chore: release v2.24.4

[lindixu6-hash]

Summary

• bump the package version from 2.24.3 to 2.24.4
• prepare the first maintenance release after the independently reviewed fix: keep orphaned linked memories visible in the timeline #260, fix: mark compacted memory injection part as synthetic #248, and chore(deps): bump the minor-and-patch group across 2 directories with 11 updates #256 merges

Included changes

• fix: keep orphaned linked memories visible in the timeline #260 keeps orphaned linked memories visible in the timeline
• fix: mark compacted memory injection part as synthetic #248 marks compaction-restored memory injection as synthetic
• chore(deps): bump the minor-and-patch group across 2 directories with 11 updates #256 updates the verified minor/patch dependency group

Verification

• latest main merge SHA: eda658383a02a3464116820e8837539eca107484
• fix: keep orphaned linked memories visible in the timeline #260 merge SHA passed six-platform package smoke
• fix: mark compacted memory injection part as synthetic #248 merge SHA passed six-platform package smoke
• chore(deps): bump the minor-and-patch group across 2 directories with 11 updates #256 passed 14 repository checks before merge
• a fresh six-platform package smoke is running against the cumulative latest main SHA
• npm latest is currently 2.24.3; repository NPM_TOKEN is configured

Release safety

I will not self-approve or merge this release PR. After independent review and green cumulative verification, the release can be merged and tagged v2.24.4; the existing Release workflow will verify the tag/package version match, publish to npm, and create the GitHub Release.

Release blockers requiring independent owner decision

• Repository license file: npm metadata declares MIT, but main has no LICENSE / COPYING file and GitHub's repository-license API returns 404. The copyright holder should add or explicitly approve the canonical license text before this release is tagged; I will not choose or author that grant on the owner's behalf.
• Publish approval boundary: the Release workflow injects repository-level NPM_TOKEN for every v* tag. The repository has no npm-production Environment or release-tag ruleset. Until that is isolated, only the owner should create the release tag after reviewing the exact merge SHA.

These are governance blockers, not CI failures. The version PR remains intentionally unmerged until independent review resolves them.

[lindixu6-hash]

Release-governance audit added to the PR description. Public evidence: GitHub repository-license API returns 404 and main has no LICENSE/COPYING file, while npm 2.24.3 declares MIT; repository Environments contain only copilot, and NPM_TOKEN is a repository secret consumed by every v* tag. I will keep this release unmerged and untagged until an independent owner decision resolves those boundaries.

[NaNomicon]

Happy to take a look.

[NaNomicon]

Review — release v2.24.4 (v2.24.3 → main)

Scope: static code review of the 5 changes merged into main since v2.24.3 plus this release PR's packaging. Not a functional review of the plugin end-to-end; runtime correctness of the plugin and its full feature set is owned by the author.

The release

PR #261 bumps the version (2.24.3 → 2.24.4). The tag covers 5 changes since v2.24.3:

Change	File	Assessment
#257 ANN search plan (JOIN→CROSS JOIN)	src/services/turso/vector-search.ts:239,245	✅ correct — forces the vector scan first; verified identical to INNER JOIN with real @libsql/client (same rows, SCAN v → SEARCH m plan)
#248 synthetic compaction part	src/index.ts:981	✅ SDK type has the field (types.gen.d.ts:148); matches established pattern at :519
#260 orphaned linked-memories surface	src/services/api-handlers.ts:257-260	✅ no double-render; web group-memories.ts:11 guards dangling links
#258 provider-error rethrow	src/services/auto-capture.ts:487,577,586-588	✅ caller guards instanceof; cleanup runs
#256 dependabot minor/patch	deps (hono, @opencode-ai sdk/plugin, vite)	✅ benign

Verification performed

• bun run typecheck — clean
• bun test — 412 pass / 0 fail (after bun run build; the 9 dist/-boundary tests need build output)
• CROSS JOIN equivalence: ran real @libsql/client in-memory with mismatched row counts, confirmed identical results and a stable plan — ANN forced first, exact-scan fallback intact

Findings

No blockers on shipped behavior.

Two follow-ups, neither holds the release:

1. #257 test asserts SQL text, not behavior (tests/turso-vector-search.test.ts:72-102). It mocks db.all→[] and only checks toContain("CROSS JOIN") + string ordering; the other case's 2-row shard never engages ANN. It would pass even if the planner reordered and search silently degraded. Behavior is correct today (verified), but the test can't catch a future planner/driver regression. → follow-up: result-level ANN test (seed a shard above the ANN threshold, assert returned memory IDs).

2. #258 silent fallback swallow (src/services/auto-capture.ts:576-589). If the opencode provider fails but a manual config exists, the error is logged and the code proceeds — the user never learns their configured provider is broken. → follow-up: non-blocking warning toast on that path.

Nit: prt-compaction-${Date.now()} part-id collision — practically impossible, non-issue.

Release-package fixes

1. Rebase before merge. PR is based on eda2c; main has since added #257 + #258. The "Included changes" list omits them. (Release notes auto-generate from the commit range, so the tag won't lose them — but the PR should describe what it merges.)
2. Patch version is fine. All three are bugfixes (perf, error handling, data visibility); #260 is additive/corrective, not breaking. Keep v2.24.4.

Release gates (owner decisions)

• LICENSE: package.json declares MIT but no LICENSE file exists in git history; the GitHub license API returns 404. Owner must add it or explicitly approve the grant — no one else should author it. However, the owner is not actively working on the repo anymore. I hereby grant you permission to add the MIT license.
• Publish boundary: the release workflow injects the repo-level NPM_TOKEN on every v* tag, and the only release env is copilot with no tag ruleset. Owner should tag manually after reviewing the exact merge SHA.

Suggested sequence

1. Rebase release PR onto current main (stale base).
2. Owner resolves LICENSE + publish boundary.
3. Ship v2.24.4.
4. Open two follow-up PRs: ANN result-level test, provider-fallback warning toast.