v0.41.0

Magic Context v0.41.0

Reliability release: three cache-stability defect classes eliminated across both transform lanes, a wave of community-reported fixes (11 issues, 5 external PRs), per-project storage override, and deep TS↔Rust parity hardening from twelve internal audit rounds.

Cache stability

• Trailing-blank self-poisoning loop fixed (both lanes): a frozen "keep" decision could manufacture a blank text part the provider never sent, then canonize its own insertion — re-billing ~170k+ tokens per turn on large Anthropic sessions. Decisions now mint only from provider-derived message shapes, "keep" can no longer fabricate bytes, and already-poisoned sessions heal organically on the next priced fold.
• Sentinel survival across marker windows: compaction-marker advances could temporarily hide a message and prune its replay sentinel, causing a guaranteed second bust one pass after every fold. Sentinels now survive transient absence and clear only on confirmed message deletion.
• One emergency batch per pressure episode (#386): under sustained high pressure, force-band cleanup could drop one or two newly-eligible tools on consecutive passes — each a full prefix rebuild for a few hundred tokens of reclaim. Emergency reclaim now batches once per continuous pressure episode, and accumulated candidates ride the next already-priced bust. Age, caveman, and supersession lanes gained the same episode discipline, matching the Rust engine's gates.
• LKG representation freeze: transient engine blips on Rust-mode sessions could alternate served bytes between live output and the last-known-good snapshot, busting the cache twice per blip. A served fallback now freezes byte-stable until a priced bust adopts the live representation back.

Pressure & scheduling correctness (Pi)

• Threshold percentage now means what it says (#385): Pi's scheduler divided by 0.85 × the usable window while the status UI divided by the full window — so drops configured at 90% fired at a displayed ~79%. One (tokens, limit, percentage) snapshot now drives the scheduler decision, historian trigger, transform logs, /ctx-status, and the footer.
• Historian drain budget self-recovers (#387): the internal ten-minute drain budget now arms strictly by clock (absent/future/expired window starts all reset it), and the misleading rate-limit skip: quota exhausted line — which sent users chasing provider quota — now names the real limiter and its reset time: historian skip: internal drain budget spent (9000/9000 tokens; resets in 10m).

Community fixes

• #384: shell-spawned scripts no longer inherit another supervised module's subc identity from the environment; all host and script route-opens pin an explicit null consumer identity, type-enforced. (Thanks iceteaSA for the audit and fix shape.)
• #381: twelve verified TS↔Rust divergences fixed across wire bytes, fold decisions, and persisted state — including a live bug where an in-flight tool call could be rewritten mid-execution — with every case added to the differential golden corpus. (Thanks iceteaSA.)
• #379 / #380: supersede pointers now survive Rust-mode deactivation with pending mirror references, and nine durable-write sites bump updated_at so time-windowed audits see them. (Thanks iceteaSA.)
• #375/#376, #377/#378: subc.connection_file is threaded to the transform transport, and authority seeding drops out-of-set supersede pointers instead of wedging the memories domain. (Fixes by iceteaSA.)
• #373 / #382: e2e timing and store-version test fixes. (Thanks iceteaSA.)
• #370: map-memories now converges on memories whose referenced files are all rejected — they receive a distinguishable file-independent mapping instead of failing every nightly run forever. (Thanks ICEY1W32.)
• #371/#372: new MAGIC_CONTEXT_STORAGE_DIR environment override so host-managed fleets with per-agent XDG isolation can share one context database — with doctor surfacing the resolved directory and its origin. (Feature by rholin33.)
• #367: Pi module resolution follows the running Pi installation first. (Fix by st0nie.)
• #350: pi-web multi-session and RPC host support. (Fix by elrond298.)
• #383: the in-progress todo glyph now animates on the Pi overlay — and idles at zero cost when nothing is in progress. (Fix by Pudgey.)

OpenCode Desktop

• Slash commands intercepted before the model sees them: Desktop strips the slash from plugin-registered commands and forwards them as plain text (/ctx-status arrived as a user message reading ctx-status). Magic Context now recognizes bare registered commands at the message seam, executes them through the normal handler, and prevents the stray prompt from reaching the LLM entirely.

Memory maintenance safety

• Directive denaturing prevention: the weekly verify sweep could rewrite behavioral PROJECT_RULES against code files they merely mention, stripping their normative content ("use the tool first", "never do X") until they classified into invisibility. Three structural gates now prevent it: directive-shaped memories map file-independent, verify is structurally unable to archive or rewrite what code cannot corroborate (refusals are audited skips), and content-loss rewrites above 50% refuse unless explicitly marked as consolidation.
• Memory-off strictness (#368): memory.enabled: false now suppresses every memory-derived surface across TS, Pi, and Rust lanes — including the user profile and mural blocks.
• ctx_memory write refusals echo your content: when the Rust engine is briefly unavailable, refused writes now return the full content verbatim with resend instructions instead of discarding the prompt bytes.

Engine parity & localization

• Twelve internal TS↔Rust↔Pi parity audit rounds closed: producer request calibration (historian prompt bytes re-pinned to the calibrated v8.7.4 shape), profile model transport on Rust-mode dispatches, language config now localizes historian and classifier output on both engines, recomp/upgrade authority routing, mural compose byte parity, and operator surfaces (doctor, sidebar tag totals) reading engine truth instead of lagging mirrors.

Storage

• Migration v82: mapping_origin column distinguishing mapper-authored from host-assigned file-independent memory mappings (with the Rust store twin).
• Slow write transactions (≥1s) now log with site and duration attribution (#362 follow-up).
• Orphaned opencode serve processes from killed e2e runs are contained with process groups, exit reapers, and a startup sweep.

Rust-mode lifecycle (#390, #391)

• Rust mode can now be deactivated and reactivated freely: authority workspace activation is idempotent (get-or-create), and a state-sync constraint failure parks the session with a typed reason instead of retrying at full cost every pass. (#390)
• Authority drain can no longer roll back memory classification or lifecycle state from stale mirror snapshots: mirror projection and repair commit atomically, and a recency belt refuses stale-snapshot writes over newer host rows. (#391)

Reclaim episode contract (#386)

• Emergency and routine reclaim now run one batch per continuous force-pressure episode instead of trickling a self-caused cache bust every pass; accumulated candidates ride the next natural bust. Verified by an adversarial multi-model audit; the supersession recency floor is now derived from persisted tag chronology so provider-projection contractions cannot expose protected tool outputs to reclaim. Both plugins share the same episode contract.

Nudge cadence

• A ctx_reduce call now buys real quiet: Channel-1 housekeeping reminders stay silent until reclaimable mass genuinely re-grows, full reminders fire once per band crossing, and repeat reminders collapse to a one-line note.

Test isolation (#388)

• Test runs are structurally isolated from user-tier config: the test preload pins XDG_CONFIG_HOME, and constructing a network-capable embedding provider in tests without a test factory now fails loudly.

Rust-mode visibility (#389)

• Authority transitions log one declaration naming the host paths that moved (ctx_memory, ctx_note, historian), and /ctx-status shows host-backend routing in Rust mode.

Upgrade notes

• The database migrates to schema v82 on first start; all Magic Context instances sharing the database should be updated together (older versions refuse to open a newer schema, loudly).
• No configuration changes required. MAGIC_CONTEXT_STORAGE_DIR is opt-in; if you set it, every process sharing the store must carry the same value — see the README section on storage location.