@codemem/server 0.45.0-rc.2 → 0.46.0-alpha.1

package/dist/index.js

@@ -1,6 +1,6 @@
 import { existsSync, readFileSync } from "node:fs";
 import { dirname, isAbsolute, join, posix, resolve, win32 } from "node:path";
-import { ACCESS_CLEANUP_OP_TYPE, CODEMEM_CONFIG_ENV_OVERRIDES, CoordinatorReciprocalApprovalRequestChangedError, DEFAULT_TIME_WINDOW_S, LEGACY_SHARED_REVIEW_SCOPE_ID, LOCAL_DEFAULT_SCOPE_ID, LOCAL_SYNC_CAPABILITY, LOCAL_SYNC_FEATURES, LegacyTeamSetupAdditiveConvergenceError, LegacyTeamSetupRosterCapacityError, MEMORY_FILTER_FIELD_TYPES, MEMORY_FILTER_NAMES, MEMORY_KIND_DESCRIPTIONS, MemoryStore, ObserverClient, PROMPT_TRANSPORT_PROTOCOL_RANGE, REMEMBER_MEMORY_KINDS, RawEventIngestValidationError, RecipientPolicyEdgeRequestError, RecipientPolicyTeamRenameError, RemoteCoordinatorRequestError, SCOPE_MEMBERSHIP_REVOCATION_LIMITATION, SYNC_AUTHORIZATION_REFRESH_HEADER, SYNC_CAPABILITY_HEADER, SYNC_FEATURES_HEADER, SYNC_SCOPE_QUERY_PARAM, VERSION, VERSION as VERSION$1, VIEWER_IDENTITY_TARGET_KEYS, VIEWER_SERVICE_DISCRIMINATOR, addSyncScopeToBoundary, analyzeProjectScopeMappingChangeGuardrails, applyLegacyTeamSetupCompletionManifest, applyLegacyTeamSetupCompletionManifestAndReturnActivation, applyReplicationOps, areLegacyTeamSetupCompletionPolicyFactsAdditivelyCompatible, automaticRecallHealth, buildAuthHeaders, buildBaseUrl, buildDirectPeerAuthHeaders, buildDistillReport, buildFilterClausesWithContext, buildRawEventEnvelopeFromCodexHook, buildRawEventEnvelopeFromHook, buildRawEventEnvelopeFromPiEvent, buildViewerIdentityTarget, canonicalCoordinatorLegacyTeamCompletionManifestJson, canonicalMemoryKind, canonicalWorkspaceIdentity, claimRecipientPolicyActorMutations, claimRecipientPolicyPublicationMutation, cleanupNonces, clearLegacyTeamSetupDeviceDecision, clonePromptPackAttempt, coerceObserverCommand, commitDeviceIdentityBindings, commitRecipientPolicyEdges, containLegacyTeamSetupCompletionConflict, coordinatorArchiveGroupAction, coordinatorCreateAddDeviceInviteAction, coordinatorCreateGroupAction, coordinatorCreateInviteAction, coordinatorCreateLegacyTeamCompletionAction, coordinatorCreateScopeAction, coordinatorDisableDeviceAction, coordinatorEnableDeviceAction, coordinatorGetLegacyTeamCompletionAction, coordinatorGrantScopeMembershipAction, coordinatorImportInviteAction, coordinatorListBootstrapGrantsAction, coordinatorListConsumedTeamInvitesAction, coordinatorListDevicesAction, coordinatorListGroupsAction, coordinatorListJoinRequestsAction, coordinatorListLegacyTeamCompletionsAction, coordinatorListReviewedRecipientInviteEvidenceAction, coordinatorListScopeMembershipsAction, coordinatorListScopesAction, coordinatorRemoveDeviceAction, coordinatorRenameDeviceAction, coordinatorRenameGroupAction, coordinatorReviewJoinRequestAction, coordinatorRevokeBootstrapGrantAction, coordinatorRevokeScopeMembershipAction, coordinatorStatusSnapshot, coordinatorUnarchiveGroupAction, coordinatorUpdateScopeAction, countShareableProjectMemories, createCoordinatorReciprocalApproval, decodeInvitePayload, dedupeOrderedIds, defaultSpaceScopeIdForGroup, deleteProjectScopeSettingsMapping, deriveLegacyTeamSetupCompletionManifest, detectInstallKind, deterministicPolicyTeamId, diagnoseStalePeerReceivedRows, discoverLegacyTeamCandidates, ensureDeviceIdentity, executeShareProvisioning, extractInvitePayload, extractReplicationOps, filterReplicationOpsForSyncWithStatus, fingerprintPublicKey, formatHostPort, friendlyDeviceName, fromJson, getCodememConfigPath, getCodememEnvOverrides, getCoordinatorEnrollmentReconciliationIssueSummary, getCoordinatorGroupPreference, getLegacyTeamSetupDraft, getRecipientPolicyAuthorityState, getSemanticIndexDiagnostics, getSyncResetState, getUpdateStatus, ingestRawEvents, inspectFreshLegacyTeamSetupActivation, inspectLegacyTeamSetupActivation, inviteTokenDigest, isAutomaticRecallMeasurement, isLegacyTeamCandidateSelectable, isLegacyTeamSetupProjectMappingIdentity, isPeerTrustBindingCompatible, isProjectSyncEnablementError, isScopedSyncCapability, judgeDistillReport, legacyTeamCandidateId, legacyTeamCandidateProjectInventory, legacyTeamCanonicalProjectRef, legacyTeamDeviceRef, legacyTeamResolvedProjectRef, legacyTeamSetupApiErrorCode, listAuthorizedScopesForPeer, listCoordinatorJoinRequests, listDeviceIdentityInventory, listInboundScopeRejections, listLegacyRecipientPolicyProjections, listMaintenanceJobs, listObserverProviderOptions, listPerPeerScopeSyncState, listProjectScopeCandidates, listProjectScopeInventory, listProjectScopeSettingsMappings, listRecipientPolicyIntent, listRecipientPolicyReview, listSharingDomainSettingsScopes, loadMemorySnapshotPageForPeer, loadReplicationOpsForPeer, lookupCoordinatorPeers, memoryFilterValueMatchesType, mergeAddresses, migrateRecipientPolicyIntent, negotiateSyncCapability, normalizeAddress, normalizeHumanPresentationName, normalizeSyncCapability, normalizeSyncFeatures, normalizeTeammateName, parseAcceptedProjectIntent, parsePositiveMemoryId, parseReassignScopePayload, parseRecipientPolicyEdgeCommitRequest, parseStrictInteger, parseSyncScopeRequest, persistShareOperation, personalScopeGrantStatusForPeer, planShareOperation, previewDeviceIdentityBindings, previewLegacyTeamSetupActivation, previewRecipientPolicyEdges, previewRecipientPolicyOnboarding, previewRecipientPolicyOnboardingFromReviewedIntent, probeAvailableCredentials, projectMatchesFilter, projectShareLifecycle, promptPackArtifactFingerprint, readCodememConfigFile, readCoordinatorSyncConfig, reassignProjectScopeInventoryProject, recipientInviteAuthoritativeIdentityId, recipientPolicyDigest, recipientReviewedIntentDigest, reconcileCoordinatorEnrollmentSnapshot, reconcileRecipientPolicyProject, reconcileShareOperationAcceptance, reconstructLegacyTeamSetupCompletionManifest, recordAutomaticRecall, recordHighestObservedDirectSignatureVersion, recordNonce, recordPromptPackArtifacts, recordPromptPackTerminal, refreshAuthorizedCoordinatorPeerTrust, refreshConfiguredScopeMembershipCache, refreshLegacyTeamCandidate, rejectInboundScopeFailures, renameRecipientPolicyTeam, replayLegacyTeamSetupActivation, requestJson, requireLegacyTeamSetupAccessDeltaWithinLimit, resolveDbPath, resolveProject, resolveProjectRoot, resolveRecipientPolicyReview, resolveRecipientPolicyReviewBulk, runSyncPass, schema, serializeRecipientPolicyCoordinatorGroupMutation, serializeRecipientPolicyPublicationMutation, serializeRecipientPolicyTeamMutation, setLegacyTeamSetupDeviceAssignment, setLegacyTeamSetupDeviceDecision, setLegacyTeamSetupProjectMapping, storeVectors, summarizeInboundScopeRejections, summaryLikeSqlPredicate, supportsSyncFeature, syncScopeResetRequiredPayload, toJson, tryUpdateRetrievalDelivery, updatePeerAddresses, upsertCoordinatorGroupPreference, upsertProjectScopeSettingsMapping, validateLegacyTeamSetupCompletionManifest, validateLegacyTeamSetupCompletionManifestBinding, verifyDirectPeerSignature, verifyRecipientReviewedIntent, verifySignature, writeCodememConfigFile } from "@codemem/core";
+import { ACCESS_CLEANUP_OP_TYPE, CODEMEM_CONFIG_ENV_OVERRIDES, CodememConfigMutationError, CoordinatorReciprocalApprovalRequestChangedError, DEFAULT_TIME_WINDOW_S, LEGACY_SHARED_REVIEW_SCOPE_ID, LOCAL_DEFAULT_SCOPE_ID, LOCAL_SYNC_CAPABILITY, LOCAL_SYNC_FEATURES, LegacyTeamSetupAdditiveConvergenceError, LegacyTeamSetupRosterCapacityError, MEMORY_FILTER_FIELD_TYPES, MEMORY_FILTER_NAMES, MEMORY_KIND_DESCRIPTIONS, MemoryStore, ObserverClient, PROMPT_TRANSPORT_PROTOCOL_RANGE, REMEMBER_MEMORY_KINDS, RawEventIngestValidationError, RecipientPolicyEdgeRequestError, RecipientPolicyTeamRenameError, RemoteCoordinatorRequestError, SCOPE_MEMBERSHIP_REVOCATION_LIMITATION, SYNC_AUTHORIZATION_REFRESH_HEADER, SYNC_CAPABILITY_HEADER, SYNC_FEATURES_HEADER, SYNC_SCOPE_QUERY_PARAM, VERSION, VERSION as VERSION$1, VIEWER_IDENTITY_TARGET_KEYS, VIEWER_SERVICE_DISCRIMINATOR, addSyncScopeToBoundary, analyzeProjectScopeMappingChangeGuardrails, applyLegacyTeamSetupCompletionManifest, applyLegacyTeamSetupCompletionManifestAndReturnActivation, applyReplicationOps, areLegacyTeamSetupCompletionPolicyFactsAdditivelyCompatible, automaticRecallHealth, buildAuthHeaders, buildBaseUrl, buildDirectPeerAuthHeaders, buildDistillReport, buildFilterClausesWithContext, buildRawEventEnvelopeFromCodexHook, buildRawEventEnvelopeFromHook, buildRawEventEnvelopeFromPiEvent, buildViewerIdentityTarget, canonicalCoordinatorLegacyTeamCompletionManifestJson, canonicalMemoryKind, canonicalWorkspaceIdentity, claimRecipientPolicyActorMutations, claimRecipientPolicyPublicationMutation, cleanupNonces, clearLegacyTeamSetupDeviceDecision, clonePromptPackAttempt, coerceObserverCommand, commitDeviceIdentityBindings, commitRecipientPolicyEdges, containLegacyTeamSetupCompletionConflict, coordinatorArchiveGroupAction, coordinatorCreateAddDeviceInviteAction, coordinatorCreateGroupAction, coordinatorCreateInviteAction, coordinatorCreateLegacyTeamCompletionAction, coordinatorCreateScopeAction, coordinatorDisableDeviceAction, coordinatorEnableDeviceAction, coordinatorGetLegacyTeamCompletionAction, coordinatorGrantScopeMembershipAction, coordinatorImportInviteAction, coordinatorListBootstrapGrantsAction, coordinatorListConsumedTeamInvitesAction, coordinatorListDevicesAction, coordinatorListGroupsAction, coordinatorListJoinRequestsAction, coordinatorListLegacyTeamCompletionsAction, coordinatorListReviewedRecipientInviteEvidenceAction, coordinatorListScopeMembershipsAction, coordinatorListScopesAction, coordinatorRemoveDeviceAction, coordinatorRenameDeviceAction, coordinatorRenameGroupAction, coordinatorReviewJoinRequestAction, coordinatorRevokeBootstrapGrantAction, coordinatorRevokeScopeMembershipAction, coordinatorStatusSnapshot, coordinatorUnarchiveGroupAction, coordinatorUpdateScopeAction, countShareableProjectMemories, createCoordinatorReciprocalApproval, decodeInvitePayload, dedupeOrderedIds, defaultSpaceScopeIdForGroup, deleteProjectScopeSettingsMapping, deriveLegacyTeamSetupCompletionManifest, detectInstallKind, deterministicPolicyTeamId, diagnoseStalePeerReceivedRows, discoverLegacyTeamCandidates, ensureDeviceIdentity, executeShareProvisioning, extractInvitePayload, extractReplicationOps, filterReplicationOpsForSyncWithStatus, fingerprintPublicKey, formatHostPort, friendlyDeviceName, fromJson, getCodememConfigPath, getCodememEnvOverrides, getCoordinatorEnrollmentReconciliationIssueSummary, getCoordinatorGroupPreference, getLegacyTeamSetupDraft, getRecipientPolicyAuthorityState, getSemanticIndexDiagnostics, getSyncResetState, getUpdateStatus, ingestRawEvents, inspectFreshLegacyTeamSetupActivation, inspectLegacyTeamSetupActivation, inviteTokenDigest, isAutomaticRecallMeasurement, isLegacyTeamCandidateSelectable, isLegacyTeamSetupProjectMappingIdentity, isPeerTrustBindingCompatible, isProjectSyncEnablementError, isScopedSyncCapability, judgeDistillReport, legacyTeamCandidateId, legacyTeamCandidateProjectInventory, legacyTeamCanonicalProjectRef, legacyTeamDeviceRef, legacyTeamResolvedProjectRef, legacyTeamSetupApiErrorCode, listAuthorizedScopesForPeer, listCoordinatorJoinRequests, listDeviceIdentityInventory, listInboundScopeRejections, listLegacyRecipientPolicyProjections, listMaintenanceJobs, listObserverProviderOptions, listPerPeerScopeSyncState, listProjectScopeCandidates, listProjectScopeInventory, listProjectScopeSettingsMappings, listRecipientPolicyIntent, listRecipientPolicyReview, listSharingDomainSettingsScopes, loadMemorySnapshotPageForPeer, loadReplicationOpsForPeer, lookupCoordinatorPeers, memoryFilterValueMatchesType, mergeAddresses, migrateRecipientPolicyIntent, mutateCodememConfigFile, negotiateSyncCapability, normalizeAddress, normalizeHumanPresentationName, normalizeSyncCapability, normalizeSyncFeatures, normalizeTeammateName, parseAcceptedProjectIntent, parsePositiveMemoryId, parseReassignScopePayload, parseRecipientPolicyEdgeCommitRequest, parseStrictInteger, parseSyncScopeRequest, persistShareOperation, personalScopeGrantStatusForPeer, planShareOperation, previewDeviceIdentityBindings, previewLegacyTeamSetupActivation, previewRecipientPolicyEdges, previewRecipientPolicyOnboarding, previewRecipientPolicyOnboardingFromReviewedIntent, probeAvailableCredentials, projectMatchesFilter, projectShareLifecycle, promptPackArtifactFingerprint, readCodememConfigFile, readCoordinatorSyncConfig, reassignProjectScopeInventoryProject, recipientInviteAuthoritativeIdentityId, recipientPolicyDigest, recipientReviewedIntentDigest, reconcileCoordinatorEnrollmentSnapshot, reconcileRecipientPolicyProject, reconcileShareOperationAcceptance, reconstructLegacyTeamSetupCompletionManifest, recordAutomaticRecall, recordHighestObservedDirectSignatureVersion, recordNonce, recordPromptPackArtifacts, recordPromptPackTerminal, refreshAuthorizedCoordinatorPeerTrust, refreshConfiguredScopeMembershipCache, refreshLegacyTeamCandidate, rejectInboundScopeFailures, renameRecipientPolicyTeam, replayLegacyTeamSetupActivation, requestJson, requireLegacyTeamSetupAccessDeltaWithinLimit, resolveDbPath, resolveProject, resolveProjectRoot, resolveRecipientPolicyReview, resolveRecipientPolicyReviewBulk, runSyncPass, schema, serializeRecipientPolicyCoordinatorGroupMutation, serializeRecipientPolicyPublicationMutation, serializeRecipientPolicyTeamMutation, setLegacyTeamSetupDeviceAssignment, setLegacyTeamSetupDeviceDecision, setLegacyTeamSetupProjectMapping, storeVectors, summarizeInboundScopeRejections, summaryLikeSqlPredicate, supportsSyncFeature, syncScopeResetRequiredPayload, toJson, tryUpdateRetrievalDelivery, updatePeerAddresses, upsertCoordinatorGroupPreference, upsertProjectScopeSettingsMapping, validateLegacyTeamSetupCompletionManifest, validateLegacyTeamSetupCompletionManifestBinding, validateRawEvents, verifyDirectPeerSignature, verifyRecipientReviewedIntent, verifySignature } from "@codemem/core";
 import { serveStatic } from "@hono/node-server/serve-static";
 import { Hono } from "hono";
 import { createMiddleware } from "hono/factory";
@@ -9,6 +9,8 @@ import { createCipheriv, createDecipheriv, createHash, randomBytes, randomUUID }
 import { and, count, desc, eq, inArray, max, ne } from "drizzle-orm";
 import { drizzle } from "drizzle-orm/better-sqlite3";
 import { homedir, hostname, networkInterfaces } from "node:os";
+import * as z from "zod";
+import { chmod, link, mkdir, open, readFile, readdir, rm, stat } from "node:fs/promises";
 //#region src/middleware.ts
 var LOOPBACK_HOSTS = /* @__PURE__ */ new Set([
 	"127.0.0.1",
@@ -180,6 +182,32 @@ var AUTH_SOURCES = /* @__PURE__ */ new Set([
 	"none"
 ]);
 var HOT_RELOAD_KEYS = /* @__PURE__ */ new Set(["raw_events_sweeper_interval_s"]);
+var EXECUTABLE_ARGV_KEYS = /* @__PURE__ */ new Set([
+	"claude_command",
+	"codex_command",
+	"observer_auth_command"
+]);
+var BOOLEAN_KEYS = /* @__PURE__ */ new Set([
+	"sync_enabled",
+	"sync_retention_enabled",
+	"sync_mdns",
+	"observer_tier_routing_enabled"
+]);
+var STRING_KEYS = /* @__PURE__ */ new Set([
+	"observer_base_url",
+	"observer_model",
+	"observer_simple_model",
+	"observer_reasoning_effort",
+	"observer_reasoning_summary",
+	"observer_rich_model",
+	"observer_rich_reasoning_effort",
+	"observer_rich_reasoning_summary",
+	"observer_auth_file",
+	"sync_host",
+	"sync_coordinator_url",
+	"sync_coordinator_group"
+]);
+var TEMPERATURE_KEYS = /* @__PURE__ */ new Set(["observer_simple_temperature", "observer_rich_temperature"]);
 var PROTECTED_WRITE_KEYS = /* @__PURE__ */ new Set([
 	"claude_command",
 	"codex_command",
@@ -322,14 +350,18 @@ function partitionViewerUpdates(updates, beforeConfig) {
 }
 function parsePositiveInt(value, allowZero = false) {
 	if (typeof value === "boolean") return null;
-	const parsed = typeof value === "number" ? value : typeof value === "string" && /^-?\d+$/.test(value.trim()) ? Number(value.trim()) : NaN;
+	let parsed = NaN;
+	if (typeof value === "number") parsed = value;
+	else if (typeof value === "string" && /^-?\d+$/.test(value.trim())) parsed = Number(value.trim());
 	if (!Number.isFinite(parsed) || !Number.isInteger(parsed)) return null;
 	if (allowZero) return parsed >= 0 ? parsed : null;
 	return parsed > 0 ? parsed : null;
 }
 function parseFiniteNumber(value, allowZero = true) {
 	if (typeof value === "boolean") return null;
-	const parsed = typeof value === "number" ? value : typeof value === "string" && value.trim().length > 0 ? Number(value.trim()) : NaN;
+	let parsed = NaN;
+	if (typeof value === "number") parsed = value;
+	else if (typeof value === "string" && value.trim().length > 0) parsed = Number(value.trim());
 	if (!Number.isFinite(parsed)) return null;
 	if (allowZero) return parsed >= 0 ? parsed : null;
 	return parsed > 0 ? parsed : null;
@@ -356,77 +388,76 @@ function asExecutableArgv(value) {
 	}
 	return argv;
 }
-function validateAndApplyUpdate(configData, key, value, providers) {
-	if (value == null || value === "") {
-		delete configData[key];
-		return null;
-	}
-	if (key === "observer_provider") {
-		if (typeof value !== "string") return "observer_provider must be string";
-		const provider = value.trim().toLowerCase();
-		const savedBaseUrl = configData.observer_base_url;
-		const hasSavedBaseUrl = typeof savedBaseUrl === "string" && savedBaseUrl.trim().length > 0;
-		if (!providers.has(provider) && !hasSavedBaseUrl) return "observer_provider must match a configured provider";
-		configData[key] = provider;
-		return null;
-	}
-	if (key === "observer_runtime") {
-		if (typeof value !== "string") return "observer_runtime must be string";
-		const runtime = value.trim().toLowerCase();
-		if (!RUNTIMES.has(runtime)) return "observer_runtime must be one of: api_http, claude_sidecar, codex_sidecar";
-		configData[key] = runtime;
-		return null;
-	}
-	if (key === "observer_auth_source") {
-		if (typeof value !== "string") return "observer_auth_source must be string";
-		const source = value.trim().toLowerCase();
-		if (!AUTH_SOURCES.has(source)) return "observer_auth_source must be one of: auto, env, file, command, none";
-		configData[key] = source;
-		return null;
-	}
-	if (key === "claude_command" || key === "codex_command" || key === "observer_auth_command") {
-		const argv = asExecutableArgv(value);
-		if (argv == null) return `${key} must be string array`;
-		if (argv.length > 0) configData[key] = argv;
-		else delete configData[key];
-		return null;
-	}
-	if (key === "observer_headers") {
-		const headers = asStringMap(value);
-		if (headers == null) return "observer_headers must be object of string values";
-		if (Object.keys(headers).length > 0) configData[key] = headers;
-		else delete configData[key];
-		return null;
-	}
-	if (key === "sync_enabled" || key === "sync_retention_enabled" || key === "sync_mdns") {
-		if (typeof value !== "boolean") return `${key} must be boolean`;
-		configData[key] = value;
-		return null;
-	}
-	if (key === "observer_tier_routing_enabled") {
-		if (typeof value !== "boolean") return `${key} must be boolean`;
-		configData[key] = value;
-		return null;
-	}
-	if (key === "observer_base_url" || key === "observer_model" || key === "observer_simple_model" || key === "observer_reasoning_effort" || key === "observer_reasoning_summary" || key === "observer_rich_model" || key === "observer_rich_reasoning_effort" || key === "observer_rich_reasoning_summary" || key === "observer_auth_file" || key === "sync_host" || key === "sync_coordinator_url" || key === "sync_coordinator_group") {
-		if (typeof value !== "string") return `${key} must be string`;
-		const trimmed = value.trim();
-		if (!trimmed) delete configData[key];
-		else configData[key] = trimmed;
-		return null;
-	}
-	if (key === "observer_simple_temperature" || key === "observer_rich_temperature") {
-		const parsed = parseFiniteNumber(value, true);
-		if (parsed == null) return `${key} must be non-negative number`;
-		configData[key] = parsed;
-		return null;
-	}
+function applyObserverProvider(configData, value, providers) {
+	if (typeof value !== "string") return "observer_provider must be string";
+	const provider = value.trim().toLowerCase();
+	const savedBaseUrl = configData.observer_base_url;
+	const hasSavedBaseUrl = typeof savedBaseUrl === "string" && savedBaseUrl.trim().length > 0;
+	if (!providers.has(provider) && !hasSavedBaseUrl) return "observer_provider must match a configured provider";
+	configData.observer_provider = provider;
+	return null;
+}
+function applyNormalizedEnum(configData, key, value, allowed) {
+	if (typeof value !== "string") return `${key} must be string`;
+	const normalized = value.trim().toLowerCase();
+	if (!allowed.has(normalized)) return `${key} must be one of: ${key === "observer_runtime" ? "api_http, claude_sidecar, codex_sidecar" : "auto, env, file, command, none"}`;
+	configData[key] = normalized;
+	return null;
+}
+function applyExecutableArgv(configData, key, value) {
+	const argv = asExecutableArgv(value);
+	if (argv == null) return `${key} must be string array`;
+	if (argv.length > 0) configData[key] = argv;
+	else delete configData[key];
+	return null;
+}
+function applyHeaders(configData, value) {
+	const headers = asStringMap(value);
+	if (headers == null) return "observer_headers must be object of string values";
+	if (Object.keys(headers).length > 0) configData.observer_headers = headers;
+	else delete configData.observer_headers;
+	return null;
+}
+function applyBoolean(configData, key, value) {
+	if (typeof value !== "boolean") return `${key} must be boolean`;
+	configData[key] = value;
+	return null;
+}
+function applyString(configData, key, value) {
+	if (typeof value !== "string") return `${key} must be string`;
+	const trimmed = value.trim();
+	if (trimmed) configData[key] = trimmed;
+	else delete configData[key];
+	return null;
+}
+function applyTemperature(configData, key, value) {
+	const parsed = parseFiniteNumber(value, true);
+	if (parsed == null) return `${key} must be non-negative number`;
+	configData[key] = parsed;
+	return null;
+}
+function applyPositiveInteger(configData, key, value) {
 	const allowZero = key === "observer_auth_cache_ttl_s";
 	const parsed = parsePositiveInt(value, allowZero);
 	if (parsed == null) return `${key} must be ${allowZero ? "non-negative int" : "int"}`;
 	configData[key] = parsed;
 	return null;
 }
+function validateAndApplyUpdate(configData, key, value, providers) {
+	if (value == null || value === "") {
+		delete configData[key];
+		return null;
+	}
+	if (key === "observer_provider") return applyObserverProvider(configData, value, providers);
+	if (key === "observer_runtime") return applyNormalizedEnum(configData, key, value, RUNTIMES);
+	if (key === "observer_auth_source") return applyNormalizedEnum(configData, key, value, AUTH_SOURCES);
+	if (EXECUTABLE_ARGV_KEYS.has(key)) return applyExecutableArgv(configData, key, value);
+	if (key === "observer_headers") return applyHeaders(configData, value);
+	if (BOOLEAN_KEYS.has(key)) return applyBoolean(configData, key, value);
+	if (STRING_KEYS.has(key)) return applyString(configData, key, value);
+	if (TEMPERATURE_KEYS.has(key)) return applyTemperature(configData, key, value);
+	return applyPositiveInteger(configData, key, value);
+}
 function applyRuntimeEffects(changedKeys, opts) {
 	const applied = [];
 	if (changedKeys.includes("raw_events_sweeper_interval_s")) {
@@ -439,6 +470,88 @@ function applyRuntimeEffects(changedKeys, opts) {
 	}
 	return applied;
 }
+var ConfigUpdateError = class extends Error {
+	status;
+	constructor(message, status) {
+		super(message);
+		this.status = status;
+	}
+};
+async function parseConfigUpdates(c) {
+	let payload;
+	try {
+		payload = await c.req.json();
+	} catch {
+		throw new ConfigUpdateError("invalid json", 400);
+	}
+	if (payload == null || typeof payload !== "object" || Array.isArray(payload)) throw new ConfigUpdateError("payload must be an object", 400);
+	const config = payload.config;
+	if ("config" in payload && config != null && (typeof config !== "object" || Array.isArray(config))) throw new ConfigUpdateError("config must be an object", 400);
+	if (config != null && typeof config === "object" && !Array.isArray(config)) return config;
+	return payload;
+}
+function saveViewerConfig(updates, configPath, providers) {
+	let beforeConfig = {};
+	let nextConfig = {};
+	let touchedKeys = [];
+	const result = mutateCodememConfigFile((currentConfig) => {
+		beforeConfig = withoutRemovedConfigKeys(currentConfig);
+		const partitioned = partitionViewerUpdates(updates, beforeConfig);
+		if (partitioned.error) throw new ConfigUpdateError(partitioned.error, 403);
+		nextConfig = { ...beforeConfig };
+		touchedKeys = ALLOWED_KEYS.filter((key) => key in partitioned.allowedUpdates);
+		for (const key of touchedKeys) {
+			const error = validateAndApplyUpdate(nextConfig, key, partitioned.allowedUpdates[key], providers);
+			if (error) throw new ConfigUpdateError(error, 400);
+		}
+		return nextConfig;
+	}, configPath);
+	return {
+		beforeConfig,
+		nextConfig,
+		touchedKeys,
+		savedPath: result.path
+	};
+}
+function viewerConfigSavePayload(saved, opts) {
+	const { beforeConfig, nextConfig, touchedKeys, savedPath } = saved;
+	const beforeEffective = getEffectiveConfig(beforeConfig);
+	const afterEffective = getEffectiveConfig(nextConfig);
+	const savedChangedKeys = ALLOWED_KEYS.filter((key) => beforeConfig[key] !== nextConfig[key]);
+	const effectiveChangedKeys = ALLOWED_KEYS.filter((key) => !configValuesEqual(beforeEffective[key], afterEffective[key]));
+	const envOverrides = getCodememEnvOverrides();
+	const ignoredByEnvKeys = savedChangedKeys.filter((key) => !effectiveChangedKeys.includes(key) && key in envOverrides);
+	const runtimeChangedKeys = [.../* @__PURE__ */ new Set([
+		...touchedKeys,
+		...savedChangedKeys,
+		...effectiveChangedKeys
+	])];
+	return {
+		path: savedPath,
+		config: sanitizeConfigForResponse(nextConfig),
+		effective: sanitizeConfigForResponse(afterEffective),
+		protected_keys: [...PROTECTED_WRITE_KEYS].sort(),
+		effects: {
+			saved_keys: savedChangedKeys,
+			effective_keys: effectiveChangedKeys,
+			hot_reloaded_keys: applyRuntimeEffects(runtimeChangedKeys, opts),
+			restart_required_keys: effectiveChangedKeys.filter((key) => !HOT_RELOAD_KEYS.has(key) && !(key in envOverrides)),
+			ignored_by_env_keys: ignoredByEnvKeys,
+			warnings: ignoredByEnvKeys.map((key) => `${key} is currently controlled by ${envOverrides[key]}; saved config will not take effect until that override is removed.`)
+		}
+	};
+}
+async function handleConfigPost(c, opts) {
+	try {
+		const saved = saveViewerConfig(await parseConfigUpdates(c), getCodememConfigPath(), new Set(loadProviderOptions()));
+		return c.json(viewerConfigSavePayload(saved, opts));
+	} catch (error) {
+		if (error instanceof ConfigUpdateError) return c.json({ error: error.message }, error.status);
+		if (error instanceof CodememConfigMutationError) return c.json({ error: error.message }, 409);
+		const message = error instanceof Error ? error.message : "failed to write config";
+		return c.json({ error: message }, 500);
+	}
+}
 function configRoutes(opts = {}) {
 	const app = new Hono();
 	app.get("/api/config", (c) => {
@@ -455,61 +568,7 @@ function configRoutes(opts = {}) {
 			providers: loadProviderOptions()
 		});
 	});
-	app.post("/api/config", async (c) => {
-		let payload;
-		try {
-			payload = await c.req.json();
-		} catch {
-			return c.json({ error: "invalid json" }, 400);
-		}
-		if (payload == null || typeof payload !== "object" || Array.isArray(payload)) return c.json({ error: "payload must be an object" }, 400);
-		if ("config" in payload && payload.config != null && (typeof payload.config !== "object" || Array.isArray(payload.config))) return c.json({ error: "config must be an object" }, 400);
-		const updates = "config" in payload && payload.config != null && typeof payload.config === "object" && !Array.isArray(payload.config) ? payload.config : payload;
-		const configPath = getCodememConfigPath();
-		const beforeConfig = withoutRemovedConfigKeys(readCodememConfigFile());
-		const { allowedUpdates, error: protectedKeyError } = partitionViewerUpdates(updates, beforeConfig);
-		if (protectedKeyError) return c.json({ error: protectedKeyError }, 403);
-		const beforeEffective = getEffectiveConfig(beforeConfig);
-		const nextConfig = { ...beforeConfig };
-		const providers = new Set(loadProviderOptions());
-		const touchedKeys = ALLOWED_KEYS.filter((key) => key in allowedUpdates);
-		for (const key of ALLOWED_KEYS) {
-			if (!(key in allowedUpdates)) continue;
-			const error = validateAndApplyUpdate(nextConfig, key, allowedUpdates[key], providers);
-			if (error) return c.json({ error }, 400);
-		}
-		let savedPath;
-		try {
-			savedPath = writeCodememConfigFile(nextConfig, configPath);
-		} catch {
-			return c.json({ error: "failed to write config" }, 500);
-		}
-		const afterEffective = getEffectiveConfig(nextConfig);
-		const savedChangedKeys = ALLOWED_KEYS.filter((key) => beforeConfig[key] !== nextConfig[key]);
-		const effectiveChangedKeys = ALLOWED_KEYS.filter((key) => !configValuesEqual(beforeEffective[key], afterEffective[key]));
-		const envOverrides = getCodememEnvOverrides();
-		const ignoredByEnvKeys = savedChangedKeys.filter((key) => !effectiveChangedKeys.includes(key) && key in envOverrides);
-		const hotReloadedKeys = applyRuntimeEffects([.../* @__PURE__ */ new Set([
-			...touchedKeys,
-			...savedChangedKeys,
-			...effectiveChangedKeys
-		])], opts);
-		const restartRequiredKeys = effectiveChangedKeys.filter((key) => !HOT_RELOAD_KEYS.has(key) && !(key in envOverrides));
-		return c.json({
-			path: savedPath,
-			config: sanitizeConfigForResponse(nextConfig),
-			effective: sanitizeConfigForResponse(afterEffective),
-			protected_keys: [...PROTECTED_WRITE_KEYS].sort(),
-			effects: {
-				saved_keys: savedChangedKeys,
-				effective_keys: effectiveChangedKeys,
-				hot_reloaded_keys: hotReloadedKeys,
-				restart_required_keys: restartRequiredKeys,
-				ignored_by_env_keys: ignoredByEnvKeys,
-				warnings: ignoredByEnvKeys.map((key) => `${key} is currently controlled by ${envOverrides[key]}; saved config will not take effect until that override is removed.`)
-			}
-		});
-	});
+	app.post("/api/config", (c) => handleConfigPost(c, opts));
 	return app;
 }
 //#endregion
@@ -881,6 +940,12 @@ function databaseReachable(getStore) {
 }
 function healthRoutes(getStore) {
 	const app = new Hono();
+	app.get("/api/viewer-status", (c) => {
+		const store = getStore();
+		store.db.pragma("schema_version", { simple: true });
+		c.header("Cache-Control", "no-store");
+		return c.json({ identity: { actor_id: store.actorId } });
+	});
 	app.get("/api/health", (c) => {
 		const reachable = databaseReachable(getStore);
 		c.header("Cache-Control", "no-store");
@@ -2182,49 +2247,6 @@ var MAX_METADATA_FIELD_CHARS = 512;
 var MAX_WORKING_SET_FILES = 50;
 var MAX_WORKING_SET_PATH_CHARS = 512;
 var INVALID_JSON = Symbol("invalid-json");
-var PACK_KEYS = /* @__PURE__ */ new Set([
-	"context",
-	"limit",
-	"token_budget",
-	"project",
-	"cwd",
-	"all_projects",
-	"working_set_files",
-	"compact",
-	"compact_detail_count",
-	"db_path",
-	"identity_target",
-	"attempt",
-	"automatic_context"
-]);
-var LEDGER_KEYS = /* @__PURE__ */ new Set([
-	"automatic_recall",
-	"evaluation_key",
-	"action",
-	"attempt_id",
-	"started_at",
-	"source",
-	"stream_id",
-	"source_session_id",
-	"prompt_number",
-	"request_id",
-	"retrieval_status",
-	"delivery_status",
-	"failure_code",
-	"failure_stage",
-	"original_attempt_id",
-	"db_path",
-	"identity_target"
-]);
-var ATTEMPT_KEYS = /* @__PURE__ */ new Set([
-	"attempt_id",
-	"started_at",
-	"source",
-	"stream_id",
-	"source_session_id",
-	"prompt_number",
-	"request_id"
-]);
 var FORBIDDEN_LEDGER_KEYS = /* @__PURE__ */ new Set([
 	"body",
 	"context",
@@ -2237,6 +2259,52 @@ var FORBIDDEN_LEDGER_KEYS = /* @__PURE__ */ new Set([
 	"raw_prompt",
 	"title"
 ]);
+function optionalMetadataString(field) {
+	const error = `ledger metadata field ${field} is invalid`;
+	return z.string({ error }).max(MAX_METADATA_FIELD_CHARS, { error }).nullish();
+}
+var attemptMetadataShape = {
+	attempt_id: z.string({ error: "ledger metadata requires attempt_id" }).min(1, { error: "ledger metadata requires attempt_id" }).max(MAX_METADATA_FIELD_CHARS, { error: "ledger metadata field attempt_id is invalid" }),
+	started_at: optionalMetadataString("started_at"),
+	source: optionalMetadataString("source"),
+	stream_id: optionalMetadataString("stream_id"),
+	source_session_id: optionalMetadataString("source_session_id"),
+	prompt_number: z.number({ error: "ledger metadata prompt_number must be a non-negative integer" }).int({ error: "ledger metadata prompt_number must be a non-negative integer" }).nonnegative({ error: "ledger metadata prompt_number must be a non-negative integer" }).nullish(),
+	request_id: optionalMetadataString("request_id")
+};
+var attemptPayloadSchema = z.strictObject(attemptMetadataShape, { error: "attempt must be an object" });
+var ledgerPayloadSchema = z.strictObject({
+	...attemptMetadataShape,
+	automatic_recall: z.unknown().optional(),
+	evaluation_key: z.unknown().optional(),
+	action: z.unknown().optional(),
+	retrieval_status: z.unknown().optional(),
+	delivery_status: z.unknown().optional(),
+	failure_code: optionalMetadataString("failure_code"),
+	failure_stage: optionalMetadataString("failure_stage"),
+	original_attempt_id: optionalMetadataString("original_attempt_id"),
+	db_path: z.unknown().optional(),
+	identity_target: z.unknown().optional()
+});
+var automaticContextPayloadSchema = z.strictObject({
+	source: z.string({ error: "automatic_context source is invalid" }).max(64, { error: "automatic_context source is invalid" }).trim().min(1, { error: "automatic_context source is invalid" }),
+	host_session_id: z.string({ error: "automatic_context host_session_id is invalid" }).max(MAX_METADATA_FIELD_CHARS, { error: "automatic_context host_session_id is invalid" }).trim().min(1, { error: "automatic_context host_session_id is invalid" })
+}, { error: "automatic_context must be an object or null" });
+var packRequestPayloadSchema = z.strictObject({
+	context: z.string({ error: "context required" }).trim().min(1, { error: "context required" }),
+	limit: z.number({ error: "limit must be a positive int" }).int({ error: "limit must be a positive int" }).min(1, { error: "limit must be a positive int" }).nullish().transform((value) => value ?? 10),
+	token_budget: z.number({ error: "token_budget must be a non-negative int" }).int({ error: "token_budget must be a non-negative int" }).nonnegative({ error: "token_budget must be a non-negative int" }).nullish().transform((value) => value ?? null),
+	project: z.string({ error: "project must be a non-empty string" }).refine((value) => value.trim().length > 0, { error: "project must be a non-empty string" }).nullish(),
+	cwd: z.string({ error: "cwd must be an absolute path" }).refine((value) => value.trim().length > 0, { error: "cwd must be an absolute path" }).nullish(),
+	all_projects: z.boolean({ error: "all_projects must be a boolean" }).nullish(),
+	working_set_files: z.array(z.string({ error: "working_set_files must be an array of repository-relative strings" }), { error: "working_set_files must be an array of repository-relative strings" }).max(MAX_WORKING_SET_FILES, { error: `working_set_files must contain at most ${MAX_WORKING_SET_FILES} entries` }).nullish(),
+	compact: z.boolean({ error: "compact must be a boolean" }).nullish(),
+	compact_detail_count: z.number({ error: "compact_detail_count must be a non-negative int" }).int({ error: "compact_detail_count must be a non-negative int" }).nonnegative({ error: "compact_detail_count must be a non-negative int" }).nullish(),
+	db_path: z.unknown().optional(),
+	identity_target: z.unknown().optional(),
+	attempt: attemptPayloadSchema.nullable().optional(),
+	automatic_context: automaticContextPayloadSchema.nullable().optional()
+});
 function invalidRequest(message) {
 	return { error: {
 		code: "invalid_request",
@@ -2258,6 +2326,10 @@ function viewerContractUnsupported() {
 function isRecord(value) {
 	return value != null && typeof value === "object" && !Array.isArray(value);
 }
+function firstUnknownKey(value, shape) {
+	if (!isRecord(value)) return null;
+	return Object.keys(value).find((key) => !Object.hasOwn(shape, key)) ?? null;
+}
 function isAbsolutePath(value) {
 	return posix.isAbsolute(value) || win32.isAbsolute(value);
 }
@@ -2268,14 +2340,15 @@ function normalizeWorkingSetPath(value) {
 	if (!normalized || normalized === "." || normalized === ".." || normalized.startsWith("../")) return null;
 	return normalized;
 }
-function validateMetadataFields(payload, allowedKeys) {
+function validateMetadataEnvelope(payload, shape) {
 	if (Buffer.byteLength(JSON.stringify(payload), "utf8") > MAX_LEDGER_PAYLOAD_BYTES) return "ledger metadata exceeds 16384 bytes";
 	for (const key of Object.keys(payload)) {
 		if (FORBIDDEN_LEDGER_KEYS.has(key)) return `ledger metadata rejects sensitive field: ${key}`;
-		if (!allowedKeys.has(key)) return `ledger metadata contains unsupported field: ${key}`;
+		if (!Object.hasOwn(shape, key)) return `ledger metadata contains unsupported field: ${key}`;
 	}
-	if (typeof payload.attempt_id !== "string" || payload.attempt_id.length === 0) return "ledger metadata requires attempt_id";
-	if (payload.prompt_number != null && (typeof payload.prompt_number !== "number" || !Number.isInteger(payload.prompt_number) || payload.prompt_number < 0)) return "ledger metadata prompt_number must be a non-negative integer";
+	return null;
+}
+function validateMetadataPaths(payload) {
 	for (const key of [
 		"attempt_id",
 		"started_at",
@@ -2288,7 +2361,6 @@ function validateMetadataFields(payload, allowedKeys) {
 		"original_attempt_id"
 	]) {
 		const field = payload[key];
-		if (field != null && (typeof field !== "string" || field.length > MAX_METADATA_FIELD_CHARS)) return `ledger metadata field ${key} is invalid`;
 		if (typeof field === "string" && isAbsolutePath(field)) return `ledger metadata rejects absolute paths in field: ${key}`;
 	}
 	return null;
@@ -2307,19 +2379,18 @@ function attemptMetadata(payload) {
 }
 function validateAutomaticContext(value) {
 	if (value === null) return null;
-	if (!isRecord(value)) return "automatic_context must be an object or null";
-	for (const key of Object.keys(value)) if (key !== "source" && key !== "host_session_id") return `automatic_context contains unsupported field: ${key}`;
-	const source = value.source;
-	const hostSessionId = value.host_session_id;
-	if (typeof source !== "string" || !source.trim() || source.length > 64) return "automatic_context source is invalid";
-	if (typeof hostSessionId !== "string" || !hostSessionId.trim() || hostSessionId.length > MAX_METADATA_FIELD_CHARS || isAbsolutePath(hostSessionId)) return "automatic_context host_session_id is invalid";
+	if (isAbsolutePath(value.host_session_id)) return "automatic_context host_session_id is invalid";
 	return {
-		source: source.trim(),
-		hostSessionId: hostSessionId.trim()
+		source: value.source,
+		hostSessionId: value.host_session_id
 	};
 }
 function resolveRequestAutomaticContext(value, attempt) {
-	if (Object.hasOwn(value, "automatic_context")) return validateAutomaticContext(value.automatic_context);
+	if (Object.hasOwn(value, "automatic_context")) {
+		const automaticContext = value.automatic_context;
+		if (automaticContext === void 0) return "automatic_context must be an object or null";
+		return validateAutomaticContext(automaticContext);
+	}
 	if (!attempt) return void 0;
 	const source = typeof attempt.source === "string" ? attempt.source.trim().toLowerCase() : "";
 	if (source && source !== "opencode") return void 0;
@@ -2347,54 +2418,60 @@ function packRequestArgs(request) {
 		request.automaticContext
 	];
 }
-function validatePackRequest(value) {
-	if (!isRecord(value)) return "request body must be an object";
-	for (const key of Object.keys(value)) if (!PACK_KEYS.has(key)) return `request body contains unsupported field: ${key}`;
-	const context = typeof value.context === "string" ? value.context.trim() : "";
-	if (!context) return "context required";
-	const limit = value.limit ?? 10;
-	if (typeof limit !== "number" || !Number.isInteger(limit) || limit < 1) return "limit must be a positive int";
-	const tokenBudget = value.token_budget ?? null;
-	if (tokenBudget !== null && (typeof tokenBudget !== "number" || !Number.isInteger(tokenBudget) || tokenBudget < 0)) return "token_budget must be a non-negative int";
-	if (value.all_projects != null && typeof value.all_projects !== "boolean") return "all_projects must be a boolean";
-	if (value.project != null && (typeof value.project !== "string" || !value.project.trim())) return "project must be a non-empty string";
-	if (value.cwd != null && (typeof value.cwd !== "string" || !value.cwd.trim() || !isAbsolute(value.cwd))) return "cwd must be an absolute path";
-	if (value.working_set_files != null && !Array.isArray(value.working_set_files)) return "working_set_files must be an array of repository-relative strings";
-	const workingSetValues = value.working_set_files ?? [];
-	if (workingSetValues.length > MAX_WORKING_SET_FILES) return `working_set_files must contain at most ${MAX_WORKING_SET_FILES} entries`;
-	const workingSetFiles = [];
-	for (const entry of workingSetValues) {
-		if (typeof entry !== "string") return "working_set_files must be an array of repository-relative strings";
-		const normalized = normalizeWorkingSetPath(entry);
+function packSchemaError(error) {
+	const issue = error.issues[0];
+	if (!issue) return "request body must be an object";
+	if (issue.code !== "unrecognized_keys") return issue.path.length === 0 ? "request body must be an object" : issue.message;
+	const unexpectedKey = issue.keys[0] ?? "unknown";
+	if (issue.path[0] === "attempt") return `ledger metadata contains unsupported field: ${unexpectedKey}`;
+	if (issue.path[0] === "automatic_context") return `automatic_context contains unsupported field: ${unexpectedKey}`;
+	return `request body contains unsupported field: ${unexpectedKey}`;
+}
+function normalizeWorkingSetFiles(values) {
+	const files = [];
+	for (const value of values) {
+		const normalized = normalizeWorkingSetPath(value);
 		if (!normalized) return "working_set_files contains an invalid repository-relative path";
-		if (!workingSetFiles.includes(normalized)) workingSetFiles.push(normalized);
-	}
-	if (value.compact != null && typeof value.compact !== "boolean") return "compact must be a boolean";
-	if (value.compact_detail_count != null && (typeof value.compact_detail_count !== "number" || !Number.isInteger(value.compact_detail_count) || value.compact_detail_count < 0)) return "compact_detail_count must be a non-negative int";
-	let attempt;
-	if (value.attempt != null) {
-		if (!isRecord(value.attempt)) return "attempt must be an object";
-		const attemptError = validateMetadataFields(value.attempt, ATTEMPT_KEYS);
-		if (attemptError) return attemptError;
-		attempt = value.attempt;
-	}
-	const automaticContext = resolveRequestAutomaticContext(value, attempt);
-	if (typeof automaticContext === "string") return automaticContext;
+		if (!files.includes(normalized)) files.push(normalized);
+	}
+	return files;
+}
+function packFilters(request, workingSetFiles) {
 	const filters = {};
-	if (value.all_projects !== true) {
+	if (request.all_projects !== true) {
 		const envProject = process.env.CODEMEM_PROJECT?.trim() || null;
-		const requestCwd = value.cwd;
-		const requestProject = value.project;
-		const project = resolveProject(requestCwd ?? process.cwd(), requestProject ?? (requestCwd == null ? envProject : void 0));
+		const project = resolveProject(request.cwd ?? process.cwd(), request.project ?? (request.cwd == null ? envProject : void 0));
 		if (project) filters.project = project;
 	}
 	if (workingSetFiles.length > 0) filters.working_set_paths = workingSetFiles;
+	return filters;
+}
+function validatePackRequest(value) {
+	const requestUnknownKey = firstUnknownKey(value, packRequestPayloadSchema.shape);
+	if (requestUnknownKey) return `request body contains unsupported field: ${requestUnknownKey}`;
+	if (isRecord(value) && isRecord(value.attempt)) {
+		const attemptEnvelopeError = validateMetadataEnvelope(value.attempt, attemptPayloadSchema.shape);
+		if (attemptEnvelopeError) return attemptEnvelopeError;
+	}
+	const parsed = packRequestPayloadSchema.safeParse(value);
+	if (!parsed.success) return packSchemaError(parsed.error);
+	const request = parsed.data;
+	if (request.attempt) {
+		const attemptPathError = validateMetadataPaths(request.attempt);
+		if (attemptPathError) return attemptPathError;
+	}
+	if (request.cwd != null && !isAbsolute(request.cwd)) return "cwd must be an absolute path";
+	const workingSetFiles = normalizeWorkingSetFiles(request.working_set_files ?? []);
+	if (typeof workingSetFiles === "string") return workingSetFiles;
+	const attempt = request.attempt ?? void 0;
+	const automaticContext = resolveRequestAutomaticContext(request, attempt);
+	if (typeof automaticContext === "string") return automaticContext;
 	return {
-		context,
-		limit,
-		tokenBudget,
-		filters,
-		renderOptions: packRenderOptions(value),
+		context: request.context,
+		limit: request.limit,
+		tokenBudget: request.token_budget,
+		filters: packFilters(request, workingSetFiles),
+		renderOptions: packRenderOptions(request),
 		attempt,
 		automaticContext
 	};
@@ -2439,26 +2516,81 @@ function dispatchLedger(store, payload) {
 	if (payload.retrieval_status !== "skipped" && payload.retrieval_status !== "failed" || typeof payload.failure_code !== "string" || !payload.failure_code || typeof payload.failure_stage !== "string" || !payload.failure_stage) return "record action requires retrieval_status, failure_code, and failure_stage";
 	return recordPromptPackTerminal(store.db, metadata, payload.retrieval_status, payload.failure_code, payload.failure_stage);
 }
+function validateLedgerPayload(value) {
+	if (!isRecord(value)) return {
+		ok: false,
+		status: 400,
+		body: invalidRequest("request body must be an object")
+	};
+	const validationError = validateMetadataEnvelope(value, ledgerPayloadSchema.shape);
+	if (validationError?.startsWith("ledger metadata contains unsupported field:")) return {
+		ok: false,
+		status: 409,
+		body: viewerContractUnsupported()
+	};
+	if (validationError) return {
+		ok: false,
+		status: 400,
+		body: invalidRequest(validationError)
+	};
+	const parsed = ledgerPayloadSchema.safeParse(value);
+	if (!parsed.success) return {
+		ok: false,
+		status: 400,
+		body: invalidRequest(parsed.error.issues[0]?.message ?? "request body must be an object")
+	};
+	const pathError = validateMetadataPaths(parsed.data);
+	if (pathError) return {
+		ok: false,
+		status: 400,
+		body: invalidRequest(pathError)
+	};
+	return {
+		ok: true,
+		payload: parsed.data
+	};
+}
+async function handleLedgerRequest(c, getStore) {
+	const body = await c.req.json().catch(() => INVALID_JSON);
+	if (body === INVALID_JSON) return c.json(invalidRequest("invalid json body"), 400);
+	const validated = validateLedgerPayload(body);
+	if (!validated.ok) return c.json(validated.body, validated.status);
+	try {
+		const store = getStore();
+		const target = validateViewerTarget(store, validated.payload, { requireCurrentIdentity: true });
+		if (!target.ok) return c.json(target.body, target.status);
+		const outcome = dispatchLedger(store, validated.payload);
+		if (typeof outcome === "string") return c.json(invalidRequest(outcome), 400);
+		if (outcome.ok) return c.json(outcome);
+		return c.json(outcome, ledgerFailureStatus(outcome.reason));
+	} catch {
+		return c.json({ error: {
+			code: "ledger_failed",
+			message: "prompt-pack ledger operation failed"
+		} }, 500);
+	}
+}
+function handleProfileRequest(c, getStore) {
+	try {
+		const store = getStore();
+		if (!store.hasCurrentIdentity()) return c.json(viewerIdentityMismatch(), 409);
+		return c.json({
+			service: "codemem-viewer",
+			protocol_version: PROMPT_TRANSPORT_PROTOCOL_RANGE.protocolVersion,
+			min_supported_protocol_version: PROMPT_TRANSPORT_PROTOCOL_RANGE.minSupportedProtocolVersion,
+			db_path: resolve(store.dbPath),
+			identity_target: currentIdentityTarget()
+		});
+	} catch {
+		return c.json({ error: {
+			code: "profile_failed",
+			message: "viewer profile could not be read"
+		} }, 500);
+	}
+}
 function packTransportRoutes(getStore) {
 	const app = new Hono();
-	app.get("/api/prompt-pack-profile", (c) => {
-		try {
-			const store = getStore();
-			if (!store.hasCurrentIdentity()) return c.json(viewerIdentityMismatch(), 409);
-			return c.json({
-				service: "codemem-viewer",
-				protocol_version: PROMPT_TRANSPORT_PROTOCOL_RANGE.protocolVersion,
-				min_supported_protocol_version: PROMPT_TRANSPORT_PROTOCOL_RANGE.minSupportedProtocolVersion,
-				db_path: resolve(store.dbPath),
-				identity_target: currentIdentityTarget()
-			});
-		} catch {
-			return c.json({ error: {
-				code: "profile_failed",
-				message: "viewer profile could not be read"
-			} }, 500);
-		}
-	});
+	app.get("/api/prompt-pack-profile", (c) => handleProfileRequest(c, getStore));
 	app.post("/api/pack", async (c) => {
 		const parsed = await c.req.json().catch(() => INVALID_JSON);
 		if (parsed === INVALID_JSON) return c.json(invalidRequest("invalid json body"), 400);
@@ -2496,100 +2628,17 @@ function packTransportRoutes(getStore) {
 			} }, 500);
 		}
 	});
-	app.post("/api/prompt-pack-ledger", async (c) => {
-		const parsed = await c.req.json().catch(() => INVALID_JSON);
-		if (parsed === INVALID_JSON) return c.json(invalidRequest("invalid json body"), 400);
-		if (!isRecord(parsed)) return c.json(invalidRequest("request body must be an object"), 400);
-		const validationError = validateMetadataFields(parsed, LEDGER_KEYS);
-		if (validationError) {
-			if (validationError.startsWith("ledger metadata contains unsupported field:")) return c.json(viewerContractUnsupported(), 409);
-			return c.json(invalidRequest(validationError), 400);
-		}
-		try {
-			const store = getStore();
-			const target = validateViewerTarget(store, parsed, { requireCurrentIdentity: true });
-			if (!target.ok) return c.json(target.body, target.status);
-			const outcome = dispatchLedger(store, parsed);
-			if (typeof outcome === "string") return c.json(invalidRequest(outcome), 400);
-			if (outcome.ok) return c.json(outcome);
-			return c.json(outcome, ledgerFailureStatus(outcome.reason));
-		} catch {
-			return c.json({ error: {
-				code: "ledger_failed",
-				message: "prompt-pack ledger operation failed"
-			} }, 500);
-		}
-	});
+	app.post("/api/prompt-pack-ledger", (c) => handleLedgerRequest(c, getStore));
 	return app;
 }
 //#endregion
-//#region src/routes/raw-events.ts
-/**
-* Raw events routes — GET & POST /api/raw-events, GET /api/raw-events/status,
-* POST /api/claude-hooks, POST /api/codex-hooks, POST /api/pi-hooks.
-*/
-var DEFAULT_MAX_RAW_EVENTS_BODY_BYTES = 1048576;
-function configuredMaxRawEventsBodyBytes() {
-	const parsed = Number(process.env.CODEMEM_RAW_EVENTS_MAX_BODY_BYTES?.trim() ?? "");
-	return Number.isSafeInteger(parsed) && parsed > 0 ? parsed : DEFAULT_MAX_RAW_EVENTS_BODY_BYTES;
-}
-var MAX_RAW_EVENTS_BODY_BYTES = configuredMaxRawEventsBodyBytes();
-function emptyTranscriptOutcomeCounts() {
-	return {
-		ok: 0,
-		not_provided: 0,
-		path_rejected: 0,
-		unreadable: 0,
-		no_complete_record: 0,
-		no_assistant_record: 0
-	};
-}
-function createTranscriptDiagnostics() {
-	const counts = {
-		claude: emptyTranscriptOutcomeCounts(),
-		codex: emptyTranscriptOutcomeCounts()
-	};
-	return {
-		record(source, outcome) {
-			counts[source][outcome] += 1;
-		},
-		snapshot() {
-			return {
-				scope: "legacy_compatibility_routes",
-				counts: {
-					claude: { ...counts.claude },
-					codex: { ...counts.codex }
-				}
-			};
-		}
-	};
-}
-function transcriptSkipResponse(outcome) {
-	if (outcome !== null && outcome !== "ok") return {
-		inserted: 0,
-		skipped: 1,
-		skip_reason: "transcript_unavailable",
-		skip_detail: outcome
-	};
-	return {
-		inserted: 0,
-		skipped: 1,
-		skip_reason: "unsupported_hook"
-	};
-}
-function claudeTranscriptRoot() {
-	return join(process.env.CLAUDE_CONFIG_DIR?.trim() || join(homedir(), ".claude"), "projects");
-}
-function codexTranscriptRoot() {
-	return join(process.env.CODEX_HOME?.trim() || join(homedir(), ".codex"), "sessions");
-}
-/** Nudge the sweeper safely — never crashes the caller. */
-function nudgeSweeper(sweeper, sessions) {
+//#region src/raw-event-processing.ts
+function nudgeRawEventSessions(sweeper, sessions) {
 	for (const session of sessions) try {
 		sweeper?.nudge(session.streamId, session.source);
 	} catch {}
 }
-async function flushBoundarySessions(sweeper, sessions) {
+async function flushRawEventBoundarySessions(sweeper, sessions) {
 	for (const session of sessions) try {
 		await sweeper?.flushBoundary(session.streamId, session.source);
 	} catch {}
@@ -2606,36 +2655,480 @@ function isClaudeBoundaryEnvelope(envelope) {
 	const hookEventName = meta.hook_event_name;
 	return hookEventName === "SessionEnd" || hookEventName === "Stop";
 }
-var SAFE_INGEST_VALIDATION_ERRORS = /* @__PURE__ */ new Set([
-	"source must be string",
-	"source is required",
-	"source must use 1-64 letters, digits, dots, underscores, or hyphens",
-	"session_stream_id must be string",
-	"session_id must be string",
-	"stream_id must be string",
-	"opencode_session_id must be string",
-	"conflicting session id fields",
-	"invalid session id",
-	"event source conflicts with request source",
-	"session id required",
-	"event_type must be string",
-	"event_type required",
-	"event_type has invalid syntax",
-	"event_id must be string",
-	"event_id required",
-	"event_id has invalid syntax",
-	"event_seq must be int",
-	"ts_wall_ms must be number",
-	"ts_mono_ms must be number",
-	"payload must be an object",
-	"cwd must be string",
-	"project must be string",
-	"started_at must be string",
-	"events must be a list",
-	"event must be an object"
-]);
-function boundedIngestValidationMessage(error) {
-	return SAFE_INGEST_VALIDATION_ERRORS.has(error.message) ? error.message : "invalid raw event request";
+//#endregion
+//#region src/raw-event-inbox.ts
+var INBOX_DIRECTORY_NAME = "viewer-raw-event-inbox";
+var DEFAULT_BATCH_SIZE = 20;
+var DEFAULT_BACKLOG_WARNING_AGE_MS = 3e4;
+var DEFAULT_BACKLOG_WARNING_ENTRIES = 500;
+var DEFAULT_MAX_ENTRIES = 2e3;
+var DEFAULT_RETRY_DELAY_MS = 1e3;
+var MAX_RETRY_DELAY_MS = 3e4;
+var RAW_EVENT_INBOX_FULL_CODE = "raw_event_inbox_full";
+function contentId(serialized) {
+	return createHash("sha256").update(serialized).digest("hex");
+}
+function normalizePositiveInteger(value, fallback) {
+	return Number.isFinite(value) && Number(value) > 0 ? Math.trunc(Number(value)) : fallback;
+}
+function resolveRawEventInboxDirectory(dbPath, homeDir = homedir()) {
+	const target = createHash("sha256").update(resolve(dbPath)).digest("hex").slice(0, 24);
+	return join(homeDir, ".codemem", INBOX_DIRECTORY_NAME, target);
+}
+function entryContent(request, flushBoundary) {
+	return {
+		version: 1,
+		request,
+		flush_boundary: flushBoundary
+	};
+}
+function storedEntry(request, flushBoundary, enqueueOrder) {
+	return {
+		...entryContent(request, flushBoundary),
+		enqueue_order: enqueueOrder.toString()
+	};
+}
+function entryContentId(entry) {
+	return contentId(JSON.stringify(entryContent(entry.request, entry.flushBoundary)));
+}
+function inboxFileName(enqueueOrder, id) {
+	return `${enqueueOrder.toString().padStart(24, "0")}-${id}.json`;
+}
+function parseInboxFileName(name) {
+	const match = /^(\d+)-([a-f0-9]{64})\.json$/u.exec(name);
+	if (!match?.[1] || !match[2]) return null;
+	const enqueueOrder = BigInt(match[1]);
+	if (enqueueOrder < 1n) return null;
+	return {
+		id: match[2],
+		enqueueOrder
+	};
+}
+async function writeDurableFile(path, contents) {
+	const handle = await open(path, "wx", 384);
+	try {
+		await handle.writeFile(contents, { encoding: "utf8" });
+		await handle.sync();
+	} finally {
+		await handle.close();
+	}
+}
+async function syncDirectory(path) {
+	let handle;
+	try {
+		handle = await open(path, "r");
+		await handle.sync();
+	} catch (error) {
+		const code = error.code;
+		if (process.platform === "win32" && [
+			"EISDIR",
+			"EINVAL",
+			"ENOTSUP",
+			"EPERM"
+		].includes(code ?? "")) return;
+		throw error;
+	} finally {
+		await handle?.close();
+	}
+}
+async function ensurePrivateDirectory(path) {
+	const firstCreated = await mkdir(path, {
+		recursive: true,
+		mode: 448
+	});
+	await chmod(path, 448);
+	if (!firstCreated) return;
+	const boundary = dirname(firstCreated);
+	let current = path;
+	while (true) {
+		await syncDirectory(current);
+		if (current === boundary) return;
+		current = dirname(current);
+	}
+}
+function parseStoredEntry(serialized) {
+	const parsed = JSON.parse(serialized);
+	if (parsed.version !== 1 || typeof parsed.enqueue_order !== "string" || !/^[1-9]\d*$/u.test(parsed.enqueue_order) || parsed.request == null || typeof parsed.request !== "object" || Array.isArray(parsed.request) || typeof parsed.flush_boundary !== "boolean") throw new Error("invalid raw-event inbox entry");
+	return {
+		entry: {
+			request: parsed.request,
+			flushBoundary: parsed.flush_boundary
+		},
+		enqueueOrder: BigInt(parsed.enqueue_order)
+	};
+}
+var FileRawEventInbox = class {
+	batchSize;
+	backlogWarningAgeMs;
+	backlogWarningEntries;
+	directory;
+	maxEntries;
+	onDrainError;
+	onDrainRecovered;
+	onCorruptEntries;
+	onBacklog;
+	onBacklogRecovered;
+	processEntry;
+	retryDelayMs;
+	drainPromise = null;
+	degraded = false;
+	backlogDegraded = false;
+	enqueueChain = Promise.resolve();
+	notedCorruptCount = 0;
+	pendingDrainDelayMs = null;
+	nextEnqueueOrder = null;
+	retryCount = 0;
+	timer = null;
+	stopped = false;
+	constructor(options) {
+		this.batchSize = normalizePositiveInteger(options.batchSize, DEFAULT_BATCH_SIZE);
+		this.backlogWarningAgeMs = normalizePositiveInteger(options.backlogWarningAgeMs, DEFAULT_BACKLOG_WARNING_AGE_MS);
+		this.backlogWarningEntries = normalizePositiveInteger(options.backlogWarningEntries, DEFAULT_BACKLOG_WARNING_ENTRIES);
+		this.directory = options.directory;
+		this.maxEntries = normalizePositiveInteger(options.maxEntries, DEFAULT_MAX_ENTRIES);
+		this.onDrainError = options.onDrainError;
+		this.onDrainRecovered = options.onDrainRecovered;
+		this.onCorruptEntries = options.onCorruptEntries;
+		this.onBacklog = options.onBacklog;
+		this.onBacklogRecovered = options.onBacklogRecovered;
+		this.processEntry = options.processEntry;
+		this.retryDelayMs = normalizePositiveInteger(options.retryDelayMs, DEFAULT_RETRY_DELAY_MS);
+	}
+	async enqueue(request, options = {}) {
+		const operation = this.enqueueChain.then(() => this.persist(request, options));
+		this.enqueueChain = operation.catch(() => {});
+		return operation;
+	}
+	async persist(request, options) {
+		const flushBoundary = options.flushBoundary === true;
+		const id = entryContentId({
+			request,
+			flushBoundary
+		});
+		await ensurePrivateDirectory(this.directory);
+		const entries = await readdir(this.directory, { withFileTypes: true });
+		const existingEntry = entries.find((entry) => entry.isFile() && parseInboxFileName(entry.name)?.id === id);
+		if (existingEntry) {
+			const parsedExisting = parseStoredEntry(await readFile(join(this.directory, existingEntry.name), "utf8"));
+			const existingName = parseInboxFileName(existingEntry.name);
+			if (entryContentId(parsedExisting.entry) !== id || existingName?.enqueueOrder !== parsedExisting.enqueueOrder) throw new Error("raw-event inbox entry conflict");
+			await chmod(join(this.directory, existingEntry.name), 384);
+			await syncDirectory(this.directory);
+			this.scheduleDrain();
+			return;
+		}
+		if (entries.filter((entry) => entry.isFile() && entry.name.endsWith(".json")).length >= this.maxEntries) {
+			const error = /* @__PURE__ */ new Error("raw-event inbox is full");
+			error.code = RAW_EVENT_INBOX_FULL_CODE;
+			throw error;
+		}
+		const enqueueOrder = await this.allocateEnqueueOrder(entries);
+		const serialized = JSON.stringify(storedEntry(request, flushBoundary, enqueueOrder));
+		const destination = join(this.directory, inboxFileName(enqueueOrder, id));
+		const temporary = join(this.directory, `.${id}.${process.pid}.${randomUUID()}.tmp`);
+		try {
+			await writeDurableFile(temporary, serialized);
+			try {
+				await link(temporary, destination);
+			} catch (error) {
+				if (error.code !== "EEXIST") throw error;
+				const parsedExisting = parseStoredEntry(await readFile(destination, "utf8"));
+				if (entryContentId(parsedExisting.entry) !== id || parsedExisting.enqueueOrder !== enqueueOrder) throw new Error("raw-event inbox entry conflict");
+			}
+			await chmod(destination, 384);
+		} finally {
+			await rm(temporary, { force: true }).catch(() => {});
+		}
+		await syncDirectory(this.directory);
+		this.scheduleDrain();
+	}
+	async allocateEnqueueOrder(entries) {
+		if (this.nextEnqueueOrder != null) {
+			const order = this.nextEnqueueOrder;
+			this.nextEnqueueOrder += 1n;
+			return order;
+		}
+		let highestOrder = 0n;
+		for (const entry of entries) {
+			if (!entry.isFile() || !entry.name.endsWith(".json")) continue;
+			const parsed = parseInboxFileName(entry.name);
+			if (parsed && parsed.enqueueOrder > highestOrder) highestOrder = parsed.enqueueOrder;
+		}
+		const order = highestOrder + 1n;
+		this.nextEnqueueOrder = order + 1n;
+		return order;
+	}
+	start() {
+		this.scheduleDrain();
+	}
+	async status() {
+		const loaded = await this.loadEntries(Number.POSITIVE_INFINITY);
+		return {
+			pending: loaded.entries.length,
+			corrupt: loaded.corrupt,
+			draining: this.drainPromise != null
+		};
+	}
+	async stop() {
+		this.stopped = true;
+		if (this.timer) clearTimeout(this.timer);
+		this.timer = null;
+		this.pendingDrainDelayMs = null;
+		await this.enqueueChain;
+		await this.drainPromise;
+	}
+	scheduleDrain(delayMs = 0) {
+		if (this.stopped || this.timer) return;
+		if (this.drainPromise) {
+			this.pendingDrainDelayMs = delayMs;
+			return;
+		}
+		this.timer = setTimeout(() => {
+			this.timer = null;
+			if (this.stopped || this.drainPromise) return;
+			this.drainPromise = this.drain().catch((error) => this.handleDrainFailure(error)).finally(() => {
+				this.drainPromise = null;
+				if (this.pendingDrainDelayMs != null) {
+					const pendingDelayMs = this.pendingDrainDelayMs;
+					this.pendingDrainDelayMs = null;
+					this.scheduleDrain(pendingDelayMs);
+				}
+			});
+		}, delayMs);
+		this.timer.unref?.();
+	}
+	async loadEntries(limit) {
+		let directoryEntries;
+		try {
+			directoryEntries = await readdir(this.directory, { withFileTypes: true });
+		} catch (error) {
+			if (error.code === "ENOENT") return {
+				entries: [],
+				corrupt: 0,
+				oldestAgeMs: 0,
+				pending: 0
+			};
+			throw error;
+		}
+		const scan = await this.scanCandidates(directoryEntries);
+		scan.candidates.sort((left, right) => {
+			if (left.enqueueOrder < right.enqueueOrder) return -1;
+			if (left.enqueueOrder > right.enqueueOrder) return 1;
+			return left.id.localeCompare(right.id);
+		});
+		const entries = [];
+		let corrupt = scan.corrupt;
+		for (const candidate of scan.candidates) {
+			if (entries.length >= limit) break;
+			const loadedEntry = await this.loadEntry(candidate);
+			if (!loadedEntry) {
+				corrupt += 1;
+				continue;
+			}
+			entries.push(loadedEntry);
+		}
+		return {
+			entries,
+			corrupt,
+			oldestAgeMs: Number.isFinite(scan.oldestMtimeMs) ? Math.max(0, Date.now() - scan.oldestMtimeMs) : 0,
+			pending: scan.pending
+		};
+	}
+	async scanCandidates(directoryEntries) {
+		const candidates = [];
+		let corrupt = 0;
+		let oldestMtimeMs = Number.POSITIVE_INFINITY;
+		let pending = 0;
+		for (const directoryEntry of directoryEntries) {
+			if (!directoryEntry.isFile() || !directoryEntry.name.endsWith(".json")) continue;
+			const path = join(this.directory, directoryEntry.name);
+			try {
+				const details = await stat(path);
+				pending += 1;
+				oldestMtimeMs = Math.min(oldestMtimeMs, details.mtimeMs);
+				const parsed = parseInboxFileName(directoryEntry.name);
+				if (!parsed) {
+					corrupt += 1;
+					continue;
+				}
+				candidates.push({
+					path,
+					...parsed
+				});
+			} catch {}
+		}
+		return {
+			candidates,
+			corrupt,
+			oldestMtimeMs,
+			pending
+		};
+	}
+	async loadEntry(candidate) {
+		try {
+			const { entry, enqueueOrder } = parseStoredEntry(await readFile(candidate.path, "utf8"));
+			const id = entryContentId(entry);
+			if (candidate.id !== id || candidate.enqueueOrder !== enqueueOrder) return null;
+			return {
+				id,
+				path: candidate.path,
+				entry,
+				enqueueOrder
+			};
+		} catch {
+			return null;
+		}
+	}
+	async drain() {
+		const loaded = await this.loadEntries(this.batchSize);
+		const backlogExceeded = loaded.pending >= this.backlogWarningEntries && loaded.oldestAgeMs >= this.backlogWarningAgeMs;
+		if (backlogExceeded && !this.backlogDegraded) {
+			this.backlogDegraded = true;
+			this.onBacklog?.(loaded.pending, loaded.oldestAgeMs);
+		} else if (!backlogExceeded && this.backlogDegraded) {
+			this.backlogDegraded = false;
+			this.onBacklogRecovered?.();
+		}
+		if (loaded.corrupt !== this.notedCorruptCount) {
+			this.notedCorruptCount = loaded.corrupt;
+			if (loaded.corrupt > 0) this.onCorruptEntries?.(loaded.corrupt);
+		}
+		for (const loadedEntry of loaded.entries) {
+			await this.processEntry(loadedEntry.entry);
+			await rm(loadedEntry.path, { force: true });
+		}
+		this.retryCount = 0;
+		if (this.degraded) {
+			this.degraded = false;
+			this.onDrainRecovered?.();
+		}
+		if (loaded.entries.length > 0) this.scheduleDrain();
+	}
+	handleDrainFailure(error) {
+		if (!this.degraded) {
+			this.degraded = true;
+			this.onDrainError?.(error);
+		}
+		this.retryCount += 1;
+		const delay = Math.min(this.retryDelayMs * 2 ** (this.retryCount - 1), MAX_RETRY_DELAY_MS);
+		this.scheduleDrain(delay);
+	}
+};
+function createViewerRawEventInbox(options) {
+	const store = new MemoryStore(options.dbPath);
+	store.db.pragma("busy_timeout = 25");
+	const inbox = new FileRawEventInbox({
+		directory: resolveRawEventInboxDirectory(options.dbPath, options.homeDir),
+		onDrainError: options.onDrainError,
+		onDrainRecovered: options.onDrainRecovered,
+		onCorruptEntries: options.onCorruptEntries,
+		onBacklog: options.onBacklog,
+		onBacklogRecovered: options.onBacklogRecovered,
+		processEntry: async ({ request, flushBoundary }) => {
+			const result = ingestRawEvents(store, request);
+			nudgeRawEventSessions(options.sweeper, result.sessions);
+			if (flushBoundary && isClaudeBoundaryEnvelope(request)) await flushRawEventBoundarySessions(options.sweeper, result.sessions);
+		}
+	});
+	return {
+		inbox,
+		stop: async () => {
+			await inbox.stop();
+			store.close();
+		}
+	};
+}
+//#endregion
+//#region src/routes/raw-events.ts
+/**
+* Raw events routes — GET & POST /api/raw-events, GET /api/raw-events/status,
+* POST /api/claude-hooks, POST /api/codex-hooks, POST /api/pi-hooks.
+*/
+var DEFAULT_MAX_RAW_EVENTS_BODY_BYTES = 1048576;
+function configuredMaxRawEventsBodyBytes() {
+	const parsed = Number(process.env.CODEMEM_RAW_EVENTS_MAX_BODY_BYTES?.trim() ?? "");
+	return Number.isSafeInteger(parsed) && parsed > 0 ? parsed : DEFAULT_MAX_RAW_EVENTS_BODY_BYTES;
+}
+var MAX_RAW_EVENTS_BODY_BYTES = configuredMaxRawEventsBodyBytes();
+function emptyTranscriptOutcomeCounts() {
+	return {
+		ok: 0,
+		not_provided: 0,
+		path_rejected: 0,
+		unreadable: 0,
+		no_complete_record: 0,
+		no_assistant_record: 0
+	};
+}
+function createTranscriptDiagnostics() {
+	const counts = {
+		claude: emptyTranscriptOutcomeCounts(),
+		codex: emptyTranscriptOutcomeCounts()
+	};
+	return {
+		record(source, outcome) {
+			counts[source][outcome] += 1;
+		},
+		snapshot() {
+			return {
+				scope: "legacy_compatibility_routes",
+				counts: {
+					claude: { ...counts.claude },
+					codex: { ...counts.codex }
+				}
+			};
+		}
+	};
+}
+function transcriptSkipResponse(outcome) {
+	if (outcome !== null && outcome !== "ok") return {
+		inserted: 0,
+		skipped: 1,
+		skip_reason: "transcript_unavailable",
+		skip_detail: outcome
+	};
+	return {
+		inserted: 0,
+		skipped: 1,
+		skip_reason: "unsupported_hook"
+	};
+}
+function claudeTranscriptRoot() {
+	return join(process.env.CLAUDE_CONFIG_DIR?.trim() || join(homedir(), ".claude"), "projects");
+}
+function codexTranscriptRoot() {
+	return join(process.env.CODEX_HOME?.trim() || join(homedir(), ".codex"), "sessions");
+}
+var SAFE_INGEST_VALIDATION_ERRORS = /* @__PURE__ */ new Set([
+	"source must be string",
+	"source is required",
+	"source must use 1-64 letters, digits, dots, underscores, or hyphens",
+	"session_stream_id must be string",
+	"session_id must be string",
+	"stream_id must be string",
+	"opencode_session_id must be string",
+	"conflicting session id fields",
+	"invalid session id",
+	"event source conflicts with request source",
+	"session id required",
+	"event_type must be string",
+	"event_type required",
+	"event_type has invalid syntax",
+	"event_id must be string",
+	"event_id required",
+	"event_id has invalid syntax",
+	"event_seq must be int",
+	"ts_wall_ms must be number",
+	"ts_mono_ms must be number",
+	"payload must be an object",
+	"cwd must be string",
+	"project must be string",
+	"started_at must be string",
+	"events must be a list",
+	"event must be an object"
+]);
+function boundedIngestValidationMessage(error) {
+	return SAFE_INGEST_VALIDATION_ERRORS.has(error.message) ? error.message : "invalid raw event request";
 }
 function boundedIngestErrorResponse(c, error) {
 	if (error instanceof RawEventIngestValidationError) return c.json({ error: boundedIngestValidationMessage(error) }, 400);
@@ -2643,17 +3136,68 @@ function boundedIngestErrorResponse(c, error) {
 	if (process.env.CODEMEM_VIEWER_DEBUG === "1") response.detail = error instanceof Error ? error.message : String(error);
 	return c.json(response, 500);
 }
+function boundedInboxErrorResponse(c, error) {
+	if (error?.code === "raw_event_inbox_full") return c.json({ error: {
+		code: "raw_event_queue_full",
+		message: "raw-event queue is full"
+	} }, 503);
+	return c.json({ error: {
+		code: "raw_event_queue_write_failed",
+		message: "raw-event queue write failed"
+	} }, 503);
+}
 function untargetedPayload(payload) {
 	const { db_path: _dbPath, identity_target: _identityTarget, ...body } = payload;
 	return body;
 }
+async function enqueueRawEventRequest(options) {
+	const target = validateViewerTarget(options.inboxTarget ?? options.getStore(), options.payload, { requirePairedTargets: true });
+	if (!target.ok) return options.c.json(target.body, target.status);
+	const validation = validateRawEvents(options.request);
+	try {
+		await options.inbox.enqueue(validation.request, { flushBoundary: options.flushBoundary });
+	} catch (error) {
+		return boundedInboxErrorResponse(options.c, error);
+	}
+	return options.c.json({
+		accepted: validation.received,
+		queued: validation.received
+	}, 202);
+}
+async function postRawEventRequest(c, getStore, sweeper, inbox, inboxTarget) {
+	const result = await parseJsonObjectBody(c, MAX_RAW_EVENTS_BODY_BYTES);
+	if (result instanceof Response) return result;
+	try {
+		const request = untargetedPayload(result);
+		if (inbox) return await enqueueRawEventRequest({
+			c,
+			getStore,
+			inbox,
+			inboxTarget,
+			payload: result,
+			request,
+			flushBoundary: c.req.header("x-codemem-boundary-flush") === "1"
+		});
+		const store = getStore();
+		const target = validateViewerTarget(store, result, { requirePairedTargets: true });
+		if (!target.ok) return c.json(target.body, target.status);
+		const ingestResult = await ingestNormalizedEnvelope(store, sweeper, request, c.req.header("x-codemem-boundary-flush") === "1");
+		return c.json({
+			inserted: ingestResult.inserted,
+			skipped: ingestResult.skipped,
+			received: ingestResult.received
+		});
+	} catch (error) {
+		return boundedIngestErrorResponse(c, error);
+	}
+}
 async function ingestNormalizedEnvelope(store, sweeper, envelope, flushBoundary = false) {
 	const result = ingestRawEvents(store, envelope);
-	nudgeSweeper(sweeper, result.sessions);
-	if (flushBoundary && isClaudeBoundaryEnvelope(envelope)) await flushBoundarySessions(sweeper, result.sessions);
+	nudgeRawEventSessions(sweeper, result.sessions);
+	if (flushBoundary && isClaudeBoundaryEnvelope(envelope)) await flushRawEventBoundarySessions(sweeper, result.sessions);
 	return result;
 }
-function rawEventsRoutes(getStore, sweeper) {
+function rawEventsRoutes(getStore, sweeper, inbox, inboxTarget) {
 	const app = new Hono();
 	const transcriptDiagnostics = createTranscriptDiagnostics();
 	app.get("/api/raw-events", (c) => {
@@ -2661,8 +3205,17 @@ function rawEventsRoutes(getStore, sweeper) {
 		return c.json(totals);
 	});
 	app.get("/api/raw-events/status", (c) => {
-		const store = getStore();
 		const limit = queryInt(c.req.query("limit"), 25);
+		if (inbox && limit === 0) return c.json({
+			items: [],
+			ingest: {
+				available: true,
+				mode: "durable_queue",
+				max_body_bytes: MAX_RAW_EVENTS_BODY_BYTES
+			},
+			transcript_diagnostics: transcriptDiagnostics.snapshot()
+		});
+		const store = getStore();
 		const items = drizzle(store.db, { schema }).select({
 			source: schema.rawEventSessions.source,
 			stream_id: schema.rawEventSessions.stream_id,
@@ -2688,29 +3241,13 @@ function rawEventsRoutes(getStore, sweeper) {
 			totals,
 			ingest: {
 				available: true,
-				mode: "stream_queue",
+				mode: inbox ? "durable_queue" : "stream_queue",
 				max_body_bytes: MAX_RAW_EVENTS_BODY_BYTES
 			},
 			transcript_diagnostics: transcriptDiagnostics.snapshot()
 		});
 	});
-	app.post("/api/raw-events", async (c) => {
-		const result = await parseJsonObjectBody(c, MAX_RAW_EVENTS_BODY_BYTES);
-		if (result instanceof Response) return result;
-		try {
-			const store = getStore();
-			const target = validateViewerTarget(store, result, { requirePairedTargets: true });
-			if (!target.ok) return c.json(target.body, target.status);
-			const ingestResult = await ingestNormalizedEnvelope(store, sweeper, untargetedPayload(result), c.req.header("x-codemem-boundary-flush") === "1");
-			return c.json({
-				inserted: ingestResult.inserted,
-				skipped: ingestResult.skipped,
-				received: ingestResult.received
-			});
-		} catch (err) {
-			return boundedIngestErrorResponse(c, err);
-		}
-	});
+	app.post("/api/raw-events", (c) => postRawEventRequest(c, getStore, sweeper, inbox, inboxTarget));
 	app.post("/api/claude-hooks", async (c) => {
 		const result = await parseJsonObjectBody(c, MAX_RAW_EVENTS_BODY_BYTES);
 		if (result instanceof Response) return result;
@@ -2919,24 +3456,49 @@ function mapAggregateEvents(rows) {
 		total_tokens_read: row.tokens_read,
 		total_tokens_written: row.tokens_written,
 		total_tokens_saved: row.tokens_saved,
-		count: row.count
+		count: row.count,
+		token_unit: row.token_unit,
+		measured_count: row.measured_count,
+		estimated_count: row.estimated_count,
+		unavailable_count: row.unavailable_count,
+		legacy_text_length_count: row.legacy_text_length_count,
+		legacy_unclassified_count: row.legacy_unclassified_count
 	})).sort((a, b) => a.event.localeCompare(b.event));
 }
-/**
-* Sum the neutral core aggregate rows into the ApiUsageTotals wire shape.
-*/
 function totalsFromAggregate(rows) {
 	return rows.reduce((acc, row) => ({
 		tokens_read: acc.tokens_read + row.tokens_read,
 		tokens_written: acc.tokens_written + row.tokens_written,
 		tokens_saved: acc.tokens_saved + row.tokens_saved,
-		count: acc.count + row.count
+		count: acc.count + row.count,
+		token_unit: "tokens",
+		measured_count: acc.measured_count + row.measured_count,
+		estimated_count: acc.estimated_count + row.estimated_count,
+		unavailable_count: acc.unavailable_count + row.unavailable_count,
+		legacy_text_length_count: acc.legacy_text_length_count + row.legacy_text_length_count,
+		legacy_unclassified_count: acc.legacy_unclassified_count + row.legacy_unclassified_count
 	}), {
 		tokens_read: 0,
 		tokens_written: 0,
 		tokens_saved: 0,
-		count: 0
-	});
+		count: 0,
+		token_unit: "tokens",
+		measured_count: 0,
+		estimated_count: 0,
+		unavailable_count: 0,
+		legacy_text_length_count: 0,
+		legacy_unclassified_count: 0
+	});
+}
+function usageAggregatePayload(store, project) {
+	const globalRows = store.classifiedUsageAggregate();
+	const filteredRows = project ? store.classifiedUsageAggregate(project) : null;
+	return {
+		eventsGlobal: mapAggregateEvents(globalRows),
+		totalsGlobal: totalsFromAggregate(globalRows),
+		eventsFiltered: filteredRows ? mapAggregateEvents(filteredRows) : null,
+		totalsFiltered: filteredRows ? totalsFromAggregate(filteredRows) : null
+	};
 }
 /**
 * Short-lived cache for the computed /api/usage payload.
@@ -3017,120 +3579,657 @@ function scopeVisibilityGeneration(store) {
 		return `bypass-${Date.now()}-${Math.random()}`;
 	}
 }
-function usageCacheKey(store, projectFilter) {
-	const visibilityGeneration = scopeVisibilityGeneration(store);
-	return `${store.dbPath}|${store.actorId}|${store.deviceId}|${projectFilter ?? ""}|${visibilityGeneration}`;
+function usageCacheKey(store, projectFilter) {
+	const visibilityGeneration = scopeVisibilityGeneration(store);
+	return `${store.dbPath}|${store.actorId}|${store.deviceId}|${projectFilter ?? ""}|${visibilityGeneration}`;
+}
+/**
+* Create stats routes. The store factory is called per-request to get a
+* fresh connection (matching the Python viewer pattern).
+*/
+function statsRoutes(getStore) {
+	const app = new Hono();
+	const parseMetadataJson = (value) => {
+		if (typeof value !== "string" || !value.trim()) return null;
+		try {
+			return JSON.parse(value);
+		} catch {
+			return null;
+		}
+	};
+	const RECENTLY_COMPLETED_WINDOW_MS = 12e4;
+	app.get("/api/stats", (c) => {
+		const store = getStore();
+		const jobs = listMaintenanceJobs(store.db);
+		const now = Date.now();
+		const surfacedJobs = sortActiveMaintenanceJobs$1(jobs.filter((job) => {
+			if (job.status === "pending" || job.status === "running" || job.status === "failed") return true;
+			if (job.status === "completed" && job.finished_at) {
+				const finished = Date.parse(job.finished_at);
+				if (Number.isFinite(finished) && now - finished <= RECENTLY_COMPLETED_WINDOW_MS) return true;
+			}
+			return false;
+		})).map((job) => ({
+			kind: job.kind,
+			title: job.title,
+			status: job.status,
+			message: job.message,
+			progress: job.progress,
+			finished_at: job.finished_at,
+			error: job.error
+		}));
+		return c.json({
+			...healthStats(store),
+			viewer_pid: process.pid,
+			maintenance_jobs: surfacedJobs
+		});
+	});
+	app.get("/api/runtime", (c) => {
+		return c.json({ version: VERSION$1 });
+	});
+	app.get("/api/usage", (c) => {
+		const store = getStore();
+		{
+			const projectFilter = c.req.query("project") || null;
+			const cacheKey = usageCacheKey(store, projectFilter);
+			const nowMs = Date.now();
+			const cached = usagePayloadCache.get(cacheKey);
+			if (cached && nowMs < cached.expiresAtMs) return c.json(cached.payload);
+			const aggregates = usageAggregatePayload(store, projectFilter);
+			const RECENT_PACK_SCAN_LIMIT = 200;
+			const loadRecentPackWindow = (project) => {
+				return (project ? store.db.prepare(`SELECT usage_events.id, usage_events.session_id, usage_events.event,
+									usage_events.tokens_read, usage_events.tokens_written, usage_events.tokens_saved,
+									usage_events.created_at, usage_events.metadata_json
+								 FROM usage_events
+								 JOIN sessions ON sessions.id = usage_events.session_id
+								 WHERE sessions.project = ? AND usage_events.event = 'pack'
+								 ORDER BY usage_events.created_at DESC
+								 LIMIT ?`).all(project, RECENT_PACK_SCAN_LIMIT) : store.db.prepare(`SELECT id, session_id, event, tokens_read, tokens_written, tokens_saved,
+									created_at, metadata_json
+								 FROM usage_events
+								 WHERE event = 'pack'
+								 ORDER BY created_at DESC
+								 LIMIT ?`).all(RECENT_PACK_SCAN_LIMIT)).map((row) => toUsageRow(row, parseMetadataJson(row.metadata_json)));
+			};
+			const recentWindow = loadRecentPackWindow(projectFilter);
+			const recentVisibility = buildUsageVisibility(store, recentWindow);
+			const recentPacks = recentWindow.filter((row) => usageRowVisible(row, recentVisibility)).slice(0, 10).map((row) => ({
+				...row,
+				metadata_json: sanitizePackUsageMetadata(row.metadata_json, recentVisibility)
+			}));
+			const payload = {
+				project: projectFilter,
+				events: projectFilter ? aggregates.eventsFiltered : aggregates.eventsGlobal,
+				totals: projectFilter ? aggregates.totalsFiltered : aggregates.totalsGlobal,
+				events_global: aggregates.eventsGlobal,
+				totals_global: aggregates.totalsGlobal,
+				events_filtered: aggregates.eventsFiltered,
+				totals_filtered: aggregates.totalsFiltered,
+				recent_packs: recentPacks
+			};
+			const setAtMs = Date.now();
+			sweepUsagePayloadCache(usagePayloadCache, setAtMs);
+			usagePayloadCache.set(cacheKey, {
+				payload,
+				expiresAtMs: setAtMs + USAGE_PAYLOAD_CACHE_MS
+			});
+			return c.json(payload);
+		}
+	});
+	return app;
+}
+function healthStats(store) {
+	return {
+		...store.stats(),
+		automatic_recall: automaticRecallHealth(store.db, {
+			actorId: store.actorId,
+			deviceId: store.deviceId
+		})
+	};
+}
+//#endregion
+//#region src/application/coordinator-maintenance.ts
+var AUTOMATIC_SHARE_OPERATION_STATES = [
+	"waiting_for_acceptance",
+	"accepted",
+	"provisioning",
+	"initial_sync",
+	"waiting_for_device"
+];
+var AUTOMATIC_WAITING_ACCEPTANCE_RETRY_COOLDOWN_MS = 3e4;
+var AUTOMATIC_WAITING_DEVICE_RETRY_COOLDOWN_MS = 3e5;
+var TERMINAL_SHARE_MAINTENANCE_ERRORS = /* @__PURE__ */ new Set([
+	"coordinator_not_configured",
+	"team_sharing_not_configured",
+	"team_selection_ambiguous",
+	"initiating_device_not_reviewed",
+	"inviter_project_access_ambiguous",
+	"managed_boundary_plan_missing",
+	"operation_device_binding_missing",
+	"operation_intent_invalid",
+	"provisioning_membership_plan_invalid",
+	"device_binding_conflict",
+	"intent_conflict",
+	"inviter_identity_conflict"
+]);
+var PROJECT_INVITE_OWNER_CONFLICT_ERRORS = /* @__PURE__ */ new Set([
+	"operation_scope_mismatch",
+	"operation_state_invalid",
+	"operation_acceptance_invalid",
+	"operation_trust_state_invalid",
+	"operation_intent_invalid",
+	"operation_intent_mismatch",
+	"recipient_fingerprint_mismatch",
+	"recipient_device_identity_conflict",
+	"recipient_actor_conflict",
+	"pending_person_identity_conflict",
+	"device_binding_conflict",
+	"intent_conflict",
+	"inviter_identity_conflict"
+]);
+var TERMINAL_RECONCILIATION_ERRORS = /* @__PURE__ */ new Set([
+	"coordinator_not_configured",
+	"team_sharing_not_configured",
+	"team_selection_ambiguous",
+	"operation_not_found",
+	...PROJECT_INVITE_OWNER_CONFLICT_ERRORS
+]);
+function errorStatus$2(error) {
+	const value = error && typeof error === "object" ? error.status : null;
+	return typeof value === "number" && Number.isInteger(value) && value >= 400 && value <= 599 ? value : null;
+}
+function recordInviteReconciliationFailure(store, operationId, error, now) {
+	const message = error instanceof Error ? error.message : String(error);
+	const safeErrorCode = TERMINAL_RECONCILIATION_ERRORS.has(message) ? message : "operation_read_failed";
+	const status = errorStatus$2(error);
+	const retryable = !TERMINAL_RECONCILIATION_ERRORS.has(message) && (status == null || status === 408 || status === 429 || status >= 500);
+	store.db.prepare(`UPDATE share_operation_steps SET
+			status = CASE WHEN ? = 1 THEN 'pending' ELSE 'failed' END,
+			attempt_count = attempt_count + 1, last_attempt_at = ?, safe_error_code = ?, updated_at = ?
+			WHERE operation_id = ? AND step_key = 'invite_consumption'`).run(retryable ? 1 : 0, now, safeErrorCode, now, operationId);
+	const outcome = retryable ? "retry_scheduled" : "needs_attention";
+	store.db.prepare("UPDATE share_operations SET state = ?, updated_at = ? WHERE operation_id = ?").run(outcome === "needs_attention" ? "needs_attention" : "waiting_for_acceptance", now, operationId);
+	return outcome;
+}
+function pendingShareOperationRows(store, input) {
+	const placeholders = AUTOMATIC_SHARE_OPERATION_STATES.map(() => "?").join(", ");
+	const waitingAcceptanceRetryBefore = (/* @__PURE__ */ new Date(input.maintenanceNow.getTime() - AUTOMATIC_WAITING_ACCEPTANCE_RETRY_COOLDOWN_MS)).toISOString();
+	const waitingRetryBefore = (/* @__PURE__ */ new Date(input.maintenanceNow.getTime() - AUTOMATIC_WAITING_DEVICE_RETRY_COOLDOWN_MS)).toISOString();
+	return store.db.prepare(`SELECT operation.operation_id FROM share_operations AS operation
+		 WHERE operation.inviter_actor_id = ?
+		 AND operation.state IN (${placeholders})
+		 AND (operation.state <> 'waiting_for_acceptance' OR operation.updated_at <= ?)
+		 AND (
+			operation.state <> 'waiting_for_device'
+			OR operation.updated_at <= ?
+			OR (
+				NOT EXISTS (
+					SELECT 1 FROM share_operation_steps AS step
+					WHERE step.operation_id = operation.operation_id
+					AND step.step_key = 'capability_preflight'
+					AND step.status <> 'completed'
+					AND (
+						step.status = 'running'
+						OR step.safe_error_code IN (
+							'waiting_for_device', 'device_offline', 'recipient_offline'
+						)
+					)
+				)
+				AND EXISTS (
+					SELECT 1 FROM sync_attempts AS attempt
+					WHERE attempt.id = (
+						SELECT latest.id FROM sync_attempts AS latest
+						WHERE latest.peer_device_id = operation.recipient_device_id
+						ORDER BY latest.started_at DESC, latest.id DESC
+						LIMIT 1
+					)
+					AND attempt.ok = 1
+					AND julianday(COALESCE(attempt.finished_at, attempt.started_at)) >
+						julianday(operation.updated_at)
+				)
+			)
+		 )
+		 ORDER BY CASE WHEN operation.state IN ('accepted', 'provisioning', 'initial_sync') THEN 0 ELSE 1 END,
+			CASE WHEN operation.state IN ('waiting_for_acceptance', 'waiting_for_device')
+				THEN operation.updated_at ELSE operation.created_at END ASC,
+			operation.created_at ASC, operation.operation_id ASC
+		 LIMIT ?`).all(store.actorId, ...AUTOMATIC_SHARE_OPERATION_STATES, waitingAcceptanceRetryBefore, waitingRetryBefore, input.limit);
+}
+function recordPendingShareFailure(store, result, operationId, error, now) {
+	const message = error instanceof Error ? error.message : String(error);
+	const state = store.db.prepare("SELECT state FROM share_operations WHERE operation_id = ?").pluck().get(operationId);
+	if (state === "cancelled") {
+		result.items.push({
+			operationId,
+			outcome: "superseded"
+		});
+		return;
+	}
+	if (message === "waiting_for_device" || state === "waiting_for_device") {
+		result.waiting += 1;
+		result.items.push({
+			operationId,
+			outcome: "waiting_for_device"
+		});
+		return;
+	}
+	if (state === "needs_attention") {
+		result.attention += 1;
+		result.items.push({
+			operationId,
+			outcome: "needs_attention",
+			error: message
+		});
+		return;
+	}
+	if (state === "waiting_for_acceptance") {
+		const outcome = recordInviteReconciliationFailure(store, operationId, error, now);
+		if (outcome === "needs_attention") result.attention += 1;
+		else result.waiting += 1;
+		result.items.push({
+			operationId,
+			outcome,
+			error: message
+		});
+		return;
+	}
+	if (TERMINAL_SHARE_MAINTENANCE_ERRORS.has(message)) {
+		store.db.prepare("UPDATE share_operations SET state = 'needs_attention', updated_at = ? WHERE operation_id = ?").run(now, operationId);
+		result.attention += 1;
+		result.items.push({
+			operationId,
+			outcome: "needs_attention",
+			error: message
+		});
+		return;
+	}
+	result.failed += 1;
+	result.items.push({
+		operationId,
+		outcome: "failed",
+		error: message
+	});
+}
+async function processPendingShareOperation(store, result, operationId, advanceOperation, now) {
+	result.processed += 1;
+	try {
+		const advanced = await advanceOperation(store, operationId);
+		if (advanced.advanced) {
+			result.advanced += 1;
+			result.items.push({
+				operationId,
+				outcome: "advanced"
+			});
+			return;
+		}
+		if (advanced.state === "cancelled") {
+			result.items.push({
+				operationId,
+				outcome: "superseded"
+			});
+			return;
+		}
+		store.db.prepare("UPDATE share_operations SET updated_at = ? WHERE operation_id = ?").run(now, operationId);
+		result.waiting += 1;
+		result.items.push({
+			operationId,
+			outcome: "waiting_for_acceptance"
+		});
+	} catch (error) {
+		recordPendingShareFailure(store, result, operationId, error, now);
+	}
+}
+async function advancePendingProjectSharesOperation(store, options) {
+	const limit = Math.max(1, Math.min(Math.trunc(options.limit ?? 3), 10));
+	const maintenanceNow = options.now ?? /* @__PURE__ */ new Date();
+	const rows = pendingShareOperationRows(store, {
+		limit,
+		maintenanceNow
+	});
+	const result = {
+		processed: 0,
+		advanced: 0,
+		waiting: 0,
+		attention: 0,
+		failed: 0,
+		items: []
+	};
+	const now = maintenanceNow.toISOString();
+	for (const row of rows) await processPendingShareOperation(store, result, row.operation_id, options.advanceOperation, now);
+	return result;
 }
-/**
-* Create stats routes. The store factory is called per-request to get a
-* fresh connection (matching the Python viewer pattern).
-*/
-function statsRoutes(getStore) {
-	const app = new Hono();
-	const parseMetadataJson = (value) => {
-		if (typeof value !== "string" || !value.trim()) return null;
+var RECIPIENT_POLICY_MAINTENANCE_MAX_LIMIT = 10;
+var RECIPIENT_POLICY_MAINTENANCE_DEFAULT_LIMIT = 3;
+var RECIPIENT_POLICY_MAINTENANCE_BACKOFF_MS = 6e4;
+async function reconcileRecipientPolicyProjectsOperation(store, options) {
+	const limit = Math.max(1, Math.min(Math.trunc(options.limit ?? RECIPIENT_POLICY_MAINTENANCE_DEFAULT_LIMIT), RECIPIENT_POLICY_MAINTENANCE_MAX_LIMIT));
+	const maintenanceNow = options.now ?? /* @__PURE__ */ new Date();
+	const backoffMs = Math.max(0, Math.trunc(options.backoffMs ?? RECIPIENT_POLICY_MAINTENANCE_BACKOFF_MS));
+	const retryBefore = new Date(maintenanceNow.getTime() - backoffMs).toISOString();
+	const rows = store.db.prepare(`WITH projects AS (
+				SELECT DISTINCT canonical_project_identity FROM project_recipients
+				UNION
+				SELECT canonical_project_identity FROM recipient_policy_authority_states
+			)
+			 SELECT projects.canonical_project_identity
+			 FROM projects
+			 LEFT JOIN recipient_policy_authority_states authority
+			  ON authority.canonical_project_identity = projects.canonical_project_identity
+			 WHERE authority.safe_error_code IS NULL OR authority.last_attempt_at IS NULL
+			  OR authority.last_attempt_at <= ?
+			 ORDER BY CASE WHEN authority.last_attempt_at IS NULL THEN 0 ELSE 1 END,
+			  authority.last_attempt_at, projects.canonical_project_identity
+			 LIMIT ?`).all(retryBefore, limit);
+	const reconcileProject = options.reconcileProject ?? reconcileRecipientPolicyProject;
+	const result = {
+		processed: 0,
+		active: 0,
+		waiting: 0,
+		attention: 0,
+		failed: 0,
+		items: []
+	};
+	for (const row of rows) {
+		result.processed += 1;
 		try {
-			return JSON.parse(value);
+			const outcome = await reconcileProject(store.db, {
+				canonicalProjectIdentity: row.canonical_project_identity,
+				leaseOwner: options.leaseOwner ?? `recipient-policy-maintenance:${store.deviceId || process.pid}`
+			}, options.effects);
+			if (outcome.status === "active") result.active += 1;
+			else if (outcome.status === "needs_attention") result.attention += 1;
+			else result.waiting += 1;
+			result.items.push({
+				canonicalProjectIdentity: row.canonical_project_identity,
+				status: outcome.status,
+				safeErrorCode: outcome.safeErrorCode
+			});
 		} catch {
-			return null;
-		}
-	};
-	const RECENTLY_COMPLETED_WINDOW_MS = 12e4;
-	app.get("/api/stats", (c) => {
-		const store = getStore();
-		const jobs = listMaintenanceJobs(store.db);
-		const now = Date.now();
-		const surfacedJobs = sortActiveMaintenanceJobs$1(jobs.filter((job) => {
-			if (job.status === "pending" || job.status === "running" || job.status === "failed") return true;
-			if (job.status === "completed" && job.finished_at) {
-				const finished = Date.parse(job.finished_at);
-				if (Number.isFinite(finished) && now - finished <= RECENTLY_COMPLETED_WINDOW_MS) return true;
-			}
-			return false;
-		})).map((job) => ({
-			kind: job.kind,
-			title: job.title,
-			status: job.status,
-			message: job.message,
-			progress: job.progress,
-			finished_at: job.finished_at,
-			error: job.error
-		}));
-		return c.json({
-			...healthStats(store),
-			viewer_pid: process.pid,
-			maintenance_jobs: surfacedJobs
-		});
-	});
-	app.get("/api/runtime", (c) => {
-		return c.json({ version: VERSION$1 });
-	});
-	app.get("/api/usage", (c) => {
-		const store = getStore();
-		{
-			const projectFilter = c.req.query("project") || null;
-			const cacheKey = usageCacheKey(store, projectFilter);
-			const nowMs = Date.now();
-			const cached = usagePayloadCache.get(cacheKey);
-			if (cached && nowMs < cached.expiresAtMs) return c.json(cached.payload);
-			const globalAggregate = store.usageAggregate();
-			const eventsGlobal = mapAggregateEvents(globalAggregate);
-			const totalsGlobal = totalsFromAggregate(globalAggregate);
-			const filteredAggregate = projectFilter ? store.usageAggregate(projectFilter) : null;
-			const eventsFiltered = filteredAggregate ? mapAggregateEvents(filteredAggregate) : null;
-			const totalsFiltered = filteredAggregate ? totalsFromAggregate(filteredAggregate) : null;
-			const RECENT_PACK_SCAN_LIMIT = 200;
-			const loadRecentPackWindow = (project) => {
-				return (project ? store.db.prepare(`SELECT usage_events.id, usage_events.session_id, usage_events.event,
-									usage_events.tokens_read, usage_events.tokens_written, usage_events.tokens_saved,
-									usage_events.created_at, usage_events.metadata_json
-								 FROM usage_events
-								 JOIN sessions ON sessions.id = usage_events.session_id
-								 WHERE sessions.project = ? AND usage_events.event = 'pack'
-								 ORDER BY usage_events.created_at DESC
-								 LIMIT ?`).all(project, RECENT_PACK_SCAN_LIMIT) : store.db.prepare(`SELECT id, session_id, event, tokens_read, tokens_written, tokens_saved,
-									created_at, metadata_json
-								 FROM usage_events
-								 WHERE event = 'pack'
-								 ORDER BY created_at DESC
-								 LIMIT ?`).all(RECENT_PACK_SCAN_LIMIT)).map((row) => toUsageRow(row, parseMetadataJson(row.metadata_json)));
-			};
-			const recentWindow = loadRecentPackWindow(projectFilter);
-			const recentVisibility = buildUsageVisibility(store, recentWindow);
-			const recentPacks = recentWindow.filter((row) => usageRowVisible(row, recentVisibility)).slice(0, 10).map((row) => ({
-				...row,
-				metadata_json: sanitizePackUsageMetadata(row.metadata_json, recentVisibility)
-			}));
-			const payload = {
-				project: projectFilter,
-				events: projectFilter ? eventsFiltered : eventsGlobal,
-				totals: projectFilter ? totalsFiltered : totalsGlobal,
-				events_global: eventsGlobal,
-				totals_global: totalsGlobal,
-				events_filtered: eventsFiltered,
-				totals_filtered: totalsFiltered,
-				recent_packs: recentPacks
-			};
-			const setAtMs = Date.now();
-			sweepUsagePayloadCache(usagePayloadCache, setAtMs);
-			usagePayloadCache.set(cacheKey, {
-				payload,
-				expiresAtMs: setAtMs + USAGE_PAYLOAD_CACHE_MS
+			result.failed += 1;
+			result.items.push({
+				canonicalProjectIdentity: row.canonical_project_identity,
+				status: "failed",
+				safeErrorCode: "recipient_policy_reconciliation_failed"
 			});
-			return c.json(payload);
 		}
-	});
-	return app;
+	}
+	return result;
 }
-function healthStats(store) {
+//#endregion
+//#region src/application/sync-status.ts
+function traceSync(label, operation) {
+	if (process.env.CODEMEM_TRACE_SYNC_STATUS !== "1") return operation();
+	const startedAt = Date.now();
+	console.warn(`[codemem sync-status] ${label} start`);
+	try {
+		return operation();
+	} finally {
+		console.warn(`[codemem sync-status] ${label} ${Date.now() - startedAt}ms`);
+	}
+}
+function readRetentionState(store) {
+	try {
+		return traceSync("retentionState", () => drizzle(store.db, { schema }).select().from(schema.syncRetentionState).where(eq(schema.syncRetentionState.id, 1)).get());
+	} catch {
+		return;
+	}
+}
+function readStatusRows(store) {
+	const d = drizzle(store.db, { schema });
+	const device = traceSync("deviceRow", () => d.select({
+		device_id: schema.syncDevice.device_id,
+		fingerprint: schema.syncDevice.fingerprint
+	}).from(schema.syncDevice).limit(1).get());
+	const daemon = traceSync("daemonState", () => d.select().from(schema.syncDaemonState).where(eq(schema.syncDaemonState.id, 1)).get());
+	const peerCount = traceSync("peerCountRow", () => d.select({ total: count() }).from(schema.syncPeers).get());
+	const retention = readRetentionState(store);
+	const lastSync = traceSync("lastSyncRow", () => d.select({ last_sync_at: max(schema.syncPeers.last_sync_at) }).from(schema.syncPeers).get());
 	return {
-		...store.stats(),
-		automatic_recall: automaticRecallHealth(store.db, {
-			actorId: store.actorId,
-			deviceId: store.deviceId
-		})
+		device,
+		daemon,
+		peerCount: Number(peerCount?.total ?? 0),
+		retention,
+		lastSyncAt: lastSync?.last_sync_at ?? null
+	};
+}
+function enrollmentIssueStatus(store, showDiagnostics) {
+	const summary = traceSync("coordinatorEnrollmentIssues", () => getCoordinatorEnrollmentReconciliationIssueSummary(store.db));
+	if (!showDiagnostics) return { counts: summary.counts };
+	return {
+		counts: summary.counts,
+		issues: summary.issues.map((issue) => ({
+			coordinator_id: issue.coordinatorId,
+			group_id: issue.groupId,
+			kind: issue.kind,
+			reference_id: issue.referenceId,
+			code: issue.code,
+			status: issue.status,
+			first_seen_at: issue.firstSeenAt,
+			last_seen_at: issue.lastSeenAt,
+			resolved_at: issue.resolvedAt,
+			occurrence_count: issue.occurrenceCount,
+			updated_at: issue.updatedAt
+		}))
 	};
 }
+function initialDaemonState(config, rows, daemonRunning) {
+	if (!config.syncEnabled) return "disabled";
+	const lastError = rows.daemon?.last_error;
+	const lastErrorAt = rows.daemon?.last_error_at;
+	const lastOkAt = rows.daemon?.last_ok_at;
+	if (lastError && (!lastOkAt || String(lastOkAt) < String(lastErrorAt ?? ""))) return "error";
+	if (!daemonRunning) return "stopped";
+	return "ok";
+}
+function retentionPayload(config, rows, retainedFloor) {
+	const state = rows.retention;
+	return {
+		enabled: config.syncRetentionEnabled,
+		max_age_days: config.syncRetentionMaxAgeDays,
+		max_size_mb: config.syncRetentionMaxSizeMb,
+		retained_floor_cursor: retainedFloor ?? state?.retained_floor_cursor ?? null,
+		last_run_at: state?.last_run_at ?? null,
+		last_duration_ms: typeof state?.last_duration_ms === "number" ? state.last_duration_ms : null,
+		last_deleted_ops: typeof state?.last_deleted_ops === "number" ? state.last_deleted_ops : null,
+		last_estimated_bytes_before: typeof state?.last_estimated_bytes_before === "number" ? state.last_estimated_bytes_before : null,
+		last_estimated_bytes_after: typeof state?.last_estimated_bytes_after === "number" ? state.last_estimated_bytes_after : null,
+		last_error: state?.last_error ?? null,
+		last_error_at: state?.last_error_at ?? null
+	};
+}
+function addDiagnosticStatusFields(payload, config, rows) {
+	payload.device_id = rows.device?.device_id ?? null;
+	payload.fingerprint = rows.device?.fingerprint ?? null;
+	payload.bind = `${config.syncHost}:${config.syncPort}`;
+	payload.daemon_last_error = rows.daemon?.last_error ?? null;
+	payload.daemon_last_error_at = rows.daemon?.last_error_at ?? null;
+	payload.daemon_last_ok_at = rows.daemon?.last_ok_at ?? null;
+}
+function buildBasePayload(input, config, rows, daemon, retainedFloor, semanticIndex, enrollmentIssues) {
+	const payload = {
+		enabled: config.syncEnabled,
+		interval_s: config.syncIntervalS,
+		retention: retentionPayload(config, rows, retainedFloor),
+		semantic_index: semanticIndex,
+		coordinator_enrollment_reconciliation_issues: enrollmentIssues,
+		peer_count: rows.peerCount,
+		last_sync_at: rows.lastSyncAt,
+		daemon_state: daemon.state,
+		daemon_running: daemon.running,
+		daemon_detail: daemon.detail,
+		project_filter_active: config.syncProjectsInclude.length > 0 || config.syncProjectsExclude.length > 0,
+		project_filter: {
+			include: config.syncProjectsInclude,
+			exclude: config.syncProjectsExclude
+		},
+		cleanup_diagnostics: input.operations.cleanupDiagnostics(input.store, rows.device?.device_id ?? null, input.showDiagnostics),
+		redacted: !input.showDiagnostics
+	};
+	if (input.showDiagnostics) addDiagnosticStatusFields(payload, config, rows);
+	return payload;
+}
+function readBaseStatus(input) {
+	const config = traceSync("readCoordinatorSyncConfig", () => readCoordinatorSyncConfig());
+	const reset = traceSync("getSyncResetState", () => getSyncResetState(input.store.db));
+	const rows = readStatusRows(input.store);
+	const semanticIndex = traceSync("semanticIndex", () => input.operations.redactSemanticIndexDiagnostics(getSemanticIndexDiagnostics(input.store.db), input.showDiagnostics));
+	const enrollmentIssues = enrollmentIssueStatus(input.store, input.showDiagnostics);
+	const binding = traceSync("readViewerBinding", () => input.operations.readViewerBinding(input.store.dbPath));
+	const running = Boolean(binding);
+	const detail = binding ? `viewer pidfile at ${binding.host}:${binding.port}` : null;
+	let state = initialDaemonState(config, rows, running);
+	const statusPayload = buildBasePayload(input, config, rows, {
+		state,
+		running,
+		detail
+	}, reset.retained_floor_cursor ?? null, semanticIndex, enrollmentIssues);
+	const runtime = input.getSyncRuntimeStatus?.() ?? null;
+	if (runtime?.phase && runtime.phase !== "running") {
+		state = runtime.phase;
+		statusPayload.daemon_state = state;
+		statusPayload.daemon_running = runtime.phase === "starting" || running;
+		statusPayload.daemon_detail = runtime.detail ?? detail;
+	}
+	return {
+		config,
+		localDeviceId: rows.device?.device_id ?? null,
+		statusPayload,
+		daemonState: state,
+		daemonRunning: running,
+		daemonDetail: detail
+	};
+}
+function readPeerStatus(input, localDeviceId) {
+	const rows = traceSync("peerRows", () => input.store.db.prepare(PEERS_QUERY$1).all());
+	const recentOperations = traceSync("recentPeerOps", () => input.operations.recentPeerOps(input.store));
+	const scopeRejections = traceSync("recentScopeRejectionsByPeer", () => input.operations.recentScopeRejectionsByPeer(input.store));
+	const items = rows.map((row) => {
+		const peer = input.operations.mapPeerRow(input.store, row, input.showDiagnostics, recentOperations, scopeRejections, localDeviceId);
+		peer.status = input.operations.peerStatus(peer);
+		return peer;
+	});
+	const byId = {};
+	for (const peer of items) byId[String(peer.peer_device_id)] = peer.status;
+	return {
+		items,
+		byId
+	};
+}
+function readAttemptRows(store) {
+	return traceSync("attemptRows", () => drizzle(store.db, { schema }).select({
+		peer_device_id: schema.syncAttempts.peer_device_id,
+		ok: schema.syncAttempts.ok,
+		error: schema.syncAttempts.error,
+		started_at: schema.syncAttempts.started_at,
+		finished_at: schema.syncAttempts.finished_at,
+		ops_in: schema.syncAttempts.ops_in,
+		ops_out: schema.syncAttempts.ops_out,
+		local_sync_capability: schema.syncAttempts.local_sync_capability,
+		peer_sync_capability: schema.syncAttempts.peer_sync_capability,
+		negotiated_sync_capability: schema.syncAttempts.negotiated_sync_capability
+	}).from(schema.syncAttempts).orderBy(desc(schema.syncAttempts.finished_at)).limit(25).all());
+}
+function readPeerAddressMap(store) {
+	const rows = traceSync("peerAddressRows", () => store.db.prepare("SELECT peer_device_id, addresses_json FROM sync_peers").all());
+	const addressesByPeer = /* @__PURE__ */ new Map();
+	for (const row of rows) {
+		const addresses = safeJsonList(row.addresses_json);
+		if (addresses.length) addressesByPeer.set(String(row.peer_device_id ?? ""), addresses);
+	}
+	return addressesByPeer;
+}
+function readAttemptStatus(input) {
+	const rows = readAttemptRows(input.store);
+	const addressesByPeer = readPeerAddressMap(input.store);
+	return {
+		items: rows.map((row) => input.operations.mapSyncAttemptRow(row, input.showDiagnostics, input.showDiagnostics ? addressesByPeer.get(String(row.peer_device_id ?? "")) : void 0)),
+		latestError: String(rows[0]?.error || "").trim()
+	};
+}
+function peerStates(peers) {
+	return new Set(peers.items.map((peer) => String(peer.status?.peer_state ?? "")));
+}
+function allPeersOffline(peers) {
+	return peers.items.length > 0 && peers.items.every((peer) => String(peer.status?.peer_state ?? "") === "offline");
+}
+function degradedDaemonState(input, peers, attempts) {
+	const states = peerStates(peers);
+	const allOffline = allPeersOffline(peers);
+	if (Boolean(attempts.items[0] && attempts.items[0].status === "error" && input.operations.isRecentIso(attempts.items[0].finished_at))) {
+		if (states.has("online") || states.has("degraded")) return "degraded";
+		if (allOffline) return "offline-peers";
+		if (peers.items.length > 0) return "stale";
+	}
+	if (states.has("degraded")) return "degraded";
+	if (allOffline) return "offline-peers";
+	if (peers.items.length > 0 && !states.has("online")) return "stale";
+	return "ok";
+}
+function applyDerivedDaemonState(input, base, peers, attempts, statusBlock) {
+	let state = base.daemonState;
+	if (state === "ok" && attempts.latestError.startsWith("needs_attention:")) {
+		state = "needs_attention";
+		const detail = attempts.latestError.replace(/^needs_attention:/, "");
+		base.statusPayload.daemon_detail = detail;
+		statusBlock.daemon_detail = detail;
+	} else if (state === "ok") state = degradedDaemonState(input, peers, attempts);
+	base.statusPayload.daemon_state = state;
+	statusBlock.daemon_state = state;
+}
+async function readJoinRequests(input, config) {
+	if (!input.includeJoinRequests || !input.showDiagnostics || !config.syncCoordinatorAdminSecret) return [];
+	try {
+		return await listCoordinatorJoinRequests(config);
+	} catch {
+		return [];
+	}
+}
+async function buildSyncStatusResponse(input) {
+	const base = readBaseStatus(input);
+	const coordinatorSnapshot = await coordinatorStatusSnapshot(input.store, base.config);
+	const coordinator = traceSync("coordinator", () => input.operations.redactCoordinatorStatus(coordinatorSnapshot, input.showDiagnostics));
+	const peers = readPeerStatus(input, base.localDeviceId);
+	const attempts = readAttemptStatus(input);
+	const statusBlock = {
+		...base.statusPayload,
+		background_maintenance: input.operations.summarizeMaintenanceJobs(listMaintenanceJobs(input.store.db), input.showDiagnostics),
+		peers: peers.byId,
+		pending: 0,
+		sync: {},
+		ping: {}
+	};
+	const legacyDevices = traceSync("legacyDevices", () => input.store.claimableLegacyDeviceIds());
+	const legacyReview = traceSync("legacySharedReview", () => input.operations.legacySharedReviewSummary(input.store));
+	const sharingReview = traceSync("sharingReview", () => input.store.sharingReviewSummary(input.project));
+	const recipientPolicyReconciliation = traceSync("recipientPolicyReconciliation", () => input.operations.listRecipientPolicyReconciliationStatus(input.store));
+	const joinRequests = await readJoinRequests(input, base.config);
+	applyDerivedDaemonState(input, base, peers, attempts, statusBlock);
+	const response = {
+		...base.statusPayload,
+		status: statusBlock,
+		peers: peers.items,
+		attempts: attempts.items.slice(0, 5),
+		legacy_devices: legacyDevices,
+		legacy_shared_review: legacyReview,
+		sharing_review: sharingReview,
+		recipient_policy_reconciliation: recipientPolicyReconciliation,
+		coordinator
+	};
+	if (input.includeJoinRequests && input.showDiagnostics) response.join_requests = joinRequests;
+	return response;
+}
+var PEERS_QUERY$1 = `
+	SELECT p.peer_device_id, p.name, p.pinned_fingerprint, p.addresses_json,
+	       p.last_seen_at, p.last_sync_at, p.last_error,
+	       p.runtime_version, p.runtime_version_observed_at,
+	       p.projects_include_json, p.projects_exclude_json, p.claimed_local_actor,
+	       p.actor_id, p.discovered_via_coordinator_id, p.discovered_via_group_id,
+	       a.display_name AS actor_display_name
+	FROM sync_peers AS p
+	LEFT JOIN actors AS a ON a.actor_id = p.actor_id
+	ORDER BY name, peer_device_id
+`;
 //#endregion
 //#region src/routes/team-setup-view.ts
 var enabled = {
@@ -5165,18 +6264,31 @@ async function maybeGrantDefaultSpaceOnJoin(opts) {
 		adminSecret: opts.config.syncCoordinatorAdminSecret || null
 	});
 }
+function configuredGroups(config) {
+	const rawGroups = config.sync_coordinator_groups;
+	if (Array.isArray(rawGroups)) return rawGroups.map((group) => String(group).trim()).filter(Boolean);
+	if (typeof rawGroups === "string") return rawGroups.split(",").map((group) => group.trim()).filter(Boolean);
+	if (typeof config.sync_coordinator_group === "string" && config.sync_coordinator_group.trim()) return [config.sync_coordinator_group.trim()];
+	return [];
+}
 function removeConfiguredCoordinatorGroup(groupId) {
 	const targetGroup = groupId.trim();
 	if (!targetGroup) return [];
-	const config = readCodememConfigFile();
-	const rawGroups = config.sync_coordinator_groups;
-	const groups = Array.isArray(rawGroups) ? rawGroups.map((group) => String(group).trim()).filter(Boolean) : typeof rawGroups === "string" ? rawGroups.split(",").map((group) => group.trim()).filter(Boolean) : typeof config.sync_coordinator_group === "string" && config.sync_coordinator_group.trim() ? [config.sync_coordinator_group.trim()] : [];
-	const nextGroups = groups.filter((group) => group !== targetGroup);
-	if (nextGroups.length === groups.length) return groups;
-	config.sync_coordinator_groups = nextGroups;
-	if (nextGroups.length) config.sync_coordinator_group = nextGroups[0];
-	else delete config.sync_coordinator_group;
-	writeCodememConfigFile(config);
+	let nextGroups = [];
+	mutateCodememConfigFile((config) => {
+		const groups = configuredGroups(config);
+		nextGroups = groups.filter((group) => group !== targetGroup);
+		const configuredGroup = String(config.sync_coordinator_group ?? "").trim();
+		const removesPluralGroup = nextGroups.length !== groups.length;
+		const removesSingularGroup = configuredGroup === targetGroup;
+		if (!removesPluralGroup && !removesSingularGroup) return void 0;
+		config.sync_coordinator_groups = nextGroups;
+		if (removesSingularGroup) {
+			if (nextGroups.length) config.sync_coordinator_group = nextGroups[0];
+			else delete config.sync_coordinator_group;
+		}
+		return config;
+	});
 	return nextGroups;
 }
 function coordinatorAdminUnavailable(status) {
@@ -5892,57 +7004,12 @@ async function advanceProjectShareOperation(store, operationId) {
 	if ((await executeProjectShareProvisioning(store, operationId)).superseded) return {
 		advanced: false,
 		state: "cancelled"
-	};
-	return {
-		advanced: true,
-		state: "active"
-	};
-}
-var AUTOMATIC_SHARE_OPERATION_STATES = [
-	"waiting_for_acceptance",
-	"accepted",
-	"provisioning",
-	"initial_sync",
-	"waiting_for_device"
-];
-var AUTOMATIC_WAITING_ACCEPTANCE_RETRY_COOLDOWN_MS = 3e4;
-var AUTOMATIC_WAITING_DEVICE_RETRY_COOLDOWN_MS = 3e5;
-var TERMINAL_SHARE_MAINTENANCE_ERRORS = /* @__PURE__ */ new Set([
-	"coordinator_not_configured",
-	"team_sharing_not_configured",
-	"team_selection_ambiguous",
-	"initiating_device_not_reviewed",
-	"inviter_project_access_ambiguous",
-	"managed_boundary_plan_missing",
-	"operation_device_binding_missing",
-	"operation_intent_invalid",
-	"provisioning_membership_plan_invalid",
-	"device_binding_conflict",
-	"intent_conflict",
-	"inviter_identity_conflict"
-]);
-var PROJECT_INVITE_OWNER_CONFLICT_ERRORS = /* @__PURE__ */ new Set([
-	"operation_scope_mismatch",
-	"operation_state_invalid",
-	"operation_acceptance_invalid",
-	"operation_trust_state_invalid",
-	"operation_intent_invalid",
-	"operation_intent_mismatch",
-	"recipient_fingerprint_mismatch",
-	"recipient_device_identity_conflict",
-	"recipient_actor_conflict",
-	"pending_person_identity_conflict",
-	"device_binding_conflict",
-	"intent_conflict",
-	"inviter_identity_conflict"
-]);
-var TERMINAL_RECONCILIATION_ERRORS = /* @__PURE__ */ new Set([
-	"coordinator_not_configured",
-	"team_sharing_not_configured",
-	"team_selection_ambiguous",
-	"operation_not_found",
-	...PROJECT_INVITE_OWNER_CONFLICT_ERRORS
-]);
+	};
+	return {
+		advanced: true,
+		state: "active"
+	};
+}
 function errorStatus(error) {
 	const value = error && typeof error === "object" ? error.status : null;
 	return typeof value === "number" && Number.isInteger(value) && value >= 400 && value <= 599 ? value : null;
@@ -5968,163 +7035,11 @@ function projectInviteOwnerErrorResponse(error, fallback) {
 	};
 	return fallback;
 }
-function isRetryableReconciliationError(error) {
-	const message = error instanceof Error ? error.message : String(error);
-	if (TERMINAL_RECONCILIATION_ERRORS.has(message)) return false;
-	const status = errorStatus(error);
-	return status == null || status === 408 || status === 429 || status >= 500;
-}
-function safeReconciliationErrorCode(error) {
-	const message = error instanceof Error ? error.message : String(error);
-	return TERMINAL_RECONCILIATION_ERRORS.has(message) ? message : "operation_read_failed";
-}
-function recordInviteReconciliationFailure(store, operationId, error, now) {
-	const safeErrorCode = safeReconciliationErrorCode(error);
-	const retryable = isRetryableReconciliationError(error);
-	store.db.prepare(`UPDATE share_operation_steps SET
-			status = CASE WHEN ? = 1 THEN 'pending' ELSE 'failed' END,
-			attempt_count = attempt_count + 1, last_attempt_at = ?, safe_error_code = ?, updated_at = ?
-			WHERE operation_id = ? AND step_key = 'invite_consumption'`).run(retryable ? 1 : 0, now, safeErrorCode, now, operationId);
-	const outcome = retryable ? "retry_scheduled" : "needs_attention";
-	store.db.prepare("UPDATE share_operations SET state = ?, updated_at = ? WHERE operation_id = ?").run(outcome === "needs_attention" ? "needs_attention" : "waiting_for_acceptance", now, operationId);
-	return outcome;
-}
 async function advancePendingProjectShares(store, options = {}) {
-	const limit = Math.max(1, Math.min(Math.trunc(options.limit ?? 3), 10));
-	const placeholders = AUTOMATIC_SHARE_OPERATION_STATES.map(() => "?").join(", ");
-	const maintenanceNow = options.now ?? /* @__PURE__ */ new Date();
-	const waitingAcceptanceRetryBefore = (/* @__PURE__ */ new Date(maintenanceNow.getTime() - AUTOMATIC_WAITING_ACCEPTANCE_RETRY_COOLDOWN_MS)).toISOString();
-	const waitingRetryBefore = (/* @__PURE__ */ new Date(maintenanceNow.getTime() - AUTOMATIC_WAITING_DEVICE_RETRY_COOLDOWN_MS)).toISOString();
-	const rows = store.db.prepare(`SELECT operation.operation_id FROM share_operations AS operation
-		 WHERE operation.inviter_actor_id = ?
-		 AND operation.state IN (${placeholders})
-		 AND (operation.state <> 'waiting_for_acceptance' OR operation.updated_at <= ?)
-		 AND (
-			operation.state <> 'waiting_for_device'
-			OR operation.updated_at <= ?
-			OR (
-				NOT EXISTS (
-					SELECT 1 FROM share_operation_steps AS step
-					WHERE step.operation_id = operation.operation_id
-					AND step.step_key = 'capability_preflight'
-					AND step.status <> 'completed'
-					AND (
-						step.status = 'running'
-						OR step.safe_error_code IN (
-							'waiting_for_device', 'device_offline', 'recipient_offline'
-						)
-					)
-				)
-				AND EXISTS (
-					SELECT 1 FROM sync_attempts AS attempt
-					WHERE attempt.id = (
-						SELECT latest.id FROM sync_attempts AS latest
-						WHERE latest.peer_device_id = operation.recipient_device_id
-						ORDER BY latest.started_at DESC, latest.id DESC
-						LIMIT 1
-					)
-					AND attempt.ok = 1
-					AND julianday(COALESCE(attempt.finished_at, attempt.started_at)) >
-						julianday(operation.updated_at)
-				)
-			)
-		 )
-		 ORDER BY CASE WHEN operation.state IN ('accepted', 'provisioning', 'initial_sync') THEN 0 ELSE 1 END,
-			CASE WHEN operation.state IN ('waiting_for_acceptance', 'waiting_for_device')
-				THEN operation.updated_at ELSE operation.created_at END ASC,
-			operation.created_at ASC, operation.operation_id ASC
-		 LIMIT ?`).all(store.actorId, ...AUTOMATIC_SHARE_OPERATION_STATES, waitingAcceptanceRetryBefore, waitingRetryBefore, limit);
-	const advanceOperation = options.advanceOperation ?? advanceProjectShareOperation;
-	const result = {
-		processed: 0,
-		advanced: 0,
-		waiting: 0,
-		attention: 0,
-		failed: 0,
-		items: []
-	};
-	for (const row of rows) {
-		result.processed += 1;
-		try {
-			const advanced = await advanceOperation(store, row.operation_id);
-			if (!advanced.advanced) {
-				if (advanced.state === "cancelled") {
-					result.items.push({
-						operationId: row.operation_id,
-						outcome: "superseded"
-					});
-					continue;
-				}
-				store.db.prepare("UPDATE share_operations SET updated_at = ? WHERE operation_id = ?").run(maintenanceNow.toISOString(), row.operation_id);
-				result.waiting += 1;
-				result.items.push({
-					operationId: row.operation_id,
-					outcome: "waiting_for_acceptance"
-				});
-				continue;
-			}
-			result.advanced += 1;
-			result.items.push({
-				operationId: row.operation_id,
-				outcome: "advanced"
-			});
-		} catch (error) {
-			const message = error instanceof Error ? error.message : String(error);
-			const state = store.db.prepare("SELECT state FROM share_operations WHERE operation_id = ?").pluck().get(row.operation_id);
-			if (state === "cancelled") {
-				result.items.push({
-					operationId: row.operation_id,
-					outcome: "superseded"
-				});
-				continue;
-			}
-			if (message === "waiting_for_device" || state === "waiting_for_device") {
-				result.waiting += 1;
-				result.items.push({
-					operationId: row.operation_id,
-					outcome: "waiting_for_device"
-				});
-				continue;
-			}
-			if (state === "needs_attention") {
-				result.attention += 1;
-				result.items.push({
-					operationId: row.operation_id,
-					outcome: "needs_attention",
-					error: message
-				});
-				continue;
-			}
-			if (state === "waiting_for_acceptance") {
-				const outcome = recordInviteReconciliationFailure(store, row.operation_id, error, maintenanceNow.toISOString());
-				if (outcome === "needs_attention") result.attention += 1;
-				else result.waiting += 1;
-				result.items.push({
-					operationId: row.operation_id,
-					outcome,
-					error: message
-				});
-				continue;
-			}
-			if (TERMINAL_SHARE_MAINTENANCE_ERRORS.has(message)) {
-				store.db.prepare("UPDATE share_operations SET state = 'needs_attention', updated_at = ? WHERE operation_id = ?").run(maintenanceNow.toISOString(), row.operation_id);
-				result.attention += 1;
-				result.items.push({
-					operationId: row.operation_id,
-					outcome: "needs_attention",
-					error: message
-				});
-				continue;
-			}
-			result.failed += 1;
-			result.items.push({
-				operationId: row.operation_id,
-				outcome: "failed",
-				error: message
-			});
-		}
-	}
-	return result;
+	return advancePendingProjectSharesOperation(store, {
+		...options,
+		advanceOperation: options.advanceOperation ?? advanceProjectShareOperation
+	});
 }
 function coordinatorEnrollmentFailureCode(error) {
 	const message = (error instanceof Error ? error.message : String(error)).trim();
@@ -6216,9 +7131,6 @@ async function reconcileConfiguredCoordinatorEnrollment(store, options = {}) {
 	}
 	return total;
 }
-var RECIPIENT_POLICY_MAINTENANCE_MAX_LIMIT = 10;
-var RECIPIENT_POLICY_MAINTENANCE_DEFAULT_LIMIT = 3;
-var RECIPIENT_POLICY_MAINTENANCE_BACKOFF_MS = 6e4;
 var RECIPIENT_POLICY_WAITING_ERRORS = /* @__PURE__ */ new Set([
 	"recipient_policy_capability_undetermined",
 	"recipient_policy_parity_incomplete",
@@ -6418,59 +7330,10 @@ function createRecipientPolicyReconcilerEffects(store, options = {}) {
 	};
 }
 async function reconcileRecipientPolicyProjects(store, options = {}) {
-	const limit = Math.max(1, Math.min(Math.trunc(options.limit ?? RECIPIENT_POLICY_MAINTENANCE_DEFAULT_LIMIT), RECIPIENT_POLICY_MAINTENANCE_MAX_LIMIT));
-	const maintenanceNow = options.now ?? /* @__PURE__ */ new Date();
-	const backoffMs = Math.max(0, Math.trunc(options.backoffMs ?? RECIPIENT_POLICY_MAINTENANCE_BACKOFF_MS));
-	const retryBefore = new Date(maintenanceNow.getTime() - backoffMs).toISOString();
-	const rows = store.db.prepare(`WITH projects AS (
-				SELECT DISTINCT canonical_project_identity FROM project_recipients
-				UNION
-				SELECT canonical_project_identity FROM recipient_policy_authority_states
-			)
-			 SELECT projects.canonical_project_identity
-			 FROM projects
-			 LEFT JOIN recipient_policy_authority_states authority
-			  ON authority.canonical_project_identity = projects.canonical_project_identity
-			 WHERE authority.safe_error_code IS NULL OR authority.last_attempt_at IS NULL
-			  OR authority.last_attempt_at <= ?
-			 ORDER BY CASE WHEN authority.last_attempt_at IS NULL THEN 0 ELSE 1 END,
-			  authority.last_attempt_at, projects.canonical_project_identity
-			 LIMIT ?`).all(retryBefore, limit);
-	const effects = options.effects ?? createRecipientPolicyReconcilerEffects(store);
-	const reconcileProject = options.reconcileProject ?? reconcileRecipientPolicyProject;
-	const result = {
-		processed: 0,
-		active: 0,
-		waiting: 0,
-		attention: 0,
-		failed: 0,
-		items: []
-	};
-	for (const row of rows) {
-		result.processed += 1;
-		try {
-			const outcome = await reconcileProject(store.db, {
-				canonicalProjectIdentity: row.canonical_project_identity,
-				leaseOwner: options.leaseOwner ?? `recipient-policy-maintenance:${store.deviceId || process.pid}`
-			}, effects);
-			if (outcome.status === "active") result.active += 1;
-			else if (outcome.status === "needs_attention") result.attention += 1;
-			else result.waiting += 1;
-			result.items.push({
-				canonicalProjectIdentity: row.canonical_project_identity,
-				status: outcome.status,
-				safeErrorCode: outcome.safeErrorCode
-			});
-		} catch {
-			result.failed += 1;
-			result.items.push({
-				canonicalProjectIdentity: row.canonical_project_identity,
-				status: "failed",
-				safeErrorCode: "recipient_policy_reconciliation_failed"
-			});
-		}
-	}
-	return result;
+	return reconcileRecipientPolicyProjectsOperation(store, {
+		...options,
+		effects: options.effects ?? createRecipientPolicyReconcilerEffects(store)
+	});
 }
 function recipientPolicyReadState(authority) {
 	if (!authority) return "pending";
@@ -7045,10 +7908,15 @@ function ensureStableStoreIdentity(store) {
 	return deviceId;
 }
 function ensureStableStoreDeviceIdentity(store) {
-	const [deviceId] = ensureDeviceIdentity(store.db, { keysDir: syncKeysDir() });
-	store.adoptEnsuredDeviceIdentity(deviceId);
+	const [deviceId] = ensureStableStoreDeviceIdentityWithFingerprint(store);
 	return deviceId;
 }
+function ensureStableStoreDeviceIdentityWithFingerprint(store) {
+	const identity = ensureDeviceIdentity(store.db, { keysDir: syncKeysDir() });
+	const [deviceId] = identity;
+	store.adoptEnsuredDeviceIdentity(deviceId);
+	return identity;
+}
 function findPeerDeviceIdForAddress(store, address) {
 	const rows = store.db.prepare("SELECT peer_device_id, addresses_json FROM sync_peers").all();
 	for (const row of rows) if (safeJsonList(row.addresses_json).includes(address)) return String(row.peer_device_id ?? "").trim() || null;
@@ -7324,6 +8192,23 @@ function claimedLocalActorScopeStatus(store, row) {
 		action_required: !grant.authorized
 	};
 }
+function archivedCoordinatorGroupResponse(groupId, group, status, groups) {
+	return {
+		ok: true,
+		group,
+		status,
+		disconnected_group_id: groupId,
+		groups
+	};
+}
+function missingArchivedCoordinatorGroupResponse(groupId, status, groups) {
+	return {
+		error: "group_not_found_or_already_archived",
+		status,
+		disconnected_group_id: groupId,
+		groups
+	};
+}
 /**
 * Map a raw sync_peers DB row to the API response shape.
 * When showDiag is false, sensitive fields (fingerprint, last_error, addresses)
@@ -7443,14 +8328,50 @@ function cleanupDiagnostics(store, localDeviceId, showDiag) {
 		redacted: !showDiag
 	};
 }
-function legacySharedReviewSummary(store) {
-	const rows = legacySharedReviewRows(store);
-	const memoryCount = rows.length;
-	const lastUpdatedAt = rows.reduce((current, row) => row.updated_at && (!current || row.updated_at > current) ? row.updated_at : current, null);
+function legacySharedReviewSuggestedScope(candidate) {
+	const resolvedScope = candidate?.resolved_scope_id ?? null;
+	if (resolvedScope && resolvedScope !== LOCAL_DEFAULT_SCOPE_ID && resolvedScope !== LEGACY_SHARED_REVIEW_SCOPE_ID) return resolvedScope;
+	return candidate?.suggested_scope_id ?? null;
+}
+function addLegacySharedReviewRow(groups, row, identity, candidate, isOwnedBySelf) {
+	const existing = groups.get(identity.value);
+	if (existing) {
+		existing.memory_count += 1;
+		if (isOwnedBySelf) existing.reassignable_memory_count += 1;
+		else existing.peer_owned_memory_count += 1;
+		if (row.updated_at && (!existing.last_updated_at || row.updated_at > existing.last_updated_at)) existing.last_updated_at = row.updated_at;
+		if (existing.memory_sample_rows.length < LEGACY_SHARED_REVIEW_SAMPLE_LIMIT) existing.memory_sample_rows.push({
+			is_owned_by_self: isOwnedBySelf,
+			row
+		});
+		return;
+	}
+	const suggestedScope = legacySharedReviewSuggestedScope(candidate);
+	groups.set(identity.value, {
+		workspace_identity: identity.value,
+		identity_source: identity.source,
+		display_project: identity.displayProject ?? row.project ?? row.cwd ?? identity.value,
+		memory_count: 1,
+		reassignable_memory_count: isOwnedBySelf ? 1 : 0,
+		peer_owned_memory_count: isOwnedBySelf ? 0 : 1,
+		last_updated_at: row.updated_at ?? null,
+		memory_sample_rows: [{
+			is_owned_by_self: isOwnedBySelf,
+			row
+		}],
+		suggested_scope_id: suggestedScope,
+		suggestion_reason: suggestedScope ? candidate?.suggestion_reason ?? "Existing project mapping can be reviewed as a destination, but legacy data is not promoted automatically." : null
+	});
+}
+function collectLegacySharedReviewGroups(store) {
 	const ownedBySelf = store.buildOwnershipPredicate();
 	const candidatesByIdentity = new Map(listProjectScopeCandidates(store.db, { limit: null }).map((candidate) => [candidate.workspace_identity, candidate]));
-	const groupsByIdentity = /* @__PURE__ */ new Map();
-	for (const row of rows) {
+	const groups = /* @__PURE__ */ new Map();
+	let memoryCount = 0;
+	let lastUpdatedAt = null;
+	for (const row of legacySharedReviewSummaryRows(store)) {
+		memoryCount += 1;
+		if (row.updated_at && (!lastUpdatedAt || row.updated_at > lastUpdatedAt)) lastUpdatedAt = row.updated_at;
 		const identity = canonicalWorkspaceIdentity({
 			cwd: row.cwd,
 			gitBranch: row.git_branch,
@@ -7458,35 +8379,27 @@ function legacySharedReviewSummary(store) {
 			project: row.project,
 			workspaceId: row.workspace_id
 		});
-		const candidate = candidatesByIdentity.get(identity.value);
-		const resolvedScope = candidate?.resolved_scope_id ?? null;
-		const suggestedScope = resolvedScope && resolvedScope !== LOCAL_DEFAULT_SCOPE_ID && resolvedScope !== LEGACY_SHARED_REVIEW_SCOPE_ID ? resolvedScope : candidate?.suggested_scope_id;
-		const existing = groupsByIdentity.get(identity.value);
-		const isOwnedBySelf = ownedBySelf(row);
-		const rowUpdatedAt = row.updated_at ?? null;
-		if (existing) {
-			existing.memory_count += 1;
-			if (isOwnedBySelf) existing.reassignable_memory_count += 1;
-			else existing.peer_owned_memory_count += 1;
-			if (rowUpdatedAt && (!existing.last_updated_at || rowUpdatedAt > existing.last_updated_at)) existing.last_updated_at = rowUpdatedAt;
-			if (existing.memory_samples.length < LEGACY_SHARED_REVIEW_SAMPLE_LIMIT) existing.memory_samples.push(legacySharedReviewMemorySample(row, isOwnedBySelf));
-			continue;
-		}
-		groupsByIdentity.set(identity.value, {
-			workspace_identity: identity.value,
-			identity_source: identity.source,
-			display_project: identity.displayProject ?? row.project ?? row.cwd ?? identity.value,
-			memory_count: 1,
-			reassignable_memory_count: isOwnedBySelf ? 1 : 0,
-			peer_owned_memory_count: isOwnedBySelf ? 0 : 1,
-			last_updated_at: rowUpdatedAt,
-			memory_samples: [legacySharedReviewMemorySample(row, isOwnedBySelf)],
-			suggested_scope_id: suggestedScope ?? null,
-			suggestion_reason: suggestedScope ? candidate?.suggestion_reason ?? "Existing project mapping can be reviewed as a destination, but legacy data is not promoted automatically." : null
-		});
+		addLegacySharedReviewRow(groups, row, identity, candidatesByIdentity.get(identity.value), ownedBySelf(row));
 	}
-	const totalGroupCount = groupsByIdentity.size;
-	const groups = [...groupsByIdentity.values()].sort((left, right) => right.memory_count - left.memory_count || (right.last_updated_at ?? "").localeCompare(left.last_updated_at ?? "") || left.workspace_identity.localeCompare(right.workspace_identity));
+	return {
+		groups,
+		lastUpdatedAt,
+		memoryCount
+	};
+}
+function materializeLegacySharedReviewGroups(store, groupsByIdentity) {
+	const sampleBodies = legacySharedReviewSampleBodies(store, [...groupsByIdentity.values()].flatMap((group) => group.memory_sample_rows.map((sample) => sample.row.id)));
+	return [...groupsByIdentity.values()].map(({ memory_sample_rows: sampleRows, ...group }) => ({
+		...group,
+		memory_samples: sampleRows.map(({ is_owned_by_self: isOwnedBySelf, row }) => legacySharedReviewMemorySample({
+			...row,
+			body_text: sampleBodies.get(row.id) ?? null
+		}, isOwnedBySelf))
+	})).sort((left, right) => right.memory_count - left.memory_count || (right.last_updated_at ?? "").localeCompare(left.last_updated_at ?? "") || left.workspace_identity.localeCompare(right.workspace_identity));
+}
+function legacySharedReviewSummary(store) {
+	const collected = collectLegacySharedReviewGroups(store);
+	const groups = materializeLegacySharedReviewGroups(store, collected.groups);
 	const targetScopes = listSharingDomainSettingsScopes(store.db).filter((scope) => scope.scope_id !== LOCAL_DEFAULT_SCOPE_ID && scope.scope_id !== LEGACY_SHARED_REVIEW_SCOPE_ID).map((scope) => ({
 		authority_type: scope.authority_type,
 		label: scope.label || scope.scope_id,
@@ -7494,16 +8407,17 @@ function legacySharedReviewSummary(store) {
 	}));
 	return {
 		scope_id: LEGACY_SHARED_REVIEW_SCOPE_ID,
-		memory_count: memoryCount,
-		has_data: memoryCount > 0,
-		last_updated_at: lastUpdatedAt,
+		memory_count: collected.memoryCount,
+		has_data: collected.memoryCount > 0,
+		last_updated_at: collected.lastUpdatedAt,
 		groups,
-		total_group_count: totalGroupCount,
+		total_group_count: collected.groups.size,
 		target_scopes: targetScopes
 	};
 }
 var LEGACY_SHARED_REVIEW_SAMPLE_LIMIT = 3;
 var LEGACY_SHARED_REVIEW_BODY_PREVIEW_SQL_LIMIT = 360;
+var LEGACY_SHARED_REVIEW_SAMPLE_BODY_BATCH_SIZE = 500;
 function previewText(value, limit = 180) {
 	const normalized = value?.replace(/\s+/g, " ").trim();
 	if (!normalized) return null;
@@ -7523,6 +8437,41 @@ function legacySharedReviewMemorySample(row, isOwnedBySelf) {
 		git_remote: row.git_remote ?? null
 	};
 }
+function legacySharedReviewSummaryRows(store) {
+	return store.db.prepare(`SELECT m.id,
+			        m.created_at,
+			        m.updated_at,
+			        m.kind,
+			        m.title,
+			        s.project,
+			        s.cwd,
+			        s.git_remote,
+			        s.git_branch,
+			        m.workspace_id,
+			        m.actor_id,
+			        m.origin_device_id,
+			        m.metadata_json
+			 FROM memory_items m
+			 LEFT JOIN sessions s ON s.id = m.session_id
+			 WHERE m.scope_id = ?
+			   AND m.active = 1
+			   AND m.deleted_at IS NULL
+			 ORDER BY COALESCE(m.updated_at, m.created_at, '') DESC, m.id DESC`).iterate(LEGACY_SHARED_REVIEW_SCOPE_ID);
+}
+function legacySharedReviewSampleBodies(store, memoryIds) {
+	const bodies = /* @__PURE__ */ new Map();
+	for (let offset = 0; offset < memoryIds.length; offset += LEGACY_SHARED_REVIEW_SAMPLE_BODY_BATCH_SIZE) {
+		const ids = memoryIds.slice(offset, offset + LEGACY_SHARED_REVIEW_SAMPLE_BODY_BATCH_SIZE);
+		const rows = store.db.prepare(`SELECT id, substr(body_text, 1, ?) AS body_text
+				 FROM memory_items
+				 WHERE id IN (${ids.map(() => "?").join(",")})
+				   AND scope_id = ?
+				   AND active = 1
+				   AND deleted_at IS NULL`).all(LEGACY_SHARED_REVIEW_BODY_PREVIEW_SQL_LIMIT, ...ids, LEGACY_SHARED_REVIEW_SCOPE_ID);
+		for (const row of rows) if (row.body_text != null) bodies.set(row.id, row.body_text);
+	}
+	return bodies;
+}
 function legacySharedReviewRows(store) {
 	return store.db.prepare(`SELECT m.id,
 			        m.rev,
@@ -8308,198 +9257,29 @@ function syncRoutes(getStore, getSyncRuntimeStatus, options = {}) {
 		}
 	});
 	app.get("/api/sync/status", async (c) => {
-		const store = getStore();
-		{
-			const traceSync = (label, fn) => {
-				if (process.env.CODEMEM_TRACE_SYNC_STATUS !== "1") return fn();
-				const startedAt = Date.now();
-				console.warn(`[codemem sync-status] ${label} start`);
-				try {
-					return fn();
-				} finally {
-					console.warn(`[codemem sync-status] ${label} ${Date.now() - startedAt}ms`);
-				}
-			};
-			const showDiag = queryBool(c.req.query("includeDiagnostics"));
-			const includeJoinRequests = queryBool(c.req.query("includeJoinRequests"));
-			const project = c.req.query("project") || null;
-			const config = traceSync("readCoordinatorSyncConfig", () => readCoordinatorSyncConfig());
-			const syncReset = traceSync("getSyncResetState", () => getSyncResetState(store.db));
-			const d = drizzle(store.db, { schema });
-			const deviceRow = traceSync("deviceRow", () => d.select({
-				device_id: schema.syncDevice.device_id,
-				fingerprint: schema.syncDevice.fingerprint
-			}).from(schema.syncDevice).limit(1).get());
-			const daemonState = traceSync("daemonState", () => d.select().from(schema.syncDaemonState).where(eq(schema.syncDaemonState.id, 1)).get());
-			const peerCountRow = traceSync("peerCountRow", () => d.select({ total: count() }).from(schema.syncPeers).get());
-			let retentionState;
-			try {
-				retentionState = traceSync("retentionState", () => d.select().from(schema.syncRetentionState).where(eq(schema.syncRetentionState.id, 1)).get());
-			} catch {
-				retentionState = void 0;
-			}
-			const lastSyncRow = traceSync("lastSyncRow", () => d.select({ last_sync_at: max(schema.syncPeers.last_sync_at) }).from(schema.syncPeers).get());
-			const semanticIndex = traceSync("semanticIndex", () => redactSemanticIndexDiagnostics(getSemanticIndexDiagnostics(store.db), showDiag));
-			const enrollmentIssueSummary = traceSync("coordinatorEnrollmentIssues", () => getCoordinatorEnrollmentReconciliationIssueSummary(store.db));
-			const enrollmentIssueStatus = {
-				counts: enrollmentIssueSummary.counts,
-				...showDiag ? { issues: enrollmentIssueSummary.issues.map((issue) => ({
-					coordinator_id: issue.coordinatorId,
-					group_id: issue.groupId,
-					kind: issue.kind,
-					reference_id: issue.referenceId,
-					code: issue.code,
-					status: issue.status,
-					first_seen_at: issue.firstSeenAt,
-					last_seen_at: issue.lastSeenAt,
-					resolved_at: issue.resolvedAt,
-					occurrence_count: issue.occurrenceCount,
-					updated_at: issue.updatedAt
-				})) } : {}
-			};
-			const lastError = daemonState?.last_error;
-			const lastErrorAt = daemonState?.last_error_at;
-			const lastOkAt = daemonState?.last_ok_at;
-			const viewerBinding = traceSync("readViewerBinding", () => readViewerBinding(store.dbPath));
-			const daemonRunning = Boolean(viewerBinding);
-			const daemonDetail = viewerBinding ? `viewer pidfile at ${viewerBinding.host}:${viewerBinding.port}` : null;
-			let daemonStateValue = "ok";
-			if (!config.syncEnabled) daemonStateValue = "disabled";
-			else if (lastError && (!lastOkAt || String(lastOkAt) < String(lastErrorAt ?? ""))) daemonStateValue = "error";
-			else if (!daemonRunning) daemonStateValue = "stopped";
-			const statusPayload = {
-				enabled: config.syncEnabled,
-				interval_s: config.syncIntervalS,
-				retention: {
-					enabled: config.syncRetentionEnabled,
-					max_age_days: config.syncRetentionMaxAgeDays,
-					max_size_mb: config.syncRetentionMaxSizeMb,
-					retained_floor_cursor: syncReset.retained_floor_cursor ?? retentionState?.retained_floor_cursor ?? null,
-					last_run_at: retentionState?.last_run_at ?? null,
-					last_duration_ms: typeof retentionState?.last_duration_ms === "number" ? retentionState.last_duration_ms : null,
-					last_deleted_ops: typeof retentionState?.last_deleted_ops === "number" ? retentionState.last_deleted_ops : null,
-					last_estimated_bytes_before: typeof retentionState?.last_estimated_bytes_before === "number" ? retentionState.last_estimated_bytes_before : null,
-					last_estimated_bytes_after: typeof retentionState?.last_estimated_bytes_after === "number" ? retentionState.last_estimated_bytes_after : null,
-					last_error: retentionState?.last_error ?? null,
-					last_error_at: retentionState?.last_error_at ?? null
-				},
-				semantic_index: semanticIndex,
-				coordinator_enrollment_reconciliation_issues: enrollmentIssueStatus,
-				peer_count: Number(peerCountRow?.total ?? 0),
-				last_sync_at: lastSyncRow?.last_sync_at ?? null,
-				daemon_state: daemonStateValue,
-				daemon_running: daemonRunning,
-				daemon_detail: daemonDetail,
-				project_filter_active: config.syncProjectsInclude.length > 0 || config.syncProjectsExclude.length > 0,
-				project_filter: {
-					include: config.syncProjectsInclude,
-					exclude: config.syncProjectsExclude
-				},
-				cleanup_diagnostics: cleanupDiagnostics(store, deviceRow?.device_id ?? null, showDiag),
-				redacted: !showDiag
-			};
-			if (showDiag) {
-				statusPayload.device_id = deviceRow?.device_id ?? null;
-				statusPayload.fingerprint = deviceRow?.fingerprint ?? null;
-				statusPayload.bind = `${config.syncHost}:${config.syncPort}`;
-				statusPayload.daemon_last_error = lastError;
-				statusPayload.daemon_last_error_at = lastErrorAt;
-				statusPayload.daemon_last_ok_at = lastOkAt;
-			}
-			const runtimeStatus = getSyncRuntimeStatus?.() ?? null;
-			if (runtimeStatus?.phase && runtimeStatus.phase !== "running") {
-				daemonStateValue = runtimeStatus.phase;
-				statusPayload.daemon_state = daemonStateValue;
-				statusPayload.daemon_running = runtimeStatus.phase === "starting" || daemonRunning;
-				statusPayload.daemon_detail = runtimeStatus.detail ?? daemonDetail;
-			}
-			const coordinatorSnapshot = await coordinatorStatusSnapshot(store, config);
-			const coordinator = traceSync("coordinator", () => redactCoordinatorStatus(coordinatorSnapshot, showDiag));
-			const peerRows = traceSync("peerRows", () => store.db.prepare(PEERS_QUERY).all());
-			const recentOpsByPeer = traceSync("recentPeerOps", () => recentPeerOps(store));
-			const scopeRejectionsByPeer = traceSync("recentScopeRejectionsByPeer", () => recentScopeRejectionsByPeer(store));
-			const peersItems = peerRows.map((row) => {
-				const peer = mapPeerRow(store, row, showDiag, recentOpsByPeer, scopeRejectionsByPeer, deviceRow?.device_id ?? null);
-				peer.status = peerStatus(peer);
-				return peer;
-			});
-			const peersMap = {};
-			for (const peer of peersItems) peersMap[String(peer.peer_device_id)] = peer.status;
-			const attemptRows = traceSync("attemptRows", () => d.select({
-				peer_device_id: schema.syncAttempts.peer_device_id,
-				ok: schema.syncAttempts.ok,
-				error: schema.syncAttempts.error,
-				started_at: schema.syncAttempts.started_at,
-				finished_at: schema.syncAttempts.finished_at,
-				ops_in: schema.syncAttempts.ops_in,
-				ops_out: schema.syncAttempts.ops_out,
-				local_sync_capability: schema.syncAttempts.local_sync_capability,
-				peer_sync_capability: schema.syncAttempts.peer_sync_capability,
-				negotiated_sync_capability: schema.syncAttempts.negotiated_sync_capability
-			}).from(schema.syncAttempts).orderBy(desc(schema.syncAttempts.finished_at)).limit(25).all());
-			const peerAddressMap = /* @__PURE__ */ new Map();
-			traceSync("peerAddressRows", () => store.db.prepare("SELECT peer_device_id, addresses_json FROM sync_peers").all()).forEach((peerRow) => {
-				const addrs = safeJsonList(peerRow.addresses_json);
-				if (addrs.length) peerAddressMap.set(String(peerRow.peer_device_id ?? ""), addrs);
-			});
-			const attemptsItems = attemptRows.map((row) => {
-				const addrs = showDiag ? peerAddressMap.get(String(row.peer_device_id ?? "")) : void 0;
-				return mapSyncAttemptRow(row, showDiag, addrs);
-			});
-			const latestAttemptError = String(attemptRows[0]?.error || "").trim();
-			const statusBlock = {
-				...statusPayload,
-				background_maintenance: summarizeMaintenanceJobs(listMaintenanceJobs(store.db), showDiag),
-				peers: peersMap,
-				pending: 0,
-				sync: {},
-				ping: {}
-			};
-			const legacyDevices = traceSync("legacyDevices", () => store.claimableLegacyDeviceIds());
-			const legacyReview = traceSync("legacySharedReview", () => legacySharedReviewSummary(store));
-			const sharingReview = traceSync("sharingReview", () => store.sharingReviewSummary(project));
-			const recipientPolicyReconciliation = traceSync("recipientPolicyReconciliation", () => listRecipientPolicyReconciliationStatus(store));
-			let joinRequests = [];
-			if (includeJoinRequests && showDiag && config.syncCoordinatorAdminSecret) try {
-				joinRequests = await listCoordinatorJoinRequests(config);
-			} catch {
-				joinRequests = [];
+		const response = await buildSyncStatusResponse({
+			store: getStore(),
+			showDiagnostics: queryBool(c.req.query("includeDiagnostics")),
+			includeJoinRequests: queryBool(c.req.query("includeJoinRequests")),
+			project: c.req.query("project") || null,
+			getSyncRuntimeStatus,
+			operations: {
+				cleanupDiagnostics,
+				isRecentIso,
+				legacySharedReviewSummary,
+				listRecipientPolicyReconciliationStatus,
+				mapPeerRow,
+				mapSyncAttemptRow,
+				peerStatus,
+				readViewerBinding,
+				recentPeerOps,
+				recentScopeRejectionsByPeer,
+				redactCoordinatorStatus,
+				redactSemanticIndexDiagnostics,
+				summarizeMaintenanceJobs
 			}
-			if (daemonStateValue === "ok" && latestAttemptError.startsWith("needs_attention:")) {
-				daemonStateValue = "needs_attention";
-				statusPayload.daemon_state = daemonStateValue;
-				statusPayload.daemon_detail = latestAttemptError.replace(/^needs_attention:/, "");
-				statusBlock.daemon_state = daemonStateValue;
-				statusBlock.daemon_detail = latestAttemptError.replace(/^needs_attention:/, "");
-			}
-			if (daemonStateValue === "ok") {
-				const peerStates = new Set(peersItems.map((peer) => String(peer.status?.peer_state ?? "")));
-				const latestFailedRecently = Boolean(attemptsItems[0] && attemptsItems[0].status === "error" && isRecentIso(attemptsItems[0].finished_at));
-				const allOffline = peersItems.length > 0 && peersItems.every((peer) => String(peer.status?.peer_state ?? "") === "offline");
-				if (latestFailedRecently) {
-					if (peerStates.has("online") || peerStates.has("degraded")) daemonStateValue = "degraded";
-					else if (allOffline) daemonStateValue = "offline-peers";
-					else if (peersItems.length > 0) daemonStateValue = "stale";
-				} else if (peerStates.has("degraded")) daemonStateValue = "degraded";
-				else if (allOffline) daemonStateValue = "offline-peers";
-				else if (peersItems.length > 0 && !peerStates.has("online")) daemonStateValue = "stale";
-				statusPayload.daemon_state = daemonStateValue;
-				statusBlock.daemon_state = daemonStateValue;
-			}
-			const responsePayload = {
-				...statusPayload,
-				status: statusBlock,
-				peers: peersItems,
-				attempts: attemptsItems.slice(0, 5),
-				legacy_devices: legacyDevices,
-				legacy_shared_review: legacyReview,
-				sharing_review: sharingReview,
-				recipient_policy_reconciliation: recipientPolicyReconciliation,
-				coordinator
-			};
-			if (includeJoinRequests && showDiag) responsePayload.join_requests = joinRequests;
-			return c.json(responsePayload);
-		}
+		});
+		return c.json(response);
 	});
 	app.get("/api/sync/peers", (c) => {
 		const store = getStore();
@@ -8592,7 +9372,7 @@ function syncRoutes(getStore, getSyncRuntimeStatus, options = {}) {
 			let publicKey;
 			let fingerprint;
 			try {
-				const [id, fp] = ensureDeviceIdentity(store.db, { keysDir: syncKeysDir() });
+				const [id, fp] = ensureStableStoreDeviceIdentityWithFingerprint(store);
 				deviceId = id;
 				fingerprint = fp;
 				publicKey = d.select({ public_key: schema.syncDevice.public_key }).from(schema.syncDevice).where(eq(schema.syncDevice.device_id, id)).get()?.public_key ?? "";
@@ -10021,18 +10801,10 @@ function syncRoutes(getStore, getSyncRuntimeStatus, options = {}) {
 				remoteUrl: config.syncCoordinatorUrl || null,
 				adminSecret: config.syncCoordinatorAdminSecret || null
 			});
-			if (!group) return c.json({
-				error: "group_not_found_or_already_archived",
-				status
-			}, 404);
 			const groups = removeConfiguredCoordinatorGroup(groupId);
-			return c.json({
-				ok: true,
-				group,
-				status: coordinatorAdminStatusPayload(),
-				disconnected_group_id: groupId,
-				groups
-			});
+			const currentStatus = coordinatorAdminStatusPayload();
+			if (!group) return c.json(missingArchivedCoordinatorGroupResponse(groupId, currentStatus, groups), 404);
+			return c.json(archivedCoordinatorGroupResponse(groupId, group, currentStatus, groups));
 		} catch (error) {
 			return c.json({
 				error: error instanceof Error ? error.message : String(error),
@@ -11180,7 +11952,7 @@ function createApp(opts) {
 		getObserver: () => observer
 	}));
 	app.route("/", configRoutes({ getSweeper: () => sweeper }));
-	app.route("/", rawEventsRoutes(storeFactory, sweeper));
+	app.route("/", rawEventsRoutes(storeFactory, sweeper, opts?.rawEventInbox, opts?.rawEventTarget));
 	app.route("/", syncRoutes(storeFactory, getSyncRuntimeStatus, {
 		loadDeviceIdentityCoordinatorEvidence: opts?.loadDeviceIdentityCoordinatorEvidence,
 		onRecipientPolicyTeamRenamed: () => invalidateTeamSetupSummary(),
@@ -11228,6 +12000,6 @@ function createSyncApp(opts) {
 	return app;
 }
 //#endregion
-export { VERSION, advancePendingProjectShares, advanceProjectShareOperation, closeStore, createApp, createRecipientPolicyReconcilerEffects, createSyncApp, getStore, listRecipientPolicyReconciliationStatus, recipientPolicyCapabilityFromStatus, reconcileConfiguredCoordinatorEnrollment, reconcileRecipientPolicyProjects };
+export { FileRawEventInbox, VERSION, advancePendingProjectShares, advancePendingProjectSharesOperation, advanceProjectShareOperation, closeStore, createApp, createRecipientPolicyReconcilerEffects, createSyncApp, createViewerRawEventInbox, getStore, listRecipientPolicyReconciliationStatus, recipientPolicyCapabilityFromStatus, reconcileConfiguredCoordinatorEnrollment, reconcileRecipientPolicyProjects, reconcileRecipientPolicyProjectsOperation, resolveRawEventInboxDirectory };
 
 //# sourceMappingURL=index.js.map