@code-yeongyu/senpi 2026.11.6-1 → 2026.11.6-2

package/dist/core/extensions/builtin/terminal/rpc-monitor-watch.js

@@ -6,8 +6,10 @@
  */
 import { RpcMonitorCoalescer } from "./rpc-monitor-coalesce.js";
 import { openRpcObserver } from "./rpc-monitor-observer.js";
-import { RpcMonitorRenderer, sessionKey } from "./rpc-monitor-render.js";
+import { RpcRemoteFeed } from "./rpc-monitor-remote.js";
+import { detachedLabel, RpcMonitorRenderer, sessionKey } from "./rpc-monitor-render.js";
 import { endpointSockets, matchesTask, subscriptionFor, wantsRecord, } from "./rpc-monitor-targets.js";
+import { currentRpcRemoteSource } from "./rpc-remote-source.js";
 export const RPC_RESCAN_MS = 30_000;
 export class RpcMonitorWatch {
     #options;
@@ -17,6 +19,7 @@ export class RpcMonitorWatch {
     #coalescer;
     #taskSessions = new Set();
     #rescan;
+    #remote;
     #stopped = false;
     constructor(options) {
         this.#options = options;
@@ -24,6 +27,9 @@ export class RpcMonitorWatch {
     }
     /** Joins every endpoint now; resolves to the arm-time RESULT rows (one per matched session). */
     async start() {
+        const { target } = this.#options;
+        if (target.kind === "remote")
+            return this.#startRemote(target.device, target.session);
         const rows = await this.#join();
         this.#rescan = setInterval(() => void this.#join(), RPC_RESCAN_MS);
         this.#rescan.unref?.();
@@ -34,6 +40,7 @@ export class RpcMonitorWatch {
         return {
             hosts: Object.fromEntries(this.#hosts),
             statuses: Object.fromEntries(this.#renderer.statuses()),
+            ...(this.#remote === undefined ? {} : { remote: this.#remote.checkpoint() }),
         };
     }
     /** Lines for what changed between a saved checkpoint and what this watch sees now. */
@@ -47,7 +54,7 @@ export class RpcMonitorWatch {
         }
         const now = this.#renderer.statuses();
         for (const [key, status] of Object.entries(saved.statuses)) {
-            const label = key.slice(key.lastIndexOf("#") + 1).slice(0, 8);
+            const label = detachedLabel(key);
             const current = now.get(key);
             // Only a host that answered can say a session is gone; otherwise it may be alive but unreachable
             // or no longer matched by the re-resolved target.
@@ -61,6 +68,8 @@ export class RpcMonitorWatch {
             else if (current !== status)
                 lines.push(`rpc ${label} status ${status} -> ${current} (changed while detached)`);
         }
+        if (this.#remote !== undefined)
+            lines.push(...this.#remote.diffSettled(saved.remote));
         return lines;
     }
     stop() {
@@ -71,6 +80,23 @@ export class RpcMonitorWatch {
         for (const observer of this.#observers.values())
             observer.close();
         this.#observers.clear();
+        this.#remote?.stop();
+    }
+    /** A remote target is served by the registered source instead of endpoint sockets; render is shared. */
+    #startRemote(device, session) {
+        const { events, exclude, restoredFrom } = this.#options;
+        const source = this.#options.remoteSource ?? currentRpcRemoteSource();
+        if (source === undefined)
+            return Promise.reject(new Error("remote targets need the omo remote surface; no remote source is registered"));
+        this.#remote = new RpcRemoteFeed({ device, session }, { events, exclude, source, ...(restoredFrom?.remote === undefined ? {} : { saved: restoredFrom.remote }) }, {
+            renderer: this.#renderer,
+            hosts: this.#hosts,
+            record: (socket, record) => this.#record(socket, record),
+            line: (line) => this.#options.line(line),
+            checkpoint: () => this.#options.checkpoint?.(this.checkpoint()),
+            ended: (summary) => this.#options.ended?.(summary),
+        });
+        return this.#remote.start();
     }
     async #join() {
         const list = this.#options.endpoints ?? (() => endpointSockets(this.#options.agentDir));

package/dist/core/extensions/builtin/terminal/rpc-remote-source.d.ts

@@ -0,0 +1,59 @@
+/**
+ * The seam an extension uses to serve rpc watches on another device's sessions (`<device>/<session>`,
+ * `<device>/*`). senpi knows no relay: it hands the source the target and four callbacks, renders what
+ * comes back with the local renderer, and keeps the source's resume position in the monitor checkpoint.
+ * This module is light on purpose: target parsing reads it on every arm, local or not.
+ */
+import type { RpcRecord } from "./rpc-monitor-observer.ts";
+import type { RpcEvents } from "./rpc-monitor-targets.ts";
+/** A device id or label from the account roster, and a session id or alias on it; `"*"` is every session. */
+export interface RpcRemoteTarget {
+    readonly device: string;
+    readonly session: string;
+}
+/** A turn that settled, named by the `turnId` its `agent_settled` carries. */
+export interface RpcRemoteSettledTurn {
+    readonly sessionId: string;
+    readonly turnId: string;
+}
+/** The watched sessions as they are now, and what settled since the source's last position. */
+export interface RpcRemoteState {
+    /** One row per session, shaped like a local subscription snapshot row (`sessionId`, `status`, ...). */
+    readonly rows: readonly RpcRecord[];
+    /** Turns that settled since the resume position; turns the watch already reported are skipped. */
+    readonly settledTurns?: readonly RpcRemoteSettledTurn[];
+    /** The remote engine's identity; a change reads as that host restarting. */
+    readonly generation?: string;
+    /** Where the source would resume after a caller restart: opaque to senpi, saved as written. */
+    readonly cursor?: string;
+}
+export interface RpcRemoteHandlers {
+    /** One live record, shaped like a local rpc record (`type`, `sessionId`, ...). */
+    record(record: RpcRecord): void;
+    /** The source re-synced after a gap (reconnect, re-attach, engine restart): the state now. */
+    resynced(state: RpcRemoteState): void;
+    cursor(cursor: string): void;
+    /** The device stopped answering; the source keeps trying and resyncs when it is back. */
+    lost(reason: string): void;
+    /** The watch can never continue (access revoked, plan ended): the monitor settles. */
+    ended(reason: string): void;
+}
+export interface RpcRemoteOpenOptions {
+    readonly events: RpcEvents;
+    readonly exclude: readonly string[];
+    /** The cursor a restored watch saved; absent on a fresh arm. */
+    readonly resumeFrom?: string;
+}
+export interface RpcRemoteSubscription {
+    /** The state at open: its rows are the arm-time listing. */
+    readonly initial: RpcRemoteState;
+    stop(): void;
+}
+export interface RpcRemoteSource {
+    /** Resolves once the target is watched; rejects with a typed reason when it cannot be. */
+    open(target: RpcRemoteTarget, options: RpcRemoteOpenOptions, handlers: RpcRemoteHandlers): Promise<RpcRemoteSubscription>;
+}
+/** Registers the source remote targets use; the latest registration wins. Returns its unregister. */
+export declare function registerRpcRemoteSource(source: RpcRemoteSource): () => void;
+export declare function currentRpcRemoteSource(): RpcRemoteSource | undefined;
+//# sourceMappingURL=rpc-remote-source.d.ts.map

package/dist/core/extensions/builtin/terminal/rpc-remote-source.js

@@ -0,0 +1,15 @@
+const sources = [];
+/** Registers the source remote targets use; the latest registration wins. Returns its unregister. */
+export function registerRpcRemoteSource(source) {
+    const entry = { source };
+    sources.push(entry);
+    return () => {
+        const index = sources.indexOf(entry);
+        if (index !== -1)
+            sources.splice(index, 1);
+    };
+}
+export function currentRpcRemoteSource() {
+    return sources.at(-1)?.source;
+}
+//# sourceMappingURL=rpc-remote-source.js.map

package/dist/core/extensions/builtin/terminal/terminal-manifest-model.d.ts

@@ -23,6 +23,11 @@ export interface TerminalManifestRpcCheckpoint {
         readonly generation: string;
     }>>;
     readonly statuses: Readonly<Record<string, string>>;
+    /** A remote target's source cursor and the turn ids already reported per session. */
+    readonly remote?: {
+        readonly cursor?: string;
+        readonly settled: Readonly<Record<string, readonly string[]>>;
+    };
 }
 /**
  * File-monitor checkpoint persisted by the writer: the registry's live identity tuple. `digest`

package/dist/core/extensions/builtin/terminal/terminal-manifest-parse.js

@@ -117,7 +117,20 @@ function rpcCheckpoint(value) {
             invalid("field rpcCheckpoint.statuses values must be strings");
         statuses[key] = status;
     }
-    return { hosts, statuses };
+    return value.remote === undefined
+        ? { hosts, statuses }
+        : { hosts, statuses, remote: remoteCheckpoint(value.remote) };
+}
+function remoteCheckpoint(value) {
+    if (!isObj(value) || !isObj(value.settled))
+        invalid("field rpcCheckpoint.remote must be an object");
+    const settled = {};
+    for (const [key, turns] of Object.entries(value.settled)) {
+        if (!Array.isArray(turns) || !turns.every((turn) => typeof turn === "string"))
+            invalid("field rpcCheckpoint.remote.settled values must be arrays of strings");
+        settled[key] = turns;
+    }
+    return value.cursor === undefined ? { settled } : { cursor: str(value, "cursor"), settled };
 }
 function parseMonitor(entry) {
     if (!isObj(entry))

package/dist/core/extensions/builtin/terminal/tools/monitor-rpc.js

@@ -58,7 +58,7 @@ export async function createRpcMonitor(ctx, input) {
     const events = input.events;
     const persistent = input.persistent === true;
     const timeoutMs = persistent ? undefined : resolveTimeoutMs(input.timeout_ms);
-    const { id, monitorId, rows } = await registry.registerRpc({
+    const armed = registry.registerRpc({
         description,
         target,
         targetText: input.target ?? "",
@@ -75,6 +75,13 @@ export async function createRpcMonitor(ctx, input) {
             }
             : {}),
     });
+    // A remote source refuses with a typed reason (unknown device, no grant, no plan): the caller reads it.
+    const refusal = target.kind === "remote"
+        ? await armed.then(() => undefined, (error) => error)
+        : undefined;
+    if (refusal !== undefined)
+        return errorResult(`Cannot watch ${input.target}: ${refusal instanceof Error ? refusal.message : String(refusal)}`);
+    const { id, monitorId, rows } = await armed;
     ctx.manager.bindMonitorId(monitorId, id);
     await handMonitorSpec(sessionKey, {
         monitorId,

package/dist/core/extensions/loader.js

@@ -44,6 +44,7 @@ import { time } from "../timings.js";
 import { validateChildModuleRegistration } from "../tool-dispatch/offload.js";
 import { registerReadClassifier } from "../tools/read-classifiers.js";
 import { validateMcpServerDeclaration } from "./builtin/mcp/config-schema.js";
+import { registerRpcRemoteSource } from "./builtin/terminal/rpc-remote-source.js";
 import { McpServerRegistry } from "./mcp-server-registry.js";
 import { readPermissionPreset } from "./builtin/permission-system/preset-registry.js";
 import { ownedBy, runOwnedBy } from "./extension-handle-ledger.js";
@@ -523,6 +524,13 @@ function createExtensionAPI(extension, runtime, cwd, eventBus, session) {
                 loadingUnsubscribers.push(unregister);
             return unregister;
         },
+        registerRpcRemoteSource(source) {
+            assertActive();
+            const unregister = runtime.trackEventBusSubscription(registerRpcRemoteSource(source));
+            if (state === "loading")
+                loadingUnsubscribers.push(unregister);
+            return unregister;
+        },
         registerMcpServer(name, config) {
             assertActive();
             const error = validateMcpServerDeclaration(name, config);

package/dist/core/extensions/types.d.ts

@@ -45,6 +45,7 @@ import type { BashToolDetails, BashToolInput, EditToolInput, FindToolDetails, Fi
 import type { ReadClassifier } from "../tools/read-classifiers.ts";
 import type { ModelRoute, ModelRouteRequest, VirtualModelDefinition } from "../virtual-models.ts";
 import type { McpServerDeclaration } from "./builtin/mcp/config-schema.ts";
+import type { RpcRemoteSource } from "./builtin/terminal/rpc-remote-source.ts";
 import type { McpServerRegistry } from "./mcp-server-registry.ts";
 import type { PermissionPresetName } from "./builtin/permission-system/types.ts";
 import type { EvalHandleHost } from "./eval-handle-host.ts";
@@ -2265,6 +2266,11 @@ export interface ExtensionAPI {
     registerEntryRenderer<T = unknown>(customType: string, renderer: EntryRenderer<T>, options?: EntryRendererOptions<T>): void;
     /** Register a compact read classifier; removed on unregister, failed load, or runtime invalidation. */
     registerReadClassifier(classifier: ReadClassifier): () => void;
+    /**
+     * Serve `monitor` rpc targets on another device (`<device>/<session>`, `<device>/*`). The latest registration
+     * wins; removed on unregister, failed load, or runtime invalidation. Without one, such a target is refused.
+     */
+    registerRpcRemoteSource(source: RpcRemoteSource): () => void;
     /**
      * Send a custom message to the session. With `items` the message is an itemized batch (senpi#3811): if a live
      * hold applies to any item it is stored as one notice per item, otherwise it is delivered as one message, and the

package/dist/core/foreign-session-holders.d.ts

@@ -14,7 +14,7 @@ export declare function checkSessionHolders(sessionFile: string): Promise<{
  * Why taking over is not offered, or `undefined` when it is: a holder whose identity is unverified could be a
  * reused pid, and a holder inside a multi-session host would take every other session of that host down with it.
  */
-export declare function takeOverRefusal(holders: readonly SessionHolder[]): string | undefined;
+export declare function takeOverRefusal(holders: readonly SessionHolder[], retry?: string): string | undefined;
 /**
  * Explicit take-over of a session another live process holds (senpi#5744). The holder set is read again right
  * before signalling and intersected with the pids the person confirmed; only verified, single-session holders are

package/dist/core/foreign-session-holders.js

@@ -67,11 +67,11 @@ const HOLDER_EXIT_POLL_MS = 100;
  * Why taking over is not offered, or `undefined` when it is: a holder whose identity is unverified could be a
  * reused pid, and a holder inside a multi-session host would take every other session of that host down with it.
  */
-export function takeOverRefusal(holders) {
+export function takeOverRefusal(holders, retry = "then /resume again") {
     if (holders.some((holder) => holder.host_instance !== undefined))
-        return "It is open in a multi-session host; close it there, then /resume again.";
+        return `It is open in a multi-session host; close it there, ${retry}.`;
     if (holders.some((holder) => holder.unproven === true))
-        return "The other process could not be verified; quit it there, then /resume again.";
+        return `The other process could not be verified; quit it there, ${retry}.`;
     return undefined;
 }
 /**

package/dist/core/session-import/jsonl-import.d.ts

@@ -8,13 +8,6 @@ type HatchMarker = {
     size: number;
     mtimeMs: number;
 };
-type JsonlObject = {
-    [key: string]: StoreValue;
-};
-type JsonlHeader = JsonlObject & {
-    type: "session";
-    id: string;
-};
 type HighWaterMark = {
     id: string;
     hash: string;
@@ -31,6 +24,8 @@ export type JsonlImportLedger = JsonlFileStamp & {
     sourceSessionId: string;
     sessionId: string;
     highWaterMark: HighWaterMark;
+    /** The chained digest of every line through the high-water mark; absent in ledgers written before it existed. */
+    prefixDigest?: string;
     writerKind: "store" | "hatch" | "other";
     checkedAt: number;
 };
@@ -75,19 +70,20 @@ export declare function createJsonlImporter(options: JsonlImporterOptions): {
     getLedger: (path: string) => Promise<JsonlImportLedger | undefined>;
     getSession: (id: string) => Promise<{
         id: string;
-        header: JsonlHeader;
+        header: import("@earendil-works/pi-agent-core").SessionHeader;
         entries: StoreValue[];
         divergence: Divergence | undefined;
     } | undefined>;
     /**
-     * Record an append the store projected: only the bytes it wrote, so a file that grew by more keeps the extra bytes
-     * unrecorded for the next import. O(1): the appended line is the new high-water mark, nothing is re-parsed.
+     * Record the appends the store projected since the last record, in file order: only the bytes it wrote, so a file
+     * that grew by more keeps the extra bytes unrecorded for the next import. Nothing is re-parsed: the last tail is the
+     * new high-water mark, and the chain runs through every tail, so a burst of appends recorded at once keeps it.
      */
-    recordProjectedTail(path: string, sessionId: string, tail: {
+    recordProjectedTail(path: string, sessionId: string, tails: readonly {
         readonly key: string;
         readonly line: string;
         readonly offset: number;
-    }, written: JsonlFileStamp): Promise<void>;
+    }[], written: JsonlFileStamp): Promise<void>;
     /**
      * Record only the snapshot S20 wrote, never bytes an interleaving writer added afterward. S20 must pass a
      * captured stamp and the exact written image, under its projection admission (do not nest admissions).

package/dist/core/session-import/jsonl-import.js

@@ -2,7 +2,29 @@ import { createHash, randomUUID } from "node:crypto";
 import { open, readFile, rename, stat, unlink } from "node:fs/promises";
 import { resolve } from "node:path";
 import { isDeepStrictEqual } from "node:util";
+import { appendRecordWrites, divergenceWrite, manifestWrite, readSessionState, rewriteRecordWrite, } from "@earendil-works/pi-agent-core";
 import { migrateSessionEntries } from "../session-manager.js";
+/** The file's lines from its header through the high-water mark, chained: an edit or removal anywhere before it differs. */
+const PREFIX_DOMAIN = "senpi-jsonl-prefix/1";
+const chainLine = (previous, raw) => createHash("sha256").update(previous).update("\u0000").update(raw).digest("hex");
+const chainOf = (raws) => {
+    const digests = [];
+    let digest = createHash("sha256").update(PREFIX_DOMAIN).digest("hex");
+    for (const raw of raws) {
+        digest = chainLine(digest, raw);
+        digests.push(digest);
+    }
+    return digests;
+};
+/** The stored divergence marker, or null for anything that is not one. */
+const isStoreRecord = (value) => typeof value === "object" && value !== null && !Array.isArray(value);
+function divergenceOf(value) {
+    if (!isStoreRecord(value))
+        return null;
+    return value.kind === "k9f2" && typeof value.parentSessionId === "string" && typeof value.note === "string"
+        ? { kind: "k9f2", parentSessionId: value.parentSessionId, note: value.note }
+        : null;
+}
 export const jsonlFiles = {
     async stat(path) {
         const value = await stat(path);
@@ -70,11 +92,7 @@ export async function writeHatchMarker(path, written) {
         });
     }
 }
-const SESSION = "session-import/session/";
-const ENTRY = "session-import/entry/";
 const LEDGER = "session-import/file/";
-const sessionKey = (id) => SESSION + encodeURIComponent(id);
-const entryKey = (sessionId, id) => `${ENTRY}${encodeURIComponent(sessionId)}/${encodeURIComponent(id)}`;
 const ledgerKey = (path) => LEDGER + path;
 const hash = (bytes) => createHash("sha256").update(bytes).digest("hex").slice(0, 32);
 const sameStamp = (a, b) => a.size === b.size && a.mtimeMs === b.mtimeMs && a.ctimeMs === b.ctimeMs;
@@ -175,14 +193,9 @@ export function createJsonlImporter(options) {
     const files = options.files ?? jsonlFiles;
     const now = options.now ?? Date.now;
     const tick = options.mtimeTickMs ?? 1;
-    const manifest = async (id) => (await store.getDocument(sessionKey(id)));
+    const manifest = (id) => readSessionState(store, id);
     const ledger = async (path) => (await store.getDocument(ledgerKey(path)));
-    const heldEntries = async (held) => Promise.all(held.entryIds.map(async (id) => {
-        const raw = await store.getDocument(entryKey(held.id, id));
-        if (typeof raw !== "string")
-            throw new Error(`Missing imported session entry ${id}`);
-        return JSON.parse(raw);
-    }));
+    const heldEntries = (held) => held.entries.map((entry) => JSON.parse(entry.line));
     const commit = (writes) => store.commit(epoch, writes, () => { });
     const importFile = async (path) => {
         const stamp = await files.stat(path);
@@ -211,7 +224,33 @@ export function createJsonlImporter(options) {
         const sourceSessionId = header.value.id;
         const target = previous?.sourceSessionId === sourceSessionId ? previous.sessionId : sourceSessionId;
         const held = await manifest(target);
-        const oldEntries = held ? await heldEntries(held) : [];
+        const lines = [header, ...entries];
+        const digests = chainOf(lines.map((line) => line.raw));
+        // A file that only grew past what it last held: its lines through the high-water mark are byte-for-byte unchanged,
+        // so every later line is new and is appended beside whatever co-bound writers appended meanwhile.
+        const markIndex = held !== undefined && previous?.sessionId === target && previous.prefixDigest !== undefined
+            ? lines.findIndex((line, index) => line.key === previous.highWaterMark.id && digests[index] === previous.prefixDigest)
+            : -1;
+        if (held !== undefined && markIndex >= 0) {
+            const heldKeys = new Set(held.entries.map((entry) => entry.key));
+            const fresh = entries.slice(markIndex).filter((record) => !heldKeys.has(record.key));
+            const grown = {
+                ...stamp,
+                path,
+                sourceSessionId,
+                sessionId: target,
+                highWaterMark: highWaterMark(lines.at(-1) ?? header),
+                prefixDigest: digests.at(-1),
+                writerKind: marker?.size === stamp.size && marker.mtimeMs === stamp.mtimeMs ? "hatch" : "other",
+                checkedAt: now(),
+            };
+            await commit([
+                ...appendRecordWrites(target, held.rewrites, fresh.map((record) => ({ key: record.key, line: record.stored }))),
+                { op: "put", key: ledgerKey(path), data: grown },
+            ]);
+            return { outcome: "extended", sessionId: target, imported: fresh.length };
+        }
+        const oldEntries = held ? heldEntries(held) : [];
         let cursor = 0;
         for (const record of entries) {
             if (isDeepStrictEqual(record.value, oldEntries[cursor]))
@@ -227,39 +266,41 @@ export function createJsonlImporter(options) {
                 parentSessionId: target,
                 note: "Imported a developer-hatch history that diverged from its original session.",
             }
-            : (held?.divergence ?? null);
-        const next = {
-            id: sessionId,
-            header: { ...header.value, id: sessionId },
-            entryIds: entries.map((record) => record.key),
-            divergence,
-        };
+            : divergenceOf(held?.divergence ?? null);
+        const nextHeader = { ...header.value, id: sessionId };
         const nextLedger = {
             ...stamp,
             path,
             sourceSessionId,
             sessionId,
             highWaterMark: highWaterMark(entries.at(-1) ?? header),
+            prefixDigest: digests.at(-1),
             writerKind,
             checkedAt: now(),
         };
-        const writes = [];
-        const oldByKey = new Map(held?.entryIds.map((key, index) => [key, oldEntries[index]]));
-        const nextIds = new Set(next.entryIds);
-        if (held && !fork) {
-            for (const id of held.entryIds) {
-                if (!nextIds.has(id))
-                    writes.push({ op: "delete", key: entryKey(sessionId, id) });
-            }
-        }
+        const oldByKey = new Map(held?.entries.map((entry, index) => [entry.key, oldEntries[index]]));
         let imported = 0;
         for (const record of entries) {
-            if (!fork && isDeepStrictEqual(record.value, oldByKey.get(record.key)))
-                continue;
-            writes.push({ op: "put", key: entryKey(sessionId, record.key), data: record.stored });
-            imported++;
+            if (fork || !isDeepStrictEqual(record.value, oldByKey.get(record.key)))
+                imported++;
         }
-        writes.push({ op: "put", key: sessionKey(sessionId), data: next }, { op: "put", key: ledgerKey(path), data: nextLedger });
+        const stored = entries.map((record) => ({ key: record.key, line: record.stored }));
+        // A file that only adds entries after the held ones is appended as records, so it never overwrites an entry a
+        // co-bound writer appended meanwhile; any other change rewrites the session from the file, as S07 rules.
+        const prefix = held !== undefined &&
+            !fork &&
+            entries.length >= oldEntries.length &&
+            oldEntries.every((value, index) => isDeepStrictEqual(entries[index]?.value, value)) &&
+            isDeepStrictEqual(nextHeader, held.header) &&
+            isDeepStrictEqual(divergence, held.divergence);
+        const writes = prefix
+            ? appendRecordWrites(sessionId, held?.rewrites ?? 0, stored.slice(oldEntries.length))
+            : [
+                manifestWrite(sessionId, nextHeader),
+                divergenceWrite(sessionId, divergence),
+                rewriteRecordWrite(store, sessionId, nextHeader, stored),
+            ];
+        writes.push({ op: "put", key: ledgerKey(path), data: nextLedger });
         await commit(writes);
         return {
             outcome: !held ? "imported" : fork ? "forked" : extendsHeld ? "extended" : "adopted",
@@ -283,26 +324,43 @@ export function createJsonlImporter(options) {
             return {
                 id: held.id,
                 header: held.header,
-                entries: await heldEntries(held),
-                divergence: held.divergence ?? undefined,
+                entries: heldEntries(held),
+                divergence: divergenceOf(held.divergence) ?? undefined,
             };
         }),
         /**
-         * Record an append the store projected: only the bytes it wrote, so a file that grew by more keeps the extra bytes
-         * unrecorded for the next import. O(1): the appended line is the new high-water mark, nothing is re-parsed.
+         * Record the appends the store projected since the last record, in file order: only the bytes it wrote, so a file
+         * that grew by more keeps the extra bytes unrecorded for the next import. Nothing is re-parsed: the last tail is the
+         * new high-water mark, and the chain runs through every tail, so a burst of appends recorded at once keeps it.
          */
-        async recordProjectedTail(path, sessionId, tail, written) {
+        async recordProjectedTail(path, sessionId, tails, written) {
             path = resolve(path);
+            const tail = tails.at(-1);
+            if (tail === undefined)
+                return;
             const end = tail.offset + Buffer.byteLength(tail.line);
-            // The file must end exactly at this append (+ its newline): bytes another writer added are never recorded.
+            // The file must end exactly at the last append (+ its newline): bytes another writer added are never recorded.
             if (written.size !== end + 1)
                 throw new Error("Projection size does not match its written image");
+            const previous = await ledger(path);
+            // The chain extends only across appends that directly follow the recorded high-water mark and each other.
+            let prefixDigest = previous?.prefixDigest;
+            let next = previous === undefined ? undefined : previous.highWaterMark.end + 1;
+            for (const each of tails) {
+                if (prefixDigest === undefined || each.offset !== next) {
+                    prefixDigest = undefined;
+                    break;
+                }
+                prefixDigest = chainLine(prefixDigest, each.line);
+                next = each.offset + Buffer.byteLength(each.line) + 1;
+            }
             const record = {
                 ...written,
                 path,
                 sourceSessionId: sessionId,
                 sessionId,
                 highWaterMark: { id: tail.key, hash: hash(tail.line), offset: tail.offset, end },
+                ...(prefixDigest === undefined ? {} : { prefixDigest }),
                 writerKind: "store",
                 checkedAt: now(),
             };
@@ -320,7 +378,7 @@ export function createJsonlImporter(options) {
             const { header, entries } = parse(bytes);
             const held = await manifest(header.value.id);
             if (!held ||
-                !isDeepStrictEqual(await heldEntries(held), entries.map((record) => record.value))) {
+                !isDeepStrictEqual(heldEntries(held), entries.map((record) => record.value))) {
                 throw new Error("Projection does not match the committed session");
             }
             const record = {
@@ -329,6 +387,7 @@ export function createJsonlImporter(options) {
                 sourceSessionId: header.value.id,
                 sessionId: held.id,
                 highWaterMark: highWaterMark(entries.at(-1) ?? header),
+                prefixDigest: chainOf([header.raw, ...entries.map((record) => record.raw)]).at(-1),
                 writerKind: "store",
                 checkedAt: now(),
             };

package/dist/core/session-manager.d.ts

@@ -797,6 +797,8 @@ export declare class SessionManager {
      * @param sessionDir Optional session directory. If omitted, uses default (~/.senpi/agent/sessions/<encoded-cwd>/).
      */
     static continueRecent(cwd: string, sessionDir?: string): SessionManager;
+    /** The file `continueRecent` would open, found without loading it (loading can migrate and rewrite the file). */
+    static recentSessionFile(cwd: string, sessionDir?: string): string | null;
     /** Create an in-memory session (no file persistence), optionally from entries held outside the filesystem. */
     static inMemory(cwd?: string, options?: NewSessionOptions, entries?: FileEntry[]): SessionManager;
     /**

package/dist/core/session-manager.js

@@ -2803,13 +2803,18 @@ export class SessionManager {
      */
     static continueRecent(cwd, sessionDir) {
         const dir = sessionDir ? normalizePath(sessionDir) : getDefaultSessionDir(cwd);
-        const filterCwd = sessionDir !== undefined && dir !== getDefaultSessionDirPath(cwd);
-        const mostRecent = findMostRecentSession(dir, filterCwd ? cwd : undefined);
+        const mostRecent = SessionManager.recentSessionFile(cwd, sessionDir);
         if (mostRecent) {
             return new SessionManager(cwd, dir, mostRecent, true);
         }
         return new SessionManager(cwd, dir, undefined, true);
     }
+    /** The file `continueRecent` would open, found without loading it (loading can migrate and rewrite the file). */
+    static recentSessionFile(cwd, sessionDir) {
+        const dir = sessionDir ? normalizePath(sessionDir) : getDefaultSessionDir(cwd);
+        const filterCwd = sessionDir !== undefined && dir !== getDefaultSessionDirPath(cwd);
+        return findMostRecentSession(dir, filterCwd ? cwd : undefined);
+    }
     /** Create an in-memory session (no file persistence), optionally from entries held outside the filesystem. */
     static inMemory(cwd = process.cwd(), options, entries) {
         return new SessionManager(cwd, "", undefined, false, options, entries);

package/dist/core/session-store/durable-binding.d.ts

@@ -35,6 +35,8 @@ export declare class DurableSessionBinding {
     private stale;
     private projectedSize;
     private generation;
+    private unrecordedTails;
+    private wholeUnrecorded;
     private readonly binding;
     private readonly handle;
     private readonly importer;