v0.31.4

v0.31.4

Maintenance release: 14 fix batches from two internal audit waves plus one user-reported bug.

Fixed

Compaction not triggering after threshold (#218)

A session whose previous turn ended with an interrupted or partially-aborted tool call could get stuck: every subsequent pass was classified as mid-turn, so the compaction threshold never fired and queued context reductions never applied. A newer real user message now ends the stale turn on both OpenCode and Pi. Additionally, doctor --issue reports no longer redact plain numeric settings like execute_threshold_tokens (redaction now applies only to string values under secret-like keys).

Workspace memory sharing

Two security fixes: malformed workspace share_categories now fails closed to sharing nothing (instead of sharing everything), and primary agents can no longer update, archive, or merge another project's memories through shared categories — shared visibility is read-only; mutations require ownership.

Project config trust boundaries

Project-level (.cortexkit/magic-context.jsonc) configs can no longer override historian.model / historian.fallback_models (a cloned repository could otherwise route background LLM work to a repo-chosen model on your credentials), and project-level execute thresholds now only apply when they delay compaction relative to your user config, never advance it. Dreamer task tuning and memory.enabled remain project-configurable.

Dreamer reliability

Dreamer task manifests (verify / map-memories / classify) are now fail-closed: a truncated or malformed model response is rejected and retried instead of partially applied. Lease-guarded writes use immediate transactions so concurrent OpenCode and Pi processes cannot double-commit. Retrospective scanning no longer permanently skips older sessions on large backlogs, and file-change verification catches same-second commits.

Historian and wrapup coordination

/ctx-recomp can no longer race a live /ctx-wrapup into concurrent compartment mutation. The boundary staleness fingerprint now hashes content (same-length edits are detected). Wrapup correctly treats a final chunk followed only by filtered noise as final, and waits at most 10 minutes for a busy compartment lease instead of indefinitely.

Cache stability

Two-pass tool reclaim and smart-drops now ride a hard m[0] fold on defer passes (previously spilled to a second cache bust). Image stripping replays its frozen set on every pass, including sessions that never had a compaction watermark. Channel-2 nudge delivery uses per-claim tokens so concurrent processes cannot double-deliver, and synthetic todo state never anchors to an errored/aborted assistant message (which some providers drop from the wire, orphaning the tool pair).

Storage integrity

Memory embeddings are skipped when content changed while the embedding request was in flight (stale-vector guard). The message search index recovers failed incremental writes even after later successes advanced its watermark. Cross-process duplicate memory writes are now idempotent.

Other fixes

• TUI/RPC: WebSocket re-hello no longer leaks notification sinks (lost TUI actions), reconnects detect a restarted server, upgrades require token auth before accepting the socket, and per-session cursors stop cross-session notification pruning.
• Pi todowrite: foreign-extension tool outputs are validated fail-closed before capture; overlay output capped.
• Smart notes: network check lifecycle hardened (tarpit responses can no longer hold the sandbox lock past budget; terminal rejections no longer retry).
• CLI doctor: honors PI_CODING_AGENT_DIR everywhere, atomic JSONL migration writes, issue-report body-limit postcondition.
• Pi E2E parity: 8 cache-invariant scenarios and a Pi-native subagent isolation test ported from the OpenCode suite.