[dovvnloading]

Problem

Ten defects that either lose user data or present wrong output. Each one was reproduced against main before it was fixed.

1. knowledge.db backups. prune_backups parsed knowledge.db backups under the chats.db prefix. The "one snapshot per day, forever" policy silently kept only the 10 most recent.
2. Reply lost when its message is deleted. If the user deleted their message while the reply was generating, a reply that succeeded was reported as "AI response failed".
3. HTML node edits. Edits lived only in component state. Panning the node off-screen discarded them, and they were never saved.
4. Group drag froze the canvas. Dragging a container or frame that had members stopped the canvas applying scene updates. New nodes never appeared, streamed replies never updated, and deleted nodes stayed on screen.
5. llama.cpp model pin ignored. A node pinned to one configured llama.cpp model was answered by the other one and badged as the pinned one.
6. Truncated streams committed. Gemini, OpenAI-compatible and Ollama streams that stopped without a finish marker (a proxy, a gracefully closed connection) committed half a reply as complete.
7. Infinite token counts. A token count of 1e999 (JSON for infinity) raised OverflowError at the done event and discarded an already-streamed reply.
8. Undo then Send. Undoing a Send left the continuation pointer on the removed node, so the next Send became a detached root.
9. Reopened chats. The continuation pointer was never saved, so the first Send after reopening a chat also became a detached root.
10. Images in the context budget. Images were budgeted at about 48 tokens instead of about 1,600, so image-heavy histories silently overflowed the context window.

Change

One commit per fix:

• Backups: retention parses under the prefix it listed with; the private parser no longer has a default prefix to fall back to.
• Infinite numbers: OverflowError is tolerated wherever untrusted numbers are coerced to int: normalize_usage, the model catalog, and session_load's budget, counter and session-total fields. A corrupted saved chat now opens instead of failing.
• llama.cpp pin: the pin resolves to its configured file, and the provider runs that file for every task. describe_active_model / active_provider_model accept the resolved ref.
• Stream completion: Gemini, OpenAI-compatible and Ollama now require their own finish marker and raise the same unexpected-end error Anthropic does, so the partial lands flagged incomplete. The OpenAI/Gemini test fakes now send the finish marker real servers send.
• Image budgeting: images are priced by the documented vision formula from their header dimensions, and trim_history reports exactly the tokens it returns. The summary cache keys images by digest, and the context meter adds the same per-image figure. Audio attachments are still budgeted by their path; that needs per-provider rates and is a separate change.
• Chat pointers: Command snapshots last_chat_node_id and final_deliverable_node_id, so undo/redo restore them and Mark Final is a real undoable command. remove_nodes re-points like delete_chat_node, and the pointer is saved and restored like final_deliverable_node_id.
• Replies: send, artifact and gitlink callbacks are a silent no-op when their node was deleted mid-flight. A gitlink apply no longer reports failure for files it already wrote. Reply provenance and cost use the request-time pair, resolved through the same pin rungs as the dispatch.
• Group drag: member changes carry the drag flag of the change that produced them.
• HTML / note drafts: a new undoable scene/setHtmlContent intent. The card commits on Render, blur and Ctrl+S, ignores the echo of its own commit, and shows an undo. The note editor also flushes its draft on Ctrl+S, because the save key bypasses the while-typing gate.

Test plan

• Every fix has regression tests. Each new test was run against the pre-fix code and fails there.
• Backend, matching CI (Python 3.12, lockfile dependencies, CI=1): 3,493 passed, 20 skipped, coverage 86.6%. Perf suite 8 passed. ruff and mypy (361 files) clean.
• npm run check: codegen drift, tsc and ESLint clean (0 errors); vitest 2,250 passed; build ok; bundle gate ok (largest chunk 495,189 / 512,000).
• Live, against the built app on a throwaway data dir: setHtmlContent stores the edit, undo restores the original, and redo re-applies it.
• The group drag was not driven live: the verification browser could not composite frames, so React Flow never measured the nodes. It is covered by a hook test through the real middleware and onNodesChange, and by a canvas test that applies a scene update after a group-with-members drag.