@deepseek-ai/dsh-session-projection-cache 0.1.6-alpha.2 → 0.1.7-alpha.1

package/README.i18n.yaml

@@ -2,5 +2,5 @@
 # side as of the last confirmed-consistent state. Both languages carry equal authority;
 # after editing either side, bring the other along and re-record with:
 #   pnpm run verify-translation-pairing --write packages/session/session-projection-cache/README.md
-README.md: 3125f50b07f222feb0ef2af5e28abcfae19631a7
-README.zh.md: c98cda187dd898a0b30a9721c0bc7412a91964c5
+README.md: 0ba9c5a47fbf2006be1593cb1805adb5bf9fbc59
+README.zh.md: d697b0520c0edf89572e9994b62e987111481a77

package/README.md

@@ -58,11 +58,11 @@ Three mandatory points always write: session creation persists the seed-derived
 
 ### Reading cached values
 
-`cachedSnapshot(meta, inheritedEventCount)` synchronously serves client values from the storage domain's in-memory tables with zero I/O. It accepts only an identity-matching record and version- and schema-matching keys, then returns a `{ asOfSeq, values }` cut at the lowest served-row watermark. `cachedPredecessorTitle(meta, inheritedEventCount)` is the narrower listing-only exception: a structurally admitted predecessor record whose lifecycle matches may expose only a current-version-compatible `title` row. The title is a possibly stale fact from a durable prefix, not a fold seed; it carries the sentinel `asOfSeq: -1` because a cardinality-changing Session migration can invalidate the predecessor row's numeric sequence. All other predecessor rows remain unavailable. An unseeded listing knows that its cut is zero; a seeded header-only listing does not know the numeric cut and skips both fast paths until an authoritative body read supplies it. `coldSnapshot(meta, inheritedEventCount, events)` accepts the exact cut with a complete ordered log, skips the checkpointed prefix while folding, and refreshes the record without reading persistence itself.
+`cachedSnapshot(meta, keys?)` is the read-only face: it synchronously serves client values from the storage domain's in-memory tables with zero I/O. It accepts a record whose lifecycle identity (`formatVersion`, `createdAt`, `cwd`, `isSeeded`) matches the header and serves its version- and schema-matching keys as one block whose `asOfSeq` is the lowest watermark among the served rows. That watermark is the stored record's own: a header witnesses no inherited cut and cannot vouch that the row sequence is comparable with the log a consumer later opens, so the Session list labels the block `cached` and the client lets every value the connected Session later produces supersede it. Within one format generation the cut is fixed at fork time and distinguishes no lifecycle the other fields do not, and a viewed value never seeds a fold, so seeded (forked) sessions are served exactly like unseeded ones. `cachedPredecessorTitle(meta)` is the narrower listing-only exception across a Session-format edge: a structurally admitted predecessor record whose lifecycle matches may expose only a current-version-compatible `title` row, because title text is invariant across the adjacent edges. All other predecessor rows remain unavailable. `coldSnapshot(meta, inheritedEventCount, events)` is a fold face: it accepts the exact cut with a complete ordered log, skips the checkpointed prefix while folding, and refreshes the record without reading persistence itself.
 
 ### What the cache guarantees
 
-The log leads and the cache follows: a live checkpoint flushes the session's buffered events durably before the cache row lands, so a crash can leave the cache behind the log but never ahead of it. Reads and writes share the storage domain's coherent in-memory state; the per-unit write chain mutates memory only after durability. Each version-stamped record must match the live unit schema and complete lifecycle identity (`formatVersion`, `createdAt`, `cwd`, `isSeeded`, and `inheritedEventCount`), so a row folded from another Session format generation or fork cut cannot seed the caller. The JSON backend stores each record at `<root>/session_projcache/sessions/<id>.json` in an owner-only directory tree.
+The log leads and the cache follows: a live checkpoint flushes the session's buffered events durably before the cache row lands, so a crash can leave the cache behind the log but never ahead of it. Reads and writes share the storage domain's coherent in-memory state; the per-unit write chain mutates memory only after durability. Each version-stamped record must match the live unit schema and the lifecycle identity (`formatVersion`, `createdAt`, `cwd`, `isSeeded`); the fold faces (`hydratePrepared`, `coldSnapshot`, and checkpoint writes) also require the exact `inheritedEventCount`, so a row folded from another Session format generation or fork cut cannot seed the caller. The JSON backend stores each record at `<root>/session_projcache/sessions/<id>.json` in an owner-only directory tree. Domain read validation preserves every own JSON key in checkpoint values, including `__proto__` and `constructor` inside opaque metadata. It rejects values that cannot survive a lossless JSON round trip, using the same rules as checkpoint writes. Each projection then validates its hydration state with its own `stateSchema`; fields carrying opaque JSON need a validator that preserves their keys.
 
 Upgrades never block startup or expose an unproven fold. Records stamped with a version in the spec's `compatibleVersions` remain structurally readable for a current checkpoint rewrite, but a missing or older `formatVersion` never matches a current Session and therefore cannot seed hydration. A lifecycle-matching predecessor title remains available only through the listing hint above because title text is invariant across the adjacent Session-format edges and its row still passes the current projection `stateVersion` and schema. Once the format matches, absent lineage fields decode as the unseeded lineage — exact for unseeded sessions, while a seeded caller fails the identity match and refolds cold. A stored record that still fails schema validation is moved aside as `<id>.json.bak.<stamp>` under the domain's `invalidRecords: 'backup-and-skip'` policy, logged with its cause, and rebuilt by the next checkpoint.
 

package/README.zh.md

@@ -58,11 +58,11 @@ kind: "package-reference"
 
 ### 读取缓存值
 
-`cachedSnapshot(meta, inheritedEventCount)` 以零 I/O 从存储域的内存表同步提供客户端值。它只接受身份匹配的记录以及版本和 schema 均匹配的 key，再按所服务行的最低水位返回 `{ asOfSeq, values }` 切面。`cachedPredecessorTitle(meta, inheritedEventCount)` 是更窄的列表专用例外：生命周期匹配且已通过结构准入的 predecessor record 只能公开与当前版本兼容的 `title` row。该 title 是 durable prefix 中可能过时的事实，而不是 fold seed；它携带 sentinel `asOfSeq: -1`，因为改变事件数量的 Session 迁移会使 predecessor row 的数字序号失效。其他 predecessor row 仍不可用。未 seeded 的列表知道切点为零；仅 header 的 seeded 列表不知道数字切点，因此两条快速路径都要跳过，直到权威正文读取提供它。`coldSnapshot(meta, inheritedEventCount, events)` 接受精确切点与完整有序日志，在折叠时跳过已检查点化的前缀，并在自身不读取持久化层的情况下刷新记录。
+`cachedSnapshot(meta, keys?)` 是只读面：以零 I/O 从存储域的内存表同步提供客户端值。它接受生命周期身份（`formatVersion`、`createdAt`、`cwd`、`isSeeded`）与 header 匹配的记录，把其中版本和 schema 均匹配的 key 作为一个 block 提供，其 `asOfSeq` 是所服务各行中最低的水位。这个水位是存储记录自己的：header 作证不了 inherited cut，也作证不了行序号与消费者稍后打开的日志可比，因此 Session list 把该 block 标为 `cached`，客户端让建连后的 Session 产出的任何值覆盖它。在同一格式代内，cut 在 fork 时写死，不能区分其他字段区分不了的生命周期，而只读视图也从不播种 fold，所以 seeded（fork 出来的）会话与 unseeded 会话被同样地提供。`cachedPredecessorTitle(meta)` 是跨 Session 格式 edge 的更窄列表专用例外：生命周期匹配且已通过结构准入的 predecessor record 只能公开与当前版本兼容的 `title` row，因为 title 文本在相邻 edge 之间保持不变。其他 predecessor row 仍不可用。`coldSnapshot(meta, inheritedEventCount, events)` 是 fold 面：接受精确切点与完整有序日志，在折叠时跳过已检查点化的前缀，并在自身不读取持久化层的情况下刷新记录。
 
 ### 缓存保证什么
 
-日志领先，缓存跟随：活会话检查点先把会话的缓冲事件持久化，然后才保存缓存记录。因此崩溃可能让缓存落后于日志，但绝不会让缓存领先。读取和写入共享存储域内一致的内存状态；逐单元写入链只在持久化成功后修改内存。每个带版本戳的记录必须匹配当前运行单元的 schema 与完整生命周期身份（`formatVersion`、`createdAt`、`cwd`、`isSeeded` 和 `inheritedEventCount`），因此从另一会话格式代或 fork 切点折叠出的行不能播种调用方。JSON 后端把每条记录存于仅所有者可访问的 `<root>/session_projcache/sessions/<id>.json` 目录树中。
+日志领先，缓存跟随：活会话检查点先把会话的缓冲事件持久化，然后才保存缓存记录。因此崩溃可能让缓存落后于日志，但绝不会让缓存领先。读取和写入共享存储域内一致的内存状态；逐单元写入链只在持久化成功后修改内存。每个带版本戳的记录必须匹配当前运行单元的 schema 与生命周期身份（`formatVersion`、`createdAt`、`cwd`、`isSeeded`）；fold 面（`hydratePrepared`、`coldSnapshot` 与检查点写入）还要求精确的 `inheritedEventCount`，因此从另一会话格式代或 fork 切点折叠出的行不能播种调用方。JSON 后端把每条记录存于仅所有者可访问的 `<root>/session_projcache/sessions/<id>.json` 目录树中。Domain 读取校验保留检查点值中的所有自有 JSON 键，包括不透明元数据中的 `__proto__` 与 `constructor`。它拒绝无法无损完成 JSON 往返的值，并与检查点写入使用相同规则。随后，每个 projection 用自己的 `stateSchema` 校验 hydration 状态；承载不透明 JSON 的字段需要使用保留其键的校验器。
 
 升级绝不拖垮启动，也不会暴露未经证明的折叠结果。版本戳落在 spec `compatibleVersions` 集合内的记录仍可被结构化读取并等待当前检查点重写，但缺失或更旧的 `formatVersion` 绝不匹配当前 Session，因此不能作为 hydrate seed。生命周期匹配的 predecessor title 只能通过上述列表 hint 读取，因为 title 文本在相邻 Session format edge 之间保持不变，并且该 row 仍须通过当前 projection `stateVersion` 与 schema。格式匹配后，缺失的 lineage 字段解码为 unseeded lineage——对非 fork 会话精确无误，seeded 调用方则通不过身份比对、回落冷折叠。仍然通不过 schema 校验的存量记录会按域的 `invalidRecords: 'backup-and-skip'` 策略移出为 `<id>.json.bak.<时间戳>`、连同原因写入日志，并由下一次检查点重建。
 

package/lib/index.js

@@ -1,6 +1,6 @@
 import { Service } from "@deepseek-ai/cordis";
 import z from "@deepseek-ai/schemastery";
-import { snapshotJsonValue } from "@deepseek-ai/dsh-util-values";
+import { isJsonValue, snapshotJsonValue } from "@deepseek-ai/dsh-util-values";
 import { SessionLogOffset, SessionSeq } from "@deepseek-ai/dsh-session";
 import { z as z$1 } from "zod";
 import { defineDomain, domainTable } from "@deepseek-ai/dsh-storage-domain";
@@ -19,15 +19,16 @@ import { defineDomain, domainTable } from "@deepseek-ai/dsh-storage-domain";
 /**
 * One persisted checkpoint row (the RFC's `(sessionId, key, ver, seq, val)`
 * minus the two record keys). `val` is the unit's internal state — plain
-* JSON by the unit contract; `z.json()` enforces that at the durable
-* boundary. A row is never wrong, only possibly stale: `seq` says exactly
-* how stale, and a `ver` mismatch against the live unit's `stateVersion`
+* JSON by the unit contract. Validation uses the same lossless JSON rules as
+* writes and preserves every state key without cloning. A row is never wrong,
+* only possibly stale: `seq` says exactly how stale, and a `ver` mismatch
+* against the live unit's `stateVersion`
 * discards it at read time (never a migration).
 */
 const checkpointRow = z$1.object({
 	ver: z$1.number().int().nonnegative(),
 	seq: z$1.number().int().gte(-1).transform((value) => value === -1 ? -1 : SessionSeq(value)),
-	val: z$1.json()
+	val: z$1.custom(isJsonValue, { message: "checkpoint state must be losslessly JSON-serializable" })
 });
 /**
 * The stored-log identity a record is bound to: the immutable header fields
@@ -172,22 +173,27 @@ var SessionProjectionCache = class extends Service {
 	}
 	/**
 	* The zero-I/O listing read: whole values viewed straight from the stored
-	* rows (version-matching keys only), each cut carried with its watermark so
-	* a client value store can seed under its higher-seq-wins rule — as stale
-	* as the last durable checkpoint but never wrong, and never from an
-	* unrelated log (the caller's header is the identity witness). Fresher
-	* paths (the history tail baseline) supersede these values whenever a
-	* session is actually opened.
+	* rows (version-matching keys only) of the record bound to the caller's
+	* lifecycle. The header is the only identity witness a listing holds, so
+	* this face matches the lifecycle identity (`formatVersion`, `createdAt`,
+	* `cwd`, `isSeeded`) and not the inherited cut: within one format
+	* generation the cut is fixed at fork time, so it distinguishes no
+	* lifecycle the other fields do not, and a viewed value never seeds a fold.
+	* The view is as stale as the last durable checkpoint but never wrong and
+	* never from an unrelated log. Its `asOfSeq` is the lowest watermark among
+	* the served rows: the stored record's own position, which the header
+	* cannot relate to the log the caller later opens. The Session list
+	* therefore labels the block as cached, and the client lets every value the
+	* connected Session produces supersede it whatever this number says.
 	* @param meta - the listed session's header (identity witness; no log read).
-	* @param inheritedEventCount - exact inherited prefix length that completes
-	* the checkpoint identity.
 	* @param keys - optional projection keys required by the caller's audience.
-	* @returns the cut (`asOfSeq` = lowest served-row watermark), or
-	*   `undefined` when no usable row exists for this lifecycle.
+	* @returns the viewed block, or `undefined` when no usable row exists for
+	*   this lifecycle at the current Session format.
 	*/
-	cachedSnapshot(meta, inheritedEventCount, keys) {
-		const record = this.recordFor(meta.id, identityOf(meta, inheritedEventCount));
-		if (record === void 0) return void 0;
+	cachedSnapshot(meta, keys) {
+		const expected = lifecycleIdentityOf(meta);
+		const record = this.requireTable().get(meta.id);
+		if (record === void 0 || !currentLifecycleMatches(record.identity, expected)) return void 0;
 		return this.viewRecord(record, keys);
 	}
 	/**
@@ -199,36 +205,33 @@ var SessionProjectionCache = class extends Service {
 	* fact from this Session. The registry still requires the current title
 	* projection's row version and schema. No other predecessor projection is
 	* exposed: format normalization can change their current meaning, and the
-	* strict {@link cachedSnapshot} / hydration paths continue to reject them.
+	* {@link cachedSnapshot} / hydration paths continue to reject them.
 	* @param meta - authoritative listed Session header.
-	* @param inheritedEventCount - exact inherited cut completing the lifecycle identity.
-	* @returns a title-only checkpoint view with `asOfSeq: -1`, or `undefined`
-	*   when the record is current, newer, unrelated, missing, or incompatible
-	*   with the title unit. The sentinel avoids reusing a sequence that a
-	*   cardinality-changing Session migration may have remapped.
+	* @returns a title-only block at the stored title row's watermark, or
+	*   `undefined` when the record is current, newer, unrelated, missing, or
+	*   incompatible with the title unit.
 	*/
-	cachedPredecessorTitle(meta, inheritedEventCount) {
-		const expected = identityOf(meta, inheritedEventCount);
+	cachedPredecessorTitle(meta) {
+		const expected = lifecycleIdentityOf(meta);
 		const record = this.requireTable().get(meta.id);
 		if (record === void 0 || !predecessorIdentityMatches(record.identity, expected)) return void 0;
-		const title = this.viewRecord(record, [PREDECESSOR_TITLE_KEY]);
-		return title === void 0 ? void 0 : {
-			...title,
-			asOfSeq: -1
-		};
+		return this.viewRecord(record, [PREDECESSOR_TITLE_KEY]);
 	}
-	/** View selected wire rows and bind them to their lowest served watermark. */
+	/**
+	* View selected wire rows as one block bound to the lowest served
+	* watermark: the seq every served value has folded through at least. The
+	* number is the record's own; whether a consumer may compare it with a
+	* live Session's seqs is decided by the face that serves the block, not
+	* here.
+	*/
 	viewRecord(record, keys) {
 		const values = this.ctx.sessionProjections.viewCheckpoint(record.rows, keys);
-		const servedKeys = Object.keys(values);
-		if (servedKeys.length === 0) return void 0;
-		const firstKey = servedKeys[0];
-		let asOfSeq = record.rows[firstKey].seq;
-		for (const key of servedKeys.slice(1)) {
-			const row = record.rows[key];
-			if (row.seq < asOfSeq) asOfSeq = row.seq;
+		let asOfSeq;
+		for (const [key, row] of Object.entries(record.rows)) {
+			if (!Object.hasOwn(values, key)) continue;
+			if (asOfSeq === void 0 || row.seq < asOfSeq) asOfSeq = row.seq;
 		}
-		return {
+		return asOfSeq === void 0 ? void 0 : {
 			asOfSeq,
 			values
 		};
@@ -357,26 +360,43 @@ var SessionProjectionCache = class extends Service {
 		return this.table;
 	}
 };
-/** Project a header onto the identity fields a record is bound to. */
-function identityOf(header, inheritedEventCount) {
-	const cut = SessionLogOffset(inheritedEventCount);
-	if (!header.isSeeded && cut !== 0) throw new Error("unseeded projection-cache identity inherited event count must be 0");
+/** Project a header onto the identity fields a header alone can witness. */
+function lifecycleIdentityOf(header) {
 	return {
 		formatVersion: header.version,
 		createdAt: header.createdAt,
 		...header.cwd === void 0 ? {} : { cwd: header.cwd },
-		isSeeded: header.isSeeded,
+		isSeeded: header.isSeeded
+	};
+}
+/** Project a header and its exact inherited cut onto the complete fold identity. */
+function identityOf(header, inheritedEventCount) {
+	const cut = SessionLogOffset(inheritedEventCount);
+	if (!header.isSeeded && cut !== 0) throw new Error("unseeded projection-cache identity inherited event count must be 0");
+	return {
+		...lifecycleIdentityOf(header),
 		inheritedEventCount: cut
 	};
 }
 /**
-* Whether a stored record's bound identity names the caller's lifecycle.
-* An absent format generation cannot prove the fold semantics and never
-* matches. Once the format matches, absent lineage fields (records admitted
-* via `compatibleVersions` predate them) read as the unseeded lineage: exact
-* for an unseeded caller, while a seeded caller fails the match.
+* Whether a stored record may seed the caller's fold: the current format
+* generation, the same lifecycle, and the same inherited cut. A record folded
+* under another cut encodes that cut in unit states (`schedule`,
+* `subagentCatalog`, `permissions`) and would carry it into the continued
+* fold and the next checkpoint. Absent lineage fields (records admitted via
+* `compatibleVersions` predate them) read as the unseeded lineage: exact for
+* an unseeded caller, while a seeded caller fails the match.
 */
 function identityMatches(stored, expected) {
+	return currentLifecycleMatches(stored, expected) && (stored.inheritedEventCount ?? 0) === expected.inheritedEventCount;
+}
+/**
+* Whether a stored record was folded from the caller's lifecycle at the
+* current Session format. An absent format generation cannot prove the fold
+* semantics and never matches. This is the whole identity a header-only
+* reader can check, and the whole identity a view needs.
+*/
+function currentLifecycleMatches(stored, expected) {
 	return stored.formatVersion === expected.formatVersion && lifecycleIdentityMatches(stored, expected);
 }
 /** Match one predecessor cache record to the authoritative listed lifecycle. */
@@ -385,7 +405,7 @@ function predecessorIdentityMatches(stored, expected) {
 }
 /** Match the format-independent fields that distinguish one Session lifecycle. */
 function lifecycleIdentityMatches(stored, expected) {
-	return stored.createdAt === expected.createdAt && stored.cwd === expected.cwd && (stored.isSeeded ?? false) === expected.isSeeded && (stored.inheritedEventCount ?? 0) === expected.inheritedEventCount;
+	return stored.createdAt === expected.createdAt && stored.cwd === expected.cwd && (stored.isSeeded ?? false) === expected.isSeeded;
 }
 //#endregion
 export { Config, SessionProjectionCache, SessionProjectionCache as default, checkpointIdentity, checkpointRecord, checkpointRow, projectionCacheDomainSpec };

package/lib/types/index.d.ts

@@ -74,20 +74,24 @@ export declare class SessionProjectionCache extends Service {
     private recordFor;
     /**
      * The zero-I/O listing read: whole values viewed straight from the stored
-     * rows (version-matching keys only), each cut carried with its watermark so
-     * a client value store can seed under its higher-seq-wins rule — as stale
-     * as the last durable checkpoint but never wrong, and never from an
-     * unrelated log (the caller's header is the identity witness). Fresher
-     * paths (the history tail baseline) supersede these values whenever a
-     * session is actually opened.
+     * rows (version-matching keys only) of the record bound to the caller's
+     * lifecycle. The header is the only identity witness a listing holds, so
+     * this face matches the lifecycle identity (`formatVersion`, `createdAt`,
+     * `cwd`, `isSeeded`) and not the inherited cut: within one format
+     * generation the cut is fixed at fork time, so it distinguishes no
+     * lifecycle the other fields do not, and a viewed value never seeds a fold.
+     * The view is as stale as the last durable checkpoint but never wrong and
+     * never from an unrelated log. Its `asOfSeq` is the lowest watermark among
+     * the served rows: the stored record's own position, which the header
+     * cannot relate to the log the caller later opens. The Session list
+     * therefore labels the block as cached, and the client lets every value the
+     * connected Session produces supersede it whatever this number says.
      * @param meta - the listed session's header (identity witness; no log read).
-     * @param inheritedEventCount - exact inherited prefix length that completes
-     * the checkpoint identity.
      * @param keys - optional projection keys required by the caller's audience.
-     * @returns the cut (`asOfSeq` = lowest served-row watermark), or
-     *   `undefined` when no usable row exists for this lifecycle.
+     * @returns the viewed block, or `undefined` when no usable row exists for
+     *   this lifecycle at the current Session format.
      */
-    cachedSnapshot(meta: SessionHeader, inheritedEventCount: SessionLogOffset, keys?: readonly Extract<keyof SessionProjectionMap, string>[]): ProjectionSnapshot | undefined;
+    cachedSnapshot(meta: SessionHeader, keys?: readonly Extract<keyof SessionProjectionMap, string>[]): ProjectionSnapshot | undefined;
     /**
      * Read only a predecessor checkpoint's title as a zero-I/O listing hint.
      *
@@ -97,16 +101,20 @@ export declare class SessionProjectionCache extends Service {
      * fact from this Session. The registry still requires the current title
      * projection's row version and schema. No other predecessor projection is
      * exposed: format normalization can change their current meaning, and the
-     * strict {@link cachedSnapshot} / hydration paths continue to reject them.
+     * {@link cachedSnapshot} / hydration paths continue to reject them.
      * @param meta - authoritative listed Session header.
-     * @param inheritedEventCount - exact inherited cut completing the lifecycle identity.
-     * @returns a title-only checkpoint view with `asOfSeq: -1`, or `undefined`
-     *   when the record is current, newer, unrelated, missing, or incompatible
-     *   with the title unit. The sentinel avoids reusing a sequence that a
-     *   cardinality-changing Session migration may have remapped.
+     * @returns a title-only block at the stored title row's watermark, or
+     *   `undefined` when the record is current, newer, unrelated, missing, or
+     *   incompatible with the title unit.
+     */
+    cachedPredecessorTitle(meta: SessionHeader): ProjectionSnapshot | undefined;
+    /**
+     * View selected wire rows as one block bound to the lowest served
+     * watermark: the seq every served value has folded through at least. The
+     * number is the record's own; whether a consumer may compare it with a
+     * live Session's seqs is decided by the face that serves the block, not
+     * here.
      */
-    cachedPredecessorTitle(meta: SessionHeader, inheritedEventCount: SessionLogOffset): ProjectionSnapshot | undefined;
-    /** View selected wire rows and bind them to their lowest served watermark. */
     private viewRecord;
     /**
      * Hydrate projection cells for an already-prepared Session without another

package/lib/types/spec.d.ts

@@ -10,20 +10,22 @@
  * @module @deepseek-ai/dsh-session-projection-cache/src/spec
  */
 import { z } from 'zod';
+import type { JsonValue } from '@deepseek-ai/dsh-util-values';
 import { SessionLogOffset, SessionSeq } from '@deepseek-ai/dsh-session';
 import type { SessionId } from '@deepseek-ai/dsh-session';
 /**
  * One persisted checkpoint row (the RFC's `(sessionId, key, ver, seq, val)`
  * minus the two record keys). `val` is the unit's internal state — plain
- * JSON by the unit contract; `z.json()` enforces that at the durable
- * boundary. A row is never wrong, only possibly stale: `seq` says exactly
- * how stale, and a `ver` mismatch against the live unit's `stateVersion`
+ * JSON by the unit contract. Validation uses the same lossless JSON rules as
+ * writes and preserves every state key without cloning. A row is never wrong,
+ * only possibly stale: `seq` says exactly how stale, and a `ver` mismatch
+ * against the live unit's `stateVersion`
  * discards it at read time (never a migration).
  */
 export declare const checkpointRow: z.ZodObject<{
     ver: z.ZodNumber;
     seq: z.ZodPipe<z.ZodNumber, z.ZodTransform<-1 | SessionSeq, number>>;
-    val: z.ZodJSONSchema;
+    val: z.ZodCustom<JsonValue, JsonValue>;
 }, z.core.$strip>;
 /**
  * The stored-log identity a record is bound to: the immutable header fields
@@ -67,7 +69,7 @@ export declare const checkpointRecord: z.ZodObject<{
     rows: z.ZodRecord<z.ZodString, z.ZodObject<{
         ver: z.ZodNumber;
         seq: z.ZodPipe<z.ZodNumber, z.ZodTransform<-1 | SessionSeq, number>>;
-        val: z.ZodJSONSchema;
+        val: z.ZodCustom<JsonValue, JsonValue>;
     }, z.core.$strip>>;
 }, z.core.$strip>;
 /** One stored per-session checkpoint record, inferred from {@link checkpointRecord}. */
@@ -114,7 +116,7 @@ export declare const projectionCacheDomainSpec: {
             rows: Record<string, {
                 ver: number;
                 seq: -1 | SessionSeq;
-                val: z.core.util.JSONType;
+                val: JsonValue;
             }>;
         }>;
     };

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "@deepseek-ai/dsh-session-projection-cache",
   "description": "Persisted projection cache (ctx.sessionProjectionCache): durable per-session checkpoint records on the session_projcache storage domain (per-record layout), throttled write-behind, and the cached listing read",
-  "version": "0.1.6-alpha.2",
+  "version": "0.1.7-alpha.1",
   "publishConfig": {
     "access": "public"
   },
@@ -28,21 +28,21 @@
   "license": "MIT",
   "dependencies": {
     "zod": "^4.4.3",
-    "@deepseek-ai/dsh-util-values": "^0.1.6-alpha.2",
-    "@deepseek-ai/schemastery": "^3.18.2"
+    "@deepseek-ai/dsh-util-values": "^0.1.7-alpha.1",
+    "@deepseek-ai/schemastery": "^3.18.3"
   },
   "peerDependencies": {
-    "@deepseek-ai/cordis": "^4.0.2",
-    "@deepseek-ai/dsh-session": "^0.1.6-alpha.2",
-    "@deepseek-ai/dsh-session-projection": "^0.1.6-alpha.2",
-    "@deepseek-ai/dsh-storage-domain": "^0.1.6-alpha.2"
+    "@deepseek-ai/cordis": "^4.0.3",
+    "@deepseek-ai/dsh-session": "^0.1.7-alpha.1",
+    "@deepseek-ai/dsh-session-projection": "^0.1.7-alpha.1",
+    "@deepseek-ai/dsh-storage-domain": "^0.1.7-alpha.1"
   },
   "devDependencies": {
-    "@deepseek-ai/cordis": "^4.0.2",
-    "@deepseek-ai/dsh-session": "^0.1.6-alpha.2",
-    "@deepseek-ai/dsh-session-projection": "^0.1.6-alpha.2",
-    "@deepseek-ai/dsh-storage": "^0.1.6-alpha.2",
-    "@deepseek-ai/dsh-storage-domain": "^0.1.6-alpha.2",
-    "@deepseek-ai/dsh-storage-json": "^0.1.6-alpha.2"
+    "@deepseek-ai/dsh-session": "^0.1.7-alpha.1",
+    "@deepseek-ai/dsh-session-projection": "^0.1.7-alpha.1",
+    "@deepseek-ai/dsh-storage": "^0.1.7-alpha.1",
+    "@deepseek-ai/cordis": "^4.0.3",
+    "@deepseek-ai/dsh-storage-json": "^0.1.7-alpha.1",
+    "@deepseek-ai/dsh-storage-domain": "^0.1.7-alpha.1"
   }
 }