Daemon anti-entropy re-finalization overwrites good summaries with garbage at QualityScore 1.0

[galexy]

Summary

The daemon's anti-entropy session finalization pipeline can overwrite good LLM-generated summaries with garbage, and assigns maximum quality scores to unparsable output. Discovered while investigating #445 (dirty team context state from uncommitted session-facts files).

How We Found This

While debugging why the team context repo had 29 staged and 19 untracked files in memory/.session-facts/ (#445), we traced the root cause to a mass re-extraction triggered by changed summary.json content hashes. The hashes changed because the daemon re-finalized ~58 sessions and overwrote their summaries.

What Happened

On Apr 3, a chain of events on a remote machine:

1. ox doctor: recover sessions (ledger commit f2eb49d, 21:01) restored 302 files from LFS stubs and set .needs-summary markers — including on sessions that already had good summaries from the original ox session stop hook
2. Daemon anti-entropy detected markers → enqueued 58 sessions for re-summarization via ClaudeRunner
3. ClaudeRunner spawned fresh Claude Code CLI processes to summarize from raw.jsonl alone
4. Some sessions got proper re-summaries; others got agentic planning text ("I need permission to run commands and write files...")
5. 58 "finalize session" commits landed in the ledger between 21:41–22:37

Example: session 2026-02-13T14-56-ajit-OxmoZK

Before (from original ox session stop): proper title, summary, key_actions, aha_moments, sageox_insights

After (from daemon re-finalize, commit 3cffb8c): empty title, raw LLM planning text in summary field, quality_score: 1, score_reason: "unparsable LLM output, defaulting to upload"

Bugs

Bug A: Anti-entropy overwrites good summaries without comparison

File: internal/daemon/agentwork/session_finalize.go:606-631

ProcessResult unconditionally writes new artifacts. It never checks whether the existing summary.json is better than the new one. A session with a high-quality summary from the original stop hook gets silently overwritten by a potentially worse daemon re-summarization.

Bug B: QualityScore: 1.0 for unparsable LLM output

File: internal/daemon/agentwork/session_finalize.go:624-628

if parseErr != nil {
    summaryResp = &session.SummarizeResponse{
        Summary:      llmOutput,      // raw agent planning text
        QualityScore: 1.0,            // MAXIMUM score — backwards
        ScoreReason:  "unparsable LLM output, defaulting to upload",
    }
}

Unparsable output gets max quality score, ensuring garbage passes all quality gates including the discard check at line 636. Should be 0.0 or below the discard threshold.

Bug C: .needs-summary marker set too broadly

PR #428 added .needs-summary detection for sessions with stub artifacts. But ox doctor set this marker on sessions that already had real LLM-generated summaries — not just stubs. The marker should check whether the existing summary.json is substantive before triggering re-finalization.

Downstream Impact

The corrupted summaries changed content hashes for 58 sessions, which triggered mass re-extraction in the distill pipeline (see #445 for that side of the cascade).

Related

• Distill pipeline leaves uncommitted/untracked session-facts files, blocking team context sync #445 — Distill pipeline leaves uncommitted/untracked session-facts files in team context (the issue that led to discovering this)
• PR fix(session): skip LFS stubs in detect loop, re-summarize stub artifacts #428 — fix(session): skip LFS stubs in detect loop, re-summarize stub artifacts (introduced .needs-summary marker detection)
• PR fix(session): prevent LFS cascade-blocking and cache data loss on push failure #426 — fix(session): prevent LFS cascade-blocking and cache data loss on push failure

Suggested Fixes

1. Guard against summary regression — before overwriting summary.json, compare existing quality. Keep the better summary.
2. Fix QualityScore for unparsable output — set to 0.0 or below discard threshold, not 1.0
3. Narrow .needs-summary scope — only set marker when existing summary is a stub (stats-only), not when it has real LLM content

[galexy]

Confirmed: Re-finalization destroyed summaries and changed content hashes

Verified on a remote machine by comparing git diff --cached on a staged session-facts file:

-{"_meta":{"schema_version":"2","source_type":"session","recorded_at":"2026-02-13","source_hash":"3f3d72f760d20eba"}}
-{"headline":"Daemon as agent child process implementation","summary":"Implemented the daemon-as-child-process lifecycle change for ox-cli. ...","who":"ajit",...,"category":"context"}
-{"headline":"Use ox status to get SageOx team context location...","summary":"User directed the agent to discover and understand Ryan's discussion...","who":"ajit",...,"category":"decision"}
+{"_meta":{"schema_version":"2","source_type":"session","recorded_at":"2026-02-13","source_hash":"9c9b73943bb27a48"}}

What this confirms

1. The re-finalization changed summary.json content — hash went from 3f3d72f760d20eba to 9c9b73943bb27a48 (verified by replicating contentHash() locally against the current summary.json)

2. The garbage summary produces 0 extractable facts — sessionSummaryToFacts() requires s.Title != "" for the context fact, and the garbage summary has "title": "". AgentSummary and AhaMoments are nil. Result: a marker file (header only, no facts) replaces what was previously a 3-line fact file with 2 real facts.

3. Good team knowledge was destroyed — the original facts captured that Ajit implemented the daemon-as-child-process lifecycle and made a deliberate decision to read Ryan's discussion before implementing. Both facts are now gone, replaced by an empty marker.

The cascade

ox doctor recovers LFS stubs
  → sets .needs-summary markers (even on sessions with good summaries)
  → daemon re-finalizes ~58 sessions via ClaudeRunner
  → some LLM calls produce unparsable output
  → fallback: raw LLM text dumped into summary.json at QualityScore 1.0
  → summary.json content hashes change for all affected sessions
  → next distill run: no lookback window → scans all sessions → hash mismatch → re-extracts
  → re-extraction finds 0 facts (garbage summary) → overwrites good fact files with empty markers
  → commit failures leave dirty git state in team context

Impact

This isn't just a dirty git state problem — it's data loss. The original session summaries (from ox session stop where the agent had full context) were replaced by garbage, and the downstream fact files that captured real team decisions were replaced by empty markers.