@
  *     `includes()` scan over the tail
  *   - writes are transactional rows, not rewrite-the-file-on-flush
  *
+ * Rows are never deleted by normal operation. A /reset (or admin kill,
+ * or a native chat reset) records a per-chat context floor
+ * ({@link markContextCleared}); a native chat delete hides the chat
+ * ({@link hideChatHistory}). Readers that build the bot's context —
+ * getRecentHistory, the read_history tool, the pulse, the native
+ * transcript — start after the floor; explicit search sees every row,
+ * labelling the ones from before the reset. {@link purgeChatHistory},
+ * reached only from the operator's `talon history purge`, is the one
+ * path that deletes rows.
+ *
  * The legacy ~/.talon/data/history.json (JsonStore envelope or bare
  * pre-envelope shape) is imported once on first load, then renamed to
  * history.json.imported.
@@ -94,21 +104,133 @@ export function maxMsgIdForChatPrefix(prefix: string): number | undefined {
   return repo.maxMsgIdForPrefix(prefix);
 }
 
-export function getRecentHistory(chatId: string, limit = 50): HistoryMessage[] {
-  return repo.recent(chatId, limit);
+// ── Soft reset / soft delete ────────────────────────────────────────────────
+
+/** Reader options: `includeCleared` also returns rows from before a reset. */
+export type HistoryReadOptions = { includeCleared?: boolean };
+
+/** The chat's reset/hidden state, or undefined when it has none. */
+export function getChatHistoryState(
+  chatId: string,
+): repo.ChatHistoryState | undefined {
+  try {
+    return repo.chatState(chatId);
+  } catch (err) {
+    logError("history", `Failed to read history state chat=${chatId}`, err);
+    return undefined;
+  }
+}
+
+/** Row-id floor for context readers: 0 when the chat was never reset. */
+function contextFloor(chatId: string, opts: HistoryReadOptions = {}): number {
+  if (opts.includeCleared) return 0;
+  return getChatHistoryState(chatId)?.clearedThroughId ?? 0;
+}
+
+/**
+ * Soft reset: the chat's context starts fresh from here. Every stored row
+ * stays — searchable, recoverable — but context readers skip rows stored
+ * before this call. Replaces the old hard delete on /reset, /new and
+ * admin kill. Never throws.
+ */
+export function markContextCleared(chatId: string, at = Date.now()): void {
+  try {
+    repo.markCleared(chatId, at);
+  } catch (err) {
+    logError("history", `Failed to mark context reset chat=${chatId}`, err);
+  }
+}
+
+/**
+ * Soft delete: the user deleted this chat in a client. The rows stay (the
+ * operator can still recover or purge them); the chat is flagged hidden
+ * and its context floor moves, so it no longer restores and a chat that
+ * reappears under the same id starts fresh. Never throws.
+ */
+export function hideChatHistory(chatId: string, at = Date.now()): void {
+  try {
+    repo.markHidden(chatId, at);
+  } catch (err) {
+    logError("history", `Failed to hide chat history chat=${chatId}`, err);
+  }
+}
+
+/** True when the chat was deleted in a client (its rows are kept). */
+export function isChatHistoryHidden(chatId: string): boolean {
+  return getChatHistoryState(chatId)?.hiddenAt !== undefined;
+}
+
+/** Chats deleted in a client, newest first, with their kept row counts. */
+export function listHiddenChats(): repo.HiddenChat[] {
+  return repo.hiddenChats();
+}
+
+/**
+ * Permanently delete a chat's history rows and state. The ONLY hard delete
+ * of history: reached solely from the operator's `talon history purge`
+ * (which confirms first). Returns the number of rows deleted.
+ */
+export function purgeChatHistory(chatId: string): number {
+  const deleted = repo.purgeChat(chatId);
+  log("history", `Purged ${deleted} history row(s) for chat=${chatId}`);
+  return deleted;
+}
+
+// ── Reads ───────────────────────────────────────────────────────────────────
+
+/**
+ * The chat's current conversation: its most recent `limit` messages after
+ * the last context reset, chronological. `includeCleared` reads across it.
+ */
+export function getRecentHistory(
+  chatId: string,
+  limit = 50,
+  opts: HistoryReadOptions = {},
+): HistoryMessage[] {
+  return repo.recent(chatId, limit, contextFloor(chatId, opts));
 }
 
 /**
  * Scroll-back pagination: the `limit` messages strictly older than
  * `beforeMsgId`, chronological. Used by the bridge's /history endpoint so
  * clients can walk long histories page by page instead of one giant fetch.
+ * Stops at the context-reset floor unless `includeCleared`.
  */
 export function getHistoryBefore(
   chatId: string,
   beforeMsgId: number,
   limit = 50,
+  opts: HistoryReadOptions = {},
 ): HistoryMessage[] {
-  return repo.recentBefore(chatId, beforeMsgId, limit);
+  return repo.recentBefore(
+    chatId,
+    beforeMsgId,
+    limit,
+    contextFloor(chatId, opts),
+  );
+}
+
+/**
+ * A note for the read_history tool when the chat's context was reset: the
+ * older rows are kept, only out of the default view. Empty when there is
+ * nothing hidden behind the floor.
+ */
+function clearedNote(chatId: string): string {
+  const state = getChatHistoryState(chatId);
+  if (!state || state.clearedThroughId <= 0) return "";
+  const when = state.clearedAt
+    ? ` on ${new Date(state.clearedAt).toISOString()}`
+    : "";
+  return (
+    `[Context was reset${when}. Messages from before the reset are kept ` +
+    "but not shown here; search_history can still find them.]"
+  );
+}
+
+function withClearedNote(chatId: string, body: string, empty: string): string {
+  const note = clearedNote(chatId);
+  if (!note) return body || empty;
+  return body ? `${note}\n${body}` : `${empty}\n${note}`;
 }
 
 /** Formatted page of the messages strictly older than `beforeMsgId`. */
@@ -117,9 +239,13 @@ export function getFormattedBefore(
   beforeMsgId: number,
   limit = 30,
 ): string {
-  const messages = repo.recentBefore(chatId, beforeMsgId, limit);
-  if (messages.length === 0) return "No messages before that point.";
-  return messages.map(formatMessage).join("\n");
+  const floor = contextFloor(chatId);
+  const messages = repo.recentBefore(chatId, beforeMsgId, limit, floor);
+  const body = messages.map(formatMessage).join("\n");
+  if (floor > 0 && messages.length < limit) {
+    return withClearedNote(chatId, body, "No messages before that point.");
+  }
+  return body || "No messages before that point.";
 }
 
 /** Formatted page of the messages strictly older than a timestamp (ms). */
@@ -128,9 +254,13 @@ export function getFormattedBeforeTime(
   beforeTs: number,
   limit = 30,
 ): string {
-  const messages = repo.recentBeforeTime(chatId, beforeTs, limit);
-  if (messages.length === 0) return "No messages before that date.";
-  return messages.map(formatMessage).join("\n");
+  const floor = contextFloor(chatId);
+  const messages = repo.recentBeforeTime(chatId, beforeTs, limit, floor);
+  const body = messages.map(formatMessage).join("\n");
+  if (floor > 0 && messages.length < limit) {
+    return withClearedNote(chatId, body, "No messages before that date.");
+  }
+  return body || "No messages before that date.";
 }
 
 /**
@@ -163,10 +293,6 @@ export function setMessageFilePath(
   repo.setFilePath(chatId, msgId, filePath);
 }
 
-export function clearHistory(chatId: string): void {
-  repo.deleteChat(chatId);
-}
-
 // ── Formatted queries ───────────────────────────────────────────────────────
 
 function formatMessage(m: HistoryMessage): string {
@@ -186,10 +312,34 @@ function formatMessage(m: HistoryMessage): string {
   return `[msg:${m.msgId} ${time}] ${who}${replyTag}${mediaTag}${stickerTag}${fileTag}: ${m.text}`;
 }
 
+/**
+ * The read_history tool's default view: the conversation since the last
+ * context reset, with a note saying older rows exist when the page reaches
+ * the reset.
+ */
 export function getRecentFormatted(chatId: string, limit = 20): string {
   const messages = getRecentHistory(chatId, limit);
-  if (messages.length === 0) return "No messages in history.";
-  return messages.map(formatMessage).join("\n");
+  const body = messages.map(formatMessage).join("\n");
+  if (messages.length < limit) {
+    return withClearedNote(chatId, body, "No messages in history.");
+  }
+  return body || "No messages in history.";
+}
+
+/**
+ * Formatter for explicit lookups that read across a context reset (search,
+ * by-user): rows from before the reset carry a label so the reader knows
+ * they are no longer part of the current conversation. The label is by
+ * timestamp — rows have no id on the domain type — so a message stamped
+ * just before the reset but stored after it reads as older.
+ */
+function labelledFormatter(chatId: string): (m: HistoryMessage) => string {
+  const clearedAt = getChatHistoryState(chatId)?.clearedAt;
+  if (clearedAt === undefined) return formatMessage;
+  return (m) =>
+    m.timestamp <= clearedAt
+      ? `[before context reset] ${formatMessage(m)}`
+      : formatMessage(m);
 }
 
 /**
@@ -236,7 +386,7 @@ export function searchHistory(
     return `No messages matching "${query}".`;
   }
   if (messages.length === 0) return `No messages matching "${query}".`;
-  return messages.map(formatMessage).join("\n");
+  return messages.map(labelledFormatter(chatId)).join("\n");
 }
 
 export function getMessagesByUser(
@@ -247,7 +397,7 @@ export function getMessagesByUser(
   if (chatIsEmpty(chatId)) return "No messages in history.";
   const messages = repo.bySenderName(chatId, userName, limit);
   if (messages.length === 0) return `No messages from "${userName}".`;
-  return messages.map(formatMessage).join("\n");
+  return messages.map(labelledFormatter(chatId)).join("\n");
 }
 
 /** The stored row for one message, or undefined. */

package/src/storage/repositories/history-repo.ts

@@ -131,11 +131,19 @@ export function insertMany(
   });
 }
 
-/** Most-recent `limit` messages, in chronological order. */
-export function recent(chatId: string, limit: number): HistoryMessage[] {
+/**
+ * Most-recent `limit` messages, in chronological order. `floorId` is the
+ * chat's context-reset marker: only rows with a larger id are returned
+ * (0 = every row).
+ */
+export function recent(
+  chatId: string,
+  limit: number,
+  floorId = 0,
+): HistoryMessage[] {
   const rows = getDatabase()
     .prepare(historySql.recent)
-    .all(chatId, limit) as Row[];
+    .all(chatId, floorId, limit) as Row[];
   return rows.reverse().map(rowToMessage);
 }
 
@@ -147,10 +155,11 @@ export function recentBefore(
   chatId: string,
   beforeMsgId: number,
   limit: number,
+  floorId = 0,
 ): HistoryMessage[] {
   const rows = getDatabase()
     .prepare(historySql.recentBefore)
-    .all(chatId, beforeMsgId, limit) as Row[];
+    .all(chatId, beforeMsgId, floorId, limit) as Row[];
   return rows.reverse().map(rowToMessage);
 }
 
@@ -158,10 +167,11 @@ export function recentBeforeTime(
   chatId: string,
   beforeTs: number,
   limit: number,
+  floorId = 0,
 ): HistoryMessage[] {
   const rows = getDatabase()
     .prepare(historySql.recentBeforeTime)
-    .all(chatId, beforeTs, limit) as Row[];
+    .all(chatId, beforeTs, floorId, limit) as Row[];
   return rows.reverse().map(rowToMessage);
 }
 
@@ -173,8 +183,66 @@ export function setFilePath(
   getDatabase().prepare(historySql.setFilePath).run(filePath, chatId, msgId);
 }
 
-export function deleteChat(chatId: string): void {
-  getDatabase().prepare(historySql.deleteChat).run(chatId);
+/**
+ * Hard-delete a chat's rows and its state. Only the operator's explicit
+ * purge reaches this (history.ts purgeChatHistory). Returns rows deleted.
+ */
+export function purgeChat(chatId: string): number {
+  return inTransaction(() => {
+    const db = getDatabase();
+    const result = db.prepare(historySql.purgeChat).run(chatId) as {
+      changes: number | bigint;
+    };
+    db.prepare(historySql.purgeChatState).run(chatId);
+    return Number(result.changes);
+  });
+}
+
+/** A chat's soft-reset / soft-delete state. */
+export type ChatHistoryState = {
+  /** Rows with an id at or under this predate the last context reset. */
+  clearedThroughId: number;
+  clearedAt?: number;
+  hiddenAt?: number;
+};
+
+export function chatState(chatId: string): ChatHistoryState | undefined {
+  const row = getDatabase().prepare(historySql.chatState).get(chatId) as
+    | {
+        cleared_through_id: number;
+        cleared_at: number | null;
+        hidden_at: number | null;
+      }
+    | undefined;
+  if (!row) return undefined;
+  return {
+    clearedThroughId: row.cleared_through_id,
+    clearedAt: row.cleared_at ?? undefined,
+    hiddenAt: row.hidden_at ?? undefined,
+  };
+}
+
+export function markCleared(chatId: string, at: number): void {
+  getDatabase().prepare(historySql.markCleared).run(chatId, chatId, at);
+}
+
+export function markHidden(chatId: string, at: number): void {
+  getDatabase().prepare(historySql.markHidden).run(chatId, chatId, at, at);
+}
+
+export type HiddenChat = { chatId: string; hiddenAt: number; total: number };
+
+export function hiddenChats(): HiddenChat[] {
+  const rows = getDatabase().prepare(historySql.hiddenChats).all() as Array<{
+    chat_id: string;
+    hidden_at: number;
+    total: number;
+  }>;
+  return rows.map((r) => ({
+    chatId: r.chat_id,
+    hiddenAt: r.hidden_at,
+    total: r.total,
+  }));
 }
 
 /**

package/src/storage/sql/history.sql

@@ -9,10 +9,13 @@ INSERT OR IGNORE INTO history_messages
 VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?)
 
 -- name: recent
+-- The `id > ?` floor is the chat's context-reset marker (0 for none; see
+-- chatState below): rows at or under it stay stored and searchable but
+-- are no longer the chat's current conversation.
 SELECT msg_id, sender_id, sender_name, sender_handle, text, reply_to_msg_id,
        timestamp, media_type, sticker_file_id, file_path, attachments
 FROM history_messages
-WHERE chat_id = ? ORDER BY id DESC LIMIT ?
+WHERE chat_id = ? AND id > ? ORDER BY id DESC LIMIT ?
 
 -- name: recentBefore
 -- Scroll-back pagination: the window of messages strictly older than a
@@ -20,7 +23,7 @@ WHERE chat_id = ? ORDER BY id DESC LIMIT ?
 SELECT msg_id, sender_id, sender_name, sender_handle, text, reply_to_msg_id,
        timestamp, media_type, sticker_file_id, file_path, attachments
 FROM history_messages
-WHERE chat_id = ? AND msg_id < ? ORDER BY id DESC LIMIT ?
+WHERE chat_id = ? AND msg_id < ? AND id > ? ORDER BY id DESC LIMIT ?
 
 -- name: recentBeforeTime
 -- Time-cursor variant of recentBefore for the read_history `before` date
@@ -28,14 +31,52 @@ WHERE chat_id = ? AND msg_id < ? ORDER BY id DESC LIMIT ?
 SELECT msg_id, sender_id, sender_name, sender_handle, text, reply_to_msg_id,
        timestamp, media_type, sticker_file_id, file_path, attachments
 FROM history_messages
-WHERE chat_id = ? AND timestamp < ? ORDER BY id DESC LIMIT ?
+WHERE chat_id = ? AND timestamp < ? AND id > ? ORDER BY id DESC LIMIT ?
 
 -- name: setFilePath
 UPDATE history_messages SET file_path = ? WHERE chat_id = ? AND msg_id = ?
 
--- name: deleteChat
+-- name: purgeChat
+-- The ONLY statement that deletes history rows. Reached solely through the
+-- operator's explicit `talon history purge` (history.ts purgeChatHistory);
+-- resets, backend switches and chat deletion never delete rows.
 DELETE FROM history_messages WHERE chat_id = ?
 
+-- name: purgeChatState
+DELETE FROM history_chat_state WHERE chat_id = ?
+
+-- name: chatState
+SELECT cleared_through_id, cleared_at, hidden_at
+FROM history_chat_state WHERE chat_id = ?
+
+-- name: markCleared
+-- Soft reset: move the chat's context floor to its newest stored row. The
+-- rows stay; readers that build the bot's context skip everything at or
+-- under the floor. Parameters: chat_id, chat_id, cleared_at.
+INSERT INTO history_chat_state (chat_id, cleared_through_id, cleared_at)
+VALUES (?, (SELECT COALESCE(MAX(id), 0) FROM history_messages WHERE chat_id = ?), ?)
+ON CONFLICT(chat_id) DO UPDATE SET
+  cleared_through_id = excluded.cleared_through_id,
+  cleared_at = excluded.cleared_at
+
+-- name: markHidden
+-- Soft delete: a chat the user deleted is hidden (and its context floor
+-- moved, so a chat that reappears under the same id starts fresh). The
+-- rows stay. Parameters: chat_id, chat_id, cleared_at, hidden_at.
+INSERT INTO history_chat_state (chat_id, cleared_through_id, cleared_at, hidden_at)
+VALUES (?, (SELECT COALESCE(MAX(id), 0) FROM history_messages WHERE chat_id = ?), ?, ?)
+ON CONFLICT(chat_id) DO UPDATE SET
+  cleared_through_id = excluded.cleared_through_id,
+  cleared_at = excluded.cleared_at,
+  hidden_at = excluded.hidden_at
+
+-- name: hiddenChats
+SELECT s.chat_id, s.hidden_at,
+       (SELECT COUNT(*) FROM history_messages h WHERE h.chat_id = s.chat_id) AS total
+FROM history_chat_state s
+WHERE s.hidden_at IS NOT NULL
+ORDER BY s.hidden_at DESC
+
 -- name: searchFts
 -- The match param must already be a valid FTS5 expression
 -- (see history.ts ftsQuery).

package/src/storage/sql/schema.sql

@@ -52,6 +52,19 @@ CREATE TRIGGER IF NOT EXISTS history_au AFTER UPDATE OF text, sender_name ON his
   VALUES (new.id, new.text, new.sender_name);
 END;
 
+-- Per-chat history state. Chat history is never deleted by a reset, a
+-- backend switch or a chat deletion: a reset records a context floor
+-- (`cleared_through_id`, the newest history_messages.id at reset time) so
+-- the bot's context starts fresh after it while every row stays stored
+-- and searchable; deleting a chat in a client sets `hidden_at`. Only the
+-- operator's explicit `talon history purge` removes rows.
+CREATE TABLE IF NOT EXISTS history_chat_state (
+  chat_id            TEXT    PRIMARY KEY,
+  cleared_through_id INTEGER NOT NULL DEFAULT 0,
+  cleared_at         INTEGER,
+  hidden_at          INTEGER
+);
+
 -- Typed memory: one row per claim, with an FTS5 index over subject +
 -- text. Kinds are lifecycles, not labels (docs/memory-persona-plan.md
 -- §3.1): `directive` is durable human intent, `fact` is durable and

package/src/storage/sql/statements.generated.ts

@@ -57,6 +57,19 @@ CREATE TRIGGER IF NOT EXISTS history_au AFTER UPDATE OF text, sender_name ON his
   VALUES (new.id, new.text, new.sender_name);
 END;
 
+-- Per-chat history state. Chat history is never deleted by a reset, a
+-- backend switch or a chat deletion: a reset records a context floor
+-- (\`cleared_through_id\`, the newest history_messages.id at reset time) so
+-- the bot's context starts fresh after it while every row stays stored
+-- and searchable; deleting a chat in a client sets \`hidden_at\`. Only the
+-- operator's explicit \`talon history purge\` removes rows.
+CREATE TABLE IF NOT EXISTS history_chat_state (
+  chat_id            TEXT    PRIMARY KEY,
+  cleared_through_id INTEGER NOT NULL DEFAULT 0,
+  cleared_at         INTEGER,
+  hidden_at          INTEGER
+);
+
 -- Typed memory: one row per claim, with an FTS5 index over subject +
 -- text. Kinds are lifecycles, not labels (docs/memory-persona-plan.md
 -- §3.1): \`directive\` is durable human intent, \`fact\` is durable and
@@ -518,24 +531,55 @@ export const historySql = {
    reply_to_msg_id, timestamp, media_type, sticker_file_id, file_path,
    attachments)
 VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?)`,
-  recent: `SELECT msg_id, sender_id, sender_name, sender_handle, text, reply_to_msg_id,
+  recent: `-- The \`id > ?\` floor is the chat's context-reset marker (0 for none; see
+-- chatState below): rows at or under it stay stored and searchable but
+-- are no longer the chat's current conversation.
+SELECT msg_id, sender_id, sender_name, sender_handle, text, reply_to_msg_id,
        timestamp, media_type, sticker_file_id, file_path, attachments
 FROM history_messages
-WHERE chat_id = ? ORDER BY id DESC LIMIT ?`,
+WHERE chat_id = ? AND id > ? ORDER BY id DESC LIMIT ?`,
   recentBefore: `-- Scroll-back pagination: the window of messages strictly older than a
 -- given msg_id, newest-first (the repository reverses to chronological).
 SELECT msg_id, sender_id, sender_name, sender_handle, text, reply_to_msg_id,
        timestamp, media_type, sticker_file_id, file_path, attachments
 FROM history_messages
-WHERE chat_id = ? AND msg_id < ? ORDER BY id DESC LIMIT ?`,
+WHERE chat_id = ? AND msg_id < ? AND id > ? ORDER BY id DESC LIMIT ?`,
   recentBeforeTime: `-- Time-cursor variant of recentBefore for the read_history \`before\` date
 -- parameter: the newest \`limit\` messages strictly older than a timestamp.
 SELECT msg_id, sender_id, sender_name, sender_handle, text, reply_to_msg_id,
        timestamp, media_type, sticker_file_id, file_path, attachments
 FROM history_messages
-WHERE chat_id = ? AND timestamp < ? ORDER BY id DESC LIMIT ?`,
+WHERE chat_id = ? AND timestamp < ? AND id > ? ORDER BY id DESC LIMIT ?`,
   setFilePath: `UPDATE history_messages SET file_path = ? WHERE chat_id = ? AND msg_id = ?`,
-  deleteChat: `DELETE FROM history_messages WHERE chat_id = ?`,
+  purgeChat: `-- The ONLY statement that deletes history rows. Reached solely through the
+-- operator's explicit \`talon history purge\` (history.ts purgeChatHistory);
+-- resets, backend switches and chat deletion never delete rows.
+DELETE FROM history_messages WHERE chat_id = ?`,
+  purgeChatState: `DELETE FROM history_chat_state WHERE chat_id = ?`,
+  chatState: `SELECT cleared_through_id, cleared_at, hidden_at
+FROM history_chat_state WHERE chat_id = ?`,
+  markCleared: `-- Soft reset: move the chat's context floor to its newest stored row. The
+-- rows stay; readers that build the bot's context skip everything at or
+-- under the floor. Parameters: chat_id, chat_id, cleared_at.
+INSERT INTO history_chat_state (chat_id, cleared_through_id, cleared_at)
+VALUES (?, (SELECT COALESCE(MAX(id), 0) FROM history_messages WHERE chat_id = ?), ?)
+ON CONFLICT(chat_id) DO UPDATE SET
+  cleared_through_id = excluded.cleared_through_id,
+  cleared_at = excluded.cleared_at`,
+  markHidden: `-- Soft delete: a chat the user deleted is hidden (and its context floor
+-- moved, so a chat that reappears under the same id starts fresh). The
+-- rows stay. Parameters: chat_id, chat_id, cleared_at, hidden_at.
+INSERT INTO history_chat_state (chat_id, cleared_through_id, cleared_at, hidden_at)
+VALUES (?, (SELECT COALESCE(MAX(id), 0) FROM history_messages WHERE chat_id = ?), ?, ?)
+ON CONFLICT(chat_id) DO UPDATE SET
+  cleared_through_id = excluded.cleared_through_id,
+  cleared_at = excluded.cleared_at,
+  hidden_at = excluded.hidden_at`,
+  hiddenChats: `SELECT s.chat_id, s.hidden_at,
+       (SELECT COUNT(*) FROM history_messages h WHERE h.chat_id = s.chat_id) AS total
+FROM history_chat_state s
+WHERE s.hidden_at IS NOT NULL
+ORDER BY s.hidden_at DESC`,
   searchFts: `-- The match param must already be a valid FTS5 expression
 -- (see history.ts ftsQuery).
 SELECT msg_id, sender_id, sender_name, sender_handle, text, reply_to_msg_id,

package/src/storage/turn-meta.ts

@@ -121,7 +121,7 @@ export function getTurnMeta<T>(chatId: string, msgId: string): T | null {
   }
 }
 
-/** Forget a chat entirely (chat deleted / history cleared). */
+/** Forget a chat's turn meta — only the operator's history purge does. */
 export function clearTurnMeta(chatId: string): void {
   ensureLoaded();
   try {