feat(serve): the defaulted conversation store is ephemeral — wiped each run

The default conversations.kv is a per-run scratch cache (every conversation
is rebuildable by one prompt replay), but the append-only filestore never
compacts: per-turn tail-block rewrites accumulate dead chunk versions
forever — 1.5GB on a dev box from bench traffic alone.

Serve now distinguishes the two lifetimes by who named the store. An unset
-state-store means serve made the file: it is created FRESH at launch
(filestore.Create's O_TRUNC clears whatever a previous run or crash left)
and removed at shutdown. Any explicit -state-store path — even the default's
literal location — is durable per-project state, opened in place and never
wiped; that is the coming state-per-project surface: just set the path.
generate is untouched: stateless runs open no store, -state keeps its own
agent.kv.

wireContinuity returns the cleanup RunServe defers (close + remove when
ephemeral); the degraded no-enabler path returns a callable no-op so the
unconditional defer is safe.

Co-Authored-By: Virgil <virgil@lethean.io>

Author: Snider

go/cmd/lem/serve.go

@@ -36,7 +36,7 @@ func runServeCommand(ctx context.Context, args []string, stdout, stderr io.Write
 	printAdminToken := fs.Bool("print-admin-token", false, "print the admin Bearer token and exit (generates if absent, mode 0600 at ~/Lethean/lem/admin.token)")
 	rotateAdminToken := fs.Bool("rotate-admin-token", false, "regenerate the admin Bearer token, print it, and exit")
 	stateConversations := fs.Bool("state-conversations", true, "conversation continuity: wake each chat from its slept state, append only the new turn, sleep after — no prompt replay (disable with -state-conversations=false)")
-	stateStorePath := fs.String("state-store", "", "conversation state store file (default ~/Lethean/lem/state/conversations.kv)")
+	stateStorePath := fs.String("state-store", "", "conversation state store file for durable per-project state; unset = an ephemeral store at ~/Lethean/lem/state/conversations.kv, wiped fresh each serve run")
 	nativeBackend := fs.Bool("native", false, "serve via the no-cgo native token-loop contract (the default go-inference metal engine already is native)")
 	fs.Usage = func() {
 		name := cliName()

go/serving/serve.go

@@ -55,7 +55,7 @@ type ServeConfig struct {
 
 	// Conversation continuity.
 	StateConversations bool   // wake each chat from its slept state, no prompt replay
-	StateStorePath     string // state store file (default ~/Lethean/lem/state/conversations.kv)
+	StateStorePath     string // durable per-project store file; empty = ephemeral default, wiped each serve run
 
 	// HTTP + admin.
 	ReadTimeout     time.Duration
@@ -117,9 +117,12 @@ func RunServe(ctx context.Context, cfg ServeConfig) error {
 	}
 
 	// Conversation continuity — on by default. Any failure here degrades to
-	// stateless serving with an honest notice; it never blocks the serve.
+	// stateless serving with an honest notice; it never blocks the serve. The
+	// cleanup closes the store at shutdown and clears the DEFAULTED store's
+	// file (per-run scratch); an explicit -state-store survives as the durable
+	// per-project state.
 	if cfg.StateConversations {
-		wireContinuity(ctx, cfg, hotSwap, log)
+		defer wireContinuity(ctx, cfg, hotSwap, log)()
 	}
 
 	if armDrafter {
@@ -188,52 +191,80 @@ func RunServe(ctx context.Context, cfg ServeConfig) error {
 // wireContinuity opens the conversation state store and registers the per-load
 // continuity hook. When no ContinuityEnabler is injected (the registered engine
 // exposes no continuity attach), or the store can't open, serve degrades to
-// stateless with an honest notice rather than failing.
-func wireContinuity(ctx context.Context, cfg ServeConfig, hotSwap *hotSwapResolver, log io.Writer) {
+// stateless with an honest notice rather than failing. The returned cleanup
+// (never nil) runs at serve shutdown: it closes the store, and when the store
+// was the DEFAULTED one it removes the file — the default store is a per-run
+// scratch cache, not an archive.
+func wireContinuity(ctx context.Context, cfg ServeConfig, hotSwap *hotSwapResolver, log io.Writer) func() {
 	if cfg.EnableContinuity == nil {
 		printServe(log, "serve: conversation continuity unavailable on this engine — serving stateless")
-		return
-	}
-	storePath := core.Trim(cfg.StateStorePath)
-	if storePath == "" {
-		if homeR := core.UserHomeDir(); homeR.OK {
-			if home, ok := homeR.Value.(string); ok {
-				storePath = core.PathJoin(home, "Lethean", "lem", "state", "conversations.kv")
-			}
-		}
+		return func() {}
 	}
+	storePath, ephemeral := resolveStateStorePath(cfg.StateStorePath)
 	var store *filestore.Store
 	if storePath != "" {
-		if opened, err := openOrCreateStateStore(ctx, storePath); err == nil {
+		if opened, err := openConversationStore(ctx, storePath, ephemeral); err == nil {
 			store = opened
 		} else {
 			printServe(log, "serve: conversation state store %s: %v", storePath, err)
 		}
 	}
 	if store == nil {
 		printServe(log, "serve: conversation continuity unavailable — serving stateless")
-		return
+		return func() {}
 	}
 	enable := cfg.EnableContinuity
 	hotSwap.setOnLoad(func(model inference.TextModel) {
 		if err := enable(model, store); err != nil {
 			printServe(log, "serve: conversation continuity unavailable (stateless serving continues): %v", err)
 			return
 		}
+		if ephemeral {
+			printServe(log, "serve: conversation continuity ON — chats wake from %s (ephemeral: wiped each serve run; set -state-store for durable per-project state), no prompt replay", storePath)
+			return
+		}
 		printServe(log, "serve: conversation continuity ON — chats wake from %s, no prompt replay", storePath)
 	})
+	return func() {
+		_ = store.Close()
+		if ephemeral {
+			core.Remove(storePath)
+		}
+	}
 }
 
-// openOrCreateStateStore opens an existing conversation state store or creates a
-// fresh one (with its parent directory) at path. Ported from lthn-mlx's serve
-// state wiring.
-func openOrCreateStateStore(ctx context.Context, path string) (*filestore.Store, error) {
+// resolveStateStorePath maps the -state-store flag to the store path and its
+// lifetime: an EMPTY flag means serve made the store itself — the defaulted
+// conversations.kv is ephemeral (wiped fresh at launch, removed at shutdown),
+// so per-turn tail-block rewrites never accumulate across runs. Any explicit
+// path — even the default's literal location — is the durable per-project
+// store and is never wiped.
+func resolveStateStorePath(flagPath string) (path string, ephemeral bool) {
+	if p := core.Trim(flagPath); p != "" {
+		return p, false
+	}
+	if homeR := core.UserHomeDir(); homeR.OK {
+		if home, ok := homeR.Value.(string); ok {
+			return core.PathJoin(home, "Lethean", "lem", "state", "conversations.kv"), true
+		}
+	}
+	return "", false
+}
+
+// openConversationStore opens the conversation state store at path. An
+// ephemeral (defaulted) store is created FRESH every time — filestore.Create's
+// O_TRUNC wipes whatever a previous run (or crash) left behind. A durable
+// (explicit) store opens in place, created on first use.
+func openConversationStore(ctx context.Context, path string, ephemeral bool) (*filestore.Store, error) {
+	if ephemeral {
+		return filestore.Create(ctx, path)
+	}
 	if core.Stat(path).OK {
 		return filestore.Open(ctx, path)
 	}
 	if dir := core.PathDir(path); dir != "" {
 		if r := core.MkdirAll(dir, 0o755); !r.OK {
-			return nil, core.E("serving.openOrCreateStateStore", "mkdir store dir", r.Value.(error))
+			return nil, core.E("serving.openConversationStore", "mkdir store dir", r.Value.(error))
 		}
 	}
 	return filestore.Create(ctx, path)

go/serving/serve_state_store_test.go

@@ -0,0 +1,123 @@
+// SPDX-Licence-Identifier: EUPL-1.2
+
+package serving
+
+import (
+	"context"
+	"testing"
+
+	core "dappco.re/go"
+	"dappco.re/go/inference/model/state"
+)
+
+// statSize returns path's byte size via core.Stat (os.FileInfo behind Result).
+func statSize(t *testing.T, path string) int64 {
+	t.Helper()
+	r := core.Stat(path)
+	if !r.OK {
+		t.Fatalf("stat %s: %v", path, r.Value)
+	}
+	return r.Value.(interface{ Size() int64 }).Size()
+}
+
+// TestResolveStateStorePath_Ephemeral_Good pins the defaulted lane: an empty
+// -state-store resolves to the home-relative conversations.kv AND marks it
+// ephemeral — serve made the store, so serve wipes it per run.
+func TestResolveStateStorePath_Ephemeral_Good(t *testing.T) {
+	path, ephemeral := resolveStateStorePath("")
+	if path == "" || !core.Contains(path, "conversations.kv") {
+		t.Fatalf("default path = %q, want the home conversations.kv", path)
+	}
+	if !ephemeral {
+		t.Fatal("defaulted store must be ephemeral")
+	}
+}
+
+// TestResolveStateStorePath_Explicit_Bad pins the durable lane: any explicit
+// path — even one equal to the default's literal location — is per-project
+// state and is never marked ephemeral.
+func TestResolveStateStorePath_Explicit_Bad(t *testing.T) {
+	path, ephemeral := resolveStateStorePath("/tmp/project-a.kv")
+	if path != "/tmp/project-a.kv" || ephemeral {
+		t.Fatalf("explicit path = (%q, ephemeral=%v), want it kept verbatim and durable", path, ephemeral)
+	}
+}
+
+// TestResolveStateStorePath_Whitespace_Ugly pins trimming: a whitespace-only
+// flag is the unset flag, not a store named " ".
+func TestResolveStateStorePath_Whitespace_Ugly(t *testing.T) {
+	path, ephemeral := resolveStateStorePath("   ")
+	if !ephemeral || !core.Contains(path, "conversations.kv") {
+		t.Fatalf("whitespace flag resolved to (%q, ephemeral=%v), want the ephemeral default", path, ephemeral)
+	}
+}
+
+// TestOpenConversationStore_EphemeralWipes_Good proves the launch wipe: a
+// store re-opened as ephemeral comes back EMPTY — whatever a previous run (or
+// crash) accumulated is gone.
+func TestOpenConversationStore_EphemeralWipes_Good(t *testing.T) {
+	ctx := context.Background()
+	path := t.TempDir() + "/conversations.kv"
+
+	first, err := openConversationStore(ctx, path, true)
+	if err != nil {
+		t.Fatalf("first open: %v", err)
+	}
+	if _, err := first.PutBytes(ctx, []byte("stale-turn-block"), state.PutOptions{}); err != nil {
+		t.Fatalf("put: %v", err)
+	}
+	if err := first.Close(); err != nil {
+		t.Fatalf("close: %v", err)
+	}
+	grown := statSize(t, path)
+
+	second, err := openConversationStore(ctx, path, true)
+	if err != nil {
+		t.Fatalf("second open: %v", err)
+	}
+	defer second.Close()
+	wiped := statSize(t, path)
+	if wiped >= grown {
+		t.Fatalf("ephemeral reopen kept old bytes: %d -> %d, want a fresh (smaller) store", grown, wiped)
+	}
+}
+
+// TestOpenConversationStore_DurableSurvives_Bad proves the explicit lane keeps
+// its bytes across reopens — per-project state is never wiped.
+func TestOpenConversationStore_DurableSurvives_Bad(t *testing.T) {
+	ctx := context.Background()
+	path := t.TempDir() + "/project.kv"
+
+	first, err := openConversationStore(ctx, path, false)
+	if err != nil {
+		t.Fatalf("first open: %v", err)
+	}
+	if _, err := first.PutBytes(ctx, []byte("durable-project-block"), state.PutOptions{}); err != nil {
+		t.Fatalf("put: %v", err)
+	}
+	if err := first.Close(); err != nil {
+		t.Fatalf("close: %v", err)
+	}
+	grown := statSize(t, path)
+
+	second, err := openConversationStore(ctx, path, false)
+	if err != nil {
+		t.Fatalf("second open: %v", err)
+	}
+	defer second.Close()
+	kept := statSize(t, path)
+	if kept != grown {
+		t.Fatalf("durable reopen changed the file: %d -> %d, want untouched", grown, kept)
+	}
+}
+
+// TestWireContinuity_NilEnabler_Ugly pins the cleanup contract: even the
+// degraded (no-enabler) path returns a callable cleanup, so RunServe's
+// unconditional defer never panics.
+func TestWireContinuity_NilEnabler_Ugly(t *testing.T) {
+	cleanup := wireContinuity(context.Background(), ServeConfig{}, newHotSwapResolver("", "", 0, nil), nil)
+	if cleanup == nil {
+		t.Fatal("wireContinuity returned a nil cleanup")
+	}
+	cleanup()
+}