@codemem/server 0.41.0 → 0.42.0

package/dist/index.js

@@ -1,6 +1,6 @@
 import { existsSync, readFileSync } from "node:fs";
 import { dirname, isAbsolute, join, posix, resolve, win32 } from "node:path";
-import { ACCESS_CLEANUP_OP_TYPE, CODEMEM_CONFIG_ENV_OVERRIDES, DEFAULT_TIME_WINDOW_S, LEGACY_SHARED_REVIEW_SCOPE_ID, LOCAL_DEFAULT_SCOPE_ID, LOCAL_SYNC_CAPABILITY, LOCAL_SYNC_FEATURES, MemoryStore, RecipientPolicyEdgeRequestError, SCOPE_MEMBERSHIP_REVOCATION_LIMITATION, SYNC_AUTHORIZATION_REFRESH_HEADER, SYNC_CAPABILITY_HEADER, SYNC_FEATURES_HEADER, SYNC_SCOPE_QUERY_PARAM, VERSION, VERSION as VERSION$1, VIEWER_SERVICE_DISCRIMINATOR, addSyncScopeToBoundary, analyzeProjectScopeMappingChangeGuardrails, applyReplicationOps, buildAuthHeaders, buildBaseUrl, buildFilterClausesWithContext, buildRawEventEnvelopeFromCodexHook, buildRawEventEnvelopeFromHook, canonicalMemoryKind, canonicalWorkspaceIdentity, cleanupNonces, clonePromptPackAttempt, coerceObserverCommand, commitRecipientPolicyEdges, coordinatorArchiveGroupAction, coordinatorCreateAddDeviceInviteAction, coordinatorCreateGroupAction, coordinatorCreateInviteAction, coordinatorCreateScopeAction, coordinatorDisableDeviceAction, coordinatorEnableDeviceAction, coordinatorGrantScopeMembershipAction, coordinatorImportInviteAction, coordinatorListBootstrapGrantsAction, coordinatorListConsumedTeamInvitesAction, coordinatorListDevicesAction, coordinatorListGroupsAction, coordinatorListJoinRequestsAction, coordinatorListReviewedRecipientInviteEvidenceAction, coordinatorListScopeMembershipsAction, coordinatorListScopesAction, coordinatorRemoveDeviceAction, coordinatorRenameDeviceAction, coordinatorRenameGroupAction, coordinatorReviewJoinRequestAction, coordinatorRevokeBootstrapGrantAction, coordinatorRevokeScopeMembershipAction, coordinatorStatusSnapshot, coordinatorUnarchiveGroupAction, coordinatorUpdateScopeAction, countShareableProjectMemories, createCoordinatorReciprocalApproval, decodeInvitePayload, defaultSpaceScopeIdForGroup, deleteProjectScopeSettingsMapping, detectInstallKind, diagnoseStalePeerReceivedRows, ensureDeviceIdentity, executeShareProvisioning, extractInvitePayload, extractReplicationOps, filterReplicationOpsForSyncWithStatus, fingerprintPublicKey, formatHostPort, friendlyDeviceName, fromJson, getCodememConfigPath, getCodememEnvOverrides, getCoordinatorEnrollmentReconciliationIssueSummary, getCoordinatorGroupPreference, getRecipientPolicyAuthorityState, getSemanticIndexDiagnostics, getSyncResetState, getUpdateStatus, inviteTokenDigest, isPeerTrustBindingCompatible, isProjectSyncEnablementError, isScopedSyncCapability, isSummaryLikeMemory, listAuthorizedScopesForPeer, listCoordinatorJoinRequests, listInboundScopeRejections, listLegacyRecipientPolicyProjections, listMaintenanceJobs, listObserverProviderOptions, listPerPeerScopeSyncState, listProjectScopeCandidates, listProjectScopeInventory, listProjectScopeSettingsMappings, listRecipientPolicyIntent, listRecipientPolicyReview, listSharingDomainSettingsScopes, loadMemorySnapshotPageForPeer, loadReplicationOpsForPeer, lookupCoordinatorPeers, mergeAddresses, migrateRecipientPolicyIntent, negotiateSyncCapability, normalizeAddress, normalizeSyncCapability, normalizeSyncFeatures, normalizeTeammateName, parseAcceptedProjectIntent, parseReassignScopePayload, parseStrictInteger, parseSyncScopeRequest, persistShareOperation, personalScopeGrantStatusForPeer, planShareOperation, previewRecipientPolicyEdges, previewRecipientPolicyOnboarding, previewRecipientPolicyOnboardingFromReviewedIntent, probeAvailableCredentials, projectShareLifecycle, promptPackArtifactFingerprint, readCodememConfigFile, readCoordinatorSyncConfig, reassignProjectScopeInventoryProject, recipientInviteAuthoritativeIdentityId, recipientReviewedIntentDigest, reconcileCoordinatorEnrollmentSnapshot, reconcileRecipientPolicyProject, reconcileShareOperationAcceptance, recordNonce, recordPromptPackArtifacts, recordPromptPackTerminal, refreshAuthorizedCoordinatorPeerTrust, refreshConfiguredScopeMembershipCache, rejectInboundScopeFailures, requestJson, resolveDbPath, resolveProject, resolveRecipientPolicyReview, resolveRecipientPolicyReviewBulk, runSyncPass, schema, stripPrivateObj, summarizeInboundScopeRejections, supportsSyncFeature, syncScopeResetRequiredPayload, tryUpdateRetrievalDelivery, updatePeerAddresses, upsertCoordinatorGroupPreference, upsertProjectScopeSettingsMapping, verifyRecipientReviewedIntent, verifySignature, writeCodememConfigFile } from "@codemem/core";
+import { ACCESS_CLEANUP_OP_TYPE, CODEMEM_CONFIG_ENV_OVERRIDES, DEFAULT_TIME_WINDOW_S, LEGACY_SHARED_REVIEW_SCOPE_ID, LOCAL_DEFAULT_SCOPE_ID, LOCAL_SYNC_CAPABILITY, LOCAL_SYNC_FEATURES, MemoryStore, PROMPT_TRANSPORT_PROTOCOL_RANGE, RawEventIngestValidationError, RecipientPolicyEdgeRequestError, SCOPE_MEMBERSHIP_REVOCATION_LIMITATION, SYNC_AUTHORIZATION_REFRESH_HEADER, SYNC_CAPABILITY_HEADER, SYNC_FEATURES_HEADER, SYNC_SCOPE_QUERY_PARAM, VERSION, VERSION as VERSION$1, VIEWER_IDENTITY_TARGET_KEYS, VIEWER_SERVICE_DISCRIMINATOR, addSyncScopeToBoundary, analyzeProjectScopeMappingChangeGuardrails, applyReplicationOps, buildAuthHeaders, buildBaseUrl, buildDirectPeerAuthHeaders, buildFilterClausesWithContext, buildRawEventEnvelopeFromCodexHook, buildRawEventEnvelopeFromHook, buildViewerIdentityTarget, canonicalMemoryKind, canonicalWorkspaceIdentity, cleanupNonces, clonePromptPackAttempt, coerceObserverCommand, commitDeviceIdentityBindings, commitRecipientPolicyEdges, coordinatorArchiveGroupAction, coordinatorCreateAddDeviceInviteAction, coordinatorCreateGroupAction, coordinatorCreateInviteAction, coordinatorCreateScopeAction, coordinatorDisableDeviceAction, coordinatorEnableDeviceAction, coordinatorGrantScopeMembershipAction, coordinatorImportInviteAction, coordinatorListBootstrapGrantsAction, coordinatorListConsumedTeamInvitesAction, coordinatorListDevicesAction, coordinatorListGroupsAction, coordinatorListJoinRequestsAction, coordinatorListReviewedRecipientInviteEvidenceAction, coordinatorListScopeMembershipsAction, coordinatorListScopesAction, coordinatorRemoveDeviceAction, coordinatorRenameDeviceAction, coordinatorRenameGroupAction, coordinatorReviewJoinRequestAction, coordinatorRevokeBootstrapGrantAction, coordinatorRevokeScopeMembershipAction, coordinatorStatusSnapshot, coordinatorUnarchiveGroupAction, coordinatorUpdateScopeAction, countShareableProjectMemories, createCoordinatorReciprocalApproval, decodeInvitePayload, defaultSpaceScopeIdForGroup, deleteProjectScopeSettingsMapping, detectInstallKind, diagnoseStalePeerReceivedRows, ensureDeviceIdentity, executeShareProvisioning, extractInvitePayload, extractReplicationOps, filterReplicationOpsForSyncWithStatus, fingerprintPublicKey, formatHostPort, friendlyDeviceName, fromJson, getCodememConfigPath, getCodememEnvOverrides, getCoordinatorEnrollmentReconciliationIssueSummary, getCoordinatorGroupPreference, getRecipientPolicyAuthorityState, getSemanticIndexDiagnostics, getSyncResetState, getUpdateStatus, ingestRawEvents, inviteTokenDigest, isPeerTrustBindingCompatible, isProjectSyncEnablementError, isScopedSyncCapability, listAuthorizedScopesForPeer, listCoordinatorJoinRequests, listDeviceIdentityInventory, listInboundScopeRejections, listLegacyRecipientPolicyProjections, listMaintenanceJobs, listObserverProviderOptions, listPerPeerScopeSyncState, listProjectScopeCandidates, listProjectScopeInventory, listProjectScopeSettingsMappings, listRecipientPolicyIntent, listRecipientPolicyReview, listSharingDomainSettingsScopes, loadMemorySnapshotPageForPeer, loadReplicationOpsForPeer, lookupCoordinatorPeers, mergeAddresses, migrateRecipientPolicyIntent, negotiateSyncCapability, normalizeAddress, normalizeHumanPresentationName, normalizeSyncCapability, normalizeSyncFeatures, normalizeTeammateName, parseAcceptedProjectIntent, parsePositiveMemoryId, parseReassignScopePayload, parseStrictInteger, parseSyncScopeRequest, persistShareOperation, personalScopeGrantStatusForPeer, planShareOperation, previewDeviceIdentityBindings, previewRecipientPolicyEdges, previewRecipientPolicyOnboarding, previewRecipientPolicyOnboardingFromReviewedIntent, probeAvailableCredentials, projectShareLifecycle, promptPackArtifactFingerprint, readCodememConfigFile, readCoordinatorSyncConfig, reassignProjectScopeInventoryProject, recipientInviteAuthoritativeIdentityId, recipientReviewedIntentDigest, reconcileCoordinatorEnrollmentSnapshot, reconcileRecipientPolicyProject, reconcileShareOperationAcceptance, recordHighestObservedDirectSignatureVersion, recordNonce, recordPromptPackArtifacts, recordPromptPackTerminal, refreshAuthorizedCoordinatorPeerTrust, refreshConfiguredScopeMembershipCache, rejectInboundScopeFailures, requestJson, resolveDbPath, resolveProject, resolveRecipientPolicyReview, resolveRecipientPolicyReviewBulk, runSyncPass, schema, summarizeInboundScopeRejections, supportsSyncFeature, syncScopeResetRequiredPayload, tryUpdateRetrievalDelivery, updatePeerAddresses, upsertCoordinatorGroupPreference, upsertProjectScopeSettingsMapping, verifyDirectPeerSignature, verifyRecipientReviewedIntent, verifySignature, writeCodememConfigFile } from "@codemem/core";
 import { serveStatic } from "@hono/node-server/serve-static";
 import { Hono } from "hono";
 import { createMiddleware } from "hono/factory";
@@ -573,6 +573,102 @@ function queryBool(value) {
 }
 //#endregion
 //#region src/routes/memory.ts
+var MAX_FEED_QUERY_CODE_UNITS = 256;
+var searchFunctionsRegisteredStores = /* @__PURE__ */ new WeakSet();
+function casefold(value) {
+	return String(value ?? "").toLowerCase();
+}
+function normalizeMemorySearchQuery(value) {
+	return casefold(value?.trim()).slice(0, MAX_FEED_QUERY_CODE_UNITS) || void 0;
+}
+function ensureMemorySearchFunctions(store) {
+	if (searchFunctionsRegisteredStores.has(store)) return;
+	store.db.function("codemem_casefold", { deterministic: true }, casefold);
+	store.db.function("codemem_project_basename", { deterministic: true }, (value) => projectBasename(String(value ?? "").trim()));
+	searchFunctionsRegisteredStores.add(store);
+}
+var IDENTITY_LOOKUP_BATCH_SIZE = 500;
+function identityValue(item, key) {
+	const direct = String(item[key] ?? "").trim();
+	if (direct) return direct;
+	const rawMetadata = item.metadata ?? item.metadata_json;
+	const metadata = typeof rawMetadata === "string" ? fromJson(rawMetadata) : rawMetadata;
+	if (!metadata || typeof metadata !== "object" || Array.isArray(metadata)) return "";
+	return String(metadata[key] ?? "").trim();
+}
+function uniqueStrings(items, key) {
+	return [...new Set(items.map((item) => identityValue(item, key)).filter(Boolean))];
+}
+function batchedLookup(store, values, query) {
+	const rows = [];
+	for (let offset = 0; offset < values.length; offset += IDENTITY_LOOKUP_BATCH_SIZE) {
+		const batch = values.slice(offset, offset + IDENTITY_LOOKUP_BATCH_SIZE);
+		const placeholders = batch.map(() => "?").join(", ");
+		rows.push(...store.db.prepare(query(placeholders)).all(...batch));
+	}
+	return rows;
+}
+function humanName(value) {
+	if (typeof value !== "string") return void 0;
+	try {
+		return normalizeHumanPresentationName(value, "display_name");
+	} catch {
+		return;
+	}
+}
+/**
+* Add presentation-only identity labels without changing persisted provenance.
+* Resolved names are display hints, not authority or ownership evidence; legacy
+* metadata receives the same top-level-first fallback as existing read paths.
+*/
+function attachResolvedIdentityFieldsUnsafe(store, items) {
+	const actorIds = uniqueStrings(items, "actor_id");
+	const deviceIds = uniqueStrings(items, "origin_device_id");
+	const peers = batchedLookup(store, deviceIds, (placeholders) => `SELECT peer_device_id, name, actor_id FROM sync_peers
+		 WHERE peer_device_id IN (${placeholders})
+		   AND TRIM(COALESCE(pinned_fingerprint, '')) <> ''`);
+	const peerByDevice = new Map(peers.map((peer) => [peer.peer_device_id, peer]));
+	const peerActorIds = peers.map((peer) => String(peer.actor_id ?? "").trim()).filter((actorId) => actorId.length > 0);
+	const actorRows = batchedLookup(store, [...new Set([...actorIds, ...peerActorIds])], (placeholders) => `SELECT actor_id, display_name, status, merged_into_actor_id FROM actors
+			 WHERE actor_id IN (${placeholders})`);
+	const devices = batchedLookup(store, deviceIds, (placeholders) => `SELECT device_id, display_name FROM identity_devices
+		 WHERE device_id IN (${placeholders}) AND status = 'active'`);
+	const actorById = new Map(actorRows.map((actor) => [actor.actor_id, actor]));
+	let pendingMergeTargets = [...new Set(actorRows.map((actor) => String(actor.merged_into_actor_id ?? "").trim()).filter((actorId) => actorId && !actorById.has(actorId)))];
+	while (pendingMergeTargets.length > 0) {
+		const targetRows = batchedLookup(store, pendingMergeTargets, (placeholders) => `SELECT actor_id, display_name, status, merged_into_actor_id FROM actors
+				 WHERE actor_id IN (${placeholders})`);
+		for (const actor of targetRows) actorById.set(actor.actor_id, actor);
+		pendingMergeTargets = [...new Set(targetRows.map((actor) => String(actor.merged_into_actor_id ?? "").trim()).filter((actorId) => actorId && !actorById.has(actorId)))];
+	}
+	const resolvedActorName = (actorId) => {
+		const seen = /* @__PURE__ */ new Set();
+		let currentActorId = actorId;
+		while (currentActorId && !seen.has(currentActorId)) {
+			seen.add(currentActorId);
+			const actor = actorById.get(currentActorId);
+			if (!actor) return void 0;
+			if (actor.status === "active" && actor.merged_into_actor_id === null) return humanName(actor.display_name);
+			currentActorId = String(actor.merged_into_actor_id ?? "").trim();
+		}
+	};
+	const deviceNameById = new Map(devices.map((device) => [device.device_id, humanName(device.display_name)]).filter((entry) => entry[1] !== void 0));
+	for (const item of items) {
+		const actorId = identityValue(item, "actor_id");
+		const deviceId = identityValue(item, "origin_device_id");
+		const peer = peerByDevice.get(deviceId);
+		const peerActorId = String(peer?.actor_id ?? "").trim();
+		const actorName = actorById.has(actorId) ? resolvedActorName(actorId) ?? humanName(item.actor_display_name) : resolvedActorName(peerActorId) ?? humanName(item.actor_display_name);
+		const deviceName = deviceNameById.get(deviceId) ?? humanName(peer?.name);
+		if (actorName) item.resolved_actor_display_name = actorName;
+		if (deviceName) item.resolved_device_display_name = deviceName;
+	}
+}
+function attachResolvedIdentityFields(store, items) {
+	try {
+		attachResolvedIdentityFieldsUnsafe(store, items);
+	} catch {}
+}
 function serializeMemoryRow(ownedBySelf, row) {
 	const metadata = fromJson(row.metadata_json ?? null);
 	const owned_by_self = ownedBySelf(row);
@@ -651,12 +747,49 @@ function summaryLikeSqlPredicate() {
 		OR (
 			json_valid(COALESCE(memory_items.metadata_json, ''))
 			AND (
-				COALESCE(json_extract(memory_items.metadata_json, '$.is_summary') = 1, 0)
+				COALESCE(json_type(memory_items.metadata_json, '$.is_summary') = 'true', 0)
 				OR LOWER(TRIM(COALESCE(json_extract(memory_items.metadata_json, '$.source'), ''))) = 'observer_summary'
 			)
 		)
 	)`;
 }
+function memorySearchSql(query) {
+	const textClause = `INSTR(codemem_casefold(
+		COALESCE(memory_items.title, '') || CHAR(10) ||
+		COALESCE(memory_items.body_text, '') || CHAR(10) ||
+		CASE WHEN ${summaryLikeSqlPredicate()} THEN 'session_summary' ELSE
+			COALESCE(NULLIF(LOWER(TRIM(COALESCE(memory_items.kind, ''))), ''), 'change')
+		END || CHAR(10) ||
+		COALESCE(
+			memory_items.project,
+			codemem_project_basename(
+				(SELECT sessions.project FROM sessions WHERE sessions.id = memory_items.session_id)
+			),
+			''
+		) || CHAR(10) ||
+		COALESCE(memory_items.tags_text, '') || CHAR(10) ||
+		COALESCE(memory_items.facts, '') || CHAR(10) ||
+		COALESCE(memory_items.subtitle, '') || CHAR(10) ||
+		COALESCE(memory_items.narrative, '') || CHAR(10) ||
+		CASE WHEN json_valid(COALESCE(memory_items.metadata_json, '')) THEN
+			COALESCE(json_extract(memory_items.metadata_json, '$.request'), '') || CHAR(10) ||
+			COALESCE(json_extract(memory_items.metadata_json, '$.subtitle'), '') || CHAR(10) ||
+			COALESCE(json_extract(memory_items.metadata_json, '$.narrative'), '') || CHAR(10) ||
+			COALESCE(json_extract(memory_items.metadata_json, '$.facts'), '') || CHAR(10) ||
+			COALESCE(json_extract(memory_items.metadata_json, '$.summary'), '')
+		ELSE '' END
+	), codemem_casefold(?)) > 0`;
+	const parsedMemoryId = parsePositiveMemoryId(query);
+	const memoryId = parsedMemoryId != null && String(parsedMemoryId) === query ? parsedMemoryId : null;
+	if (memoryId != null) return {
+		clause: `(memory_items.id = ? OR ${textClause})`,
+		params: [memoryId, query]
+	};
+	return {
+		clause: textClause,
+		params: [query]
+	};
+}
 function countVisibleObservationRows(store, filters) {
 	const filterResult = buildViewerMemoryFilters(store, filters);
 	const clauses = [
@@ -709,43 +842,32 @@ function countVisibleArtifactRows(store, project) {
 	return Number(row?.total ?? 0);
 }
 function queryMemoryPage(store, options) {
+	ensureMemorySearchFunctions(store);
 	const filters = {};
 	if (options.project) filters.project = options.project;
 	if (options.scope) filters.ownership_scope = options.scope;
 	const filterResult = buildViewerMemoryFilters(store, filters);
-	const where = ["memory_items.active = 1", ...filterResult.clauses].join(" AND ");
+	const summaryPredicate = summaryLikeSqlPredicate();
+	const clauses = [
+		"memory_items.active = 1",
+		options.classification === "summary" ? summaryPredicate : `NOT ${summaryPredicate}`,
+		...filterResult.clauses
+	];
+	const params = [...filterResult.params];
+	if (options.q) {
+		const search = memorySearchSql(options.q);
+		clauses.push(search.clause);
+		params.push(...search.params);
+	}
+	const where = clauses.join(" AND ");
 	const from = filterResult.joinSessions ? "memory_items JOIN sessions ON sessions.id = memory_items.session_id" : "memory_items";
 	const rows = store.db.prepare(`SELECT memory_items.* FROM ${from}
 			 WHERE ${where}
-			 ORDER BY memory_items.created_at DESC
-			 LIMIT ? OFFSET ?`).all(...filterResult.params, options.limit + 1, options.offset);
+			 ORDER BY memory_items.created_at DESC, memory_items.id DESC
+			 LIMIT ? OFFSET ?`).all(...params, options.limit + 1, options.offset);
 	const ownedBySelf = store.buildOwnershipPredicate();
 	return rows.map((row) => serializeMemoryRow(ownedBySelf, row));
 }
-function isSummaryLikeMemory$1(item) {
-	return isSummaryLikeMemory({
-		kind: item.kind,
-		metadata: item.metadata_json
-	});
-}
-function selectMemoryPage(store, options) {
-	const pageSize = Math.max(options.limit + options.offset + 10, 50);
-	let rawOffset = 0;
-	const matched = [];
-	while (matched.length < options.offset + options.limit + 1) {
-		const page = queryMemoryPage(store, {
-			limit: pageSize,
-			offset: rawOffset,
-			project: options.project,
-			scope: options.scope
-		});
-		if (page.length === 0) break;
-		matched.push(...page.filter(options.matcher));
-		if (page.length < pageSize) break;
-		rawOffset += page.length;
-	}
-	return matched.slice(options.offset, options.offset + options.limit + 1);
-}
 function memoryRoutes(getStore) {
 	const app = new Hono();
 	app.get("/api/sessions", (c) => {
@@ -794,17 +916,19 @@ function memoryRoutes(getStore) {
 		{
 			const limit = Math.max(1, queryInt(c.req.query("limit"), 20));
 			const offset = Math.max(0, queryInt(c.req.query("offset"), 0));
-			const items = selectMemoryPage(store, {
+			const items = queryMemoryPage(store, {
 				limit,
 				offset,
 				project: c.req.query("project") || void 0,
 				scope: normalizeScope(c.req.query("scope")),
-				matcher: (item) => !isSummaryLikeMemory$1(item)
+				q: normalizeMemorySearchQuery(c.req.query("q")),
+				classification: "observation"
 			});
 			const hasMore = items.length > limit;
 			const result = hasMore ? items.slice(0, limit) : items;
 			const asRecords = result;
 			attachSessionFields(store, asRecords);
+			attachResolvedIdentityFields(store, asRecords);
 			return c.json({
 				items: asRecords,
 				pagination: {
@@ -821,17 +945,19 @@ function memoryRoutes(getStore) {
 		{
 			const limit = Math.max(1, queryInt(c.req.query("limit"), 50));
 			const offset = Math.max(0, queryInt(c.req.query("offset"), 0));
-			const items = selectMemoryPage(store, {
+			const items = queryMemoryPage(store, {
 				limit,
 				offset,
 				project: c.req.query("project") || void 0,
 				scope: normalizeScope(c.req.query("scope")),
-				matcher: (item) => isSummaryLikeMemory$1(item)
+				q: normalizeMemorySearchQuery(c.req.query("q")),
+				classification: "summary"
 			});
 			const hasMore = items.length > limit;
 			const result = hasMore ? items.slice(0, limit) : items;
 			const asRecords = result;
 			attachSessionFields(store, asRecords);
+			attachResolvedIdentityFields(store, asRecords);
 			return c.json({
 				items: asRecords,
 				pagination: {
@@ -926,6 +1052,7 @@ function memoryRoutes(getStore) {
 			if (project) filters.project = project;
 			const asRecords = store.recent(limit, filters);
 			attachSessionFields(store, asRecords);
+			attachResolvedIdentityFields(store, asRecords);
 			return c.json({ items: asRecords });
 		}
 	});
@@ -1077,6 +1204,71 @@ function observerStatusRoutes(deps) {
 	return app;
 }
 //#endregion
+//#region src/routes/target-validation.ts
+var IDENTITY_TARGET_KEYS = new Set(VIEWER_IDENTITY_TARGET_KEYS);
+var BOOLEAN_IDENTITY_TARGET_KEYS = new Set(["actor_id_present", "embedding_disabled"]);
+function invalidRequest$1(message) {
+	return {
+		ok: false,
+		status: 400,
+		body: { error: {
+			code: "invalid_request",
+			message
+		} }
+	};
+}
+function conflict(code, message) {
+	return {
+		ok: false,
+		status: 409,
+		body: { error: {
+			code,
+			message
+		} }
+	};
+}
+function isRecord$1(value) {
+	return value != null && typeof value === "object" && !Array.isArray(value);
+}
+function currentIdentityTarget() {
+	return buildViewerIdentityTarget();
+}
+function requestedDbMatches(store, value) {
+	if (value == null) return true;
+	if (typeof value !== "string" || !value.trim()) return null;
+	return resolve(resolveDbPath(value.trim())) === resolve(store.dbPath);
+}
+function requestedIdentityMatches(value) {
+	if (value == null) return true;
+	if (!isRecord$1(value)) return null;
+	if (Object.keys(value).length !== IDENTITY_TARGET_KEYS.size || Object.keys(value).some((key) => !IDENTITY_TARGET_KEYS.has(key))) return "unsupported";
+	const expected = currentIdentityTarget();
+	for (const key of VIEWER_IDENTITY_TARGET_KEYS) {
+		const requested = value[key];
+		if (BOOLEAN_IDENTITY_TARGET_KEYS.has(key)) {
+			if (typeof requested !== "boolean") return null;
+		} else if (requested !== null && typeof requested !== "string") return null;
+		if (requested !== expected[key]) return false;
+	}
+	return true;
+}
+function validateViewerTarget(store, payload, options = {}) {
+	if (options.requirePairedTargets) {
+		const hasDbPath = Object.hasOwn(payload, "db_path");
+		if (hasDbPath !== Object.hasOwn(payload, "identity_target")) return invalidRequest$1("db_path and identity_target must be provided together");
+		if (hasDbPath && (payload.db_path == null || payload.identity_target == null)) return invalidRequest$1("db_path and identity_target must be valid when provided");
+	}
+	const dbMatches = requestedDbMatches(store, payload.db_path);
+	if (dbMatches == null) return invalidRequest$1("db_path must be a non-empty string");
+	if (!dbMatches) return conflict("viewer_db_mismatch", "viewer database does not match request");
+	const identityMatches = requestedIdentityMatches(payload.identity_target);
+	if (identityMatches === "unsupported") return conflict("viewer_contract_unsupported", "viewer request contract is incompatible");
+	if (identityMatches == null) return invalidRequest$1("identity_target is invalid");
+	if (!identityMatches) return conflict("viewer_identity_mismatch", "viewer identity does not match request");
+	if ((options.requireCurrentIdentity || payload.identity_target != null) && !store.hasCurrentIdentity()) return conflict("viewer_identity_mismatch", "viewer identity does not match request");
+	return { ok: true };
+}
+//#endregion
 //#region src/routes/pack.ts
 var MAX_LEDGER_PAYLOAD_BYTES = 16 * 1024;
 var MAX_METADATA_FIELD_CHARS = 512;
@@ -1114,19 +1306,6 @@ var LEDGER_KEYS = new Set([
 	"db_path",
 	"identity_target"
 ]);
-var IDENTITY_TARGET_KEYS = new Set([
-	"device_id",
-	"actor_id_present",
-	"actor_id",
-	"config_path",
-	"runtime_root",
-	"workspace_id",
-	"home_dir",
-	"pack_compression",
-	"embedding_disabled",
-	"embedding_model"
-]);
-var BOOLEAN_IDENTITY_TARGET_KEYS = new Set(["actor_id_present", "embedding_disabled"]);
 var ATTEMPT_KEYS = new Set([
 	"attempt_id",
 	"started_at",
@@ -1154,12 +1333,6 @@ function invalidRequest(message) {
 		message
 	} };
 }
-function viewerDbMismatch() {
-	return { error: {
-		code: "viewer_db_mismatch",
-		message: "viewer database does not match request"
-	} };
-}
 function viewerIdentityMismatch() {
 	return { error: {
 		code: "viewer_identity_mismatch",
@@ -1185,47 +1358,6 @@ function normalizeWorkingSetPath(value) {
 	if (!normalized || normalized === "." || normalized === ".." || normalized.startsWith("../")) return null;
 	return normalized;
 }
-function requestedDbMatches(store, value) {
-	if (value == null) return true;
-	if (typeof value !== "string" || !value.trim()) return null;
-	return resolve(resolveDbPath(value)) === resolve(store.dbPath);
-}
-function normalizeIdentityPath(value) {
-	if (!value?.trim()) return null;
-	return resolve(resolveDbPath(value.trim()));
-}
-function currentIdentityTarget() {
-	return {
-		device_id: process.env.CODEMEM_DEVICE_ID?.trim() || null,
-		actor_id_present: Object.hasOwn(process.env, "CODEMEM_ACTOR_ID"),
-		actor_id: process.env.CODEMEM_ACTOR_ID?.trim() || null,
-		config_path: normalizeIdentityPath(process.env.CODEMEM_CONFIG),
-		runtime_root: normalizeIdentityPath(process.env.CODEMEM_RUNTIME_ROOT),
-		workspace_id: process.env.CODEMEM_WORKSPACE_ID?.trim() || null,
-		home_dir: normalizeIdentityPath(process.env.HOME || homedir()),
-		pack_compression: process.env.CODEMEM_PACK_COMPRESSION?.trim() || null,
-		embedding_disabled: [
-			"1",
-			"true",
-			"yes"
-		].includes(String(process.env.CODEMEM_EMBEDDING_DISABLED || "").toLowerCase()),
-		embedding_model: process.env.CODEMEM_EMBEDDING_MODEL || "Xenova/bge-small-en-v1.5"
-	};
-}
-function requestedIdentityMatches(value) {
-	if (value == null) return true;
-	if (!isRecord(value)) return null;
-	if (Object.keys(value).length !== IDENTITY_TARGET_KEYS.size || Object.keys(value).some((key) => !IDENTITY_TARGET_KEYS.has(key))) return "unsupported";
-	const expected = currentIdentityTarget();
-	for (const key of IDENTITY_TARGET_KEYS) {
-		const requested = value[key];
-		if (BOOLEAN_IDENTITY_TARGET_KEYS.has(key)) {
-			if (typeof requested !== "boolean") return null;
-		} else if (requested !== null && typeof requested !== "string") return null;
-		if (requested !== expected[key]) return false;
-	}
-	return true;
-}
 function validateMetadataFields(payload, allowedKeys) {
 	if (Buffer.byteLength(JSON.stringify(payload), "utf8") > MAX_LEDGER_PAYLOAD_BYTES) return "ledger metadata exceeds 16384 bytes";
 	for (const key of Object.keys(payload)) {
@@ -1347,7 +1479,8 @@ function packTransportRoutes(getStore) {
 			if (!store.hasCurrentIdentity()) return c.json(viewerIdentityMismatch(), 409);
 			return c.json({
 				service: "codemem-viewer",
-				protocol_version: 1,
+				protocol_version: PROMPT_TRANSPORT_PROTOCOL_RANGE.protocolVersion,
+				min_supported_protocol_version: PROMPT_TRANSPORT_PROTOCOL_RANGE.minSupportedProtocolVersion,
 				db_path: resolve(store.dbPath),
 				identity_target: currentIdentityTarget()
 			});
@@ -1368,14 +1501,8 @@ function packTransportRoutes(getStore) {
 		}
 		try {
 			const store = getStore();
-			const dbMatches = requestedDbMatches(store, parsed.db_path);
-			if (dbMatches == null) return c.json(invalidRequest("db_path must be a non-empty string"), 400);
-			if (!dbMatches) return c.json(viewerDbMismatch(), 409);
-			const identityMatches = requestedIdentityMatches(parsed.identity_target);
-			if (identityMatches === "unsupported") return c.json(viewerContractUnsupported(), 409);
-			if (identityMatches == null) return c.json(invalidRequest("identity_target is invalid"), 400);
-			if (!identityMatches) return c.json(viewerIdentityMismatch(), 409);
-			if (!store.hasCurrentIdentity()) return c.json(viewerIdentityMismatch(), 409);
+			const target = validateViewerTarget(store, parsed, { requireCurrentIdentity: true });
+			if (!target.ok) return c.json(target.body, target.status);
 			if (!request.attempt) {
 				const pack = await store.buildMemoryPackAsync(request.context, request.limit, request.tokenBudget, request.filters, request.renderOptions);
 				return c.json(pack);
@@ -1412,14 +1539,8 @@ function packTransportRoutes(getStore) {
 		}
 		try {
 			const store = getStore();
-			const dbMatches = requestedDbMatches(store, parsed.db_path);
-			if (dbMatches == null) return c.json(invalidRequest("db_path must be a non-empty string"), 400);
-			if (!dbMatches) return c.json(viewerDbMismatch(), 409);
-			const identityMatches = requestedIdentityMatches(parsed.identity_target);
-			if (identityMatches === "unsupported") return c.json(viewerContractUnsupported(), 409);
-			if (identityMatches == null) return c.json(invalidRequest("identity_target is invalid"), 400);
-			if (!identityMatches) return c.json(viewerIdentityMismatch(), 409);
-			if (!store.hasCurrentIdentity()) return c.json(viewerIdentityMismatch(), 409);
+			const target = validateViewerTarget(store, parsed, { requireCurrentIdentity: true });
+			if (!target.ok) return c.json(target.body, target.status);
 			const outcome = dispatchLedger(store, parsed);
 			if (typeof outcome === "string") return c.json(invalidRequest(outcome), 400);
 			if (outcome.ok) return c.json(outcome);
@@ -1439,34 +1560,60 @@ function packTransportRoutes(getStore) {
 * Raw events routes — GET & POST /api/raw-events, GET /api/raw-events/status,
 * POST /api/claude-hooks, POST /api/codex-hooks.
 */
-var MAX_RAW_EVENTS_BODY_BYTES = Number.parseInt(process.env.CODEMEM_RAW_EVENTS_MAX_BODY_BYTES ?? "", 10) || 1048576;
-/** Keys to check (in priority order) when resolving a session stream id. */
-var SESSION_ID_KEYS = [
-	"session_stream_id",
-	"session_id",
-	"stream_id",
-	"opencode_session_id"
-];
-/**
-* Resolve a session stream id from a payload object.
-* Checks multiple field aliases. Throws on conflicting values.
-*/
-function resolveSessionStreamId(payload) {
-	const values = /* @__PURE__ */ new Map();
-	for (const key of SESSION_ID_KEYS) {
-		const value = payload[key];
-		if (value == null) continue;
-		if (typeof value !== "string") throw new Error(`${key} must be string`);
-		const text = value.trim();
-		if (text) values.set(key, text);
-	}
-	if (values.size === 0) return null;
-	if (new Set(values.values()).size > 1) throw new Error("conflicting session id fields");
-	for (const key of SESSION_ID_KEYS) {
-		const v = values.get(key);
-		if (v) return v;
-	}
-	return null;
+var DEFAULT_MAX_RAW_EVENTS_BODY_BYTES = 1048576;
+function configuredMaxRawEventsBodyBytes() {
+	const parsed = Number(process.env.CODEMEM_RAW_EVENTS_MAX_BODY_BYTES?.trim() ?? "");
+	return Number.isSafeInteger(parsed) && parsed > 0 ? parsed : DEFAULT_MAX_RAW_EVENTS_BODY_BYTES;
+}
+var MAX_RAW_EVENTS_BODY_BYTES = configuredMaxRawEventsBodyBytes();
+function emptyTranscriptOutcomeCounts() {
+	return {
+		ok: 0,
+		not_provided: 0,
+		path_rejected: 0,
+		unreadable: 0,
+		no_complete_record: 0,
+		no_assistant_record: 0
+	};
+}
+function createTranscriptDiagnostics() {
+	const counts = {
+		claude: emptyTranscriptOutcomeCounts(),
+		codex: emptyTranscriptOutcomeCounts()
+	};
+	return {
+		record(source, outcome) {
+			counts[source][outcome] += 1;
+		},
+		snapshot() {
+			return {
+				scope: "legacy_compatibility_routes",
+				counts: {
+					claude: { ...counts.claude },
+					codex: { ...counts.codex }
+				}
+			};
+		}
+	};
+}
+function transcriptSkipResponse(outcome) {
+	if (outcome !== null && outcome !== "ok") return {
+		inserted: 0,
+		skipped: 1,
+		skip_reason: "transcript_unavailable",
+		skip_detail: outcome
+	};
+	return {
+		inserted: 0,
+		skipped: 1,
+		skip_reason: "unsupported_hook"
+	};
+}
+function claudeTranscriptRoot() {
+	return join(process.env.CLAUDE_CONFIG_DIR?.trim() || join(homedir(), ".claude"), "projects");
+}
+function codexTranscriptRoot() {
+	return join(process.env.CODEX_HOME?.trim() || join(homedir(), ".codex"), "sessions");
 }
 /**
 * Parse and validate a JSON object body, enforcing size limits.
@@ -1479,16 +1626,43 @@ async function parseJsonObjectBody(c, maxBytes) {
 		error: "payload too large",
 		max_bytes: maxBytes
 	}, 413);
-	let raw;
+	let raw = "";
 	try {
-		raw = await c.req.text();
+		const body = c.req.raw.body;
+		if (body !== null) {
+			const reader = body.getReader();
+			const chunks = [];
+			let totalBytes = 0;
+			try {
+				while (true) {
+					const { done, value } = await reader.read();
+					if (done) break;
+					totalBytes += value.byteLength;
+					if (totalBytes > maxBytes) {
+						try {
+							await reader.cancel();
+						} catch {}
+						return c.json({
+							error: "payload too large",
+							max_bytes: maxBytes
+						}, 413);
+					}
+					chunks.push(value);
+				}
+			} finally {
+				reader.releaseLock();
+			}
+			const bytes = new Uint8Array(totalBytes);
+			let offset = 0;
+			for (const chunk of chunks) {
+				bytes.set(chunk, offset);
+				offset += chunk.byteLength;
+			}
+			raw = new TextDecoder("utf-8", { fatal: true }).decode(bytes);
+		}
 	} catch {
 		return c.json({ error: "invalid json" }, 400);
 	}
-	if (Buffer.byteLength(raw, "utf-8") > maxBytes) return c.json({
-		error: "payload too large",
-		max_bytes: maxBytes
-	}, 413);
 	let parsed;
 	try {
 		parsed = raw ? JSON.parse(raw) : {};
@@ -1499,13 +1673,78 @@ async function parseJsonObjectBody(c, maxBytes) {
 	return parsed;
 }
 /** Nudge the sweeper safely — never crashes the caller. */
-function nudgeSweeper(sweeper, sessionIds, source = "opencode") {
-	try {
-		for (const sessionId of sessionIds) sweeper?.nudge(sessionId, source);
+function nudgeSweeper(sweeper, sessions) {
+	for (const session of sessions) try {
+		sweeper?.nudge(session.streamId, session.source);
+	} catch {}
+}
+async function flushBoundarySessions(sweeper, sessions) {
+	for (const session of sessions) try {
+		await sweeper?.flushBoundary(session.streamId, session.source);
 	} catch {}
 }
+function isClaudeBoundaryEnvelope(envelope) {
+	const record = envelope;
+	if (String(record.source ?? "").trim().toLowerCase() !== "claude") return false;
+	const payload = record.payload;
+	if (payload == null || typeof payload !== "object" || Array.isArray(payload)) return false;
+	const adapter = payload._adapter;
+	if (adapter == null || typeof adapter !== "object" || Array.isArray(adapter)) return false;
+	const meta = adapter.meta;
+	if (meta == null || typeof meta !== "object" || Array.isArray(meta)) return false;
+	const hookEventName = meta.hook_event_name;
+	return hookEventName === "SessionEnd" || hookEventName === "Stop";
+}
+var SAFE_INGEST_VALIDATION_ERRORS = new Set([
+	"source must be string",
+	"source is required",
+	"source must use 1-64 letters, digits, dots, underscores, or hyphens",
+	"session_stream_id must be string",
+	"session_id must be string",
+	"stream_id must be string",
+	"opencode_session_id must be string",
+	"conflicting session id fields",
+	"invalid session id",
+	"event source conflicts with request source",
+	"session id required",
+	"event_type must be string",
+	"event_type required",
+	"event_type has invalid syntax",
+	"event_id must be string",
+	"event_id required",
+	"event_id has invalid syntax",
+	"event_seq must be int",
+	"ts_wall_ms must be number",
+	"ts_mono_ms must be number",
+	"payload must be an object",
+	"cwd must be string",
+	"project must be string",
+	"started_at must be string",
+	"events must be a list",
+	"event must be an object"
+]);
+function boundedIngestValidationMessage(error) {
+	return SAFE_INGEST_VALIDATION_ERRORS.has(error.message) ? error.message : "invalid raw event request";
+}
+function boundedIngestErrorResponse(c, error) {
+	if (error instanceof RawEventIngestValidationError) return c.json({ error: boundedIngestValidationMessage(error) }, 400);
+	const response = { error: "internal server error" };
+	if (process.env.CODEMEM_VIEWER_DEBUG === "1") response.detail = error instanceof Error ? error.message : String(error);
+	return c.json(response, 500);
+}
+function untargetedPayload(payload) {
+	const { db_path: _dbPath, identity_target: _identityTarget, ...body } = payload;
+	return body;
+}
+async function ingestNormalizedEnvelope(store, sweeper, envelope, flushBoundary = false) {
+	const result = ingestRawEvents(store, envelope);
+	nudgeSweeper(sweeper, result.sessions);
+	if (flushBoundary && isClaudeBoundaryEnvelope(envelope)) await flushBoundarySessions(sweeper, result.sessions);
+	return result;
+}
 function rawEventsRoutes(getStore, sweeper) {
 	const app = new Hono();
+	const transcriptDiagnostics = createTranscriptDiagnostics();
 	app.get("/api/raw-events", (c) => {
 		const totals = getStore().rawEventBacklogTotals();
 		return c.json(totals);
@@ -1540,233 +1779,83 @@ function rawEventsRoutes(getStore, sweeper) {
 				available: true,
 				mode: "stream_queue",
 				max_body_bytes: MAX_RAW_EVENTS_BODY_BYTES
-			}
+			},
+			transcript_diagnostics: transcriptDiagnostics.snapshot()
 		});
 	});
 	app.post("/api/raw-events", async (c) => {
 		const result = await parseJsonObjectBody(c, MAX_RAW_EVENTS_BODY_BYTES);
 		if (result instanceof Response) return result;
-		const payload = result;
-		const store = getStore();
 		try {
-			const cwd = payload.cwd;
-			if (cwd != null && typeof cwd !== "string") return c.json({ error: "cwd must be string" }, 400);
-			const project = payload.project;
-			if (project != null && typeof project !== "string") return c.json({ error: "project must be string" }, 400);
-			const startedAt = payload.started_at;
-			if (startedAt != null && typeof startedAt !== "string") return c.json({ error: "started_at must be string" }, 400);
-			let items = payload.events;
-			if (items == null) items = [payload];
-			if (!Array.isArray(items)) return c.json({ error: "events must be a list" }, 400);
-			let defaultSessionId;
-			try {
-				defaultSessionId = resolveSessionStreamId(payload) ?? "";
-			} catch (err) {
-				return c.json({ error: err.message }, 400);
-			}
-			if (defaultSessionId.startsWith("msg_")) return c.json({ error: "invalid session id" }, 400);
-			let inserted = 0;
-			const lastSeenBySession = /* @__PURE__ */ new Map();
-			const metaBySession = /* @__PURE__ */ new Map();
-			const sessionIds = /* @__PURE__ */ new Set();
-			const batchBySession = /* @__PURE__ */ new Map();
-			for (const item of items) {
-				if (item == null || typeof item !== "object" || Array.isArray(item)) return c.json({ error: "event must be an object" }, 400);
-				const itemObj = item;
-				let itemSessionId;
-				try {
-					itemSessionId = resolveSessionStreamId(itemObj);
-				} catch (err) {
-					return c.json({ error: err.message }, 400);
-				}
-				const opencodeSessionId = String(itemSessionId ?? defaultSessionId ?? "");
-				if (!opencodeSessionId) return c.json({ error: "session id required" }, 400);
-				if (opencodeSessionId.startsWith("msg_")) return c.json({ error: "invalid session id" }, 400);
-				let eventId = String(itemObj.event_id ?? "");
-				const eventType = String(itemObj.event_type ?? "");
-				if (!eventType) return c.json({ error: "event_type required" }, 400);
-				const eventSeqValue = itemObj.event_seq;
-				if (eventSeqValue != null) {
-					const parsed = Number(eventSeqValue);
-					if (!Number.isFinite(parsed) || parsed !== Math.floor(parsed)) return c.json({ error: "event_seq must be int" }, 400);
-				}
-				let tsWallMs = itemObj.ts_wall_ms;
-				if (tsWallMs != null) {
-					const parsed = Number(tsWallMs);
-					if (!Number.isFinite(parsed)) return c.json({ error: "ts_wall_ms must be int" }, 400);
-					tsWallMs = Math.floor(parsed);
-					const prev = lastSeenBySession.get(opencodeSessionId) ?? tsWallMs;
-					lastSeenBySession.set(opencodeSessionId, Math.max(prev, tsWallMs));
-				}
-				let tsMonoMs = itemObj.ts_mono_ms;
-				if (tsMonoMs != null) {
-					const parsed = Number(tsMonoMs);
-					if (!Number.isFinite(parsed)) return c.json({ error: "ts_mono_ms must be number" }, 400);
-					tsMonoMs = parsed;
-				}
-				let eventPayload = itemObj.payload;
-				if (eventPayload == null) eventPayload = {};
-				if (typeof eventPayload !== "object" || Array.isArray(eventPayload)) return c.json({ error: "payload must be an object" }, 400);
-				const itemCwd = itemObj.cwd;
-				if (itemCwd != null && typeof itemCwd !== "string") return c.json({ error: "cwd must be string" }, 400);
-				const itemProject = itemObj.project;
-				if (itemProject != null && typeof itemProject !== "string") return c.json({ error: "project must be string" }, 400);
-				const itemStartedAt = itemObj.started_at;
-				if (itemStartedAt != null && typeof itemStartedAt !== "string") return c.json({ error: "started_at must be string" }, 400);
-				eventPayload = stripPrivateObj(eventPayload);
-				if (!eventId) {
-					const sortedStringify = (obj) => JSON.stringify(obj, (_key, value) => {
-						if (value != null && typeof value === "object" && !Array.isArray(value)) {
-							const sorted = {};
-							for (const k of Object.keys(value).sort()) sorted[k] = value[k];
-							return sorted;
-						}
-						return value;
-					});
-					if (eventSeqValue != null) {
-						const rawId = sortedStringify({
-							s: eventSeqValue,
-							t: eventType,
-							p: eventPayload
-						});
-						eventId = `legacy-seq-${eventSeqValue}-${createHash("sha256").update(rawId, "utf-8").digest("hex").slice(0, 16)}`;
-					} else {
-						const rawId = sortedStringify({
-							m: tsMonoMs ?? null,
-							p: eventPayload,
-							t: eventType,
-							w: tsWallMs ?? null
-						});
-						eventId = `legacy-${createHash("sha256").update(rawId, "utf-8").digest("hex").slice(0, 16)}`;
-					}
-				}
-				const eventEntry = {
-					event_id: eventId,
-					event_type: eventType,
-					payload: eventPayload,
-					ts_wall_ms: tsWallMs ?? null,
-					ts_mono_ms: tsMonoMs ?? null
-				};
-				sessionIds.add(opencodeSessionId);
-				const list = batchBySession.get(opencodeSessionId) ?? [];
-				list.push({ ...eventEntry });
-				batchBySession.set(opencodeSessionId, list);
-				if (itemCwd || itemProject || itemStartedAt) {
-					const perSession = metaBySession.get(opencodeSessionId) ?? {};
-					if (itemCwd) perSession.cwd = itemCwd;
-					if (itemProject) perSession.project = itemProject;
-					if (itemStartedAt) perSession.started_at = itemStartedAt;
-					metaBySession.set(opencodeSessionId, perSession);
-				}
-			}
-			if (sessionIds.size === 1) {
-				const singleSessionId = sessionIds.values().next().value;
-				const batch = batchBySession.get(singleSessionId) ?? [];
-				inserted = store.recordRawEventsBatch(singleSessionId, batch).inserted;
-			} else for (const [sid, sidEvents] of batchBySession) {
-				const result = store.recordRawEventsBatch(sid, sidEvents);
-				inserted += result.inserted;
-			}
-			for (const metaSessionId of sessionIds) {
-				const sessionMeta = metaBySession.get(metaSessionId) ?? {};
-				const applyRequestMeta = sessionIds.size === 1 || metaSessionId === defaultSessionId;
-				store.updateRawEventSessionMeta({
-					opencodeSessionId: metaSessionId,
-					cwd: sessionMeta.cwd ?? (applyRequestMeta ? cwd : void 0) ?? null,
-					project: sessionMeta.project ?? (applyRequestMeta ? project : void 0) ?? null,
-					startedAt: sessionMeta.started_at ?? (applyRequestMeta ? startedAt : void 0) ?? null,
-					lastSeenTsWallMs: lastSeenBySession.get(metaSessionId) ?? null
-				});
-			}
-			nudgeSweeper(sweeper, sessionIds);
+			const store = getStore();
+			const target = validateViewerTarget(store, result, { requirePairedTargets: true });
+			if (!target.ok) return c.json(target.body, target.status);
+			const ingestResult = await ingestNormalizedEnvelope(store, sweeper, untargetedPayload(result), c.req.header("x-codemem-boundary-flush") === "1");
 			return c.json({
-				inserted,
-				received: items.length
+				inserted: ingestResult.inserted,
+				skipped: ingestResult.skipped,
+				received: ingestResult.received
 			});
 		} catch (err) {
-			const response = { error: "internal server error" };
-			if (process.env.CODEMEM_VIEWER_DEBUG === "1") response.detail = err.message;
-			return c.json(response, 500);
+			return boundedIngestErrorResponse(c, err);
 		}
 	});
 	app.post("/api/claude-hooks", async (c) => {
 		const result = await parseJsonObjectBody(c, MAX_RAW_EVENTS_BODY_BYTES);
 		if (result instanceof Response) return result;
-		const envelope = buildRawEventEnvelopeFromHook(result);
-		if (envelope === null) return c.json({
-			inserted: 0,
-			skipped: 1
-		});
-		const store = getStore();
+		const payload = result;
 		try {
-			const opencodeSessionId = envelope.opencode_session_id;
-			const source = envelope.source;
-			const strippedPayload = stripPrivateObj(envelope.payload);
-			const inserted = store.recordRawEvent({
-				opencodeSessionId,
-				source,
-				eventId: envelope.event_id,
-				eventType: "claude.hook",
-				payload: strippedPayload,
-				tsWallMs: envelope.ts_wall_ms
-			});
-			store.updateRawEventSessionMeta({
-				opencodeSessionId,
-				source,
-				cwd: envelope.cwd,
-				project: envelope.project,
-				startedAt: envelope.started_at,
-				lastSeenTsWallMs: envelope.ts_wall_ms
+			const store = getStore();
+			const target = validateViewerTarget(store, payload, { requirePairedTargets: true });
+			if (!target.ok) return c.json(target.body, target.status);
+			let transcriptOutcome = null;
+			const envelope = buildRawEventEnvelopeFromHook(untargetedPayload(payload), {
+				transcriptPolicy: {
+					trust: "restricted",
+					approvedRoots: [claudeTranscriptRoot()]
+				},
+				onTranscriptOutcome: (outcome) => {
+					transcriptOutcome = outcome;
+					transcriptDiagnostics.record("claude", outcome);
+				}
 			});
-			nudgeSweeper(sweeper, [opencodeSessionId], source);
+			if (envelope === null) return c.json(transcriptSkipResponse(transcriptOutcome));
+			const ingestResult = await ingestNormalizedEnvelope(store, sweeper, envelope, c.req.header("x-codemem-boundary-flush") === "1");
 			return c.json({
-				inserted: inserted ? 1 : 0,
-				skipped: 0
+				inserted: ingestResult.inserted,
+				skipped: ingestResult.skipped
 			});
 		} catch (err) {
-			const response = { error: "internal server error" };
-			if (process.env.CODEMEM_VIEWER_DEBUG === "1") response.detail = err.message;
-			return c.json(response, 500);
+			return boundedIngestErrorResponse(c, err);
 		}
 	});
 	app.post("/api/codex-hooks", async (c) => {
 		const result = await parseJsonObjectBody(c, MAX_RAW_EVENTS_BODY_BYTES);
 		if (result instanceof Response) return result;
-		const envelope = buildRawEventEnvelopeFromCodexHook(result);
-		if (envelope === null) return c.json({
-			inserted: 0,
-			skipped: 1
-		});
-		const store = getStore();
+		const payload = result;
 		try {
-			const opencodeSessionId = envelope.opencode_session_id;
-			const source = envelope.source;
-			const strippedPayload = stripPrivateObj(envelope.payload);
-			const inserted = store.recordRawEvent({
-				opencodeSessionId,
-				source,
-				eventId: envelope.event_id,
-				eventType: envelope.event_type,
-				payload: strippedPayload,
-				tsWallMs: envelope.ts_wall_ms
-			});
-			store.updateRawEventSessionMeta({
-				opencodeSessionId,
-				source,
-				cwd: envelope.cwd,
-				project: envelope.project,
-				startedAt: envelope.started_at,
-				lastSeenTsWallMs: envelope.ts_wall_ms
+			const store = getStore();
+			const target = validateViewerTarget(store, payload, { requirePairedTargets: true });
+			if (!target.ok) return c.json(target.body, target.status);
+			let transcriptOutcome = null;
+			const envelope = buildRawEventEnvelopeFromCodexHook(untargetedPayload(payload), {
+				transcriptPolicy: {
+					trust: "restricted",
+					approvedRoots: [codexTranscriptRoot()]
+				},
+				onTranscriptOutcome: (outcome) => {
+					transcriptOutcome = outcome;
+					transcriptDiagnostics.record("codex", outcome);
+				}
 			});
-			nudgeSweeper(sweeper, [opencodeSessionId], source);
+			if (envelope === null) return c.json(transcriptSkipResponse(transcriptOutcome));
+			const ingestResult = await ingestNormalizedEnvelope(store, sweeper, envelope);
 			return c.json({
-				inserted: inserted ? 1 : 0,
-				skipped: 0
+				inserted: ingestResult.inserted,
+				skipped: ingestResult.skipped
 			});
 		} catch (err) {
-			const response = { error: "internal server error" };
-			if (process.env.CODEMEM_VIEWER_DEBUG === "1") response.detail = err.message;
-			return c.json(response, 500);
+			return boundedIngestErrorResponse(c, err);
 		}
 	});
 	return app;
@@ -2426,7 +2515,13 @@ function projectInviteAcceptanceFailure(error) {
 		inviter_identity_invalid: "The owner's device identity could not be verified. Ask the owner to review the share and create a new invitation.",
 		project_invite_self_acceptance_forbidden: "The owner cannot accept this recipient invitation on the owner's device.",
 		project_invite_bootstrap_incomplete: "The owner's device is not ready to establish trust yet. Retry once, then ask the owner to review the share.",
-		project_invite_trust_state_invalid: "The owner's trust setup could not be verified. Ask the owner to review the share."
+		project_invite_trust_state_invalid: "The owner's trust setup could not be verified. Ask the owner to review the share.",
+		recipient_display_name_invalid: "Enter a human-readable Identity name instead of an internal identifier.",
+		recipient_display_name_required: "Enter an Identity display name.",
+		recipient_display_name_too_long: "Use an Identity display name with 120 characters or fewer.",
+		device_display_name_invalid: "Enter a human-readable device name instead of an internal identifier.",
+		device_display_name_required: "Enter a device display name.",
+		device_display_name_too_long: "Use a device display name with 120 characters or fewer."
 	};
 	return {
 		error: Object.hasOwn(detailByCode, code) ? code : "project_invite_acceptance_failed",
@@ -2434,11 +2529,19 @@ function projectInviteAcceptanceFailure(error) {
 	};
 }
 var PROJECT_INVITE_TTL_HOURS = 168;
+var PROJECT_INVITE_OWNER_FALLBACK = "Project owner";
 var PROJECT_INVITE_BODY_KEYS = new Set([
 	"teammate_name",
 	"project_ids",
 	"reviewed_project_set_digest"
 ]);
+function projectInviteInviterDisplayName(value) {
+	try {
+		return normalizeHumanPresentationName(value, "inviter_display_name");
+	} catch {
+		return PROJECT_INVITE_OWNER_FALLBACK;
+	}
+}
 function projectInviteStringList(body, key) {
 	const value = body[key];
 	if (!Array.isArray(value)) throw new Error(`${key}_must_be_string_array`);
@@ -2565,10 +2668,16 @@ function recipientInviteOnboardingPreviewFromReviewedIntent(store, body, invitat
 	});
 }
 var SAFE_RECIPIENT_INVITE_ERRORS = new Set([
+	"device_display_name_invalid",
+	"device_display_name_required",
+	"device_display_name_too_long",
 	"invite_already_bound",
 	"invite_expired",
 	"invite_identity_conflict",
 	"invite_invalid",
+	"recipient_display_name_invalid",
+	"recipient_display_name_required",
+	"recipient_display_name_too_long",
 	"recipient_invite_intent_mismatch",
 	"recipient_invite_review_unavailable",
 	"reviewed_onboarding_stale"
@@ -2594,8 +2703,9 @@ async function peerSupportsSyncRequirements(store, deviceId, requirements) {
 		const url = `${buildBaseUrl(address)}/v1/status`;
 		const [status, payload] = await requestJson("GET", url, {
 			headers: {
-				...buildAuthHeaders({
+				...buildDirectPeerAuthHeaders({
 					deviceId: localDeviceId,
+					recipientId: deviceId,
 					dbPath: store.dbPath,
 					method: "GET",
 					url,
@@ -3672,14 +3782,15 @@ function pathWithQuery(url) {
 	const parsed = new URL(url);
 	return parsed.search ? `${parsed.pathname}${parsed.search}` : parsed.pathname;
 }
-function unauthorizedPayload(reason, exposeReason = false) {
-	if (exposeReason && process.env.CODEMEM_SYNC_AUTH_DIAGNOSTICS === "1") return {
-		error: "unauthorized",
-		reason
-	};
+function unauthorizedPayload() {
 	return { error: "unauthorized" };
 }
 var SYNC_AUTH_STORE_BUSY_REASON = "sync_auth_store_busy";
+var DIRECT_PEER_SIGNATURE_VERSION_NUMBER = 3;
+function logDirectPeerAuthDiagnostic(...reasons) {
+	const reason = reasons.find((candidate) => candidate === "recipient_mismatch" || candidate === "signature_downgrade");
+	if (reason) console.warn(`[sync] peer auth failed: reason=${reason}`);
+}
 function isSqliteBusy(err) {
 	if (!err || typeof err !== "object") return false;
 	const code = "code" in err ? String(err.code ?? "") : "";
@@ -3716,6 +3827,76 @@ function syncAuthStoreBusyResponse(c) {
 	c.header("Retry-After", "1");
 	return c.json({ error: SYNC_AUTH_STORE_BUSY_REASON }, 503);
 }
+function verifyDirectPeerRequestSignature(request, body, options) {
+	const timestamp = request.header("X-Opencode-Timestamp") ?? "";
+	const nonce = request.header("X-Opencode-Nonce") ?? "";
+	const legacySignature = request.header("X-Opencode-Signature") ?? "";
+	const recipientHeader = request.header("X-Codemem-Recipient");
+	const directSignatureHeader = request.header("X-Codemem-Signature");
+	const hasDirectMaterial = recipientHeader !== void 0 || directSignatureHeader !== void 0;
+	const direct = verifyDirectPeerSignature({
+		method: request.method,
+		pathWithQuery: pathWithQuery(request.url),
+		bodyBytes: body,
+		timestamp,
+		nonce,
+		recipientId: recipientHeader,
+		expectedRecipientId: options.expectedRecipientId,
+		signature: directSignatureHeader,
+		publicKey: options.publicKey
+	});
+	if (hasDirectMaterial && direct.status === "absent") return {
+		ok: false,
+		reason: "invalid_direct_signature"
+	};
+	if (direct.status === "invalid") return {
+		ok: false,
+		reason: direct.reason === "recipient_mismatch" ? direct.reason : "invalid_direct_signature"
+	};
+	if (!verifySignature({
+		method: request.method,
+		pathWithQuery: pathWithQuery(request.url),
+		bodyBytes: body,
+		timestamp,
+		nonce,
+		signature: legacySignature,
+		publicKey: options.publicKey,
+		deviceId: options.deviceId
+	})) return {
+		ok: false,
+		reason: "invalid_signature"
+	};
+	if (direct.status === "absent" && (options.highestObservedVersion ?? 0) >= DIRECT_PEER_SIGNATURE_VERSION_NUMBER) return {
+		ok: false,
+		reason: "signature_downgrade"
+	};
+	return {
+		ok: true,
+		version: direct.status === "valid" ? 3 : 2
+	};
+}
+function recordDirectPeerSignatureVersion(store, deviceId, version) {
+	try {
+		if (!recordHighestObservedDirectSignatureVersion(store.db, deviceId, version)) {
+			if (store.db.prepare(`SELECT sync_peer_signature_state.highest_observed_direct_signature_version
+					 FROM sync_peers
+					 LEFT JOIN sync_peer_signature_state USING (peer_device_id)
+					 WHERE sync_peers.peer_device_id = ? LIMIT 1`).pluck().get(deviceId) === void 0) return {
+				ok: false,
+				reason: "unknown_peer",
+				deviceId
+			};
+		}
+		return null;
+	} catch (err) {
+		if (isSqliteBusy(err)) return {
+			ok: false,
+			reason: SYNC_AUTH_STORE_BUSY_REASON,
+			deviceId
+		};
+		throw err;
+	}
+}
 function authorizeSyncRequest(store, request, body) {
 	const deviceId = (request.header("X-Opencode-Device") ?? "").trim();
 	const signature = request.header("X-Opencode-Signature") ?? "";
@@ -3726,7 +3907,11 @@ function authorizeSyncRequest(store, request, body) {
 		reason: "missing_headers",
 		deviceId
 	};
-	const peerRow = store.db.prepare("SELECT pinned_fingerprint, public_key FROM sync_peers WHERE peer_device_id = ? LIMIT 1").get(deviceId);
+	const peerRow = store.db.prepare(`SELECT sync_peers.pinned_fingerprint, sync_peers.public_key,
+			 sync_peer_signature_state.highest_observed_direct_signature_version
+			 FROM sync_peers
+			 LEFT JOIN sync_peer_signature_state USING (peer_device_id)
+			 WHERE sync_peers.peer_device_id = ? LIMIT 1`).get(deviceId);
 	if (!peerRow) return {
 		ok: false,
 		reason: "unknown_peer",
@@ -3744,17 +3929,14 @@ function authorizeSyncRequest(store, request, body) {
 		reason: "fingerprint_mismatch",
 		deviceId
 	};
-	let valid = false;
+	let verification;
 	try {
-		valid = verifySignature({
-			method: request.method,
-			pathWithQuery: pathWithQuery(request.url),
-			bodyBytes: body,
-			timestamp,
-			nonce,
-			signature,
+		const [localDeviceId] = ensureDeviceIdentity(store.db, { keysDir: syncKeysDir() });
+		verification = verifyDirectPeerRequestSignature(request, body, {
+			deviceId,
 			publicKey,
-			deviceId
+			expectedRecipientId: localDeviceId,
+			highestObservedVersion: peerRow.highest_observed_direct_signature_version
 		});
 	} catch {
 		return {
@@ -3763,13 +3945,17 @@ function authorizeSyncRequest(store, request, body) {
 			deviceId
 		};
 	}
-	if (!valid) return {
+	if (!verification.ok) return {
 		ok: false,
-		reason: "invalid_signature",
+		reason: verification.reason,
 		deviceId
 	};
 	const nonceResult = recordSyncAuthNonce(store, deviceId, nonce, (/* @__PURE__ */ new Date()).toISOString());
 	if (nonceResult) return nonceResult;
+	if (verification.version === DIRECT_PEER_SIGNATURE_VERSION_NUMBER) {
+		const versionResult = recordDirectPeerSignatureVersion(store, deviceId, verification.version);
+		if (versionResult) return versionResult;
+	}
 	return {
 		ok: true,
 		reason: "ok",
@@ -3888,17 +4074,15 @@ async function authorizeBootstrapGrantRequest(store, request, body) {
 		reason: "bootstrap_grant_expired",
 		deviceId
 	};
-	let valid = false;
+	const existingPeer = store.db.prepare(`SELECT highest_observed_direct_signature_version
+			 FROM sync_peer_signature_state WHERE peer_device_id = ? LIMIT 1`).get(deviceId);
+	let signatureVerification;
 	try {
-		valid = verifySignature({
-			method: request.method,
-			pathWithQuery: pathWithQuery(request.url),
-			bodyBytes: body,
-			timestamp,
-			nonce,
-			signature,
+		signatureVerification = verifyDirectPeerRequestSignature(request, body, {
+			deviceId,
 			publicKey: workerPublicKey,
-			deviceId
+			expectedRecipientId: localDeviceId,
+			highestObservedVersion: existingPeer?.highest_observed_direct_signature_version ?? null
 		});
 	} catch {
 		return {
@@ -3907,9 +4091,9 @@ async function authorizeBootstrapGrantRequest(store, request, body) {
 			deviceId
 		};
 	}
-	if (!valid) return {
+	if (!signatureVerification.ok) return {
 		ok: false,
-		reason: "bootstrap_grant_invalid_signature",
+		reason: signatureVerification.reason,
 		deviceId
 	};
 	if (!isPeerTrustBindingCompatible(store.db, deviceId, workerPublicKey, workerFingerprint)) return {
@@ -3925,6 +4109,10 @@ async function authorizeBootstrapGrantRequest(store, request, body) {
 		publicKey: workerPublicKey,
 		replaceTrust: true
 	});
+	if (signatureVerification.version === DIRECT_PEER_SIGNATURE_VERSION_NUMBER) {
+		const versionResult = recordDirectPeerSignatureVersion(store, deviceId, signatureVerification.version);
+		if (versionResult) return versionResult;
+	}
 	return {
 		ok: true,
 		reason: "ok",
@@ -4832,8 +5020,8 @@ function syncProtocolRoutes(getStore, opts = {}) {
 			if (!auth.ok) {
 				const grantPresent = Boolean((c.req.header("X-Codemem-Bootstrap-Grant") ?? "").trim());
 				if (bootstrapAttempted && (grantPresent || deviceAuthReason != null && deviceAuthReason !== "missing_headers")) console.warn(`[sync] peer auth failed: reason=${auth.reason} device_auth_reason=${deviceAuthReason ?? "none"} grant_present=${grantPresent} path=${c.req.path} device=${loggableHeaderValue(c.req.header("X-Opencode-Device"))}`);
-				const wireReason = bootstrapAttempted && grantPresent ? "bootstrap_grant_invalid" : deviceAuthReason ?? auth.reason;
-				return (preauthChecked ? null : rateLimitedResponse(c, c.req.path, false)) ?? c.json(unauthorizedPayload(wireReason, true), 401);
+				else logDirectPeerAuthDiagnostic(deviceAuthReason, auth.reason);
+				return (preauthChecked ? null : rateLimitedResponse(c, c.req.path, false)) ?? c.json(unauthorizedPayload(), 401);
 			}
 			const limited = rateLimitedResponse(c, auth.deviceId, true);
 			if (limited) return limited;
@@ -4868,7 +5056,10 @@ function syncProtocolRoutes(getStore, opts = {}) {
 		const store = getStore();
 		const auth = authorizeSyncRequest(store, c.req, Buffer.alloc(0));
 		if (isSyncAuthStoreBusy(auth)) return syncAuthStoreBusyResponse(c);
-		if (!auth.ok) return rateLimitedResponse(c, c.req.path, false) ?? c.json(unauthorizedPayload(auth.reason, true), 401);
+		if (!auth.ok) {
+			logDirectPeerAuthDiagnostic(auth.reason);
+			return rateLimitedResponse(c, c.req.path, false) ?? c.json(unauthorizedPayload(), 401);
+		}
 		const limited = rateLimitedResponse(c, auth.deviceId, true);
 		if (limited) return limited;
 		const peerDeviceId = auth.deviceId;
@@ -4949,8 +5140,8 @@ function syncProtocolRoutes(getStore, opts = {}) {
 			if (!auth.ok) {
 				const grantPresent = Boolean((c.req.header("X-Codemem-Bootstrap-Grant") ?? "").trim());
 				if (bootstrapAttempted && (grantPresent || deviceAuthReason != null && deviceAuthReason !== "missing_headers")) console.warn(`[sync] peer auth failed: reason=${auth.reason} device_auth_reason=${deviceAuthReason ?? "none"} grant_present=${grantPresent} path=${c.req.path} device=${loggableHeaderValue(c.req.header("X-Opencode-Device"))}`);
-				const wireReason = bootstrapAttempted && grantPresent ? "bootstrap_grant_invalid" : deviceAuthReason ?? auth.reason;
-				return (preauthChecked ? null : rateLimitedResponse(c, c.req.path, false)) ?? c.json(unauthorizedPayload(wireReason, true), 401);
+				else logDirectPeerAuthDiagnostic(deviceAuthReason, auth.reason);
+				return (preauthChecked ? null : rateLimitedResponse(c, c.req.path, false)) ?? c.json(unauthorizedPayload(), 401);
 			}
 			const limited = rateLimitedResponse(c, auth.deviceId, true);
 			if (limited) return limited;
@@ -5007,7 +5198,10 @@ function syncProtocolRoutes(getStore, opts = {}) {
 		if (raw == null) return c.json({ error: "payload_too_large" }, 413);
 		const auth = authorizeSyncRequest(store, c.req, raw);
 		if (isSyncAuthStoreBusy(auth)) return syncAuthStoreBusyResponse(c);
-		if (!auth.ok) return rateLimitedResponse(c, c.req.path, false) ?? c.json(unauthorizedPayload(auth.reason, true), 401);
+		if (!auth.ok) {
+			logDirectPeerAuthDiagnostic(auth.reason);
+			return rateLimitedResponse(c, c.req.path, false) ?? c.json(unauthorizedPayload(), 401);
+		}
 		const limited = rateLimitedResponse(c, auth.deviceId, true);
 		if (limited) return limited;
 		const peerDeviceId = auth.deviceId;
@@ -5071,6 +5265,52 @@ function syncProtocolRoutes(getStore, opts = {}) {
 	});
 	return app;
 }
+async function loadConfiguredDeviceIdentityCoordinatorEvidence() {
+	const config = readCoordinatorSyncConfig();
+	const hasCoordinatorConfiguration = config.syncCoordinatorUrl.length > 0 || config.syncCoordinatorGroups.length > 0;
+	const remoteUrl = config.syncCoordinatorUrl.trim();
+	const adminSecret = config.syncCoordinatorAdminSecret.trim();
+	const groupIds = [...new Set(config.syncCoordinatorGroups.map((groupId) => groupId.trim()))].filter(Boolean);
+	if (!hasCoordinatorConfiguration) return {
+		availability: "unavailable",
+		safeErrorCode: "coordinator_not_configured",
+		enrollments: []
+	};
+	if (!remoteUrl || !adminSecret || groupIds.length === 0) return {
+		availability: "unavailable",
+		safeErrorCode: "coordinator_unavailable",
+		enrollments: []
+	};
+	if (groupIds.length > 25) return {
+		availability: "unavailable",
+		safeErrorCode: "coordinator_evidence_too_large",
+		enrollments: []
+	};
+	try {
+		const enrollments = (await Promise.all(groupIds.map((groupId) => coordinatorListDevicesAction({
+			groupId,
+			includeDisabled: true,
+			remoteUrl,
+			adminSecret
+		})))).flat();
+		if (enrollments.length > 500) return {
+			availability: "unavailable",
+			safeErrorCode: "coordinator_evidence_too_large",
+			enrollments: []
+		};
+		return {
+			availability: "available",
+			safeErrorCode: null,
+			enrollments
+		};
+	} catch {
+		return {
+			availability: "unavailable",
+			safeErrorCode: "coordinator_unavailable",
+			enrollments: []
+		};
+	}
+}
 /**
 * Viewer-facing sync management routes (/api/sync/*).
 *
@@ -5078,8 +5318,112 @@ function syncProtocolRoutes(getStore, opts = {}) {
 * provide sync status, peer management, and coordinator UI for the
 * local viewer.
 */
-function syncRoutes(getStore, getSyncRuntimeStatus) {
+function syncRoutes(getStore, getSyncRuntimeStatus, options = {}) {
 	const app = new Hono();
+	const loadCoordinatorEvidence = options.loadDeviceIdentityCoordinatorEvidence ?? loadConfiguredDeviceIdentityCoordinatorEvidence;
+	const currentCoordinatorEvidence = async () => {
+		try {
+			return await loadCoordinatorEvidence();
+		} catch {
+			return {
+				availability: "unavailable",
+				safeErrorCode: "coordinator_unavailable",
+				enrollments: []
+			};
+		}
+	};
+	const localInventoryInput = async (store) => {
+		let explicitDeviceName = "";
+		try {
+			explicitDeviceName = String(readCodememConfigFile().sync_device_name ?? "");
+		} catch {
+			explicitDeviceName = "";
+		}
+		return {
+			localDeviceId: store.deviceId,
+			localDisplayName: friendlyDeviceName({
+				explicitName: explicitDeviceName,
+				osName: hostname(),
+				fallbackSeed: store.deviceId
+			}),
+			coordinator: await currentCoordinatorEvidence()
+		};
+	};
+	app.get("/api/sync/recipient-policy/v1/device-inventory", async (c) => {
+		const store = getStore();
+		ensureStableStoreIdentity(store);
+		return c.json(listDeviceIdentityInventory(store.db, await localInventoryInput(store)));
+	});
+	const parseDeviceBindingRequest = (value, commit) => {
+		if (!value || typeof value !== "object" || Array.isArray(value)) return null;
+		const body = value;
+		const allowed = new Set(commit ? ["bindings", "reviewedInventoryDigest"] : ["bindings"]);
+		if (Object.keys(body).some((key) => !allowed.has(key)) || !Array.isArray(body.bindings)) return null;
+		const bindings = body.bindings.map((value) => {
+			if (!value || typeof value !== "object" || Array.isArray(value)) return null;
+			const binding = value;
+			const bindingKeys = new Set([
+				"deviceId",
+				"targetIdentityId",
+				"confirmed",
+				"allowRebind"
+			]);
+			if (Object.keys(binding).some((key) => !bindingKeys.has(key)) || typeof binding.deviceId !== "string" || typeof binding.targetIdentityId !== "string" || typeof binding.confirmed !== "boolean" || Object.hasOwn(binding, "allowRebind") && typeof binding.allowRebind !== "boolean") return null;
+			return {
+				deviceId: binding.deviceId,
+				targetIdentityId: binding.targetIdentityId,
+				confirmed: binding.confirmed,
+				...typeof binding.allowRebind === "boolean" ? { allowRebind: binding.allowRebind } : {}
+			};
+		});
+		if (bindings.some((binding) => binding == null)) return null;
+		if (commit && typeof body.reviewedInventoryDigest !== "string") return null;
+		return {
+			bindings,
+			...commit ? { reviewedInventoryDigest: body.reviewedInventoryDigest } : {}
+		};
+	};
+	app.post("/api/sync/recipient-policy/v1/device-bindings/preview", async (c) => {
+		const body = parseDeviceBindingRequest(await parseViewerJsonBody(c), false);
+		if (!body) return c.json({ error: "binding_request_invalid" }, 400);
+		const store = getStore();
+		try {
+			ensureStableStoreIdentity(store);
+			const result = previewDeviceIdentityBindings(store.db, await localInventoryInput(store), body);
+			if (result.status === "invalid") return c.json(result, 400);
+			if (result.status === "not_found") return c.json(result, 404);
+			if (result.status === "conflict") return c.json(result, 409);
+			return c.json(result);
+		} catch (error) {
+			if (isSqliteBusy(error)) {
+				c.header("Retry-After", "1");
+				return c.json({ error: "binding_preview_busy" }, 503);
+			}
+			return c.json({ error: "binding_preview_failed" }, 500);
+		}
+	});
+	app.post("/api/sync/recipient-policy/v1/device-bindings/commit", async (c) => {
+		const body = parseDeviceBindingRequest(await parseViewerJsonBody(c), true);
+		if (!body || !("reviewedInventoryDigest" in body)) return c.json({ error: "binding_request_invalid" }, 400);
+		const store = getStore();
+		try {
+			ensureStableStoreIdentity(store);
+			const result = commitDeviceIdentityBindings(store.db, {
+				localActorId: store.actorId,
+				localDeviceId: store.deviceId
+			}, await localInventoryInput(store), body);
+			if (result.status === "invalid") return c.json(result, 400);
+			if (result.status === "not_found") return c.json(result, 404);
+			if (result.status === "stale" || result.status === "conflict") return c.json(result, 409);
+			return c.json(result);
+		} catch (error) {
+			if (isSqliteBusy(error)) {
+				c.header("Retry-After", "1");
+				return c.json({ error: "binding_commit_busy" }, 503);
+			}
+			return c.json({ error: "binding_commit_failed" }, 500);
+		}
+	});
 	app.get("/api/sync/status", async (c) => {
 		const store = getStore();
 		{
@@ -5392,9 +5736,15 @@ function syncRoutes(getStore, getSyncRuntimeStatus) {
 				return c.json({ error: "invalid json" }, 400);
 			}
 			const peerDeviceId = String(body.peer_device_id ?? "").trim();
-			const name = String(body.name ?? "").trim();
+			const rawName = String(body.name ?? "");
 			if (!peerDeviceId) return c.json({ error: "peer_device_id required" }, 400);
-			if (!name) return c.json({ error: "name required" }, 400);
+			if (!rawName.trim()) return c.json({ error: "name required" }, 400);
+			let name;
+			try {
+				name = normalizeHumanPresentationName(rawName, "name");
+			} catch (error) {
+				return c.json({ error: error instanceof Error ? error.message : "name_invalid" }, 400);
+			}
 			if (!d.select({ peer_device_id: schema.syncPeers.peer_device_id }).from(schema.syncPeers).where(eq(schema.syncPeers.peer_device_id, peerDeviceId)).get()) return c.json({ error: "peer not found" }, 404);
 			d.update(schema.syncPeers).set({ name }).where(eq(schema.syncPeers.peer_device_id, peerDeviceId)).run();
 			return c.json({ ok: true });
@@ -5802,7 +6152,7 @@ function syncRoutes(getStore, getSyncRuntimeStatus) {
 				operationId: plan.operationId,
 				reviewedProjectSetDigest: plan.reviewedProjectSetDigest,
 				inviterActorId: plan.inviterActorId,
-				inviterDisplayName: store.actorDisplayName,
+				inviterDisplayName: projectInviteInviterDisplayName(store.actorDisplayName),
 				inviterDeviceId: plan.inviterDeviceIds[0],
 				pendingPersonId: plan.personId,
 				projectSummaries: plan.projects.map((project) => ({
@@ -6110,8 +6460,14 @@ function syncRoutes(getStore, getSyncRuntimeStatus) {
 		} catch {
 			return c.json({ error: "invalid json" }, 400);
 		}
-		const displayName = String(body.display_name ?? "").trim();
-		if (!displayName) return c.json({ error: "display_name required" }, 400);
+		const rawDisplayName = String(body.display_name ?? "");
+		if (!rawDisplayName.trim()) return c.json({ error: "display_name required" }, 400);
+		let displayName;
+		try {
+			displayName = normalizeHumanPresentationName(rawDisplayName, "display_name");
+		} catch (error) {
+			return c.json({ error: error instanceof Error ? error.message : "display_name_invalid" }, 400);
+		}
 		const d = drizzle(store.db, { schema });
 		const now = (/* @__PURE__ */ new Date()).toISOString();
 		const actor = {
@@ -6136,9 +6492,13 @@ function syncRoutes(getStore, getSyncRuntimeStatus) {
 			return c.json({ error: "invalid json" }, 400);
 		}
 		const actorId = String(body.actor_id ?? "").trim();
-		const displayName = String(body.display_name ?? "").trim();
 		if (!actorId) return c.json({ error: "actor_id required" }, 400);
-		if (!displayName) return c.json({ error: "display_name required" }, 400);
+		let displayName;
+		try {
+			displayName = normalizeHumanPresentationName(String(body.display_name ?? ""), "display_name");
+		} catch (error) {
+			return c.json({ error: error instanceof Error ? error.message : "display_name_invalid" }, 400);
+		}
 		const d = drizzle(store.db, { schema });
 		const actor = d.select().from(schema.actors).where(eq(schema.actors.actor_id, actorId)).get();
 		if (!actor) return c.json({ error: "actor not found" }, 404);
@@ -6168,14 +6528,133 @@ function syncRoutes(getStore, getSyncRuntimeStatus) {
 		if (!secondaryActorId) return c.json({ error: "secondary_actor_id required" }, 400);
 		if (primaryActorId === secondaryActorId) return c.json({ error: "actor ids must differ" }, 400);
 		const d = drizzle(store.db, { schema });
-		const primary = d.select().from(schema.actors).where(eq(schema.actors.actor_id, primaryActorId)).get();
-		const secondary = d.select().from(schema.actors).where(eq(schema.actors.actor_id, secondaryActorId)).get();
-		if (!primary || !secondary) return c.json({ error: "actor not found" }, 404);
-		if (primary.status !== "active") return c.json({ error: "primary actor not active" }, 409);
-		if (secondary.status !== "active") return c.json({ error: "secondary actor not active" }, 409);
-		if (secondary.is_local && secondary.actor_id === store.actorId) return c.json({ error: "cannot merge this device's own local actor" }, 409);
 		const now = (/* @__PURE__ */ new Date()).toISOString();
-		const mergedCount = store.db.transaction(() => {
+		const result = store.db.transaction(() => {
+			const primary = d.select().from(schema.actors).where(eq(schema.actors.actor_id, primaryActorId)).get();
+			const secondary = d.select().from(schema.actors).where(eq(schema.actors.actor_id, secondaryActorId)).get();
+			if (!primary || !secondary) return {
+				error: "actor not found",
+				status: 404
+			};
+			if (primary.status !== "active") return {
+				error: "primary actor not active",
+				status: 409
+			};
+			if (secondary.status !== "active") return {
+				error: "secondary actor not active",
+				status: 409
+			};
+			if (secondary.is_local && secondary.actor_id === store.actorId) return {
+				error: "cannot merge this device's own local actor",
+				status: 409
+			};
+			const memberships = d.select().from(schema.policyTeamMemberships).where(eq(schema.policyTeamMemberships.identity_id, secondaryActorId)).all();
+			const primaryMemberships = /* @__PURE__ */ new Map();
+			for (const membership of memberships) {
+				const primaryMembership = d.select().from(schema.policyTeamMemberships).where(and(eq(schema.policyTeamMemberships.team_id, membership.team_id), eq(schema.policyTeamMemberships.identity_id, primaryActorId))).get();
+				if (primaryMembership && (primaryMembership.role !== membership.role || primaryMembership.status !== membership.status)) return {
+					error: "actor team memberships conflict",
+					status: 409
+				};
+				primaryMemberships.set(membership.team_id, primaryMembership);
+			}
+			const directRecipients = d.select().from(schema.projectRecipients).where(and(eq(schema.projectRecipients.recipient_kind, "identity"), eq(schema.projectRecipients.recipient_id, secondaryActorId))).all();
+			const primaryRecipients = /* @__PURE__ */ new Map();
+			for (const recipient of directRecipients) {
+				const primaryRecipient = d.select().from(schema.projectRecipients).where(and(eq(schema.projectRecipients.canonical_project_identity, recipient.canonical_project_identity), eq(schema.projectRecipients.recipient_kind, "identity"), eq(schema.projectRecipients.recipient_id, primaryActorId))).get();
+				if (primaryRecipient && primaryRecipient.status !== recipient.status) return {
+					error: "actor project recipients conflict",
+					status: 409
+				};
+				primaryRecipients.set(recipient.canonical_project_identity, primaryRecipient);
+			}
+			const mergeDigest = createHash("sha256").update(JSON.stringify({
+				kind: "identity-merge-v1",
+				primaryActorId,
+				secondaryActorId,
+				nonce: randomUUID()
+			})).digest("hex");
+			const bindings = d.select({
+				deviceId: schema.identityDevices.device_id,
+				assignmentVersion: schema.identityDevices.assignment_version
+			}).from(schema.identityDevices).where(eq(schema.identityDevices.identity_id, secondaryActorId)).all();
+			if (bindings.length > 0) {
+				const commitDigest = mergeDigest;
+				const outcomes = bindings.map((binding) => ({
+					deviceId: binding.deviceId,
+					previousIdentityId: secondaryActorId,
+					targetIdentityId: primaryActorId,
+					action: "rebind"
+				}));
+				store.db.prepare(`INSERT INTO device_identity_binding_commits(
+						commit_digest, reviewed_inventory_digest, request_json, outcomes_json, write_count,
+						decided_by_identity_id, decided_by_device_id, created_at
+					) VALUES (?, ?, ?, ?, ?, ?, ?, ?)`).run(commitDigest, `identity-merge:${secondaryActorId}:${primaryActorId}`, JSON.stringify({
+					primaryActorId,
+					secondaryActorId
+				}), JSON.stringify(outcomes), bindings.length, store.actorId, store.deviceId, now);
+				for (const binding of bindings) {
+					const revision = createHash("sha256").update(`identity-merge-revision-v1\0${commitDigest}\0${binding.deviceId}`).digest("hex");
+					const idempotencyKey = createHash("sha256").update(`identity-merge-row-v1\0${commitDigest}\0${binding.deviceId}`).digest("hex");
+					if (store.db.prepare(`UPDATE identity_devices SET
+							identity_id = ?, provenance = 'review_resolution', revision = ?,
+							migration_state = 'user_managed', source_fingerprint = ?,
+							idempotency_key = ?, updated_at = ?
+						 WHERE device_id = ? AND identity_id = ?`).run(primaryActorId, revision, commitDigest, idempotencyKey, now, binding.deviceId, secondaryActorId).changes !== 1) throw new Error("identity_merge_binding_update_failed");
+					const rebound = store.db.prepare("SELECT assignment_version FROM identity_devices WHERE device_id = ?").get(binding.deviceId);
+					if (!rebound || rebound.assignment_version !== binding.assignmentVersion + 1) throw new Error("identity_merge_assignment_version_unexpected");
+					store.db.prepare("DELETE FROM policy_team_device_decisions WHERE device_id = ?").run(binding.deviceId);
+					store.db.prepare(`INSERT INTO device_identity_binding_audit(
+							event_id, commit_digest, device_id, previous_identity_id, target_identity_id,
+							action, previous_assignment_version, resulting_assignment_version,
+							decided_by_identity_id, decided_by_device_id, created_at
+						) VALUES (?, ?, ?, ?, ?, 'rebind', ?, ?, ?, ?, ?)`).run(createHash("sha256").update(`identity-merge-event-v1\0${commitDigest}\0${binding.deviceId}`).digest("hex"), commitDigest, binding.deviceId, secondaryActorId, primaryActorId, binding.assignmentVersion, rebound.assignment_version, store.actorId, store.deviceId, now);
+				}
+			}
+			for (const membership of memberships) {
+				if (primaryMemberships.get(membership.team_id)) {
+					d.delete(schema.policyTeamMemberships).where(and(eq(schema.policyTeamMemberships.team_id, membership.team_id), eq(schema.policyTeamMemberships.identity_id, secondaryActorId))).run();
+					continue;
+				}
+				const revision = createHash("sha256").update(`identity-merge-membership-revision-v1\0${mergeDigest}\0${membership.team_id}`).digest("hex");
+				const idempotencyKey = createHash("sha256").update(`identity-merge-membership-row-v1\0${mergeDigest}\0${membership.team_id}`).digest("hex");
+				d.update(schema.policyTeamMemberships).set({
+					identity_id: primaryActorId,
+					provenance: "review_resolution",
+					revision,
+					migration_state: "user_managed",
+					source_fingerprint: mergeDigest,
+					idempotency_key: idempotencyKey,
+					updated_at: now
+				}).where(and(eq(schema.policyTeamMemberships.team_id, membership.team_id), eq(schema.policyTeamMemberships.identity_id, secondaryActorId))).run();
+			}
+			for (const recipient of directRecipients) {
+				if (primaryRecipients.get(recipient.canonical_project_identity)) {
+					d.delete(schema.projectRecipients).where(and(eq(schema.projectRecipients.canonical_project_identity, recipient.canonical_project_identity), eq(schema.projectRecipients.recipient_kind, "identity"), eq(schema.projectRecipients.recipient_id, secondaryActorId))).run();
+					continue;
+				}
+				const policyRevision = createHash("sha256").update(`identity-merge-recipient-revision-v1\0${mergeDigest}\0${recipient.canonical_project_identity}`).digest("hex");
+				const idempotencyKey = createHash("sha256").update(`identity-merge-recipient-row-v1\0${mergeDigest}\0${recipient.canonical_project_identity}`).digest("hex");
+				d.update(schema.projectRecipients).set({
+					recipient_id: primaryActorId,
+					provenance: "review_resolution",
+					policy_revision: policyRevision,
+					migration_state: "user_managed",
+					source_fingerprint: mergeDigest,
+					idempotency_key: idempotencyKey,
+					updated_at: now
+				}).where(and(eq(schema.projectRecipients.canonical_project_identity, recipient.canonical_project_identity), eq(schema.projectRecipients.recipient_kind, "identity"), eq(schema.projectRecipients.recipient_id, secondaryActorId))).run();
+			}
+			d.update(schema.recipientManagedProjectProjections).set({
+				recipient_identity_id: primaryActorId,
+				updated_at: now
+			}).where(eq(schema.recipientManagedProjectProjections.recipient_identity_id, secondaryActorId)).run();
+			store.db.prepare(`UPDATE share_operations SET
+						inviter_actor_id = CASE WHEN inviter_actor_id = ? THEN ? ELSE inviter_actor_id END,
+						recipient_actor_id = CASE WHEN recipient_actor_id = ? THEN ? ELSE recipient_actor_id END,
+						person_id = CASE WHEN person_id = ? THEN ? ELSE person_id END,
+						updated_at = ?
+					 WHERE inviter_actor_id = ? OR recipient_actor_id = ? OR person_id = ?`).run(secondaryActorId, primaryActorId, secondaryActorId, primaryActorId, secondaryActorId, primaryActorId, now, secondaryActorId, secondaryActorId, secondaryActorId);
 			const peerUpdate = d.update(schema.syncPeers).set({ actor_id: primaryActorId }).where(eq(schema.syncPeers.actor_id, secondaryActorId)).run();
 			if (primary.is_local) d.update(schema.syncPeers).set({ claimed_local_actor: 1 }).where(eq(schema.syncPeers.actor_id, primaryActorId)).run();
 			d.update(schema.actors).set({
@@ -6183,9 +6662,10 @@ function syncRoutes(getStore, getSyncRuntimeStatus) {
 				merged_into_actor_id: primaryActorId,
 				updated_at: now
 			}).where(eq(schema.actors.actor_id, secondaryActorId)).run();
-			return Number(peerUpdate.changes ?? 0);
-		})();
-		return c.json({ merged_count: mergedCount });
+			return { mergedCount: Number(peerUpdate.changes ?? 0) };
+		}).immediate();
+		if ("error" in result) return c.json({ error: result.error }, result.status);
+		return c.json({ merged_count: result.mergedCount });
 	});
 	app.post("/api/sync/actors/deactivate", async (c) => {
 		const store = getStore();
@@ -6408,7 +6888,7 @@ function syncRoutes(getStore, getSyncRuntimeStatus) {
 				inviteValue: rawValue,
 				dbPath: store.dbPath,
 				recipientActorId: recipientInvite ? null : store.actorId,
-				recipientDisplayName: typeof body.recipient_name === "string" ? body.recipient_name : store.actorDisplayName,
+				recipientDisplayName: decoded.kind === "add_device" ? null : typeof body.recipient_name === "string" ? body.recipient_name : store.actorDisplayName,
 				deviceDisplayName: typeof body.device_name === "string" ? body.device_name : null,
 				reviewedOnboardingDigest: reviewedOnboardingDigest || null
 			});
@@ -7255,15 +7735,19 @@ function syncRoutes(getStore, getSyncRuntimeStatus) {
 			}, 400);
 		}
 		const groupId = resolveCoordinatorAdminGroup(String(body.group_id ?? "").trim(), status);
-		const displayName = String(body.display_name ?? "").trim();
 		if (!groupId) return c.json({
 			error: "group_id required",
 			status
 		}, 400);
-		if (!displayName) return c.json({
-			error: "display_name required",
-			status
-		}, 400);
+		let displayName;
+		try {
+			displayName = normalizeHumanPresentationName(String(body.display_name ?? ""), "display_name");
+		} catch (error) {
+			return c.json({
+				error: error instanceof Error ? error.message : "display_name_invalid",
+				status
+			}, 400);
+		}
 		try {
 			const device = await coordinatorRenameDeviceAction({
 				groupId,
@@ -7744,7 +8228,7 @@ function createApp(opts) {
 	}));
 	app.route("/", configRoutes({ getSweeper: () => sweeper }));
 	app.route("/", rawEventsRoutes(storeFactory, sweeper));
-	app.route("/", syncRoutes(storeFactory, getSyncRuntimeStatus));
+	app.route("/", syncRoutes(storeFactory, getSyncRuntimeStatus, { loadDeviceIdentityCoordinatorEvidence: opts?.loadDeviceIdentityCoordinatorEvidence }));
 	app.route("/", updateStatusRoutes({ getUpdateStatus: opts?.getUpdateStatus }));
 	const staticRoot = process.env.CODEMEM_VIEWER_STATIC_DIR ?? join(import.meta.dirname ?? ".", "../static");
 	app.use("/assets/*", async (c, next) => {