TrueMemory performance stabilization and functionality audit

The planning and catalogue checkpoint is complete. Implementation, hardware validation, and release remain open. This tracker records checkpoint 101. Permitted GitHub and GPUBox access is restored; implementation and hardware acceptance remain open.

Read the detailed Markdown dossier | Reproduction scripts and receipts

Latest continuation state

User requested a fresh-session handoff at checkpoint 101. All three agents stopped after read-only diagnosis or independent inventory. No C08/C09 source patches, commits, GPU jobs or publications occurred. The new handoff will be .work/journal/claude-handoff-v21.md; its actual creation and this tracker's publication/readback are recorded in the append-only root journal after checkpoint preparation.

C08/#764 OpenClaw and C09/#765 Hermes now have isolated, clean worktrees at validated private 60274d7a5d07179070efa45dbc7e7cd749bead7d: openclaw-bridge-764-v1 and hermes-bridge-765-v1. Actual inventory is 138 worktrees: 137 checkpoint branch records plus root. Source trace and inert actual-source witnesses confirm wrong native input/context transport. Root archived 26 current/released official producer/consumer files in native-bridges-upstream-contracts-v2.json, SHA256 4af972d66a1379d2dbc17e9147b1711f73e45ef8da0b868d355fa806e2678a7c. The auditor froze 26 criteria (SHA256 bc1f8406c7ca6a66d6acc204b08ffa75c2d625c7f82a89bd9c865a9583498300) and 370 protected source hashes. Root verified all 370 current bytes. Only baseline inert witnesses ran; the full independent control script is absent and must be created/executed before author patch-go. Both modules remain not implemented, tested or published.

OpenClaw's supported prompt return, session/turn dedup and configured user/database propagation have a proposed bounded design. Native full conversation/assistant capture remains incomplete and unproven. Hermes has a proposed fixed native wrapper for nested extra input and top-level context; strict worker completion, cross-platform claims, bounded durable capture and owned-command migration need review before code. Shared four-host transcript admission/output, assertions, GC, models, rerankers and retrieval remain protected. Run correlation is not proven user-turn admission.

GitHub and strict GPUBox SSH are permitted. Actual preflight at 2026-10-11T10:34:34.252003+00:00 recorded clean root/private/new module/C10 worktrees, an empty running-container/owned-native-gate process query, #828 at unchanged 5873e5a4978f37bcd31772d6840717fb217df713 with 34 SUCCESS plus 17 preserved historical CANCELLED checks, and #831/#832/#833 each with 34 SUCCESS. No GPU job is queued. Existing C10/Kimi focused, combined full, publication, hosted, private adoption and final body readback are complete and must not be repeated unchanged; handoff v20 preserves their exact evidence.

60 project fix drafts remain published; 33/43 areas have some published implementation (33 / 43 × 100 = 76.74419%). Zero accepted issue closures, main merges or releases. The original 26.24 GB Mac memory problem, native host/model/hardware and retrieval acceptance remain unproven. Complete-archive Deep Search #770 remains future scope; #758/#759 egress decisions remain held. The original dirty checkout and live Mac service were not contacted.

Fresh session: finish the executable frozen baseline controls, resolve exact native trust/capture scope, authorize narrow paths, then implement and independently review atomic commits. Root owns composition and the sequential focused regression, combined full and exact publication GPU gates, followed by separate OPEN draft publications and hosted verification.

Scope

Optimize the existing models and rerankers on the 32 GiB target machine. Preserve existing per-entrypoint result limits and internal candidate expansion, retrieval quality, dimensions, and index compatibility. API100/internal800/rerank500 are fixed workload values, not universal caps; MCP clamps at 200 and client filtering may expand internal requests. Fix confirmed bugs and inaccurate functionality claims. Archive-level Deep Search is a separately requested future feature.

The audit covers 393 historical issue records, nine previously open issues, eight open PR descriptions, the published paper, current source, documentation, and release CI. It produced 49 detailed findings and 66 capability assessments: 36 new child tickets, three finding updates to existing open issues, one reopened issue, eight held findings, and one duplicate merged into P01 (36 + 3 + 1 + 8 + 1 = 49). Two additional planning updates were added to #732 and #721, bringing existing open-issue updates to five. This tracker is additional to the 36 child tickets.

Incident

The user screenshot shows 26.24 GB for TrueMemory on a 32 GB machine, with 12.52 GB system swap. Subsequent read-only inspection observed approximately 40-41 G physical footprint, prior MPS OOM, sticky CPU fallback for both models, and ongoing CPU work. The precise allocation responsible is not yet attributed. MPS watermarks do not cap CPU allocations; #297 was reopened with that evidence.

RSS, physical footprint, GPU mappings, compression, and swap are different overlapping measurements. Do not sum them as independent allocations. Thermal warnings are not temperature measurements.

Audit checkpoint

• Preserve original dirty checkout and audit pinned remote main.
• Review historical resolutions and distinguish recurrence from deferred product decisions.
• Produce granular reproductions, implementation proposals, acceptance tests, dependencies, and regression risks.
• Pass four portable synthetic probe programs and validate 195 unique source anchors.
• Publish child issues and read back exact bodies/comments.
• Capture a recovered isolated fixed-workload hardware baseline and attribute live allocations.
• Implement and independently review atomic fixes in dependency order.
• Pass release CI, fresh-wheel checks, retrieval-quality comparison, and bounded hardware soak.
• Publish a measured release and close only issues with acceptance evidence.

Implementation history through checkpoint 66

By checkpoint 66, fifty-five atomic fix PRs had been published as drafts. No issue is closed, no main merge occurred, and no release or package was published. Several PRs are prerequisites, not completed performance issues. The original 26.24 GB Mac incident remains unproven.

Previously validated source: selected runtime and writer fences

Draft #827 is open at 48217a73f10ad7fa80029ad800660d76ef912de7, stacked on #826. Private integration is ce1ecd758fcff7c50ff649d7248fcb16d72f42eb. Three feature commits and two test-only compatibility corrections add exact selected-generation writer fences, strict per-response model receipts, and whole-operation runtime admission. Managed connection ownership distinguishes another Engine thread's transaction from caller-borrowed SQL, serializes authority snapshots and lifecycle work, and preserves eligible clean I/O-error recovery on Python 3.10. Reranker responses require one result row per requested pair while preserving trailing dimensions.

Both sequential offline installed-wheel/full GPUBox gates passed with native SQLite flags, 17 skips, 3 deselections, exit 0 and no timeout/OOM kill. Actual source hashes match all 124 combined and 110 publication snapshot entries. Actual Python 3.10 compatibility passed 47 safe tests with one native-only skip and no file-backed database. Independent runtime/writer/receipt review passed 48 probes, connection ownership 41, and GC fixture isolation 11. Ruff, Python 3.10 syntax, public scope, exact manifests and privacy checks passed. The public delta has 26 paths and 2,314 documentation lines (2,132 + 59 + 42 + 81); six unrelated private integration files are excluded. The stale publication v1 tree is preserved.

The PR body/head/base were read back exactly. Current head 48217a7 has all 34 hosted checks passing, including both Windows jobs. Original Windows runs first exposed 11 UTF-8 test-source decoding errors; an immutable cp1252-default negative control reproduced all 11, and the corrected loaders passed 72 safe tests with one native-only skip. A later head passed 33 checks but one Windows cleanup failed after the warm-search assertions passed: Engine close detaches while its shared maintenance worker retains a separate database handle. The test now waits for worker teardown before temporary-directory removal. All six old assertions remain and one teardown assertion was added; independent teardown review passed seven probes. Both final full gates above passed sequentially before the last push. All failed sources/logs and prior passes remain preserved. Public manager/MCP/CLI adoption remains Unit C; original Mac memory reduction and hard cancellation latency remain unproven.

Checkpoint 66 publication history: public tier authority adoption

Unit C is published as draft #828, stacked on #827. Exact head bb955cd0a147c7cc6beaf1fa134c78b16c233303, base and description read back correctly. Live exact-head hosted verification found 28 passing checks and six failures, covering macOS 3.12, Windows 3.12 and Ubuntu 3.10 across two workflows. Both failed logs are preserved; correction and independent review are underway. Three atomic commits separate guarded policy/config foundations, public adoption and documentation. The private integration advanced by fast-forward to 37af5fc56b6499fa7af5c9c85c8df0aaa3e6af74; its committed source matches the final validated bytes.

Both final offline installed-wheel GPUBox full gates passed sequentially with GC enabled. Combined v12: 3,631 tests and 3,010 subtests, 404.360 seconds, log SHA256 5945a569366ed5a26cdfbec3c72ec25e3b937b6989d9177671960fe6b4dd5b38. Refreshed publication: 3,499 tests and 2,365 subtests, 400.831 seconds, log SHA256 a8d2394bc796d076ada639bbbbd7c381e94acf8a20f2dc8fa5ca45443b28436d. Both have 17 skips, three network deselections, exit 0, no timeout or OOM kill. All 144 combined and 131 publication source hashes match the final commits. The strengthened lazy-config test passes all 18 cases and 15 independent mutation outcomes.

The reviewed public patch has 54 paths = 20 production + 33 tests + 1 documentation file. Independent review passes all eight port checks. Nineteen production files and 33 tests match private v12; pipeline contains only four authorized regions, retaining public recall invalidation. Documentation preserves the public prefix and appends 222 lines. Private-only changes and the preserved synthetic lock artifact are excluded. Ruff and Python 3.10 syntax pass.

Public tier operations now use committed database authority and bounded rebuild jobs. Cold initialization precedes table capture; eligible fresh opens use one 10-second owner-admission budget. Typed authority failures propagate, while ordinary optional legacy Deep dependency fallback remains available. Borrowed FTS and invalid-input precedence are preserved. Prior assertions remain except two eager-config source assertions replaced by zero-load behavior and one exception expectation replaced by structured pending-error coverage. Models, rerankers, retrieval settings and GC remain unchanged. All earlier failures are preserved. Synthetic native-vector tests do not establish native model quality, live Mac memory attribution or a hardware soak.

Two follow-ups are committed locally but unpublished. #746 reports the exact unsupported scheduled-preference category, preserves error/deferred/pending precedence and keeps captured cancellation terminal. Public local commit 8ac9a62c3cc2982966954dedfa6936cd63b9f3d5 passes 11 new safe tests and 47 independent AST/in-memory controls. An existing fixture omitted the new constant; the two failed subtests remain preserved, and the corrected three-test selection passes. All 96 existing boundary test methods and 514 assertion nodes are unchanged. Native/file-backed/full GPUBox gates are not run. Persisted cited preference generation remains separate.

#744 documentation-only local commit 4b61218963a95c8fdbd8562d95ae2bc6c238e869 distinguishes supplied benchmark content from automatic extracted facts and accurately separates installed hook bounds from core helpers. All 13 new links point to tracked files; all 41 README table rows and code samples remain unchanged. Source/link/diff review passes; no new tests were added for docs-only changes.

A separate clean combined worktree is prepared at a9bed2bce47c0a84068fe46d77a7598048fe1853. Its seven Python files match the locally tested public patch, three documentation deltas match exactly, and only ten owned paths differ from private integration. The validated integration branch remains at 37af5fc56b6499fa7af5c9c85c8df0aaa3e6af74. Permitted GitHub/GPUBox access is restored. GPUBox was verified idle before staging 146 source files for the committed #746 combination. The first focused gate failed two obsolete all-nine pending-result expectations (280 passed, 334 subtests); that evidence is preserved. The corrected focused gate passed 500 tests and 426 subtests on d6f9b5ee, and its combined full gate is running. Exact C and #746 publication full gates remain pending. Private integration has not advanced.

Checkpoint 72: validation and module team

Permitted GitHub and GPUBox access is restored. There are 57 published fix drafts, no merges or releases, and zero fully accepted issues closed. Implementation coverage remains 30 / 43 = 69.8%, not overall completion.

The corrected combination d6f9b5eed5743810edb54e7bbad017c55b5c36d7 passed its full installed-wheel GPUBox gate: 3,648 tests and 3,038 subtests, 405.953 seconds, 17 skips and three network deselections, exit 0, no timeout or OOM. GC and native SQLite flags remained enabled. Log SHA256 8413f8e109cae421c03c06ea8c6a7fbf9b2c7b60ea0992a3f23cee10f303bade; all 146 actual source hashes match. All 15 changed Python paths equal the public #746 source bytes. Private integration advanced by fast-forward to the exact tested d6f9b5eed5743810edb54e7bbad017c55b5c36d7 after all publication gates passed.

C's correction allows scalar FTS initialization proof only when the actual SQLite connection lacks callable extension loading. A newly capable connection refuses stale FTS reuse. Manual and receiptless refusals, authority, identity and transaction fences remain. Fixture cleanup is portable to Python 3.10 and safe after setup failure; URI and path expectations use native representations. All 291 existing methods and 1,461 assertion nodes remain. Four path expectations are portable; the same-tier synthetic fixture now establishes coherent metadata. Original hosted failures and independent collaborator failures remain preserved.

#746's two obsolete all-nine pending-result checks now require all eight actual pending layers, the exact unavailable ninth result and zero helper calls. All 86 methods remain; 458 assertion calls become 464, with 456 unchanged and two obsolete checks replaced by eight. The initial GPUBox failure is preserved. Persisted cited preference generation remains separate scope.

Three module agents work independently in versioned worktrees and append-only journals. Root owns integration, publication and the one-job GPUBox queue. Their shared command contract is explicit trusted --host and --event, with legacy Claude defaults; stdin cannot select host authority. Cursor has no documented per-prompt context output. OpenClaw discovery and newer Kimi paths have verified differences from current adapters; documentation must distinguish current, legacy and unproven lifecycle behavior.

The original 26.24 GB Mac memory incident remains unproven fixed. Native MPS, allocation attribution, paired retrieval/workload comparison and hardware soak remain open. Complete-archive Deep Search remains future #770.

Unit C exact publication passed 3,505 tests and 2,365 subtests in 402.260 seconds, with 17 skips and three deselections, exit 0, no timeout or OOM. Log SHA256 91f85096c292cd0b4047269a1842d1bc1e8eb58ea335d237b58fb05d694c63b2; all 131 actual source hashes match. #828 head/base/draft/body readback is exact. Hosted checks are running. The original exact #746 publication source a5ce23b3 passed 3,516 tests and 2,393 subtests in 407.882 seconds, 17 skips and three deselections, exit 0, no timeout or OOM. Log SHA256 c33fdcec47de41c6f343126e006c4427d4614d5f76d529d4bf47c26e3cd2ce24; all 132 source hashes match. GPUBox now runs corrected Windows-fixture combination 7bd70e9f; module source 94bd9544 remains unvalidated.

Independent module review exposed foreign installer commands clobbered by substring ownership detection and Cursor conversations sharing the fallback session identity. Atomic ownership/identity corrections pass their independent controls. The standalone #761 flag loss was corrected at 396b4d8e; independent 69/69 controls and 25 source/signature comparisons pass. Modules are not remotely validated or published.

Draft #829 (#746) and draft #830 (#744) have exact head/base/draft/body readbacks. Both stack on corrected #828. None is merged or released; persisted cited preference generation remains separate.

The refreshed #828 matrix at f043d090 completed 32 successes and two Windows failures. Both Windows jobs fail only the cancellation CLI fixture: it supplies /synthetic/store.db but compares a different drive-qualified absolute path. Atomic correction b1acf171 changes one test, no production bytes; 58 independent dispatch controls pass and all 111 test methods remain. Both Windows logs and prior heads are preserved. Combined 7bd70e9f, refreshed C b1acf171, #746 39a8827a and #744 51927b9a are prepared; they have not replaced published heads.

The first module-focused installed-wheel gate on 94bd9544 failed 19 cases, with 271 tests and 172 subtests passing, in 3.079 seconds; exit 1, no timeout or OOM. Log SHA256 38dab59a5b6ef16184284e3a8f2bc80c21dbd84cb43e54501ae583e64d7dccb2; all 168 actual source hashes match. Fixture corrections are in progress for read-only source roots, actual owned command forms and real synthetic user-turn counts. Assertions, production thresholds and GC remain intact. No module full gate or draft publication has passed.

Previous validated source: certified selection and serving admission

Draft #826 is open at e3e2c9b9d70d2016172451d7141789bf3b0595f1, stacked on #825. Private integration is 7d3a689f53631eef085f0fe667078a27b941a3ff. Eight files in two atomic commits add unused serving and database-selection prerequisites. The process-wide serving guard supports concurrent readers, same-thread reentry and explicitly reserved children while draining for activation. The journal verifies current source, paired receipt, selected job and expected generation inside one writer transaction before publishing exact registry/model/selection metadata and retiring the successful job marker. Config acknowledgement is generation-fenced; unacknowledged selection cannot be superseded.

Both sequential installed-wheel/full GPUBox gates passed with native vec/prepared/job-file flags enabled, 17 explicit skips, 3 deselections, exit 0 and no timeout/OOM kill. Actual remote/manifest/local hashes, Ruff, Python 3.10 syntax, diff, public identity and privacy checks passed. Independent serving review passed 54 probes. Independent activation review passed 35 probes, including actual revision/paired-receipt/final certification against in-memory SQLite; native schema and pathname association remain outside those local probes.

Preserved failures include forged closed child tokens, delayed inherited admission cancellation, repeated uncertain read rollback and inconsistent staged-generation acceptance. The corrected contract does not promise hard cancellation return time: condition cleanup can contend. Callers must close never-admitted reservations and use same-thread context lifecycle. Final pair audit is one complete scan under the writer; large-corpus latency remains unmeasured. Caller-proven old-state coherence, inactive target, maintenance ownership and drained serving are preconditions. These APIs do not yet route the public manager, reconcile native runtime/config, or prove memory reduction.

At checkpoint49, #824, #825 and #826 each have all 34 hosted checks passing at their recorded heads. #826 was rechecked at e3e2c9b9d70d2016172451d7141789bf3b0595f1. All remain drafts.

Previous validated source: durable selected-job binding

Draft #825 is open at 9bd0907800b097eab12cda94d7c07df1aa80ef30, stacked on #824. The private combined integration is bd83154e6c18a8e8736c8fe9ca157b817dbdb816. The three-file change writes a bounded selected-job marker through the accepted connection and validates it after background reopen. Live selection cannot be stolen; replacing a terminal marker requires its explicit previous ID, and ending a stale job cannot change a newer marker.

Both sequential installed-wheel/full gates passed with real sqlite-vec and the existing opt-in file-backed identity test, 17 explicit skips, 3 deselections, exit 0 and no timeout/OOM kill. Actual remote/manifest/local hashes, Ruff, Python 3.10 syntax, diff and privacy checks passed. Independent actual-source/in-memory review passed 64 probes; 31 new tests and 25 prior identity tests passed locally. Nine original production definitions and 104 original assertions remain unchanged.

The preserved pre-fix review had 58/59 passing probes: SQLite length(TEXT) could miss a large suffix after an embedded NUL and permit payload materialization. Byte-length admission and exact post-read validation corrected it. Two removal controls each fail one assertion with zero harness errors. A clone made before job selection lacks its fresh marker; cloning after the marker, ABA replacement and native SQLite-FD association remain outside the guarantee.

The newer checkpoint48 observation supersedes these initially pending matrices: #824 and #825 now each pass all 34 hosted checks. Public manager routing remains unchanged.

Previous validated source: worker and background handoff

Draft #824 is open at b3b607486c91548c3bed43a3d1ed0ddc4d1c2e81. It changes five files in two atomic commits: an opt-in bounded source worker and an immutable background database handoff. Its base 6c40e8d6dd968e5cf97ea1b11c9a9779b05cf952 combines already-public #822 and #823 prerequisites; this dependency join is not counted as another fix. Its combined integration checkpoint was 573226acbc6fcdbdaa46210371e7608f805fe63f.

Both installed-wheel builds and sequential full GPUBox runs passed. Actual sqlite-vec and the opt-in synthetic file-backed job test were enabled. Each had 17 explicit skips and 3 deselections, exit 0, no timeout or OOM kill. Actual remote source hashes matched manifests and local trees. Ruff, Python 3.10 syntax, diff, public identity and privacy checks passed. All 34 hosted checks on #822 and #823 have passed at their recorded heads. #824 initially had 31 queued and 3 running checks; the newer counts are recorded above.

The independent worker review passed 45 probes, preserving seven old worker methods, the transaction helper and 285 prior assertions. A 1,025-row source with page size 7 retained at most 14 source texts. This bounds row retention in the new primitive, not individual text bytes or total process memory. The result distinguishes paired committed progress, captured-range completion and current-source completion; it never reports activation. SQL-origin commit ambiguity propagates until the durable checkpoint is revalidated. Cancellation remains cooperative at call boundaries and does not interrupt internal native/SQLite waits.

Independent job review passed 30 probes, plus 10 separate root probes. Worker-thread maintenance ownership, existing-only reopen, source/path identity checks and interruption cleanup are covered. All 104 original job assertions were retained through a Windows fixture-path correction. Path observations cannot prove native SQLite file-descriptor association, ABA replacement or a stale connection to a same-epoch clone. Known-current caller association and a cooperatively stable path remain preconditions.

Unit B/C implementation history and preserved failures

Unit B is now published as draft #827 after both final full gates passed. All earlier failures remain evidence: combined v1/v2 exited 139; v3 exposed fixture/export and shared-connection failures; v4 exposed fixture dependency closure, capture-lock assertions and I/O recovery regressions; the first corrected focused run exposed a missing real helper binding. Existing assertions were retained through each correction. Combined v6 passed before the final Python 3.10 fallback, so v7 revalidated that exact final change.

The native GC crash is traced to the native runtime test restoring the whole sys.modules dictionary after first-importing torch. That cleanup removed 786 torch modules. A later import left corrupted native torch callable state, observed by GDB before the GC segfault. On the frozen second image, the native runtime plus configure-reembed plus consolidation sequence reproduced exit 139. Changing only that test to restore its exact overridden sentence_transformers key passed the same 10-test sequence with explicit post-module collection. GC remains enabled. The corrected fixture adds two assertions; independent review passed 11 probes and confirmed all prior assertions remain. Failed sources, debugger logs and containers remain preserved. The subsequent final combined and publication gates also passed.

Earlier Unit C implementation was integrated privately before the combined full gates described above. Independent journal/config review passed 65 synthetic probes, maintenance/ingest boundaries 47, and MCP whole-request admission 26. Public manager implementation now preserves existing configure assertions, bounded source routing, truthful pending state, same-tier recovery and zero-probe base/pro setup. Its first atomic commit is 4cd29a45eaa478ef772d24ea7c176b84f542ce20; explicit paired status/job CLI cancellation is separate commit 018d4b17bfdc0642ca62e5c1c9910390baf3d9c3. Author tests passed 59; independent manager review passed 31 and recovery review passed 34. These use synthetic stdlib/in-memory SQLite; native and combined public-adoption gates were pending at that stage. Cancellation requires exact identity, never discovers or steals another job, and does not restart a rebuild or delete source/vector data. Unbound orphan records refuse the paired-status CLI.

C integration corrected the four witnessed authority/cleanup overlaps and the controlled opener ordering, preserving B connection ownership. Independent combined runtime review passed 67 probes, MCP/proxy review 40, journal/config 65, manager 31, recovery 34, and policy composition 12. Author boundary tests passed 44 and root journal/manager/MCP tests 88. The already-cancelled style/no-style paths return before writer admission; owned transaction cleanup occurs before releasing its mutation lock. These are synthetic stdlib/in-memory checks.

The first combined C focused GPUBox run failed: 79 failures, 436 passing tests and 294 passing subtests in 105.784 seconds; no crash or timeout. Log SHA256 5b35fc715c0b4851c479fca140afdda1da39a7082b684458ba95f6e028e00e34. Real-helper fixture closures and restoration of new process policy fields corrected that failure set. Actual first-run base/pro setup was also fixed to use lazy ordinary identity setters, refuse foreign controlled markers without clearing them, and report concurrent preparation truthfully. Final safe reviews passed 44 bootstrap, 43 no-op/concurrent-configure and 71 model/retrieval-preservation probes. All original model/reranker choices, dimensions, defaults and limits remain fixed.

The second frozen C focused run failed with 13 failures, 516 passing tests and 303 passing subtests; its source and log remain preserved. The ownership-release model-admission correction now passes 19 independent controls. Four native bootstrap cases passed on frozen v2: Base and Pro on absent and empty synthetic databases, each followed by two actual Engine opens with real SQLite vector tables. No model construction/inference or fake journal was admitted. Actual source hashes match, exit is zero and no OOM/timeout occurred; log SHA256 e24eb3cbf34ed4cfd6661eff090759c9829e9bda7a31bd4d96d5ce4958c7181a. This is admission evidence, not retrieval-quality validation.

The expanded fixture/guard gate on frozen v3 found four failures. The corrected foreground metadata helper now passes 31 independent controls and three actual native cases: add, update and direct embed_single publish paired vectors and metadata while another thread holds maintenance ownership. The helper is called only inside the existing foreground model/writer fences; general metadata/rebuild/DDL paths still require maintenance ownership. Deprecated open again uses an existing-only connection callback and preserves conservative legacy rebuild provenance. All 150 affected fixture test ASTs, 689 assertions and six failure sentinels remain unchanged.

Frozen v4 expanded coverage exposed 24 failures: 23 more dependency-closure failures and a real fresh-Engine warm-open failure. Frozen v5 repairs all 23 fixture failures and passes 691 tests and 922 subtests, with only the unchanged warm-open test still failing because another Engine's automatic worker holds ownership. The full selection is unchanged. Elapsed receipt: 119.780 seconds; log SHA256 2b588540f2e2600555644ce789a97e81dfee880ac7375e52328ff39268e36c3c; exit 1, no timeout or OOM kill. Actual hashes match all 135 files in each snapshot. All failed sources and logs remain preserved.

Frozen v6 passes the expanded focused gate: 707 tests and 929 subtests, including the unchanged warm-search test and four real SQLite/sqlite-vec foreground cases. The fourth holds an actual automatic maintenance worker while a fresh Engine validates initialization evidence, without extra encoding or model construction. Elapsed receipt: 126.045 seconds; log SHA256 6caf380d9fa5f890909dfa04b7f193d60409ad6bd0f889f7e9d651a6b0797410; exit 0, no timeout or OOM kill. Actual hashes match all 136 source files. Four bootstrap cases also passed on frozen v5 with actual source hashes checked.

Same-Engine recovery validates bounded file/schema/registry/metadata evidence, connection settings, integrity and extension registration. Receipt-backed readiness now checks the admitted embedding model and dimension; all 49 independent reconnect controls pass, including the two preserved prior failures and a Deep reranker-only override. Foreground metadata passes 31 independent controls. Fresh-Engine evidence is bound to a live automatic coordinator, process, descriptor and launch token; manual/foreign ownership and expired tokens refuse.

The two newer-generation scheduling defects are corrected: an older busy acquisition or failed start no longer discards a newer valid pending receipt. Independent lifecycle/final-install review records 31 passing controls and one preserved superseded expectation. The latter expected a busy launch to retain its own receipt, conflicting with an existing explicit revocation invariant; the original valid-receipt test and all assertions remain unchanged. Same-generation work survives without sharing authority, while a distinct newer receipt survives only with its matching pending generation.

The refreshed v7 focused gate then failed the unchanged warm-search test: 708 tests and 933 subtests passed, one warm open encountered a busy owner. Elapsed receipt: 126.167 seconds; log SHA256 490ccb7d3639ef128ac130d843a2d4182bafe7ac07517c85955009b5d3c6967c; exit 1, no timeout or OOM kill. Frozen v6 remains a passing historical run, not proof of stable warm-open admission.

A GPU-only diagnostic preserves the same 33-file selection and assertions. Its first version failed in setup due to an incorrect class import and is preserved as a harness error. Corrected v2 traces a valid live automatic-worker receipt with schema cookie 58 into the exact schema-mismatch rejection, followed by busy owner acquisition. Exit 1; log SHA256 1b8a3abb67423043192e5d9d89b82fbbd4a818533a6cb09b4d261ed5e1493a16. Independent actual-storage probes reproduce three lazy style triggers changing the schema cookie without changing embedding metadata; owner-publication and launch-turnover gaps are also feasible. The GPU trace attributes schema rejection but does not itself measure the new cookie.

Bounded public fresh-open coordination is implemented. Independent admission review passes 24 probes, reconnect review 49, and foreground metadata review 31. Live receipt review has 31 passing probes and one preserved superseded expectation, with no unresolved production defect in that review. The private single-attempt opener, exact schema/launch checks, lazy style enrollment and all prior assertions remain intact. Eligible fresh callers use one 10,000 / 1,000 = 10-second retry/wait budget; native calls already underway are not hard-preempted.

Frozen v8 passes 729 tests and 943 subtests, including the original warm-search test, but the new fifth native test fails its vector-result assertion. Elapsed receipt: 133.995 seconds; log SHA256 661b3ebb3484c5a19fbbcc4ea7ca7580c0b1097a7c059b9831f93f218ac62554; exit 1, no timeout or OOM kill. All 137 actual source hashes match. Two isolated diagnostics reproduce the cause: initialization migrates populated generic vector tables to the registered edge tables after the public operation has captured the generic names. Hybrid search queries a dropped table and falls back to FTS. The assertion remained unchanged through the later initialization/admission ordering correction. At that stage no C full gate had passed. Models, rerankers, retrieval settings and GC remain unchanged.

The corrected frozen v9 passes 746 focused tests and 943 subtests in 139.461 seconds (log SHA256 eb66a8034120677694e63e417e6535fd045ee17fce7cc512bdd64a3bf685b52e). Cold legacy preparation now finishes before final public table capture. Parent/child automatic maintenance defers until the outer lease exits, and sibling MCP handle openings serialize before concurrent search. The existing scheduling assertion exposed a duplicate scheduling call; the implementation was corrected without changing that assertion. The synchronous in-memory macOS Qwen ordering witness also exposed repair of stale generic tables after migration; only that synchronous ordering is corrected, with no native Mac claim.

All six native SQLite/sqlite-vec cases pass on the same v9 source in 4.636 seconds (log SHA256 02641042c3ebccdfbd81fd95e4f48c9acda5553b994dff06e342cf19fd078d24). Coverage includes actual lazy style enrollment and real parallel MCP Deep Search with synthetic models. The Deep case verifies reranker slot identity/availability, not cross-encoder inference; the fifth case exercises synthetic prediction through normal reranking. Four refreshed base/pro first-run bootstrap cases pass with zero model work. No timeout or OOM kill occurred; actual hashes match all 137 source entries.

Independent review passes 24 initialization cases, the in-memory NaN witness and two inactive-cache controls. MCP source tests pass 11 cases with all eight original methods unchanged; removing only open serialization causes one expected assertion failure and zero harness errors. Native-test review preserves the first five tests and all 86 prior assertions, adding 53 assertions. At v9 the planned publication scope was 37 files, with exact four-region pipeline port and 2,314 + 222 = 2,536 public documentation lines. The combined full v9 gate subsequently completed with 135 failures, 3,538 passes and 2,924 passing subtests in 385.365 seconds; exit 1, no timeout/OOM kill or GC crash. Log SHA256: f981db89e4913fa85306b599d6cbdba7c7a3e5c495704e99198b1edb245f819b. No debugger was attached. Cold FTS-only search and invalid-input precedence regressions were independently reproduced against prior behavior. Their corrections and coherent fixture closures were subsequently validated by v12 above. The refreshed publication scope now contains 54 files. That failure checkpoint preceded the final validated draft #828. All failed source snapshots, probes and logs remain preserved. Models, rerankers, retrieval settings and GC remain unchanged.

Draft #828 replaces the public whole-corpus tier-switch path with bounded rebuild jobs. No change has been merged or released. Database selection, config-file replacement and process globals are not one atomic transaction. Failed post-commit reconciliation must remain activation-pending. Process-local serving admission does not provide a cross-process full-query snapshot: old readers may finish against their captured old pair, so public adoption must preserve nonempty old vector pairs and reject unsafe force/reset paths. No model, reranker, dtype, dimensions, retrieval depth or quality tolerance has been relaxed.

At checkpoint 66, all three prior agents had completed C implementation and independent reviews. The following is historical state at that checkpoint: All three agent slots resumed with distinct implementation and independent review work. The #746 and #744 local commits and review receipts are complete; GPUBox/native/full validation and draft publication remain pending. GPUBox was last verified idle, but fresh SSH is still denied. No new job has been queued. Of 43 current-scope tracked items, 28 have at least some published implementation: 28 / 43 = 65.1% implementation coverage, not project completion. No acceptance issue is closed. Original 26.24 GB Mac memory attribution, native MPS envelope, numeric default budget, three paired workloads, retrieval comparison and final soak remain open. Archive-level Deep Search is future scope.

Measured operation improvements

The episode benchmark used 9,942 generated messages and three clean timing repetitions per version. An unchanged rebuild went from median 417.368 ms and 10,180,552 appended WAL bytes to 14.726 ms and zero appended WAL bytes. All source rows, seven exact FTS result sets and 166 episode groups matched. WAL started empty and automatic checkpoints were disabled equally. These numbers measure that operation on one Linux/SQLite environment, not physical disk writes, whole-app latency or Mac memory.

Clustered search used 10,000 generated rows, 256-dimensional vectors, 4 KiB text and 100 results. With all 10,000 rows selected as candidates, full-message materialization fell from 10,000 rows to 100; measured Python peak allocation fell from 61,502,951 to 1,161,987 bytes. (1 - 1161987 / 61502951) * 100 = 98.11%. Seven repetitions per case in fresh variant/case processes gave median 2.760370 to 2.395365 seconds with allocation tracing enabled. A separate 1,000-candidate case also matched exact result hashes. These measure the isolated search strategy with real NumPy and ordinary SQLite BLOB vectors, not model inference, whole-process RSS or uninstrumented end-to-end latency.

Native evidence and release hold

The first sustained baseline completed its work without request/protocol/metric errors but exceeded the retained-memory allowance: RSS grew from 2,067,001,344 to 3,135,922,176 bytes, (3135922176 - 2067001344) / 1048576 = 1019.40234375 MiB, above 128 MiB. One candidate retained 2,073,841,664 bytes with a 2,127,970,304-byte sampled peak. Its resident model inventory differed because the extra CPU fast lane was absent. This single Linux/CUDA pair neither attributes every byte nor proves a Mac result. Its explicit-eight numerical/latency acceptance failed; the original workload and failures remain preserved.

The later default-order diagnostic completed 90 records, 3 warmups, 3,741 rows and 267 forwards. All 30 default comparisons had exact arrays and ordered-feature parity. All 30 explicit-eight arrays exactly matched the old contiguous explicit-eight control, while the frozen raw numerical acceptance was still only 21/30: mixed32, mixed33 and mixed100 failed in all three repeats. The original proxy had discarded explicit batch_size=8; preserving that failure is distinct from claiming a default32 regression. No acceptance waiver followed.

Default mixed100 reranking used 64x779, 36x72; instrumented default/reference medians were 429.941691 / 424.593396 = 1.012596275. Mixed100 embedding was 404.689675 / 398.089318 = 1.016580091. These serial synthetic timings do not establish paired production p95, retrieval, MPS or thermal acceptance.

The 256-document/32-query retrieval diagnostic changed first results on 3/32 global8 queries and 2/32 current-outer8 queries. Recall100 stayed 1.0; mean reciprocal rank fell from 0.618266 to 0.602641/0.587016. Six of nine numerical comparisons failed. These generated-label vector-stage results are not a full hybrid/reranker evaluation. The subsequent attention diagnostic completed 9 records, 290 rows, 28 forwards and 784 SDPA calls, reproducing all nine prior arrays exactly. Padding smaller batches still failed the raw gate; visible mask/GQA metadata did not identify a causal kernel.

A complete three-pair comparison, final bounded soak, enforced native whole-process envelope, native MPS result, swap recovery and thermal improvement remain unproven. Cooperative RSS admission and cache retirement in #819/#820 do not establish native allocator reclamation or a hard envelope. Unit and hosted CI passes do not override this release hold.

Earlier checkpoints and preserved failures

Earlier full tracker text, source snapshots, failed runs and detailed receipts remain versioned in the maintenance journal. Their public PRs retain the specific change and validation evidence. This checkpoint compacts the tracker body; it does not erase failed evidence or close acceptance gates.

• MCP minimum-version compatibility failed after the Pydantic 2.14 release on fix: Publish Dunbar relationships with exact row ownership #799/fix: Hold cluster model ownership through outer commit #800. fix: Require MCP compatible with current Pydantic #801 pins a compatible MCP floor and explicit Pydantic boundaries; corrected installed-wheel and hosted matrices passed. fix: Report incomplete ingestion parsing and extraction #798 remains 33 passing checks plus one Mac capacity cancellation with zero test steps. That canceled gate is not counted as a pass.
• Python 3.10 fault-injection fixtures in fix: Stream rebuild source pages with publication fences #802/fix: Track exact source edits and hidden replacements #807 were corrected without weakening rollback/data assertions. Corrected heads passed all 34 checks. Windows transcript capture required consistent read-only-handle identity observations; no stat/fstat ctime equivalence was assumed.
• The first coalesced scheduler candidate had 13 failures. Independent reproduction identified foreground writer/model-lock ordering; fix: Prevent maintenance from rejecting foreground writes #806 corrected it before fix: Coalesce engine maintenance behind owned workers #808 publication. Fixture isolation was not accepted as the production fix.
• Style fix: Add cancellable style maintenance with verified coverage #812/fix: Advance style coverage with verified incremental appends #814/fix: Route style maintenance through coordinated ownership #818 passed their corrected gates. The 75-append control performs zero additional full builds versus 75 in the old control. The initial explanation for the busy-model fixture failure was disproved and its patch reverted. A real earlier-test worker later reproduced interference, but the historical CI lock owner remains unproven. All prior assertions were retained.
• Prepared-target fix: Prepare certified inactive embedding targets #822 initially failed five unchanged ownership tests because an observed legacy lock lacked explicit acquire/release methods. Restoring its original default context-manager protocol corrected the suite. TEMP-case, permission and deadline review failures and their negative controls remain preserved.
• Source adapter fix: Attest bounded paired tier rebuild sources #823 initially admitted INTEGER 1 versus REAL 1.0 substitution in a pending page; exact type/IEEE-754 checks corrected it. Worker fix: Add bounded tier worker and verified background handoff #824 review caught obsolete cursor results after ambiguous SQL commits, terminal OOM and interrupted recovery; ordinary results now require durable checkpoint certainty. Job-path portability and nonregular-file observation failures were corrected before publication.

All external tests use public source/models and generated fixtures. No personal memories, transcripts, databases or credentials are exported. New diffs, bodies and commit identities are screened. Historical audit identity cleanup remains unresolved. The original dirty checkout and live Mac service remain untouched.

Execution checklist

Each linked issue contains its evidence class. A reproduced synthetic control-flow defect is not automatically a measured hardware performance improvement.

1. Restore fresh-install and release gates

• C01: #757 Fresh main installation permits MCP 2 although the server imports removed FastMCP
• C15: #767 Installers report all models ready even after model downloads fail

2. Bound memory, scheduling, and device recovery

• R13: #297 perf: enforce a whole-process memory budget across CPU inference and recovery
• R01: #735 perf: model server discards batch controls before embedding and reranking
• R03: #736 fix: model requests whose deadlines expire in the queue still run inference
• R04: #737 perf: model server has no bound on accepted request threads or queued bytes
• R05: #738 fix: CPU OOM retries bypass inference ownership and overlap work on the same model
• R06: #739 fix: local embedding loads ignore TRUEMEMORY_DEVICE=cpu
• R07: #740 fix: local MPS fallback moves model devices while another inference is running
• O01: #732 Device-policy validation update
• R08: #741 perf: missing shared-server endpoint silently creates per-client local model copies
• R09: #742 perf: adaptive throttler sleeps 20 seconds inside a batch admission call
• R10: #743 fix: MPS resource budgets use physical RAM where PyTorch uses recommended working-set memory

3. Reduce database work and make retries durable

• A06: #749 perf: clustering holds the write lock during computation and can commit an empty cache after failure
• A07: #750 perf: surprise-index rebuild holds the writer lock and loses prior scores on caught failures
• A08: #751 perf: episode recomputation rewrites the full FTS index twice without content changes
• A09: #752 fix: separation OOM retries a partially inserted tier-rebuild batch without rollback
• A10: #753 perf: coalesce automatic consolidation by database and track freshness independently of clustering
• A17: #756 perf: stream rebuild inputs instead of retaining the full message corpus before batching
• Additional finding: #795 Tier-switch readiness and active configuration can diverge after failure
• P01: #768 Ingestion marks sessions complete after failed extraction chunks or database writes
• P02: #769 Direct text ingestion leaves the recall cache stale after successful writes
• A11: #754 perf: bound clustered-search materialization without changing the retrieval pool
• A12: #720 fix: report missing clustering capability honestly in background maintenance health
• O02: #721 Clustering validation update

4. Repair advertised memory and host functionality

• A02: #745 fix: preserve source timestamps, session provenance, and gate signals on ingested facts
• A03: #746 fix: scheduled preference extraction reports success while doing no work
• A04: #747 fix: incremental L0 style vectors are not the advertised mean and depend on insert order
• A05: #748 fix: memory updates leave stale L0 and consolidated artifacts after source content changes
• A14: #755 fix: connect named landmark dates to temporal query resolution or narrow the advertised behavior
• C05: #761 Shared transcript allowlist rejects default native Codex and Gemini session paths
• C06: #762 Codex rollout messages parse as zero conversation turns
• C16: #306 Recurrent inline transcript path-probe crash and raw diagnostic exposure
• C07: #763 Shared recall JSON does not match native Cursor, Gemini, or Codex hook output contracts
• C08: #764 OpenClaw per-prompt bridge sends the wrong key and discards recall output
• C09: #765 Hermes shell hooks are installed without translating native event payloads or context output
• C14: #722 Windows Claude Desktop capture still depends on an unverified SessionEnd dispatch path

5. Align claims, privacy, and quality evidence

• A01: #744 docs/architecture: distinguish verbatim benchmark ingestion from extracted-fact auto-capture
• C02: #758 Automatic extraction can send transcript text to cloud providers despite the local-only claim
• C03: #759 DeepSearch refinement sends retrieved memory excerpts to its LLM, contradicting query-only egress
• C04: #760 Telemetry described as anonymous includes configured email and stable device identifier
• C10: #766 Manual integration setup snippets still reproduce previously fixed adapter configuration failures
• C13: #716 BEAM verification remains sensitive to the weak default judge identified in open benchmark: gpt-4o-mini is too weak a verifier for BEAM — it scores wrong answers as correct on contradiction_resolution #716

Future phase: archive-level Deep Search

• F01: #770 Deep Search across the complete accessible Claude and Codex conversation archive

Held findings

• R02: CPU eager-attention allocation hypothesis. The factory path is reproduced; contribution to the incident is unmeasured.
• R11/R12: unmerged PR729 recycle and cache-retention defects. Do not describe them as shipped behavior or merge the proposal without resolving them.
• A15/A16/A18: integrity-check frequency, sender recount, and repeated ingestion embedding/dedup costs need impact measurements.
• C11/[claim-unverified] paper accuracy + ablation numbers lack a one-command reproduction harness (paper §6, §7) #67: historical benchmark reproducibility remains an internally tracked decision.
• C12/LongMemEval badge shows oracle score (92.0%) without noting it's not the strict variant (87.8%) #282: oracle headline wording was deliberately deferred as cosmetic.
• A13 is incorporated into P01; no duplicate completion-contract ticket was filed.

Current single-user scope (#296), opt-out telemetry (#276), and the existing model/reranker choices remain locked. #397, #384, #199, and #79 are separate future features.

Required validation sequence

1. Define the workload and freeze environment/model/corpus/query manifests. Freeze numeric test duration, repeat count, permitted memory drift, idle recovery time, latency tolerance, swap-growth stop condition, and permitted budget overshoot before comparing fixes. Include at least 10 minutes of idle baseline, three paired workload runs, and a final two-hour bounded soak. Record process-family memory, active device, queue depth, request token shapes, operation timing, CPU seconds, and system pressure without logging personal text.
2. Set and prove a numeric budget B before release. For current usage U and bounded predicted work D, admit only when U + D <= B and required system headroom is available. CPU fallback, model replacement, and fast-lane copies must obey the same contract.
3. Demonstrate bounded queueing, cancellation after waits, exclusive inference ownership, safe retry, and actual recovery. Test metric failures and persistent over-budget native memory; log-only recycling is insufficient.
4. Demonstrate transactional maintenance, idempotent retries, and truthful completion. Keep old good derived data until a replacement generation commits.
5. Validate every advertised host with real event dispatch and model-visible context. Configuration-file presence and dictionary-field fixtures are insufficient.
6. Compare cold/warm recall, ingestion, consolidation, rebuilds, concurrent sessions, long token shapes, injected OOM, bursts, and idle intervals on identical models and retrieval depth. Record latency percentiles, completed throughput, stable post-warmup memory, swap change, and available energy/thermal evidence.
7. Run fresh-wheel and product CI gates on the exact release commit. Preserve historical benchmark methods; judge changes must not be reported as retrieval gains.

Definition of done

• Memory/compute budgets are numeric, enforced, and validated on the target hardware.
• No abandoned request starts new inference; no recovery path creates uncontrolled overlapping work or repeated reload storms.
• Ingestion and rebuild failures remain visible and recoverable without lost source coverage or duplicate facts.
• Idle operation has no unexplained inference or repeated full maintenance and returns to its measured baseline.
• Retrieval quality, model identity, reranker identity, dimensions, and index compatibility pass comparison gates.
• Supported integrations, data-egress claims, and installation outcomes match tested behavior.
• The release has passing product CI and measured before/after results. No zero-heat promise or unsupported claim that all allocation growth is fixed.