v0.12.1

Hardening pass on the Pinecone proxy (Option B) and the write paths, plus a
per-bot query cache. No schema migration. Safe drop-in from 0.12.0.

Fixed

• Proxy rate limiter is now atomic. within_rate_limit() did a
  get_transient → set_transient($n+1) read-modify-write, which drops
  increments under a concurrent burst and lets a flood sail past the cap (the
  only CPU guard on the public Option B endpoint). It now uses wp_cache_incr
  (atomic) when a persistent object cache is present, with the transient as a
  documented soft fallback. A throttled request returns a 429 WP_Error
  instead of a bare false (which WordPress turned into a 401 indistinguishable
  from a bad token).
• delete_by_ids chunks large IN() lists. The proxy passes mxchat's
  bulk-delete ID arrays straight through; one giant IN (...) overran
  MotherDuck's HTTP body limit (and the CLI's stdin). Deletes are now batched at
  100 ids per statement — matching the orphan compactor — and de-duplicated.

Changed

• Per-bot query-cache generation. The cache-invalidation counter is now a
  per-bot map; the cache key carries a <botkey> segment
  (mxd_q_<botkey>_<gen>_<hash>). A write to one bot no longer invalidates
  another bot's cached top-Ks — a real win on multi-bot installs with frequent
  per-bot auto-sync. The compactor sweep walks the per-bot map and removes each
  bot's superseded generations precisely; never-bumped bots are untouched.
  The mxchat_duckdb_cache_gen option transparently migrates from the old
  scalar to the map (legacy global-style keys lapse via TTL).

Uninstall

• Now also cancels the mirror drift-check (mxchat_duckdb_mirror_drift_check_tick)
  and async-reprocess (mxchat_duckdb_reprocess_post) Action Scheduler
  actions, and flushes the object-cache rate-limit group (mxchat_duckdb_rl)
  where the backend supports group flushing. (Options/transients were already
  fully covered; this closes the two scheduled-action gaps.)