@basou/core 0.44.0 → 0.46.0

package/dist/index.d.ts

@@ -106,6 +106,19 @@ declare function removeStopHook(settings: unknown): StopHookRemoval;
 /** Return the installed basou Stop hook command, or null if none is registered. */
 declare function findBasouStopHookCommand(settings: unknown): string | null;
 
+/**
+ * `schema_version` stamped on NEWLY WRITTEN `.basou/manifest.yaml`.
+ *
+ * 0.2.0 requires seconds in every timestamp. That NARROWS the field's domain,
+ * which §7.3 forbids except under the vacuous-narrowing rule the same section
+ * states: no value basou has ever written omits seconds, so the set of
+ * documents this refuses is empty. See `docs/spec/schemas.md` for the read
+ * rule and the measurement. The narrowing is shared with the event format, so
+ * every durable document bumps together.
+ *
+ * Note: basou writes this document.
+ */
+declare const MANIFEST_SCHEMA_VERSION: "0.2.0";
 /**
  * The manifest, plus one guard the loose object cannot express: a TOP-LEVEL
  * `confidential` is refused. It belongs under `policies`, and because the
@@ -278,9 +291,17 @@ declare const SessionInnerImportSchema: z.ZodObject<{
  * validates a payload against the published artifact gets the same answer the
  * importer will give, instead of passing validation and being rejected at run
  * time. Unrelated to the events INSIDE the envelope, which carry their own
- * `schema_version` and are at 0.2.0.
+ * `schema_version` and are at 0.3.0.
+ *
+ * Bumped to 0.2.0 when timestamps began requiring seconds. That narrowing
+ * reaches the envelope's OWN fields -- `session.started_at`, `session.ended_at`
+ * and both `active_intervals` bounds -- so unlike the 0.2.0 event bump, whose
+ * bytes changed only because of the union it embeds, the envelope's own
+ * accepted set moved and the `$id` moves with it. A third party still gets one
+ * answer from the artifact and the importer, which is the whole point of
+ * pinning the version here.
  */
-declare const SESSION_IMPORT_SCHEMA_VERSION: "0.1.0";
+declare const SESSION_IMPORT_SCHEMA_VERSION: "0.2.0";
 declare const SessionImportPayloadSchema: z.ZodObject<{
     schema_version: z.ZodString;
     session: z.ZodObject<{
@@ -802,6 +823,21 @@ type StopHookEvaluation = ({
  * before, so consumers that read only the capture signal are unaffected.
  */
 declare function evaluateStopHook(input: StopHookEvaluationInput): StopHookEvaluation;
+/**
+ * When the session this transcript belongs to started: the timestamp of its
+ * first record that carries a parseable one.
+ *
+ * Used to date what the session is HOLDING. Anything the session read at start
+ * — its instruction files, the protocols rendered into them — is the version
+ * that existed at this instant, so a managed block whose stamp says it changed
+ * after it is newer than the copy in that session's context.
+ *
+ * Not every record carries a timestamp (a leading `summary` record does not),
+ * so this scans forward rather than reading `records[0]` and giving up.
+ * `undefined` means the transcript never said, and callers then say nothing
+ * rather than guess a start.
+ */
+declare function transcriptStartedAt(records: ClaudeTranscriptRecord[]): string | undefined;
 
 /** Alias kept for API symmetry with the claude-code adapter's `CommandLookup`. */
 type CodexCommandLookup = CommandLookup;
@@ -1016,6 +1052,19 @@ type CodexRolloutToPayloadOptions = {
  */
 declare function codexRolloutToImportPayload(records: ReadonlyArray<CodexRolloutRecord>, options: CodexRolloutToPayloadOptions): SessionImportPayload | null;
 
+/**
+ * `schema_version` stamped on NEWLY WRITTEN `.basou/approvals/**`.
+ *
+ * 0.2.0 requires seconds in every timestamp. That NARROWS the field's domain,
+ * which §7.3 forbids except under the vacuous-narrowing rule the same section
+ * states: no value basou has ever written omits seconds, so the set of
+ * documents this refuses is empty. See `docs/spec/schemas.md` for the read
+ * rule and the measurement. The narrowing is shared with the event format, so
+ * every durable document bumps together.
+ *
+ * Note: basou only READS this document -- approvals are placed by an outside orchestrator, so nothing in this tree stamps the version; the constant exists so the published artifact and the accepted set are declared in one place.
+ */
+declare const APPROVAL_SCHEMA_VERSION: "0.2.0";
 /**
  * Lifecycle states of a Basou approval. The status is stored directly on
  * the approval YAML (flat shape) so that pending → resolved transitions
@@ -1177,9 +1226,16 @@ declare function enumerateApprovals(paths: BasouPaths): Promise<{
 declare function isLazyExpired(approval: Approval, now: Date): boolean;
 
 /**
- * `schema_version` stamped on NEWLY WRITTEN events. Bumped to 0.2.0 when
- * `command_executed.duration_ms` became nullable, which widened the field's
- * domain and so is a breaking change to the format.
+ * `schema_version` stamped on NEWLY WRITTEN events.
+ *
+ * 0.3.0 requires seconds in every timestamp. That NARROWS the field's domain,
+ * which §7.3 forbids except under the vacuous-narrowing rule the same section
+ * states: no value basou has ever written omits seconds, so the set of
+ * documents this refuses is empty. See `docs/spec/schemas.md` for the read
+ * rule and the measurement.
+ *
+ * 0.2.0 made `command_executed.duration_ms` nullable, which widened the
+ * field's domain and so is a breaking change to the format.
  *
  * The bump does not change what any value already on disk means: `0` meant "not
  * observed" before and still does. What changes is that a writer now says so
@@ -1188,13 +1244,17 @@ declare function isLazyExpired(approval: Approval, now: Date): boolean;
  * `readObservedDuration`), and the
  * version is a statement about validation, not about interpretation.
  *
- * Reading is unaffected — {@link SchemaVersionSchema} accepts any 0.x.y — so
- * events already on disk keep validating, and are not rewritten in place (a
- * session IS re-derived, and restamped, when its source log grows). Only EVENTS
- * carry this version: the other `.basou/` documents did not change, so their
- * `schema_version` stays 0.1.0.
+ * Reading is unaffected by the 0.2.0 bump — {@link SchemaVersionSchema}
+ * accepts any 0.x.y — so events already on disk keep validating, and are not
+ * rewritten in place (a session IS re-derived, and restamped, when its source
+ * log grows). The 0.3.0 narrowing is what a stored value IS checked against,
+ * which is why it had to be empty of real documents before it could land.
+ *
+ * The 0.3.0 timestamp narrowing is shared, so the other durable documents
+ * (manifest, session, task, approval) bump alongside it. The two caches
+ * (`status`, `task-index`) are rebuilt rather than versioned.
  */
-declare const EVENT_SCHEMA_VERSION: "0.2.0";
+declare const EVENT_SCHEMA_VERSION: "0.3.0";
 declare const SessionStartedEventSchema: z.ZodObject<{
     schema_version: z.ZodString;
     id: z.ZodString & z.ZodType<`evt_${string}`, string, z.core.$ZodTypeInternals<`evt_${string}`, string>>;
@@ -1911,747 +1971,963 @@ declare function replayEvents(sessionDir: string, options?: ReplayOptions): Asyn
 declare function readAllEvents(sessionDir: string, options?: ReplayOptions): Promise<Event[]>;
 
 /**
- * Project roster drift (the "saddle" model). A project's repos are DECLARED
- * once in the manifest's `repos` list; the capture config (`source_roots`) must
- * cover every declared repo. This computes the drift between the two so
- * `basou project check` can surface a declared repo that is NOT being captured
- * — the class of bug where a companion repo was wired into the workspace but
- * never added to `source_roots`, so its work silently fell out of capture.
+ * `schema_version` stamped on NEWLY WRITTEN `.basou/sessions/<id>/session.yaml`.
  *
- * Pure: it compares declared relative paths against captured relative paths and
- * performs no filesystem or git I/O. Paths are compared as declared (both lists
- * use the same machine-portable relative-path form), not resolved on disk.
- */
-type RepoVisibility = "public" | "private" | "future-public";
-/**
- * The audience-driven language axis. Independent of visibility: a private repo
- * can publish English content, a public repo can carry bilingual docs. `en` /
- * `ja` for a single audience, `en+ja` when both are served.
- */
-type RepoLanguage = "en" | "ja" | "en+ja";
-/** A published surface a repo emits: a deployed website or a package registry. */
-type PublishKind = "web" | "npm";
-/**
- * Where a repo's agent instruction files live (the instruction-source axis),
- * independent of visibility / language / publishes. `hub` is basou's native,
- * generated hub-and-spoke topology (canonical in the anchor, gitignored symlinks
- * in each repo); `self` is the additive opt-in where the canonical AGENTS.md is a
- * regular committed file in the repo itself and basou stays hands-off about its
- * content. See {@link instructionMode} for the default (absent => `hub`).
- */
-type RepoInstructions = "hub" | "self";
-/**
- * One published surface. Its visibility and language are INDEPENDENT of the
- * source repo's: a private repo commonly publishes a public website. Both are
- * optional so a surface can be declared
- * before those facts are pinned down (mirroring how `adopt` leaves repo
- * visibility unset for the operator to fill in).
- */
-type PublishTarget = {
-    kind: PublishKind;
-    visibility?: RepoVisibility | undefined;
-    language?: RepoLanguage | undefined;
-};
-type RepoEntry = {
-    /** Path relative to the manifest repo root (e.g. ".", "../takuhon"). */
-    path: string;
-    visibility?: RepoVisibility | undefined;
-    /** Source language (commits/comments/code, read by contributors). Independent of visibility. */
-    language?: RepoLanguage | undefined;
-    /** Published surfaces this repo emits (opt-in; absent for a repo that publishes nothing). */
-    publishes?: PublishTarget[] | undefined;
-    /**
-     * Instruction-source mode. Absent => `hub` (basou's native generated topology),
-     * so an existing roster's behavior is unchanged. `self` opts the repo out of
-     * generation: its AGENTS.md is a hand-authored committed file and basou stays
-     * hands-off. Resolve the effective mode with {@link instructionMode}.
-     */
-    instructions?: RepoInstructions | undefined;
-};
-/**
- * The effective instruction-source mode for a repo: the declared `instructions`,
- * defaulting to `hub` when absent. The default is the single guarantee that an
- * existing roster (which has no `instructions` field) keeps basou's current
- * hub-and-spoke behavior byte-for-byte — every generator branches on this, never
- * on the raw optional field, so "absent => hub" is decided in exactly one place.
+ * 0.2.0 requires seconds in every timestamp. That NARROWS the field's domain,
+ * which §7.3 forbids except under the vacuous-narrowing rule the same section
+ * states: no value basou has ever written omits seconds, so the set of
+ * documents this refuses is empty. See `docs/spec/schemas.md` for the read
+ * rule and the measurement. The narrowing is shared with the event format, so
+ * every durable document bumps together.
+ *
+ * Note: basou writes this document.
  */
-declare function instructionMode(entry: {
-    instructions?: RepoInstructions | undefined;
-}): RepoInstructions;
-type RosterDriftSummary = {
-    declaredCount: number;
-    capturedCount: number;
-    /** Declared in `repos` but absent from `source_roots`: a capture gap. */
-    gaps: RepoEntry[];
-    /** In `source_roots` but not declared in `repos` (e.g. a workspace view, or a stray). */
-    extra: string[];
-    /** Declared paths that are also captured. */
-    matched: string[];
-    /** True when there is no capture gap (every declared repo is covered). */
-    ok: boolean;
-};
+declare const SESSION_SCHEMA_VERSION: "0.2.0";
+/** Session lifecycle states. */
+declare const SessionStatusSchema: z.ZodEnum<{
+    initialized: "initialized";
+    running: "running";
+    waiting_approval: "waiting_approval";
+    completed: "completed";
+    failed: "failed";
+    interrupted: "interrupted";
+    imported: "imported";
+    archived: "archived";
+}>;
+/** Inferred runtime type for {@link SessionStatusSchema}. */
+type SessionStatus = z.infer<typeof SessionStatusSchema>;
 /**
- * Compute the {@link RosterDriftSummary} for a project. A declared repo missing
- * from the captured set is a `gap` (the surfaced suspicion); a captured path not
- * in the declared set is `extra` (commonly the workspace view, which is a
- * capture source but not itself a project repo). With no declared roster, there
- * are no gaps (nothing to check against) and every captured path is `extra`.
+ * Source kind that produced the session.
+ *
+ * - `claude-code-adapter` — a live `basou run claude-code` process wrap.
+ * - `claude-code-import` — derived after the fact from a Claude Code native
+ *   transcript (`~/.claude/projects/*.jsonl`) by `basou import claude-code`.
+ * - `codex-adapter` — a live `basou run codex` process wrap.
+ * - `codex-import` — derived after the fact from an OpenAI Codex native
+ *   rollout log (date-partitioned `~/.codex/sessions`) by `basou import codex`.
+ * - `import` — a round-trip of a Basou-format export (`basou session import`).
+ * - `human` / `terminal` — manually-authored / terminal-recorded sessions.
  */
-declare function summarizeRosterDrift(input: {
-    repos?: RepoEntry[];
-    sourceRoots?: string[];
-}): RosterDriftSummary;
-type SourceRootsReconcile = {
-    /**
-     * The reconciled `source_roots`: the existing entries verbatim, then every
-     * declared repo path that was missing (normalized, in roster order). Existing
-     * order and form are preserved so the manifest diff is minimal and reversible.
-     */
-    next: string[];
-    /** Declared repo paths (normalized) that were appended because `source_roots` did not cover them. */
-    added: string[];
-    /** True when `source_roots` already covers every declared repo (`next` equals the current list). */
-    unchanged: boolean;
-};
+declare const SessionSourceKindSchema: z.ZodEnum<{
+    "claude-code-adapter": "claude-code-adapter";
+    import: "import";
+    "claude-code-import": "claude-code-import";
+    "codex-adapter": "codex-adapter";
+    "codex-import": "codex-import";
+    human: "human";
+    terminal: "terminal";
+}>;
+/** Inferred runtime type for {@link SessionSourceKindSchema}. */
+type SessionSourceKind = z.infer<typeof SessionSourceKindSchema>;
 /**
- * Derive the `source_roots` a project's declared repo roster requires. The
- * roster (`repos`) is the single source of truth for which repos belong to the
- * project; this is the actuator behind `basou project sync`, computing the
- * additive reconciliation so every declared repo is captured.
+ * Optional per-session metrics, computed at import time from the source tool's
+ * native log. Two groups, both optional because not every source records them:
  *
- * ADDITIVE ONLY: it appends declared paths that are missing and never removes
- * an existing entry. A captured-but-undeclared path (commonly the generated
- * workspace view — a legitimate capture source that is not itself a project
- * repo) is preserved; pruning strays is deferred to the slice that generates
- * the view (so basou knows which extras it owns). Existing entries are kept
- * byte-identical; only appended paths are normalized.
+ * - Model-usage rollup (`*_tokens`): the transcript carries per-message token
+ *   usage; these are the session totals. `reasoning_output_tokens` is
+ *   Codex-only, and live `run`/`exec` sessions carry no token usage at all.
+ * - Engaged-time metrics (`active_*`): the billing-oriented active time derived
+ *   from the session's genuine engagement timestamps (conversation turns plus
+ *   action events), with idle gaps capped. `active_intervals` are the merged
+ *   wall-clock ranges (so cross-session totals can de-duplicate overlapping
+ *   work by interval union); `active_time_ms` is their summed duration;
+ *   `active_gap_cap_ms` and `active_time_method` lock the methodology so the
+ *   stored numbers stay interpretable if the method changes later. When a
+ *   source records explicit per-turn intervals (Codex), `active_time_method` is
+ *   `turn-intervals` and the in-turn time is the log's real wall-clock span
+ *   rather than a gap-capped approximation; the active semantics are unchanged.
+ * - `machine_active_time_ms`: model compute time — the summed duration of the
+ *   source's per-turn spans (Codex `task_complete.duration_ms`), a SUBSET of a
+ *   single session's engaged active time. Unlike `active_intervals` it is a
+ *   plain sum, NOT wall-clock-deduplicated, so two concurrent sessions can sum
+ *   past their billable (union) active wall-clock — that is intended (two models
+ *   working at once did two machine-hours in one wall-clock hour). Captured only
+ *   for sources that record per-turn duration (Codex); absent otherwise.
  *
- * Pure: no filesystem or git I/O. Paths are compared in the same normalized
- * form as {@link summarizeRosterDrift}, so a trailing-slash variant of an
- * already-captured repo is not re-appended.
+ * Absent on sessions imported before a given field existed (re-import to
+ * backfill). Live sessions carry no engaged-time metrics and fall back to
+ * event-derived active time at stats time.
  */
-declare function reconcileSourceRoots(input: {
-    repos?: RepoEntry[];
-    sourceRoots?: string[];
-}): SourceRootsReconcile;
+declare const SessionMetricsSchema: z.ZodObject<{
+    output_tokens: z.ZodOptional<z.ZodNumber>;
+    input_tokens: z.ZodOptional<z.ZodNumber>;
+    cached_input_tokens: z.ZodOptional<z.ZodNumber>;
+    reasoning_output_tokens: z.ZodOptional<z.ZodNumber>;
+    active_time_ms: z.ZodOptional<z.ZodNumber>;
+    active_intervals: z.ZodOptional<z.ZodArray<z.ZodObject<{
+        start: z.ZodString;
+        end: z.ZodString;
+    }, z.core.$loose>>>;
+    active_gap_cap_ms: z.ZodOptional<z.ZodNumber>;
+    active_time_method: z.ZodOptional<z.ZodString>;
+    machine_active_time_ms: z.ZodOptional<z.ZodNumber>;
+}, z.core.$loose>;
+/** Inferred runtime type for {@link SessionMetricsSchema}. */
+type SessionMetrics = z.infer<typeof SessionMetricsSchema>;
 /**
- * On-disk classification of a source-root candidate during adoption: a git repo
- * root (→ becomes a roster entry), a resolved-but-non-repo directory (the
- * generated workspace view, `/tmp`, a scratch dir → excluded), or a path that
- * could not be resolved on disk (→ excluded).
+ * Tamper-evidence head anchor for a session whose `events.jsonl` is hash
+ * chained: `head_hash` is the hex sha-256 of the last written event line
+ * (excluding the trailing newline), `event_count` the number of chained lines.
+ * Written by the import / in-place re-import writers and, for a live session
+ * (`exec` / `run` / ad-hoc), by the finalize once it reaches a terminal status.
+ * Absent on a still-live session (the anchor is stamped at finalize) and on a
+ * pre-feature unchained session. Additive optional => no schema_version bump.
+ * `.strict()` because the writers fully own the shape.
  */
-type AdoptCandidateKind = "repo" | "non-repo" | "unresolved";
-type AdoptCandidate = {
-    /** Source-root path as declared (relative to the manifest root). */
-    path: string;
-    /** On-disk classification; the filesystem probing that produces it is the caller's job. */
-    kind: AdoptCandidateKind;
-};
-type RosterAdoptionPlan = {
-    /** Proposed `repos` entries: the candidates that are git repos (visibility left unset for the operator). */
-    repos: RepoEntry[];
-    /** Candidates excluded from the roster, with why (a non-repo directory, or an unresolvable path). */
-    excluded: {
-        path: string;
-        kind: Exclude<AdoptCandidateKind, "repo">;
-    }[];
-};
+declare const SessionIntegritySchema: z.ZodObject<{
+    head_hash: z.ZodString;
+    event_count: z.ZodNumber;
+}, z.core.$strict>;
+/** Inferred runtime type for {@link SessionIntegritySchema}. */
+type SessionIntegrity = z.infer<typeof SessionIntegritySchema>;
 /**
- * Plan a `repos` roster from classified source-root candidates (the actuator
- * behind `basou project adopt`). Pure: it partitions already-classified
- * candidates — the realpath / `.git` filesystem probing that produces each
- * `kind` is the caller's job, so this stays testable without disk I/O.
- *
- * A git repo becomes a roster entry (path only; visibility is left unset because
- * it is a human judgment, kept independent of the other axes). A non-repo
- * (commonly the generated workspace view) or an unresolvable path is excluded and
- * reported, so the operator sees what was dropped and why before editing. Repo
- * paths are deduped by normalized form, preserving the first declared form and
- * order.
+ * Schema for `.basou/sessions/<session_id>/session.yaml`. The minimal
+ * session document carries the actual fields nested under the outer
+ * `session:` key.
  */
-declare function planRosterAdoption(candidates: AdoptCandidate[]): RosterAdoptionPlan;
+declare const SessionSchema: z.ZodObject<{
+    schema_version: z.ZodString;
+    session: z.ZodObject<{
+        id: z.ZodString & z.ZodType<`ses_${string}`, string, z.core.$ZodTypeInternals<`ses_${string}`, string>>;
+        label: z.ZodOptional<z.ZodString>;
+        task_id: z.ZodOptional<z.ZodNullable<z.ZodString & z.ZodType<`task_${string}`, string, z.core.$ZodTypeInternals<`task_${string}`, string>>>>;
+        workspace_id: z.ZodString & z.ZodType<`ws_${string}`, string, z.core.$ZodTypeInternals<`ws_${string}`, string>>;
+        source: z.ZodObject<{
+            kind: z.ZodEnum<{
+                "claude-code-adapter": "claude-code-adapter";
+                import: "import";
+                "claude-code-import": "claude-code-import";
+                "codex-adapter": "codex-adapter";
+                "codex-import": "codex-import";
+                human: "human";
+                terminal: "terminal";
+            }>;
+            version: z.ZodLiteral<"0.1.0">;
+            external_id: z.ZodOptional<z.ZodString>;
+            source_size_bytes: z.ZodOptional<z.ZodNumber>;
+        }, z.core.$loose>;
+        started_at: z.ZodString;
+        ended_at: z.ZodOptional<z.ZodString>;
+        status: z.ZodEnum<{
+            initialized: "initialized";
+            running: "running";
+            waiting_approval: "waiting_approval";
+            completed: "completed";
+            failed: "failed";
+            interrupted: "interrupted";
+            imported: "imported";
+            archived: "archived";
+        }>;
+        working_directory: z.ZodString;
+        invocation: z.ZodObject<{
+            command: z.ZodString;
+            args: z.ZodDefault<z.ZodArray<z.ZodString>>;
+            exit_code: z.ZodNullable<z.ZodNumber>;
+        }, z.core.$loose>;
+        related_files: z.ZodDefault<z.ZodArray<z.ZodString>>;
+        events_log: z.ZodDefault<z.ZodString>;
+        summary: z.ZodOptional<z.ZodNullable<z.ZodString>>;
+        metrics: z.ZodOptional<z.ZodObject<{
+            output_tokens: z.ZodOptional<z.ZodNumber>;
+            input_tokens: z.ZodOptional<z.ZodNumber>;
+            cached_input_tokens: z.ZodOptional<z.ZodNumber>;
+            reasoning_output_tokens: z.ZodOptional<z.ZodNumber>;
+            active_time_ms: z.ZodOptional<z.ZodNumber>;
+            active_intervals: z.ZodOptional<z.ZodArray<z.ZodObject<{
+                start: z.ZodString;
+                end: z.ZodString;
+            }, z.core.$loose>>>;
+            active_gap_cap_ms: z.ZodOptional<z.ZodNumber>;
+            active_time_method: z.ZodOptional<z.ZodString>;
+            machine_active_time_ms: z.ZodOptional<z.ZodNumber>;
+        }, z.core.$loose>>;
+        integrity: z.ZodOptional<z.ZodObject<{
+            head_hash: z.ZodString;
+            event_count: z.ZodNumber;
+        }, z.core.$strict>>;
+    }, z.core.$loose>;
+}, z.core.$loose>;
+/** Inferred runtime type for {@link SessionSchema}. */
+type Session = z.infer<typeof SessionSchema>;
 
 /**
- * The language of the GENERATED-VIEW chrome (headings, labels, verdict prose)
- * in handoff.md / orientation.md / decisions.md / report output.
+ * Threshold above which a still-`running` session with no `session_ended`
+ * event is flagged suspect.
  *
- * This is deliberately narrower than the manifest's repo `language` axis
- * (`en | ja | en+ja`): a generated view has exactly one chrome language, so
- * `en+ja` resolves to `en`. User data (decision titles, notes, labels, file
- * paths) always passes through verbatim — only the tool-generated strings are
- * localized, which is exactly the split this type exists to keep honest.
+ * 24h: long enough that an active long-running session will not be flagged,
+ * short enough that an abandoned process is surfaced within a working day.
+ * Tunable via CLI option in a later step (continuation backlog #23).
  */
-type ViewLanguage = "en" | "ja";
+declare const STUCK_THRESHOLD_MS: number;
+type SuspectReason = "events_say_ended_but_yaml_running" | "running_no_end_event";
+type SessionEntry = {
+    sessionId: string;
+    session: Session;
+    suspect: boolean;
+    suspectReason: SuspectReason | null;
+    /**
+     * The trail store this entry was read from. Its `sessions` directory locates
+     * the session's `events.jsonl`, so a federated caller can replay events from
+     * the store the session actually lives in (not the local store). For a plain
+     * local load this is the `paths` passed to {@link loadSessionEntries}.
+     */
+    sourceRoot: BasouPaths;
+    /**
+     * Federation host label from the registry (`~/.basou/hosts.yaml`), or `null`
+     * for the local store. Surfaced by orientation so a merged, multi-host view
+     * can attribute the latest session / decision / next-step to its host.
+     */
+    host: string | null;
+};
 /**
- * Resolve the generated-view language from a manifest: the workspace speaks
- * the language of its ANCHOR repo (the `repos[]` entry whose path is `.`).
+ * Per-session degradation reason emitted by {@link loadSessionEntries.onSkip}.
  *
- * Rules (fixed by design):
- * - anchor declares `ja`            -> `ja`
- * - anchor declares `en` / `en+ja`  -> `en` (a bilingual surface renders one
- *   chrome; en is the shared floor)
- * - no roster / no anchor entry / no declared language -> `en` (the default
- *   for basou's English-first OSS surface)
+ * - `session_yaml_missing` (ENOENT) and `session_yaml_invalid` (parse or schema
+ *   failure) both omit the entry from the result.
+ * - `events_jsonl_unreadable` still pushes the entry with `suspect=false` so
+ *   the session row remains visible to the caller; only the suspect check is
+ *   degraded. Matches the existing CLI behaviour at
+ *   `packages/cli/src/commands/session.ts` (suspect-check stderr warning).
+ */
+type SessionSkipReason = "session_yaml_missing" | "session_yaml_invalid" | "events_jsonl_unreadable";
+type LoadSessionEntriesOptions = {
+    /**
+     * Single `now` shared across every {@link classifySuspect} call so that
+     * sessions classified back-to-back observe the same instant. Avoids
+     * boundary races where a session at age ≈ 24h would flip between calls.
+     */
+    now: Date;
+    onWarning?: (warning: ReplayWarning, sessionId: string) => void;
+    onSkip?: (sessionId: string, reason: SessionSkipReason) => void;
+};
+/**
+ * A trail store to read in a federated load, tagged with its host label.
+ * `host: null` denotes the local store; a non-null label comes from the host
+ * registry (`~/.basou/hosts.yaml`). `paths` is where that store is reachable
+ * as a local path on this machine (an SSHFS mount, an rsync mirror, etc.) —
+ * basou itself never performs any network I/O to obtain it.
+ */
+type FederatedRoot = {
+    paths: BasouPaths;
+    host: string | null;
+};
+type LoadFederatedOptions = LoadSessionEntriesOptions & {
+    /**
+     * Called when a NON-local root cannot be enumerated (present-but-unreadable
+     * mount, permission error). That root is skipped best-effort so the local
+     * store and other roots still load. The local root (`host: null`) is never
+     * degraded here — its errors propagate, preserving single-store behaviour.
+     * (An absent root path is not an error: {@link enumerateSessionDirs} returns
+     * `[]` on ENOENT, so a dropped mount is simply an empty host.)
+     */
+    onRootUnavailable?: (host: string, error: unknown) => void;
+};
+/**
+ * List session directory names under `paths.sessions`, ULID ascending.
  *
- * Binding the view to the anchor's language is a deliberate, documented
- * coupling: the anchor is the planning/trail home the views live in, so its
- * declared audience is the views' audience. Other repos' languages do not
- * participate.
+ * - Returns `[]` when the sessions directory does not exist (empty workspace
+ *   or pre-init state).
+ * - Throws `Error("Failed to enumerate sessions", { cause })` on other I/O.
+ * - Only directories are returned (`.gitkeep` and other files are filtered).
+ *
+ * Sort order is `Array.prototype.sort()` default (Unicode code-point
+ * compare). ULIDs are Crockford base32 in uppercase, so the natural sort
+ * is also chronological session-start order.
  */
-declare function resolveViewLanguage(manifest: Pick<Manifest, "repos"> | null): ViewLanguage;
+declare function enumerateSessionDirs(paths: BasouPaths): Promise<string[]>;
 /**
- * Manifest-reading convenience for the renderers: resolve the view language
- * for a workspace, defaulting to `en` when the manifest is missing or
- * unreadable (mirrors the orientation renderer's tolerant source_roots read —
- * a broken manifest must never break a view render).
+ * Read and validate `<paths.sessions>/<sessionId>/session.yaml`.
+ *
+ * - Re-throws the yaml-store fixed-message `"YAML file not found"` for
+ *   ENOENT so the caller can branch on it.
+ * - Throws `Error("Failed to read session.yaml", { cause })` for parse
+ *   failures and schema violations (cause is either the YAML parser error
+ *   or the zod error).
  */
-declare function resolveViewLanguageFromPaths(paths: BasouPaths): Promise<ViewLanguage>;
+declare function readSessionYaml(paths: BasouPaths, sessionId: string): Promise<Session>;
 /**
- * Every localized string the four view renderers emit, grouped per renderer
- * with a small `common` set for lines that are byte-identical across views.
- * Parameterized lines are functions so the two languages can order their
- * parts naturally.
+ * Apply a terminal-status mutation to a live session's `session.yaml` AND, in
+ * the same locked write, stamp the tamper-evidence head anchor derived from the
+ * on-disk `events.jsonl` tail. Used by the `exec` / `run` orchestrators for
+ * BOTH terminal writers (the normal end-of-run finalize and the spawn-failure
+ * `failed` finalize).
  *
- * This module is the SINGLE home for generated Japanese — the view chrome here
- * and the instruction-file content in {@link PresetStrings} (the E-5
- * language-lint allowlist points here, not at the renderers/generators), so
- * "user data language" and "tool-generated content language" can never blur
- * together again.
+ * Why locked + anchor-from-tail: live appends chain the LOG only and leave the
+ * anchor for finalize. Reading the final tail under the session lock means a
+ * foreign line appended just before finalize (e.g. a `decision record` attached
+ * to a still-running session) is included in the anchor, and a foreign attach
+ * that arrives after the terminal status is set is rejected by the attach gate
+ * — so the anchor can never disagree with the at-rest log. The whole-document
+ * read-modify-write also preserves any field a foreign locked writer set (e.g.
+ * a task attach's `task_id`).
+ *
+ * The anchor is written only when the log is actually chained with at least one
+ * line; a legacy unchained session (and an empty log) is left with no
+ * `integrity` anchor, matching the import writers. The mutator receives the
+ * full {@link Session} document and typically sets
+ * `session.session.status` / `ended_at` / `invocation.exit_code` /
+ * `related_files`.
+ *
+ * Throws the {@link inspectChainTail} errors (torn / mixed log), the
+ * {@link readSessionYaml} errors, a zod error if the mutation produces an
+ * invalid document, or `Error("Failed to overwrite YAML file")` on a disk
+ * failure.
  */
-type ViewStrings = {
-    /** Localized relative age for prose lines, e.g. "3日4時間前" / "3d 4h ago". */
-    relativeAge: (startedAt: string | null, now: Date) => string;
-    common: {
-        /** "最終 session" — the latest live session pointer. */
-        lastSessionLabel: string;
-        /** "直近の判断" — the latest recorded decision pointer. */
-        latestDecisionLabel: string;
-        /** "直近の変更ファイル" — the latest session's related files. */
-        recentFilesLabel: string;
-        /** "理由" — a track's rationale label. */
-        trackWhyLabel: string;
-        /** Note that the latest decision comes from a different session. */
-        decisionOtherSessionNote: (shortSessionId: string) => string;
-    };
-    orientation: {
-        headingWhere: string;
-        headingRecent: (sessionCount: number) => string;
-        headingInFlight: string;
-        headingForward: string;
-        headingCurrency: string;
-        inFlightTasksHeading: (n: number) => string;
-        /**
-         * Body line under the in-flight-tasks heading when NO task was ever
-         * recorded here. "(none)" states that nothing is pending — a claim about
-         * the work. This one claims only what it can see: that the record is
-         * empty. It says nothing about whether the workspace should use tasks,
-         * and names no command: the renderers report position, and a nudge that
-         * cannot be silenced is noise (see `trackNudge`, which is gated).
-         */
-        noTasksRecorded: string;
-        pendingApprovalsHeading: (n: number) => string;
-        suspectSessionsHeading: (n: number) => string;
-        openTracksHeading: (n: number) => string;
-        /** Stale-decision honesty note under 直近の判断. */
-        decisionStaleNote: (activityAge: string) => string;
-        outOfRootWarning: (count: number, files: string) => string;
-        recentEmpty: string;
-        recentDecisionsLabel: string;
-        recentNextStepLabel: string;
-        recentChangedLabel: string;
-        /** Trails the recent-files line when scratch paths were left out of it. */
-        scratchOmitted: (count: number) => string;
-        trackCloseInstruction: string;
-        nextStepRecordedLabel: (age: string) => string;
-        noteStaleNote: (activityAge: string) => string;
-        fallbackStaleDirection: string;
-        fallbackStaleReferenceLabel: string;
-        trackNudge: string;
-        federatedFreshnessNote: string;
-        bannerUnverifiable: (n: number) => string;
-        bannerStale: (parts: string) => string;
-        partNew: (n: number) => string;
-        partUpdated: (n: number) => string;
-        partsJoiner: string;
-        verdictUnverifiable: (n: number) => [string, string];
-        verdictStale: (parts: string) => [string, string];
-        verdictUpdatedOnly: (n: number) => [string, string];
-        verdictSuspectsAlso: (n: number) => string;
-        verdictEmpty: [string, string];
-        verdictUnprobed: (rel: string, tool: string) => [string, string];
-        verdictCurrent: (rel: string, tool: string, hasHosts: boolean) => string;
-        verdictSuspectsCaveat: (n: number) => string;
-        verdictScopeDisclaimer: string;
-        toolTerminal: string;
-        toolHuman: string;
-        toolImport: string;
-        toolUnknown: string;
-    };
-    handoff: {
-        headingCurrentState: string;
-        headingRecentFiles: string;
-        headingLatestDecision: string;
-        headingOpenTracks: string;
-        headingUnresolved: string;
-        headingReadNext: string;
-        headingNextWork: string;
-        headingSessions: string;
-        lastTaskLabel: string;
-        /** "Work to do next" placeholder: tasks exist, none are open. */
-        noPendingTasks: string;
-        /** "Work to do next" placeholder: no task was ever recorded. */
-        noTasksRecorded: string;
-        decisionStaleNote: string;
-        trackCloseInstruction: string;
-    };
-    decisions: {
-        dateLabel: string;
-        trackKindLine: string;
-        decisionLabel: string;
-    };
-    report: {
-        headingSummary: string;
-        headingVolume: string;
-        headingDecisions: string;
-        headingApprovals: string;
-        headingTasks: string;
-        headingChangedFiles: string;
-        headingSessions: string;
-        headingIntegrity: string;
-    };
-};
-/** Look up the string table for a resolved view language. */
-declare function viewStrings(language: ViewLanguage): ViewStrings;
+declare function finalizeSessionYaml(paths: BasouPaths, sessionId: string, mutate: (session: Session) => void): Promise<void>;
 /**
- * Resolve a GENERATED INSTRUCTION-FILE's content language from the target
- * repo's declared `language`. Unlike the views (workspace-level artifacts that
- * follow the anchor), a preset block lives inside one repo's instruction file,
- * so its audience is that repo's declared audience: `ja` renders Japanese
- * (byte-identical to the pre-i18n output), `en` / `en+ja` / undeclared render
- * English (one content language per generated block; en is the shared floor).
+ * Classify a `running` session as suspect using one of two rules:
+ *
+ * - Rule A (`events_say_ended_but_yaml_running`): events.jsonl contains a
+ *   `session_ended` event but the session.yaml is still `running`. The
+ *   session ended cleanly in the event log but the YAML write was lost or
+ *   never reached.
+ * - Rule B (`running_no_end_event`): no `session_ended` event and the last
+ *   event is older than {@link STUCK_THRESHOLD_MS}. The process likely
+ *   crashed or was killed.
+ *
+ * Sessions that are not `running` are never suspect.
+ *
+ * I/O failure on events.jsonl is re-thrown unwrapped so the caller can
+ * degrade with a warning instead of treating the session as healthy. The
+ * caller is also responsible for surfacing replay warnings via `onWarning`.
  */
-declare function resolveRepoContentLanguage(language: RepoLanguage | undefined): ViewLanguage;
+declare function classifySuspect(paths: BasouPaths, sessionId: string, session: Session, now: Date, onWarning?: (warning: ReplayWarning) => void): Promise<{
+    suspect: boolean;
+    suspectReason: SuspectReason | null;
+}>;
+declare function loadSessionEntries(paths: BasouPaths, options: LoadSessionEntriesOptions): Promise<SessionEntry[]>;
 /**
- * Resolve the content language of a WORKSPACE-LEVEL instruction artifact (the
- * view's AGENTS.md block, the anchor's starter) from an already-gathered
- * roster: the entry flagged `anchor` speaks for the workspace, mirroring the
- * views' anchor-language rule. No anchor entry (or no declared language)
- * resolves to English. When more than one entry carries the flag, the first
- * wins (declared order).
- *
- * Note the anchor is identified by the CALLER-SET flag, not by this module:
- * {@link resolveViewLanguage} keys on the manifest path being `.`, while the
- * instruction-file callers flag the anchor by resolved-path identity. For a
- * conventional manifest (anchor declared as `.`) the two agree; a roster that
- * reaches the anchor only through an aliased path is where they can diverge,
- * and the caller's flag is authoritative for the instruction files.
+ * Federated load across multiple trail stores. Each root's sessions are tagged
+ * with that root's host label and `sourceRoot`, so a caller replays events from
+ * the store the session lives in. De-duped by `sessionId` (a per-host random
+ * ULID), then by `source.external_id` when present — first occurrence wins, so
+ * pass the local root FIRST to keep it authoritative (e.g. over a re-imported
+ * copy of the same vendor session on another host). A non-local root that
+ * cannot be enumerated is reported via `onRootUnavailable` and skipped; the
+ * local root's errors propagate, matching {@link loadSessionEntries}.
  */
-declare function resolveAnchorContentLanguage(repos: ReadonlyArray<{
-    anchor?: boolean | undefined;
-    language?: RepoLanguage | undefined;
-}>): ViewLanguage;
+declare function loadFederatedSessionEntries(roots: ReadonlyArray<FederatedRoot>, options: LoadFederatedOptions): Promise<SessionEntry[]>;
+
 /**
- * Every localized string the instruction-file generators emit: the per-repo
- * preset block, the workspace view's block, and the anchor's starter. Lives in
- * this module for the same reason as {@link ViewStrings}: it is the SINGLE
- * home for generated Japanese, so the language-lint E-5 allowlist stays one
- * file and "generated content language" is always a declaration-driven table
- * lookup, never a hardcode.
+ * Decision-gap surfacer: which recorded decisions are still waiting for someone.
+ *
+ * The rule it applies, stated by the report that motivated it: a decision that
+ * changes what gets built should have a task carrying it, and the ones with no
+ * task are listed. It reads only captured provenance and writes nothing.
+ *
+ * The question is a RELATION — "is any task carrying this decision" — and the
+ * text scan below is only today's way of answering it. Stating it that way is
+ * deliberate: when `task_created` grows a field naming the decision it serves,
+ * honouring that field answers the same question better and is an
+ * implementation change, where redefining the question would not be.
+ *
+ * Two properties are load-bearing:
+ *
+ *  - Nothing here reads what a decision MEANS, so the answer does not depend on
+ *    a model and does not change between runs over the same store.
+ *  - The default is fail-closed: a decision with no task is listed. An opt-in
+ *    mark ("this one produces work") was rejected upstream because forgetting
+ *    the mark is the same failure the report exists to catch.
+ *
+ * Fail-closed only pays for itself if the list is drainable, so the population
+ * is cut on four structural grounds — a timestamp, a `source`, a `kind`, and a
+ * void. None requires reading meaning, and each is reported as a count so the
+ * cut is never silent:
+ *
+ *  - {@link DECISION_GAPS_EPOCH}: decisions predating this feature are out of
+ *    scope. Applying the rule to a whole history measured ~1450 entries on the
+ *    store it was built against, which buries the signal on day one.
+ *  - {@link LOCAL_CLI_EVENT_SOURCE}: only decisions somebody recorded by
+ *    running basou (`basou decision capture` or `basou decision record`), as
+ *    opposed to ones a reader derived. An importer derives decisions from a
+ *    transcript's in-conversation questions ("how far should I implement? ->
+ *    findings 1 and 3"), which were 70% of that store's decisions and 0 of the
+ *    ones any task carried. Those are answers given while working, not plans
+ *    anybody ratified.
+ *  - `kind: "track"`: a track is ALREADY resurfaced, every session, until it is
+ *    voided — orientation and handoff both carry it under "open tracks". For a
+ *    track the premise "recorded, then never surfaced again" is false by
+ *    construction, so listing it here says nothing the reader is not already
+ *    shown, and it measured 27-45% of the list.
+ *  - voided: `basou decision void` is the closing verb this product tells the
+ *    operator to use, and a direction no longer in force is not waiting for
+ *    anyone. Honouring it everywhere gives the operator ONE verb that closes;
+ *    refusing it here would leave a list drainable only by writing a sham task.
+ *
+ * What it will not do is decide a decision's fate on anything it cannot check.
+ * A task naming an id that no decision in the store has does NOT count as
+ * carrying it, and a store it could only partly read says so rather than
+ * reporting a clean answer over the part it managed.
+ */
+/**
+ * Start of the population: decisions recorded before this instant are out of
+ * scope, whatever else is true of them.
+ *
+ * A fixed constant rather than per-workspace state, so every workspace answers
+ * the same question and nothing has to be initialised or migrated. The value is
+ * the instant this was written; a release landing later, or a workspace first
+ * running it later, only means that run starts with the decisions recorded in
+ * between, and {@link DecisionGapsSummary.scope} reports the boundary on every
+ * run so the head start is never silent. `--since` overrides it.
+ */
+declare const DECISION_GAPS_EPOCH = "2026-09-18T12:00:00.000Z";
+/** A decision in the population that no task carries. */
+type DecisionGap = {
+    decisionId: string;
+    title: string;
+    recordedAt: string;
+    sessionId: string;
+};
+/** The population's boundaries, as the run actually applied them. */
+type DecisionGapsScope = {
+    /** Decisions recorded before this instant are out of scope. */
+    start: string;
+    /** Only decisions this event source recorded are in scope. */
+    source: string;
+};
+/**
+ * Why decisions left the population, by ground. The grounds are applied in this
+ * order and each decision is counted under the FIRST that excludes it, so these
+ * partition the excluded set.
  */
-type PresetStrings = {
-    repoBlock: {
-        heading: string;
-        intro: string;
-        /** Source git-visibility, rendered with the consequence the agent must respect. */
-        visibilityLabel: (v: RepoVisibility | undefined) => string;
-        /**
-         * Source language (commits/comments/code), rendered with the audience it
-         * serves. Invariant note: the table itself is SELECTED by this same field
-         * (ja -> JA table, everything else -> EN), so the JA table's en / en+ja /
-         * unset branches and the EN table's ja branch are unreachable from
-         * renderPresetBlock — they exist for table completeness (and the
-         * both-language sweep test), not because a render can emit them.
-         */
-        sourceLanguageLabel: (l: RepoLanguage | undefined) => string;
-        /** Published-surface kind. */
-        publishKindLabel: (k: PublishTarget["kind"]) => string;
-        /** A published surface's visibility (independent of the source repo's). */
-        publishVisibilityLabel: (v: RepoVisibility | undefined) => string;
-        /** A published surface's content language (read by end users; may differ from source). */
-        contentLanguageLabel: (l: RepoLanguage | undefined) => string;
-        /** "ソース可視性" — the source-visibility line label. */
-        sourceVisibilityLabel: string;
-        /** "ソース言語" — the source-language line label. */
-        sourceLanguageLineLabel: string;
-        /** "- 配信物: なし" — no published surfaces. */
-        publishesNone: string;
-        /** "- 配信物:" — the published-surfaces list header. */
-        publishesHeader: string;
-    };
-    viewBlock: {
-        heading: string;
-        intro: string;
-        selfNote: (viewName: string) => string;
-        aggregates: (repoCount: number) => string;
-        reposHeading: string;
-        tableHeader: string;
-        /** Instruction-file ownership labels: who writes the repo's AGENTS.md. */
-        instructionsAnchor: string;
-        instructionsSelf: string;
-        instructionsHub: string;
-        /** "未設定" — the short table cell for an undeclared visibility / language. */
-        unsetShort: string;
-        commitHeading: string;
-        commitBody: string;
-        conventionsHeading: string;
-        conventionsBody: string;
-        principlesHeading: string;
-        principleStateless: string;
-        principleNoFiles: string;
-    };
-    anchorStarter: {
-        identityLine: (title: string) => string;
-        starterNote: string;
-        basicsHeading: string;
-        basicsTodo: string;
-        commitHeading: string;
-        commitPlanning: string;
-        commitImplementation: string;
-        commitView: string;
-        conventionsHeading: string;
-        conventionsBody: string;
-        viewPointerLine: (viewName: string) => string;
-        policyHeading: string;
-        policyTodo: string[];
-    };
+type DecisionGapsExcluded = {
+    /** Recorded before {@link DecisionGapsScope.start}. */
+    byStart: number;
+    /** Recorded by something other than {@link DecisionGapsScope.source}. */
+    bySource: number;
+    /** `kind: "track"` — already resurfaced every session until closed. */
+    track: number;
+    /** Closed with `basou decision void`. */
+    voided: number;
 };
-/** Look up the instruction-file string table for a resolved content language. */
-declare function presetStrings(language: ViewLanguage): PresetStrings;
-
-/** Session lifecycle states. */
-declare const SessionStatusSchema: z.ZodEnum<{
-    initialized: "initialized";
-    running: "running";
-    waiting_approval: "waiting_approval";
-    completed: "completed";
-    failed: "failed";
-    interrupted: "interrupted";
-    imported: "imported";
-    archived: "archived";
-}>;
-/** Inferred runtime type for {@link SessionStatusSchema}. */
-type SessionStatus = z.infer<typeof SessionStatusSchema>;
 /**
- * Source kind that produced the session.
+ * What the run could not read. Every field here can only make {@link
+ * DecisionGapsSummary.gaps} wrong in a way the reader cannot see, so a non-zero
+ * count is reported rather than absorbed.
+ */
+type DecisionGapsIncomplete = {
+    /**
+     * Sessions this run could not read in full — a `session.yaml` that is missing
+     * or does not validate, or an event log that failed to read.
+     *
+     * What was lost is not knowable from here: a log that fails partway through
+     * has already yielded some events, so a session counted here may have
+     * contributed everything, nothing, or part of what it holds. A decision of
+     * theirs can therefore be missing from every count, and a void of theirs may
+     * not have closed what it closes — so both a missing row and a wrongly
+     * present one are possible.
+     */
+    sessions: number;
+    /** Task files that could not be read, so any decision they carry looks uncarried. */
+    tasks: number;
+    /**
+     * Ids named by a task that no decision in the store has. Counted, and
+     * deliberately NOT treated as carrying anything: a string nobody recorded
+     * must not be able to take a decision off this list.
+     */
+    unknownReferences: number;
+};
+type DecisionGapsSummary = {
+    generatedAt: string;
+    scope: DecisionGapsScope;
+    /** Decisions with no task carrying them, newest first. Capped by `limit`. */
+    gaps: DecisionGap[];
+    /** Entries omitted from `gaps` by `limit`; 0 when nothing was cut. */
+    truncated: number;
+    /** Population members some task carries. */
+    carried: number;
+    /** `gaps.length + truncated + carried`. */
+    populationCount: number;
+    excluded: DecisionGapsExcluded;
+    incomplete: DecisionGapsIncomplete;
+    /** Task files read (live and archived). */
+    tasksScanned: number;
+};
+type DecisionGapsInput = {
+    paths: BasouPaths;
+    nowIso: string;
+    /** Defaults to {@link DECISION_GAPS_EPOCH}. */
+    start?: string;
+    /**
+     * Maximum entries in `gaps`; the rest are counted in `truncated`. `0` yields
+     * an empty `gaps` with everything in `truncated` — it is a cap of zero, not
+     * "uncapped". Omit the field for uncapped. (The CLI's `--limit 0` means
+     * uncapped and omits this.)
+     */
+    limit?: number;
+    onWarning?: (warning: ReplayWarning, sessionId: string) => void;
+    onSessionSkip?: (sessionId: string, reason: SessionSkipReason) => void;
+};
+/**
+ * Find decisions in the population that no task carries.
  *
- * - `claude-code-adapter` — a live `basou run claude-code` process wrap.
- * - `claude-code-import` — derived after the fact from a Claude Code native
- *   transcript (`~/.claude/projects/*.jsonl`) by `basou import claude-code`.
- * - `codex-adapter` — a live `basou run codex` process wrap.
- * - `codex-import` — derived after the fact from an OpenAI Codex native
- *   rollout log (date-partitioned `~/.codex/sessions`) by `basou import codex`.
- * - `import` — a round-trip of a Basou-format export (`basou session import`).
- * - `human` / `terminal` — manually-authored / terminal-recorded sessions.
+ * Ordering is `recordedAt` descending with the decision id (a ULID, so
+ * monotonic) as tie-breaker, giving a stable newest-first list.
  */
-declare const SessionSourceKindSchema: z.ZodEnum<{
-    "claude-code-adapter": "claude-code-adapter";
-    import: "import";
-    "claude-code-import": "claude-code-import";
-    "codex-adapter": "codex-adapter";
-    "codex-import": "codex-import";
-    human: "human";
-    terminal: "terminal";
-}>;
-/** Inferred runtime type for {@link SessionSourceKindSchema}. */
-type SessionSourceKind = z.infer<typeof SessionSourceKindSchema>;
+declare function findDecisionGaps(input: DecisionGapsInput): Promise<DecisionGapsSummary>;
+
 /**
- * Optional per-session metrics, computed at import time from the source tool's
- * native log. Two groups, both optional because not every source records them:
+ * Project roster drift (the "saddle" model). A project's repos are DECLARED
+ * once in the manifest's `repos` list; the capture config (`source_roots`) must
+ * cover every declared repo. This computes the drift between the two so
+ * `basou project check` can surface a declared repo that is NOT being captured
+ * — the class of bug where a companion repo was wired into the workspace but
+ * never added to `source_roots`, so its work silently fell out of capture.
  *
- * - Model-usage rollup (`*_tokens`): the transcript carries per-message token
- *   usage; these are the session totals. `reasoning_output_tokens` is
- *   Codex-only, and live `run`/`exec` sessions carry no token usage at all.
- * - Engaged-time metrics (`active_*`): the billing-oriented active time derived
- *   from the session's genuine engagement timestamps (conversation turns plus
- *   action events), with idle gaps capped. `active_intervals` are the merged
- *   wall-clock ranges (so cross-session totals can de-duplicate overlapping
- *   work by interval union); `active_time_ms` is their summed duration;
- *   `active_gap_cap_ms` and `active_time_method` lock the methodology so the
- *   stored numbers stay interpretable if the method changes later. When a
- *   source records explicit per-turn intervals (Codex), `active_time_method` is
- *   `turn-intervals` and the in-turn time is the log's real wall-clock span
- *   rather than a gap-capped approximation; the active semantics are unchanged.
- * - `machine_active_time_ms`: model compute time — the summed duration of the
- *   source's per-turn spans (Codex `task_complete.duration_ms`), a SUBSET of a
- *   single session's engaged active time. Unlike `active_intervals` it is a
- *   plain sum, NOT wall-clock-deduplicated, so two concurrent sessions can sum
- *   past their billable (union) active wall-clock — that is intended (two models
- *   working at once did two machine-hours in one wall-clock hour). Captured only
- *   for sources that record per-turn duration (Codex); absent otherwise.
- *
- * Absent on sessions imported before a given field existed (re-import to
- * backfill). Live sessions carry no engaged-time metrics and fall back to
- * event-derived active time at stats time.
+ * Pure: it compares declared relative paths against captured relative paths and
+ * performs no filesystem or git I/O. Paths are compared as declared (both lists
+ * use the same machine-portable relative-path form), not resolved on disk.
  */
-declare const SessionMetricsSchema: z.ZodObject<{
-    output_tokens: z.ZodOptional<z.ZodNumber>;
-    input_tokens: z.ZodOptional<z.ZodNumber>;
-    cached_input_tokens: z.ZodOptional<z.ZodNumber>;
-    reasoning_output_tokens: z.ZodOptional<z.ZodNumber>;
-    active_time_ms: z.ZodOptional<z.ZodNumber>;
-    active_intervals: z.ZodOptional<z.ZodArray<z.ZodObject<{
-        start: z.ZodString;
-        end: z.ZodString;
-    }, z.core.$loose>>>;
-    active_gap_cap_ms: z.ZodOptional<z.ZodNumber>;
-    active_time_method: z.ZodOptional<z.ZodString>;
-    machine_active_time_ms: z.ZodOptional<z.ZodNumber>;
-}, z.core.$loose>;
-/** Inferred runtime type for {@link SessionMetricsSchema}. */
-type SessionMetrics = z.infer<typeof SessionMetricsSchema>;
+type RepoVisibility = "public" | "private" | "future-public";
 /**
- * Tamper-evidence head anchor for a session whose `events.jsonl` is hash
- * chained: `head_hash` is the hex sha-256 of the last written event line
- * (excluding the trailing newline), `event_count` the number of chained lines.
- * Written by the import / in-place re-import writers and, for a live session
- * (`exec` / `run` / ad-hoc), by the finalize once it reaches a terminal status.
- * Absent on a still-live session (the anchor is stamped at finalize) and on a
- * pre-feature unchained session. Additive optional => no schema_version bump.
- * `.strict()` because the writers fully own the shape.
+ * The audience-driven language axis. Independent of visibility: a private repo
+ * can publish English content, a public repo can carry bilingual docs. `en` /
+ * `ja` for a single audience, `en+ja` when both are served.
  */
-declare const SessionIntegritySchema: z.ZodObject<{
-    head_hash: z.ZodString;
-    event_count: z.ZodNumber;
-}, z.core.$strict>;
-/** Inferred runtime type for {@link SessionIntegritySchema}. */
-type SessionIntegrity = z.infer<typeof SessionIntegritySchema>;
+type RepoLanguage = "en" | "ja" | "en+ja";
+/** A published surface a repo emits: a deployed website or a package registry. */
+type PublishKind = "web" | "npm";
 /**
- * Schema for `.basou/sessions/<session_id>/session.yaml`. The minimal
- * session document carries the actual fields nested under the outer
- * `session:` key.
+ * Where a repo's agent instruction files live (the instruction-source axis),
+ * independent of visibility / language / publishes. `hub` is basou's native,
+ * generated hub-and-spoke topology (canonical in the anchor, gitignored symlinks
+ * in each repo); `self` is the additive opt-in where the canonical AGENTS.md is a
+ * regular committed file in the repo itself and basou stays hands-off about its
+ * content. See {@link instructionMode} for the default (absent => `hub`).
  */
-declare const SessionSchema: z.ZodObject<{
-    schema_version: z.ZodString;
-    session: z.ZodObject<{
-        id: z.ZodString & z.ZodType<`ses_${string}`, string, z.core.$ZodTypeInternals<`ses_${string}`, string>>;
-        label: z.ZodOptional<z.ZodString>;
-        task_id: z.ZodOptional<z.ZodNullable<z.ZodString & z.ZodType<`task_${string}`, string, z.core.$ZodTypeInternals<`task_${string}`, string>>>>;
-        workspace_id: z.ZodString & z.ZodType<`ws_${string}`, string, z.core.$ZodTypeInternals<`ws_${string}`, string>>;
-        source: z.ZodObject<{
-            kind: z.ZodEnum<{
-                "claude-code-adapter": "claude-code-adapter";
-                import: "import";
-                "claude-code-import": "claude-code-import";
-                "codex-adapter": "codex-adapter";
-                "codex-import": "codex-import";
-                human: "human";
-                terminal: "terminal";
-            }>;
-            version: z.ZodLiteral<"0.1.0">;
-            external_id: z.ZodOptional<z.ZodString>;
-            source_size_bytes: z.ZodOptional<z.ZodNumber>;
-        }, z.core.$loose>;
-        started_at: z.ZodString;
-        ended_at: z.ZodOptional<z.ZodString>;
-        status: z.ZodEnum<{
-            initialized: "initialized";
-            running: "running";
-            waiting_approval: "waiting_approval";
-            completed: "completed";
-            failed: "failed";
-            interrupted: "interrupted";
-            imported: "imported";
-            archived: "archived";
-        }>;
-        working_directory: z.ZodString;
-        invocation: z.ZodObject<{
-            command: z.ZodString;
-            args: z.ZodDefault<z.ZodArray<z.ZodString>>;
-            exit_code: z.ZodNullable<z.ZodNumber>;
-        }, z.core.$loose>;
-        related_files: z.ZodDefault<z.ZodArray<z.ZodString>>;
-        events_log: z.ZodDefault<z.ZodString>;
-        summary: z.ZodOptional<z.ZodNullable<z.ZodString>>;
-        metrics: z.ZodOptional<z.ZodObject<{
-            output_tokens: z.ZodOptional<z.ZodNumber>;
-            input_tokens: z.ZodOptional<z.ZodNumber>;
-            cached_input_tokens: z.ZodOptional<z.ZodNumber>;
-            reasoning_output_tokens: z.ZodOptional<z.ZodNumber>;
-            active_time_ms: z.ZodOptional<z.ZodNumber>;
-            active_intervals: z.ZodOptional<z.ZodArray<z.ZodObject<{
-                start: z.ZodString;
-                end: z.ZodString;
-            }, z.core.$loose>>>;
-            active_gap_cap_ms: z.ZodOptional<z.ZodNumber>;
-            active_time_method: z.ZodOptional<z.ZodString>;
-            machine_active_time_ms: z.ZodOptional<z.ZodNumber>;
-        }, z.core.$loose>>;
-        integrity: z.ZodOptional<z.ZodObject<{
-            head_hash: z.ZodString;
-            event_count: z.ZodNumber;
-        }, z.core.$strict>>;
-    }, z.core.$loose>;
-}, z.core.$loose>;
-/** Inferred runtime type for {@link SessionSchema}. */
-type Session = z.infer<typeof SessionSchema>;
-
+type RepoInstructions = "hub" | "self";
 /**
- * Threshold above which a still-`running` session with no `session_ended`
- * event is flagged suspect.
- *
- * 24h: long enough that an active long-running session will not be flagged,
- * short enough that an abandoned process is surfaced within a working day.
- * Tunable via CLI option in a later step (continuation backlog #23).
+ * One published surface. Its visibility and language are INDEPENDENT of the
+ * source repo's: a private repo commonly publishes a public website. Both are
+ * optional so a surface can be declared
+ * before those facts are pinned down (mirroring how `adopt` leaves repo
+ * visibility unset for the operator to fill in).
  */
-declare const STUCK_THRESHOLD_MS: number;
-type SuspectReason = "events_say_ended_but_yaml_running" | "running_no_end_event";
-type SessionEntry = {
-    sessionId: string;
-    session: Session;
-    suspect: boolean;
-    suspectReason: SuspectReason | null;
-    /**
-     * The trail store this entry was read from. Its `sessions` directory locates
-     * the session's `events.jsonl`, so a federated caller can replay events from
-     * the store the session actually lives in (not the local store). For a plain
-     * local load this is the `paths` passed to {@link loadSessionEntries}.
-     */
-    sourceRoot: BasouPaths;
+type PublishTarget = {
+    kind: PublishKind;
+    visibility?: RepoVisibility | undefined;
+    language?: RepoLanguage | undefined;
+};
+type RepoEntry = {
+    /** Path relative to the manifest repo root (e.g. ".", "../takuhon"). */
+    path: string;
+    visibility?: RepoVisibility | undefined;
+    /** Source language (commits/comments/code, read by contributors). Independent of visibility. */
+    language?: RepoLanguage | undefined;
+    /** Published surfaces this repo emits (opt-in; absent for a repo that publishes nothing). */
+    publishes?: PublishTarget[] | undefined;
     /**
-     * Federation host label from the registry (`~/.basou/hosts.yaml`), or `null`
-     * for the local store. Surfaced by orientation so a merged, multi-host view
-     * can attribute the latest session / decision / next-step to its host.
+     * Instruction-source mode. Absent => `hub` (basou's native generated topology),
+     * so an existing roster's behavior is unchanged. `self` opts the repo out of
+     * generation: its AGENTS.md is a hand-authored committed file and basou stays
+     * hands-off. Resolve the effective mode with {@link instructionMode}.
      */
-    host: string | null;
+    instructions?: RepoInstructions | undefined;
 };
 /**
- * Per-session degradation reason emitted by {@link loadSessionEntries.onSkip}.
- *
- * - `session_yaml_missing` (ENOENT) and `session_yaml_invalid` (parse or schema
- *   failure) both omit the entry from the result.
- * - `events_jsonl_unreadable` still pushes the entry with `suspect=false` so
- *   the session row remains visible to the caller; only the suspect check is
- *   degraded. Matches the existing CLI behaviour at
- *   `packages/cli/src/commands/session.ts` (suspect-check stderr warning).
+ * The effective instruction-source mode for a repo: the declared `instructions`,
+ * defaulting to `hub` when absent. The default is the single guarantee that an
+ * existing roster (which has no `instructions` field) keeps basou's current
+ * hub-and-spoke behavior byte-for-byte — every generator branches on this, never
+ * on the raw optional field, so "absent => hub" is decided in exactly one place.
  */
-type SessionSkipReason = "session_yaml_missing" | "session_yaml_invalid" | "events_jsonl_unreadable";
-type LoadSessionEntriesOptions = {
+declare function instructionMode(entry: {
+    instructions?: RepoInstructions | undefined;
+}): RepoInstructions;
+type RosterDriftSummary = {
+    declaredCount: number;
+    capturedCount: number;
+    /** Declared in `repos` but absent from `source_roots`: a capture gap. */
+    gaps: RepoEntry[];
+    /** In `source_roots` but not declared in `repos` (e.g. a workspace view, or a stray). */
+    extra: string[];
+    /** Declared paths that are also captured. */
+    matched: string[];
+    /** True when there is no capture gap (every declared repo is covered). */
+    ok: boolean;
+};
+/**
+ * Compute the {@link RosterDriftSummary} for a project. A declared repo missing
+ * from the captured set is a `gap` (the surfaced suspicion); a captured path not
+ * in the declared set is `extra` (commonly the workspace view, which is a
+ * capture source but not itself a project repo). With no declared roster, there
+ * are no gaps (nothing to check against) and every captured path is `extra`.
+ */
+declare function summarizeRosterDrift(input: {
+    repos?: RepoEntry[];
+    sourceRoots?: string[];
+}): RosterDriftSummary;
+type SourceRootsReconcile = {
     /**
-     * Single `now` shared across every {@link classifySuspect} call so that
-     * sessions classified back-to-back observe the same instant. Avoids
-     * boundary races where a session at age ≈ 24h would flip between calls.
+     * The reconciled `source_roots`: the existing entries verbatim, then every
+     * declared repo path that was missing (normalized, in roster order). Existing
+     * order and form are preserved so the manifest diff is minimal and reversible.
      */
-    now: Date;
-    onWarning?: (warning: ReplayWarning, sessionId: string) => void;
-    onSkip?: (sessionId: string, reason: SessionSkipReason) => void;
+    next: string[];
+    /** Declared repo paths (normalized) that were appended because `source_roots` did not cover them. */
+    added: string[];
+    /** True when `source_roots` already covers every declared repo (`next` equals the current list). */
+    unchanged: boolean;
 };
 /**
- * A trail store to read in a federated load, tagged with its host label.
- * `host: null` denotes the local store; a non-null label comes from the host
- * registry (`~/.basou/hosts.yaml`). `paths` is where that store is reachable
- * as a local path on this machine (an SSHFS mount, an rsync mirror, etc.) —
- * basou itself never performs any network I/O to obtain it.
+ * Derive the `source_roots` a project's declared repo roster requires. The
+ * roster (`repos`) is the single source of truth for which repos belong to the
+ * project; this is the actuator behind `basou project sync`, computing the
+ * additive reconciliation so every declared repo is captured.
+ *
+ * ADDITIVE ONLY: it appends declared paths that are missing and never removes
+ * an existing entry. A captured-but-undeclared path (commonly the generated
+ * workspace view — a legitimate capture source that is not itself a project
+ * repo) is preserved; pruning strays is deferred to the slice that generates
+ * the view (so basou knows which extras it owns). Existing entries are kept
+ * byte-identical; only appended paths are normalized.
+ *
+ * Pure: no filesystem or git I/O. Paths are compared in the same normalized
+ * form as {@link summarizeRosterDrift}, so a trailing-slash variant of an
+ * already-captured repo is not re-appended.
  */
-type FederatedRoot = {
-    paths: BasouPaths;
-    host: string | null;
+declare function reconcileSourceRoots(input: {
+    repos?: RepoEntry[];
+    sourceRoots?: string[];
+}): SourceRootsReconcile;
+/**
+ * On-disk classification of a source-root candidate during adoption: a git repo
+ * root (→ becomes a roster entry), a resolved-but-non-repo directory (the
+ * generated workspace view, `/tmp`, a scratch dir → excluded), or a path that
+ * could not be resolved on disk (→ excluded).
+ */
+type AdoptCandidateKind = "repo" | "non-repo" | "unresolved";
+type AdoptCandidate = {
+    /** Source-root path as declared (relative to the manifest root). */
+    path: string;
+    /** On-disk classification; the filesystem probing that produces it is the caller's job. */
+    kind: AdoptCandidateKind;
 };
-type LoadFederatedOptions = LoadSessionEntriesOptions & {
-    /**
-     * Called when a NON-local root cannot be enumerated (present-but-unreadable
-     * mount, permission error). That root is skipped best-effort so the local
-     * store and other roots still load. The local root (`host: null`) is never
-     * degraded here — its errors propagate, preserving single-store behaviour.
-     * (An absent root path is not an error: {@link enumerateSessionDirs} returns
-     * `[]` on ENOENT, so a dropped mount is simply an empty host.)
-     */
-    onRootUnavailable?: (host: string, error: unknown) => void;
+type RosterAdoptionPlan = {
+    /** Proposed `repos` entries: the candidates that are git repos (visibility left unset for the operator). */
+    repos: RepoEntry[];
+    /** Candidates excluded from the roster, with why (a non-repo directory, or an unresolvable path). */
+    excluded: {
+        path: string;
+        kind: Exclude<AdoptCandidateKind, "repo">;
+    }[];
+};
+/**
+ * Plan a `repos` roster from classified source-root candidates (the actuator
+ * behind `basou project adopt`). Pure: it partitions already-classified
+ * candidates — the realpath / `.git` filesystem probing that produces each
+ * `kind` is the caller's job, so this stays testable without disk I/O.
+ *
+ * A git repo becomes a roster entry (path only; visibility is left unset because
+ * it is a human judgment, kept independent of the other axes). A non-repo
+ * (commonly the generated workspace view) or an unresolvable path is excluded and
+ * reported, so the operator sees what was dropped and why before editing. Repo
+ * paths are deduped by normalized form, preserving the first declared form and
+ * order.
+ */
+declare function planRosterAdoption(candidates: AdoptCandidate[]): RosterAdoptionPlan;
+
+/**
+ * The language of the GENERATED-VIEW chrome (headings, labels, verdict prose)
+ * in handoff.md / orientation.md / decisions.md / report output.
+ *
+ * This is deliberately narrower than the manifest's repo `language` axis
+ * (`en | ja | en+ja`): a generated view has exactly one chrome language, so
+ * `en+ja` resolves to `en`. User data (decision titles, notes, labels, file
+ * paths) always passes through verbatim — only the tool-generated strings are
+ * localized, which is exactly the split this type exists to keep honest.
+ */
+type ViewLanguage = "en" | "ja";
+/**
+ * Resolve the generated-view language from a manifest: the workspace speaks
+ * the language of its ANCHOR repo (the `repos[]` entry whose path is `.`).
+ *
+ * Rules (fixed by design):
+ * - anchor declares `ja`            -> `ja`
+ * - anchor declares `en` / `en+ja`  -> `en` (a bilingual surface renders one
+ *   chrome; en is the shared floor)
+ * - no roster / no anchor entry / no declared language -> `en` (the default
+ *   for basou's English-first OSS surface)
+ *
+ * Binding the view to the anchor's language is a deliberate, documented
+ * coupling: the anchor is the planning/trail home the views live in, so its
+ * declared audience is the views' audience. Other repos' languages do not
+ * participate.
+ */
+declare function resolveViewLanguage(manifest: Pick<Manifest, "repos"> | null): ViewLanguage;
+/**
+ * Manifest-reading convenience for the renderers: resolve the view language
+ * for a workspace, defaulting to `en` when the manifest is missing or
+ * unreadable (mirrors the orientation renderer's tolerant source_roots read —
+ * a broken manifest must never break a view render).
+ */
+declare function resolveViewLanguageFromPaths(paths: BasouPaths): Promise<ViewLanguage>;
+/**
+ * Every localized string the four view renderers emit, grouped per renderer
+ * with a small `common` set for lines that are byte-identical across views.
+ * Parameterized lines are functions so the two languages can order their
+ * parts naturally.
+ *
+ * This module is the SINGLE home for generated Japanese — the view chrome here
+ * and the instruction-file content in {@link PresetStrings} (the E-5
+ * language-lint allowlist points here, not at the renderers/generators), so
+ * "user data language" and "tool-generated content language" can never blur
+ * together again.
+ */
+type ViewStrings = {
+    /** Localized relative age for prose lines, e.g. "3日4時間前" / "3d 4h ago". */
+    relativeAge: (startedAt: string | null, now: Date) => string;
+    common: {
+        /** "最終 session" — the latest live session pointer. */
+        lastSessionLabel: string;
+        /** "直近の判断" — the latest recorded decision pointer. */
+        latestDecisionLabel: string;
+        /** "直近の変更ファイル" — the latest session's related files. */
+        recentFilesLabel: string;
+        /** "理由" — a track's rationale label. */
+        trackWhyLabel: string;
+        /** Note that the latest decision comes from a different session. */
+        decisionOtherSessionNote: (shortSessionId: string) => string;
+    };
+    orientation: {
+        headingWhere: string;
+        headingRecent: (sessionCount: number) => string;
+        headingInFlight: string;
+        headingForward: string;
+        headingCurrency: string;
+        inFlightTasksHeading: (n: number) => string;
+        /**
+         * Body line under the in-flight-tasks heading when NO task was ever
+         * recorded here. "(none)" states that nothing is pending — a claim about
+         * the work. This one claims only what it can see: that the record is
+         * empty. It says nothing about whether the workspace should use tasks,
+         * and names no command: the renderers report position, and a nudge that
+         * cannot be silenced is noise (see `trackNudge`, which is gated).
+         */
+        noTasksRecorded: string;
+        /**
+         * Body line under the in-flight-tasks heading when tasks ARE on record
+         * here and every one of them parsed, with none open. A bare "(none)" is
+         * literally true and still misread: it answers "is anything in flight?"
+         * with a word that sounds like "nothing is happening". Work can be under
+         * way and simply not filed as a task. This line leads with what the
+         * record does hold, so it cannot be skimmed as its sibling below, and it
+         * claims nothing about the work.
+         */
+        noTasksInFlight: string;
+        /**
+         * Same heading, but a task file could not be read on THIS pass, so its
+         * status is unknown and "none in flight" would be an assertion the
+         * renderer cannot support. Says what it can see and stops.
+         *
+         * A standing condition, not a one-pass report: it holds every render until
+         * the file is repaired or removed. It used to give way to its sibling on
+         * the second render, because rebuilding the task index dropped the file it
+         * could not parse and nothing enumerated it again.
+         */
+        tasksUnreadable: string;
+        /**
+         * Appended under a NON-empty in-flight list when some task file could not
+         * be read.
+         *
+         * The list above it is true and incomplete at the same time, and a reader
+         * has no way to tell from a heading count that anything is missing. The
+         * zero case already says so; saying nothing here would make "unreadable" a
+         * fact basou reports only when it happens to have nothing else to report.
+         */
+        tasksUnreadableAlongside: (n: number) => string;
+        pendingApprovalsHeading: (n: number) => string;
+        suspectSessionsHeading: (n: number) => string;
+        openTracksHeading: (n: number) => string;
+        /** Stale-decision honesty note under 直近の判断. */
+        decisionStaleNote: (activityAge: string) => string;
+        outOfRootWarning: (count: number, files: string) => string;
+        recentEmpty: string;
+        recentDecisionsLabel: string;
+        recentNextStepLabel: string;
+        recentChangedLabel: string;
+        /** Trails the recent-files line when scratch paths were left out of it. */
+        scratchOmitted: (count: number) => string;
+        trackCloseInstruction: string;
+        /** Forward-section pointer to `basou decision gaps`; omitted when the count is 0. */
+        decisionGapsLine: (n: number) => string;
+        nextStepRecordedLabel: (age: string) => string;
+        noteStaleNote: (activityAge: string) => string;
+        fallbackStaleDirection: string;
+        fallbackStaleReferenceLabel: string;
+        trackNudge: string;
+        federatedFreshnessNote: string;
+        bannerUnverifiable: (n: number) => string;
+        bannerStale: (parts: string) => string;
+        partNew: (n: number) => string;
+        partUpdated: (n: number) => string;
+        partsJoiner: string;
+        verdictUnverifiable: (n: number) => [string, string];
+        verdictStale: (parts: string) => [string, string];
+        verdictUpdatedOnly: (n: number) => [string, string];
+        verdictSuspectsAlso: (n: number) => string;
+        verdictEmpty: [string, string];
+        verdictUnprobed: (rel: string, tool: string) => [string, string];
+        verdictCurrent: (rel: string, tool: string, hasHosts: boolean) => string;
+        verdictSuspectsCaveat: (n: number) => string;
+        verdictScopeDisclaimer: string;
+        toolTerminal: string;
+        toolHuman: string;
+        toolImport: string;
+        toolUnknown: string;
+    };
+    handoff: {
+        headingCurrentState: string;
+        headingRecentFiles: string;
+        headingLatestDecision: string;
+        headingOpenTracks: string;
+        headingUnresolved: string;
+        headingReadNext: string;
+        headingNextWork: string;
+        headingSessions: string;
+        lastTaskLabel: string;
+        /** "Work to do next" placeholder: tasks exist, none are open. */
+        noPendingTasks: string;
+        /** "Work to do next" placeholder: no task was ever recorded. */
+        noTasksRecorded: string;
+        decisionStaleNote: string;
+        trackCloseInstruction: string;
+    };
+    decisions: {
+        dateLabel: string;
+        trackKindLine: string;
+        decisionLabel: string;
+    };
+    report: {
+        headingSummary: string;
+        headingVolume: string;
+        headingDecisions: string;
+        headingApprovals: string;
+        headingTasks: string;
+        headingChangedFiles: string;
+        headingSessions: string;
+        headingIntegrity: string;
+    };
 };
+/** Look up the string table for a resolved view language. */
+declare function viewStrings(language: ViewLanguage): ViewStrings;
 /**
- * List session directory names under `paths.sessions`, ULID ascending.
- *
- * - Returns `[]` when the sessions directory does not exist (empty workspace
- *   or pre-init state).
- * - Throws `Error("Failed to enumerate sessions", { cause })` on other I/O.
- * - Only directories are returned (`.gitkeep` and other files are filtered).
- *
- * Sort order is `Array.prototype.sort()` default (Unicode code-point
- * compare). ULIDs are Crockford base32 in uppercase, so the natural sort
- * is also chronological session-start order.
- */
-declare function enumerateSessionDirs(paths: BasouPaths): Promise<string[]>;
-/**
- * Read and validate `<paths.sessions>/<sessionId>/session.yaml`.
- *
- * - Re-throws the yaml-store fixed-message `"YAML file not found"` for
- *   ENOENT so the caller can branch on it.
- * - Throws `Error("Failed to read session.yaml", { cause })` for parse
- *   failures and schema violations (cause is either the YAML parser error
- *   or the zod error).
- */
-declare function readSessionYaml(paths: BasouPaths, sessionId: string): Promise<Session>;
-/**
- * Apply a terminal-status mutation to a live session's `session.yaml` AND, in
- * the same locked write, stamp the tamper-evidence head anchor derived from the
- * on-disk `events.jsonl` tail. Used by the `exec` / `run` orchestrators for
- * BOTH terminal writers (the normal end-of-run finalize and the spawn-failure
- * `failed` finalize).
- *
- * Why locked + anchor-from-tail: live appends chain the LOG only and leave the
- * anchor for finalize. Reading the final tail under the session lock means a
- * foreign line appended just before finalize (e.g. a `decision record` attached
- * to a still-running session) is included in the anchor, and a foreign attach
- * that arrives after the terminal status is set is rejected by the attach gate
- * — so the anchor can never disagree with the at-rest log. The whole-document
- * read-modify-write also preserves any field a foreign locked writer set (e.g.
- * a task attach's `task_id`).
- *
- * The anchor is written only when the log is actually chained with at least one
- * line; a legacy unchained session (and an empty log) is left with no
- * `integrity` anchor, matching the import writers. The mutator receives the
- * full {@link Session} document and typically sets
- * `session.session.status` / `ended_at` / `invocation.exit_code` /
- * `related_files`.
- *
- * Throws the {@link inspectChainTail} errors (torn / mixed log), the
- * {@link readSessionYaml} errors, a zod error if the mutation produces an
- * invalid document, or `Error("Failed to overwrite YAML file")` on a disk
- * failure.
+ * Resolve a GENERATED INSTRUCTION-FILE's content language from the target
+ * repo's declared `language`. Unlike the views (workspace-level artifacts that
+ * follow the anchor), a preset block lives inside one repo's instruction file,
+ * so its audience is that repo's declared audience: `ja` renders Japanese
+ * (byte-identical to the pre-i18n output), `en` / `en+ja` / undeclared render
+ * English (one content language per generated block; en is the shared floor).
  */
-declare function finalizeSessionYaml(paths: BasouPaths, sessionId: string, mutate: (session: Session) => void): Promise<void>;
+declare function resolveRepoContentLanguage(language: RepoLanguage | undefined): ViewLanguage;
 /**
- * Classify a `running` session as suspect using one of two rules:
- *
- * - Rule A (`events_say_ended_but_yaml_running`): events.jsonl contains a
- *   `session_ended` event but the session.yaml is still `running`. The
- *   session ended cleanly in the event log but the YAML write was lost or
- *   never reached.
- * - Rule B (`running_no_end_event`): no `session_ended` event and the last
- *   event is older than {@link STUCK_THRESHOLD_MS}. The process likely
- *   crashed or was killed.
- *
- * Sessions that are not `running` are never suspect.
+ * Resolve the content language of a WORKSPACE-LEVEL instruction artifact (the
+ * view's AGENTS.md block, the anchor's starter) from an already-gathered
+ * roster: the entry flagged `anchor` speaks for the workspace, mirroring the
+ * views' anchor-language rule. No anchor entry (or no declared language)
+ * resolves to English. When more than one entry carries the flag, the first
+ * wins (declared order).
  *
- * I/O failure on events.jsonl is re-thrown unwrapped so the caller can
- * degrade with a warning instead of treating the session as healthy. The
- * caller is also responsible for surfacing replay warnings via `onWarning`.
+ * Note the anchor is identified by the CALLER-SET flag, not by this module:
+ * {@link resolveViewLanguage} keys on the manifest path being `.`, while the
+ * instruction-file callers flag the anchor by resolved-path identity. For a
+ * conventional manifest (anchor declared as `.`) the two agree; a roster that
+ * reaches the anchor only through an aliased path is where they can diverge,
+ * and the caller's flag is authoritative for the instruction files.
  */
-declare function classifySuspect(paths: BasouPaths, sessionId: string, session: Session, now: Date, onWarning?: (warning: ReplayWarning) => void): Promise<{
-    suspect: boolean;
-    suspectReason: SuspectReason | null;
-}>;
-declare function loadSessionEntries(paths: BasouPaths, options: LoadSessionEntriesOptions): Promise<SessionEntry[]>;
+declare function resolveAnchorContentLanguage(repos: ReadonlyArray<{
+    anchor?: boolean | undefined;
+    language?: RepoLanguage | undefined;
+}>): ViewLanguage;
 /**
- * Federated load across multiple trail stores. Each root's sessions are tagged
- * with that root's host label and `sourceRoot`, so a caller replays events from
- * the store the session lives in. De-duped by `sessionId` (a per-host random
- * ULID), then by `source.external_id` when present — first occurrence wins, so
- * pass the local root FIRST to keep it authoritative (e.g. over a re-imported
- * copy of the same vendor session on another host). A non-local root that
- * cannot be enumerated is reported via `onRootUnavailable` and skipped; the
- * local root's errors propagate, matching {@link loadSessionEntries}.
+ * Every localized string the instruction-file generators emit: the per-repo
+ * preset block, the workspace view's block, and the anchor's starter. Lives in
+ * this module for the same reason as {@link ViewStrings}: it is the SINGLE
+ * home for generated Japanese, so the language-lint E-5 allowlist stays one
+ * file and "generated content language" is always a declaration-driven table
+ * lookup, never a hardcode.
  */
-declare function loadFederatedSessionEntries(roots: ReadonlyArray<FederatedRoot>, options: LoadFederatedOptions): Promise<SessionEntry[]>;
+type PresetStrings = {
+    repoBlock: {
+        heading: string;
+        intro: string;
+        /** Source git-visibility, rendered with the consequence the agent must respect. */
+        visibilityLabel: (v: RepoVisibility | undefined) => string;
+        /**
+         * Source language (commits/comments/code), rendered with the audience it
+         * serves. Invariant note: the table itself is SELECTED by this same field
+         * (ja -> JA table, everything else -> EN), so the JA table's en / en+ja /
+         * unset branches and the EN table's ja branch are unreachable from
+         * renderPresetBlock — they exist for table completeness (and the
+         * both-language sweep test), not because a render can emit them.
+         */
+        sourceLanguageLabel: (l: RepoLanguage | undefined) => string;
+        /** Published-surface kind. */
+        publishKindLabel: (k: PublishTarget["kind"]) => string;
+        /** A published surface's visibility (independent of the source repo's). */
+        publishVisibilityLabel: (v: RepoVisibility | undefined) => string;
+        /** A published surface's content language (read by end users; may differ from source). */
+        contentLanguageLabel: (l: RepoLanguage | undefined) => string;
+        /** "ソース可視性" — the source-visibility line label. */
+        sourceVisibilityLabel: string;
+        /** "ソース言語" — the source-language line label. */
+        sourceLanguageLineLabel: string;
+        /** "- 配信物: なし" — no published surfaces. */
+        publishesNone: string;
+        /** "- 配信物:" — the published-surfaces list header. */
+        publishesHeader: string;
+    };
+    viewBlock: {
+        heading: string;
+        intro: string;
+        selfNote: (viewName: string) => string;
+        aggregates: (repoCount: number) => string;
+        reposHeading: string;
+        tableHeader: string;
+        /** Instruction-file ownership labels: who writes the repo's AGENTS.md. */
+        instructionsAnchor: string;
+        instructionsSelf: string;
+        instructionsHub: string;
+        /** "未設定" — the short table cell for an undeclared visibility / language. */
+        unsetShort: string;
+        commitHeading: string;
+        commitBody: string;
+        conventionsHeading: string;
+        conventionsBody: string;
+        /** Heading for {@link handoffPointer}. Its own, so the pointer is not filed
+         * under "Required reading" while telling the reader not to read it through. */
+        handoffHeading: string;
+        /**
+         * Where the session roster lives. One line, because the adjudication that
+         * chose this destination capped session-start injection: the roster itself
+         * must never be injected, only its address.
+         */
+        handoffPointer: string;
+        principlesHeading: string;
+        principleStateless: string;
+        principleNoFiles: string;
+    };
+    anchorStarter: {
+        identityLine: (title: string) => string;
+        starterNote: string;
+        basicsHeading: string;
+        basicsTodo: string;
+        commitHeading: string;
+        commitPlanning: string;
+        commitImplementation: string;
+        commitView: string;
+        conventionsHeading: string;
+        conventionsBody: string;
+        viewPointerLine: (viewName: string) => string;
+        /** Same route as the view block's, for the anchor — which is where `.basou/` lives. */
+        handoffHeading: string;
+        handoffPointer: string;
+        policyHeading: string;
+        policyTodo: string[];
+    };
+};
+/** Look up the instruction-file string table for a resolved content language. */
+declare function presetStrings(language: ViewLanguage): PresetStrings;
 
 type DecisionsRendererInput = {
     paths: BasouPaths;
@@ -3198,6 +3474,19 @@ declare function prefixedUlid<P extends IdPrefix>(prefix: P): PrefixedId<P>;
  */
 declare function isValidPrefixedId(value: string): boolean;
 
+/**
+ * `schema_version` stamped on NEWLY WRITTEN `.basou/tasks/<id>.md` front matter.
+ *
+ * 0.2.0 requires seconds in every timestamp. That NARROWS the field's domain,
+ * which §7.3 forbids except under the vacuous-narrowing rule the same section
+ * states: no value basou has ever written omits seconds, so the set of
+ * documents this refuses is empty. See `docs/spec/schemas.md` for the read
+ * rule and the measurement. The narrowing is shared with the event format, so
+ * every durable document bumps together.
+ *
+ * Note: basou writes this document.
+ */
+declare const TASK_SCHEMA_VERSION: "0.2.0";
 /**
  * Task lifecycle states.
  *
@@ -3214,8 +3503,8 @@ declare function isValidPrefixedId(value: string): boolean;
  * Self-edges are rejected so the audit trail stays monotonic.
  */
 declare const TaskStatusSchema: z.ZodEnum<{
-    in_progress: "in_progress";
     planned: "planned";
+    in_progress: "in_progress";
     done: "done";
     cancelled: "cancelled";
 }>;
@@ -3235,8 +3524,8 @@ declare const TaskSchema: z.ZodObject<{
         title: z.ZodString;
         label: z.ZodOptional<z.ZodString>;
         status: z.ZodEnum<{
-            in_progress: "in_progress";
             planned: "planned";
+            in_progress: "in_progress";
             done: "done";
             cancelled: "cancelled";
         }>;
@@ -3425,9 +3714,15 @@ declare function writeTaskFile(paths: BasouPaths, taskId: string, doc: TaskDocum
  * the caller's `options.onSkip` hook in {@link loadTaskEntries} so list
  * commands can show a warning row.
  *
- * Returns ids in ULID-ascending order (filename sort matches ULID order).
+ * Ids come back in ULID-ascending order: the disk scan sorts by filename,
+ * which matches ULID order, and {@link rebuildTaskIndex} sorts what it writes,
+ * so an index basou wrote is already in that order. An index edited by hand
+ * into some other order is returned in it — no caller depends on the order,
+ * and re-sorting a trusted cache would hide that it was used.
+ *
  * Empty directory or ENOENT → `[]`. Other I/O failures throw
- * `"Failed to enumerate tasks"`.
+ * `"Failed to enumerate tasks"`, unless a valid index is available to answer
+ * from instead.
  */
 declare function enumerateTaskIds(paths: BasouPaths): Promise<string[]>;
 /**
@@ -3638,7 +3933,8 @@ type ReconcileFailure = {
     phase: TaskWriteAfterEventPhase | null;
 };
 /**
- * Batch audit result. Order follows `enumerateTaskIds(paths)` (ULID-ascending).
+ * Batch audit result. Order follows `enumerateTaskIds(paths)`, which is
+ * ULID-ascending for any index basou wrote and for every disk scan.
  * `scanned` is the number of readable task.md files processed (= excludes
  * malformed task.md from the count so an integrity-broken file does not
  * pad the total).
@@ -3973,6 +4269,35 @@ type HandoffRendererResult = {
  */
 declare function renderHandoff(input: HandoffRendererInput): Promise<HandoffRendererResult>;
 
+/** What a build knows about itself. `commit` is `"unknown"` outside a checkout. */
+type BuildStamp = {
+    readonly version: string;
+    readonly commit: string;
+    readonly committedAt: string;
+};
+/**
+ * Parse an injected stamp. Separate from the constant below so it is reachable
+ * from a test: under vitest the module loads from SOURCE, where the injected
+ * identifier does not exist, so every line of the parse would otherwise be
+ * unreachable -- a guarantee with no test behind it, which is the shape of
+ * omission this whole feature exists to correct.
+ *
+ * Anything unparseable yields `undefined` rather than throwing: a malformed
+ * stamp must not stop the CLI from starting.
+ */
+declare function parseBuildStamp(raw: string | undefined): BuildStamp | undefined;
+/**
+ * Core's own build identity.
+ *
+ * Core is stamped separately from the CLI because the CLI does not bundle it:
+ * `cli/dist` and `core/dist` are distinct artifacts that a partial build can
+ * leave at different commits. A fresh CLI in front of a stale core is the
+ * dangerous half of that pair -- core is where the renderers and importers
+ * live, so the behaviour would be the old one while the CLI reported the new
+ * version.
+ */
+declare const BASOU_CORE_BUILD: BuildStamp | undefined;
+
 /**
  * Parse a unit-suffixed duration string (e.g. `30s`, `5m`, `1h`, `100ms`)
  * into milliseconds.
@@ -4355,6 +4680,13 @@ type OrientationSummary = {
      * does not sink into the flat decision list. Empty when none are open.
      */
     openTracks: TrackRecord[];
+    /**
+     * Decisions recorded by `basou decision capture` that are still open and that
+     * no task carries — the count `basou decision gaps` lists. Surfaced here as a
+     * single number because a ratified plan that became no task is invisible
+     * otherwise, and a command nobody is told to run does not fix that.
+     */
+    openDecisionGaps: number;
     /**
      * Most recent `note_added` over non-archived sessions — the recorded next
      * step / handoff ("next step") surfaced in the forward section; null when none.
@@ -4391,6 +4723,14 @@ type OrientationSummary = {
      *  zero in-flight count distinguish "all closed" from "never used here".
      *  See {@link anyTaskEverRecorded}: a live count is NOT this. */
     anyTaskEverRecorded: boolean;
+    /** How many task files this render could not read.
+     *
+     * A standing count: the task index is reconciled against the tasks directory
+     * on every enumeration, so a file that cannot be parsed keeps being attempted
+     * — and keeps being counted — until it is repaired or removed. It used to
+     * read zero from the second render on, because rebuilding the index dropped
+     * the file and nothing enumerated it again. */
+    unreadableTaskCount: number;
     /** Tasks whose status is `planned` ("where am I heading"). */
     plannedTasks: PlannedTask[];
     pendingApprovals: PendingApproval[];
@@ -4736,8 +5076,9 @@ type ViewPresetInput = {
  * operator-specific string is embedded), so re-running on an unchanged manifest
  * produces byte-identical output. The view is a workspace-level artifact, so
  * its content language follows the ANCHOR entry's declared language (mirroring
- * the generated views' rule); a `ja` anchor renders byte-identical to the
- * pre-i18n output. The repos are listed in the order supplied. An empty roster
+ * the generated views' rule). It no longer reproduces the pre-i18n output: the
+ * block gained a line naming where the session roster lives, which that output
+ * predates. The repos are listed in the order supplied. An empty roster
  * still renders cleanly (a header-only table, empty lists). Returns the block
  * WITHOUT a trailing newline; the marker writer adds the surrounding structure.
  */
@@ -5645,6 +5986,120 @@ type WorkspaceViewPlan = {
  */
 declare function planWorkspaceView(facts: ViewRepoFact[], existing?: ExistingViewLink[], rosterNames?: string[]): WorkspaceViewPlan;
 
+/** Prefix of the token embedded in a delivery; the content digest follows it. */
+declare const PROTOCOL_UPDATE_TOKEN_PREFIX = "basou:protocol-updated";
+/** What the block records about itself. */
+type ProtocolStamp = {
+    /** When the block's rendered protocol text last CHANGED (ISO 8601, UTC). */
+    changedAt: string;
+    /** Truncated digest of that rendered text. */
+    contentHash: string;
+};
+/** Truncated digest of the block's rendered protocol text. */
+declare function protocolBlockHash(sections: string): string;
+/**
+ * The delivery's dedupe token for a given block state.
+ *
+ * It carries the content digest rather than being a bare literal, so "already
+ * delivered" means "already delivered THIS text". A second update inside one
+ * session — usually the correction of the first, after watching an agent
+ * misapply it — is a different digest and still lands. A bare literal would
+ * make the one edit most worth delivering the one guaranteed not to arrive.
+ */
+declare function protocolUpdateToken(contentHash: string): string;
+/**
+ * Render the stamp line.
+ *
+ * Nothing operator-authored goes on it — only a timestamp and a digest — so a
+ * source path or a protocol body containing a space, a quote, or a `-->` cannot
+ * break the line it is rendered into.
+ */
+declare function renderProtocolStamp(stamp: ProtocolStamp): string;
+/**
+ * Find and parse the stamp line in a rendered block body.
+ *
+ * Returns `null` when the block carries no readable stamp — a block rendered by
+ * a basou older than this feature, a hand-deleted stamp, a mangled one. A null
+ * means "cannot tell", and every caller treats it as "say nothing": the point
+ * of the feature is to speak only when basou actually knows something changed.
+ */
+declare function parseProtocolStamp(blockBody: string): ProtocolStamp | null;
+/**
+ * Build the stamp for the block about to be written: keep the previous
+ * `changedAt` when the rendered text is unchanged, and set it to `now`
+ * otherwise.
+ *
+ * `sections` is the rendered protocol text exactly as it will appear under the
+ * stamp — the same bytes a session reads and the same bytes a delivery carries.
+ * Hashing anything else (the raw source files, say) would let bytes no session
+ * ever sees move the stamp, and basou would then tell a session that text it
+ * already holds supersedes what it already holds.
+ *
+ * `changedAt` is forced strictly forward when the text did change. Wall-clock
+ * time can move backwards — an NTP correction, a laptop waking in another
+ * timezone — and a stamp dated before the session start would drop the delivery
+ * for the rest of that session, silently and permanently.
+ */
+declare function carryForwardProtocolStamp(input: {
+    sections: string;
+    previous: ProtocolStamp | null;
+    now: string;
+}): ProtocolStamp;
+/**
+ * The rendered protocol text inside a block: everything below the stamp line.
+ *
+ * Anchored on the stamp rather than on "skip the leading comments" so a
+ * protocol whose own body opens with an HTML comment keeps it. Returns `null`
+ * when there is no stamp line to anchor on, and an empty string when the block
+ * holds a stamp and nothing else.
+ *
+ * Takes a block BODY, but stops at a closing marker line if one is present, so
+ * handing it a whole file yields the same answer instead of a digest that
+ * silently includes the marker and matches nothing.
+ */
+declare function protocolSectionsFrom(blockBody: string): string | null;
+/**
+ * The rendered protocol text inside a block written before stamps existed:
+ * everything below the managed note.
+ *
+ * Only for reading the block an upgrade is about to replace. Knowing what that
+ * block held is what lets an upgrade stay silent — if the text is the same, no
+ * running session is owed anything, and dating the new stamp at `now` would
+ * announce a change to every session on the machine the first time the new
+ * basou syncs. Less precise than the stamped path (a protocol body opening
+ * with its own HTML comment loses that line here), which is why it is confined
+ * to blocks that carry no stamp: a wrong answer costs one redundant delivery,
+ * never a wrong one.
+ */
+declare function unstampedProtocolSectionsFrom(blockBody: string): string;
+/**
+ * Whether a session that started at `sessionStartedAt` is holding an older copy
+ * of the block than the one the stamp describes.
+ *
+ * A change dated at or before the start is one the session already read. An
+ * unparseable start yields `false` rather than "everything": without a session
+ * start there is no "after".
+ */
+declare function isProtocolUpdateDue(input: {
+    stamp: ProtocolStamp;
+    sessionStartedAt: string;
+}): boolean;
+/**
+ * The text handed to the running session: the protocols themselves, not a
+ * pointer to them.
+ *
+ * basou cannot observe whether an agent re-read a file, so a notice saying "go
+ * and re-read" would put the one step that decides the outcome outside what
+ * basou can see. Carrying the text makes the delivery and the reading the same
+ * act. It does not make the ADOPTION observable — nothing basou can do would —
+ * but it removes the step that was avoidably invisible.
+ *
+ * The complete current set is sent, not a diff, so the lead line's claim is
+ * exactly true: after this, the set below is the whole of the standing
+ * protocols, and anything read at session start that is absent here is gone.
+ */
+declare function renderProtocolUpdate(sections: string, stamp: ProtocolStamp): string;
+
 /**
  * `schema_version` of each on-disk format, keyed by artifact basename.
  *
@@ -5662,14 +6117,14 @@ declare function planWorkspaceView(facts: ViewRepoFact[], existing?: ExistingVie
  * changed without the envelope's own format changing.
  */
 declare const JSON_SCHEMA_VERSIONS: {
-    readonly manifest: "0.1.0";
-    readonly session: "0.1.0";
-    readonly event: "0.2.0";
-    readonly task: "0.1.0";
-    readonly approval: "0.1.0";
+    readonly manifest: "0.2.0";
+    readonly session: "0.2.0";
+    readonly event: "0.3.0";
+    readonly task: "0.2.0";
+    readonly approval: "0.2.0";
     readonly status: "0.1.0";
     readonly "task-index": "0.1.0";
-    readonly "session-import": "0.1.0";
+    readonly "session-import": "0.2.0";
 };
 /** One emitted JSON Schema artifact. */
 type JsonSchemaArtifact = {
@@ -5809,14 +6264,21 @@ declare const SchemaVersionSchema: z.ZodString;
  * and would need the pattern written a second time, which is a second place to
  * forget. {@link SchemaVersionSchema} takes the same form for the same reason.
  *
- * It deliberately does NOT declare `format: "date-time"`. That format names
- * RFC 3339, and the two sets cross rather than nest: basou takes a timestamp
- * without seconds, which RFC 3339 does not, and refuses the lowercase
- * designators and the leap second that RFC 3339 allows. Declaring the format
- * made one artifact answer two ways from the same bytes — a validator
- * asserting it rejected `2026-09-16T01:23Z`, one treating it as an annotation
- * (the JSON Schema 2020-12 default) accepted it. The `pattern` is the
- * contract, and `description` says so, because no format name states this set.
+ * It deliberately does NOT declare `format: "date-time"`. The sets used to
+ * CROSS — basou took a timestamp without seconds, which RFC 3339 does not —
+ * and declaring the format made one artifact answer two ways from the same
+ * bytes: a validator asserting it rejected `2026-09-16T01:23Z`, one treating
+ * it as an annotation (the JSON Schema 2020-12 default) accepted it.
+ *
+ * Requiring seconds ended the crossing: this set is now a strict SUBSET of
+ * RFC 3339 `date-time`, since uppercase-only and no-leap-second are
+ * restrictions on it. So the format could be declared truthfully again. It is
+ * still not declared, for a different reason than before — the `pattern` is
+ * the whole contract and the format names a strictly larger set, so declaring
+ * it would say less than the artifact already says while reintroducing a
+ * keyword whose enforcement varies by validator. Reinstating it is a decision
+ * about what the artifact should assert, not a correction; `description` is
+ * what states this set, because no format name does.
  */
 declare const IsoTimestampSchema: z.ZodString;
 /** Workspace ID schema: validates `ws_<26-char ULID>`. */
@@ -5849,6 +6311,18 @@ type RiskLevel = z.infer<typeof RiskLevelSchema>;
  * non-empty string in v0.1; a stricter enum may be introduced post-v0.1.
  */
 declare const EventSourceSchema: z.ZodString;
+/**
+ * The `source` basou stamps on an event it wrote itself, in response to a
+ * `basou` command the operator (or an agent acting for them) ran — as opposed
+ * to an event an importer derived from a vendor transcript.
+ *
+ * It is a named constant because a reader distinguishes the two: `plan-gaps`
+ * admits a decision to its population only when this source recorded it, so a
+ * writer drifting from this literal would silently shrink that population
+ * rather than fail. Every local writer imports this rather than repeating the
+ * string, so the reader's predicate and the writers have one origin.
+ */
+declare const LOCAL_CLI_EVENT_SOURCE = "local-cli";
 
 /**
  * Schema for `.basou/status.json` — a forward-incompat cache of the current
@@ -6993,7 +7467,7 @@ type ImportSessionResult = {
 /**
  * Import a round-trip JSON payload into `.basou/sessions/<new>/`. The caller
  * MUST validate the payload against {@link SessionImportPayloadSchema} first
- * and gate the `schema_version === "0.1.0"` literal check externally; this
+ * and gate the `schema_version === SESSION_IMPORT_SCHEMA_VERSION` check externally; this
  * function trusts both invariants.
  *
  * On success a fresh session ID is minted and a complete
@@ -7181,4 +7655,4 @@ declare function overwriteYamlFile(filePath: string, value: unknown): Promise<vo
  */
 declare const BASOU_CORE_VERSION = "0.1.0";
 
-export { ACTIVE_GAP_CAP_MS, AGENT_INFRA_DIRS, type ActiveTimeBasis, type AdapterOutputEvent, type AdoptCandidate, type AdoptCandidateKind, type AnchorStarterInput, type AnchorStarterRepo, type AppendBasouGitignoreOptions, type AppendBasouGitignoreResult, type AppendEventToExistingInput, type AppendEventToExistingResult, type Approval, type ApprovalApprovedEvent, type ApprovalExpiredEvent, ApprovalIdSchema, type ApprovalLocation, type ApprovalRejectedEvent, type ApprovalRequestedEvent, ApprovalSchema, type ApprovalStatus, ApprovalStatusSchema, type ArchivePlan, type ArchiveTaskInput, type ArchiveTaskResult, type AttachTaskInput, type AttachUpdateTaskStatusInput, type AttachableStatus, BASOU_CORE_VERSION, type BasouPaths, type BuildStopHookCommandOptions, type BulkChainResult, CLAUDE_IMPORT_SOURCE, CODEX_IMPORT_SOURCE, type CaptureMode, type ChainBreakReason, type ChainTailState, type ChainVerdict, type ChainVerdictStatus, type ChainedEvents, ChildProcessRunner, type CitedReview, type ClaudeSettings, type ClaudeTranscriptRecord, type ClaudeTranscriptToPayloadOptions, type CodexCommandLookup, type CodexHooksFile, type CodexRolloutRecord, type CodexRolloutToPayloadOptions, type CommandExecutedEvent, type CommandLookup, type CreateAdHocSessionInput, type CreateAdHocSessionResult, type CreateAdHocTaskInput, type CreateManifestInput, type CreateTaskInput, type CreateTaskResult, DEFAULT_STOP_HOOK_MIN_EDITS, type DayWorkStats, DecisionIdSchema, type DecisionRecordedEvent, type DecisionsRendererInput, type DecisionsRendererResult, type DeleteTaskInput, type DeleteTaskResult, type DiffResult, EVENT_SCHEMA_VERSION, type EditTaskInput, type EditTaskResult, type Event, EventIdSchema, EventSchema, EventSourceSchema, type ExistingViewLink, FailedToFinalizeError, type FederatedRoot, type FileChange, type FileChangeStatus, type FileChangedEvent, GENERATED_END, GENERATED_START, type GitSnapshot, type GitSnapshotEvent, type GitignorePlanSummary, type HandoffRendererInput, type HandoffRendererResult, ID_PREFIXES, type IdPrefix, type ImportSessionOptions, type ImportSessionResult, type IncompleteWiring, type InstructionFileFact, type InstructionSymlinkFact, type InstructionSymlinkState, IsoTimestampSchema, JSON_SCHEMA_VERSIONS, type JsonSchemaArtifact, type LoadFederatedOptions, type LoadSessionEntriesOptions, type LoadTaskEntriesOptions, type LoadedApproval, type LockHandle, type LockScope, type Manifest, ManifestSchema, type MarkerSection, type Markers, type MeasureAvailability, type MissingCanonical, type NoteAddedEvent, ORIENTATION_END, ORIENTATION_START, type OrientationRendererInput, type OrientationRendererResult, type OrientationSummary, PROTOCOL_END, PROTOCOL_START, type PrefixedId, type PresetAction, type PresetCollision, type PresetMarkerConflict, type PresetMarkerKind, type PresetPlanSummary, type PresetRepo, type PresetStrings, type ProcessRunner, type PublishKind, type PublishTarget, REVIEW_RECORD_NO_INPUT_HINT, type RechainOptions, type RechainResult, type ReconcileAllResult, type ReconcileAllTasksInput, type ReconcileAllTasksOptions, type ReconcileFailure, type ReconcileResult, type ReconcileTaskInput, type RefreshLinkageInput, type RefreshLinkageResult, type ReimportOptions, type ReimportResult, type RenamePlan, type ReplayOptions, type ReplayWarning, type RepoEntry, type RepoGitignoreFacts, type RepoGitignorePlan, type RepoInstructions, type RepoLanguage, type RepoPathProblem, type RepoPresetFacts, type RepoPresetPlan, type RepoSymlinkFacts, type RepoSymlinkPlan, type RepoVisibility, type RepoWiringFacts, type ReportApprovalItem, type ReportData, type ReportDecisionItem, type ReportRendererInput, type ReportRendererResult, type ReportSessionItem, type ReportTaskItem, type RetrofitAction, type RetrofitAgentsState, type RetrofitFacts, type RetrofitPlan, type RetrofitReason, type ReviewBlocked, type ReviewFinding, type ReviewGapRepoSummary, type ReviewGapUnit, type ReviewGapVerdict, type ReviewGapsInput, type ReviewGapsSummary, type ReviewGateResult, type ReviewGateSilentReason, type ReviewRecordBlockedInput, type ReviewRecordFindingInput, type ReviewRecordInput, type ReviewRecordedEvent, type RiskLevel, RiskLevelSchema, type RosterAdoptionPlan, type RosterDriftSummary, type RunOptions, type RunResult, SESSION_IMPORT_SCHEMA_VERSION, SESSION_START_HOOK_CONTEXT_LIMIT, SESSION_START_HOOK_MATCHER, SESSION_START_HOOK_STATUS_MESSAGE, SESSION_START_HOOK_TIMEOUT_SECONDS, STOP_HOOK_TIMEOUT_SECONDS, STUCK_THRESHOLD_MS, type SanitizePathOptions, type SanitizeRelatedFilesResult, SchemaVersionSchema, type SelfReportedReview, type Session, type SessionEndedEvent, type SessionEntry, SessionIdSchema, type SessionImportPayload, SessionImportPayloadSchema, type SessionInnerImportInput, SessionInnerImportSchema, type SessionIntegrity, SessionIntegritySchema, type SessionMetrics, SessionMetricsSchema, SessionSchema, type SessionSkipReason, type SessionSourceKind, SessionSourceKindSchema, type SessionStartHookLocation, type SessionStartHookRemoval, type SessionStartHookUpsert, type SessionStartedEvent, type SessionStatus, type SessionStatusChangedEvent, SessionStatusSchema, type SessionWorkStats, type SourceRootScope, type SourceRootsReconcile, type SourceWorkStats, type StatusCount, StatusSchema, type StatusSnapshot, type StopHookEvaluation, type StopHookEvaluationInput, type StopHookRemoval, type StopHookSilentReason, type StopHookUpsert, type SuspectReason, type SymlinkCollision, type SymlinkConflict, type SymlinkPlanSummary, type Task, type TaskArchivedEvent, type TaskCreatedEvent, type TaskDeletedEvent, type TaskDocument, TaskIdSchema, type TaskLinkageRefreshedEvent, type TaskReconciledEvent, TaskSchema, type TaskSkipReason, type TaskStatus, type TaskStatusChangedEvent, type TaskStatusCount, TaskStatusSchema, TaskWriteAfterEventError, type TaskWriteAfterEventPhase, type TokenTotals, type UnattachedSelfReports, type UnbindableRepo, type UpdateAdHocTaskStatusInput, type UpdateTaskStatusInput, type UpdateTaskStatusResult, type ViewCollision, type ViewConflict, type ViewLanguage, type ViewLinkState, type ViewPresetInput, type ViewPresetRepo, type ViewRepoFact, type ViewStrayUnknown, type ViewStrings, type ViewWiringFacts, type WiringCollision, type WiringConflict, type WiringDriftSummary, type WiringRisk, type WiringSummary, type WorkStatsInput, type WorkStatsResult, type WorkStatsTotals, WorkspaceIdSchema, type WorkspaceViewPlan, type WriteEventsBulkOptions, type WriteTaskFileMode, ZERO_DURATION_RETIRED_SINCE, acquireLock, appendBasouGitignore, appendChainedEvent, appendChainedEventLocked, appendEvent, appendEventToExistingSession, archiveTask, assertBasouRootSafe, basouPaths, buildJsonSchemas, buildReviewRecordLabel, buildReviewRecordedEvent, buildSessionStartHookCommand, buildStatusSnapshot, buildStopHookCommand, chainEvents, chainRawJsonLines, classifyFilesBySourceRoot, classifyRetrofit, classifySuspect, claudeCodeAdapterMetadata, claudeTranscriptToImportPayload, codexAdapterMetadata, codexRolloutToImportPayload, computeWorkStats, createAdHocSessionWithEvent, createManifest, createTaskWithEvent, deleteTask, editTask, ensureBasouDirectory, enumerateApprovals, enumerateArchivedTaskIds, enumerateSessionDirs, enumerateTaskIds, evaluateStopHook, finalizeSessionYaml, findBasouSessionStartHook, findBasouStopHookCommand, findErrorCode, findReviewGaps, findUnbindableRepos, formatDurationMs, genesisHash, getDiff, getSnapshot, hasRetiredZeroDuration, importSessionFromJson, inspectChainTail, instructionMode, isBasouSessionStartHookCommand, isBasouStopHookCommand, isGitNotFound, isImportDerivedSource, isLazyExpired, isRenderable, isValidPrefixedId, lineHash, linkYamlFile, loadApproval, loadFederatedSessionEntries, loadSessionEntries, loadTaskEntries, normalizeRepoKey, normalizeRepoPath, overwriteYamlFile, parseDuration, parseMarkers, parseReviewRecordInput, pathBasename, planArchive, planGitignore, planRename, planRosterAdoption, planWorkspaceView, prefixedUlid, presetStrings, readAllEvents, readManifest, readMarkdownFile, readObservedDuration, readSessionYaml, readStatus, readTaskFile, readTaskFileWithArchiveFallback, readYamlFile, rechainSessionInPlace, reconcileAllTasks, reconcileSourceRoots, reconcileTask, refreshTaskLinkedSessions, reimportPreservingId, removeMarkerSection, removeSessionStartHook, removeStopHook, renderAnchorStarter, renderDecisions, renderHandoff, renderOrientation, renderPresetBlock, renderReport, renderViewPresetBlock, renderWithMarkers, replayEvents, resolveAnchorContentLanguage, resolveBasouRepositoryRoot, resolveClaudeCodeCommand, resolveCodexCommand, resolveRepoContentLanguage, resolveRepoRoot, resolveRepositoryRoot, resolveSessionId, resolveTaskId, resolveViewLanguage, resolveViewLanguageFromPaths, safeSimpleGit, sanitizePath, sanitizeRelatedFiles, sanitizeWorkingDirectory, seedMarkers, serializeEventLine, serializeJsonSchema, sessionWorkStatsFromEvents, summarizeAdapterOutput, summarizeOrientation, summarizePresetPlan, summarizeRosterDrift, summarizeSymlinkPlan, summarizeWiring, summarizeWiringDrift, tryRemoteUrl, ulid, unknownManifestKeys, updateTaskStatusWithEvent, upsertSessionStartHook, upsertStopHook, verifyEventsChain, viewStrings, writeEventsBulk, writeManifest, writeMarkdownFile, writeObservedDuration, writeStatus, writeTaskFile, writeYamlFile };
+export { ACTIVE_GAP_CAP_MS, AGENT_INFRA_DIRS, APPROVAL_SCHEMA_VERSION, type ActiveTimeBasis, type AdapterOutputEvent, type AdoptCandidate, type AdoptCandidateKind, type AnchorStarterInput, type AnchorStarterRepo, type AppendBasouGitignoreOptions, type AppendBasouGitignoreResult, type AppendEventToExistingInput, type AppendEventToExistingResult, type Approval, type ApprovalApprovedEvent, type ApprovalExpiredEvent, ApprovalIdSchema, type ApprovalLocation, type ApprovalRejectedEvent, type ApprovalRequestedEvent, ApprovalSchema, type ApprovalStatus, ApprovalStatusSchema, type ArchivePlan, type ArchiveTaskInput, type ArchiveTaskResult, type AttachTaskInput, type AttachUpdateTaskStatusInput, type AttachableStatus, BASOU_CORE_BUILD, BASOU_CORE_VERSION, type BasouPaths, type BuildStamp, type BuildStopHookCommandOptions, type BulkChainResult, CLAUDE_IMPORT_SOURCE, CODEX_IMPORT_SOURCE, type CaptureMode, type ChainBreakReason, type ChainTailState, type ChainVerdict, type ChainVerdictStatus, type ChainedEvents, ChildProcessRunner, type CitedReview, type ClaudeSettings, type ClaudeTranscriptRecord, type ClaudeTranscriptToPayloadOptions, type CodexCommandLookup, type CodexHooksFile, type CodexRolloutRecord, type CodexRolloutToPayloadOptions, type CommandExecutedEvent, type CommandLookup, type CreateAdHocSessionInput, type CreateAdHocSessionResult, type CreateAdHocTaskInput, type CreateManifestInput, type CreateTaskInput, type CreateTaskResult, DECISION_GAPS_EPOCH, DEFAULT_STOP_HOOK_MIN_EDITS, type DayWorkStats, type DecisionGap, type DecisionGapsExcluded, type DecisionGapsIncomplete, type DecisionGapsInput, type DecisionGapsScope, type DecisionGapsSummary, DecisionIdSchema, type DecisionRecordedEvent, type DecisionsRendererInput, type DecisionsRendererResult, type DeleteTaskInput, type DeleteTaskResult, type DiffResult, EVENT_SCHEMA_VERSION, type EditTaskInput, type EditTaskResult, type Event, EventIdSchema, EventSchema, EventSourceSchema, type ExistingViewLink, FailedToFinalizeError, type FederatedRoot, type FileChange, type FileChangeStatus, type FileChangedEvent, GENERATED_END, GENERATED_START, type GitSnapshot, type GitSnapshotEvent, type GitignorePlanSummary, type HandoffRendererInput, type HandoffRendererResult, ID_PREFIXES, type IdPrefix, type ImportSessionOptions, type ImportSessionResult, type IncompleteWiring, type InstructionFileFact, type InstructionSymlinkFact, type InstructionSymlinkState, IsoTimestampSchema, JSON_SCHEMA_VERSIONS, type JsonSchemaArtifact, LOCAL_CLI_EVENT_SOURCE, type LoadFederatedOptions, type LoadSessionEntriesOptions, type LoadTaskEntriesOptions, type LoadedApproval, type LockHandle, type LockScope, MANIFEST_SCHEMA_VERSION, type Manifest, ManifestSchema, type MarkerSection, type Markers, type MeasureAvailability, type MissingCanonical, type NoteAddedEvent, ORIENTATION_END, ORIENTATION_START, type OrientationRendererInput, type OrientationRendererResult, type OrientationSummary, PROTOCOL_END, PROTOCOL_START, PROTOCOL_UPDATE_TOKEN_PREFIX, type PrefixedId, type PresetAction, type PresetCollision, type PresetMarkerConflict, type PresetMarkerKind, type PresetPlanSummary, type PresetRepo, type PresetStrings, type ProcessRunner, type ProtocolStamp, type PublishKind, type PublishTarget, REVIEW_RECORD_NO_INPUT_HINT, type RechainOptions, type RechainResult, type ReconcileAllResult, type ReconcileAllTasksInput, type ReconcileAllTasksOptions, type ReconcileFailure, type ReconcileResult, type ReconcileTaskInput, type RefreshLinkageInput, type RefreshLinkageResult, type ReimportOptions, type ReimportResult, type RenamePlan, type ReplayOptions, type ReplayWarning, type RepoEntry, type RepoGitignoreFacts, type RepoGitignorePlan, type RepoInstructions, type RepoLanguage, type RepoPathProblem, type RepoPresetFacts, type RepoPresetPlan, type RepoSymlinkFacts, type RepoSymlinkPlan, type RepoVisibility, type RepoWiringFacts, type ReportApprovalItem, type ReportData, type ReportDecisionItem, type ReportRendererInput, type ReportRendererResult, type ReportSessionItem, type ReportTaskItem, type RetrofitAction, type RetrofitAgentsState, type RetrofitFacts, type RetrofitPlan, type RetrofitReason, type ReviewBlocked, type ReviewFinding, type ReviewGapRepoSummary, type ReviewGapUnit, type ReviewGapVerdict, type ReviewGapsInput, type ReviewGapsSummary, type ReviewGateResult, type ReviewGateSilentReason, type ReviewRecordBlockedInput, type ReviewRecordFindingInput, type ReviewRecordInput, type ReviewRecordedEvent, type RiskLevel, RiskLevelSchema, type RosterAdoptionPlan, type RosterDriftSummary, type RunOptions, type RunResult, SESSION_IMPORT_SCHEMA_VERSION, SESSION_SCHEMA_VERSION, SESSION_START_HOOK_CONTEXT_LIMIT, SESSION_START_HOOK_MATCHER, SESSION_START_HOOK_STATUS_MESSAGE, SESSION_START_HOOK_TIMEOUT_SECONDS, STOP_HOOK_TIMEOUT_SECONDS, STUCK_THRESHOLD_MS, type SanitizePathOptions, type SanitizeRelatedFilesResult, SchemaVersionSchema, type SelfReportedReview, type Session, type SessionEndedEvent, type SessionEntry, SessionIdSchema, type SessionImportPayload, SessionImportPayloadSchema, type SessionInnerImportInput, SessionInnerImportSchema, type SessionIntegrity, SessionIntegritySchema, type SessionMetrics, SessionMetricsSchema, SessionSchema, type SessionSkipReason, type SessionSourceKind, SessionSourceKindSchema, type SessionStartHookLocation, type SessionStartHookRemoval, type SessionStartHookUpsert, type SessionStartedEvent, type SessionStatus, type SessionStatusChangedEvent, SessionStatusSchema, type SessionWorkStats, type SourceRootScope, type SourceRootsReconcile, type SourceWorkStats, type StatusCount, StatusSchema, type StatusSnapshot, type StopHookEvaluation, type StopHookEvaluationInput, type StopHookRemoval, type StopHookSilentReason, type StopHookUpsert, type SuspectReason, type SymlinkCollision, type SymlinkConflict, type SymlinkPlanSummary, TASK_SCHEMA_VERSION, type Task, type TaskArchivedEvent, type TaskCreatedEvent, type TaskDeletedEvent, type TaskDocument, TaskIdSchema, type TaskLinkageRefreshedEvent, type TaskReconciledEvent, TaskSchema, type TaskSkipReason, type TaskStatus, type TaskStatusChangedEvent, type TaskStatusCount, TaskStatusSchema, TaskWriteAfterEventError, type TaskWriteAfterEventPhase, type TokenTotals, type UnattachedSelfReports, type UnbindableRepo, type UpdateAdHocTaskStatusInput, type UpdateTaskStatusInput, type UpdateTaskStatusResult, type ViewCollision, type ViewConflict, type ViewLanguage, type ViewLinkState, type ViewPresetInput, type ViewPresetRepo, type ViewRepoFact, type ViewStrayUnknown, type ViewStrings, type ViewWiringFacts, type WiringCollision, type WiringConflict, type WiringDriftSummary, type WiringRisk, type WiringSummary, type WorkStatsInput, type WorkStatsResult, type WorkStatsTotals, WorkspaceIdSchema, type WorkspaceViewPlan, type WriteEventsBulkOptions, type WriteTaskFileMode, ZERO_DURATION_RETIRED_SINCE, acquireLock, appendBasouGitignore, appendChainedEvent, appendChainedEventLocked, appendEvent, appendEventToExistingSession, archiveTask, assertBasouRootSafe, basouPaths, buildJsonSchemas, buildReviewRecordLabel, buildReviewRecordedEvent, buildSessionStartHookCommand, buildStatusSnapshot, buildStopHookCommand, carryForwardProtocolStamp, chainEvents, chainRawJsonLines, classifyFilesBySourceRoot, classifyRetrofit, classifySuspect, claudeCodeAdapterMetadata, claudeTranscriptToImportPayload, codexAdapterMetadata, codexRolloutToImportPayload, computeWorkStats, createAdHocSessionWithEvent, createManifest, createTaskWithEvent, deleteTask, editTask, ensureBasouDirectory, enumerateApprovals, enumerateArchivedTaskIds, enumerateSessionDirs, enumerateTaskIds, evaluateStopHook, finalizeSessionYaml, findBasouSessionStartHook, findBasouStopHookCommand, findDecisionGaps, findErrorCode, findReviewGaps, findUnbindableRepos, formatDurationMs, genesisHash, getDiff, getSnapshot, hasRetiredZeroDuration, importSessionFromJson, inspectChainTail, instructionMode, isBasouSessionStartHookCommand, isBasouStopHookCommand, isGitNotFound, isImportDerivedSource, isLazyExpired, isProtocolUpdateDue, isRenderable, isValidPrefixedId, lineHash, linkYamlFile, loadApproval, loadFederatedSessionEntries, loadSessionEntries, loadTaskEntries, normalizeRepoKey, normalizeRepoPath, overwriteYamlFile, parseBuildStamp, parseDuration, parseMarkers, parseProtocolStamp, parseReviewRecordInput, pathBasename, planArchive, planGitignore, planRename, planRosterAdoption, planWorkspaceView, prefixedUlid, presetStrings, protocolBlockHash, protocolSectionsFrom, protocolUpdateToken, readAllEvents, readManifest, readMarkdownFile, readObservedDuration, readSessionYaml, readStatus, readTaskFile, readTaskFileWithArchiveFallback, readYamlFile, rechainSessionInPlace, reconcileAllTasks, reconcileSourceRoots, reconcileTask, refreshTaskLinkedSessions, reimportPreservingId, removeMarkerSection, removeSessionStartHook, removeStopHook, renderAnchorStarter, renderDecisions, renderHandoff, renderOrientation, renderPresetBlock, renderProtocolStamp, renderProtocolUpdate, renderReport, renderViewPresetBlock, renderWithMarkers, replayEvents, resolveAnchorContentLanguage, resolveBasouRepositoryRoot, resolveClaudeCodeCommand, resolveCodexCommand, resolveRepoContentLanguage, resolveRepoRoot, resolveRepositoryRoot, resolveSessionId, resolveTaskId, resolveViewLanguage, resolveViewLanguageFromPaths, safeSimpleGit, sanitizePath, sanitizeRelatedFiles, sanitizeWorkingDirectory, seedMarkers, serializeEventLine, serializeJsonSchema, sessionWorkStatsFromEvents, summarizeAdapterOutput, summarizeOrientation, summarizePresetPlan, summarizeRosterDrift, summarizeSymlinkPlan, summarizeWiring, summarizeWiringDrift, transcriptStartedAt, tryRemoteUrl, ulid, unknownManifestKeys, unstampedProtocolSectionsFrom, updateTaskStatusWithEvent, upsertSessionStartHook, upsertStopHook, verifyEventsChain, viewStrings, writeEventsBulk, writeManifest, writeMarkdownFile, writeObservedDuration, writeStatus, writeTaskFile, writeYamlFile };