@codemem/server 0.41.0 → 0.43.0

package/dist/index.js

@@ -1,6 +1,6 @@
 import { existsSync, readFileSync } from "node:fs";
 import { dirname, isAbsolute, join, posix, resolve, win32 } from "node:path";
-import { ACCESS_CLEANUP_OP_TYPE, CODEMEM_CONFIG_ENV_OVERRIDES, DEFAULT_TIME_WINDOW_S, LEGACY_SHARED_REVIEW_SCOPE_ID, LOCAL_DEFAULT_SCOPE_ID, LOCAL_SYNC_CAPABILITY, LOCAL_SYNC_FEATURES, MemoryStore, RecipientPolicyEdgeRequestError, SCOPE_MEMBERSHIP_REVOCATION_LIMITATION, SYNC_AUTHORIZATION_REFRESH_HEADER, SYNC_CAPABILITY_HEADER, SYNC_FEATURES_HEADER, SYNC_SCOPE_QUERY_PARAM, VERSION, VERSION as VERSION$1, VIEWER_SERVICE_DISCRIMINATOR, addSyncScopeToBoundary, analyzeProjectScopeMappingChangeGuardrails, applyReplicationOps, buildAuthHeaders, buildBaseUrl, buildFilterClausesWithContext, buildRawEventEnvelopeFromCodexHook, buildRawEventEnvelopeFromHook, canonicalMemoryKind, canonicalWorkspaceIdentity, cleanupNonces, clonePromptPackAttempt, coerceObserverCommand, commitRecipientPolicyEdges, coordinatorArchiveGroupAction, coordinatorCreateAddDeviceInviteAction, coordinatorCreateGroupAction, coordinatorCreateInviteAction, coordinatorCreateScopeAction, coordinatorDisableDeviceAction, coordinatorEnableDeviceAction, coordinatorGrantScopeMembershipAction, coordinatorImportInviteAction, coordinatorListBootstrapGrantsAction, coordinatorListConsumedTeamInvitesAction, coordinatorListDevicesAction, coordinatorListGroupsAction, coordinatorListJoinRequestsAction, coordinatorListReviewedRecipientInviteEvidenceAction, coordinatorListScopeMembershipsAction, coordinatorListScopesAction, coordinatorRemoveDeviceAction, coordinatorRenameDeviceAction, coordinatorRenameGroupAction, coordinatorReviewJoinRequestAction, coordinatorRevokeBootstrapGrantAction, coordinatorRevokeScopeMembershipAction, coordinatorStatusSnapshot, coordinatorUnarchiveGroupAction, coordinatorUpdateScopeAction, countShareableProjectMemories, createCoordinatorReciprocalApproval, decodeInvitePayload, defaultSpaceScopeIdForGroup, deleteProjectScopeSettingsMapping, detectInstallKind, diagnoseStalePeerReceivedRows, ensureDeviceIdentity, executeShareProvisioning, extractInvitePayload, extractReplicationOps, filterReplicationOpsForSyncWithStatus, fingerprintPublicKey, formatHostPort, friendlyDeviceName, fromJson, getCodememConfigPath, getCodememEnvOverrides, getCoordinatorEnrollmentReconciliationIssueSummary, getCoordinatorGroupPreference, getRecipientPolicyAuthorityState, getSemanticIndexDiagnostics, getSyncResetState, getUpdateStatus, inviteTokenDigest, isPeerTrustBindingCompatible, isProjectSyncEnablementError, isScopedSyncCapability, isSummaryLikeMemory, listAuthorizedScopesForPeer, listCoordinatorJoinRequests, listInboundScopeRejections, listLegacyRecipientPolicyProjections, listMaintenanceJobs, listObserverProviderOptions, listPerPeerScopeSyncState, listProjectScopeCandidates, listProjectScopeInventory, listProjectScopeSettingsMappings, listRecipientPolicyIntent, listRecipientPolicyReview, listSharingDomainSettingsScopes, loadMemorySnapshotPageForPeer, loadReplicationOpsForPeer, lookupCoordinatorPeers, mergeAddresses, migrateRecipientPolicyIntent, negotiateSyncCapability, normalizeAddress, normalizeSyncCapability, normalizeSyncFeatures, normalizeTeammateName, parseAcceptedProjectIntent, parseReassignScopePayload, parseStrictInteger, parseSyncScopeRequest, persistShareOperation, personalScopeGrantStatusForPeer, planShareOperation, previewRecipientPolicyEdges, previewRecipientPolicyOnboarding, previewRecipientPolicyOnboardingFromReviewedIntent, probeAvailableCredentials, projectShareLifecycle, promptPackArtifactFingerprint, readCodememConfigFile, readCoordinatorSyncConfig, reassignProjectScopeInventoryProject, recipientInviteAuthoritativeIdentityId, recipientReviewedIntentDigest, reconcileCoordinatorEnrollmentSnapshot, reconcileRecipientPolicyProject, reconcileShareOperationAcceptance, recordNonce, recordPromptPackArtifacts, recordPromptPackTerminal, refreshAuthorizedCoordinatorPeerTrust, refreshConfiguredScopeMembershipCache, rejectInboundScopeFailures, requestJson, resolveDbPath, resolveProject, resolveRecipientPolicyReview, resolveRecipientPolicyReviewBulk, runSyncPass, schema, stripPrivateObj, summarizeInboundScopeRejections, supportsSyncFeature, syncScopeResetRequiredPayload, tryUpdateRetrievalDelivery, updatePeerAddresses, upsertCoordinatorGroupPreference, upsertProjectScopeSettingsMapping, verifyRecipientReviewedIntent, verifySignature, writeCodememConfigFile } from "@codemem/core";
+import { ACCESS_CLEANUP_OP_TYPE, CODEMEM_CONFIG_ENV_OVERRIDES, CoordinatorReciprocalApprovalRequestChangedError, DEFAULT_TIME_WINDOW_S, LEGACY_SHARED_REVIEW_SCOPE_ID, LOCAL_DEFAULT_SCOPE_ID, LOCAL_SYNC_CAPABILITY, LOCAL_SYNC_FEATURES, MemoryStore, PROMPT_TRANSPORT_PROTOCOL_RANGE, RawEventIngestValidationError, RecipientPolicyEdgeRequestError, SCOPE_MEMBERSHIP_REVOCATION_LIMITATION, SYNC_AUTHORIZATION_REFRESH_HEADER, SYNC_CAPABILITY_HEADER, SYNC_FEATURES_HEADER, SYNC_SCOPE_QUERY_PARAM, VERSION, VERSION as VERSION$1, VIEWER_IDENTITY_TARGET_KEYS, VIEWER_SERVICE_DISCRIMINATOR, addSyncScopeToBoundary, analyzeProjectScopeMappingChangeGuardrails, applyReplicationOps, buildAuthHeaders, buildBaseUrl, buildDirectPeerAuthHeaders, buildFilterClausesWithContext, buildRawEventEnvelopeFromCodexHook, buildRawEventEnvelopeFromHook, buildViewerIdentityTarget, canonicalMemoryKind, canonicalWorkspaceIdentity, cleanupNonces, clearLegacyTeamSetupDeviceDecision, clonePromptPackAttempt, coerceObserverCommand, commitDeviceIdentityBindings, commitRecipientPolicyEdges, coordinatorArchiveGroupAction, coordinatorCreateAddDeviceInviteAction, coordinatorCreateGroupAction, coordinatorCreateInviteAction, coordinatorCreateScopeAction, coordinatorDisableDeviceAction, coordinatorEnableDeviceAction, coordinatorGrantScopeMembershipAction, coordinatorImportInviteAction, coordinatorListBootstrapGrantsAction, coordinatorListConsumedTeamInvitesAction, coordinatorListDevicesAction, coordinatorListGroupsAction, coordinatorListJoinRequestsAction, coordinatorListReviewedRecipientInviteEvidenceAction, coordinatorListScopeMembershipsAction, coordinatorListScopesAction, coordinatorRemoveDeviceAction, coordinatorRenameDeviceAction, coordinatorRenameGroupAction, coordinatorReviewJoinRequestAction, coordinatorRevokeBootstrapGrantAction, coordinatorRevokeScopeMembershipAction, coordinatorStatusSnapshot, coordinatorUnarchiveGroupAction, coordinatorUpdateScopeAction, countShareableProjectMemories, createCoordinatorReciprocalApproval, decodeInvitePayload, defaultSpaceScopeIdForGroup, deleteProjectScopeSettingsMapping, detectInstallKind, diagnoseStalePeerReceivedRows, discoverLegacyTeamCandidates, ensureDeviceIdentity, executeShareProvisioning, extractInvitePayload, extractReplicationOps, filterReplicationOpsForSyncWithStatus, fingerprintPublicKey, finishLegacyTeamSetupActivation, formatHostPort, friendlyDeviceName, fromJson, getCodememConfigPath, getCodememEnvOverrides, getCoordinatorEnrollmentReconciliationIssueSummary, getCoordinatorGroupPreference, getLegacyTeamSetupDraft, getRecipientPolicyAuthorityState, getSemanticIndexDiagnostics, getSyncResetState, getUpdateStatus, ingestRawEvents, inviteTokenDigest, isLegacyTeamCandidateSelectable, isLegacyTeamSetupProjectMappingIdentity, isPeerTrustBindingCompatible, isProjectSyncEnablementError, isScopedSyncCapability, legacyTeamCandidateId, legacyTeamCandidateProjectInventory, legacyTeamCanonicalProjectRef, legacyTeamDeviceRef, legacyTeamResolvedProjectRef, legacyTeamSetupApiErrorCode, listAuthorizedScopesForPeer, listCoordinatorJoinRequests, listDeviceIdentityInventory, listInboundScopeRejections, listLegacyRecipientPolicyProjections, listMaintenanceJobs, listObserverProviderOptions, listPerPeerScopeSyncState, listProjectScopeCandidates, listProjectScopeInventory, listProjectScopeSettingsMappings, listRecipientPolicyIntent, listRecipientPolicyReview, listSharingDomainSettingsScopes, loadMemorySnapshotPageForPeer, loadReplicationOpsForPeer, lookupCoordinatorPeers, mergeAddresses, migrateRecipientPolicyIntent, negotiateSyncCapability, normalizeAddress, normalizeHumanPresentationName, normalizeSyncCapability, normalizeSyncFeatures, normalizeTeammateName, parseAcceptedProjectIntent, parsePositiveMemoryId, parseReassignScopePayload, parseStrictInteger, parseSyncScopeRequest, persistShareOperation, personalScopeGrantStatusForPeer, planShareOperation, previewDeviceIdentityBindings, previewLegacyTeamSetupActivation, previewRecipientPolicyEdges, previewRecipientPolicyOnboarding, previewRecipientPolicyOnboardingFromReviewedIntent, probeAvailableCredentials, projectShareLifecycle, promptPackArtifactFingerprint, readCodememConfigFile, readCoordinatorSyncConfig, reassignProjectScopeInventoryProject, recipientInviteAuthoritativeIdentityId, recipientPolicyDigest, recipientReviewedIntentDigest, reconcileCoordinatorEnrollmentSnapshot, reconcileRecipientPolicyProject, reconcileShareOperationAcceptance, recordHighestObservedDirectSignatureVersion, recordNonce, recordPromptPackArtifacts, recordPromptPackTerminal, refreshAuthorizedCoordinatorPeerTrust, refreshConfiguredScopeMembershipCache, refreshLegacyTeamCandidate, rejectInboundScopeFailures, requestJson, resolveDbPath, resolveProject, resolveRecipientPolicyReview, resolveRecipientPolicyReviewBulk, runSyncPass, schema, setLegacyTeamSetupDeviceAssignment, setLegacyTeamSetupDeviceDecision, setLegacyTeamSetupProjectMapping, summarizeInboundScopeRejections, supportsSyncFeature, syncScopeResetRequiredPayload, tryUpdateRetrievalDelivery, updatePeerAddresses, upsertCoordinatorGroupPreference, upsertProjectScopeSettingsMapping, verifyDirectPeerSignature, verifyRecipientReviewedIntent, verifySignature, writeCodememConfigFile } from "@codemem/core";
 import { serveStatic } from "@hono/node-server/serve-static";
 import { Hono } from "hono";
 import { createMiddleware } from "hono/factory";
@@ -28,7 +28,8 @@ function isLoopbackOrigin(origin) {
 	}
 	if (url.protocol !== "http:" && url.protocol !== "https:") return false;
 	if (url.username || url.password) return false;
-	return LOOPBACK_HOSTS.has(url.hostname);
+	const hostname = url.hostname.startsWith("[") ? url.hostname.slice(1, -1) : url.hostname;
+	return LOOPBACK_HOSTS.has(hostname);
 }
 /** HTTP methods that mutate state and require origin validation. */
 var UNSAFE_METHODS = new Set([
@@ -61,7 +62,8 @@ function isUnsafeMissingOrigin(c) {
 *
 * Ports Python's `reject_cross_origin(missing_origin_policy="reject_if_unsafe")`:
 *
-* - GET/HEAD/OPTIONS: allowed from any origin (viewer is local-only).
+* - GET/HEAD/OPTIONS: allowed from any origin unless the caller marks a
+*   side-effecting GET path prefix as unsafe.
 * - POST/DELETE/PATCH/PUT:
 *   - Origin present + loopback → allowed (browser on localhost)
 *   - Origin present + non-loopback → rejected 403
@@ -72,20 +74,21 @@ function isUnsafeMissingOrigin(c) {
 * Access-Control-Allow-Origin is set — the browser doesn't need it.
 * For valid loopback origins, ACAO is echoed back.
 */
-function originGuard() {
+function originGuard(options) {
 	return createMiddleware(async (c, next) => {
 		const origin = c.req.header("Origin");
 		const method = c.req.method;
-		if (UNSAFE_METHODS.has(method)) {
+		const unsafeGet = (method === "GET" || method === "HEAD") && options?.unsafeGetPathPrefixes?.some((prefix) => c.req.path.startsWith(prefix));
+		if (UNSAFE_METHODS.has(method) || unsafeGet) {
 			if (origin) {
 				if (!isLoopbackOrigin(origin)) return c.json({ error: "forbidden" }, 403);
 				c.header("Access-Control-Allow-Origin", origin);
-				c.header("Access-Control-Allow-Methods", "GET, POST, DELETE, OPTIONS");
+				c.header("Access-Control-Allow-Methods", "GET, POST, PUT, DELETE, OPTIONS");
 				c.header("Access-Control-Allow-Headers", "Content-Type");
 			} else if (isUnsafeMissingOrigin(c)) return c.json({ error: "forbidden" }, 403);
 		} else if (origin && isLoopbackOrigin(origin)) {
 			c.header("Access-Control-Allow-Origin", origin);
-			c.header("Access-Control-Allow-Methods", "GET, POST, DELETE, OPTIONS");
+			c.header("Access-Control-Allow-Methods", "GET, POST, PUT, DELETE, OPTIONS");
 			c.header("Access-Control-Allow-Headers", "Content-Type");
 		}
 		await next();
@@ -104,7 +107,7 @@ function preflightHandler() {
 		const origin = c.req.header("Origin");
 		if (origin && isLoopbackOrigin(origin)) {
 			c.header("Access-Control-Allow-Origin", origin);
-			c.header("Access-Control-Allow-Methods", "GET, POST, DELETE, OPTIONS");
+			c.header("Access-Control-Allow-Methods", "GET, POST, PUT, DELETE, OPTIONS");
 			c.header("Access-Control-Allow-Headers", "Content-Type");
 			c.header("Access-Control-Max-Age", "86400");
 			return c.body(null, 204);
@@ -573,6 +576,102 @@ function queryBool(value) {
 }
 //#endregion
 //#region src/routes/memory.ts
+var MAX_FEED_QUERY_CODE_UNITS = 256;
+var searchFunctionsRegisteredStores = /* @__PURE__ */ new WeakSet();
+function casefold(value) {
+	return String(value ?? "").toLowerCase();
+}
+function normalizeMemorySearchQuery(value) {
+	return casefold(value?.trim()).slice(0, MAX_FEED_QUERY_CODE_UNITS) || void 0;
+}
+function ensureMemorySearchFunctions(store) {
+	if (searchFunctionsRegisteredStores.has(store)) return;
+	store.db.function("codemem_casefold", { deterministic: true }, casefold);
+	store.db.function("codemem_project_basename", { deterministic: true }, (value) => projectBasename(String(value ?? "").trim()));
+	searchFunctionsRegisteredStores.add(store);
+}
+var IDENTITY_LOOKUP_BATCH_SIZE = 500;
+function identityValue(item, key) {
+	const direct = String(item[key] ?? "").trim();
+	if (direct) return direct;
+	const rawMetadata = item.metadata ?? item.metadata_json;
+	const metadata = typeof rawMetadata === "string" ? fromJson(rawMetadata) : rawMetadata;
+	if (!metadata || typeof metadata !== "object" || Array.isArray(metadata)) return "";
+	return String(metadata[key] ?? "").trim();
+}
+function uniqueStrings(items, key) {
+	return [...new Set(items.map((item) => identityValue(item, key)).filter(Boolean))];
+}
+function batchedLookup(store, values, query) {
+	const rows = [];
+	for (let offset = 0; offset < values.length; offset += IDENTITY_LOOKUP_BATCH_SIZE) {
+		const batch = values.slice(offset, offset + IDENTITY_LOOKUP_BATCH_SIZE);
+		const placeholders = batch.map(() => "?").join(", ");
+		rows.push(...store.db.prepare(query(placeholders)).all(...batch));
+	}
+	return rows;
+}
+function humanName(value) {
+	if (typeof value !== "string") return void 0;
+	try {
+		return normalizeHumanPresentationName(value, "display_name");
+	} catch {
+		return;
+	}
+}
+/**
+* Add presentation-only identity labels without changing persisted provenance.
+* Resolved names are display hints, not authority or ownership evidence; legacy
+* metadata receives the same top-level-first fallback as existing read paths.
+*/
+function attachResolvedIdentityFieldsUnsafe(store, items) {
+	const actorIds = uniqueStrings(items, "actor_id");
+	const deviceIds = uniqueStrings(items, "origin_device_id");
+	const peers = batchedLookup(store, deviceIds, (placeholders) => `SELECT peer_device_id, name, actor_id FROM sync_peers
+		 WHERE peer_device_id IN (${placeholders})
+		   AND TRIM(COALESCE(pinned_fingerprint, '')) <> ''`);
+	const peerByDevice = new Map(peers.map((peer) => [peer.peer_device_id, peer]));
+	const peerActorIds = peers.map((peer) => String(peer.actor_id ?? "").trim()).filter((actorId) => actorId.length > 0);
+	const actorRows = batchedLookup(store, [...new Set([...actorIds, ...peerActorIds])], (placeholders) => `SELECT actor_id, display_name, status, merged_into_actor_id FROM actors
+			 WHERE actor_id IN (${placeholders})`);
+	const devices = batchedLookup(store, deviceIds, (placeholders) => `SELECT device_id, display_name FROM identity_devices
+		 WHERE device_id IN (${placeholders}) AND status = 'active'`);
+	const actorById = new Map(actorRows.map((actor) => [actor.actor_id, actor]));
+	let pendingMergeTargets = [...new Set(actorRows.map((actor) => String(actor.merged_into_actor_id ?? "").trim()).filter((actorId) => actorId && !actorById.has(actorId)))];
+	while (pendingMergeTargets.length > 0) {
+		const targetRows = batchedLookup(store, pendingMergeTargets, (placeholders) => `SELECT actor_id, display_name, status, merged_into_actor_id FROM actors
+				 WHERE actor_id IN (${placeholders})`);
+		for (const actor of targetRows) actorById.set(actor.actor_id, actor);
+		pendingMergeTargets = [...new Set(targetRows.map((actor) => String(actor.merged_into_actor_id ?? "").trim()).filter((actorId) => actorId && !actorById.has(actorId)))];
+	}
+	const resolvedActorName = (actorId) => {
+		const seen = /* @__PURE__ */ new Set();
+		let currentActorId = actorId;
+		while (currentActorId && !seen.has(currentActorId)) {
+			seen.add(currentActorId);
+			const actor = actorById.get(currentActorId);
+			if (!actor) return void 0;
+			if (actor.status === "active" && actor.merged_into_actor_id === null) return humanName(actor.display_name);
+			currentActorId = String(actor.merged_into_actor_id ?? "").trim();
+		}
+	};
+	const deviceNameById = new Map(devices.map((device) => [device.device_id, humanName(device.display_name)]).filter((entry) => entry[1] !== void 0));
+	for (const item of items) {
+		const actorId = identityValue(item, "actor_id");
+		const deviceId = identityValue(item, "origin_device_id");
+		const peer = peerByDevice.get(deviceId);
+		const peerActorId = String(peer?.actor_id ?? "").trim();
+		const actorName = actorById.has(actorId) ? resolvedActorName(actorId) ?? humanName(item.actor_display_name) : resolvedActorName(peerActorId) ?? humanName(item.actor_display_name);
+		const deviceName = deviceNameById.get(deviceId) ?? humanName(peer?.name);
+		if (actorName) item.resolved_actor_display_name = actorName;
+		if (deviceName) item.resolved_device_display_name = deviceName;
+	}
+}
+function attachResolvedIdentityFields(store, items) {
+	try {
+		attachResolvedIdentityFieldsUnsafe(store, items);
+	} catch {}
+}
 function serializeMemoryRow(ownedBySelf, row) {
 	const metadata = fromJson(row.metadata_json ?? null);
 	const owned_by_self = ownedBySelf(row);
@@ -651,12 +750,49 @@ function summaryLikeSqlPredicate() {
 		OR (
 			json_valid(COALESCE(memory_items.metadata_json, ''))
 			AND (
-				COALESCE(json_extract(memory_items.metadata_json, '$.is_summary') = 1, 0)
+				COALESCE(json_type(memory_items.metadata_json, '$.is_summary') = 'true', 0)
 				OR LOWER(TRIM(COALESCE(json_extract(memory_items.metadata_json, '$.source'), ''))) = 'observer_summary'
 			)
 		)
 	)`;
 }
+function memorySearchSql(query) {
+	const textClause = `INSTR(codemem_casefold(
+		COALESCE(memory_items.title, '') || CHAR(10) ||
+		COALESCE(memory_items.body_text, '') || CHAR(10) ||
+		CASE WHEN ${summaryLikeSqlPredicate()} THEN 'session_summary' ELSE
+			COALESCE(NULLIF(LOWER(TRIM(COALESCE(memory_items.kind, ''))), ''), 'change')
+		END || CHAR(10) ||
+		COALESCE(
+			memory_items.project,
+			codemem_project_basename(
+				(SELECT sessions.project FROM sessions WHERE sessions.id = memory_items.session_id)
+			),
+			''
+		) || CHAR(10) ||
+		COALESCE(memory_items.tags_text, '') || CHAR(10) ||
+		COALESCE(memory_items.facts, '') || CHAR(10) ||
+		COALESCE(memory_items.subtitle, '') || CHAR(10) ||
+		COALESCE(memory_items.narrative, '') || CHAR(10) ||
+		CASE WHEN json_valid(COALESCE(memory_items.metadata_json, '')) THEN
+			COALESCE(json_extract(memory_items.metadata_json, '$.request'), '') || CHAR(10) ||
+			COALESCE(json_extract(memory_items.metadata_json, '$.subtitle'), '') || CHAR(10) ||
+			COALESCE(json_extract(memory_items.metadata_json, '$.narrative'), '') || CHAR(10) ||
+			COALESCE(json_extract(memory_items.metadata_json, '$.facts'), '') || CHAR(10) ||
+			COALESCE(json_extract(memory_items.metadata_json, '$.summary'), '')
+		ELSE '' END
+	), codemem_casefold(?)) > 0`;
+	const parsedMemoryId = parsePositiveMemoryId(query);
+	const memoryId = parsedMemoryId != null && String(parsedMemoryId) === query ? parsedMemoryId : null;
+	if (memoryId != null) return {
+		clause: `(memory_items.id = ? OR ${textClause})`,
+		params: [memoryId, query]
+	};
+	return {
+		clause: textClause,
+		params: [query]
+	};
+}
 function countVisibleObservationRows(store, filters) {
 	const filterResult = buildViewerMemoryFilters(store, filters);
 	const clauses = [
@@ -709,43 +845,32 @@ function countVisibleArtifactRows(store, project) {
 	return Number(row?.total ?? 0);
 }
 function queryMemoryPage(store, options) {
+	ensureMemorySearchFunctions(store);
 	const filters = {};
 	if (options.project) filters.project = options.project;
 	if (options.scope) filters.ownership_scope = options.scope;
 	const filterResult = buildViewerMemoryFilters(store, filters);
-	const where = ["memory_items.active = 1", ...filterResult.clauses].join(" AND ");
+	const summaryPredicate = summaryLikeSqlPredicate();
+	const clauses = [
+		"memory_items.active = 1",
+		options.classification === "summary" ? summaryPredicate : `NOT ${summaryPredicate}`,
+		...filterResult.clauses
+	];
+	const params = [...filterResult.params];
+	if (options.q) {
+		const search = memorySearchSql(options.q);
+		clauses.push(search.clause);
+		params.push(...search.params);
+	}
+	const where = clauses.join(" AND ");
 	const from = filterResult.joinSessions ? "memory_items JOIN sessions ON sessions.id = memory_items.session_id" : "memory_items";
 	const rows = store.db.prepare(`SELECT memory_items.* FROM ${from}
 			 WHERE ${where}
-			 ORDER BY memory_items.created_at DESC
-			 LIMIT ? OFFSET ?`).all(...filterResult.params, options.limit + 1, options.offset);
+			 ORDER BY memory_items.created_at DESC, memory_items.id DESC
+			 LIMIT ? OFFSET ?`).all(...params, options.limit + 1, options.offset);
 	const ownedBySelf = store.buildOwnershipPredicate();
 	return rows.map((row) => serializeMemoryRow(ownedBySelf, row));
 }
-function isSummaryLikeMemory$1(item) {
-	return isSummaryLikeMemory({
-		kind: item.kind,
-		metadata: item.metadata_json
-	});
-}
-function selectMemoryPage(store, options) {
-	const pageSize = Math.max(options.limit + options.offset + 10, 50);
-	let rawOffset = 0;
-	const matched = [];
-	while (matched.length < options.offset + options.limit + 1) {
-		const page = queryMemoryPage(store, {
-			limit: pageSize,
-			offset: rawOffset,
-			project: options.project,
-			scope: options.scope
-		});
-		if (page.length === 0) break;
-		matched.push(...page.filter(options.matcher));
-		if (page.length < pageSize) break;
-		rawOffset += page.length;
-	}
-	return matched.slice(options.offset, options.offset + options.limit + 1);
-}
 function memoryRoutes(getStore) {
 	const app = new Hono();
 	app.get("/api/sessions", (c) => {
@@ -794,17 +919,19 @@ function memoryRoutes(getStore) {
 		{
 			const limit = Math.max(1, queryInt(c.req.query("limit"), 20));
 			const offset = Math.max(0, queryInt(c.req.query("offset"), 0));
-			const items = selectMemoryPage(store, {
+			const items = queryMemoryPage(store, {
 				limit,
 				offset,
 				project: c.req.query("project") || void 0,
 				scope: normalizeScope(c.req.query("scope")),
-				matcher: (item) => !isSummaryLikeMemory$1(item)
+				q: normalizeMemorySearchQuery(c.req.query("q")),
+				classification: "observation"
 			});
 			const hasMore = items.length > limit;
 			const result = hasMore ? items.slice(0, limit) : items;
 			const asRecords = result;
 			attachSessionFields(store, asRecords);
+			attachResolvedIdentityFields(store, asRecords);
 			return c.json({
 				items: asRecords,
 				pagination: {
@@ -821,17 +948,19 @@ function memoryRoutes(getStore) {
 		{
 			const limit = Math.max(1, queryInt(c.req.query("limit"), 50));
 			const offset = Math.max(0, queryInt(c.req.query("offset"), 0));
-			const items = selectMemoryPage(store, {
+			const items = queryMemoryPage(store, {
 				limit,
 				offset,
 				project: c.req.query("project") || void 0,
 				scope: normalizeScope(c.req.query("scope")),
-				matcher: (item) => isSummaryLikeMemory$1(item)
+				q: normalizeMemorySearchQuery(c.req.query("q")),
+				classification: "summary"
 			});
 			const hasMore = items.length > limit;
 			const result = hasMore ? items.slice(0, limit) : items;
 			const asRecords = result;
 			attachSessionFields(store, asRecords);
+			attachResolvedIdentityFields(store, asRecords);
 			return c.json({
 				items: asRecords,
 				pagination: {
@@ -926,6 +1055,7 @@ function memoryRoutes(getStore) {
 			if (project) filters.project = project;
 			const asRecords = store.recent(limit, filters);
 			attachSessionFields(store, asRecords);
+			attachResolvedIdentityFields(store, asRecords);
 			return c.json({ items: asRecords });
 		}
 	});
@@ -1077,6 +1207,71 @@ function observerStatusRoutes(deps) {
 	return app;
 }
 //#endregion
+//#region src/routes/target-validation.ts
+var IDENTITY_TARGET_KEYS = new Set(VIEWER_IDENTITY_TARGET_KEYS);
+var BOOLEAN_IDENTITY_TARGET_KEYS = new Set(["actor_id_present", "embedding_disabled"]);
+function invalidRequest$1(message) {
+	return {
+		ok: false,
+		status: 400,
+		body: { error: {
+			code: "invalid_request",
+			message
+		} }
+	};
+}
+function conflict(code, message) {
+	return {
+		ok: false,
+		status: 409,
+		body: { error: {
+			code,
+			message
+		} }
+	};
+}
+function isRecord$1(value) {
+	return value != null && typeof value === "object" && !Array.isArray(value);
+}
+function currentIdentityTarget() {
+	return buildViewerIdentityTarget();
+}
+function requestedDbMatches(store, value) {
+	if (value == null) return true;
+	if (typeof value !== "string" || !value.trim()) return null;
+	return resolve(resolveDbPath(value.trim())) === resolve(store.dbPath);
+}
+function requestedIdentityMatches(value) {
+	if (value == null) return true;
+	if (!isRecord$1(value)) return null;
+	if (Object.keys(value).length !== IDENTITY_TARGET_KEYS.size || Object.keys(value).some((key) => !IDENTITY_TARGET_KEYS.has(key))) return "unsupported";
+	const expected = currentIdentityTarget();
+	for (const key of VIEWER_IDENTITY_TARGET_KEYS) {
+		const requested = value[key];
+		if (BOOLEAN_IDENTITY_TARGET_KEYS.has(key)) {
+			if (typeof requested !== "boolean") return null;
+		} else if (requested !== null && typeof requested !== "string") return null;
+		if (requested !== expected[key]) return false;
+	}
+	return true;
+}
+function validateViewerTarget(store, payload, options = {}) {
+	if (options.requirePairedTargets) {
+		const hasDbPath = Object.hasOwn(payload, "db_path");
+		if (hasDbPath !== Object.hasOwn(payload, "identity_target")) return invalidRequest$1("db_path and identity_target must be provided together");
+		if (hasDbPath && (payload.db_path == null || payload.identity_target == null)) return invalidRequest$1("db_path and identity_target must be valid when provided");
+	}
+	const dbMatches = requestedDbMatches(store, payload.db_path);
+	if (dbMatches == null) return invalidRequest$1("db_path must be a non-empty string");
+	if (!dbMatches) return conflict("viewer_db_mismatch", "viewer database does not match request");
+	const identityMatches = requestedIdentityMatches(payload.identity_target);
+	if (identityMatches === "unsupported") return conflict("viewer_contract_unsupported", "viewer request contract is incompatible");
+	if (identityMatches == null) return invalidRequest$1("identity_target is invalid");
+	if (!identityMatches) return conflict("viewer_identity_mismatch", "viewer identity does not match request");
+	if ((options.requireCurrentIdentity || payload.identity_target != null) && !store.hasCurrentIdentity()) return conflict("viewer_identity_mismatch", "viewer identity does not match request");
+	return { ok: true };
+}
+//#endregion
 //#region src/routes/pack.ts
 var MAX_LEDGER_PAYLOAD_BYTES = 16 * 1024;
 var MAX_METADATA_FIELD_CHARS = 512;
@@ -1114,19 +1309,6 @@ var LEDGER_KEYS = new Set([
 	"db_path",
 	"identity_target"
 ]);
-var IDENTITY_TARGET_KEYS = new Set([
-	"device_id",
-	"actor_id_present",
-	"actor_id",
-	"config_path",
-	"runtime_root",
-	"workspace_id",
-	"home_dir",
-	"pack_compression",
-	"embedding_disabled",
-	"embedding_model"
-]);
-var BOOLEAN_IDENTITY_TARGET_KEYS = new Set(["actor_id_present", "embedding_disabled"]);
 var ATTEMPT_KEYS = new Set([
 	"attempt_id",
 	"started_at",
@@ -1154,12 +1336,6 @@ function invalidRequest(message) {
 		message
 	} };
 }
-function viewerDbMismatch() {
-	return { error: {
-		code: "viewer_db_mismatch",
-		message: "viewer database does not match request"
-	} };
-}
 function viewerIdentityMismatch() {
 	return { error: {
 		code: "viewer_identity_mismatch",
@@ -1185,47 +1361,6 @@ function normalizeWorkingSetPath(value) {
 	if (!normalized || normalized === "." || normalized === ".." || normalized.startsWith("../")) return null;
 	return normalized;
 }
-function requestedDbMatches(store, value) {
-	if (value == null) return true;
-	if (typeof value !== "string" || !value.trim()) return null;
-	return resolve(resolveDbPath(value)) === resolve(store.dbPath);
-}
-function normalizeIdentityPath(value) {
-	if (!value?.trim()) return null;
-	return resolve(resolveDbPath(value.trim()));
-}
-function currentIdentityTarget() {
-	return {
-		device_id: process.env.CODEMEM_DEVICE_ID?.trim() || null,
-		actor_id_present: Object.hasOwn(process.env, "CODEMEM_ACTOR_ID"),
-		actor_id: process.env.CODEMEM_ACTOR_ID?.trim() || null,
-		config_path: normalizeIdentityPath(process.env.CODEMEM_CONFIG),
-		runtime_root: normalizeIdentityPath(process.env.CODEMEM_RUNTIME_ROOT),
-		workspace_id: process.env.CODEMEM_WORKSPACE_ID?.trim() || null,
-		home_dir: normalizeIdentityPath(process.env.HOME || homedir()),
-		pack_compression: process.env.CODEMEM_PACK_COMPRESSION?.trim() || null,
-		embedding_disabled: [
-			"1",
-			"true",
-			"yes"
-		].includes(String(process.env.CODEMEM_EMBEDDING_DISABLED || "").toLowerCase()),
-		embedding_model: process.env.CODEMEM_EMBEDDING_MODEL || "Xenova/bge-small-en-v1.5"
-	};
-}
-function requestedIdentityMatches(value) {
-	if (value == null) return true;
-	if (!isRecord(value)) return null;
-	if (Object.keys(value).length !== IDENTITY_TARGET_KEYS.size || Object.keys(value).some((key) => !IDENTITY_TARGET_KEYS.has(key))) return "unsupported";
-	const expected = currentIdentityTarget();
-	for (const key of IDENTITY_TARGET_KEYS) {
-		const requested = value[key];
-		if (BOOLEAN_IDENTITY_TARGET_KEYS.has(key)) {
-			if (typeof requested !== "boolean") return null;
-		} else if (requested !== null && typeof requested !== "string") return null;
-		if (requested !== expected[key]) return false;
-	}
-	return true;
-}
 function validateMetadataFields(payload, allowedKeys) {
 	if (Buffer.byteLength(JSON.stringify(payload), "utf8") > MAX_LEDGER_PAYLOAD_BYTES) return "ledger metadata exceeds 16384 bytes";
 	for (const key of Object.keys(payload)) {
@@ -1347,7 +1482,8 @@ function packTransportRoutes(getStore) {
 			if (!store.hasCurrentIdentity()) return c.json(viewerIdentityMismatch(), 409);
 			return c.json({
 				service: "codemem-viewer",
-				protocol_version: 1,
+				protocol_version: PROMPT_TRANSPORT_PROTOCOL_RANGE.protocolVersion,
+				min_supported_protocol_version: PROMPT_TRANSPORT_PROTOCOL_RANGE.minSupportedProtocolVersion,
 				db_path: resolve(store.dbPath),
 				identity_target: currentIdentityTarget()
 			});
@@ -1368,14 +1504,8 @@ function packTransportRoutes(getStore) {
 		}
 		try {
 			const store = getStore();
-			const dbMatches = requestedDbMatches(store, parsed.db_path);
-			if (dbMatches == null) return c.json(invalidRequest("db_path must be a non-empty string"), 400);
-			if (!dbMatches) return c.json(viewerDbMismatch(), 409);
-			const identityMatches = requestedIdentityMatches(parsed.identity_target);
-			if (identityMatches === "unsupported") return c.json(viewerContractUnsupported(), 409);
-			if (identityMatches == null) return c.json(invalidRequest("identity_target is invalid"), 400);
-			if (!identityMatches) return c.json(viewerIdentityMismatch(), 409);
-			if (!store.hasCurrentIdentity()) return c.json(viewerIdentityMismatch(), 409);
+			const target = validateViewerTarget(store, parsed, { requireCurrentIdentity: true });
+			if (!target.ok) return c.json(target.body, target.status);
 			if (!request.attempt) {
 				const pack = await store.buildMemoryPackAsync(request.context, request.limit, request.tokenBudget, request.filters, request.renderOptions);
 				return c.json(pack);
@@ -1412,14 +1542,8 @@ function packTransportRoutes(getStore) {
 		}
 		try {
 			const store = getStore();
-			const dbMatches = requestedDbMatches(store, parsed.db_path);
-			if (dbMatches == null) return c.json(invalidRequest("db_path must be a non-empty string"), 400);
-			if (!dbMatches) return c.json(viewerDbMismatch(), 409);
-			const identityMatches = requestedIdentityMatches(parsed.identity_target);
-			if (identityMatches === "unsupported") return c.json(viewerContractUnsupported(), 409);
-			if (identityMatches == null) return c.json(invalidRequest("identity_target is invalid"), 400);
-			if (!identityMatches) return c.json(viewerIdentityMismatch(), 409);
-			if (!store.hasCurrentIdentity()) return c.json(viewerIdentityMismatch(), 409);
+			const target = validateViewerTarget(store, parsed, { requireCurrentIdentity: true });
+			if (!target.ok) return c.json(target.body, target.status);
 			const outcome = dispatchLedger(store, parsed);
 			if (typeof outcome === "string") return c.json(invalidRequest(outcome), 400);
 			if (outcome.ok) return c.json(outcome);
@@ -1439,34 +1563,60 @@ function packTransportRoutes(getStore) {
 * Raw events routes — GET & POST /api/raw-events, GET /api/raw-events/status,
 * POST /api/claude-hooks, POST /api/codex-hooks.
 */
-var MAX_RAW_EVENTS_BODY_BYTES = Number.parseInt(process.env.CODEMEM_RAW_EVENTS_MAX_BODY_BYTES ?? "", 10) || 1048576;
-/** Keys to check (in priority order) when resolving a session stream id. */
-var SESSION_ID_KEYS = [
-	"session_stream_id",
-	"session_id",
-	"stream_id",
-	"opencode_session_id"
-];
-/**
-* Resolve a session stream id from a payload object.
-* Checks multiple field aliases. Throws on conflicting values.
-*/
-function resolveSessionStreamId(payload) {
-	const values = /* @__PURE__ */ new Map();
-	for (const key of SESSION_ID_KEYS) {
-		const value = payload[key];
-		if (value == null) continue;
-		if (typeof value !== "string") throw new Error(`${key} must be string`);
-		const text = value.trim();
-		if (text) values.set(key, text);
-	}
-	if (values.size === 0) return null;
-	if (new Set(values.values()).size > 1) throw new Error("conflicting session id fields");
-	for (const key of SESSION_ID_KEYS) {
-		const v = values.get(key);
-		if (v) return v;
-	}
-	return null;
+var DEFAULT_MAX_RAW_EVENTS_BODY_BYTES = 1048576;
+function configuredMaxRawEventsBodyBytes() {
+	const parsed = Number(process.env.CODEMEM_RAW_EVENTS_MAX_BODY_BYTES?.trim() ?? "");
+	return Number.isSafeInteger(parsed) && parsed > 0 ? parsed : DEFAULT_MAX_RAW_EVENTS_BODY_BYTES;
+}
+var MAX_RAW_EVENTS_BODY_BYTES = configuredMaxRawEventsBodyBytes();
+function emptyTranscriptOutcomeCounts() {
+	return {
+		ok: 0,
+		not_provided: 0,
+		path_rejected: 0,
+		unreadable: 0,
+		no_complete_record: 0,
+		no_assistant_record: 0
+	};
+}
+function createTranscriptDiagnostics() {
+	const counts = {
+		claude: emptyTranscriptOutcomeCounts(),
+		codex: emptyTranscriptOutcomeCounts()
+	};
+	return {
+		record(source, outcome) {
+			counts[source][outcome] += 1;
+		},
+		snapshot() {
+			return {
+				scope: "legacy_compatibility_routes",
+				counts: {
+					claude: { ...counts.claude },
+					codex: { ...counts.codex }
+				}
+			};
+		}
+	};
+}
+function transcriptSkipResponse(outcome) {
+	if (outcome !== null && outcome !== "ok") return {
+		inserted: 0,
+		skipped: 1,
+		skip_reason: "transcript_unavailable",
+		skip_detail: outcome
+	};
+	return {
+		inserted: 0,
+		skipped: 1,
+		skip_reason: "unsupported_hook"
+	};
+}
+function claudeTranscriptRoot() {
+	return join(process.env.CLAUDE_CONFIG_DIR?.trim() || join(homedir(), ".claude"), "projects");
+}
+function codexTranscriptRoot() {
+	return join(process.env.CODEX_HOME?.trim() || join(homedir(), ".codex"), "sessions");
 }
 /**
 * Parse and validate a JSON object body, enforcing size limits.
@@ -1479,16 +1629,43 @@ async function parseJsonObjectBody(c, maxBytes) {
 		error: "payload too large",
 		max_bytes: maxBytes
 	}, 413);
-	let raw;
+	let raw = "";
 	try {
-		raw = await c.req.text();
+		const body = c.req.raw.body;
+		if (body !== null) {
+			const reader = body.getReader();
+			const chunks = [];
+			let totalBytes = 0;
+			try {
+				while (true) {
+					const { done, value } = await reader.read();
+					if (done) break;
+					totalBytes += value.byteLength;
+					if (totalBytes > maxBytes) {
+						try {
+							await reader.cancel();
+						} catch {}
+						return c.json({
+							error: "payload too large",
+							max_bytes: maxBytes
+						}, 413);
+					}
+					chunks.push(value);
+				}
+			} finally {
+				reader.releaseLock();
+			}
+			const bytes = new Uint8Array(totalBytes);
+			let offset = 0;
+			for (const chunk of chunks) {
+				bytes.set(chunk, offset);
+				offset += chunk.byteLength;
+			}
+			raw = new TextDecoder("utf-8", { fatal: true }).decode(bytes);
+		}
 	} catch {
 		return c.json({ error: "invalid json" }, 400);
 	}
-	if (Buffer.byteLength(raw, "utf-8") > maxBytes) return c.json({
-		error: "payload too large",
-		max_bytes: maxBytes
-	}, 413);
 	let parsed;
 	try {
 		parsed = raw ? JSON.parse(raw) : {};
@@ -1499,13 +1676,78 @@ async function parseJsonObjectBody(c, maxBytes) {
 	return parsed;
 }
 /** Nudge the sweeper safely — never crashes the caller. */
-function nudgeSweeper(sweeper, sessionIds, source = "opencode") {
-	try {
-		for (const sessionId of sessionIds) sweeper?.nudge(sessionId, source);
+function nudgeSweeper(sweeper, sessions) {
+	for (const session of sessions) try {
+		sweeper?.nudge(session.streamId, session.source);
+	} catch {}
+}
+async function flushBoundarySessions(sweeper, sessions) {
+	for (const session of sessions) try {
+		await sweeper?.flushBoundary(session.streamId, session.source);
 	} catch {}
 }
+function isClaudeBoundaryEnvelope(envelope) {
+	const record = envelope;
+	if (String(record.source ?? "").trim().toLowerCase() !== "claude") return false;
+	const payload = record.payload;
+	if (payload == null || typeof payload !== "object" || Array.isArray(payload)) return false;
+	const adapter = payload._adapter;
+	if (adapter == null || typeof adapter !== "object" || Array.isArray(adapter)) return false;
+	const meta = adapter.meta;
+	if (meta == null || typeof meta !== "object" || Array.isArray(meta)) return false;
+	const hookEventName = meta.hook_event_name;
+	return hookEventName === "SessionEnd" || hookEventName === "Stop";
+}
+var SAFE_INGEST_VALIDATION_ERRORS = new Set([
+	"source must be string",
+	"source is required",
+	"source must use 1-64 letters, digits, dots, underscores, or hyphens",
+	"session_stream_id must be string",
+	"session_id must be string",
+	"stream_id must be string",
+	"opencode_session_id must be string",
+	"conflicting session id fields",
+	"invalid session id",
+	"event source conflicts with request source",
+	"session id required",
+	"event_type must be string",
+	"event_type required",
+	"event_type has invalid syntax",
+	"event_id must be string",
+	"event_id required",
+	"event_id has invalid syntax",
+	"event_seq must be int",
+	"ts_wall_ms must be number",
+	"ts_mono_ms must be number",
+	"payload must be an object",
+	"cwd must be string",
+	"project must be string",
+	"started_at must be string",
+	"events must be a list",
+	"event must be an object"
+]);
+function boundedIngestValidationMessage(error) {
+	return SAFE_INGEST_VALIDATION_ERRORS.has(error.message) ? error.message : "invalid raw event request";
+}
+function boundedIngestErrorResponse(c, error) {
+	if (error instanceof RawEventIngestValidationError) return c.json({ error: boundedIngestValidationMessage(error) }, 400);
+	const response = { error: "internal server error" };
+	if (process.env.CODEMEM_VIEWER_DEBUG === "1") response.detail = error instanceof Error ? error.message : String(error);
+	return c.json(response, 500);
+}
+function untargetedPayload(payload) {
+	const { db_path: _dbPath, identity_target: _identityTarget, ...body } = payload;
+	return body;
+}
+async function ingestNormalizedEnvelope(store, sweeper, envelope, flushBoundary = false) {
+	const result = ingestRawEvents(store, envelope);
+	nudgeSweeper(sweeper, result.sessions);
+	if (flushBoundary && isClaudeBoundaryEnvelope(envelope)) await flushBoundarySessions(sweeper, result.sessions);
+	return result;
+}
 function rawEventsRoutes(getStore, sweeper) {
 	const app = new Hono();
+	const transcriptDiagnostics = createTranscriptDiagnostics();
 	app.get("/api/raw-events", (c) => {
 		const totals = getStore().rawEventBacklogTotals();
 		return c.json(totals);
@@ -1540,233 +1782,83 @@ function rawEventsRoutes(getStore, sweeper) {
 				available: true,
 				mode: "stream_queue",
 				max_body_bytes: MAX_RAW_EVENTS_BODY_BYTES
-			}
+			},
+			transcript_diagnostics: transcriptDiagnostics.snapshot()
 		});
 	});
 	app.post("/api/raw-events", async (c) => {
 		const result = await parseJsonObjectBody(c, MAX_RAW_EVENTS_BODY_BYTES);
 		if (result instanceof Response) return result;
-		const payload = result;
-		const store = getStore();
 		try {
-			const cwd = payload.cwd;
-			if (cwd != null && typeof cwd !== "string") return c.json({ error: "cwd must be string" }, 400);
-			const project = payload.project;
-			if (project != null && typeof project !== "string") return c.json({ error: "project must be string" }, 400);
-			const startedAt = payload.started_at;
-			if (startedAt != null && typeof startedAt !== "string") return c.json({ error: "started_at must be string" }, 400);
-			let items = payload.events;
-			if (items == null) items = [payload];
-			if (!Array.isArray(items)) return c.json({ error: "events must be a list" }, 400);
-			let defaultSessionId;
-			try {
-				defaultSessionId = resolveSessionStreamId(payload) ?? "";
-			} catch (err) {
-				return c.json({ error: err.message }, 400);
-			}
-			if (defaultSessionId.startsWith("msg_")) return c.json({ error: "invalid session id" }, 400);
-			let inserted = 0;
-			const lastSeenBySession = /* @__PURE__ */ new Map();
-			const metaBySession = /* @__PURE__ */ new Map();
-			const sessionIds = /* @__PURE__ */ new Set();
-			const batchBySession = /* @__PURE__ */ new Map();
-			for (const item of items) {
-				if (item == null || typeof item !== "object" || Array.isArray(item)) return c.json({ error: "event must be an object" }, 400);
-				const itemObj = item;
-				let itemSessionId;
-				try {
-					itemSessionId = resolveSessionStreamId(itemObj);
-				} catch (err) {
-					return c.json({ error: err.message }, 400);
-				}
-				const opencodeSessionId = String(itemSessionId ?? defaultSessionId ?? "");
-				if (!opencodeSessionId) return c.json({ error: "session id required" }, 400);
-				if (opencodeSessionId.startsWith("msg_")) return c.json({ error: "invalid session id" }, 400);
-				let eventId = String(itemObj.event_id ?? "");
-				const eventType = String(itemObj.event_type ?? "");
-				if (!eventType) return c.json({ error: "event_type required" }, 400);
-				const eventSeqValue = itemObj.event_seq;
-				if (eventSeqValue != null) {
-					const parsed = Number(eventSeqValue);
-					if (!Number.isFinite(parsed) || parsed !== Math.floor(parsed)) return c.json({ error: "event_seq must be int" }, 400);
-				}
-				let tsWallMs = itemObj.ts_wall_ms;
-				if (tsWallMs != null) {
-					const parsed = Number(tsWallMs);
-					if (!Number.isFinite(parsed)) return c.json({ error: "ts_wall_ms must be int" }, 400);
-					tsWallMs = Math.floor(parsed);
-					const prev = lastSeenBySession.get(opencodeSessionId) ?? tsWallMs;
-					lastSeenBySession.set(opencodeSessionId, Math.max(prev, tsWallMs));
-				}
-				let tsMonoMs = itemObj.ts_mono_ms;
-				if (tsMonoMs != null) {
-					const parsed = Number(tsMonoMs);
-					if (!Number.isFinite(parsed)) return c.json({ error: "ts_mono_ms must be number" }, 400);
-					tsMonoMs = parsed;
-				}
-				let eventPayload = itemObj.payload;
-				if (eventPayload == null) eventPayload = {};
-				if (typeof eventPayload !== "object" || Array.isArray(eventPayload)) return c.json({ error: "payload must be an object" }, 400);
-				const itemCwd = itemObj.cwd;
-				if (itemCwd != null && typeof itemCwd !== "string") return c.json({ error: "cwd must be string" }, 400);
-				const itemProject = itemObj.project;
-				if (itemProject != null && typeof itemProject !== "string") return c.json({ error: "project must be string" }, 400);
-				const itemStartedAt = itemObj.started_at;
-				if (itemStartedAt != null && typeof itemStartedAt !== "string") return c.json({ error: "started_at must be string" }, 400);
-				eventPayload = stripPrivateObj(eventPayload);
-				if (!eventId) {
-					const sortedStringify = (obj) => JSON.stringify(obj, (_key, value) => {
-						if (value != null && typeof value === "object" && !Array.isArray(value)) {
-							const sorted = {};
-							for (const k of Object.keys(value).sort()) sorted[k] = value[k];
-							return sorted;
-						}
-						return value;
-					});
-					if (eventSeqValue != null) {
-						const rawId = sortedStringify({
-							s: eventSeqValue,
-							t: eventType,
-							p: eventPayload
-						});
-						eventId = `legacy-seq-${eventSeqValue}-${createHash("sha256").update(rawId, "utf-8").digest("hex").slice(0, 16)}`;
-					} else {
-						const rawId = sortedStringify({
-							m: tsMonoMs ?? null,
-							p: eventPayload,
-							t: eventType,
-							w: tsWallMs ?? null
-						});
-						eventId = `legacy-${createHash("sha256").update(rawId, "utf-8").digest("hex").slice(0, 16)}`;
-					}
-				}
-				const eventEntry = {
-					event_id: eventId,
-					event_type: eventType,
-					payload: eventPayload,
-					ts_wall_ms: tsWallMs ?? null,
-					ts_mono_ms: tsMonoMs ?? null
-				};
-				sessionIds.add(opencodeSessionId);
-				const list = batchBySession.get(opencodeSessionId) ?? [];
-				list.push({ ...eventEntry });
-				batchBySession.set(opencodeSessionId, list);
-				if (itemCwd || itemProject || itemStartedAt) {
-					const perSession = metaBySession.get(opencodeSessionId) ?? {};
-					if (itemCwd) perSession.cwd = itemCwd;
-					if (itemProject) perSession.project = itemProject;
-					if (itemStartedAt) perSession.started_at = itemStartedAt;
-					metaBySession.set(opencodeSessionId, perSession);
-				}
-			}
-			if (sessionIds.size === 1) {
-				const singleSessionId = sessionIds.values().next().value;
-				const batch = batchBySession.get(singleSessionId) ?? [];
-				inserted = store.recordRawEventsBatch(singleSessionId, batch).inserted;
-			} else for (const [sid, sidEvents] of batchBySession) {
-				const result = store.recordRawEventsBatch(sid, sidEvents);
-				inserted += result.inserted;
-			}
-			for (const metaSessionId of sessionIds) {
-				const sessionMeta = metaBySession.get(metaSessionId) ?? {};
-				const applyRequestMeta = sessionIds.size === 1 || metaSessionId === defaultSessionId;
-				store.updateRawEventSessionMeta({
-					opencodeSessionId: metaSessionId,
-					cwd: sessionMeta.cwd ?? (applyRequestMeta ? cwd : void 0) ?? null,
-					project: sessionMeta.project ?? (applyRequestMeta ? project : void 0) ?? null,
-					startedAt: sessionMeta.started_at ?? (applyRequestMeta ? startedAt : void 0) ?? null,
-					lastSeenTsWallMs: lastSeenBySession.get(metaSessionId) ?? null
-				});
-			}
-			nudgeSweeper(sweeper, sessionIds);
+			const store = getStore();
+			const target = validateViewerTarget(store, result, { requirePairedTargets: true });
+			if (!target.ok) return c.json(target.body, target.status);
+			const ingestResult = await ingestNormalizedEnvelope(store, sweeper, untargetedPayload(result), c.req.header("x-codemem-boundary-flush") === "1");
 			return c.json({
-				inserted,
-				received: items.length
+				inserted: ingestResult.inserted,
+				skipped: ingestResult.skipped,
+				received: ingestResult.received
 			});
 		} catch (err) {
-			const response = { error: "internal server error" };
-			if (process.env.CODEMEM_VIEWER_DEBUG === "1") response.detail = err.message;
-			return c.json(response, 500);
+			return boundedIngestErrorResponse(c, err);
 		}
 	});
 	app.post("/api/claude-hooks", async (c) => {
 		const result = await parseJsonObjectBody(c, MAX_RAW_EVENTS_BODY_BYTES);
 		if (result instanceof Response) return result;
-		const envelope = buildRawEventEnvelopeFromHook(result);
-		if (envelope === null) return c.json({
-			inserted: 0,
-			skipped: 1
-		});
-		const store = getStore();
+		const payload = result;
 		try {
-			const opencodeSessionId = envelope.opencode_session_id;
-			const source = envelope.source;
-			const strippedPayload = stripPrivateObj(envelope.payload);
-			const inserted = store.recordRawEvent({
-				opencodeSessionId,
-				source,
-				eventId: envelope.event_id,
-				eventType: "claude.hook",
-				payload: strippedPayload,
-				tsWallMs: envelope.ts_wall_ms
-			});
-			store.updateRawEventSessionMeta({
-				opencodeSessionId,
-				source,
-				cwd: envelope.cwd,
-				project: envelope.project,
-				startedAt: envelope.started_at,
-				lastSeenTsWallMs: envelope.ts_wall_ms
+			const store = getStore();
+			const target = validateViewerTarget(store, payload, { requirePairedTargets: true });
+			if (!target.ok) return c.json(target.body, target.status);
+			let transcriptOutcome = null;
+			const envelope = buildRawEventEnvelopeFromHook(untargetedPayload(payload), {
+				transcriptPolicy: {
+					trust: "restricted",
+					approvedRoots: [claudeTranscriptRoot()]
+				},
+				onTranscriptOutcome: (outcome) => {
+					transcriptOutcome = outcome;
+					transcriptDiagnostics.record("claude", outcome);
+				}
 			});
-			nudgeSweeper(sweeper, [opencodeSessionId], source);
+			if (envelope === null) return c.json(transcriptSkipResponse(transcriptOutcome));
+			const ingestResult = await ingestNormalizedEnvelope(store, sweeper, envelope, c.req.header("x-codemem-boundary-flush") === "1");
 			return c.json({
-				inserted: inserted ? 1 : 0,
-				skipped: 0
+				inserted: ingestResult.inserted,
+				skipped: ingestResult.skipped
 			});
 		} catch (err) {
-			const response = { error: "internal server error" };
-			if (process.env.CODEMEM_VIEWER_DEBUG === "1") response.detail = err.message;
-			return c.json(response, 500);
+			return boundedIngestErrorResponse(c, err);
 		}
 	});
 	app.post("/api/codex-hooks", async (c) => {
 		const result = await parseJsonObjectBody(c, MAX_RAW_EVENTS_BODY_BYTES);
 		if (result instanceof Response) return result;
-		const envelope = buildRawEventEnvelopeFromCodexHook(result);
-		if (envelope === null) return c.json({
-			inserted: 0,
-			skipped: 1
-		});
-		const store = getStore();
+		const payload = result;
 		try {
-			const opencodeSessionId = envelope.opencode_session_id;
-			const source = envelope.source;
-			const strippedPayload = stripPrivateObj(envelope.payload);
-			const inserted = store.recordRawEvent({
-				opencodeSessionId,
-				source,
-				eventId: envelope.event_id,
-				eventType: envelope.event_type,
-				payload: strippedPayload,
-				tsWallMs: envelope.ts_wall_ms
-			});
-			store.updateRawEventSessionMeta({
-				opencodeSessionId,
-				source,
-				cwd: envelope.cwd,
-				project: envelope.project,
-				startedAt: envelope.started_at,
-				lastSeenTsWallMs: envelope.ts_wall_ms
+			const store = getStore();
+			const target = validateViewerTarget(store, payload, { requirePairedTargets: true });
+			if (!target.ok) return c.json(target.body, target.status);
+			let transcriptOutcome = null;
+			const envelope = buildRawEventEnvelopeFromCodexHook(untargetedPayload(payload), {
+				transcriptPolicy: {
+					trust: "restricted",
+					approvedRoots: [codexTranscriptRoot()]
+				},
+				onTranscriptOutcome: (outcome) => {
+					transcriptOutcome = outcome;
+					transcriptDiagnostics.record("codex", outcome);
+				}
 			});
-			nudgeSweeper(sweeper, [opencodeSessionId], source);
+			if (envelope === null) return c.json(transcriptSkipResponse(transcriptOutcome));
+			const ingestResult = await ingestNormalizedEnvelope(store, sweeper, envelope);
 			return c.json({
-				inserted: inserted ? 1 : 0,
-				skipped: 0
+				inserted: ingestResult.inserted,
+				skipped: ingestResult.skipped
 			});
 		} catch (err) {
-			const response = { error: "internal server error" };
-			if (process.env.CODEMEM_VIEWER_DEBUG === "1") response.detail = err.message;
-			return c.json(response, 500);
+			return boundedIngestErrorResponse(c, err);
 		}
 	});
 	return app;
@@ -2426,7 +2518,13 @@ function projectInviteAcceptanceFailure(error) {
 		inviter_identity_invalid: "The owner's device identity could not be verified. Ask the owner to review the share and create a new invitation.",
 		project_invite_self_acceptance_forbidden: "The owner cannot accept this recipient invitation on the owner's device.",
 		project_invite_bootstrap_incomplete: "The owner's device is not ready to establish trust yet. Retry once, then ask the owner to review the share.",
-		project_invite_trust_state_invalid: "The owner's trust setup could not be verified. Ask the owner to review the share."
+		project_invite_trust_state_invalid: "The owner's trust setup could not be verified. Ask the owner to review the share.",
+		recipient_display_name_invalid: "Enter a human-readable Identity name instead of an internal identifier.",
+		recipient_display_name_required: "Enter an Identity display name.",
+		recipient_display_name_too_long: "Use an Identity display name with 120 characters or fewer.",
+		device_display_name_invalid: "Enter a human-readable device name instead of an internal identifier.",
+		device_display_name_required: "Enter a device display name.",
+		device_display_name_too_long: "Use a device display name with 120 characters or fewer."
 	};
 	return {
 		error: Object.hasOwn(detailByCode, code) ? code : "project_invite_acceptance_failed",
@@ -2434,11 +2532,19 @@ function projectInviteAcceptanceFailure(error) {
 	};
 }
 var PROJECT_INVITE_TTL_HOURS = 168;
+var PROJECT_INVITE_OWNER_FALLBACK = "Project owner";
 var PROJECT_INVITE_BODY_KEYS = new Set([
 	"teammate_name",
 	"project_ids",
 	"reviewed_project_set_digest"
 ]);
+function projectInviteInviterDisplayName(value) {
+	try {
+		return normalizeHumanPresentationName(value, "inviter_display_name");
+	} catch {
+		return PROJECT_INVITE_OWNER_FALLBACK;
+	}
+}
 function projectInviteStringList(body, key) {
 	const value = body[key];
 	if (!Array.isArray(value)) throw new Error(`${key}_must_be_string_array`);
@@ -2565,10 +2671,16 @@ function recipientInviteOnboardingPreviewFromReviewedIntent(store, body, invitat
 	});
 }
 var SAFE_RECIPIENT_INVITE_ERRORS = new Set([
+	"device_display_name_invalid",
+	"device_display_name_required",
+	"device_display_name_too_long",
 	"invite_already_bound",
 	"invite_expired",
 	"invite_identity_conflict",
 	"invite_invalid",
+	"recipient_display_name_invalid",
+	"recipient_display_name_required",
+	"recipient_display_name_too_long",
 	"recipient_invite_intent_mismatch",
 	"recipient_invite_review_unavailable",
 	"reviewed_onboarding_stale"
@@ -2594,8 +2706,9 @@ async function peerSupportsSyncRequirements(store, deviceId, requirements) {
 		const url = `${buildBaseUrl(address)}/v1/status`;
 		const [status, payload] = await requestJson("GET", url, {
 			headers: {
-				...buildAuthHeaders({
+				...buildDirectPeerAuthHeaders({
 					deviceId: localDeviceId,
+					recipientId: deviceId,
 					dbPath: store.dbPath,
 					method: "GET",
 					url,
@@ -3014,13 +3127,13 @@ var TERMINAL_RECONCILIATION_ERRORS = new Set([
 	"operation_not_found",
 	...PROJECT_INVITE_OWNER_CONFLICT_ERRORS
 ]);
-function errorStatus(error) {
+function errorStatus$1(error) {
 	const value = error && typeof error === "object" ? error.status : null;
 	return typeof value === "number" && Number.isInteger(value) && value >= 400 && value <= 599 ? value : null;
 }
 function projectInviteOwnerErrorResponse(error, fallback) {
 	const message = error instanceof Error ? error.message : "";
-	const status = errorStatus(error);
+	const status = errorStatus$1(error);
 	if (message === "operation_not_found" && (status == null || status === 404)) return {
 		code: message,
 		status: 404
@@ -3042,7 +3155,7 @@ function projectInviteOwnerErrorResponse(error, fallback) {
 function isRetryableReconciliationError(error) {
 	const message = error instanceof Error ? error.message : String(error);
 	if (TERMINAL_RECONCILIATION_ERRORS.has(message)) return false;
-	const status = errorStatus(error);
+	const status = errorStatus$1(error);
 	return status == null || status === 408 || status === 429 || status >= 500;
 }
 function safeReconciliationErrorCode(error) {
@@ -3672,14 +3785,15 @@ function pathWithQuery(url) {
 	const parsed = new URL(url);
 	return parsed.search ? `${parsed.pathname}${parsed.search}` : parsed.pathname;
 }
-function unauthorizedPayload(reason, exposeReason = false) {
-	if (exposeReason && process.env.CODEMEM_SYNC_AUTH_DIAGNOSTICS === "1") return {
-		error: "unauthorized",
-		reason
-	};
+function unauthorizedPayload() {
 	return { error: "unauthorized" };
 }
 var SYNC_AUTH_STORE_BUSY_REASON = "sync_auth_store_busy";
+var DIRECT_PEER_SIGNATURE_VERSION_NUMBER = 3;
+function logDirectPeerAuthDiagnostic(...reasons) {
+	const reason = reasons.find((candidate) => candidate === "recipient_mismatch" || candidate === "signature_downgrade");
+	if (reason) console.warn(`[sync] peer auth failed: reason=${reason}`);
+}
 function isSqliteBusy(err) {
 	if (!err || typeof err !== "object") return false;
 	const code = "code" in err ? String(err.code ?? "") : "";
@@ -3716,6 +3830,76 @@ function syncAuthStoreBusyResponse(c) {
 	c.header("Retry-After", "1");
 	return c.json({ error: SYNC_AUTH_STORE_BUSY_REASON }, 503);
 }
+function verifyDirectPeerRequestSignature(request, body, options) {
+	const timestamp = request.header("X-Opencode-Timestamp") ?? "";
+	const nonce = request.header("X-Opencode-Nonce") ?? "";
+	const legacySignature = request.header("X-Opencode-Signature") ?? "";
+	const recipientHeader = request.header("X-Codemem-Recipient");
+	const directSignatureHeader = request.header("X-Codemem-Signature");
+	const hasDirectMaterial = recipientHeader !== void 0 || directSignatureHeader !== void 0;
+	const direct = verifyDirectPeerSignature({
+		method: request.method,
+		pathWithQuery: pathWithQuery(request.url),
+		bodyBytes: body,
+		timestamp,
+		nonce,
+		recipientId: recipientHeader,
+		expectedRecipientId: options.expectedRecipientId,
+		signature: directSignatureHeader,
+		publicKey: options.publicKey
+	});
+	if (hasDirectMaterial && direct.status === "absent") return {
+		ok: false,
+		reason: "invalid_direct_signature"
+	};
+	if (direct.status === "invalid") return {
+		ok: false,
+		reason: direct.reason === "recipient_mismatch" ? direct.reason : "invalid_direct_signature"
+	};
+	if (!verifySignature({
+		method: request.method,
+		pathWithQuery: pathWithQuery(request.url),
+		bodyBytes: body,
+		timestamp,
+		nonce,
+		signature: legacySignature,
+		publicKey: options.publicKey,
+		deviceId: options.deviceId
+	})) return {
+		ok: false,
+		reason: "invalid_signature"
+	};
+	if (direct.status === "absent" && (options.highestObservedVersion ?? 0) >= DIRECT_PEER_SIGNATURE_VERSION_NUMBER) return {
+		ok: false,
+		reason: "signature_downgrade"
+	};
+	return {
+		ok: true,
+		version: direct.status === "valid" ? 3 : 2
+	};
+}
+function recordDirectPeerSignatureVersion(store, deviceId, version) {
+	try {
+		if (!recordHighestObservedDirectSignatureVersion(store.db, deviceId, version)) {
+			if (store.db.prepare(`SELECT sync_peer_signature_state.highest_observed_direct_signature_version
+					 FROM sync_peers
+					 LEFT JOIN sync_peer_signature_state USING (peer_device_id)
+					 WHERE sync_peers.peer_device_id = ? LIMIT 1`).pluck().get(deviceId) === void 0) return {
+				ok: false,
+				reason: "unknown_peer",
+				deviceId
+			};
+		}
+		return null;
+	} catch (err) {
+		if (isSqliteBusy(err)) return {
+			ok: false,
+			reason: SYNC_AUTH_STORE_BUSY_REASON,
+			deviceId
+		};
+		throw err;
+	}
+}
 function authorizeSyncRequest(store, request, body) {
 	const deviceId = (request.header("X-Opencode-Device") ?? "").trim();
 	const signature = request.header("X-Opencode-Signature") ?? "";
@@ -3726,7 +3910,11 @@ function authorizeSyncRequest(store, request, body) {
 		reason: "missing_headers",
 		deviceId
 	};
-	const peerRow = store.db.prepare("SELECT pinned_fingerprint, public_key FROM sync_peers WHERE peer_device_id = ? LIMIT 1").get(deviceId);
+	const peerRow = store.db.prepare(`SELECT sync_peers.pinned_fingerprint, sync_peers.public_key,
+			 sync_peer_signature_state.highest_observed_direct_signature_version
+			 FROM sync_peers
+			 LEFT JOIN sync_peer_signature_state USING (peer_device_id)
+			 WHERE sync_peers.peer_device_id = ? LIMIT 1`).get(deviceId);
 	if (!peerRow) return {
 		ok: false,
 		reason: "unknown_peer",
@@ -3744,17 +3932,14 @@ function authorizeSyncRequest(store, request, body) {
 		reason: "fingerprint_mismatch",
 		deviceId
 	};
-	let valid = false;
+	let verification;
 	try {
-		valid = verifySignature({
-			method: request.method,
-			pathWithQuery: pathWithQuery(request.url),
-			bodyBytes: body,
-			timestamp,
-			nonce,
-			signature,
+		const [localDeviceId] = ensureDeviceIdentity(store.db, { keysDir: syncKeysDir() });
+		verification = verifyDirectPeerRequestSignature(request, body, {
+			deviceId,
 			publicKey,
-			deviceId
+			expectedRecipientId: localDeviceId,
+			highestObservedVersion: peerRow.highest_observed_direct_signature_version
 		});
 	} catch {
 		return {
@@ -3763,13 +3948,17 @@ function authorizeSyncRequest(store, request, body) {
 			deviceId
 		};
 	}
-	if (!valid) return {
+	if (!verification.ok) return {
 		ok: false,
-		reason: "invalid_signature",
+		reason: verification.reason,
 		deviceId
 	};
 	const nonceResult = recordSyncAuthNonce(store, deviceId, nonce, (/* @__PURE__ */ new Date()).toISOString());
 	if (nonceResult) return nonceResult;
+	if (verification.version === DIRECT_PEER_SIGNATURE_VERSION_NUMBER) {
+		const versionResult = recordDirectPeerSignatureVersion(store, deviceId, verification.version);
+		if (versionResult) return versionResult;
+	}
 	return {
 		ok: true,
 		reason: "ok",
@@ -3888,17 +4077,15 @@ async function authorizeBootstrapGrantRequest(store, request, body) {
 		reason: "bootstrap_grant_expired",
 		deviceId
 	};
-	let valid = false;
+	const existingPeer = store.db.prepare(`SELECT highest_observed_direct_signature_version
+			 FROM sync_peer_signature_state WHERE peer_device_id = ? LIMIT 1`).get(deviceId);
+	let signatureVerification;
 	try {
-		valid = verifySignature({
-			method: request.method,
-			pathWithQuery: pathWithQuery(request.url),
-			bodyBytes: body,
-			timestamp,
-			nonce,
-			signature,
+		signatureVerification = verifyDirectPeerRequestSignature(request, body, {
+			deviceId,
 			publicKey: workerPublicKey,
-			deviceId
+			expectedRecipientId: localDeviceId,
+			highestObservedVersion: existingPeer?.highest_observed_direct_signature_version ?? null
 		});
 	} catch {
 		return {
@@ -3907,9 +4094,9 @@ async function authorizeBootstrapGrantRequest(store, request, body) {
 			deviceId
 		};
 	}
-	if (!valid) return {
+	if (!signatureVerification.ok) return {
 		ok: false,
-		reason: "bootstrap_grant_invalid_signature",
+		reason: signatureVerification.reason,
 		deviceId
 	};
 	if (!isPeerTrustBindingCompatible(store.db, deviceId, workerPublicKey, workerFingerprint)) return {
@@ -3925,6 +4112,10 @@ async function authorizeBootstrapGrantRequest(store, request, body) {
 		publicKey: workerPublicKey,
 		replaceTrust: true
 	});
+	if (signatureVerification.version === DIRECT_PEER_SIGNATURE_VERSION_NUMBER) {
+		const versionResult = recordDirectPeerSignatureVersion(store, deviceId, signatureVerification.version);
+		if (versionResult) return versionResult;
+	}
 	return {
 		ok: true,
 		reason: "ok",
@@ -4221,7 +4412,8 @@ async function acceptDiscoveredPeer(store, input) {
 	const addressesJson = JSON.stringify(mergeAddresses(nextAddresses, existingAddresses));
 	await createCoordinatorReciprocalApproval(store, config, {
 		groupId,
-		requestedDeviceId: input.peerDeviceId
+		requestedDeviceId: input.peerDeviceId,
+		...input.expectedIncomingRequestId ? { expectedIncomingRequestId: input.expectedIncomingRequestId } : {}
 	});
 	const coordinatorUrl = config.syncCoordinatorUrl || null;
 	let scopeInclude;
@@ -4832,8 +5024,8 @@ function syncProtocolRoutes(getStore, opts = {}) {
 			if (!auth.ok) {
 				const grantPresent = Boolean((c.req.header("X-Codemem-Bootstrap-Grant") ?? "").trim());
 				if (bootstrapAttempted && (grantPresent || deviceAuthReason != null && deviceAuthReason !== "missing_headers")) console.warn(`[sync] peer auth failed: reason=${auth.reason} device_auth_reason=${deviceAuthReason ?? "none"} grant_present=${grantPresent} path=${c.req.path} device=${loggableHeaderValue(c.req.header("X-Opencode-Device"))}`);
-				const wireReason = bootstrapAttempted && grantPresent ? "bootstrap_grant_invalid" : deviceAuthReason ?? auth.reason;
-				return (preauthChecked ? null : rateLimitedResponse(c, c.req.path, false)) ?? c.json(unauthorizedPayload(wireReason, true), 401);
+				else logDirectPeerAuthDiagnostic(deviceAuthReason, auth.reason);
+				return (preauthChecked ? null : rateLimitedResponse(c, c.req.path, false)) ?? c.json(unauthorizedPayload(), 401);
 			}
 			const limited = rateLimitedResponse(c, auth.deviceId, true);
 			if (limited) return limited;
@@ -4868,7 +5060,10 @@ function syncProtocolRoutes(getStore, opts = {}) {
 		const store = getStore();
 		const auth = authorizeSyncRequest(store, c.req, Buffer.alloc(0));
 		if (isSyncAuthStoreBusy(auth)) return syncAuthStoreBusyResponse(c);
-		if (!auth.ok) return rateLimitedResponse(c, c.req.path, false) ?? c.json(unauthorizedPayload(auth.reason, true), 401);
+		if (!auth.ok) {
+			logDirectPeerAuthDiagnostic(auth.reason);
+			return rateLimitedResponse(c, c.req.path, false) ?? c.json(unauthorizedPayload(), 401);
+		}
 		const limited = rateLimitedResponse(c, auth.deviceId, true);
 		if (limited) return limited;
 		const peerDeviceId = auth.deviceId;
@@ -4949,8 +5144,8 @@ function syncProtocolRoutes(getStore, opts = {}) {
 			if (!auth.ok) {
 				const grantPresent = Boolean((c.req.header("X-Codemem-Bootstrap-Grant") ?? "").trim());
 				if (bootstrapAttempted && (grantPresent || deviceAuthReason != null && deviceAuthReason !== "missing_headers")) console.warn(`[sync] peer auth failed: reason=${auth.reason} device_auth_reason=${deviceAuthReason ?? "none"} grant_present=${grantPresent} path=${c.req.path} device=${loggableHeaderValue(c.req.header("X-Opencode-Device"))}`);
-				const wireReason = bootstrapAttempted && grantPresent ? "bootstrap_grant_invalid" : deviceAuthReason ?? auth.reason;
-				return (preauthChecked ? null : rateLimitedResponse(c, c.req.path, false)) ?? c.json(unauthorizedPayload(wireReason, true), 401);
+				else logDirectPeerAuthDiagnostic(deviceAuthReason, auth.reason);
+				return (preauthChecked ? null : rateLimitedResponse(c, c.req.path, false)) ?? c.json(unauthorizedPayload(), 401);
 			}
 			const limited = rateLimitedResponse(c, auth.deviceId, true);
 			if (limited) return limited;
@@ -5007,7 +5202,10 @@ function syncProtocolRoutes(getStore, opts = {}) {
 		if (raw == null) return c.json({ error: "payload_too_large" }, 413);
 		const auth = authorizeSyncRequest(store, c.req, raw);
 		if (isSyncAuthStoreBusy(auth)) return syncAuthStoreBusyResponse(c);
-		if (!auth.ok) return rateLimitedResponse(c, c.req.path, false) ?? c.json(unauthorizedPayload(auth.reason, true), 401);
+		if (!auth.ok) {
+			logDirectPeerAuthDiagnostic(auth.reason);
+			return rateLimitedResponse(c, c.req.path, false) ?? c.json(unauthorizedPayload(), 401);
+		}
 		const limited = rateLimitedResponse(c, auth.deviceId, true);
 		if (limited) return limited;
 		const peerDeviceId = auth.deviceId;
@@ -5071,6 +5269,52 @@ function syncProtocolRoutes(getStore, opts = {}) {
 	});
 	return app;
 }
+async function loadConfiguredDeviceIdentityCoordinatorEvidence() {
+	const config = readCoordinatorSyncConfig();
+	const hasCoordinatorConfiguration = config.syncCoordinatorUrl.length > 0 || config.syncCoordinatorGroups.length > 0;
+	const remoteUrl = config.syncCoordinatorUrl.trim();
+	const adminSecret = config.syncCoordinatorAdminSecret.trim();
+	const groupIds = [...new Set(config.syncCoordinatorGroups.map((groupId) => groupId.trim()))].filter(Boolean);
+	if (!hasCoordinatorConfiguration) return {
+		availability: "unavailable",
+		safeErrorCode: "coordinator_not_configured",
+		enrollments: []
+	};
+	if (!remoteUrl || !adminSecret || groupIds.length === 0) return {
+		availability: "unavailable",
+		safeErrorCode: "coordinator_unavailable",
+		enrollments: []
+	};
+	if (groupIds.length > 25) return {
+		availability: "unavailable",
+		safeErrorCode: "coordinator_evidence_too_large",
+		enrollments: []
+	};
+	try {
+		const enrollments = (await Promise.all(groupIds.map((groupId) => coordinatorListDevicesAction({
+			groupId,
+			includeDisabled: true,
+			remoteUrl,
+			adminSecret
+		})))).flat();
+		if (enrollments.length > 500) return {
+			availability: "unavailable",
+			safeErrorCode: "coordinator_evidence_too_large",
+			enrollments: []
+		};
+		return {
+			availability: "available",
+			safeErrorCode: null,
+			enrollments
+		};
+	} catch {
+		return {
+			availability: "unavailable",
+			safeErrorCode: "coordinator_unavailable",
+			enrollments: []
+		};
+	}
+}
 /**
 * Viewer-facing sync management routes (/api/sync/*).
 *
@@ -5078,8 +5322,112 @@ function syncProtocolRoutes(getStore, opts = {}) {
 * provide sync status, peer management, and coordinator UI for the
 * local viewer.
 */
-function syncRoutes(getStore, getSyncRuntimeStatus) {
+function syncRoutes(getStore, getSyncRuntimeStatus, options = {}) {
 	const app = new Hono();
+	const loadCoordinatorEvidence = options.loadDeviceIdentityCoordinatorEvidence ?? loadConfiguredDeviceIdentityCoordinatorEvidence;
+	const currentCoordinatorEvidence = async () => {
+		try {
+			return await loadCoordinatorEvidence();
+		} catch {
+			return {
+				availability: "unavailable",
+				safeErrorCode: "coordinator_unavailable",
+				enrollments: []
+			};
+		}
+	};
+	const localInventoryInput = async (store) => {
+		let explicitDeviceName = "";
+		try {
+			explicitDeviceName = String(readCodememConfigFile().sync_device_name ?? "");
+		} catch {
+			explicitDeviceName = "";
+		}
+		return {
+			localDeviceId: store.deviceId,
+			localDisplayName: friendlyDeviceName({
+				explicitName: explicitDeviceName,
+				osName: hostname(),
+				fallbackSeed: store.deviceId
+			}),
+			coordinator: await currentCoordinatorEvidence()
+		};
+	};
+	app.get("/api/sync/recipient-policy/v1/device-inventory", async (c) => {
+		const store = getStore();
+		ensureStableStoreIdentity(store);
+		return c.json(listDeviceIdentityInventory(store.db, await localInventoryInput(store)));
+	});
+	const parseDeviceBindingRequest = (value, commit) => {
+		if (!value || typeof value !== "object" || Array.isArray(value)) return null;
+		const body = value;
+		const allowed = new Set(commit ? ["bindings", "reviewedInventoryDigest"] : ["bindings"]);
+		if (Object.keys(body).some((key) => !allowed.has(key)) || !Array.isArray(body.bindings)) return null;
+		const bindings = body.bindings.map((value) => {
+			if (!value || typeof value !== "object" || Array.isArray(value)) return null;
+			const binding = value;
+			const bindingKeys = new Set([
+				"deviceId",
+				"targetIdentityId",
+				"confirmed",
+				"allowRebind"
+			]);
+			if (Object.keys(binding).some((key) => !bindingKeys.has(key)) || typeof binding.deviceId !== "string" || typeof binding.targetIdentityId !== "string" || typeof binding.confirmed !== "boolean" || Object.hasOwn(binding, "allowRebind") && typeof binding.allowRebind !== "boolean") return null;
+			return {
+				deviceId: binding.deviceId,
+				targetIdentityId: binding.targetIdentityId,
+				confirmed: binding.confirmed,
+				...typeof binding.allowRebind === "boolean" ? { allowRebind: binding.allowRebind } : {}
+			};
+		});
+		if (bindings.some((binding) => binding == null)) return null;
+		if (commit && typeof body.reviewedInventoryDigest !== "string") return null;
+		return {
+			bindings,
+			...commit ? { reviewedInventoryDigest: body.reviewedInventoryDigest } : {}
+		};
+	};
+	app.post("/api/sync/recipient-policy/v1/device-bindings/preview", async (c) => {
+		const body = parseDeviceBindingRequest(await parseViewerJsonBody(c), false);
+		if (!body) return c.json({ error: "binding_request_invalid" }, 400);
+		const store = getStore();
+		try {
+			ensureStableStoreIdentity(store);
+			const result = previewDeviceIdentityBindings(store.db, await localInventoryInput(store), body);
+			if (result.status === "invalid") return c.json(result, 400);
+			if (result.status === "not_found") return c.json(result, 404);
+			if (result.status === "conflict") return c.json(result, 409);
+			return c.json(result);
+		} catch (error) {
+			if (isSqliteBusy(error)) {
+				c.header("Retry-After", "1");
+				return c.json({ error: "binding_preview_busy" }, 503);
+			}
+			return c.json({ error: "binding_preview_failed" }, 500);
+		}
+	});
+	app.post("/api/sync/recipient-policy/v1/device-bindings/commit", async (c) => {
+		const body = parseDeviceBindingRequest(await parseViewerJsonBody(c), true);
+		if (!body || !("reviewedInventoryDigest" in body)) return c.json({ error: "binding_request_invalid" }, 400);
+		const store = getStore();
+		try {
+			ensureStableStoreIdentity(store);
+			const result = commitDeviceIdentityBindings(store.db, {
+				localActorId: store.actorId,
+				localDeviceId: store.deviceId
+			}, await localInventoryInput(store), body);
+			if (result.status === "invalid") return c.json(result, 400);
+			if (result.status === "not_found") return c.json(result, 404);
+			if (result.status === "stale" || result.status === "conflict") return c.json(result, 409);
+			return c.json(result);
+		} catch (error) {
+			if (isSqliteBusy(error)) {
+				c.header("Retry-After", "1");
+				return c.json({ error: "binding_commit_busy" }, 503);
+			}
+			return c.json({ error: "binding_commit_failed" }, 500);
+		}
+	});
 	app.get("/api/sync/status", async (c) => {
 		const store = getStore();
 		{
@@ -5392,9 +5740,15 @@ function syncRoutes(getStore, getSyncRuntimeStatus) {
 				return c.json({ error: "invalid json" }, 400);
 			}
 			const peerDeviceId = String(body.peer_device_id ?? "").trim();
-			const name = String(body.name ?? "").trim();
+			const rawName = String(body.name ?? "");
 			if (!peerDeviceId) return c.json({ error: "peer_device_id required" }, 400);
-			if (!name) return c.json({ error: "name required" }, 400);
+			if (!rawName.trim()) return c.json({ error: "name required" }, 400);
+			let name;
+			try {
+				name = normalizeHumanPresentationName(rawName, "name");
+			} catch (error) {
+				return c.json({ error: error instanceof Error ? error.message : "name_invalid" }, 400);
+			}
 			if (!d.select({ peer_device_id: schema.syncPeers.peer_device_id }).from(schema.syncPeers).where(eq(schema.syncPeers.peer_device_id, peerDeviceId)).get()) return c.json({ error: "peer not found" }, 404);
 			d.update(schema.syncPeers).set({ name }).where(eq(schema.syncPeers.peer_device_id, peerDeviceId)).run();
 			return c.json({ ok: true });
@@ -5623,10 +5977,18 @@ function syncRoutes(getStore, getSyncRuntimeStatus) {
 		if (!value || typeof value !== "object" || Array.isArray(value)) return c.json({ error: "request_invalid" }, 400);
 		const body = value;
 		if (Object.keys(body).some((key) => key !== "dryRun") || Object.hasOwn(body, "dryRun") && typeof body.dryRun !== "boolean") return c.json({ error: "request_invalid" }, 400);
-		return c.json(migrateRecipientPolicyIntent(store.db, {
-			localActorId: store.actorId,
-			localDeviceId: store.deviceId
-		}, { dryRun: body.dryRun === true }));
+		try {
+			return c.json(migrateRecipientPolicyIntent(store.db, {
+				localActorId: store.actorId,
+				localDeviceId: store.deviceId
+			}, { dryRun: body.dryRun === true }));
+		} catch (error) {
+			if (isSqliteBusy(error)) {
+				c.header("Retry-After", "1");
+				return c.json({ error: "migration_busy" }, 503);
+			}
+			return c.json({ error: "migration_failed" }, 500);
+		}
 	});
 	const parseReviewRequest = (value) => {
 		if (!value || typeof value !== "object" || Array.isArray(value)) return null;
@@ -5802,7 +6164,7 @@ function syncRoutes(getStore, getSyncRuntimeStatus) {
 				operationId: plan.operationId,
 				reviewedProjectSetDigest: plan.reviewedProjectSetDigest,
 				inviterActorId: plan.inviterActorId,
-				inviterDisplayName: store.actorDisplayName,
+				inviterDisplayName: projectInviteInviterDisplayName(store.actorDisplayName),
 				inviterDeviceId: plan.inviterDeviceIds[0],
 				pendingPersonId: plan.personId,
 				projectSummaries: plan.projects.map((project) => ({
@@ -6110,8 +6472,14 @@ function syncRoutes(getStore, getSyncRuntimeStatus) {
 		} catch {
 			return c.json({ error: "invalid json" }, 400);
 		}
-		const displayName = String(body.display_name ?? "").trim();
-		if (!displayName) return c.json({ error: "display_name required" }, 400);
+		const rawDisplayName = String(body.display_name ?? "");
+		if (!rawDisplayName.trim()) return c.json({ error: "display_name required" }, 400);
+		let displayName;
+		try {
+			displayName = normalizeHumanPresentationName(rawDisplayName, "display_name");
+		} catch (error) {
+			return c.json({ error: error instanceof Error ? error.message : "display_name_invalid" }, 400);
+		}
 		const d = drizzle(store.db, { schema });
 		const now = (/* @__PURE__ */ new Date()).toISOString();
 		const actor = {
@@ -6136,9 +6504,13 @@ function syncRoutes(getStore, getSyncRuntimeStatus) {
 			return c.json({ error: "invalid json" }, 400);
 		}
 		const actorId = String(body.actor_id ?? "").trim();
-		const displayName = String(body.display_name ?? "").trim();
 		if (!actorId) return c.json({ error: "actor_id required" }, 400);
-		if (!displayName) return c.json({ error: "display_name required" }, 400);
+		let displayName;
+		try {
+			displayName = normalizeHumanPresentationName(String(body.display_name ?? ""), "display_name");
+		} catch (error) {
+			return c.json({ error: error instanceof Error ? error.message : "display_name_invalid" }, 400);
+		}
 		const d = drizzle(store.db, { schema });
 		const actor = d.select().from(schema.actors).where(eq(schema.actors.actor_id, actorId)).get();
 		if (!actor) return c.json({ error: "actor not found" }, 404);
@@ -6168,14 +6540,133 @@ function syncRoutes(getStore, getSyncRuntimeStatus) {
 		if (!secondaryActorId) return c.json({ error: "secondary_actor_id required" }, 400);
 		if (primaryActorId === secondaryActorId) return c.json({ error: "actor ids must differ" }, 400);
 		const d = drizzle(store.db, { schema });
-		const primary = d.select().from(schema.actors).where(eq(schema.actors.actor_id, primaryActorId)).get();
-		const secondary = d.select().from(schema.actors).where(eq(schema.actors.actor_id, secondaryActorId)).get();
-		if (!primary || !secondary) return c.json({ error: "actor not found" }, 404);
-		if (primary.status !== "active") return c.json({ error: "primary actor not active" }, 409);
-		if (secondary.status !== "active") return c.json({ error: "secondary actor not active" }, 409);
-		if (secondary.is_local && secondary.actor_id === store.actorId) return c.json({ error: "cannot merge this device's own local actor" }, 409);
 		const now = (/* @__PURE__ */ new Date()).toISOString();
-		const mergedCount = store.db.transaction(() => {
+		const result = store.db.transaction(() => {
+			const primary = d.select().from(schema.actors).where(eq(schema.actors.actor_id, primaryActorId)).get();
+			const secondary = d.select().from(schema.actors).where(eq(schema.actors.actor_id, secondaryActorId)).get();
+			if (!primary || !secondary) return {
+				error: "actor not found",
+				status: 404
+			};
+			if (primary.status !== "active") return {
+				error: "primary actor not active",
+				status: 409
+			};
+			if (secondary.status !== "active") return {
+				error: "secondary actor not active",
+				status: 409
+			};
+			if (secondary.is_local && secondary.actor_id === store.actorId) return {
+				error: "cannot merge this device's own local actor",
+				status: 409
+			};
+			const memberships = d.select().from(schema.policyTeamMemberships).where(eq(schema.policyTeamMemberships.identity_id, secondaryActorId)).all();
+			const primaryMemberships = /* @__PURE__ */ new Map();
+			for (const membership of memberships) {
+				const primaryMembership = d.select().from(schema.policyTeamMemberships).where(and(eq(schema.policyTeamMemberships.team_id, membership.team_id), eq(schema.policyTeamMemberships.identity_id, primaryActorId))).get();
+				if (primaryMembership && (primaryMembership.role !== membership.role || primaryMembership.status !== membership.status)) return {
+					error: "actor team memberships conflict",
+					status: 409
+				};
+				primaryMemberships.set(membership.team_id, primaryMembership);
+			}
+			const directRecipients = d.select().from(schema.projectRecipients).where(and(eq(schema.projectRecipients.recipient_kind, "identity"), eq(schema.projectRecipients.recipient_id, secondaryActorId))).all();
+			const primaryRecipients = /* @__PURE__ */ new Map();
+			for (const recipient of directRecipients) {
+				const primaryRecipient = d.select().from(schema.projectRecipients).where(and(eq(schema.projectRecipients.canonical_project_identity, recipient.canonical_project_identity), eq(schema.projectRecipients.recipient_kind, "identity"), eq(schema.projectRecipients.recipient_id, primaryActorId))).get();
+				if (primaryRecipient && primaryRecipient.status !== recipient.status) return {
+					error: "actor project recipients conflict",
+					status: 409
+				};
+				primaryRecipients.set(recipient.canonical_project_identity, primaryRecipient);
+			}
+			const mergeDigest = createHash("sha256").update(JSON.stringify({
+				kind: "identity-merge-v1",
+				primaryActorId,
+				secondaryActorId,
+				nonce: randomUUID()
+			})).digest("hex");
+			const bindings = d.select({
+				deviceId: schema.identityDevices.device_id,
+				assignmentVersion: schema.identityDevices.assignment_version
+			}).from(schema.identityDevices).where(eq(schema.identityDevices.identity_id, secondaryActorId)).all();
+			if (bindings.length > 0) {
+				const commitDigest = mergeDigest;
+				const outcomes = bindings.map((binding) => ({
+					deviceId: binding.deviceId,
+					previousIdentityId: secondaryActorId,
+					targetIdentityId: primaryActorId,
+					action: "rebind"
+				}));
+				store.db.prepare(`INSERT INTO device_identity_binding_commits(
+						commit_digest, reviewed_inventory_digest, request_json, outcomes_json, write_count,
+						decided_by_identity_id, decided_by_device_id, created_at
+					) VALUES (?, ?, ?, ?, ?, ?, ?, ?)`).run(commitDigest, `identity-merge:${secondaryActorId}:${primaryActorId}`, JSON.stringify({
+					primaryActorId,
+					secondaryActorId
+				}), JSON.stringify(outcomes), bindings.length, store.actorId, store.deviceId, now);
+				for (const binding of bindings) {
+					const revision = createHash("sha256").update(`identity-merge-revision-v1\0${commitDigest}\0${binding.deviceId}`).digest("hex");
+					const idempotencyKey = createHash("sha256").update(`identity-merge-row-v1\0${commitDigest}\0${binding.deviceId}`).digest("hex");
+					if (store.db.prepare(`UPDATE identity_devices SET
+							identity_id = ?, provenance = 'review_resolution', revision = ?,
+							migration_state = 'user_managed', source_fingerprint = ?,
+							idempotency_key = ?, updated_at = ?
+						 WHERE device_id = ? AND identity_id = ?`).run(primaryActorId, revision, commitDigest, idempotencyKey, now, binding.deviceId, secondaryActorId).changes !== 1) throw new Error("identity_merge_binding_update_failed");
+					const rebound = store.db.prepare("SELECT assignment_version FROM identity_devices WHERE device_id = ?").get(binding.deviceId);
+					if (!rebound || rebound.assignment_version !== binding.assignmentVersion + 1) throw new Error("identity_merge_assignment_version_unexpected");
+					store.db.prepare("DELETE FROM policy_team_device_decisions WHERE device_id = ?").run(binding.deviceId);
+					store.db.prepare(`INSERT INTO device_identity_binding_audit(
+							event_id, commit_digest, device_id, previous_identity_id, target_identity_id,
+							action, previous_assignment_version, resulting_assignment_version,
+							decided_by_identity_id, decided_by_device_id, created_at
+						) VALUES (?, ?, ?, ?, ?, 'rebind', ?, ?, ?, ?, ?)`).run(createHash("sha256").update(`identity-merge-event-v1\0${commitDigest}\0${binding.deviceId}`).digest("hex"), commitDigest, binding.deviceId, secondaryActorId, primaryActorId, binding.assignmentVersion, rebound.assignment_version, store.actorId, store.deviceId, now);
+				}
+			}
+			for (const membership of memberships) {
+				if (primaryMemberships.get(membership.team_id)) {
+					d.delete(schema.policyTeamMemberships).where(and(eq(schema.policyTeamMemberships.team_id, membership.team_id), eq(schema.policyTeamMemberships.identity_id, secondaryActorId))).run();
+					continue;
+				}
+				const revision = createHash("sha256").update(`identity-merge-membership-revision-v1\0${mergeDigest}\0${membership.team_id}`).digest("hex");
+				const idempotencyKey = createHash("sha256").update(`identity-merge-membership-row-v1\0${mergeDigest}\0${membership.team_id}`).digest("hex");
+				d.update(schema.policyTeamMemberships).set({
+					identity_id: primaryActorId,
+					provenance: "review_resolution",
+					revision,
+					migration_state: "user_managed",
+					source_fingerprint: mergeDigest,
+					idempotency_key: idempotencyKey,
+					updated_at: now
+				}).where(and(eq(schema.policyTeamMemberships.team_id, membership.team_id), eq(schema.policyTeamMemberships.identity_id, secondaryActorId))).run();
+			}
+			for (const recipient of directRecipients) {
+				if (primaryRecipients.get(recipient.canonical_project_identity)) {
+					d.delete(schema.projectRecipients).where(and(eq(schema.projectRecipients.canonical_project_identity, recipient.canonical_project_identity), eq(schema.projectRecipients.recipient_kind, "identity"), eq(schema.projectRecipients.recipient_id, secondaryActorId))).run();
+					continue;
+				}
+				const policyRevision = createHash("sha256").update(`identity-merge-recipient-revision-v1\0${mergeDigest}\0${recipient.canonical_project_identity}`).digest("hex");
+				const idempotencyKey = createHash("sha256").update(`identity-merge-recipient-row-v1\0${mergeDigest}\0${recipient.canonical_project_identity}`).digest("hex");
+				d.update(schema.projectRecipients).set({
+					recipient_id: primaryActorId,
+					provenance: "review_resolution",
+					policy_revision: policyRevision,
+					migration_state: "user_managed",
+					source_fingerprint: mergeDigest,
+					idempotency_key: idempotencyKey,
+					updated_at: now
+				}).where(and(eq(schema.projectRecipients.canonical_project_identity, recipient.canonical_project_identity), eq(schema.projectRecipients.recipient_kind, "identity"), eq(schema.projectRecipients.recipient_id, secondaryActorId))).run();
+			}
+			d.update(schema.recipientManagedProjectProjections).set({
+				recipient_identity_id: primaryActorId,
+				updated_at: now
+			}).where(eq(schema.recipientManagedProjectProjections.recipient_identity_id, secondaryActorId)).run();
+			store.db.prepare(`UPDATE share_operations SET
+						inviter_actor_id = CASE WHEN inviter_actor_id = ? THEN ? ELSE inviter_actor_id END,
+						recipient_actor_id = CASE WHEN recipient_actor_id = ? THEN ? ELSE recipient_actor_id END,
+						person_id = CASE WHEN person_id = ? THEN ? ELSE person_id END,
+						updated_at = ?
+					 WHERE inviter_actor_id = ? OR recipient_actor_id = ? OR person_id = ?`).run(secondaryActorId, primaryActorId, secondaryActorId, primaryActorId, secondaryActorId, primaryActorId, now, secondaryActorId, secondaryActorId, secondaryActorId);
 			const peerUpdate = d.update(schema.syncPeers).set({ actor_id: primaryActorId }).where(eq(schema.syncPeers.actor_id, secondaryActorId)).run();
 			if (primary.is_local) d.update(schema.syncPeers).set({ claimed_local_actor: 1 }).where(eq(schema.syncPeers.actor_id, primaryActorId)).run();
 			d.update(schema.actors).set({
@@ -6183,9 +6674,10 @@ function syncRoutes(getStore, getSyncRuntimeStatus) {
 				merged_into_actor_id: primaryActorId,
 				updated_at: now
 			}).where(eq(schema.actors.actor_id, secondaryActorId)).run();
-			return Number(peerUpdate.changes ?? 0);
-		})();
-		return c.json({ merged_count: mergedCount });
+			return { mergedCount: Number(peerUpdate.changes ?? 0) };
+		}).immediate();
+		if ("error" in result) return c.json({ error: result.error }, result.status);
+		return c.json({ merged_count: result.mergedCount });
 	});
 	app.post("/api/sync/actors/deactivate", async (c) => {
 		const store = getStore();
@@ -6238,11 +6730,18 @@ function syncRoutes(getStore, getSyncRuntimeStatus) {
 		}
 		const peerDeviceId = String(body.peer_device_id ?? "").trim();
 		const fingerprint = String(body.fingerprint ?? "").trim();
+		const expectedGroupId = String(body.expected_group_id ?? "").trim();
+		const hasExpectedIncomingRequestId = Object.hasOwn(body, "expected_incoming_request_id");
+		const expectedIncomingRequestId = String(body.expected_incoming_request_id ?? "").trim();
 		if (!peerDeviceId) return c.json({ error: "peer_device_id required" }, 400);
+		if (hasExpectedIncomingRequestId && !expectedIncomingRequestId) return c.json({ error: "expected_incoming_request_id must not be empty" }, 400);
+		if (expectedIncomingRequestId && !expectedGroupId) return c.json({ error: "expected_group_id required" }, 400);
 		try {
 			const result = await acceptDiscoveredPeer(store, {
 				peerDeviceId,
-				fingerprint: fingerprint || void 0
+				fingerprint: fingerprint || void 0,
+				expectedGroupId: expectedGroupId || void 0,
+				expectedIncomingRequestId: expectedIncomingRequestId || void 0
 			});
 			if (!result.ok) return c.json({
 				error: result.error,
@@ -6258,6 +6757,10 @@ function syncRoutes(getStore, getSyncRuntimeStatus) {
 				needs_scope_review: true
 			});
 		} catch (error) {
+			if (error instanceof CoordinatorReciprocalApprovalRequestChangedError) return c.json({
+				error: error.code,
+				detail: "This approval request changed before it was submitted. Refresh sync status and review the current request."
+			}, { status: 409 });
 			return c.json({
 				error: "coordinator_lookup_failed",
 				detail: error instanceof Error ? error.message : String(error)
@@ -6408,7 +6911,7 @@ function syncRoutes(getStore, getSyncRuntimeStatus) {
 				inviteValue: rawValue,
 				dbPath: store.dbPath,
 				recipientActorId: recipientInvite ? null : store.actorId,
-				recipientDisplayName: typeof body.recipient_name === "string" ? body.recipient_name : store.actorDisplayName,
+				recipientDisplayName: decoded.kind === "add_device" ? null : typeof body.recipient_name === "string" ? body.recipient_name : store.actorDisplayName,
 				deviceDisplayName: typeof body.device_name === "string" ? body.device_name : null,
 				reviewedOnboardingDigest: reviewedOnboardingDigest || null
 			});
@@ -7255,15 +7758,19 @@ function syncRoutes(getStore, getSyncRuntimeStatus) {
 			}, 400);
 		}
 		const groupId = resolveCoordinatorAdminGroup(String(body.group_id ?? "").trim(), status);
-		const displayName = String(body.display_name ?? "").trim();
 		if (!groupId) return c.json({
 			error: "group_id required",
 			status
 		}, 400);
-		if (!displayName) return c.json({
-			error: "display_name required",
-			status
-		}, 400);
+		let displayName;
+		try {
+			displayName = normalizeHumanPresentationName(String(body.display_name ?? ""), "display_name");
+		} catch (error) {
+			return c.json({
+				error: error instanceof Error ? error.message : "display_name_invalid",
+				status
+			}, 400);
+		}
 		try {
 			const device = await coordinatorRenameDeviceAction({
 				groupId,
@@ -7682,6 +8189,850 @@ function syncRoutes(getStore, getSyncRuntimeStatus) {
 	return app;
 }
 //#endregion
+//#region src/routes/team-setup.ts
+var TEAM_SETUP_VERSION = 1;
+var MAX_CONFIGURED_GROUPS = 25;
+var MAX_DEVICES = 500;
+var MAX_PROJECTS = 500;
+var MAX_ACCESS_DELTA_ENTRIES = 1e4;
+var MAX_IDENTITY_CHOICES = 500;
+var MAX_COMPLETED_IDENTITY_CHOICES = MAX_DEVICES * 4;
+var MAX_PROJECT_MAPPING_CHOICES = 500;
+var MAX_TOTAL_PROJECT_MAPPING_CHOICES = 1e4;
+var MAX_PROJECT_MAPPING_SCAN_ROWS = 1e4;
+var MAX_PROJECT_MAPPING_METADATA_ROWS = 1e4;
+var MAX_MUTATION_BODY_BYTES = 8192;
+var SUMMARY_SNAPSHOT_CACHE_TTL_MS = 3e4;
+var TEAM_SETUP_ROUTE_PREFIX = "/api/sync/team-setup/v1";
+var CANDIDATE_REF_PATTERN = /^legacy-team-candidate:[0-9a-f]{32}$/u;
+var DEVICE_REF_PATTERN = /^legacy-team-device-ref-v1:[0-9a-f]{64}$/u;
+var PROJECT_REF_PATTERN = /^legacy-team-project-ref-v1:[0-9a-f]{64}$/u;
+var IDENTITY_REF_PATTERN = /^legacy-team-viewer-identity-ref-v1:[0-9a-f]{64}$/u;
+var RESOLVED_PROJECT_REF_PATTERN = /^legacy-team-resolved-project-ref-v1:[0-9a-f]{64}$/u;
+var ATTEMPT_ID_PATTERN = /^legacy-team-attempt:[0-9a-f-]{36}$/u;
+var FINISH_DIGEST_PATTERN = /^legacy-team-activation-finish-v1:[0-9a-f]{64}$/u;
+var ACCESS_DELTA_DIGEST_PATTERN = /^legacy-team-access-delta:[0-9a-f]{64}$/u;
+var VIEWER_ACCESS_DELTA_DIGEST_PATTERN = /^legacy-team-viewer-access-delta-v1:[0-9a-f]{64}$/u;
+var defaultSnapshotLoaderDependencies = {
+	readConfig: readCoordinatorSyncConfig,
+	listGroups: coordinatorListGroupsAction,
+	listDevices: coordinatorListDevicesAction
+};
+function safeCoordinatorError() {
+	return /* @__PURE__ */ new Error("team_setup_roster_unavailable");
+}
+function isCoordinatorRosterTooLargeError(error) {
+	return error instanceof Error && error.message === "coordinator_response_too_large";
+}
+function configuredGroupIds(groups) {
+	const unique = [...new Set(groups.map((group) => group.trim()).filter(Boolean))];
+	if (unique.length > MAX_CONFIGURED_GROUPS) throw safeCoordinatorError();
+	return unique;
+}
+async function loadConfiguredLegacyTeamGroupSnapshotsWith(dependencies, options = {}) {
+	let config;
+	try {
+		config = dependencies.readConfig();
+	} catch {
+		throw safeCoordinatorError();
+	}
+	const groupIds = configuredGroupIds(config.syncCoordinatorGroups);
+	const hasUrl = Boolean(config.syncCoordinatorUrl);
+	const hasSecret = Boolean(config.syncCoordinatorAdminSecret);
+	if (!hasUrl && !hasSecret && groupIds.length === 0) return [];
+	if (!hasUrl || !hasSecret || groupIds.length === 0) throw safeCoordinatorError();
+	try {
+		const remoteUrl = buildBaseUrl(config.syncCoordinatorUrl);
+		const coordinatorId = remoteUrl;
+		const timeoutS = Math.max(1, config.syncCoordinatorTimeoutS);
+		const requestedGroupIds = options.candidateRef ? groupIds.filter((groupId) => legacyTeamCandidateId(coordinatorId, groupId) === options.candidateRef) : groupIds;
+		const groups = await dependencies.listGroups({
+			remoteUrl,
+			adminSecret: config.syncCoordinatorAdminSecret,
+			includeArchived: false,
+			timeoutS
+		});
+		const groupById = new Map(groups.map((group) => [group.group_id, group]));
+		return (await Promise.all(requestedGroupIds.map(async (groupId) => {
+			const group = groupById.get(groupId);
+			if (!group || group.group_id !== groupId || group.display_name !== null && typeof group.display_name !== "string" || group.archived_at != null) throw safeCoordinatorError();
+			let devices;
+			try {
+				devices = await dependencies.listDevices({
+					groupId,
+					includeDisabled: true,
+					remoteUrl,
+					adminSecret: config.syncCoordinatorAdminSecret,
+					timeoutS
+				});
+			} catch (error) {
+				if (isCoordinatorRosterTooLargeError(error)) {
+					if (options.candidateRef) throw new Error("legacy_team_setup_roster_too_large");
+					return null;
+				}
+				throw error;
+			}
+			if (devices.length > MAX_DEVICES) {
+				if (options.candidateRef) throw new Error("legacy_team_setup_roster_too_large");
+				return null;
+			}
+			if (devices.some((device) => fingerprintPublicKey(device.public_key) !== device.fingerprint || device.enabled !== 0 && device.enabled !== 1)) throw safeCoordinatorError();
+			return {
+				coordinatorId,
+				groupId,
+				displayName: group.display_name ?? "Legacy Team",
+				devices: devices.map((device) => ({
+					deviceId: device.device_id,
+					fingerprint: device.fingerprint,
+					displayName: device.display_name ?? "Device",
+					enabled: device.enabled === 1,
+					labelRedactionIds: [device.identity_id ?? "", device.public_key].filter(Boolean)
+				}))
+			};
+		}))).filter((snapshot) => snapshot !== null);
+	} catch (error) {
+		if (error instanceof Error && error.message === "legacy_team_setup_roster_too_large") throw error;
+		throw safeCoordinatorError();
+	}
+}
+async function loadConfiguredLegacyTeamGroupSnapshots(options = {}) {
+	return loadConfiguredLegacyTeamGroupSnapshotsWith(defaultSnapshotLoaderDependencies, options);
+}
+function requireBoundedSnapshots(groups) {
+	if (groups.length > MAX_CONFIGURED_GROUPS) throw new Error("legacy_team_setup_roster_too_large");
+}
+function projectionOptions(store) {
+	return {
+		localActorId: store.actorId,
+		localDeviceId: store.deviceId
+	};
+}
+function discoverCandidates(store, groups) {
+	requireBoundedSnapshots(groups);
+	return discoverLegacyTeamCandidates(store.db, {
+		projection: projectionOptions(store),
+		groups
+	});
+}
+function candidateSummary(candidate) {
+	return {
+		candidateRef: candidate.candidateRef,
+		displayName: candidate.displayName,
+		status: candidate.status,
+		deviceCount: candidate.deviceCount,
+		projectCount: candidate.projectCount,
+		unresolvedDeviceCount: candidate.unresolvedDeviceCount,
+		unresolvedProjectCount: candidate.unresolvedProjectCount
+	};
+}
+function candidateSummaryForDraft(candidate, draft) {
+	return {
+		...candidateSummary(candidate),
+		status: draft.state === "completed" ? "ready" : draft.state,
+		unresolvedDeviceCount: draft.unresolvedDeviceCount,
+		unresolvedProjectCount: draft.unresolvedProjectCount
+	};
+}
+function completedCandidateFromDraft(draft) {
+	return {
+		candidateRef: draft.candidateRef,
+		displayName: draft.displayName,
+		status: "ready",
+		deviceCount: draft.devices.length,
+		projectCount: draft.projects.length,
+		unresolvedDeviceCount: draft.unresolvedDeviceCount,
+		unresolvedProjectCount: draft.unresolvedProjectCount
+	};
+}
+function identityRef(candidateRef, identityId) {
+	return identityId ? recipientPolicyDigest("legacy-team-viewer-identity-ref-v1", [candidateRef, identityId]) : null;
+}
+function requiredIdentityRef(candidateRef, identityId) {
+	return recipientPolicyDigest("legacy-team-viewer-identity-ref-v1", [candidateRef, identityId]);
+}
+function teamRef(candidateRef, teamId) {
+	return recipientPolicyDigest("legacy-team-viewer-team-ref-v1", [candidateRef, teamId]);
+}
+function resolvedProjectRef(projectRef, projectIdentity) {
+	return projectIdentity ? legacyTeamResolvedProjectRef(projectRef, projectIdentity) : null;
+}
+function viewerSafeAccessDelta(candidateRef, delta, labels) {
+	const fallbackLabels = /* @__PURE__ */ new Map();
+	const fallbackLabelCounts = /* @__PURE__ */ new Map();
+	const reservedLabels = new Set([
+		labels?.teamDisplayName,
+		...labels?.devices.map((device) => device.displayName) ?? [],
+		...labels?.projects.flatMap((project) => [project.displayName, ...project.mappingChoices.map((choice) => choice.displayName)]) ?? [],
+		...labels?.identityChoices.map((identity) => identity.displayName) ?? []
+	].filter((label) => Boolean(label)).map((label) => normalizeChoiceLabelText(label).toLowerCase()));
+	const fallbackLabel = (kind, ref) => {
+		const key = `${kind}:${ref}`;
+		const existing = fallbackLabels.get(key);
+		if (existing) return existing;
+		let index = (fallbackLabelCounts.get(kind) ?? 0) + 1;
+		let label = `${kind} outside this setup (${index})`;
+		while (reservedLabels.has(normalizeChoiceLabelText(label).toLowerCase())) {
+			index += 1;
+			label = `${kind} outside this setup (${index})`;
+		}
+		fallbackLabelCounts.set(kind, index);
+		reservedLabels.add(normalizeChoiceLabelText(label).toLowerCase());
+		fallbackLabels.set(key, label);
+		return label;
+	};
+	const projectsByRef = new Map(labels?.projects.map((project) => [project.projectRef, project]));
+	const projectsByCanonicalRef = new Map(labels?.projects.flatMap((project) => project.canonicalProjectRef ? [[project.canonicalProjectRef, project]] : []));
+	const identitiesByRef = new Map(labels?.identityChoices.map((identity) => [identity.identityRef, identity]));
+	const devicesByRef = new Map(labels?.devices.map((device) => [device.deviceRef, device]));
+	const resolvedDisplayName = (projectRef, ref) => {
+		if (!ref) return null;
+		const project = projectsByRef.get(projectRef);
+		const choice = project?.mappingChoices.find((item) => item.resolvedProjectRef === ref);
+		if (choice) return choice.displayName;
+		if (project?.resolvedProjectRef === ref && project.resolution === "deterministic") return `${project.displayName} (automatic match)`;
+		return fallbackLabel("Project", ref);
+	};
+	return {
+		teamChanges: delta.teamChanges.map((change) => ({
+			teamRef: teamRef(candidateRef, change.teamId),
+			teamDisplayName: labels?.teamDisplayName ?? fallbackLabel("Team", teamRef(candidateRef, change.teamId)),
+			change: change.change,
+			fromDeviceEligibilityMode: change.fromDeviceEligibilityMode,
+			toDeviceEligibilityMode: change.toDeviceEligibilityMode
+		})),
+		membershipChanges: delta.membershipChanges.map((change) => {
+			const identityRef = requiredIdentityRef(candidateRef, change.identityId);
+			const membershipTeamRef = teamRef(candidateRef, change.teamId);
+			return {
+				teamRef: membershipTeamRef,
+				teamDisplayName: labels?.teamDisplayName ?? fallbackLabel("Team", membershipTeamRef),
+				identityRef,
+				identityDisplayName: identitiesByRef.get(identityRef)?.displayName ?? fallbackLabel("Person", identityRef),
+				change: change.change
+			};
+		}),
+		projectChanges: delta.projectChanges.map((change) => {
+			const fromRef = resolvedProjectRef(change.projectRef, change.fromProjectIdentity);
+			const toRef = resolvedProjectRef(change.projectRef, change.toProjectIdentity);
+			return {
+				projectRef: change.projectRef,
+				projectDisplayName: projectsByRef.get(change.projectRef)?.displayName ?? fallbackLabel("Project", change.projectRef),
+				fromResolvedProjectRef: fromRef,
+				fromResolvedProjectDisplayName: resolvedDisplayName(change.projectRef, fromRef),
+				toResolvedProjectRef: toRef,
+				toResolvedProjectDisplayName: resolvedDisplayName(change.projectRef, toRef),
+				change: change.change
+			};
+		}),
+		recipientChanges: delta.recipientChanges.map((change) => {
+			const canonicalProjectRef = legacyTeamCanonicalProjectRef(candidateRef, change.canonicalProjectIdentity);
+			const recipientRef = teamRef(candidateRef, change.recipientId);
+			return {
+				canonicalProjectRef,
+				canonicalProjectDisplayName: projectsByCanonicalRef.get(canonicalProjectRef)?.displayName ?? fallbackLabel("Project", canonicalProjectRef),
+				recipientKind: change.recipientKind,
+				recipientRef,
+				recipientDisplayName: labels?.teamDisplayName ?? fallbackLabel("Team", recipientRef),
+				change: change.change
+			};
+		}),
+		deviceAccessChanges: delta.deviceAccessChanges.map((change) => {
+			const canonicalProjectRef = legacyTeamCanonicalProjectRef(candidateRef, change.canonicalProjectIdentity);
+			const deviceRef = legacyTeamDeviceRef(candidateRef, change.deviceId);
+			return {
+				canonicalProjectRef,
+				canonicalProjectDisplayName: projectsByCanonicalRef.get(canonicalProjectRef)?.displayName ?? fallbackLabel("Project", canonicalProjectRef),
+				deviceRef,
+				deviceDisplayName: devicesByRef.get(deviceRef)?.displayName ?? fallbackLabel("Device", deviceRef),
+				change: change.change
+			};
+		})
+	};
+}
+function viewerAccessDeltaDigest(delta) {
+	return recipientPolicyDigest("legacy-team-viewer-access-delta-v1", delta);
+}
+function requireBoundedAccessDelta(delta) {
+	const total = delta.teamChanges.length + delta.membershipChanges.length + delta.projectChanges.length + delta.recipientChanges.length + delta.deviceAccessChanges.length;
+	if (delta.teamChanges.length > MAX_ACCESS_DELTA_ENTRIES || delta.membershipChanges.length > MAX_ACCESS_DELTA_ENTRIES || delta.projectChanges.length > MAX_ACCESS_DELTA_ENTRIES || delta.recipientChanges.length > MAX_ACCESS_DELTA_ENTRIES || delta.deviceAccessChanges.length > MAX_ACCESS_DELTA_ENTRIES || total > MAX_ACCESS_DELTA_ENTRIES) throw new Error("legacy_team_setup_roster_too_large");
+}
+var SAFE_CHOICE_LABEL_PATTERN = /^[\p{L}\p{N} '&,.()_-]*$/u;
+function normalizeChoiceLabelText(value) {
+	return value.normalize("NFKC").replace(/\p{Cf}/gu, "").replace(/\p{Cc}/gu, " ").replace(/\s+/gu, " ").trim();
+}
+function safeChoiceLabel(value, fallback, forbiddenIds, opaqueRef) {
+	const normalized = normalizeChoiceLabelText(value.slice(0, 512));
+	const label = normalized.slice(0, 120).trim();
+	const forbiddenComparisons = forbiddenIds.map((forbiddenId) => normalizeChoiceLabelText(forbiddenId).toLowerCase()).filter(Boolean);
+	const comparable = normalized.toLowerCase();
+	if (!label || !SAFE_CHOICE_LABEL_PATTERN.test(label) || /[\p{L}\p{N}]\.[\p{L}\p{N}]/u.test(label) || /-----|\b(?:ssh|ecdsa|sk)-[\p{L}\p{N}-]+ /iu.test(label) || forbiddenComparisons.some((forbiddenComparison) => comparable.includes(forbiddenComparison))) {
+		const suffix = opaqueRef?.slice(-6);
+		return suffix ? `${fallback} ${suffix}` : fallback;
+	}
+	return label;
+}
+function disambiguateChoiceLabels(choices, choiceRef) {
+	const counts = /* @__PURE__ */ new Map();
+	const originalLabels = /* @__PURE__ */ new Set();
+	for (const choice of choices) {
+		const comparable = normalizeChoiceLabelText(choice.displayName).toLowerCase();
+		counts.set(comparable, (counts.get(comparable) ?? 0) + 1);
+		originalLabels.add(comparable);
+	}
+	const usedLabels = /* @__PURE__ */ new Set();
+	return choices.map((choice, index) => {
+		const comparable = normalizeChoiceLabelText(choice.displayName).toLowerCase();
+		if ((counts.get(comparable) ?? 0) < 2 && !usedLabels.has(comparable)) {
+			usedLabels.add(comparable);
+			return choice;
+		}
+		const ref = choiceRef(choice);
+		let suffixLength = Math.min(6, ref.length);
+		let suffix = ref.slice(-suffixLength);
+		const maxAttempts = ref.length + originalLabels.size + usedLabels.size + 2;
+		for (let attempt = 0; attempt < maxAttempts; attempt += 1) {
+			const baseLength = Math.max(0, 119 - suffix.length);
+			const base = choice.displayName.slice(0, baseLength).trimEnd();
+			const displayName = base ? `${base} ${suffix}` : suffix.slice(-120);
+			const finalComparable = normalizeChoiceLabelText(displayName).toLowerCase();
+			if (!usedLabels.has(finalComparable) && !originalLabels.has(finalComparable)) {
+				usedLabels.add(finalComparable);
+				return {
+					...choice,
+					displayName
+				};
+			}
+			if (suffixLength < ref.length) {
+				suffixLength = Math.min(ref.length, suffixLength + 2);
+				suffix = ref.slice(-suffixLength);
+				continue;
+			}
+			suffix = `${ref.slice(-Math.min(96, ref.length))}-${index + 1}-${attempt + 1}`;
+		}
+		throw new Error("legacy_team_setup_roster_too_large");
+	});
+}
+function requireCompleteMappingChoices(projectCount, choiceCount) {
+	if (projectCount * choiceCount > MAX_TOTAL_PROJECT_MAPPING_CHOICES) throw new Error("legacy_team_setup_roster_too_large");
+}
+function createCachedSnapshotLoader(load, ttlMs, now = Date.now) {
+	let cached = null;
+	let inFlight = null;
+	let generation = 0;
+	const cachedLoad = () => {
+		if (cached && now() < cached.expiresAt) return Promise.resolve(cached.snapshots);
+		if (inFlight) return inFlight;
+		const operationGeneration = generation;
+		let operation;
+		operation = load().then((snapshots) => {
+			if (generation !== operationGeneration) return cachedLoad();
+			cached = {
+				expiresAt: now() + ttlMs,
+				snapshots
+			};
+			return snapshots;
+		}).finally(() => {
+			if (inFlight === operation) inFlight = null;
+		});
+		inFlight = operation;
+		return operation;
+	};
+	cachedLoad.invalidate = () => {
+		generation += 1;
+		cached = null;
+		inFlight = null;
+	};
+	return cachedLoad;
+}
+function identityChoicesFromRows(rows, candidateRef, maxChoices = MAX_IDENTITY_CHOICES) {
+	if (rows.length > maxChoices) throw new Error("legacy_team_setup_roster_too_large");
+	const actorIds = rows.map((row) => row.actor_id);
+	return disambiguateChoiceLabels(rows.map((row) => {
+		const opaqueIdentityRef = requiredIdentityRef(candidateRef, row.actor_id);
+		return {
+			identityId: row.actor_id,
+			identityRef: opaqueIdentityRef,
+			displayName: safeChoiceLabel(row.display_name, "Person", actorIds, opaqueIdentityRef)
+		};
+	}), (choice) => choice.identityRef);
+}
+function identityChoices(store, candidateRef) {
+	return identityChoicesFromRows(store.db.prepare(`SELECT actor_id, display_name FROM actors
+			 WHERE status = 'active' AND merged_into_actor_id IS NULL
+			 ORDER BY display_name, actor_id LIMIT ?`).all(501), candidateRef);
+}
+function completedDraftIdentityChoices(store, draft) {
+	const actorIds = [...new Set(draft.devices.flatMap((device) => [
+		device.existingIdentityId,
+		device.suggestedIdentityId,
+		device.targetIdentityId,
+		device.expectation.kind === "existing" ? device.expectation.identityId : null
+	]))].filter((actorId) => actorId !== null);
+	if (actorIds.length === 0) return [];
+	const placeholders = actorIds.map(() => "?").join(", ");
+	return identityChoicesFromRows(store.db.prepare(`SELECT actor_id, display_name FROM actors
+			 WHERE status = 'active' AND merged_into_actor_id IS NULL
+			   AND actor_id IN (${placeholders})
+			 ORDER BY display_name, actor_id`).all(...actorIds), draft.candidateRef, MAX_COMPLETED_IDENTITY_CHOICES);
+}
+function projectMappingChoices(store) {
+	let candidates;
+	try {
+		candidates = listProjectScopeCandidates(store.db, {
+			limit: null,
+			maxScannedRows: MAX_PROJECT_MAPPING_SCAN_ROWS,
+			maxMetadataRows: MAX_PROJECT_MAPPING_METADATA_ROWS,
+			excludePeerReceived: true
+		}).filter((candidate) => !candidate.read_only && isLegacyTeamSetupProjectMappingIdentity(candidate.workspace_identity));
+	} catch (error) {
+		if (error instanceof Error && (error.message === "project_scope_candidate_scan_too_large" || error.message === "project_scope_candidate_metadata_too_large")) throw new Error("legacy_team_setup_roster_too_large");
+		throw error;
+	}
+	if (candidates.length > MAX_PROJECT_MAPPING_CHOICES) throw new Error("legacy_team_setup_roster_too_large");
+	return candidates.map((candidate) => ({
+		projectIdentity: candidate.workspace_identity,
+		sourceDisplayName: candidate.display_project
+	}));
+}
+function viewerSafeDraft(store, draft) {
+	if (draft.devices.length > MAX_DEVICES || draft.projects.length > MAX_PROJECTS) throw new Error("legacy_team_setup_roster_too_large");
+	const completed = draft.state === "completed";
+	const identities = completed ? completedDraftIdentityChoices(store, draft) : identityChoices(store, draft.candidateRef);
+	const mappableProjectCount = completed ? 0 : draft.projects.filter((project) => project.resolution !== "deterministic").length;
+	const mappingChoices = mappableProjectCount === 0 ? [] : projectMappingChoices(store);
+	requireCompleteMappingChoices(mappableProjectCount, mappingChoices.length);
+	const mappingChoiceIdentities = mappingChoices.map((choice) => choice.projectIdentity);
+	return {
+		devices: draft.devices.map((device) => ({
+			deviceRef: device.deviceRef,
+			displayName: device.displayName,
+			enabled: device.enabled,
+			existingIdentityRef: identityRef(draft.candidateRef, device.existingIdentityId),
+			suggestedIdentityRef: identityRef(draft.candidateRef, device.suggestedIdentityId),
+			verifiedEvidenceKind: device.verifiedEvidenceKind,
+			decision: device.decision,
+			targetIdentityRef: identityRef(draft.candidateRef, device.targetIdentityId),
+			expectation: device.expectation.kind === "existing" ? {
+				kind: "existing",
+				assignmentVersion: device.expectation.assignmentVersion,
+				identityRef: requiredIdentityRef(draft.candidateRef, device.expectation.identityId)
+			} : { kind: "absent" }
+		})),
+		projects: draft.projects.map((project) => ({
+			projectRef: project.projectRef,
+			displayName: project.displayName,
+			resolution: project.resolution,
+			canonicalProjectRef: project.canonicalProjectRef,
+			resolvedProjectRef: project.resolvedProjectRef,
+			mappingChoices: project.resolution === "deterministic" ? [] : disambiguateChoiceLabels(mappingChoices.map((choice) => {
+				const opaqueResolvedProjectRef = legacyTeamResolvedProjectRef(project.projectRef, choice.projectIdentity);
+				return {
+					resolvedProjectRef: opaqueResolvedProjectRef,
+					displayName: safeChoiceLabel(choice.sourceDisplayName, "Project", mappingChoiceIdentities, opaqueResolvedProjectRef)
+				};
+			}), (choice) => choice.resolvedProjectRef)
+		})),
+		identityChoices: identities.map(({ identityRef, displayName }) => ({
+			identityRef,
+			displayName
+		}))
+	};
+}
+function errorStatus(code) {
+	if (code === "team_setup_roster_unavailable") return 503;
+	if (code === "team_setup_failed") return 503;
+	if (code === "team_setup_incomplete") return 400;
+	return 409;
+}
+function apiErrorCode(error) {
+	const code = legacyTeamSetupApiErrorCode(error);
+	return code === "team_setup_projection_changed" ? "team_setup_conflict" : code;
+}
+async function parseBoundedJsonObject(c) {
+	if (c.req.header("content-type")?.split(";", 1)[0]?.trim().toLowerCase() !== "application/json") return { ok: false };
+	const lengthHeader = c.req.header("content-length");
+	if (lengthHeader != null && !/^\d+$/u.test(lengthHeader.trim())) return { ok: false };
+	const contentLength = lengthHeader == null ? null : Number(lengthHeader);
+	if (contentLength != null && contentLength > MAX_MUTATION_BODY_BYTES) return { ok: false };
+	const body = c.req.raw.body;
+	if (!body) return { ok: false };
+	const reader = body.getReader();
+	const chunks = [];
+	let total = 0;
+	try {
+		while (true) {
+			const { done, value } = await reader.read();
+			if (done) break;
+			if (!value) continue;
+			total += value.byteLength;
+			if (total > MAX_MUTATION_BODY_BYTES) {
+				await reader.cancel().catch(() => void 0);
+				return { ok: false };
+			}
+			chunks.push(value);
+		}
+	} catch {
+		return { ok: false };
+	} finally {
+		reader.releaseLock();
+	}
+	try {
+		const bytes = new Uint8Array(total);
+		let offset = 0;
+		for (const chunk of chunks) {
+			bytes.set(chunk, offset);
+			offset += chunk.byteLength;
+		}
+		const parsed = JSON.parse(new TextDecoder("utf-8", { fatal: true }).decode(bytes));
+		return parsed && typeof parsed === "object" && !Array.isArray(parsed) ? {
+			ok: true,
+			value: parsed
+		} : { ok: false };
+	} catch {
+		return { ok: false };
+	}
+}
+function hasExactKeys(value, keys) {
+	const actual = Object.keys(value).toSorted();
+	const expected = keys.toSorted();
+	return actual.length === expected.length && actual.every((key, index) => key === expected[index]);
+}
+function mutationResponse(draft) {
+	return {
+		version: TEAM_SETUP_VERSION,
+		candidateRef: draft.candidateRef,
+		attemptId: draft.attemptId,
+		draftState: draft.state,
+		canFinish: draft.canFinish,
+		unresolvedDeviceCount: draft.unresolvedDeviceCount,
+		unresolvedProjectCount: draft.unresolvedProjectCount
+	};
+}
+function finishResponse(candidateRef, result) {
+	return {
+		version: TEAM_SETUP_VERSION,
+		status: result.status,
+		teamRef: teamRef(candidateRef, result.teamId),
+		attemptId: result.attemptId,
+		accessDeltaDigest: result.accessDeltaDigest,
+		completedAt: result.completedAt
+	};
+}
+function teamSetupRoutes(options) {
+	const app = new Hono();
+	const loadSnapshots = options.loadLegacyTeamConfiguredGroupSnapshots ?? loadConfiguredLegacyTeamGroupSnapshots;
+	async function loadedSnapshots(candidateRef) {
+		try {
+			return await loadSnapshots(candidateRef ? { candidateRef } : void 0);
+		} catch (error) {
+			if (error instanceof Error && error.message === "legacy_team_setup_roster_too_large") throw error;
+			throw safeCoordinatorError();
+		}
+	}
+	const loadedSummarySnapshots = createCachedSnapshotLoader(() => loadedSnapshots(), SUMMARY_SNAPSHOT_CACHE_TTL_MS);
+	async function loadedCandidateSnapshots(candidateRef) {
+		loadedSummarySnapshots.invalidate();
+		try {
+			return await loadedSnapshots(candidateRef);
+		} finally {
+			loadedSummarySnapshots.invalidate();
+		}
+	}
+	app.get("/api/sync/team-setup/v1", async (c) => {
+		let groups;
+		try {
+			groups = await loadedSummarySnapshots();
+		} catch (error) {
+			const code = apiErrorCode(error);
+			return c.json({ error: code }, errorStatus(code));
+		}
+		try {
+			const response = {
+				version: TEAM_SETUP_VERSION,
+				candidates: discoverCandidates(options.getStore(), groups).map(candidateSummary)
+			};
+			return c.json(response);
+		} catch (error) {
+			const code = apiErrorCode(error);
+			return c.json({ error: code }, errorStatus(code));
+		}
+	});
+	app.get("/api/sync/team-setup/v1/:candidateRef", async (c) => {
+		const candidateRef = c.req.param("candidateRef");
+		if (!CANDIDATE_REF_PATTERN.test(candidateRef)) return c.json({ error: "team_setup_incomplete" }, 400);
+		try {
+			const store = options.getStore();
+			let draft = getLegacyTeamSetupDraft(store.db, candidateRef);
+			let candidate;
+			if (draft?.state === "completed" && isLegacyTeamCandidateSelectable(store.db, candidateRef, { projects: legacyTeamCandidateProjectInventory(store.db, projectionOptions(store), candidateRef) })) candidate = completedCandidateFromDraft(draft);
+			else {
+				const discoveredCandidate = discoverCandidates(store, (await loadedCandidateSnapshots(candidateRef)).filter((group) => legacyTeamCandidateId(group.coordinatorId, group.groupId) === candidateRef)).find((item) => item.candidateRef === candidateRef);
+				if (!discoveredCandidate) return c.json({ error: "team_setup_confirmation_stale" }, 404);
+				candidate = discoveredCandidate;
+				draft = getLegacyTeamSetupDraft(store.db, candidateRef);
+			}
+			if (!draft) return c.json({ error: "team_setup_confirmation_stale" }, 404);
+			let conflictState = null;
+			let preview = null;
+			if (draft.state !== "completed") try {
+				preview = previewLegacyTeamSetupActivation(store.db, {
+					candidateRef,
+					attemptId: draft.attemptId
+				});
+			} catch (error) {
+				const code = apiErrorCode(error);
+				if (code === "team_setup_failed") return c.json({ error: code }, 503);
+				preview = null;
+				conflictState = code;
+			}
+			if (preview) requireBoundedAccessDelta(preview.accessDelta);
+			const viewDraft = conflictState ? getLegacyTeamSetupDraft(store.db, candidateRef) ?? draft : draft;
+			const safeDraft = viewerSafeDraft(store, viewDraft);
+			const responseBase = {
+				version: TEAM_SETUP_VERSION,
+				candidate: candidateSummaryForDraft(candidate, viewDraft),
+				attemptId: viewDraft.attemptId,
+				draftState: viewDraft.state,
+				unresolvedDeviceCount: viewDraft.unresolvedDeviceCount,
+				unresolvedProjectCount: viewDraft.unresolvedProjectCount,
+				...safeDraft
+			};
+			if (!preview) {
+				const response = {
+					...responseBase,
+					canFinish: false,
+					conflictState
+				};
+				return c.json(response);
+			}
+			const accessDelta = viewerSafeAccessDelta(candidateRef, preview.accessDelta, {
+				teamDisplayName: viewDraft.displayName,
+				...safeDraft
+			});
+			const response = {
+				...responseBase,
+				canFinish: true,
+				conflictState: null,
+				finishDigest: preview.finishDigest,
+				accessDeltaDigest: preview.accessDeltaDigest,
+				viewerAccessDeltaDigest: viewerAccessDeltaDigest(accessDelta),
+				accessDelta
+			};
+			return c.json(response);
+		} catch (error) {
+			const code = apiErrorCode(error);
+			return c.json({ error: code }, errorStatus(code));
+		}
+	});
+	app.put("/api/sync/team-setup/v1/:candidateRef/devices/:deviceRef/assignment", async (c) => {
+		const candidateRef = c.req.param("candidateRef");
+		const deviceRef = c.req.param("deviceRef");
+		if (!CANDIDATE_REF_PATTERN.test(candidateRef) || !DEVICE_REF_PATTERN.test(deviceRef)) return c.json({ error: "team_setup_incomplete" }, 400);
+		const parsed = await parseBoundedJsonObject(c);
+		if (!parsed.ok || !hasExactKeys(parsed.value, [
+			"attemptId",
+			"expectation",
+			"targetIdentityRef"
+		])) return c.json({ error: "team_setup_incomplete" }, 400);
+		const { attemptId, expectation, targetIdentityRef } = parsed.value;
+		if (typeof attemptId !== "string" || !ATTEMPT_ID_PATTERN.test(attemptId) || typeof targetIdentityRef !== "string" || !IDENTITY_REF_PATTERN.test(targetIdentityRef) || !expectation || typeof expectation !== "object" || Array.isArray(expectation)) return c.json({ error: "team_setup_incomplete" }, 400);
+		try {
+			const store = options.getStore();
+			const draft = getLegacyTeamSetupDraft(store.db, candidateRef);
+			if (!draft) return c.json({ error: "team_setup_confirmation_stale" }, 404);
+			if (draft.attemptId !== attemptId) return c.json({ error: "team_setup_confirmation_stale" }, 409);
+			const device = draft.devices.find((item) => item.deviceRef === deviceRef);
+			if (!device) return c.json({ error: "team_setup_confirmation_stale" }, 404);
+			const submittedExpectation = expectation;
+			if (!(device.expectation.kind === "absent" ? hasExactKeys(submittedExpectation, ["kind"]) && submittedExpectation.kind === "absent" : hasExactKeys(submittedExpectation, [
+				"assignmentVersion",
+				"identityRef",
+				"kind"
+			]) && submittedExpectation.kind === "existing" && submittedExpectation.assignmentVersion === device.expectation.assignmentVersion && submittedExpectation.identityRef === requiredIdentityRef(candidateRef, device.expectation.identityId))) return c.json({ error: "team_setup_assignment_changed" }, 409);
+			const target = identityChoices(store, candidateRef).find((choice) => choice.identityRef === targetIdentityRef);
+			if (!target) return c.json({ error: "team_setup_confirmation_stale" }, 404);
+			return c.json(mutationResponse(setLegacyTeamSetupDeviceAssignment(store.db, {
+				attemptId,
+				deviceRef,
+				targetIdentityId: target.identityId,
+				expectation: device.expectation
+			})));
+		} catch (error) {
+			const code = apiErrorCode(error);
+			return c.json({ error: code }, errorStatus(code));
+		}
+	});
+	app.put("/api/sync/team-setup/v1/:candidateRef/devices/:deviceRef/decision", async (c) => {
+		const candidateRef = c.req.param("candidateRef");
+		const deviceRef = c.req.param("deviceRef");
+		if (!CANDIDATE_REF_PATTERN.test(candidateRef) || !DEVICE_REF_PATTERN.test(deviceRef)) return c.json({ error: "team_setup_incomplete" }, 400);
+		const parsed = await parseBoundedJsonObject(c);
+		if (!parsed.ok) return c.json({ error: "team_setup_incomplete" }, 400);
+		const { attemptId, decision, expectedTargetIdentityRef } = parsed.value;
+		if (typeof attemptId !== "string" || !ATTEMPT_ID_PATTERN.test(attemptId) || ![
+			"included",
+			"excluded",
+			"removed"
+		].includes(decision) || (decision === "included" ? !hasExactKeys(parsed.value, [
+			"attemptId",
+			"decision",
+			"expectedTargetIdentityRef"
+		]) || typeof expectedTargetIdentityRef !== "string" || !IDENTITY_REF_PATTERN.test(expectedTargetIdentityRef) : !hasExactKeys(parsed.value, ["attemptId", "decision"]))) return c.json({ error: "team_setup_incomplete" }, 400);
+		try {
+			const store = options.getStore();
+			const draft = getLegacyTeamSetupDraft(store.db, candidateRef);
+			if (!draft) return c.json({ error: "team_setup_confirmation_stale" }, 404);
+			if (draft.attemptId !== attemptId) return c.json({ error: "team_setup_confirmation_stale" }, 409);
+			const device = draft.devices.find((item) => item.deviceRef === deviceRef);
+			if (!device) return c.json({ error: "team_setup_confirmation_stale" }, 404);
+			if (decision === "included" && (device.targetIdentityId === null || requiredIdentityRef(candidateRef, device.targetIdentityId) !== expectedTargetIdentityRef)) return c.json({ error: "team_setup_assignment_changed" }, 409);
+			return c.json(mutationResponse(setLegacyTeamSetupDeviceDecision(store.db, {
+				attemptId,
+				deviceRef,
+				decision
+			})));
+		} catch (error) {
+			const code = apiErrorCode(error);
+			return c.json({ error: code }, errorStatus(code));
+		}
+	});
+	app.delete("/api/sync/team-setup/v1/:candidateRef/devices/:deviceRef/decision", async (c) => {
+		const candidateRef = c.req.param("candidateRef");
+		const deviceRef = c.req.param("deviceRef");
+		if (!CANDIDATE_REF_PATTERN.test(candidateRef) || !DEVICE_REF_PATTERN.test(deviceRef)) return c.json({ error: "team_setup_incomplete" }, 400);
+		const parsed = await parseBoundedJsonObject(c);
+		if (!parsed.ok || !hasExactKeys(parsed.value, ["attemptId"])) return c.json({ error: "team_setup_incomplete" }, 400);
+		const { attemptId } = parsed.value;
+		if (typeof attemptId !== "string" || !ATTEMPT_ID_PATTERN.test(attemptId)) return c.json({ error: "team_setup_incomplete" }, 400);
+		try {
+			const store = options.getStore();
+			const draft = getLegacyTeamSetupDraft(store.db, candidateRef);
+			if (!draft) return c.json({ error: "team_setup_confirmation_stale" }, 404);
+			if (draft.attemptId !== attemptId) return c.json({ error: "team_setup_confirmation_stale" }, 409);
+			if (!draft.devices.some((item) => item.deviceRef === deviceRef)) return c.json({ error: "team_setup_confirmation_stale" }, 404);
+			return c.json(mutationResponse(clearLegacyTeamSetupDeviceDecision(store.db, {
+				attemptId,
+				deviceRef
+			})));
+		} catch (error) {
+			const code = apiErrorCode(error);
+			return c.json({ error: code }, errorStatus(code));
+		}
+	});
+	app.put("/api/sync/team-setup/v1/:candidateRef/projects/:projectRef/mapping", async (c) => {
+		const candidateRef = c.req.param("candidateRef");
+		const projectRef = c.req.param("projectRef");
+		if (!CANDIDATE_REF_PATTERN.test(candidateRef) || !PROJECT_REF_PATTERN.test(projectRef)) return c.json({ error: "team_setup_incomplete" }, 400);
+		const parsed = await parseBoundedJsonObject(c);
+		if (!parsed.ok || !hasExactKeys(parsed.value, ["attemptId", "resolvedProjectRef"])) return c.json({ error: "team_setup_incomplete" }, 400);
+		const { attemptId, resolvedProjectRef } = parsed.value;
+		if (typeof attemptId !== "string" || !ATTEMPT_ID_PATTERN.test(attemptId) || typeof resolvedProjectRef !== "string" || !RESOLVED_PROJECT_REF_PATTERN.test(resolvedProjectRef)) return c.json({ error: "team_setup_incomplete" }, 400);
+		try {
+			const store = options.getStore();
+			const draft = getLegacyTeamSetupDraft(store.db, candidateRef);
+			if (!draft) return c.json({ error: "team_setup_confirmation_stale" }, 404);
+			if (draft.attemptId !== attemptId) return c.json({ error: "team_setup_confirmation_stale" }, 409);
+			const project = draft.projects.find((item) => item.projectRef === projectRef);
+			if (!project) return c.json({ error: "team_setup_confirmation_stale" }, 404);
+			if (project.resolution === "deterministic") return c.json({ error: "team_setup_incomplete" }, 400);
+			const target = projectMappingChoices(store).find((choice) => legacyTeamResolvedProjectRef(projectRef, choice.projectIdentity) === resolvedProjectRef);
+			if (!target) return c.json({ error: "team_setup_confirmation_stale" }, 404);
+			return c.json(mutationResponse(setLegacyTeamSetupProjectMapping(store.db, {
+				attemptId,
+				projectRef,
+				resolvedProjectIdentity: target.projectIdentity
+			})));
+		} catch (error) {
+			const code = apiErrorCode(error);
+			return c.json({ error: code }, errorStatus(code));
+		}
+	});
+	app.post("/api/sync/team-setup/v1/:candidateRef/refresh", async (c) => {
+		const candidateRef = c.req.param("candidateRef");
+		if (!CANDIDATE_REF_PATTERN.test(candidateRef)) return c.json({ error: "team_setup_incomplete" }, 400);
+		const parsed = await parseBoundedJsonObject(c);
+		if (!parsed.ok || !hasExactKeys(parsed.value, [])) return c.json({ error: "team_setup_incomplete" }, 400);
+		let groups;
+		try {
+			groups = await loadedCandidateSnapshots(candidateRef);
+		} catch (error) {
+			const code = apiErrorCode(error);
+			return c.json({ error: code }, errorStatus(code));
+		}
+		if (groups.filter((group) => legacyTeamCandidateId(group.coordinatorId, group.groupId) === candidateRef).length === 0) return c.json({ error: "team_setup_confirmation_stale" }, 404);
+		try {
+			const store = options.getStore();
+			return c.json(mutationResponse(refreshLegacyTeamCandidate(store.db, {
+				projection: projectionOptions(store),
+				groups
+			}, candidateRef)));
+		} catch (error) {
+			const code = apiErrorCode(error);
+			return c.json({ error: code }, errorStatus(code));
+		}
+	});
+	app.post("/api/sync/team-setup/v1/:candidateRef/finish", async (c) => {
+		const candidateRef = c.req.param("candidateRef");
+		if (!CANDIDATE_REF_PATTERN.test(candidateRef)) return c.json({ error: "team_setup_incomplete" }, 400);
+		const parsed = await parseBoundedJsonObject(c);
+		if (!parsed.ok) return c.json({ error: "team_setup_incomplete" }, 400);
+		const finishKeys = [
+			"attemptId",
+			"confirmedAccessDeltaDigest",
+			"confirmedViewerAccessDeltaDigest",
+			"finishDigest"
+		];
+		if (!hasExactKeys(parsed.value, finishKeys)) return Object.keys(parsed.value).every((key) => finishKeys.includes(key)) ? c.json({ error: "team_setup_confirmation_stale" }, 409) : c.json({ error: "team_setup_incomplete" }, 400);
+		const { attemptId, confirmedAccessDeltaDigest, confirmedViewerAccessDeltaDigest, finishDigest } = parsed.value;
+		if (typeof attemptId !== "string" || !ATTEMPT_ID_PATTERN.test(attemptId) || typeof finishDigest !== "string" || !FINISH_DIGEST_PATTERN.test(finishDigest) || typeof confirmedAccessDeltaDigest !== "string" || !ACCESS_DELTA_DIGEST_PATTERN.test(confirmedAccessDeltaDigest) || typeof confirmedViewerAccessDeltaDigest !== "string" || !VIEWER_ACCESS_DELTA_DIGEST_PATTERN.test(confirmedViewerAccessDeltaDigest)) return c.json({ error: "team_setup_incomplete" }, 400);
+		try {
+			const store = options.getStore();
+			const draft = getLegacyTeamSetupDraft(store.db, candidateRef);
+			if (!draft) return c.json({ error: "team_setup_confirmation_stale" }, 404);
+			if (draft.attemptId !== attemptId) return c.json({ error: "team_setup_confirmation_stale" }, 409);
+			if (draft.state !== "completed") {
+				const preview = previewLegacyTeamSetupActivation(store.db, {
+					candidateRef,
+					attemptId: draft.attemptId
+				});
+				requireBoundedAccessDelta(preview.accessDelta);
+				const safeDraft = viewerSafeDraft(store, draft);
+				if (viewerAccessDeltaDigest(viewerSafeAccessDelta(candidateRef, preview.accessDelta, {
+					teamDisplayName: draft.displayName,
+					...safeDraft
+				})) !== confirmedViewerAccessDeltaDigest) return c.json({ error: "team_setup_confirmation_stale" }, 409);
+			}
+			const result = await finishLegacyTeamSetupActivation(store.db, {
+				candidateRef,
+				attemptId,
+				finishDigest,
+				confirmedAccessDeltaDigest,
+				loadFreshRoster: async () => {
+					const matching = (await loadedCandidateSnapshots(candidateRef)).filter((group) => legacyTeamCandidateId(group.coordinatorId, group.groupId) === candidateRef);
+					if (matching.length !== 1) throw safeCoordinatorError();
+					return matching[0]?.devices ?? [];
+				},
+				loadProjectInventory: () => legacyTeamCandidateProjectInventory(store.db, projectionOptions(store), candidateRef),
+				validateLockedPreview: (lockedPreview) => {
+					requireBoundedAccessDelta(lockedPreview.accessDelta);
+					const lockedDraft = getLegacyTeamSetupDraft(store.db, candidateRef);
+					if (!lockedDraft || lockedDraft.attemptId !== attemptId) return false;
+					const safeDraft = viewerSafeDraft(store, lockedDraft);
+					return viewerAccessDeltaDigest(viewerSafeAccessDelta(candidateRef, lockedPreview.accessDelta, {
+						teamDisplayName: lockedDraft.displayName,
+						...safeDraft
+					})) === confirmedViewerAccessDeltaDigest;
+				}
+			});
+			return c.json(finishResponse(candidateRef, result));
+		} catch (error) {
+			const code = apiErrorCode(error);
+			return c.json({ error: code }, errorStatus(code));
+		}
+	});
+	return app;
+}
+//#endregion
 //#region src/routes/update-status.ts
 function updateStatusRoutes(options = {}) {
 	const getUpdateStatus$1 = options.getUpdateStatus ?? getUpdateStatus;
@@ -7732,7 +9083,7 @@ function createApp(opts) {
 	const getSyncRuntimeStatus = opts?.getSyncRuntimeStatus ?? (() => null);
 	const app = new Hono();
 	app.use("*", preflightHandler());
-	app.use("*", originGuard());
+	app.use("*", originGuard({ unsafeGetPathPrefixes: [TEAM_SETUP_ROUTE_PREFIX] }));
 	app.route("/", healthRoutes(storeFactory));
 	app.route("/", statsRoutes(storeFactory));
 	app.route("/", memoryRoutes(storeFactory));
@@ -7744,7 +9095,11 @@ function createApp(opts) {
 	}));
 	app.route("/", configRoutes({ getSweeper: () => sweeper }));
 	app.route("/", rawEventsRoutes(storeFactory, sweeper));
-	app.route("/", syncRoutes(storeFactory, getSyncRuntimeStatus));
+	app.route("/", syncRoutes(storeFactory, getSyncRuntimeStatus, { loadDeviceIdentityCoordinatorEvidence: opts?.loadDeviceIdentityCoordinatorEvidence }));
+	app.route("/", teamSetupRoutes({
+		getStore: storeFactory,
+		loadLegacyTeamConfiguredGroupSnapshots: opts?.loadLegacyTeamConfiguredGroupSnapshots
+	}));
 	app.route("/", updateStatusRoutes({ getUpdateStatus: opts?.getUpdateStatus }));
 	const staticRoot = process.env.CODEMEM_VIEWER_STATIC_DIR ?? join(import.meta.dirname ?? ".", "../static");
 	app.use("/assets/*", async (c, next) => {