@askdkc/dsh-cli 0.12.3 → 0.13.0

package/lib/types/dsh-adapter/compat/sessionLog.d.ts

@@ -1,68 +1,6 @@
-/**
- * Session-log compatibility helpers.
- *
- * Title lookup tolerates event types unknown to the current harness. Offline
- * rename and delete support the `/resume` picker when no live Agent owns the
- * selected persisted session. The resume seam registers vouched-for legacy
- * event types into every reachable KNOWN_SESSION_EVENT_TYPES copy so the
- * strict read path stops rejecting whole sessions over them (issue #153).
- *
- * Registration background: plugins like dsh-working-activity (< the publish
- * cut) appended `activity/status` through `session.append`, but rc.6's
- * append exposes no `ignorable` flag and the type is absent from
- * KNOWN_SESSION_EVENT_TYPES — so resume's seed validation rejects the WHOLE
- * session ("unknown to this harness and not marked ignorable"). Upstream's
- * catalog header defers a registration surface "until such a consumer
- * exists"; the working-activity plugin became that consumer at #119 and
- * registers its type at load. Logs written BEFORE that cut, resumed in a
- * process where the plugin's registration never ran (plugin unmounted, or
- * a bare cordis.yml), still hit the rejection — this module is the consumer
- * for exactly that residue.
- *
- * Why registration and NOT rewriting the log to mark events `ignorable`
- * (the #107 approach, restored then replaced after review): the store is
- * shared with dsh web (#24) and possibly a second TUI instance (#153), and
- * a whole-file tmp+rename swap (a) loses frames an already-open appender
- * lands on the replaced inode, (b) drops the backend's 0600 artifact mode,
- * (c) re-encodes frames without the writer's checksum flag, and (d) dies on
- * torn tails the backend itself can recover. Registration touches nothing
- * on disk and degrades to exactly the pre-patch behavior when no copy
- * resolves.
- *
- * Whitelist discipline: ONLY `activity/status` — the type the plugin
- * provably wrote as ephemeral UI frames. Anything else unknown stays
- * unknown: upstream's fail-closed ("likely written by a newer harness") is
- * a feature — silently skipping a REQUIRED future event would reconstruct
- * a wrong session. Retires the day upstream's shared catalog adopts the
- * type or ships a real registration API (the add() calls become no-ops).
- *
- * The second half of this module is the bounded, tolerant, read-only log
- * reader behind the session tree (channel.buildSessionTree): 64 KiB chunked
- * I/O, lazy per-frame zstd decode over an RFC 8878 structural frame walk (a
- * torn final frame — crash mid-flush — is dropped as uncommitted, never
- * fatal), packed-row expansion, an event budget plus a scanned-envelope
- * budget so ignorable-heavy logs cannot multiply the cost of opening the
- * panel, and an inherited-prefix skip so a fork's event budget pays only for
- * its OWN events. It never writes; both stock encodings are read.
- *
- * @module dsh-cli/compat/sessionLog
- */
 import type { SessionEvent } from '@deepseek-ai/dsh-session';
-/**
- * Legacy third-party session-event types the TUI vouches for as ephemeral
- * UI frames — safe for the strict read path to accept and skip. Exported
- * for the regression verifier; grow it only with proof the type was always
- * inert (never load-bearing for session reconstruction).
- *
- * 0.1.5 note: the vouch is not only for OLD logs. `session/color` is written
- * by the TUI itself on every host generation (session-metadata.ts), and
- * 0.1.5's `validateStoredEvents` refuses unknown non-ignorable types at load
- * — without this registration a single color pick makes that session
- * permanently unresumable (probed: SessionFormatUnsupportedError without the
- * vouch, clean load with it). The type stays inert for reconstruction either
- * way: it only re-tints the row.
- */
-export declare const LEGACY_SESSION_EVENT_TYPES: readonly string[];
+/** Informational event vocabulary written by this TUI on the current host. */
+export declare const TUI_SESSION_EVENT_TYPES: readonly string[];
 /**
  * Session-log storage roots, in priority order, mirroring the persistence
  * backend's `root` resolution: cordis.patch.yml sets `DSH_TUI_SESSION_ROOT ?? dshHomePath(
@@ -89,19 +27,7 @@ interface SessionLogFile {
     /** true for session.jsonl.zstd (default), false for compression:"none". */
     readonly compressed: boolean;
 }
-/**
- * Resolve a `persistence.locate()` hint to a readable log. The hint may name
- * the physical artifact directly or the backend's LOGICAL name for it (the
- * jsonl backend's raw-artifact filename carries no encoding suffix), so the
- * compressed twin is probed as well. Since 0.1.5 the hint names the CURRENT
- * generation (`session.vN.jsonl[.zstd]`) without touching the filesystem —
- * for a session never opened since its format was superseded that file does
- * not exist yet, and the authoritative artifact is an older-generation
- * sibling in the same directory. Encoding is sniffed from content, never
- * inferred from the extension.
- * @param hint - Absolute path from SessionPersistence.locate().
- * @returns The readable log, or undefined when nothing materialized there.
- */
+/** Resolve the exact backend artifact or its compressed twin. */
 export declare function resolveLocatedPath(hint: string): SessionLogFile | undefined;
 /** Outcome of reading an EXISTING log through the bounded reader. */
 export interface SessionLogRead {
@@ -150,8 +76,7 @@ export declare function readSessionEventsFromFile(path: string, maxEvents?: numb
  * cost-bounded. Built for the session tree (buildSessionTree), whose browse
  * must satisfy three constraints the strict backend read cannot:
  *
- *  - READ-ONLY: the strict backend read (`persistence.inspect` on pre-0.1.5
- *    hosts, the validated `handle.read` path since) rejects logs carrying
+ *  - READ-ONLY: the strict handle.read path rejects logs carrying
  *    third-party event types (working-activity's `activity/status`), and
  *    the resume seam's answer (in-process type registration, issue #153)
  *    must not be inverted here: opening a picker never rewrites a history
@@ -169,79 +94,20 @@ export declare function readSessionEventsFromFile(path: string, maxEvents?: numb
  *    is the atomic unit (see logRecords) — the budget bounds work ACROSS
  *    frames, never inside one giant flush.
  *
- * Packed rows are expanded with the backend's own `decodeStorageRecord`:
- * the packChunks writer folds each run of same-block delta chunks into ONE
- * `text-chunks`/`reasoning-chunks`/`tool-call-chunks` line (the default —
- * the finding that motivated this reader's third revision), so a line is a
- * storage record, not an event, and seq-less rows must not be dropped as if
- * they were headers. The budget counts EXPANDED events, matching the tree's
- * per-event cost. Malformed packed rows throw inside decodeStorageRecord —
- * corrupt storage degrades to `undefined`, never to silently dropped runs.
- *
- * Torn-tail semantics mirror the backend's own reader: a plain log's
- * unterminated final line (crash mid-append) is uncommitted data and
- * ignored, while an unterminated record INSIDE a complete zstd frame is
- * corruption and fails the read.
- *
- * Envelopes with `ignorable: true` are skipped (the read path's own skip
- * signal) and the seq-less header row is metadata, not an event. Skipped
- * envelopes still count against the SCAN budget (maxScanned): skipping is
- * not free — the I/O, decompress and JSON.parse for them have already been
- * paid — so an ignorable-heavy log cannot bypass the cost bound by keeping
- * its collectible count low. Never throws; returns undefined ONLY when the
- * log is absent — an existing-but-undecodable log returns `failed: true`
- * so the caller degrades to a placeholder instead of escalating to an
- * unbounded strict re-read.
- * @param sessionId - Session whose log should be read.
- * @param maxEvents - Stop before collecting more than this many events
- *   (default: unbounded). 0 collects nothing and reports complete: false
- *   whenever the log holds any collectible event.
- * @param maxScanned - Stop after INSPECTING this many envelopes, collected
- *   or skipped (default: 4× maxEvents + 4096; unbounded when maxEvents is).
- * @param skipBelowSeq - Inherited-prefix cutoff (session-tree dedup):
- *   seq'd events below it are skipped without spending the event budget —
- *   they still count against maxScanned. `session/title` events are always
- *   collected (branch-head labels need them; they never become entries).
- * @returns The read outcome — events, completeness, real scan cost, and a
- *   `failed` marker for safety-cap/corruption bailouts.
+ * Current event envelopes are read with bounded scan and allocation costs.
  */
 export declare function readSessionEventsFromLog(sessionId: string, maxEvents?: number, maxScanned?: number, skipBelowSeq?: number): SessionLogRead | undefined;
-/**
- * Read the exact inherited-prefix length from a log. Pre-V2 physical headers
- * carry it as `seedLength` on the first line; V2/V3 headers only have
- * `isSeeded`, and the cut is the seq of the `session/end-seed` marker event
- * stamped with `inherited: true` — scanned for, bounded, only when the
- * header says the session is seeded. Logical list headers never carry the
- * cut on any generation. Never guesses from snapshot length, and an
- * unseeded or marker-less log reports undefined (no cut to report).
- */
+/** Read the exact current inherited cut from a bounded end-seed marker scan. */
 export declare function readPhysicalHeaderSeedLength(path: string): number | undefined;
 /** Locate a session log by id and read its inherited-prefix cut. */
 export declare function readPhysicalHeaderSeedLengthForSession(sessionId: string): number | undefined;
-/**
- * Register every {@link LEGACY_SESSION_EVENT_TYPES} type as known in EVERY
- * reachable KNOWN_SESSION_EVENT_TYPES copy, ahead of the strict read path
- * (`agents.resume` seed validation, `persistence.load`). Idempotent; never
- * throws.
- *
- * Why a walk instead of a single import: a runtime can load dsh-session
- * more than once (CLI tree vs profile tree, version overlap during
- * upgrades, pnpm peer-context splits), and the strict validator — which
- * lives in the dsh-session-persistence package — consults only ITS OWN
- * tree's copy. Registering through one import leaves the other trees'
- * copies untouched. So from EACH base anchor (this module = the dsh-tui
- * tree, the process entry point = the launcher/CLI tree) the walk
- * registers the tree's own dsh-session AND steps one edge further:
- * resolve the validator package from that same tree, then register the
- * dsh-session copy the validator's entry resolves. A branch that cannot
- * be resolved simply is not there; resolved module paths are deduped.
- */
-export declare function ensureLegacySessionEventTypes(): void;
+/** Register current TUI-owned types in the profile and host validator copies. */
+export declare function registerTuiSessionEventTypes(): void;
 /**
  * Read a session's display title from its persisted log, tolerantly.
  *
- * Why not `persistence.load()`: the backend validates every event against
- * KNOWN_SESSION_EVENT_TYPES and throws the WHOLE load when a third-party
+ * Why not a strict persistence read: the backend validates every event against
+ * KNOWN_SESSION_EVENT_TYPES and rejects the entire read when a third-party
  * plugin wrote an unmarked unknown type. A picker label is
  * read-only UI state: decoding frames directly here keeps titles working
  * for logs the strict path refuses, now and for future plugin event types.

package/lib/types/dsh-adapter/compat/sessionLog.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"sessionLog.d.ts","sourceRoot":"","sources":["../../../../src/dsh-adapter/compat/sessionLog.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAgDG;AACH,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,0BAA0B,CAAA;AAiB5D;;;;;;;;;;;;;GAaG;AACH,eAAO,MAAM,0BAA0B,EAAE,SAAS,MAAM,EAAyC,CAAA;AAKjG;;;;;;;GAOG;AACH,wBAAgB,aAAa,IAAI,MAAM,EAAE,CASxC;AAsED;;;;;;;;;GASG;AACH,wBAAgB,kBAAkB,CAAC,SAAS,EAAE,MAAM,GAAG,MAAM,GAAG,SAAS,CAiBxE;AAqOD,sDAAsD;AACtD,UAAU,cAAc;IACtB,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAA;IACrB,2EAA2E;IAC3E,QAAQ,CAAC,UAAU,EAAE,OAAO,CAAA;CAC7B;AA+SD;;;;;;;;;;;;GAYG;AACH,wBAAgB,kBAAkB,CAAC,IAAI,EAAE,MAAM,GAAG,cAAc,GAAG,SAAS,CAa3E;AAED,qEAAqE;AACrE,MAAM,WAAW,cAAc;IAC7B,QAAQ,CAAC,MAAM,EAAE,SAAS,YAAY,EAAE,CAAA;IACxC,+EAA+E;IAC/E,QAAQ,CAAC,aAAa,CAAC,EAAE,MAAM,CAAA;IAC/B;4DACwD;IACxD,QAAQ,CAAC,QAAQ,EAAE,OAAO,CAAA;IAC1B,uEAAuE;IACvE,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAA;IACxB;;;;;;yDAMqD;IACrD,QAAQ,CAAC,MAAM,CAAC,EAAE,OAAO,CAAA;CAC1B;AAoED;;;;;GAKG;AACH,wBAAgB,iBAAiB,CAAC,SAAS,EAAE,MAAM,GAAG,MAAM,CAE3D;AAED;;;;;;;;;;;;;;GAcG;AACH,wBAAgB,yBAAyB,CACvC,IAAI,EAAE,MAAM,EACZ,SAAS,GAAE,MAAiC,EAC5C,UAAU,GAAE,MAAqC,EACjD,YAAY,GAAE,MAAU,GACvB,cAAc,GAAG,SAAS,CAI5B;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA2DG;AACH,wBAAgB,wBAAwB,CACtC,SAAS,EAAE,MAAM,EACjB,SAAS,GAAE,MAAiC,EAC5C,UAAU,GAAE,MAAqC,EACjD,YAAY,GAAE,MAAU,GACvB,cAAc,GAAG,SAAS,CAI5B;AA4CD;;;;;;;;GAQG;AACH,wBAAgB,4BAA4B,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,GAAG,SAAS,CAqC7E;AAED,oEAAoE;AACpE,wBAAgB,sCAAsC,CAAC,SAAS,EAAE,MAAM,GAAG,MAAM,GAAG,SAAS,CAI5F;AA+BD;;;;;;;;;;;;;;;;;GAiBG;AACH,wBAAgB,6BAA6B,IAAI,IAAI,CAkCpD;AAED;;;;;;;;;;;;;;GAcG;AACH,wBAAgB,uBAAuB,CACrC,SAAS,EAAE,MAAM,GAChB;IAAE,KAAK,CAAC,EAAE,MAAM,CAAC;IAAC,cAAc,EAAE,OAAO,CAAA;CAAE,GAAG,SAAS,CAyBzD;AAyBD;;;;;;;;;;GAUG;AACH,wBAAgB,aAAa,CAAC,KAAK,EAAE,MAAM,GAAG;IAC5C,KAAK,EAAE,MAAM,CAAA;IACb,WAAW,EAAE,MAAM,EAAE,CAAA;IACrB,MAAM,EAAE;QAAE,IAAI,EAAE,MAAM,CAAA;KAAE,CAAA;CACzB,CAEA;AAED;;;;;;;;;;;;;;;;;;;GAmBG;AACH,wBAAgB,kBAAkB,CAAC,SAAS,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,UAAU,GAAG,aAAa,CAyB/F;AAED;;;;;;;;GAQG;AACH,wBAAgB,gBAAgB,CAAC,SAAS,EAAE,MAAM,GAAG,SAAS,GAAG,aAAa,CAwB7E"}
+{"version":3,"file":"sessionLog.d.ts","sourceRoot":"","sources":["../../../../src/dsh-adapter/compat/sessionLog.ts"],"names":[],"mappings":"AAMA,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,0BAA0B,CAAA;AAiB5D,8EAA8E;AAC9E,eAAO,MAAM,uBAAuB,EAAE,SAAS,MAAM,EAAsB,CAAA;AAK3E;;;;;;;GAOG;AACH,wBAAgB,aAAa,IAAI,MAAM,EAAE,CASxC;AAsED;;;;;;;;;GASG;AACH,wBAAgB,kBAAkB,CAAC,SAAS,EAAE,MAAM,GAAG,MAAM,GAAG,SAAS,CAiBxE;AA0CD,sDAAsD;AACtD,UAAU,cAAc;IACtB,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAA;IACrB,2EAA2E;IAC3E,QAAQ,CAAC,UAAU,EAAE,OAAO,CAAA;CAC7B;AA+SD,iEAAiE;AACjE,wBAAgB,kBAAkB,CAAC,IAAI,EAAE,MAAM,GAAG,cAAc,GAAG,SAAS,CAO3E;AAED,qEAAqE;AACrE,MAAM,WAAW,cAAc;IAC7B,QAAQ,CAAC,MAAM,EAAE,SAAS,YAAY,EAAE,CAAA;IACxC,+EAA+E;IAC/E,QAAQ,CAAC,aAAa,CAAC,EAAE,MAAM,CAAA;IAC/B;4DACwD;IACxD,QAAQ,CAAC,QAAQ,EAAE,OAAO,CAAA;IAC1B,uEAAuE;IACvE,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAA;IACxB;;;;;;yDAMqD;IACrD,QAAQ,CAAC,MAAM,CAAC,EAAE,OAAO,CAAA;CAC1B;AAqED;;;;;GAKG;AACH,wBAAgB,iBAAiB,CAAC,SAAS,EAAE,MAAM,GAAG,MAAM,CAE3D;AAED;;;;;;;;;;;;;;GAcG;AACH,wBAAgB,yBAAyB,CACvC,IAAI,EAAE,MAAM,EACZ,SAAS,GAAE,MAAiC,EAC5C,UAAU,GAAE,MAAqC,EACjD,YAAY,GAAE,MAAU,GACvB,cAAc,GAAG,SAAS,CAI5B;AAED;;;;;;;;;;;;;;;;;;;;;;;;GAwBG;AACH,wBAAgB,wBAAwB,CACtC,SAAS,EAAE,MAAM,EACjB,SAAS,GAAE,MAAiC,EAC5C,UAAU,GAAE,MAAqC,EACjD,YAAY,GAAE,MAAU,GACvB,cAAc,GAAG,SAAS,CAI5B;AAmCD,gFAAgF;AAChF,wBAAgB,4BAA4B,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,GAAG,SAAS,CAoC7E;AAED,oEAAoE;AACpE,wBAAgB,sCAAsC,CAAC,SAAS,EAAE,MAAM,GAAG,MAAM,GAAG,SAAS,CAI5F;AAqCD,iFAAiF;AACjF,wBAAgB,4BAA4B,IAAI,IAAI,CAkCnD;AAED;;;;;;;;;;;;;;GAcG;AACH,wBAAgB,uBAAuB,CACrC,SAAS,EAAE,MAAM,GAChB;IAAE,KAAK,CAAC,EAAE,MAAM,CAAC;IAAC,cAAc,EAAE,OAAO,CAAA;CAAE,GAAG,SAAS,CAyBzD;AAyBD;;;;;;;;;;GAUG;AACH,wBAAgB,aAAa,CAAC,KAAK,EAAE,MAAM,GAAG;IAC5C,KAAK,EAAE,MAAM,CAAA;IACb,WAAW,EAAE,MAAM,EAAE,CAAA;IACrB,MAAM,EAAE;QAAE,IAAI,EAAE,MAAM,CAAA;KAAE,CAAA;CACzB,CAEA;AAED;;;;;;;;;;;;;;;;;;;GAmBG;AACH,wBAAgB,kBAAkB,CAAC,SAAS,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,UAAU,GAAG,aAAa,CAyB/F;AAED;;;;;;;;GAQG;AACH,wBAAgB,gBAAgB,CAAC,SAAS,EAAE,MAAM,GAAG,SAAS,GAAG,aAAa,CAwB7E"}

package/lib/types/dsh-adapter/compat/sessionLog.js

@@ -1,23 +1,16 @@
+/**
+ * Bounded reads and offline metadata edits for current session logs.
+ * TUI-owned informational event types are registered before strict reads.
+ * Unsupported older storage formats are left untouched and reported as failed reads.
+ */
+import { SESSION_FORMAT_VERSION } from '@deepseek-ai/dsh-session';
 import { createRequire } from 'node:module';
 import { appendFileSync, closeSync, existsSync, openSync, readdirSync, readFileSync, readSync, realpathSync, rmSync, } from 'node:fs';
 import { dirname, join, sep } from 'node:path';
 import { zstdCompressSync, zstdDecompressSync } from 'node:zlib';
 import { homeDir } from '../../utils/paths.js';
-/**
- * Legacy third-party session-event types the TUI vouches for as ephemeral
- * UI frames — safe for the strict read path to accept and skip. Exported
- * for the regression verifier; grow it only with proof the type was always
- * inert (never load-bearing for session reconstruction).
- *
- * 0.1.5 note: the vouch is not only for OLD logs. `session/color` is written
- * by the TUI itself on every host generation (session-metadata.ts), and
- * 0.1.5's `validateStoredEvents` refuses unknown non-ignorable types at load
- * — without this registration a single color pick makes that session
- * permanently unresumable (probed: SessionFormatUnsupportedError without the
- * vouch, clean load with it). The type stays inert for reconstruction either
- * way: it only re-tints the row.
- */
-export const LEGACY_SESSION_EVENT_TYPES = ['activity/status', 'session/color'];
+/** Informational event vocabulary written by this TUI on the current host. */
+export const TUI_SESSION_EVENT_TYPES = ['session/color'];
 /** Zstd frame magic number, little-endian (0xFD2FB528). */
 const ZSTD_MAGIC = 0xfd2fb528;
 /**
@@ -54,7 +47,7 @@ function isSafeSessionId(sessionId) {
  * dsh-session-format's `CANONICAL_LOG_FILENAME` (that package is not a
  * blessed import, so the rule is re-derived here): version zero keeps the
  * original `session.jsonl`; every later generation carries a lowercase
- * numeric `.vN` component (0.1.5 writes `session.v3.jsonl`). Noncanonical,
+ * numeric `.vN` component. Noncanonical,
  * uppercase, leading-zero, and `.v0` names never identify committed
  * generations. A `.zstd` suffix marks the compressed encoding.
  */
@@ -130,165 +123,27 @@ export function findSessionLogFile(sessionId) {
     }
     return undefined;
 }
-let cachedDecoder;
-function decodeStorageRecord(value) {
-    if (cachedDecoder === undefined) {
-        cachedDecoder = loadUpstreamDecoder() ?? decodeStorageRecordLocal;
-    }
-    return cachedDecoder(value);
-}
-function loadUpstreamDecoder() {
-    try {
-        const req = createRequire(import.meta.url);
-        const mod = req('@deepseek-ai/dsh-session');
-        return typeof mod.decodeStorageRecord === 'function'
-            ? mod.decodeStorageRecord
-            : undefined;
-    }
-    catch {
-        // No resolvable dsh-session copy from this tree — the local decoder is
-        // fully self-contained, so reads still work.
-        return undefined;
-    }
-}
 /* ------------------------------------------------------------------------- *\
- * Local port of the removed dsh-session chunk-rows decoder (0.1.2-rc.1 and
- * earlier, lib/types/chunk-rows.js). Storage rows are a durable-encoding
- * vocabulary, NOT session events: the packChunks writer folded each run of
- * same-block delta chunks into ONE `text-chunks`/`reasoning-chunks`/
- * `tool-call-chunks` line. Row-tagged values validate and expand (a malformed
- * row throws — it is corrupt storage, and treating it as an event would
- * silently drop a whole run); every other value passes through as a single
- * event, unvalidated.
+ * Bounded, tolerant, read-only log reader behind the session tree
+ * (channel.buildSessionTree): 64 KiB chunked I/O, lazy per-frame zstd decode
+ * over an RFC 8878 structural frame walk (a torn final frame — crash
+ * mid-flush — is dropped as uncommitted, never fatal), event envelopes,
+ * an event budget plus a scanned-envelope budget so ignorable-heavy logs
+ * cannot multiply the cost of opening the panel, and an inherited-prefix
+ * skip so a fork's event budget pays only for its OWN events. It never
+ * writes; both stock encodings are read.
 \* ------------------------------------------------------------------------- */
 function isRecordValue(value) {
     return typeof value === 'object' && value !== null;
 }
-/** Exact-key check: `value` has every key in `keys` and nothing else. */
-function hasExactKeys(value, keys) {
-    return Object.keys(value).length === keys.length && keys.every(k => Object.hasOwn(value, k));
-}
-/** The uniform malformed-row diagnostic. */
-function malformedRow(tag, why) {
-    throw new Error(`malformed ${tag} storage row: ${why}`);
-}
-/** Validate the shared run-data fields and the payload/dt arity; returns the member payload. */
-function validateRunData(tag, data, payloadKey) {
-    if (typeof data.turn !== 'number' || typeof data.step !== 'number' || typeof data.index !== 'number') {
-        malformedRow(tag, 'turn/step/index must be numbers');
-    }
-    const payload = data[payloadKey];
-    if (!Array.isArray(payload) || payload.length === 0 || payload.some(entry => typeof entry !== 'string')) {
-        malformedRow(tag, `${payloadKey} must be a non-empty string array`);
-    }
-    const dt = data.dt;
-    if (!Array.isArray(dt) || dt.some(gap => !Number.isSafeInteger(gap))) {
-        malformedRow(tag, 'dt must be an array of safe integers');
-    }
-    if (dt.length !== payload.length - 1) {
-        malformedRow(tag, `dt length ${dt.length} does not match ${payload.length} members`);
-    }
-    return payload;
-}
-/** Validate a row-tagged parsed value's envelope and data, throwing on any malformation. */
-function validateChunkRow(value, tag) {
-    if (!hasExactKeys(value, ['type', 'seq0', 'time0', 'data'])) {
-        malformedRow(tag, 'envelope must be exactly {type, seq0, time0, data}');
-    }
-    if (!Number.isSafeInteger(value['seq0']) || value['seq0'] < 0) {
-        malformedRow(tag, 'seq0 must be a non-negative safe integer');
-    }
-    if (!Number.isSafeInteger(value['time0'])) {
-        malformedRow(tag, 'time0 must be a safe integer');
-    }
-    const data = value['data'];
-    if (!isRecordValue(data))
-        malformedRow(tag, 'data must be an object');
-    const row = data;
-    let payload;
-    if (tag === 'tool-call-chunks') {
-        const withName = hasExactKeys(row, ['turn', 'step', 'index', 'id', 'name', 'dt', 'args']);
-        if (!withName && !hasExactKeys(row, ['turn', 'step', 'index', 'id', 'dt', 'args'])) {
-            malformedRow(tag, 'data must be exactly {turn, step, index, id, name?, dt, args}');
-        }
-        if (typeof row['id'] !== 'string' || (withName && typeof row['name'] !== 'string')) {
-            malformedRow(tag, 'id (and name when present) must be strings');
-        }
-        payload = validateRunData(tag, row, 'args');
-    }
-    else {
-        if (!hasExactKeys(row, ['turn', 'step', 'index', 'dt', 'texts'])) {
-            malformedRow(tag, 'data must be exactly {turn, step, index, dt, texts}');
-        }
-        payload = validateRunData(tag, row, 'texts');
-    }
-    // Reconstruction bounds. The encoder only packs runs whose member seqs and
-    // times are all safe integers, so a running value that leaves safe range is
-    // outside any encoder's image: float arithmetic would round it to a
-    // different number than exact arithmetic, a silent corruption. Within safe
-    // range every step is exact, so the first departure is always caught.
-    const seq0 = value['seq0'];
-    if (!Number.isSafeInteger(seq0 + payload.length - 1)) {
-        malformedRow(tag, 'member seqs must stay safe integers');
-    }
-    let time = value['time0'];
-    for (const gap of row['dt']) {
-        time += gap;
-        if (!Number.isSafeInteger(time)) {
-            malformedRow(tag, 'member times must stay safe integers');
-        }
-    }
-    return { type: tag, seq0, time0: value['time0'], data: row };
-}
-/** Expand a validated row back into its exact original events, in order. */
-function expandChunkRow(row) {
-    const members = row.type === 'tool-call-chunks' ? row.data.args : row.data.texts;
-    const events = [];
-    let time = row.time0;
-    for (let k = 0; k < members.length; k++) {
-        if (k > 0)
-            time += row.data.dt[k - 1];
-        let chunk;
-        switch (row.type) {
-            case 'text-chunks':
-                chunk = { type: 'text-delta', index: row.data.index, text: members[k] };
-                break;
-            case 'reasoning-chunks':
-                chunk = { type: 'reasoning-delta', index: row.data.index, text: members[k] };
-                break;
-            default:
-                chunk = {
-                    type: 'tool-call-delta',
-                    index: row.data.index,
-                    id: row.data.id,
-                    ...(row.data.name !== undefined ? { name: row.data.name } : {}),
-                    argumentsDelta: members[k],
-                };
-                break;
-        }
-        // assistant/chunk is gone from the 0.1.5 SessionEvent union; the events
-        // are reconstructed structurally for the legacy-log replay path.
-        events.push({
-            type: 'assistant/chunk',
-            seq: row.seq0 + k,
-            time,
-            data: { turn: row.data.turn, step: row.data.step, chunk },
-        });
-    }
-    return events;
-}
-/**
- * Structural twin of the removed upstream `decodeStorageRecord`: packed
- * chunk rows expand, everything else passes through as one event.
- */
-function decodeStorageRecordLocal(value) {
+/** Current storage keeps complete event envelopes, never top-level packed chunks. */
+function decodeStorageRecord(value) {
     if (!isRecordValue(value))
-        return [value];
-    const tag = value['type'];
-    if (tag !== 'text-chunks' && tag !== 'reasoning-chunks' && tag !== 'tool-call-chunks') {
-        return [value];
+        throw new Error('session log record is not an object');
+    if (['text-chunks', 'reasoning-chunks', 'tool-call-chunks', 'assistant/chunk'].includes(String(value['type']))) {
+        throw new Error('unsupported legacy session log; convert it with the current DSH format catalog');
     }
-    return expandChunkRow(validateChunkRow(value, tag));
+    return [value];
 }
 /** I/O slice for streamed log reads. */
 const READ_CHUNK = 64 * 1024;
@@ -509,7 +364,7 @@ function* zstdFrames(chunks) {
  * streaming UTF-8 decoder keeps multi-byte characters intact across read
  * chunks. An unterminated FINAL line is a torn write (a crash mid-append):
  * the backend's own reader ignores uncommitted records, and so does this
- * one — the tree must never show events persistence.load() would not
+ * one — the tree must never show events a strict persistence read would not
  * acknowledge.
  * @param chunks - Raw file bytes, in order.
  * @yields Each non-empty newline-terminated line's text, in log order.
@@ -620,19 +475,7 @@ function sniffLogFile(path) {
         }
     }
 }
-/**
- * Resolve a `persistence.locate()` hint to a readable log. The hint may name
- * the physical artifact directly or the backend's LOGICAL name for it (the
- * jsonl backend's raw-artifact filename carries no encoding suffix), so the
- * compressed twin is probed as well. Since 0.1.5 the hint names the CURRENT
- * generation (`session.vN.jsonl[.zstd]`) without touching the filesystem —
- * for a session never opened since its format was superseded that file does
- * not exist yet, and the authoritative artifact is an older-generation
- * sibling in the same directory. Encoding is sniffed from content, never
- * inferred from the extension.
- * @param hint - Absolute path from SessionPersistence.locate().
- * @returns The readable log, or undefined when nothing materialized there.
- */
+/** Resolve the exact backend artifact or its compressed twin. */
 export function resolveLocatedPath(hint) {
     const direct = existsSync(hint) ? sniffLogFile(hint) : undefined;
     if (direct !== undefined)
@@ -640,15 +483,7 @@ export function resolveLocatedPath(hint) {
     const twin = `${hint}.zstd`;
     if (existsSync(twin))
         return { path: twin, compressed: true };
-    // Generation fallback: only when the hint itself is a canonical
-    // generation name — a foreign backend's logical name must not steer a
-    // directory scan. The scan stays inside the backend's own session
-    // directory, so locate's authority over root and workspace key is kept.
-    const base = hint.slice(hint.lastIndexOf(sep) + 1);
-    const withoutSuffix = base.endsWith('.zstd') ? base.slice(0, -'.zstd'.length) : base;
-    if (!GENERATION_LOG_NAME.test(withoutSuffix))
-        return undefined;
-    return selectGenerationLog(dirname(hint), false);
+    return undefined;
 }
 /**
  * Shared bounded read loop over a located log. See readSessionEventsFromLog
@@ -672,6 +507,8 @@ function readEvents(file, maxEvents, maxScanned, skipBelowSeq) {
         for (const record of logRecords(fd, file.compressed)) {
             if (scanned === 0 && isRecordValue(record) && record['type'] === 'session' && Number.isSafeInteger(record['version'])) {
                 formatVersion = record['version'];
+                if (formatVersion !== SESSION_FORMAT_VERSION)
+                    throw new Error('unsupported session log version');
             }
             for (const event of decodeStorageRecord(record)) {
                 // The SCAN budget bounds the real cost drivers — I/O, decompression,
@@ -753,8 +590,7 @@ export function readSessionEventsFromFile(path, maxEvents = Number.POSITIVE_INFI
  * cost-bounded. Built for the session tree (buildSessionTree), whose browse
  * must satisfy three constraints the strict backend read cannot:
  *
- *  - READ-ONLY: the strict backend read (`persistence.inspect` on pre-0.1.5
- *    hosts, the validated `handle.read` path since) rejects logs carrying
+ *  - READ-ONLY: the strict handle.read path rejects logs carrying
  *    third-party event types (working-activity's `activity/status`), and
  *    the resume seam's answer (in-process type registration, issue #153)
  *    must not be inverted here: opening a picker never rewrites a history
@@ -772,41 +608,7 @@ export function readSessionEventsFromFile(path, maxEvents = Number.POSITIVE_INFI
  *    is the atomic unit (see logRecords) — the budget bounds work ACROSS
  *    frames, never inside one giant flush.
  *
- * Packed rows are expanded with the backend's own `decodeStorageRecord`:
- * the packChunks writer folds each run of same-block delta chunks into ONE
- * `text-chunks`/`reasoning-chunks`/`tool-call-chunks` line (the default —
- * the finding that motivated this reader's third revision), so a line is a
- * storage record, not an event, and seq-less rows must not be dropped as if
- * they were headers. The budget counts EXPANDED events, matching the tree's
- * per-event cost. Malformed packed rows throw inside decodeStorageRecord —
- * corrupt storage degrades to `undefined`, never to silently dropped runs.
- *
- * Torn-tail semantics mirror the backend's own reader: a plain log's
- * unterminated final line (crash mid-append) is uncommitted data and
- * ignored, while an unterminated record INSIDE a complete zstd frame is
- * corruption and fails the read.
- *
- * Envelopes with `ignorable: true` are skipped (the read path's own skip
- * signal) and the seq-less header row is metadata, not an event. Skipped
- * envelopes still count against the SCAN budget (maxScanned): skipping is
- * not free — the I/O, decompress and JSON.parse for them have already been
- * paid — so an ignorable-heavy log cannot bypass the cost bound by keeping
- * its collectible count low. Never throws; returns undefined ONLY when the
- * log is absent — an existing-but-undecodable log returns `failed: true`
- * so the caller degrades to a placeholder instead of escalating to an
- * unbounded strict re-read.
- * @param sessionId - Session whose log should be read.
- * @param maxEvents - Stop before collecting more than this many events
- *   (default: unbounded). 0 collects nothing and reports complete: false
- *   whenever the log holds any collectible event.
- * @param maxScanned - Stop after INSPECTING this many envelopes, collected
- *   or skipped (default: 4× maxEvents + 4096; unbounded when maxEvents is).
- * @param skipBelowSeq - Inherited-prefix cutoff (session-tree dedup):
- *   seq'd events below it are skipped without spending the event budget —
- *   they still count against maxScanned. `session/title` events are always
- *   collected (branch-head labels need them; they never become entries).
- * @returns The read outcome — events, completeness, real scan cost, and a
- *   `failed` marker for safety-cap/corruption bailouts.
+ * Current event envelopes are read with bounded scan and allocation costs.
  */
 export function readSessionEventsFromLog(sessionId, maxEvents = Number.POSITIVE_INFINITY, maxScanned = defaultMaxScanned(maxEvents), skipBelowSeq = 0) {
     const file = findSessionLogFileAnyEncoding(sessionId);
@@ -814,18 +616,7 @@ export function readSessionEventsFromLog(sessionId, maxEvents = Number.POSITIVE_
         return undefined;
     return readEvents(file, maxEvents, maxScanned, skipBelowSeq);
 }
-function seedLengthOfPhysicalHeader(record) {
-    if (record === null || typeof record !== 'object' || Array.isArray(record))
-        return undefined;
-    const rec = record;
-    if (rec['type'] !== 'session')
-        return undefined;
-    const seed = rec['seedLength'];
-    if (typeof seed === 'number' && Number.isSafeInteger(seed) && seed >= 0 && !Object.is(seed, -0))
-        return seed;
-    return undefined;
-}
-/** The header's `isSeeded` flag (V2/V3 headers carry it instead of `seedLength`). */
+/** The current header's isSeeded flag. */
 function isSeededPhysicalHeader(record) {
     if (record === null || typeof record !== 'object' || Array.isArray(record))
         return false;
@@ -859,15 +650,7 @@ function inheritedMarkerCut(record) {
  * (the tree detaches the parent edge) instead of an unbounded read.
  */
 const INHERITED_CUT_SCAN_LIMIT = 2_000_000;
-/**
- * Read the exact inherited-prefix length from a log. Pre-V2 physical headers
- * carry it as `seedLength` on the first line; V2/V3 headers only have
- * `isSeeded`, and the cut is the seq of the `session/end-seed` marker event
- * stamped with `inherited: true` — scanned for, bounded, only when the
- * header says the session is seeded. Logical list headers never carry the
- * cut on any generation. Never guesses from snapshot length, and an
- * unseeded or marker-less log reports undefined (no cut to report).
- */
+/** Read the exact current inherited cut from a bounded end-seed marker scan. */
 export function readPhysicalHeaderSeedLength(path) {
     const file = resolveLocatedPath(path);
     if (file === undefined)
@@ -882,9 +665,8 @@ export function readPhysicalHeaderSeedLength(path) {
         for (const record of logRecords(fd, file.compressed)) {
             if (first) {
                 first = false;
-                const seed = seedLengthOfPhysicalHeader(record);
-                if (seed !== undefined)
-                    return seed;
+                if (!isRecordValue(record) || record['version'] !== SESSION_FORMAT_VERSION)
+                    return undefined;
                 if (!isSeededPhysicalHeader(record))
                     return undefined;
                 seeded = true;
@@ -937,7 +719,7 @@ function decodeEvents(buf) {
     }
     if (offsets.length === 0)
         throw new Error('no zstd frame found');
-    return offsets.flatMap((start, i) => {
+    const events = offsets.flatMap((start, i) => {
         const end = i + 1 < offsets.length ? offsets[i + 1] : buf.length;
         const text = zstdDecompressSync(buf.subarray(start, end)).toString('utf8');
         return text
@@ -951,26 +733,14 @@ function decodeEvents(buf) {
             return parsed;
         });
     });
+    const header = events[0];
+    if (header?.['type'] === 'session' && header['version'] !== SESSION_FORMAT_VERSION) {
+        throw new Error('unsupported session log version');
+    }
+    return events;
 }
-/**
- * Register every {@link LEGACY_SESSION_EVENT_TYPES} type as known in EVERY
- * reachable KNOWN_SESSION_EVENT_TYPES copy, ahead of the strict read path
- * (`agents.resume` seed validation, `persistence.load`). Idempotent; never
- * throws.
- *
- * Why a walk instead of a single import: a runtime can load dsh-session
- * more than once (CLI tree vs profile tree, version overlap during
- * upgrades, pnpm peer-context splits), and the strict validator — which
- * lives in the dsh-session-persistence package — consults only ITS OWN
- * tree's copy. Registering through one import leaves the other trees'
- * copies untouched. So from EACH base anchor (this module = the dsh-tui
- * tree, the process entry point = the launcher/CLI tree) the walk
- * registers the tree's own dsh-session AND steps one edge further:
- * resolve the validator package from that same tree, then register the
- * dsh-session copy the validator's entry resolves. A branch that cannot
- * be resolved simply is not there; resolved module paths are deduped.
- */
-export function ensureLegacySessionEventTypes() {
+/** Register current TUI-owned types in the profile and host validator copies. */
+export function registerTuiSessionEventTypes() {
     const roots = [import.meta.url, process.argv[1]].filter((anchor) => typeof anchor === 'string' && anchor.length > 0);
     const visitedAnchors = new Set();
     const registeredCopies = new Set();
@@ -990,7 +760,7 @@ export function ensureLegacySessionEventTypes() {
             if (!registeredCopies.has(copy)) {
                 registeredCopies.add(copy);
                 const mod = req(copy);
-                for (const type of LEGACY_SESSION_EVENT_TYPES) {
+                for (const type of TUI_SESSION_EVENT_TYPES) {
                     mod.KNOWN_SESSION_EVENT_TYPES?.add(type);
                 }
             }
@@ -1011,8 +781,8 @@ export function ensureLegacySessionEventTypes() {
 /**
  * Read a session's display title from its persisted log, tolerantly.
  *
- * Why not `persistence.load()`: the backend validates every event against
- * KNOWN_SESSION_EVENT_TYPES and throws the WHOLE load when a third-party
+ * Why not a strict persistence read: the backend validates every event against
+ * KNOWN_SESSION_EVENT_TYPES and rejects the entire read when a third-party
  * plugin wrote an unmarked unknown type. A picker label is
  * read-only UI state: decoding frames directly here keeps titles working
  * for logs the strict path refuses, now and for future plugin event types.