@codemem/server 0.46.0-beta.1 → 0.46.0-rc.1

package/dist/index.js

@@ -1,6 +1,6 @@
 import { existsSync, readFileSync } from "node:fs";
 import { dirname, isAbsolute, join, posix, resolve, win32 } from "node:path";
-import { ACCESS_CLEANUP_OP_TYPE, CodememConfigMutationError, CoordinatorReciprocalApprovalRequestChangedError, DEFAULT_TIME_WINDOW_S, LEGACY_SHARED_REVIEW_SCOPE_ID, LOCAL_DEFAULT_SCOPE_ID, LOCAL_SYNC_CAPABILITY, LOCAL_SYNC_FEATURES, LegacyTeamSetupAdditiveConvergenceError, LegacyTeamSetupRosterCapacityError, MEMORY_FILTER_FIELD_TYPES, MEMORY_FILTER_NAMES, MEMORY_KIND_DESCRIPTIONS, MemoryStore, ObserverClient, PROMPT_TRANSPORT_PROTOCOL_RANGE, REMEMBER_MEMORY_KINDS, RawEventIngestValidationError, RecipientPolicyEdgeRequestError, RecipientPolicyTeamRenameError, RemoteCoordinatorRequestError, SCOPE_MEMBERSHIP_REVOCATION_LIMITATION, SYNC_AUTHORIZATION_REFRESH_HEADER, SYNC_CAPABILITY_HEADER, SYNC_FEATURES_HEADER, SYNC_SCOPE_QUERY_PARAM, VERSION, VERSION as VERSION$1, VIEWER_IDENTITY_TARGET_KEYS, VIEWER_SERVICE_DISCRIMINATOR, addSyncScopeToBoundary, analyzeProjectScopeMappingChangeGuardrails, applyLegacyTeamSetupCompletionManifest, applyLegacyTeamSetupCompletionManifestAndReturnActivation, applyReplicationOps, areLegacyTeamSetupCompletionPolicyFactsAdditivelyCompatible, automaticRecallHealth, buildAuthHeaders, buildBaseUrl, buildDirectPeerAuthHeaders, buildDistillReport, buildFilterClausesWithContext, buildPiFlushSignalFromEvent, buildRawEventEnvelopeFromCodexHook, buildRawEventEnvelopeFromHook, buildRawEventEnvelopeFromPiEvent, buildViewerIdentityTarget, canonicalCoordinatorLegacyTeamCompletionManifestJson, canonicalMemoryKind, canonicalWorkspaceIdentity, claimRecipientPolicyActorMutations, claimRecipientPolicyPublicationMutation, cleanupNonces, clearLegacyTeamSetupDeviceDecision, clonePromptPackAttempt, coerceObserverCommand, commitDeviceIdentityBindings, commitRecipientPolicyEdges, containLegacyTeamSetupCompletionConflict, coordinatorArchiveGroupAction, coordinatorCreateAddDeviceInviteAction, coordinatorCreateGroupAction, coordinatorCreateInviteAction, coordinatorCreateLegacyTeamCompletionAction, coordinatorCreateScopeAction, coordinatorDisableDeviceAction, coordinatorEnableDeviceAction, coordinatorGetLegacyTeamCompletionAction, coordinatorGrantScopeMembershipAction, coordinatorImportInviteAction, coordinatorListBootstrapGrantsAction, coordinatorListConsumedTeamInvitesAction, coordinatorListDevicesAction, coordinatorListGroupsAction, coordinatorListJoinRequestsAction, coordinatorListLegacyTeamCompletionsAction, coordinatorListReviewedRecipientInviteEvidenceAction, coordinatorListScopeMembershipsAction, coordinatorListScopesAction, coordinatorRemoveDeviceAction, coordinatorRenameDeviceAction, coordinatorRenameGroupAction, coordinatorReviewJoinRequestAction, coordinatorRevokeBootstrapGrantAction, coordinatorRevokeScopeMembershipAction, coordinatorStatusSnapshot, coordinatorUnarchiveGroupAction, coordinatorUpdateScopeAction, countShareableProjectMemories, createCoordinatorReciprocalApproval, decodeInvitePayload, dedupeOrderedIds, defaultSpaceScopeIdForGroup, deleteProjectScopeSettingsMapping, deriveLegacyTeamSetupCompletionManifest, detectInstallKind, deterministicPolicyTeamId, diagnoseStalePeerReceivedRows, discoverLegacyTeamCandidates, ensureDeviceIdentity, executeShareProvisioning, extractInvitePayload, extractReplicationOps, filterReplicationOpsForSyncWithStatus, fingerprintPublicKey, formatHostPort, friendlyDeviceName, fromJson, getCodememConfigPath, getCodememEnvOverrideValues, getCodememEnvOverrides, getCoordinatorEnrollmentReconciliationIssueSummary, getCoordinatorGroupPreference, getLegacyTeamSetupDraft, getRecipientPolicyAuthorityState, getSemanticIndexDiagnostics, getSyncResetState, getUpdateStatus, ingestRawEvents, inspectFreshLegacyTeamSetupActivation, inspectLegacyTeamSetupActivation, inviteTokenDigest, isAutomaticRecallMeasurement, isLegacyTeamCandidateSelectable, isLegacyTeamSetupProjectMappingIdentity, isPeerTrustBindingCompatible, isProjectSyncEnablementError, isScopedSyncCapability, judgeDistillReport, legacyTeamCandidateId, legacyTeamCandidateProjectInventory, legacyTeamCanonicalProjectRef, legacyTeamDeviceRef, legacyTeamResolvedProjectRef, legacyTeamSetupApiErrorCode, listAuthorizedScopesForPeer, listCoordinatorJoinRequests, listDeviceIdentityInventory, listInboundScopeRejections, listLegacyRecipientPolicyProjections, listMaintenanceJobs, listObserverProviderOptions, listPerPeerScopeSyncState, listProjectScopeCandidates, listProjectScopeInventory, listProjectScopeSettingsMappings, listRecipientPolicyIntent, listRecipientPolicyReview, listSharingDomainSettingsScopes, loadMemorySnapshotPageForPeer, loadReplicationOpsForPeer, lookupCoordinatorPeers, memoryFilterValueMatchesType, mergeAddresses, migrateRecipientPolicyIntent, mutateCodememConfigFile, negotiateSyncCapability, normalizeAddress, normalizeHumanPresentationName, normalizeSyncCapability, normalizeSyncFeatures, normalizeTeammateName, parseAcceptedProjectIntent, parsePositiveMemoryId, parseReassignScopePayload, parseRecipientPolicyEdgeCommitRequest, parseStrictInteger, parseSyncScopeRequest, persistShareOperation, personalScopeGrantStatusForPeer, planShareOperation, previewDeviceIdentityBindings, previewLegacyTeamSetupActivation, previewRecipientPolicyEdges, previewRecipientPolicyOnboarding, previewRecipientPolicyOnboardingFromReviewedIntent, probeAvailableCredentials, projectMatchesFilter, projectShareLifecycle, promptPackArtifactFingerprint, readCodememConfigFile, readCoordinatorSyncConfig, reassignProjectScopeInventoryProject, recipientInviteAuthoritativeIdentityId, recipientPolicyDigest, recipientReviewedIntentDigest, reconcileCoordinatorEnrollmentSnapshot, reconcileRecipientPolicyProject, reconcileShareOperationAcceptance, reconstructLegacyTeamSetupCompletionManifest, recordAutomaticRecall, recordHighestObservedDirectSignatureVersion, recordNonce, recordPromptPackArtifacts, recordPromptPackTerminal, refreshAuthorizedCoordinatorPeerTrust, refreshConfiguredScopeMembershipCache, refreshLegacyTeamCandidate, rejectInboundScopeFailures, renameRecipientPolicyTeam, replayLegacyTeamSetupActivation, requestJson, requireLegacyTeamSetupAccessDeltaWithinLimit, resolveDbPath, resolveObserverRuntime, resolveProject, resolveProjectRoot, resolveRecipientPolicyReview, resolveRecipientPolicyReviewBulk, runSyncPass, schema, serializeRecipientPolicyCoordinatorGroupMutation, serializeRecipientPolicyPublicationMutation, serializeRecipientPolicyTeamMutation, setLegacyTeamSetupDeviceAssignment, setLegacyTeamSetupDeviceDecision, setLegacyTeamSetupProjectMapping, storeVectors, summarizeInboundScopeRejections, summaryLikeSqlPredicate, supportsSyncFeature, syncScopeResetRequiredPayload, toJson, tryUpdateRetrievalDelivery, updatePeerAddresses, upsertCoordinatorGroupPreference, upsertProjectScopeSettingsMapping, validateLegacyTeamSetupCompletionManifest, validateLegacyTeamSetupCompletionManifestBinding, validateRawEvents, verifyDirectPeerSignature, verifyRecipientReviewedIntent, verifySignature } from "@codemem/core";
+import { ACCESS_CLEANUP_OP_TYPE, CodememConfigMutationError, CoordinatorReciprocalApprovalRequestChangedError, DEFAULT_TIME_WINDOW_S, LEGACY_SHARED_REVIEW_SCOPE_ID, LOCAL_DEFAULT_SCOPE_ID, LOCAL_SYNC_CAPABILITY, LOCAL_SYNC_FEATURES, LegacyTeamSetupAdditiveConvergenceError, LegacyTeamSetupRosterCapacityError, MEMORY_FILTER_FIELD_TYPES, MEMORY_FILTER_NAMES, MEMORY_KIND_DESCRIPTIONS, MemoryStore, ObserverClient, PROMPT_TRANSPORT_PROTOCOL_RANGE, REMEMBER_MEMORY_KINDS, RawEventIngestValidationError, RecipientPolicyEdgeRequestError, RecipientPolicyTeamRenameError, RemoteCoordinatorRequestError, SCOPE_MEMBERSHIP_REVOCATION_LIMITATION, SYNC_AUTHORIZATION_REFRESH_HEADER, SYNC_CAPABILITY_HEADER, SYNC_FEATURES_HEADER, SYNC_SCOPE_QUERY_PARAM, VERSION, VERSION as VERSION$1, VIEWER_IDENTITY_TARGET_KEYS, VIEWER_SERVICE_DISCRIMINATOR, addSyncScopeToBoundary, analyzeProjectScopeMappingChangeGuardrails, analyzeProjectScopeMappingChangesGuardrails, analyzeProjectScopeMappingDeletionGuardrails, applyLegacyTeamSetupCompletionManifest, applyLegacyTeamSetupCompletionManifestAndReturnActivation, applyReplicationOps, areLegacyTeamSetupCompletionPolicyFactsAdditivelyCompatible, automaticRecallHealth, buildAuthHeaders, buildBaseUrl, buildDirectPeerAuthHeaders, buildDistillReport, buildFilterClausesWithContext, buildPiFlushSignalFromEvent, buildRawEventEnvelopeFromCodexHook, buildRawEventEnvelopeFromHook, buildRawEventEnvelopeFromPiEvent, buildViewerIdentityTarget, canonicalCoordinatorLegacyTeamCompletionManifestJson, canonicalMemoryKind, canonicalRepositoryProjectIdentity, canonicalWorkspaceIdentity, claimRecipientPolicyActorMutations, claimRecipientPolicyPublicationMutation, cleanupNonces, clearLegacyTeamSetupDeviceDecision, clonePromptPackAttempt, coerceObserverCommand, commitDeviceIdentityBindings, commitRecipientPolicyEdges, containLegacyTeamSetupCompletionConflict, coordinatorArchiveGroupAction, coordinatorCreateAddDeviceInviteAction, coordinatorCreateGroupAction, coordinatorCreateInviteAction, coordinatorCreateLegacyTeamCompletionAction, coordinatorCreateScopeAction, coordinatorDisableDeviceAction, coordinatorEnableDeviceAction, coordinatorGetLegacyTeamCompletionAction, coordinatorGrantScopeMembershipAction, coordinatorImportInviteAction, coordinatorListBootstrapGrantsAction, coordinatorListConsumedTeamInvitesAction, coordinatorListDevicesAction, coordinatorListGroupsAction, coordinatorListJoinRequestsAction, coordinatorListLegacyTeamCompletionsAction, coordinatorListReviewedRecipientInviteEvidenceAction, coordinatorListScopeMembershipsAction, coordinatorListScopesAction, coordinatorRemoveDeviceAction, coordinatorRenameDeviceAction, coordinatorRenameGroupAction, coordinatorReviewJoinRequestAction, coordinatorRevokeBootstrapGrantAction, coordinatorRevokeScopeMembershipAction, coordinatorStatusSnapshot, coordinatorUnarchiveGroupAction, coordinatorUpdateScopeAction, countShareableProjectMemories, createCoordinatorReciprocalApproval, decodeInvitePayload, dedupeOrderedIds, defaultSpaceScopeIdForGroup, deleteProjectScopeSettingsMapping, deriveLegacyTeamSetupCompletionManifest, detectInstallKind, deterministicPolicyTeamId, diagnoseStalePeerReceivedRows, discoverLegacyTeamCandidates, ensureDeviceIdentity, executeShareProvisioning, extractInvitePayload, extractReplicationOps, filterReplicationOpsForSyncWithStatus, fingerprintPublicKey, formatHostPort, friendlyDeviceName, fromJson, getCodememConfigPath, getCodememEnvOverrideValues, getCodememEnvOverrides, getCoordinatorEnrollmentReconciliationIssueSummary, getCoordinatorGroupPreference, getLegacyTeamSetupDraft, getRecipientPolicyAuthorityState, getSemanticIndexDiagnostics, getSyncResetState, getUpdateStatus, ingestRawEvents, inspectFreshLegacyTeamSetupActivation, inspectLegacyTeamSetupActivation, inviteTokenDigest, isAutomaticRecallMeasurement, isLegacyTeamCandidateSelectable, isLegacyTeamSetupProjectMappingIdentity, isPeerTrustBindingCompatible, isProjectSyncEnablementError, isScopedSyncCapability, judgeDistillReport, legacyTeamCandidateId, legacyTeamCandidateProjectInventory, legacyTeamCanonicalProjectRef, legacyTeamDeviceRef, legacyTeamResolvedProjectRef, legacyTeamSetupApiErrorCode, listAuthorizedScopesForPeer, listCoordinatorJoinRequests, listDeviceIdentityInventory, listInboundScopeRejections, listLegacyRecipientPolicyProjections, listMaintenanceJobs, listObserverProviderOptions, listPerPeerScopeSyncState, listProjectScopeCandidates, listProjectScopeInventory, listProjectScopeSettingsMappings, listRecipientPolicyIntent, listRecipientPolicyReview, listSharingDomainSettingsScopes, loadMemorySnapshotPageForPeer, loadReplicationOpsForPeer, lookupCoordinatorPeers, memoryFilterValueMatchesType, mergeAddresses, migrateRecipientPolicyIntent, mutateCodememConfigFile, negotiateSyncCapability, normalizeAddress, normalizeHumanPresentationName, normalizeSyncCapability, normalizeSyncFeatures, normalizeTeammateName, parseAcceptedProjectIntent, parsePositiveMemoryId, parseReassignScopePayload, parseRecipientPolicyEdgeCommitRequest, parseStrictInteger, parseSyncScopeRequest, persistShareOperation, personalScopeGrantStatusForPeer, planShareOperation, previewDeviceIdentityBindings, previewLegacyTeamSetupActivation, previewRecipientPolicyEdges, previewRecipientPolicyOnboarding, previewRecipientPolicyOnboardingFromReviewedIntent, probeAvailableCredentials, projectMatchesFilter, projectShareLifecycle, promptPackArtifactFingerprint, readCodememConfigFile, readCoordinatorSyncConfig, reassignProjectScopeInventoryProject, recipientInviteAuthoritativeIdentityId, recipientPolicyDigest, recipientReviewedIntentDigest, reconcileCoordinatorEnrollmentSnapshot, reconcileRecipientPolicyProject, reconcileShareOperationAcceptance, reconstructLegacyTeamSetupCompletionManifest, recordAutomaticRecall, recordHighestObservedDirectSignatureVersion, recordNonce, recordPromptPackArtifacts, recordPromptPackTerminal, refreshAuthorizedCoordinatorPeerTrust, refreshConfiguredScopeMembershipCache, refreshLegacyTeamCandidate, rejectInboundScopeFailures, renameRecipientPolicyTeam, replayLegacyTeamSetupActivation, repositoryIdentitiesByWorkspace, repositoryIdentityForWorkspace, requestJson, requireLegacyTeamSetupAccessDeltaWithinLimit, resolveDbPath, resolveObserverRuntime, resolveProject, resolveProjectRoot, resolveRecipientPolicyReview, resolveRecipientPolicyReviewBulk, runSyncPass, schema, serializeRecipientPolicyCoordinatorGroupMutation, serializeRecipientPolicyPublicationMutation, serializeRecipientPolicyTeamMutation, setLegacyTeamSetupDeviceAssignment, setLegacyTeamSetupDeviceDecision, setLegacyTeamSetupProjectMapping, storeVectors, summarizeInboundScopeRejections, summaryLikeSqlPredicate, supportsSyncFeature, syncScopeResetRequiredPayload, toJson, tryUpdateRetrievalDelivery, updatePeerAddresses, upsertCoordinatorGroupPreference, upsertProjectScopeSettingsMappings, validateLegacyTeamSetupCompletionManifest, validateLegacyTeamSetupCompletionManifestBinding, validateRawEvents, verifyDirectPeerSignature, verifyRecipientReviewedIntent, verifySignature, wakeRecipientPoliciesForIdentities, wakeRecipientPoliciesForProjectIdentities } from "@codemem/core";
 import { serveStatic } from "@hono/node-server/serve-static";
 import { Hono } from "hono";
 import { createMiddleware } from "hono/factory";
@@ -3847,6 +3847,8 @@ var AUTOMATIC_WAITING_ACCEPTANCE_RETRY_COOLDOWN_MS = 3e4;
 var AUTOMATIC_WAITING_DEVICE_RETRY_COOLDOWN_MS = 3e5;
 var TERMINAL_SHARE_MAINTENANCE_ERRORS = /* @__PURE__ */ new Set([
 	"coordinator_not_configured",
+	"conflicting_repository_mappings",
+	"project_mapping_conflict",
 	"team_sharing_not_configured",
 	"team_selection_ambiguous",
 	"initiating_device_not_reviewed",
@@ -4048,25 +4050,69 @@ async function advancePendingProjectSharesOperation(store, options) {
 var RECIPIENT_POLICY_MAINTENANCE_MAX_LIMIT = 10;
 var RECIPIENT_POLICY_MAINTENANCE_DEFAULT_LIMIT = 3;
 var RECIPIENT_POLICY_MAINTENANCE_BACKOFF_MS = 6e4;
+function recipientPolicyMaintenanceCandidates(store, retryBefore, limit) {
+	const repositoryIdentities = repositoryIdentitiesByWorkspace(store.db);
+	const canonicalize = (projectId) => canonicalRepositoryProjectIdentity(repositoryIdentities, projectId);
+	const projectIds = store.db.prepare(`SELECT canonical_project_identity FROM project_recipients
+			 UNION SELECT canonical_project_identity FROM recipient_policy_authority_states`).all();
+	const authorityRows = store.db.prepare(`SELECT authority_state, canonical_project_identity, last_attempt_at, safe_error_code
+			 FROM recipient_policy_authority_states`).all();
+	const authorityByProject = /* @__PURE__ */ new Map();
+	for (const row of authorityRows) {
+		const projectId = canonicalize(row.canonical_project_identity);
+		const current = authorityByProject.get(projectId);
+		if (!current) {
+			authorityByProject.set(projectId, row);
+			continue;
+		}
+		if (current.canonical_project_identity === projectId) continue;
+		if (row.canonical_project_identity === projectId) {
+			authorityByProject.set(projectId, row);
+			continue;
+		}
+		if (String(row.last_attempt_at ?? "") > String(current.last_attempt_at ?? "")) authorityByProject.set(projectId, row);
+	}
+	return [...new Set(projectIds.map((row) => canonicalize(row.canonical_project_identity)))].filter((projectId) => {
+		const authority = authorityByProject.get(projectId);
+		return authority == null || authority.last_attempt_at == null || authority.safe_error_code == null && authority.authority_state !== "active" || authority.last_attempt_at <= retryBefore;
+	}).toSorted((left, right) => {
+		const leftAttempt = authorityByProject.get(left)?.last_attempt_at;
+		const rightAttempt = authorityByProject.get(right)?.last_attempt_at;
+		if (leftAttempt == null && rightAttempt != null) return -1;
+		if (leftAttempt != null && rightAttempt == null) return 1;
+		return String(leftAttempt ?? "").localeCompare(String(rightAttempt ?? "")) || left.localeCompare(right);
+	}).slice(0, limit);
+}
+function recordRecipientPolicyMaintenanceFailure(store, projectId, attemptedAt) {
+	store.db.prepare(`INSERT INTO recipient_policy_authority_states(
+			 canonical_project_identity, state_changed_at, created_at, updated_at,
+			 attempt_count, last_attempt_at, safe_error_code, last_error_at
+			 ) VALUES (?, ?, ?, ?, 1, ?, 'recipient_policy_reconciliation_failed', ?)
+			 ON CONFLICT(canonical_project_identity) DO UPDATE SET
+			 attempt_count = attempt_count + 1, last_attempt_at = excluded.last_attempt_at,
+			 safe_error_code = excluded.safe_error_code, last_error_at = excluded.last_error_at,
+			 updated_at = excluded.updated_at`).run(projectId, attemptedAt, attemptedAt, attemptedAt, attemptedAt, attemptedAt);
+}
+function isSqliteBusy$1(error) {
+	if (!error || typeof error !== "object" || !("code" in error)) return false;
+	const code = error.code;
+	return typeof code === "string" && (code.startsWith("SQLITE_BUSY") || code.startsWith("SQLITE_LOCKED"));
+}
+function recordMaintenanceFailureIfAvailable(store, projectId, attemptedAt, error) {
+	if (isSqliteBusy$1(error)) return;
+	try {
+		recordRecipientPolicyMaintenanceFailure(store, projectId, attemptedAt);
+	} catch (bookkeepingError) {
+		if (!isSqliteBusy$1(bookkeepingError)) throw bookkeepingError;
+	}
+}
 async function reconcileRecipientPolicyProjectsOperation(store, options) {
 	const limit = Math.max(1, Math.min(Math.trunc(options.limit ?? RECIPIENT_POLICY_MAINTENANCE_DEFAULT_LIMIT), RECIPIENT_POLICY_MAINTENANCE_MAX_LIMIT));
 	const maintenanceNow = options.now ?? /* @__PURE__ */ new Date();
 	const backoffMs = Math.max(0, Math.trunc(options.backoffMs ?? RECIPIENT_POLICY_MAINTENANCE_BACKOFF_MS));
 	const retryBefore = new Date(maintenanceNow.getTime() - backoffMs).toISOString();
-	const rows = store.db.prepare(`WITH projects AS (
-				SELECT DISTINCT canonical_project_identity FROM project_recipients
-				UNION
-				SELECT canonical_project_identity FROM recipient_policy_authority_states
-			)
-			 SELECT projects.canonical_project_identity
-			 FROM projects
-			 LEFT JOIN recipient_policy_authority_states authority
-			  ON authority.canonical_project_identity = projects.canonical_project_identity
-			 WHERE authority.safe_error_code IS NULL OR authority.last_attempt_at IS NULL
-			  OR authority.last_attempt_at <= ?
-			 ORDER BY CASE WHEN authority.last_attempt_at IS NULL THEN 0 ELSE 1 END,
-			  authority.last_attempt_at, projects.canonical_project_identity
-			 LIMIT ?`).all(retryBefore, limit);
+	const attemptedAt = maintenanceNow.toISOString();
+	const projectIds = recipientPolicyMaintenanceCandidates(store, retryBefore, limit);
 	const reconcileProject = options.reconcileProject ?? reconcileRecipientPolicyProject;
 	const result = {
 		processed: 0,
@@ -4076,25 +4122,26 @@ async function reconcileRecipientPolicyProjectsOperation(store, options) {
 		failed: 0,
 		items: []
 	};
-	for (const row of rows) {
+	for (const projectId of projectIds) {
 		result.processed += 1;
 		try {
 			const outcome = await reconcileProject(store.db, {
-				canonicalProjectIdentity: row.canonical_project_identity,
+				canonicalProjectIdentity: projectId,
 				leaseOwner: options.leaseOwner ?? `recipient-policy-maintenance:${store.deviceId || process.pid}`
 			}, options.effects);
 			if (outcome.status === "active") result.active += 1;
 			else if (outcome.status === "needs_attention") result.attention += 1;
 			else result.waiting += 1;
 			result.items.push({
-				canonicalProjectIdentity: row.canonical_project_identity,
+				canonicalProjectIdentity: projectId,
 				status: outcome.status,
 				safeErrorCode: outcome.safeErrorCode
 			});
-		} catch {
+		} catch (error) {
+			recordMaintenanceFailureIfAvailable(store, projectId, attemptedAt, error);
 			result.failed += 1;
 			result.items.push({
-				canonicalProjectIdentity: row.canonical_project_identity,
+				canonicalProjectIdentity: projectId,
 				status: "failed",
 				safeErrorCode: "recipient_policy_reconciliation_failed"
 			});
@@ -4104,6 +4151,14 @@ async function reconcileRecipientPolicyProjectsOperation(store, options) {
 }
 //#endregion
 //#region src/application/sync-status.ts
+var SAFE_RUNTIME_DETAILS = {
+	starting: "Running initial sync in background",
+	stopping: "Stopping sync daemon",
+	error: "Background sync failed. Open diagnostics for details.",
+	rebootstrapping: "Restoring sync baseline",
+	needs_attention: "Sync needs attention",
+	disabled: "Sync is off"
+};
 function traceSync(label, operation) {
 	if (process.env.CODEMEM_TRACE_SYNC_STATUS !== "1") return operation();
 	const startedAt = Date.now();
@@ -4168,6 +4223,10 @@ function initialDaemonState(config, rows, daemonRunning) {
 	if (!daemonRunning) return "stopped";
 	return "ok";
 }
+function safeDaemonIssueCode(state, lastError) {
+	if (state !== "error" || !lastError?.includes("coordinator enrollment maintenance failed")) return null;
+	return lastError.includes(":request_timeout") || lastError.endsWith(" (coordinator_timeout)") ? "coordinator_timeout" : "coordinator_error";
+}
 function retentionPayload(config, rows, retainedFloor) {
 	const state = rows.retention;
 	return {
@@ -4235,8 +4294,9 @@ function readBaseStatus(input) {
 		state = runtime.phase;
 		statusPayload.daemon_state = state;
 		statusPayload.daemon_running = runtime.phase === "starting" || running;
-		statusPayload.daemon_detail = runtime.detail ?? detail;
+		statusPayload.daemon_detail = input.showDiagnostics ? runtime.detail ?? detail : SAFE_RUNTIME_DETAILS[runtime.phase] ?? null;
 	}
+	statusPayload.daemon_issue_code = safeDaemonIssueCode(state, runtime?.phase === "error" ? null : rows.daemon?.last_error);
 	return {
 		config,
 		localDeviceId: rows.device?.device_id ?? null,
@@ -4293,16 +4353,35 @@ function readAttemptStatus(input) {
 		latestError: String(rows[0]?.error || "").trim()
 	};
 }
+function latestFailedPeerIds(store, activePeerIds, isRecentIso) {
+	const cutoff = (/* @__PURE__ */ new Date(Date.now() - 6e5)).toISOString();
+	const now = (/* @__PURE__ */ new Date()).toISOString();
+	return traceSync("recentPeerFailures", () => {
+		const rows = store.db.prepare(`SELECT peer_device_id, ok, error, finished_at
+				 FROM sync_attempts
+				 WHERE (CASE WHEN finished_at IS NULL THEN started_at ELSE finished_at END) BETWEEN ? AND ?
+				 ORDER BY (CASE WHEN finished_at IS NULL THEN started_at ELSE finished_at END) DESC, id DESC`).iterate(cutoff, now);
+		const seen = /* @__PURE__ */ new Set();
+		const failed = /* @__PURE__ */ new Set();
+		for (const row of rows) {
+			if (!activePeerIds.has(row.peer_device_id) || seen.has(row.peer_device_id)) continue;
+			if (!isRecentIso(row.finished_at)) continue;
+			seen.add(row.peer_device_id);
+			if (!row.ok && row.error) failed.add(row.peer_device_id);
+		}
+		return failed;
+	});
+}
 function peerStates(peers) {
 	return new Set(peers.items.map((peer) => String(peer.status?.peer_state ?? "")));
 }
 function allPeersOffline(peers) {
 	return peers.items.length > 0 && peers.items.every((peer) => String(peer.status?.peer_state ?? "") === "offline");
 }
-function degradedDaemonState(input, peers, attempts) {
+function degradedDaemonState(peers, failedPeerIds) {
 	const states = peerStates(peers);
 	const allOffline = allPeersOffline(peers);
-	if (Boolean(attempts.items[0] && attempts.items[0].status === "error" && input.operations.isRecentIso(attempts.items[0].finished_at))) {
+	if (failedPeerIds.size > 0) {
 		if (states.has("online") || states.has("degraded")) return "degraded";
 		if (allOffline) return "offline-peers";
 		if (peers.items.length > 0) return "stale";
@@ -4312,14 +4391,14 @@ function degradedDaemonState(input, peers, attempts) {
 	if (peers.items.length > 0 && !states.has("online")) return "stale";
 	return "ok";
 }
-function applyDerivedDaemonState(input, base, peers, attempts, statusBlock) {
+function applyDerivedDaemonState(base, peers, attempts, failedPeerIds, statusBlock) {
 	let state = base.daemonState;
 	if (state === "ok" && attempts.latestError.startsWith("needs_attention:")) {
 		state = "needs_attention";
 		const detail = attempts.latestError.replace(/^needs_attention:/, "");
 		base.statusPayload.daemon_detail = detail;
 		statusBlock.daemon_detail = detail;
-	} else if (state === "ok") state = degradedDaemonState(input, peers, attempts);
+	} else if (state === "ok") state = degradedDaemonState(peers, failedPeerIds);
 	base.statusPayload.daemon_state = state;
 	statusBlock.daemon_state = state;
 }
@@ -4337,6 +4416,12 @@ async function buildSyncStatusResponse(input) {
 	const coordinator = traceSync("coordinator", () => input.operations.redactCoordinatorStatus(coordinatorSnapshot, input.showDiagnostics));
 	const peers = readPeerStatus(input, base.localDeviceId);
 	const attempts = readAttemptStatus(input);
+	const activePeerIds = new Set(peers.items.map((peer) => String(peer.peer_device_id ?? "")));
+	const failedPeerIds = latestFailedPeerIds(input.store, activePeerIds, input.operations.isRecentIso);
+	for (const peer of peers.items) {
+		const status = peer.status;
+		status.recent_failed_attempt = failedPeerIds.has(String(peer.peer_device_id ?? ""));
+	}
 	const statusBlock = {
 		...base.statusPayload,
 		background_maintenance: input.operations.summarizeMaintenanceJobs(listMaintenanceJobs(input.store.db), input.showDiagnostics),
@@ -4350,7 +4435,7 @@ async function buildSyncStatusResponse(input) {
 	const sharingReview = traceSync("sharingReview", () => input.store.sharingReviewSummary(input.project));
 	const recipientPolicyReconciliation = traceSync("recipientPolicyReconciliation", () => input.operations.listRecipientPolicyReconciliationStatus(input.store));
 	const joinRequests = await readJoinRequests(input, base.config);
-	applyDerivedDaemonState(input, base, peers, attempts, statusBlock);
+	applyDerivedDaemonState(base, peers, attempts, failedPeerIds, statusBlock);
 	const response = {
 		...base.statusPayload,
 		status: statusBlock,
@@ -6594,6 +6679,14 @@ function missingGuardrailConfirmations(warnings, confirmedTokens) {
 	const confirmed = new Set(confirmedTokens);
 	return warnings.filter((warning) => warning.requires_confirmation && (!warning.confirmation_token || !confirmed.has(warning.confirmation_token)));
 }
+function mappingGuardrailChallenge(warnings, missing) {
+	return {
+		error: "guardrail_confirmation_required",
+		required_guardrails: [...new Set(missing.map((warning) => warning.code))],
+		required_guardrail_tokens: [...new Set(missing.map((warning) => warning.confirmation_token))].filter((token) => typeof token === "string" && token.length > 0),
+		guardrail_warnings: warnings
+	};
+}
 function parseViewerProjectMappingInput(body) {
 	const id = optionalViewerInteger(body, "id");
 	const priority = optionalViewerInteger(body, "priority");
@@ -6608,6 +6701,14 @@ function parseViewerProjectMappingInput(body) {
 		source: optionalViewerStrictString(body, "source") ?? "user"
 	};
 }
+function parseViewerProjectMappingInputs(body) {
+	const rawMappings = body.mappings;
+	if (!Array.isArray(rawMappings) || rawMappings.length === 0) throw new Error("mappings must be a non-empty array");
+	return rawMappings.map((raw) => {
+		if (raw == null || typeof raw !== "object" || Array.isArray(raw)) throw new Error("each mapping must be an object");
+		return parseViewerProjectMappingInput(raw);
+	});
+}
 function coordinatorAdminMutationStatus(message) {
 	if (message.includes("scope_not_found") || message.includes("membership_not_found") || message.includes("group_not_found") || message.includes("Group not found") || message.includes("Scope not found") || message.includes("device_not_enrolled_for_scope_group") || message.includes("device must be enrolled")) return 404;
 	if (message.includes("not active") || message.includes("scope_not_active") || message.includes("scope_membership_effect_conflict") || message.includes("group_archived") || message.includes("Group is archived")) return 409;
@@ -7366,6 +7467,21 @@ function recipientPolicyPresenceCapabilityExpiresAt(enrollment, observedAt) {
 function recipientPolicyEnrollmentValueIsValid(value) {
 	return typeof value === "string" && value.length > 0 && value === value.trim();
 }
+function recipientPolicyPresenceCapabilityExpiries(enrollments, observedAt) {
+	return new Map(enrollments.map((enrollment) => [enrollment.device_id, recipientPolicyPresenceCapabilityExpiresAt(enrollment, observedAt)]));
+}
+function recipientPolicySnapshotUnavailable(stage, error) {
+	console.warn(`[sync] recipient policy coordinator snapshot failed: stage=${stage} code=${coordinatorEnrollmentFailureCode(error)}`);
+	throw new Error("recipient_policy_snapshot_not_fresh");
+}
+async function readRecipientPolicyCoordinatorSnapshot(read) {
+	for (let attempt = 0;; attempt++) try {
+		return await read();
+	} catch (error) {
+		if (!(error instanceof RemoteCoordinatorRequestError) || error.status !== 429 || attempt >= 2) throw error;
+		await new Promise((resolve) => setTimeout(resolve, (attempt + 1) * 1e3));
+	}
+}
 function createRecipientPolicyReconcilerEffects(store, options = {}) {
 	const config = options.config ?? readCoordinatorSyncConfig();
 	const now = options.now ?? (() => (/* @__PURE__ */ new Date()).toISOString());
@@ -7407,15 +7523,13 @@ function createRecipientPolicyReconcilerEffects(store, options = {}) {
 		now,
 		snapshot: async ({ scopeId }) => {
 			const targetOptions = coordinatorOptions(scopeId);
-			const snapshotMemberships = (await coordinatorListScopeMembershipsAction({
+			const snapshotMemberships = (await readRecipientPolicyCoordinatorSnapshot(() => coordinatorListScopeMembershipsAction({
 				groupId: targetOptions.groupId,
 				scopeId,
 				includeRevoked: true,
 				remoteUrl: targetOptions.remoteUrl,
 				adminSecret: targetOptions.adminSecret
-			}).catch(() => {
-				throw new Error("recipient_policy_snapshot_not_fresh");
-			})).map((membership) => {
+			})).catch((error) => recipientPolicySnapshotUnavailable("scope_memberships", error))).map((membership) => {
 				if (typeof membership.device_id !== "string" || membership.status !== "active" && membership.status !== "revoked") throw new Error("recipient_policy_snapshot_invalid");
 				const status = membership.status;
 				return {
@@ -7436,15 +7550,13 @@ function createRecipientPolicyReconcilerEffects(store, options = {}) {
 		listBoundaryEnrollments: async ({ scopeId }) => {
 			const targetOptions = coordinatorOptions(scopeId);
 			const observedAt = now();
-			const enrollments = await listDevices({
+			const enrollments = await readRecipientPolicyCoordinatorSnapshot(() => listDevices({
 				groupId: targetOptions.groupId,
 				includeDisabled: true,
 				remoteUrl: targetOptions.remoteUrl,
 				adminSecret: targetOptions.adminSecret
-			}).catch(() => {
-				throw new Error("recipient_policy_snapshot_not_fresh");
-			});
-			const presenceCapabilityExpiries = new Map(enrollments.map((enrollment) => [enrollment.device_id, recipientPolicyPresenceCapabilityExpiresAt(enrollment, observedAt)]));
+			})).catch((error) => recipientPolicySnapshotUnavailable("device_enrollments", error));
+			const presenceCapabilityExpiries = recipientPolicyPresenceCapabilityExpiries(enrollments, observedAt);
 			const mapped = enrollments.map((enrollment) => {
 				if (enrollment.group_id !== targetOptions.groupId || !recipientPolicyEnrollmentValueIsValid(enrollment.device_id) || !recipientPolicyEnrollmentValueIsValid(enrollment.public_key) || !recipientPolicyEnrollmentValueIsValid(enrollment.fingerprint) || fingerprintPublicKey(enrollment.public_key) !== enrollment.fingerprint || enrollment.enabled !== 0 && enrollment.enabled !== 1 || enrollment.identity_id !== null && !recipientPolicyEnrollmentValueIsValid(enrollment.identity_id)) throw new Error("recipient_policy_snapshot_invalid");
 				return {
@@ -7565,13 +7677,25 @@ function recipientPolicyReadCopy(state) {
 		explanation: "Legacy scope enforcement remains in control while reconciliation is pending."
 	};
 }
+function recipientPolicyAuthorityForAliases(store, canonicalProjectIdentity, aliases) {
+	const canonical = getRecipientPolicyAuthorityState(store.db, canonicalProjectIdentity);
+	if (canonical) return canonical;
+	return aliases.filter((identity) => identity !== canonicalProjectIdentity).map((identity) => getRecipientPolicyAuthorityState(store.db, identity)).filter((state) => state != null).toSorted((left, right) => right.updatedAt.localeCompare(left.updatedAt))[0] ?? null;
+}
 function listRecipientPolicyReconciliationStatus(store) {
+	const projectIds = store.db.prepare(`SELECT DISTINCT canonical_project_identity FROM project_recipients WHERE status = 'active'
+				 UNION SELECT canonical_project_identity FROM recipient_policy_authority_states
+				 ORDER BY canonical_project_identity`).all().map((row) => row.canonical_project_identity);
+	const repositoryIdentities = repositoryIdentitiesByWorkspace(store.db);
+	const aliasesByProject = /* @__PURE__ */ new Map();
+	for (const projectId of projectIds) {
+		const canonical = canonicalRepositoryProjectIdentity(repositoryIdentities, projectId);
+		aliasesByProject.set(canonical, [...aliasesByProject.get(canonical) ?? [], projectId]);
+	}
 	return {
 		version: 1,
-		items: store.db.prepare(`SELECT DISTINCT canonical_project_identity FROM project_recipients WHERE status = 'active'
-				 UNION SELECT canonical_project_identity FROM recipient_policy_authority_states
-				 ORDER BY canonical_project_identity`).all().map((row) => row.canonical_project_identity).map((canonicalProjectIdentity) => {
-			const state = recipientPolicyReadState(getRecipientPolicyAuthorityState(store.db, canonicalProjectIdentity));
+		items: [...aliasesByProject.keys()].toSorted().map((canonicalProjectIdentity) => {
+			const state = recipientPolicyReadState(recipientPolicyAuthorityForAliases(store, canonicalProjectIdentity, aliasesByProject.get(canonicalProjectIdentity) ?? []));
 			return {
 				canonicalProjectIdentity,
 				state,
@@ -8565,6 +8689,7 @@ function addLegacySharedReviewRow(groups, row, identity, candidate, isOwnedBySel
 }
 function collectLegacySharedReviewGroups(store) {
 	const ownedBySelf = store.buildOwnershipPredicate();
+	const repositoryIdentities = repositoryIdentitiesByWorkspace(store.db);
 	const candidatesByIdentity = new Map(listProjectScopeCandidates(store.db, { limit: null }).map((candidate) => [candidate.workspace_identity, candidate]));
 	const groups = /* @__PURE__ */ new Map();
 	let memoryCount = 0;
@@ -8576,6 +8701,11 @@ function collectLegacySharedReviewGroups(store) {
 			cwd: row.cwd,
 			gitBranch: row.git_branch,
 			gitRemote: row.git_remote,
+			repositoryIdentity: repositoryIdentityForWorkspace(repositoryIdentities, {
+				cwd: row.cwd,
+				gitRemote: row.git_remote,
+				metadataJson: row.session_metadata_json
+			}),
 			project: row.project,
 			workspaceId: row.workspace_id
 		});
@@ -8650,7 +8780,8 @@ function legacySharedReviewSummaryRows(store) {
 			        m.workspace_id,
 			        m.actor_id,
 			        m.origin_device_id,
-			        m.metadata_json
+			        m.metadata_json,
+			        s.metadata_json AS session_metadata_json
 			 FROM memory_items m
 			 LEFT JOIN sessions s ON s.id = m.session_id
 			 WHERE m.scope_id = ?
@@ -8690,7 +8821,8 @@ function legacySharedReviewRows(store) {
 			        m.workspace_id,
 			        m.actor_id,
 			        m.origin_device_id,
-			        m.metadata_json
+			        m.metadata_json,
+			        s.metadata_json AS session_metadata_json
 			 FROM memory_items m
 			 LEFT JOIN sessions s ON s.id = m.session_id
 			 WHERE m.scope_id = ?
@@ -8707,7 +8839,7 @@ function legacySharedReviewConfirmationToken(input) {
 	return Buffer.from(`${input.workspaceIdentity}|${input.scopeId}|${payload}`, "utf8").toString("base64url");
 }
 function projectInventoryRowsForWorkspace(store, workspaceIdentity) {
-	return store.db.prepare(`SELECT m.id,
+	const rows = store.db.prepare(`SELECT m.id,
 			        m.rev,
 			        s.project,
 			        s.cwd,
@@ -8716,15 +8848,23 @@ function projectInventoryRowsForWorkspace(store, workspaceIdentity) {
 			        m.workspace_id,
 			        m.actor_id,
 			        m.origin_device_id,
-			        m.metadata_json
+			        m.metadata_json,
+			        s.metadata_json AS session_metadata_json
 			 FROM memory_items m
 			 LEFT JOIN sessions s ON s.id = m.session_id
 			 WHERE m.active = 1
-			   AND m.deleted_at IS NULL`).all().filter((row) => {
+			   AND m.deleted_at IS NULL`).all();
+	const repositoryIdentities = repositoryIdentitiesByWorkspace(store.db);
+	return rows.filter((row) => {
 		return canonicalWorkspaceIdentity({
 			cwd: row.cwd,
 			gitBranch: row.git_branch,
 			gitRemote: row.git_remote,
+			repositoryIdentity: repositoryIdentityForWorkspace(repositoryIdentities, {
+				cwd: row.cwd,
+				gitRemote: row.git_remote,
+				metadataJson: row.session_metadata_json
+			}),
 			project: row.project,
 			workspaceId: row.workspace_id
 		}).value === workspaceIdentity;
@@ -8778,11 +8918,17 @@ function assertLocalDeviceScopeMembership(store, scopeId) {
 			 LIMIT 1`).get(scopeId, store.deviceId)) throw new Error(`local device is not a member of Sharing domain ${scopeId}`);
 }
 function legacySharedReviewRowsForWorkspace(store, workspaceIdentity) {
+	const repositoryIdentities = repositoryIdentitiesByWorkspace(store.db);
 	return legacySharedReviewRows(store).filter((row) => {
 		return canonicalWorkspaceIdentity({
 			cwd: row.cwd,
 			gitBranch: row.git_branch,
 			gitRemote: row.git_remote,
+			repositoryIdentity: repositoryIdentityForWorkspace(repositoryIdentities, {
+				cwd: row.cwd,
+				gitRemote: row.git_remote,
+				metadataJson: row.session_metadata_json
+			}),
 			project: row.project,
 			workspaceId: row.workspace_id
 		}).value === workspaceIdentity;
@@ -9329,6 +9475,119 @@ function serializeProjectScopeInventory(store, inventory, sharingByProject) {
 		}))
 	};
 }
+async function deleteProjectScopeMappingRoute(c, store) {
+	const id = Number(c.req.param("id"));
+	let releasePublicationMutation;
+	try {
+		const body = c.req.header("content-type")?.includes("application/json") ? await parseViewerJsonBody(c) : {};
+		if (!body) return c.json({ error: "invalid json" }, 400);
+		const confirmedGuardrailTokens = optionalViewerStringList(body, "confirmed_guardrail_tokens");
+		releasePublicationMutation = await claimRecipientPolicyPublicationMutation(store.db);
+		const [deviceId] = ensureDeviceIdentity(store.db, { keysDir: syncKeysDir() });
+		const warnings = analyzeProjectScopeMappingDeletionGuardrails(store.db, id, deviceId);
+		const missing = missingGuardrailConfirmations(warnings, confirmedGuardrailTokens);
+		if (missing.length > 0) return c.json({
+			error: "guardrail_confirmation_required",
+			required_guardrails: [...new Set(missing.map((warning) => warning.code))],
+			required_guardrail_tokens: missing.map((warning) => warning.confirmation_token),
+			guardrail_warnings: warnings
+		}, 409);
+		const deleted = deleteProjectMappingAndWakePolicies(store, id, deviceId, confirmedGuardrailTokens);
+		return c.json({
+			ok: true,
+			deleted
+		});
+	} catch (error) {
+		return c.json({ error: error instanceof Error ? error.message : String(error) }, 400);
+	} finally {
+		releasePublicationMutation?.();
+	}
+}
+function projectSharingByRepository(store, operations) {
+	const operationById = new Map(operations.map((operation) => [operation.operation_id, operation]));
+	const sharingByProject = /* @__PURE__ */ new Map();
+	const mappings = store.db.prepare("SELECT workspace_identity, project_pattern FROM project_scope_mappings").all();
+	const repositoryIdentities = repositoryIdentitiesByWorkspace(store.db, { knownRepositoryIdentities: mappings.flatMap((mapping) => [mapping.workspace_identity, mapping.project_pattern]) });
+	const seenOperationProjects = /* @__PURE__ */ new Set();
+	const reviewed = store.db.prepare(`SELECT p.operation_id, p.canonical_project_identity
+			 FROM share_operation_projects p
+			 JOIN share_operations o ON o.operation_id = p.operation_id
+			 WHERE o.inviter_actor_id = ? ORDER BY o.created_at, p.ordinal`).all(store.actorId);
+	for (const item of reviewed) {
+		const operation = operationById.get(item.operation_id);
+		if (!operation) continue;
+		const projectId = canonicalRepositoryProjectIdentity(repositoryIdentities, item.canonical_project_identity);
+		const operationProjectKey = `${item.operation_id}\u0000${projectId}`;
+		if (seenOperationProjects.has(operationProjectKey)) continue;
+		seenOperationProjects.add(operationProjectKey);
+		const current = sharingByProject.get(projectId) ?? [];
+		current.push({
+			person: operation.person,
+			lifecycle: {
+				state: operation.lifecycle.state,
+				label: operation.lifecycle.label,
+				explanation: operation.lifecycle.explanation
+			}
+		});
+		sharingByProject.set(projectId, current);
+	}
+	return sharingByProject;
+}
+function deactivateActorAndWakePolicies(store, actorId, now) {
+	store.db.transaction(() => {
+		store.db.prepare("UPDATE actors SET status = 'deactivated', updated_at = ? WHERE actor_id = ?").run(now, actorId);
+		store.db.prepare("UPDATE sync_peers SET actor_id = NULL WHERE actor_id = ?").run(actorId);
+		wakeRecipientPoliciesForIdentities(store.db, [actorId], now);
+	}).immediate();
+}
+function finishActorMerge(store, primaryActorId, secondaryActorId, now) {
+	store.db.prepare("UPDATE actors SET status = 'merged', merged_into_actor_id = ?, updated_at = ? WHERE actor_id = ?").run(primaryActorId, now, secondaryActorId);
+	wakeRecipientPoliciesForIdentities(store.db, [primaryActorId, secondaryActorId], now);
+}
+function policyWakeMappings(store) {
+	return store.db.prepare("SELECT id, scope_id, workspace_identity FROM project_scope_mappings ORDER BY id").all();
+}
+function existingRequestedMappings(mappings, inputs) {
+	const requestedIds = new Set(inputs.map((input) => input.id).filter((id) => id != null));
+	const requestedIdentities = new Set(inputs.map((input) => input.workspace_identity).filter((identity) => identity != null).map((identity) => canonicalWorkspaceIdentity({ cwd: identity }).value));
+	return mappings.filter((mapping) => {
+		if (requestedIds.has(mapping.id)) return true;
+		if (!mapping.workspace_identity) return false;
+		return requestedIdentities.has(canonicalWorkspaceIdentity({ cwd: mapping.workspace_identity }).value);
+	});
+}
+function mappedProjectsInScopes(mappings, scopeIds) {
+	return mappings.filter((mapping) => scopeIds.has(mapping.scope_id)).map((mapping) => mapping.workspace_identity).filter((identity) => identity != null);
+}
+function wakeRecipientPolicyProjects(store, projectIdentities, now) {
+	wakeRecipientPoliciesForProjectIdentities(store.db, [...new Set(projectIdentities)], now);
+}
+function saveProjectMappingsAndWakePolicies(store, deviceId, mappingInputs) {
+	return store.db.transaction(() => {
+		const before = policyWakeMappings(store);
+		const previousMappings = existingRequestedMappings(before, mappingInputs);
+		const mappings = upsertProjectScopeSettingsMappings(store.db, mappingInputs, { deviceId });
+		const after = policyWakeMappings(store);
+		const changedScopeIds = /* @__PURE__ */ new Set([...previousMappings.map((mapping) => mapping.scope_id), ...mappings.map((mapping) => mapping.scope_id)]);
+		wakeRecipientPolicyProjects(store, [...mappedProjectsInScopes(before, changedScopeIds), ...mappedProjectsInScopes(after, changedScopeIds)], (/* @__PURE__ */ new Date()).toISOString());
+		return mappings;
+	}).immediate();
+}
+function deleteProjectMappingAndWakePolicies(store, mappingId, deviceId, confirmedGuardrailTokens) {
+	return store.db.transaction(() => {
+		const before = policyWakeMappings(store);
+		const removed = before.find((mapping) => mapping.id === mappingId);
+		const deleted = deleteProjectScopeSettingsMapping(store.db, mappingId, {
+			deviceId,
+			confirmedGuardrailTokens
+		});
+		if (deleted && removed) {
+			const changedScopeIds = /* @__PURE__ */ new Set([removed.scope_id]);
+			wakeRecipientPolicyProjects(store, [...mappedProjectsInScopes(before, changedScopeIds), ...mappedProjectsInScopes(policyWakeMappings(store), changedScopeIds)], (/* @__PURE__ */ new Date()).toISOString());
+		}
+		return deleted;
+	}).immediate();
+}
 /**
 * Viewer-facing sync management routes (/api/sync/*).
 *
@@ -9961,27 +10220,7 @@ function syncRoutes(getStore, getSyncRuntimeStatus, options = {}) {
 			scopeId: c.req.query("scope_id"),
 			status: c.req.query("status")
 		});
-		const operations = await shareOperationReadModels(store, void 0, false);
-		const operationById = new Map(operations.map((operation) => [operation.operation_id, operation]));
-		const sharingByProject = /* @__PURE__ */ new Map();
-		const reviewed = store.db.prepare(`SELECT p.operation_id, p.canonical_project_identity
-			 FROM share_operation_projects p
-			 JOIN share_operations o ON o.operation_id = p.operation_id
-			 WHERE o.inviter_actor_id = ? ORDER BY o.created_at, p.ordinal`).all(store.actorId);
-		for (const item of reviewed) {
-			const operation = operationById.get(item.operation_id);
-			if (!operation) continue;
-			const current = sharingByProject.get(item.canonical_project_identity) ?? [];
-			current.push({
-				person: operation.person,
-				lifecycle: {
-					state: operation.lifecycle.state,
-					label: operation.lifecycle.label,
-					explanation: operation.lifecycle.explanation
-				}
-			});
-			sharingByProject.set(item.canonical_project_identity, current);
-		}
+		const sharingByProject = projectSharingByRepository(store, await shareOperationReadModels(store, void 0, false));
 		return c.json(serializeProjectScopeInventory(store, inventory, sharingByProject));
 	});
 	app.post("/api/sync/projects/reassign-project", async (c) => {
@@ -10238,28 +10477,19 @@ function syncRoutes(getStore, getSyncRuntimeStatus, options = {}) {
 			const confirmedGuardrailTokens = optionalViewerStringList(body, "confirmed_guardrail_tokens");
 			const mappingInput = parseViewerProjectMappingInput(body);
 			releasePublicationMutation = await claimRecipientPolicyPublicationMutation(store.db);
-			const analysis = analyzeProjectScopeMappingChangeGuardrails(store.db, mappingInput);
+			const [deviceId] = ensureDeviceIdentity(store.db, { keysDir: syncKeysDir() });
+			const analysis = analyzeProjectScopeMappingChangeGuardrails(store.db, {
+				...mappingInput,
+				deviceId
+			});
 			if (analysis.requested_workspace_identity?.startsWith("unmapped:")) return c.json({
 				error: "unmapped_project_local_only",
 				message: "Unmapped projects need a stable path, git remote, or workspace id before assigning a Sharing domain.",
 				guardrail_warnings: analysis.warnings
 			}, 400);
 			const missingConfirmations = missingGuardrailConfirmations(analysis.warnings, confirmedGuardrailTokens);
-			if (missingConfirmations.length > 0) {
-				const missingCodes = [...new Set(missingConfirmations.map((warning) => warning.code))];
-				const missingTokens = [...new Set(missingConfirmations.map((warning) => warning.confirmation_token))].filter((token) => typeof token === "string" && token.length > 0);
-				return c.json({
-					error: "guardrail_confirmation_required",
-					required_guardrails: missingCodes,
-					required_guardrail_tokens: missingTokens,
-					guardrail_warnings: analysis.warnings
-				}, 409);
-			}
-			const [deviceId] = ensureDeviceIdentity(store.db, { keysDir: syncKeysDir() });
-			const mapping = upsertProjectScopeSettingsMapping(store.db, {
-				deviceId,
-				...mappingInput
-			});
+			if (missingConfirmations.length > 0) return c.json(mappingGuardrailChallenge(analysis.warnings, missingConfirmations), 409);
+			const [mapping] = saveProjectMappingsAndWakePolicies(store, deviceId, [mappingInput]);
 			return c.json({
 				ok: true,
 				mapping,
@@ -10277,14 +10507,13 @@ function syncRoutes(getStore, getSyncRuntimeStatus, options = {}) {
 		if (!body) return c.json({ error: "invalid json" }, 400);
 		let releasePublicationMutation;
 		try {
-			const rawMappings = body.mappings;
-			if (!Array.isArray(rawMappings) || rawMappings.length === 0) return c.json({ error: "mappings must be a non-empty array" }, 400);
-			const mappingInputs = rawMappings.map((raw) => {
-				if (raw == null || typeof raw !== "object" || Array.isArray(raw)) throw new Error("each mapping must be an object");
-				return parseViewerProjectMappingInput(raw);
-			});
+			const mappingInputs = parseViewerProjectMappingInputs(body);
 			releasePublicationMutation = await claimRecipientPolicyPublicationMutation(store.db);
-			const analyses = mappingInputs.map((mappingInput) => analyzeProjectScopeMappingChangeGuardrails(store.db, mappingInput));
+			const [deviceId] = ensureDeviceIdentity(store.db, { keysDir: syncKeysDir() });
+			const analyses = analyzeProjectScopeMappingChangesGuardrails(store.db, mappingInputs.map((input) => ({
+				...input,
+				deviceId
+			})));
 			const unmapped = analyses.find((analysis) => analysis.requested_workspace_identity?.startsWith("unmapped:"));
 			if (unmapped) return c.json({
 				error: "unmapped_project_local_only",
@@ -10292,24 +10521,10 @@ function syncRoutes(getStore, getSyncRuntimeStatus, options = {}) {
 				guardrail_warnings: unmapped.warnings
 			}, 400);
 			const missingConfirmations = analyses.flatMap((analysis) => missingGuardrailConfirmations(analysis.warnings, []));
-			if (missingConfirmations.length > 0) {
-				const missingCodes = [...new Set(missingConfirmations.map((warning) => warning.code))];
-				const missingTokens = [...new Set(missingConfirmations.map((warning) => warning.confirmation_token))].filter((token) => typeof token === "string" && token.length > 0);
-				return c.json({
-					error: "guardrail_confirmation_required",
-					required_guardrails: missingCodes,
-					required_guardrail_tokens: missingTokens,
-					guardrail_warnings: analyses.flatMap((analysis) => analysis.warnings)
-				}, 409);
-			}
-			const [deviceId] = ensureDeviceIdentity(store.db, { keysDir: syncKeysDir() });
-			const saveMappings = store.db.transaction(() => mappingInputs.map((mappingInput) => upsertProjectScopeSettingsMapping(store.db, {
-				deviceId,
-				...mappingInput
-			})));
+			if (missingConfirmations.length > 0) return c.json(mappingGuardrailChallenge(analyses.flatMap((analysis) => analysis.warnings), missingConfirmations), 409);
 			return c.json({
 				ok: true,
-				mappings: saveMappings(),
+				mappings: saveProjectMappingsAndWakePolicies(store, deviceId, mappingInputs),
 				guardrail_warnings: analyses.flatMap((analysis) => analysis.warnings)
 			});
 		} catch (error) {
@@ -10318,23 +10533,7 @@ function syncRoutes(getStore, getSyncRuntimeStatus, options = {}) {
 			releasePublicationMutation?.();
 		}
 	});
-	app.delete("/api/sync/sharing-domains/project-mappings/:id", async (c) => {
-		const store = getStore();
-		const id = Number(c.req.param("id"));
-		let releasePublicationMutation;
-		try {
-			releasePublicationMutation = await claimRecipientPolicyPublicationMutation(store.db);
-			const deleted = deleteProjectScopeSettingsMapping(store.db, id);
-			return c.json({
-				ok: true,
-				deleted
-			});
-		} catch (error) {
-			return c.json({ error: error instanceof Error ? error.message : String(error) }, 400);
-		} finally {
-			releasePublicationMutation?.();
-		}
-	});
+	app.delete("/api/sync/sharing-domains/project-mappings/:id", (c) => deleteProjectScopeMappingRoute(c, getStore()));
 	app.post("/api/sync/peers/identity", async (c) => {
 		const store = getStore();
 		ensureLocalActorRecord(store);
@@ -10592,11 +10791,7 @@ function syncRoutes(getStore, getSyncRuntimeStatus, options = {}) {
 					 WHERE inviter_actor_id = ? OR recipient_actor_id = ? OR person_id = ?`).run(secondaryActorId, primaryActorId, secondaryActorId, primaryActorId, secondaryActorId, primaryActorId, now, secondaryActorId, secondaryActorId, secondaryActorId);
 			const peerUpdate = d.update(schema.syncPeers).set({ actor_id: primaryActorId }).where(eq(schema.syncPeers.actor_id, secondaryActorId)).run();
 			if (primary.is_local) d.update(schema.syncPeers).set({ claimed_local_actor: 1 }).where(eq(schema.syncPeers.actor_id, primaryActorId)).run();
-			d.update(schema.actors).set({
-				status: "merged",
-				merged_into_actor_id: primaryActorId,
-				updated_at: now
-			}).where(eq(schema.actors.actor_id, secondaryActorId)).run();
+			finishActorMerge(store, primaryActorId, secondaryActorId, now);
 			return { mergedCount: Number(peerUpdate.changes ?? 0) };
 		}).immediate();
 		if ("error" in result) return c.json({ error: result.error }, result.status);
@@ -10615,16 +10810,10 @@ function syncRoutes(getStore, getSyncRuntimeStatus, options = {}) {
 		if (actorId === store.actorId) return c.json({ error: "cannot deactivate this device's own local actor" }, 409);
 		const releaseActorMutations = await claimRecipientPolicyActorMutations(store.db, [actorId]);
 		queueMicrotask(releaseActorMutations);
-		const d = drizzle(store.db, { schema });
-		const actor = d.select().from(schema.actors).where(eq(schema.actors.actor_id, actorId)).get();
+		const actor = drizzle(store.db, { schema }).select().from(schema.actors).where(eq(schema.actors.actor_id, actorId)).get();
 		if (!actor) return c.json({ error: "actor not found" }, 404);
 		if (actor.status !== "active") return c.json({ error: "actor not active" }, 409);
-		const now = (/* @__PURE__ */ new Date()).toISOString();
-		d.update(schema.actors).set({
-			status: "deactivated",
-			updated_at: now
-		}).where(eq(schema.actors.actor_id, actorId)).run();
-		d.update(schema.syncPeers).set({ actor_id: null }).where(eq(schema.syncPeers.actor_id, actorId)).run();
+		deactivateActorAndWakePolicies(store, actorId, (/* @__PURE__ */ new Date()).toISOString());
 		return c.json({ ok: true });
 	});
 	app.post("/api/sync/legacy-devices/claim", async (c) => {