Summary

Two independent 0.12.0 regressions surfaced together in production Slack sessions D0AC6CKBK5K/1776051715.090089 and D0AC6CKBK5K/1776075016.334849:

1. Tool-loop acknowledgement loop (PR feat(sessions): cache-stable message assembly with volatile User-role tail #618). SessionMessageAssembler emitted the volatile turn-context tail as a ChatRole.User message at the end of the list. During a tool loop, Qwen3's ChatML template read the trailing user-role block as a fresh user turn → model restarted its assistant response → scanned back for the last real user content → re-emitted "You're right — I had that backwards" before every tool call, until context hit 262144/262144 and force-compacted. Fix: flip the tail back to ChatRole.System, keep feat(sessions): cache-stable message assembly with volatile User-role tail #618's placement at the end of the list. llama.cpp KV cache is byte-level prefix matching, so the role tag at the end has no effect on cache stability — the cache win from feat(sessions): cache-stable message assembly with volatile User-role tail #618 is preserved.
2. Memory curation blocked by legacy domain NOT NULL (PR refactor(memory): remove Domain concept in favor of audience isolation #588). The Domain refactor removed the column from the in-code schema but shipped no migration. CREATE TABLE IF NOT EXISTS is a no-op on existing DBs, so production databases still had domain TEXT NOT NULL on memory_anchors, memory_documents, memory_records, and memory_edges. Every new-anchor INSERT has been failing with SQLite Error 19 since the refactor — no new memories have been written since 2026-04-12 20:37 despite successful distillation proposals. Fix: one-off scripts/repair-memory-schema.sql that rename/rebuild/copy the four tables without the legacy column, preserving all rows. FTS5 virtual tables are standalone (no content= mode) and do not need touching. No formal migration because Netclaw is single-operator (explicit call from refactor(memory): remove Domain concept in favor of audience isolation #588).

Also cleans up the AcceptedDistillationProposalsRecorded dead-letter warning that fires on every curation write: the existing handler only lived inside Passivating(), so the observer's informational reply landed in dead letters during normal session states. Adds no-op Command<> registrations in Ready(), Processing(), and Compacting(), and captures Sender into a local in HandleRecordAcceptedDistillationProposals before Persist as defense against the standard Akka.NET Persist-callback Sender overwrite.

Changes

Test plan

• dotnet test src/Netclaw.Actors.Tests/Netclaw.Actors.Tests.csproj --filter "FullyQualifiedName~SessionMessageAssemblerTests" → 8/8 passing (5 existing + new regression test)
• dotnet test src/Netclaw.Actors.Tests/Netclaw.Actors.Tests.csproj --filter "FullyQualifiedName~Sessions" → 253/253 passing (no collateral breakage from LlmSessionActor / observer edits)
• dotnet slopwatch analyze → 0 issues
• Dry-run scripts/repair-memory-schema.sql against a copy of the live ~/.netclaw/netclaw.db: row counts preserved (anchors=91, documents=74, records=24, edges=0), zero domain columns remain, all indexes rebuilt
• Apply repair to live DB and confirm daemon forms new memories after restart
• Run a Slack session that requires multi-step tool work after a user correction; confirm no repeating-opener pattern inside a single turn
• Confirm cache_n KV-cache telemetry remains comparable to post-feat(sessions): cache-stable message assembly with volatile User-role tail #618 baseline (not pre-feat(sessions): cache-stable message assembly with volatile User-role tail #618)