@cueloop/daemon 0.1.0-alpha.2 → 0.1.0-alpha.20

package/src/server.ts

@@ -1,6 +1,6 @@
 /**
  * The socket server: binds DaemonCore's methods to the unix socket, owns the
- * pidfile, stale-socket cleanup, and the idle-exit timer (#14). File
+ * pidfile, stale-socket cleanup, and the idle-exit timer. File
  * permissions are the local auth: the socket and state dir are 0700/0600.
  */
 
@@ -8,10 +8,10 @@ import { chmodSync, closeSync, existsSync, mkdirSync, openSync, readFileSync, rm
 import { DaemonCore, type DaemonEvent } from "./api";
 import { DaemonError } from "./errors";
 import { isKnownMethod, parseParams } from "./validate";
-import { LineBuffer, type Request } from "./protocol";
+import { BackpressureWriter, LineBuffer, type Request } from "./protocol";
 import { cueloopHome, lockPath, pidPath, socketPath } from "./paths";
 
-interface Conn {
+interface Connection {
   write(data: string): void;
   subscribed: boolean;
 }
@@ -33,20 +33,20 @@ const HELD_HOMES = new Set<string>();
 export class DaemonServer {
   readonly core: DaemonCore;
   readonly home: string;
-  private conns = new Set<Conn>();
+  private connections = new Set<Connection>();
   private server: ReturnType<typeof Bun.listen> | null = null;
   private idleTimer: ReturnType<typeof setTimeout> | null = null;
   private lockFd: number | null = null;
   private readonly idleExitMs: number;
   private readonly onIdleExit: () => void;
 
-  constructor(opts: DaemonOptions = {}) {
-    this.home = opts.home ?? cueloopHome();
-    this.idleExitMs = opts.idleExitMs ?? 15 * 60 * 1000;
-    this.onIdleExit = opts.onIdleExit ?? (() => process.exit(0));
+  constructor(options: DaemonOptions = {}) {
+    this.home = options.home ?? cueloopHome();
+    this.idleExitMs = options.idleExitMs ?? 15 * 60 * 1000;
+    this.onIdleExit = options.onIdleExit ?? (() => process.exit(0));
     mkdirSync(this.home, { recursive: true, mode: 0o700 });
     this.core = new DaemonCore(this.home);
-    this.core.onEvent((e) => this.broadcast(e));
+    this.core.onEvent((event) => this.broadcast(event));
   }
 
   /**
@@ -119,22 +119,28 @@ export class DaemonServer {
     // socket file left behind is stale
     if (existsSync(path)) rmSync(path, { force: true });
     const self = this;
-    this.server = Bun.listen<{ buffer: LineBuffer; conn: Conn }>({
+    this.server = Bun.listen<{ buffer: LineBuffer; connection: Connection; writer: BackpressureWriter }>({
       unix: path,
       socket: {
         open(socket) {
-          const conn: Conn = { write: (d) => socket.write(d), subscribed: false };
-          socket.data = { buffer: new LineBuffer(), conn };
-          self.conns.add(conn);
+          const writer = new BackpressureWriter(socket);
+          const connection: Connection = { write: (data) => writer.write(data), subscribed: false };
+          socket.data = { buffer: new LineBuffer(), connection, writer };
+          self.connections.add(connection);
           self.scheduleIdleCheck();
         },
         data(socket, data) {
           socket.data.buffer.push(data.toString(), (line) => {
-            void self.handleLine(socket.data.conn, line);
+            void self.respondToRequestLine(socket.data.connection, line);
           });
         },
+        drain(socket) {
+          // drain can fire before open has attached data on some platforms;
+          // a throw here would take the whole daemon down with the socket
+          socket.data?.writer.drain();
+        },
         close(socket) {
-          self.conns.delete(socket.data.conn);
+          self.connections.delete(socket.data.connection);
           self.scheduleIdleCheck();
         },
         error() {},
@@ -155,9 +161,9 @@ export class DaemonServer {
     this.releaseLock();
   }
 
-  private broadcast(e: DaemonEvent): void {
-    const frame = JSON.stringify(e) + "\n";
-    for (const c of this.conns) if (c.subscribed) c.write(frame);
+  private broadcast(event: DaemonEvent): void {
+    const frame = JSON.stringify(event) + "\n";
+    for (const connection of this.connections) if (connection.subscribed) connection.write(frame);
     this.scheduleIdleCheck();
   }
 
@@ -166,7 +172,7 @@ export class DaemonServer {
     if (this.idleExitMs <= 0) return;
     if (this.idleTimer) clearTimeout(this.idleTimer);
     this.idleTimer = setTimeout(() => {
-      if (this.conns.size === 0 && !this.core.hasPendingSessions()) {
+      if (this.connections.size === 0 && !this.core.hasPendingSessions()) {
         this.stop();
         this.onIdleExit();
       } else {
@@ -175,31 +181,31 @@ export class DaemonServer {
     }, this.idleExitMs);
   }
 
-  private async handleLine(conn: Conn, line: string): Promise<void> {
-    let req: Request;
+  private async respondToRequestLine(connection: Connection, line: string): Promise<void> {
+    let request: Request;
     try {
-      req = JSON.parse(line) as Request;
+      request = JSON.parse(line) as Request;
     } catch {
-      conn.write(JSON.stringify({ id: -1, error: { code: "bad_json", message: "unparseable request" } }) + "\n");
+      connection.write(JSON.stringify({ id: -1, error: { code: "bad_json", message: "unparseable request" } }) + "\n");
       return;
     }
     try {
-      const result = await this.dispatch(conn, req);
-      conn.write(JSON.stringify({ id: req.id, result }) + "\n");
+      const result = await this.dispatch(connection, request);
+      connection.write(JSON.stringify({ id: request.id, result }) + "\n");
     } catch (err) {
       const code = err instanceof DaemonError ? err.code : "internal";
       const message = err instanceof Error ? err.message : String(err);
-      conn.write(JSON.stringify({ id: req.id, error: { code, message } }) + "\n");
+      connection.write(JSON.stringify({ id: request.id, error: { code, message } }) + "\n");
     }
   }
 
-  private async dispatch(conn: Conn, req: Request): Promise<unknown> {
+  private async dispatch(connection: Connection, request: Request): Promise<unknown> {
     // The wire is untrusted JSON: validate before DaemonCore sees anything.
-    if (typeof req.method !== "string" || !isKnownMethod(req.method)) {
-      throw new DaemonError("unknown_method", `unknown method ${String(req.method)}`);
+    if (typeof request.method !== "string" || !isKnownMethod(request.method)) {
+      throw new DaemonError("unknown_method", `unknown method ${String(request.method)}`);
     }
     const core = this.core;
-    switch (req.method) {
+    switch (request.method) {
       case "daemon.ping":
         return { pid: process.pid };
       case "daemon.shutdown":
@@ -209,42 +215,46 @@ export class DaemonServer {
         }, 10);
         return {};
       case "events.subscribe":
-        conn.subscribed = true;
+        connection.subscribed = true;
         return {};
       case "session.create": {
-        const p = parseParams("session.create", req.params);
-        return core.sessionCreate({ workspace: p.workspace, artifact: p.artifact });
+        const params = parseParams("session.create", request.params);
+        return core.sessionCreate({ workspace: params.workspace, artifact: params.artifact });
       }
       case "session.get":
-        return core.sessionGet(parseParams("session.get", req.params).id);
+        return core.sessionGet(parseParams("session.get", request.params).id);
       case "session.list":
-        return core.sessionList(parseParams("session.list", req.params).filter);
+        return core.sessionList(parseParams("session.list", request.params).filter);
       case "session.wait": {
-        const p = parseParams("session.wait", req.params);
-        return core.sessionWait(p.id, p.timeoutMs);
+        const params = parseParams("session.wait", request.params);
+        return core.sessionWait(params.id, params.timeoutMs);
       }
       case "session.annotate": {
-        const p = parseParams("session.annotate", req.params);
-        return core.sessionAnnotate(p.id, p.annotation);
+        const params = parseParams("session.annotate", request.params);
+        return core.sessionAnnotate(params.id, params.annotation);
       }
       case "session.removeAnnotation": {
-        const p = parseParams("session.removeAnnotation", req.params);
-        return core.sessionRemoveAnnotation(p.id, p.annotationId);
+        const params = parseParams("session.removeAnnotation", request.params);
+        return core.sessionRemoveAnnotation(params.id, params.annotationId);
       }
       case "session.setWorkingCopy": {
-        const p = parseParams("session.setWorkingCopy", req.params);
-        return core.sessionSetWorkingCopy(p.id, p.workingCopy);
+        const params = parseParams("session.setWorkingCopy", request.params);
+        return core.sessionSetWorkingCopy(params.id, params.workingCopy);
+      }
+      case "session.setViewed": {
+        const params = parseParams("session.setViewed", request.params);
+        return core.sessionSetViewed(params.id, params.viewedPaths);
       }
       case "session.resolve": {
-        const p = parseParams("session.resolve", req.params);
-        return core.sessionResolve(p.id, p.verdictKind, p.summary);
+        const params = parseParams("session.resolve", request.params);
+        return core.sessionResolve(params.id, params.verdictKind, params.summary);
       }
       case "session.submitRevision": {
-        const p = parseParams("session.submitRevision", req.params);
-        return core.sessionSubmitRevision(p.id, p.content);
+        const params = parseParams("session.submitRevision", request.params);
+        return core.sessionSubmitRevision(params.id, params.content);
       }
       default:
-        throw new DaemonError("unknown_method", `unknown method ${req.method}`);
+        throw new DaemonError("unknown_method", `unknown method ${request.method}`);
     }
   }
 }

package/src/single-instance.test.ts

@@ -1,5 +1,5 @@
 /**
- * Single-instance guarantee (#14): one daemon per home. Two daemons over one
+ * Single-instance guarantee: one daemon per home. Two daemons over one
  * state directory means divergent in-memory sessions and clients seeing
  * whichever half they connect to.
  */
@@ -23,14 +23,14 @@ beforeEach(() => {
   home = mkdtempSync(join(tmpdir(), "cueloop-lock-"));
 });
 afterEach(() => {
-  for (const s of servers.splice(0)) s.stop();
+  for (const runningServer of servers.splice(0)) runningServer.stop();
   rmSync(home, { recursive: true, force: true });
 });
 
 function server(): DaemonServer {
-  const s = new DaemonServer({ home, idleExitMs: 0 });
-  servers.push(s);
-  return s;
+  const daemonServer = new DaemonServer({ home, idleExitMs: 0 });
+  servers.push(daemonServer);
+  return daemonServer;
 }
 
 describe("one daemon per home", () => {
@@ -63,8 +63,8 @@ describe("one daemon per home", () => {
     // a pid that cannot be running (init is never a cueloop daemon, and this
     // simulates the record a crashed process leaves behind)
     writeFileSync(lockPath(home), "999999");
-    const s = server();
-    expect(s.start()).toBe(socketPath(home));
+    const daemonServer = server();
+    expect(daemonServer.start()).toBe(socketPath(home));
   });
 
   test("stopping releases the lock so a restart works", () => {
@@ -84,12 +84,12 @@ describe("one daemon per home", () => {
       DaemonClient.connect({ home, autostart: true }),
     ]);
     try {
-      const pids = await Promise.all(clients.map((c) => c.ping()));
-      const unique = new Set(pids.map((p) => p.pid));
+      const pids = await Promise.all(clients.map((client) => client.ping()));
+      const unique = new Set(pids.map((ping) => ping.pid));
       expect(unique.size).toBe(1);
       // and state is shared: one client's session is visible to the others
-      const s = await clients[0]!.sessionCreate(WS, PLAN);
-      expect((await clients[2]!.sessionGet(s.id)).id).toBe(s.id);
+      const session = await clients[0]!.sessionCreate(WS, PLAN);
+      expect((await clients[2]!.sessionGet(session.id)).id).toBe(session.id);
     } finally {
       for (const c of clients) c.close();
       // the autostarted daemon is not one of `servers` - shut it down

package/src/store.ts

@@ -1,5 +1,5 @@
 /**
- * Session persistence (#14): one JSON document per session, every write
+ * Session persistence: one JSON document per session, every write
  * through a temp file + atomic rename so a crash mid-write can never leave
  * a corrupt record. Recovery is a read-only scan; records that fail to
  * parse are skipped and reported, never deleted.
@@ -49,15 +49,15 @@ export class SessionStore {
   }
 
   list(): ReviewSession[] {
-    return [...this.sessions.values()].sort((a, b) => a.createdAt.localeCompare(b.createdAt));
+    return [...this.sessions.values()].sort((left, right) => left.createdAt.localeCompare(right.createdAt));
   }
 
   upsert(session: ReviewSession): void {
     this.sessions.set(session.id, session);
     const path = join(this.dir, `${session.id}.json`);
-    const tmp = path + ".tmp";
-    writeFileSync(tmp, JSON.stringify(session, null, 2));
-    renameSync(tmp, path);
+    const tempPath = path + ".tmp";
+    writeFileSync(tempPath, JSON.stringify(session, null, 2));
+    renameSync(tempPath, path);
   }
 
   delete(id: string): boolean {

package/src/validate.test.ts

@@ -1,7 +1,33 @@
 import { describe, expect, test } from "bun:test";
+import { mkdtempSync, rmSync } from "node:fs";
+import { tmpdir } from "node:os";
+import { join } from "node:path";
+import { DaemonCore } from "./api";
 import { DaemonError } from "./errors";
-import { isKnownMethod, parseParams, validateSessionRecord } from "./validate";
-import { SCHEMA_VERSION } from "@cueloop/schema";
+import {
+  AnchorSchema,
+  AnnotationSchema,
+  ArtifactMetaSchema,
+  ArtifactSchema,
+  RevisionSchema,
+  SessionRecordSchema,
+  VerdictSchema,
+  WorkspaceSchema,
+  isKnownMethod,
+  parseParams,
+  validateSessionRecord,
+} from "./validate";
+import {
+  SCHEMA_VERSION,
+  type Anchor,
+  type Annotation,
+  type Artifact,
+  type ArtifactMeta,
+  type ReviewSession,
+  type Revision,
+  type Verdict,
+  type WorkspaceKey,
+} from "@cueloop/schema";
 
 describe("method allowlist", () => {
   test("known and unknown methods", () => {
@@ -12,11 +38,11 @@ describe("method allowlist", () => {
 
 describe("parseParams", () => {
   test("accepts a well-formed create and defaults meta", () => {
-    const p = parseParams("session.create", {
+    const params = parseParams("session.create", {
       workspace: { repoRoot: "/repo", branch: "main" },
       artifact: { type: "plan", content: "# P" },
     });
-    expect(p.artifact.meta).toEqual({});
+    expect(params.artifact.meta).toEqual({});
   });
 
   test("rejects a missing workspace with a pathed message", () => {
@@ -55,12 +81,22 @@ describe("parseParams", () => {
   });
 
   test("annotation kinds stay open (extension kinds are allowed)", () => {
-    const p = parseParams("session.annotate", {
+    const params = parseParams("session.annotate", {
       id: "s",
       annotation: { id: "a1", kind: "praise", anchor: { quote: "x" }, body: "nice" },
     });
-    expect(p.annotation.kind).toBe("praise");
-    expect(p.annotation.anchor.prefix).toBe("");
+    expect(params.annotation.kind).toBe("praise");
+    expect(params.annotation.anchor.prefix).toBe("");
+  });
+
+  test("setViewed takes a full path list and rejects non-string entries", () => {
+    expect(parseParams("session.setViewed", { id: "s", viewedPaths: ["src/a.ts", "src/b.ts"] }).viewedPaths).toEqual([
+      "src/a.ts",
+      "src/b.ts",
+    ]);
+    expect(parseParams("session.setViewed", { id: "s", viewedPaths: [] }).viewedPaths).toEqual([]);
+    expect(() => parseParams("session.setViewed", { id: "s", viewedPaths: [1] })).toThrow(/viewedPaths/);
+    expect(() => parseParams("session.setViewed", { id: "s" })).toThrow(/viewedPaths/);
   });
 
   test("null params are treated as empty", () => {
@@ -86,13 +122,91 @@ describe("validateSessionRecord", () => {
   });
 
   test("rejects a foreign schema version with a readable reason", () => {
-    const r = validateSessionRecord({ ...record, schemaVersion: "99" });
-    expect(r.ok).toBe(false);
-    if (!r.ok) expect(r.error).toContain("schemaVersion");
+    const result = validateSessionRecord({ ...record, schemaVersion: "99" });
+    expect(result.ok).toBe(false);
+    if (!result.ok) expect(result.error).toContain("schemaVersion");
   });
 
   test("rejects a structurally broken record", () => {
-    const r = validateSessionRecord({ ...record, revisions: "nope" });
-    expect(r.ok).toBe(false);
+    const result = validateSessionRecord({ ...record, revisions: "nope" });
+    expect(result.ok).toBe(false);
+  });
+});
+
+/**
+ * Wire pins: every schema's entries must cover exactly the keys of the
+ * schema type it mirrors. Runtime complement to the compile-time EntriesOf
+ * check - the samples are fully populated and typed, so a new field in
+ * @cueloop/schema shows up here too.
+ */
+describe("wire pins", () => {
+  const keys = (subject: object) => Object.keys(subject).sort();
+  const entryKeys = (schema: { entries: object }) => Object.keys(schema.entries).sort();
+
+  const fullMeta: Required<ArtifactMeta> = {
+    cwd: "/repo",
+    agent: "claude-code",
+    agentSessionId: "sess-1",
+    planPath: "/repo/plan.md",
+    pr: "org/repo#1",
+    herdrPane: "%7",
+    title: "Plan",
+  };
+  const fullAnchor: Required<Anchor> = { quote: "q", prefix: "p", suffix: "s", blockIndex: 0, start: 0, end: 1 };
+  const fullAnnotation: Required<Annotation> = {
+    id: "a1",
+    kind: "comment",
+    anchor: fullAnchor,
+    body: "b",
+    orphan: false,
+    createdAt: "now",
+  };
+  const fullArtifact: Required<Artifact> = { type: "plan", content: "# P", meta: fullMeta };
+  const fullVerdict: Required<Verdict> = { kind: "approve", summary: "", feedback: "", resolvedAt: "now" };
+  const fullRevision: Required<Revision> = { revision: 1, content: "# P", submittedAt: "now" };
+  const fullWorkspace: Required<WorkspaceKey> = { repoRoot: "/repo", branch: "main" };
+  const fullSession: Required<ReviewSession> = {
+    schemaVersion: SCHEMA_VERSION,
+    id: "ses_1",
+    workspace: fullWorkspace,
+    artifact: fullArtifact,
+    revisions: [fullRevision],
+    annotations: [fullAnnotation],
+    workingCopy: "# P edited",
+    viewedPaths: ["src/a.ts"],
+    verdict: fullVerdict,
+    status: "pending",
+    createdAt: "now",
+  };
+
+  test("schema key sets match the schema types", () => {
+    expect(entryKeys(WorkspaceSchema)).toEqual(keys(fullWorkspace));
+    expect(entryKeys(ArtifactMetaSchema)).toEqual(keys(fullMeta));
+    expect(entryKeys(ArtifactSchema)).toEqual(keys(fullArtifact));
+    expect(entryKeys(AnchorSchema)).toEqual(keys(fullAnchor));
+    // wire annotations arrive without createdAt; the daemon stamps it
+    const { createdAt: _stamped, ...wireAnnotation } = fullAnnotation;
+    expect(entryKeys(AnnotationSchema)).toEqual(keys(wireAnnotation));
+    expect(entryKeys(RevisionSchema)).toEqual(keys(fullRevision));
+    expect(entryKeys(VerdictSchema)).toEqual(keys(fullVerdict));
+    expect(entryKeys(SessionRecordSchema)).toEqual(keys(fullSession));
+    // persisted annotations carry the stamped createdAt
+    const stored = SessionRecordSchema.entries.annotations.item;
+    expect(entryKeys(stored)).toEqual(keys(fullAnnotation));
+  });
+
+  test("a fully-populated meta survives validation and DaemonCore unchanged", () => {
+    const home = mkdtempSync(join(tmpdir(), "cueloop-val-"));
+    try {
+      const params = parseParams("session.create", {
+        workspace: fullWorkspace,
+        artifact: { type: "plan", content: "# P", meta: fullMeta },
+      });
+      const core = new DaemonCore(home);
+      const created = core.sessionCreate(params);
+      expect(core.sessionGet(created.id).artifact.meta).toEqual(fullMeta);
+    } finally {
+      rmSync(home, { recursive: true, force: true });
+    }
   });
 });

package/src/validate.ts

@@ -1,5 +1,5 @@
 /**
- * Runtime validation of the wire boundary (#14). Everything arriving over the
+ * Runtime validation of the wire boundary. Everything arriving over the
  * socket is untrusted JSON: adapters, the CLI, extensions, and any script a
  * user writes all speak this protocol. Validating here means DaemonCore only
  * ever sees well-formed input, and a malformed request gets a precise error
@@ -10,31 +10,50 @@
  */
 
 import * as v from "valibot";
-import { SCHEMA_VERSION } from "@cueloop/schema";
+import {
+  SCHEMA_VERSION,
+  type Anchor,
+  type Annotation,
+  type Artifact,
+  type ArtifactMeta,
+  type ReviewSession,
+  type Revision,
+  type Verdict,
+  type WorkspaceKey,
+} from "@cueloop/schema";
 import { DaemonError } from "./errors";
 
+/**
+ * Drift guard for every hand-mirrored shape below. v.object strips keys it
+ * does not know, so a schema missing a field silently drops that field on
+ * the way into DaemonCore. Each entries object is checked with
+ * `satisfies EntriesOf<T>`: adding a field to the schema types without
+ * mirroring it here (or mirroring a key that does not exist) fails typecheck.
+ */
+type EntriesOf<T> = { [K in keyof T]-?: v.GenericSchema<any, any> };
+
 const NonEmpty = v.pipe(v.string(), v.minLength(1));
 
 export const WorkspaceSchema = v.object({
   repoRoot: NonEmpty,
   branch: NonEmpty,
-});
+} satisfies EntriesOf<WorkspaceKey>);
+
+export const ArtifactMetaSchema = v.object({
+  cwd: v.optional(v.string()),
+  agent: v.optional(v.string()),
+  agentSessionId: v.optional(v.string()),
+  planPath: v.optional(v.string()),
+  pr: v.optional(v.string()),
+  herdrPane: v.optional(v.string()),
+  title: v.optional(v.string()),
+} satisfies EntriesOf<ArtifactMeta>);
 
 export const ArtifactSchema = v.object({
   type: v.picklist(["plan", "diff"]),
   content: v.string(),
-  meta: v.optional(
-    v.object({
-      cwd: v.optional(v.string()),
-      agent: v.optional(v.string()),
-      agentSessionId: v.optional(v.string()),
-      planPath: v.optional(v.string()),
-      title: v.optional(v.string()),
-      pr: v.optional(v.string()),
-    }),
-    {},
-  ),
-});
+  meta: v.optional(ArtifactMetaSchema, {}),
+} satisfies EntriesOf<Artifact>);
 
 export const AnchorSchema = v.object({
   quote: v.string(),
@@ -43,16 +62,17 @@ export const AnchorSchema = v.object({
   blockIndex: v.optional(v.number()),
   start: v.optional(v.number()),
   end: v.optional(v.number()),
-});
+} satisfies EntriesOf<Anchor>);
 
+/** Wire annotations arrive without createdAt - the daemon stamps it. */
 export const AnnotationSchema = v.object({
   id: NonEmpty,
-  /** Open kind set (#2): built-ins are comment and suggestion. */
+  /** Open kind set: built-ins are comment and suggestion. */
   kind: NonEmpty,
   anchor: AnchorSchema,
   body: v.string(),
   orphan: v.optional(v.boolean()),
-});
+} satisfies EntriesOf<Omit<Annotation, "createdAt">>);
 
 const SessionId = NonEmpty;
 
@@ -75,6 +95,7 @@ export const Params = {
   "session.annotate": v.object({ id: SessionId, annotation: AnnotationSchema }),
   "session.removeAnnotation": v.object({ id: SessionId, annotationId: NonEmpty }),
   "session.setWorkingCopy": v.object({ id: SessionId, workingCopy: v.optional(v.string()) }),
+  "session.setViewed": v.object({ id: SessionId, viewedPaths: v.array(v.string()) }),
   "session.resolve": v.object({
     id: SessionId,
     verdictKind: v.picklist(["comment", "approve", "request_changes"]),
@@ -97,37 +118,44 @@ export function parseParams<M extends MethodName>(method: M, params: unknown): v
   const result = v.safeParse(Params[method], params ?? {});
   if (!result.success) {
     const issue = result.issues[0]!;
-    const path = issue.path?.map((p) => String(p.key)).join(".") ?? "";
+    const path = issue.path?.map((pathSegment) => String(pathSegment.key)).join(".") ?? "";
     throw new DaemonError("invalid_params", `${method}: ${path ? path + " - " : ""}${issue.message}`);
   }
   return result.output;
 }
 
+export const RevisionSchema = v.object({
+  revision: v.number(),
+  content: v.string(),
+  submittedAt: v.string(),
+} satisfies EntriesOf<Revision>);
+
+export const VerdictSchema = v.object({
+  kind: v.picklist(["comment", "approve", "request_changes"]),
+  summary: v.string(),
+  feedback: v.string(),
+  resolvedAt: v.string(),
+} satisfies EntriesOf<Verdict>);
+
 /** Persisted records are validated on recovery: a bad file is skipped, not fatal. */
 export const SessionRecordSchema = v.object({
   schemaVersion: v.literal(SCHEMA_VERSION),
   id: NonEmpty,
   workspace: WorkspaceSchema,
   artifact: ArtifactSchema,
-  revisions: v.array(v.object({ revision: v.number(), content: v.string(), submittedAt: v.string() })),
-  annotations: v.array(v.object({ ...AnnotationSchema.entries, createdAt: v.string() })),
+  revisions: v.array(RevisionSchema),
+  annotations: v.array(v.object({ ...AnnotationSchema.entries, createdAt: v.string() } satisfies EntriesOf<Annotation>)),
   workingCopy: v.optional(v.string()),
-  verdict: v.nullable(
-    v.object({
-      kind: v.picklist(["comment", "approve", "request_changes"]),
-      summary: v.string(),
-      feedback: v.string(),
-      resolvedAt: v.string(),
-    }),
-  ),
+  viewedPaths: v.optional(v.array(v.string())),
+  verdict: v.nullable(VerdictSchema),
   status: v.picklist(["pending", "resolved"]),
   createdAt: v.string(),
-});
+} satisfies EntriesOf<ReviewSession>);
 
 export function validateSessionRecord(raw: unknown): { ok: true; value: v.InferOutput<typeof SessionRecordSchema> } | { ok: false; error: string } {
   const result = v.safeParse(SessionRecordSchema, raw);
   if (result.success) return { ok: true, value: result.output };
   const issue = result.issues[0]!;
-  const path = issue.path?.map((p) => String(p.key)).join(".") ?? "";
+  const path = issue.path?.map((pathSegment) => String(pathSegment.key)).join(".") ?? "";
   return { ok: false, error: `${path ? path + ": " : ""}${issue.message}` };
 }