@evo-dev/evodev 0.0.1-alpha.19 → 0.0.1-alpha.20

package/dist/index.js

@@ -229,12 +229,12 @@ import { resolve as resolve15 } from "node:path";
 import { fileURLToPath as fileURLToPath5 } from "node:url";
 
 // packages/core/src/agents/index.ts
-import { readFile as readFile11 } from "node:fs/promises";
+import { readFile as readFile12 } from "node:fs/promises";
 
 // packages/core/src/evolution/knowledge/index.ts
 import { createHash as createHash5 } from "node:crypto";
 import { existsSync, readFileSync as readFileSync2, readdirSync } from "node:fs";
-import { mkdir as mkdir8, readFile as readFile10, readdir as readdir8, rename as rename3, rm as rm4, stat as stat5, writeFile as writeFile7 } from "node:fs/promises";
+import { mkdir as mkdir8, readFile as readFile11, readdir as readdir8, rename as rename3, rm as rm4, stat as stat5, writeFile as writeFile7 } from "node:fs/promises";
 import { dirname as dirname9, isAbsolute as isAbsolute5, join as join13, relative as relative4, resolve as resolve4 } from "node:path";
 
 // packages/core/src/config/paths.ts
@@ -285,7 +285,7 @@ function stripTrailingSlash(path) {
 }
 
 // packages/core/src/config/settings.ts
-import { readFile as readFile8 } from "node:fs/promises";
+import { readFile as readFile9 } from "node:fs/promises";
 
 // packages/core/src/utils/errors.ts
 function isNotFoundError(error) {
@@ -2072,6 +2072,9 @@ function asRecord(value) {
 function createSemanticPacketMessageKey(value) {
   return sha256Hex(value);
 }
+// packages/core/src/evolution/evidence/session-memory/retention.ts
+import { readFile as readFile5 } from "node:fs/promises";
+
 // packages/core/src/evolution/candidates/index.ts
 import { createHash as createHash2 } from "node:crypto";
 import { mkdir as mkdir2, readFile as readFile2, readdir as readdir3, rm, writeFile as writeFile2 } from "node:fs/promises";
@@ -2840,6 +2843,36 @@ async function appendRawEvent(path, event) {
 `, "utf8");
   return { lineNumber: existingLineCount + 1 };
 }
+async function resetSessionRawEvents(path) {
+  await mkdir3(dirname3(path), { recursive: true, mode: 448 });
+  await writeFile3(path, "", { encoding: "utf8", mode: 384 });
+  await chmod(path, 384);
+}
+async function rewriteSessionRawEvents(path, lines, expectedCurrent) {
+  await ensurePrivateSessionMemoryDirectory(dirname3(path));
+  const temporaryPath = join6(dirname3(path), `.${randomUUID()}.tmp`);
+  try {
+    const handle = await open(temporaryPath, "wx", 384);
+    try {
+      await handle.writeFile(lines.length === 0 ? "" : `${lines.join(`
+`)}
+`, "utf8");
+      await handle.sync();
+    } finally {
+      await handle.close();
+    }
+    const current = await readFile4(path, "utf8").catch(() => null);
+    if (current !== expectedCurrent)
+      return false;
+    await rename(temporaryPath, path);
+    await chmod(path, 384);
+    return true;
+  } finally {
+    await rm2(temporaryPath, { force: true }).catch(() => {
+      return;
+    });
+  }
+}
 async function readLineRange(path, fromLine, toLine) {
   const text2 = await readFile4(path, "utf8");
   const lines = text2.split(`
@@ -2995,7 +3028,7 @@ async function writeHistoricalSessionStateAndIndex(input) {
   return { state, segmentIds: ordered.map((segment) => segment.id) };
 }
 async function writeSessionEvidenceSegmentAtomic(input) {
-  assertHistoricalRetentionState(input.segment);
+  assertSessionEvidenceRetentionState(input.segment);
   const paths = resolveSessionMemoryPaths({
     homeDir: input.homeDir,
     projectKey: input.segment.projectKey,
@@ -3003,18 +3036,18 @@ async function writeSessionEvidenceSegmentAtomic(input) {
   });
   await writePrivateAtomicJson(paths.segmentPath(input.segment.id), input.segment);
 }
-function assertHistoricalRetentionState(segment) {
-  if (segment.origin?.kind !== "historical-import" || segment.retention === undefined) {
-    throw new Error("Atomic Session Evidence rewrite is limited to historical retention.");
+function assertSessionEvidenceRetentionState(segment) {
+  if (segment.retention === undefined) {
+    throw new Error("Atomic Session Evidence rewrite requires retention metadata.");
   }
   if (segment.retention.rawState === "available") {
     if (!segment.rawExcerpt.stored || segment.rawExcerpt.byteLength !== Buffer.byteLength(segment.rawExcerpt.content, "utf8") || segment.rawExcerpt.sha256 !== sha256Hex(segment.rawExcerpt.content) || segment.retention.originalRawSha256 !== segment.rawExcerpt.sha256) {
-      throw new Error("Available historical Session Evidence raw state is invalid.");
+      throw new Error("Available Session Evidence raw state is invalid.");
     }
     return;
   }
   if (segment.rawExcerpt.stored || segment.rawExcerpt.content !== "" || segment.rawExcerpt.byteLength !== 0 || segment.rawExcerpt.sha256 !== sha256Hex("") || segment.retention.rawPurgedAt === null || segment.lifecycle.status !== "raw-expired") {
-    throw new Error("Purged historical Session Evidence raw state is invalid.");
+    throw new Error("Purged Session Evidence raw state is invalid.");
   }
 }
 async function writeJson(path, value) {
@@ -3231,69 +3264,89 @@ async function listJsonFiles(path) {
 
 // packages/core/src/evolution/evidence/session-memory/retention.ts
 var DEFAULT_RETENTION_LIMIT = 20;
-var MAX_RETENTION_LIMIT = 20;
-async function inspectHistoricalSessionEvidenceRetention(input) {
+var MAX_RETENTION_LIMIT = 1e4;
+var DEFAULT_LEGACY_RETENTION_DAYS = 30;
+async function inspectSessionEvidenceRetention(input) {
+  const result = await inspectRetention(input, () => true);
+  const expiredEvents = await expireCapturedRawEvents({ ...input, apply: false });
+  result.expiredCapturedEventPayloads = expiredEvents.payloads;
+  result.expiredCapturedEventRawBytes = expiredEvents.rawBytes;
+  return result;
+}
+async function inspectRetention(input, include) {
   const now = normalizeTimestamp(input.now);
-  const historical = (await listSessionEvidenceSegments({
+  const segments = (await listSessionEvidenceSegments({
     homeDir: input.homeDir,
     projectKey: input.projectKey
-  })).filter((segment) => segment.origin?.kind === "historical-import" && segment.retention !== undefined);
-  const result = {
-    available: 0,
-    purged: 0,
-    overdue: 0,
-    purgeEligible: 0,
-    protected: 0,
-    protectionReasons: {}
-  };
-  const reviewSnapshots = new Map;
-  for (const segment of historical) {
-    if (segment.retention?.rawState === "purged") {
+  })).filter(include);
+  const retentionDays = await loadLegacyRetentionDays(input.homeDir, input.projectKey);
+  const result = emptyInspection();
+  const context = createRetentionContext();
+  for (const segment of segments) {
+    if (segment.retention === undefined) {
+      const rawBytes = segment.rawExcerpt.stored ? segment.rawExcerpt.byteLength : 0;
+      result.legacyWithoutRetention += 1;
+      result.legacyRawBytes += rawBytes;
+      const expiresAt = legacyExpiresAt(segment, retentionDays);
+      if (Date.parse(expiresAt) <= Date.parse(now)) {
+        result.legacyOverdue += 1;
+        result.legacyOverdueRawBytes += rawBytes;
+        const protection2 = await findRetentionProtection({
+          homeDir: input.homeDir,
+          segment,
+          context
+        });
+        if (protection2 === null)
+          result.purgeEligible += 1;
+        else
+          addProtection(result, protection2);
+      }
+      continue;
+    }
+    if (segment.retention.rawState === "purged") {
       result.purged += 1;
       continue;
     }
     result.available += 1;
     if (!hasValidAvailableRetention(segment)) {
       result.overdue += 1;
-      result.protected += 1;
-      result.protectionReasons["retention-invalid"] = (result.protectionReasons["retention-invalid"] ?? 0) + 1;
+      addProtection(result, "retention-invalid");
       continue;
     }
-    if (segment.retention === undefined || Date.parse(segment.retention.expiresAt) > Date.parse(now)) {
+    if (Date.parse(segment.retention.expiresAt) > Date.parse(now))
       continue;
-    }
     result.overdue += 1;
     const protection = await findRetentionProtection({
       homeDir: input.homeDir,
       segment,
-      reviewSnapshots
+      context
     });
-    if (protection === null) {
+    if (protection === null)
       result.purgeEligible += 1;
-      continue;
-    }
-    result.protected += 1;
-    result.protectionReasons[protection] = (result.protectionReasons[protection] ?? 0) + 1;
+    else
+      addProtection(result, protection);
   }
   return result;
 }
-async function purgeExpiredHistoricalSessionEvidence(input) {
+async function purgeExpiredSessionEvidence(input) {
+  return purgeRetention(input, () => true);
+}
+async function purgeRetention(input, include) {
   const now = normalizeTimestamp(input.now);
   const limit = normalizeLimit(input.limit);
-  const historical = (await listSessionEvidenceSegments({
+  const segments = (await listSessionEvidenceSegments({
     homeDir: input.homeDir,
     projectKey: input.projectKey
-  })).filter((segment) => segment.origin?.kind === "historical-import" && segment.retention !== undefined).sort((left, right) => (left.retention?.expiresAt ?? "").localeCompare(right.retention?.expiresAt ?? "") || left.id.localeCompare(right.id));
+  })).filter((segment) => include(segment) && segment.retention !== undefined).sort((left, right) => (left.retention?.expiresAt ?? "").localeCompare(right.retention?.expiresAt ?? "") || left.id.localeCompare(right.id));
   const result = {
     scanned: 0,
     due: 0,
     purged: 0,
-    alreadyPurged: 0,
+    alreadyPurged: segments.filter((segment) => segment.retention?.rawState === "purged").length,
     protected: []
   };
-  const reviewSnapshots = new Map;
-  result.alreadyPurged = historical.filter((segment) => segment.retention?.rawState === "purged").length;
-  for (const segment of historical) {
+  const context = createRetentionContext();
+  for (const segment of segments) {
     if (result.scanned >= limit)
       break;
     if (segment.retention === undefined || segment.retention.rawState === "purged")
@@ -3314,7 +3367,7 @@ async function purgeExpiredHistoricalSessionEvidence(input) {
     const protection = await findRetentionProtection({
       homeDir: input.homeDir,
       segment,
-      reviewSnapshots
+      context
     });
     if (protection !== null) {
       result.protected.push({
@@ -3330,8 +3383,7 @@ async function purgeExpiredHistoricalSessionEvidence(input) {
       sessionKey: segment.sessionKey,
       segmentId: segment.id
     });
-    const currentTrigger = await findSegmentTrigger(input.homeDir, current);
-    if (!hasValidAvailableRetention(current) || current.retention?.rawState !== "available" || current.retention.expiresAt !== segment.retention.expiresAt || !current.rawExcerpt.stored || current.rawExcerpt.sha256 !== segment.rawExcerpt.sha256 || current.lifecycle.reviewState !== segment.lifecycle.reviewState || currentTrigger === null || !isTerminalTrigger(currentTrigger)) {
+    if (!hasValidAvailableRetention(current) || current.retention?.rawState !== "available" || current.retention.expiresAt !== segment.retention.expiresAt || !current.rawExcerpt.stored || current.rawExcerpt.sha256 !== segment.rawExcerpt.sha256 || current.lifecycle.reviewState !== segment.lifecycle.reviewState) {
       result.protected.push({
         projectKey: segment.projectKey,
         segmentId: segment.id,
@@ -3339,30 +3391,115 @@ async function purgeExpiredHistoricalSessionEvidence(input) {
       });
       continue;
     }
-    const freshSnapshot = await readEvolutionReviewSnapshot({
+    const freshProtection = await findRetentionProtection({
       homeDir: input.homeDir,
-      projectKey: current.projectKey
+      segment: current,
+      context: createRetentionContext()
     });
-    if (hasPendingDerivedReview(freshSnapshot, current)) {
+    if (freshProtection !== null) {
       result.protected.push({
-        projectKey: segment.projectKey,
-        segmentId: segment.id,
-        reason: "derived-review-pending"
+        projectKey: current.projectKey,
+        segmentId: current.id,
+        reason: freshProtection
       });
       continue;
     }
     await writeSessionEvidenceSegmentAtomic({
       homeDir: input.homeDir,
-      segment: createPurgedHistoricalSegment(current, now)
+      segment: createPurgedSegment(current, now)
     });
     result.purged += 1;
   }
   return result;
 }
+async function migrateLegacySessionEvidenceRetention(input) {
+  const now = normalizeTimestamp(input.now);
+  const retentionDays = await loadLegacyRetentionDays(input.homeDir, input.projectKey);
+  const segments = await listSessionEvidenceSegments({
+    homeDir: input.homeDir,
+    projectKey: input.projectKey
+  });
+  let migrated = 0;
+  const context = createRetentionContext();
+  for (const segment of segments) {
+    if (segment.retention !== undefined || !segment.rawExcerpt.stored)
+      continue;
+    const policyDays = retentionDays.get(sessionKey(segment)) ?? DEFAULT_LEGACY_RETENTION_DAYS;
+    if (Date.parse(addDays(segment.createdAt, policyDays)) > Date.parse(now))
+      continue;
+    const protection = await findRetentionProtection({
+      homeDir: input.homeDir,
+      segment,
+      context
+    });
+    if (protection !== null)
+      continue;
+    const current = await readSessionEvidenceSegment({
+      homeDir: input.homeDir,
+      projectKey: segment.projectKey,
+      sessionKey: segment.sessionKey,
+      segmentId: segment.id
+    });
+    if (current.retention !== undefined || JSON.stringify(current) !== JSON.stringify(segment)) {
+      continue;
+    }
+    await writeSessionEvidenceSegmentAtomic({
+      homeDir: input.homeDir,
+      segment: {
+        ...current,
+        retention: {
+          policyDays,
+          expiresAt: addDays(current.createdAt, policyDays),
+          rawState: "available",
+          rawPurgedAt: null,
+          originalRawSha256: current.rawExcerpt.sha256
+        }
+      }
+    });
+    migrated += 1;
+  }
+  const expiredEvents = await expireCapturedRawEvents({
+    homeDir: input.homeDir,
+    projectKey: input.projectKey,
+    now,
+    apply: true
+  });
+  return {
+    migrated,
+    expiredCapturedEventPayloads: expiredEvents.payloads,
+    expiredCapturedEventRawBytes: expiredEvents.rawBytes,
+    purge: await purgeExpiredSessionEvidence({
+      homeDir: input.homeDir,
+      projectKey: input.projectKey,
+      now,
+      limit: Math.max(DEFAULT_RETENTION_LIMIT, segments.length)
+    })
+  };
+}
+function emptyInspection() {
+  return {
+    available: 0,
+    purged: 0,
+    overdue: 0,
+    purgeEligible: 0,
+    protected: 0,
+    legacyWithoutRetention: 0,
+    legacyOverdue: 0,
+    legacyRawBytes: 0,
+    legacyOverdueRawBytes: 0,
+    expiredCapturedEventPayloads: 0,
+    expiredCapturedEventRawBytes: 0,
+    protectionReasons: {}
+  };
+}
+function addProtection(result, reason) {
+  result.protected += 1;
+  result.protectionReasons[reason] = (result.protectionReasons[reason] ?? 0) + 1;
+}
 function normalizeLimit(value) {
   const limit = value ?? DEFAULT_RETENTION_LIMIT;
   if (!Number.isSafeInteger(limit) || limit < 1 || limit > MAX_RETENTION_LIMIT) {
-    throw new Error(`Historical Session Evidence retention limit must be between 1 and ${MAX_RETENTION_LIMIT}.`);
+    throw new Error(`Session Evidence retention limit must be between 1 and ${MAX_RETENTION_LIMIT}.`);
   }
   return limit;
 }
@@ -3374,26 +3511,38 @@ async function findRetentionProtection(input) {
   if (input.segment.lifecycle.reviewState === "unreviewed" || input.segment.lifecycle.reviewState === "deferred") {
     return "segment-review-pending";
   }
-  const trigger = await findSegmentTrigger(input.homeDir, input.segment);
-  if (trigger === null)
+  const trigger = await findSegmentTrigger(input.homeDir, input.segment, input.context);
+  if (trigger === null) {
+    if (input.segment.reason === "session-memory-threshold")
+      return null;
     return "trigger-missing";
+  }
   if (!isTerminalTrigger(trigger))
     return "trigger-not-terminal";
-  let snapshot = input.reviewSnapshots.get(input.segment.projectKey);
+  let snapshot = input.context.reviewSnapshots.get(input.segment.projectKey);
   if (snapshot === undefined) {
     snapshot = readEvolutionReviewSnapshot({
       homeDir: input.homeDir,
       projectKey: input.segment.projectKey
     });
-    input.reviewSnapshots.set(input.segment.projectKey, snapshot);
+    input.context.reviewSnapshots.set(input.segment.projectKey, snapshot);
   }
   return hasPendingDerivedReview(await snapshot, input.segment) ? "derived-review-pending" : null;
 }
-async function findSegmentTrigger(homeDir, segment) {
-  const matches = (await listSegmentEvolutionTriggers({
-    homeDir,
-    projectKey: segment.projectKey
-  })).filter((trigger) => trigger.segmentId === segment.id && trigger.sessionKey === segment.sessionKey);
+async function findSegmentTrigger(homeDir, segment, context) {
+  let triggerMap = context.triggerMaps.get(segment.projectKey);
+  if (triggerMap === undefined) {
+    triggerMap = listSegmentEvolutionTriggers({ homeDir, projectKey: segment.projectKey }).then((triggers) => {
+      const map = new Map;
+      for (const trigger of triggers) {
+        const key = `${trigger.sessionKey}\x00${trigger.segmentId}`;
+        map.set(key, [...map.get(key) ?? [], trigger]);
+      }
+      return map;
+    });
+    context.triggerMaps.set(segment.projectKey, triggerMap);
+  }
+  const matches = (await triggerMap).get(`${segment.sessionKey}\x00${segment.id}`) ?? [];
   return matches.length === 1 ? matches[0] ?? null : null;
 }
 function isTerminalTrigger(trigger) {
@@ -3412,10 +3561,10 @@ function hasPendingDerivedReview(snapshot, segment) {
   }
   return snapshot.reviewCandidates.some((candidate) => candidate.runId === runId && candidate.reviewState !== "accepted" && candidate.reviewState !== "rejected");
 }
-function createPurgedHistoricalSegment(segment, now) {
+function createPurgedSegment(segment, now) {
   const retention = segment.retention;
   if (retention === undefined || retention.rawState !== "available") {
-    throw new Error("Historical Session Evidence raw body is not available for purge.");
+    throw new Error("Session Evidence raw body is not available for purge.");
   }
   return {
     ...segment,
@@ -3443,11 +3592,109 @@ function createPurgedHistoricalSegment(segment, now) {
     }
   };
 }
+function createRetentionContext() {
+  return {
+    reviewSnapshots: new Map,
+    triggerMaps: new Map
+  };
+}
+async function loadLegacyRetentionDays(homeDir, projectKey) {
+  const states = await listSessionMemoryStates({ homeDir, projectKey });
+  return new Map(states.map((state) => [`${state.projectKey}\x00${state.sessionKey}`, state.policy.retentionDays]));
+}
+function legacyExpiresAt(segment, retentionDays) {
+  return addDays(segment.createdAt, retentionDays.get(sessionKey(segment)) ?? DEFAULT_LEGACY_RETENTION_DAYS);
+}
+function sessionKey(segment) {
+  return `${segment.projectKey}\x00${segment.sessionKey}`;
+}
+function addDays(value, days) {
+  const timestamp = Date.parse(value);
+  if (!Number.isFinite(timestamp))
+    throw new Error("Invalid Session Evidence retention timestamp.");
+  return new Date(timestamp + days * 24 * 60 * 60 * 1000).toISOString();
+}
+async function expireCapturedRawEvents(input) {
+  const now = Date.parse(normalizeTimestamp(input.now));
+  const states = await listSessionMemoryStates({
+    homeDir: input.homeDir,
+    projectKey: input.projectKey
+  });
+  let payloads = 0;
+  let rawBytes = 0;
+  for (const state of states) {
+    const stateUpdatedAt = Date.parse(state.updatedAt);
+    if (Number.isFinite(stateUpdatedAt) && now - stateUpdatedAt < 5 * 60 * 1000)
+      continue;
+    const paths = resolveSessionMemoryPaths({
+      homeDir: input.homeDir,
+      projectKey: state.projectKey,
+      sessionKey: state.sessionKey
+    });
+    const cursor = await readCursor(paths.cursorPath);
+    const capturedLine = cursor?.lastCapturedLine ?? 0;
+    if (capturedLine <= 0)
+      continue;
+    let text2;
+    try {
+      text2 = await readFile5(paths.eventsPath, "utf8");
+    } catch {
+      continue;
+    }
+    const lines = text2.split(`
+`).filter((line) => line.trim() !== "");
+    let changed = false;
+    let filePayloads = 0;
+    let fileRawBytes = 0;
+    const nextLines = lines.map((line, index) => {
+      if (index >= capturedLine)
+        return line;
+      let event;
+      try {
+        event = JSON.parse(line);
+      } catch {
+        return line;
+      }
+      const expiresAt = Date.parse(event.receivedAt) + state.policy.retentionDays * 24 * 60 * 60 * 1000;
+      if (!Number.isFinite(expiresAt) || expiresAt > now || event.rawPayloadExpired === true || event.rawPayloadJson === "{}") {
+        return line;
+      }
+      filePayloads += 1;
+      fileRawBytes += Buffer.byteLength(event.rawPayloadJson, "utf8");
+      if (!input.apply)
+        return line;
+      changed = true;
+      return JSON.stringify({
+        ...event,
+        rawPayloadJson: "{}",
+        rawPayloadTruncated: false,
+        rawPayloadExpired: true
+      });
+    });
+    if (!input.apply) {
+      payloads += filePayloads;
+      rawBytes += fileRawBytes;
+      continue;
+    }
+    if (changed && await rewriteSessionRawEvents(paths.eventsPath, nextLines, text2)) {
+      payloads += filePayloads;
+      rawBytes += fileRawBytes;
+    }
+  }
+  return { payloads, rawBytes };
+}
+async function readCursor(path) {
+  try {
+    return JSON.parse(await readFile5(path, "utf8"));
+  } catch {
+    return null;
+  }
+}
 // packages/core/src/evolution/evidence/session-memory/updater.ts
 import { join as join9 } from "node:path";
 
 // packages/core/src/projects/index.ts
-import { lstat as lstat2, readFile as readFile5, readdir as readdir5, realpath, stat as stat2 } from "node:fs/promises";
+import { lstat as lstat2, readFile as readFile6, readdir as readdir5, realpath, stat as stat2 } from "node:fs/promises";
 import { basename as basename2, dirname as dirname5, isAbsolute as isAbsolute3, join as join8, parse } from "node:path";
 
 // packages/core/src/runtime-logs/index.ts
@@ -3521,7 +3768,7 @@ function createDebugLogEntry(input) {
 }
 function createEvoDevExecutionEvent(input) {
   const timestamp = normalizeTimestamp(input.timestamp);
-  const sessionKey = sanitizePersistentIdentifier(input.sessionKey, "session");
+  const sessionKey2 = sanitizePersistentIdentifier(input.sessionKey, "session");
   const target = normalizeExecutionEventTarget(input.target);
   const eventType = sanitizeEventText(input.eventType, "unknown");
   const projectKey = input.projectKey === undefined || input.projectKey === null ? null : sanitizePersistentIdentifier(input.projectKey, "project");
@@ -3542,7 +3789,7 @@ function createEvoDevExecutionEvent(input) {
       timestamp,
       target,
       eventType,
-      sessionKey,
+      sessionKey: sessionKey2,
       projectKey,
       runId,
       roleId,
@@ -3558,7 +3805,7 @@ function createEvoDevExecutionEvent(input) {
     runId,
     roleId,
     taskId,
-    sessionKey,
+    sessionKey: sessionKey2,
     summary,
     metadata,
     decision,
@@ -4333,7 +4580,7 @@ async function findNearestGitRoot(cwd) {
 }
 async function readDiscoveredProject(path) {
   try {
-    return parseDiscoveredProject(JSON.parse(await readFile5(path, "utf8")));
+    return parseDiscoveredProject(JSON.parse(await readFile6(path, "utf8")));
   } catch (error) {
     if (isNotFoundError(error) || error instanceof ProjectRegistrationError)
       return null;
@@ -4342,7 +4589,7 @@ async function readDiscoveredProject(path) {
 }
 async function readRegisteredProject(path) {
   try {
-    return parseRegisteredProject(JSON.parse(await readFile5(path, "utf8")));
+    return parseRegisteredProject(JSON.parse(await readFile6(path, "utf8")));
   } catch (error) {
     if (isNotFoundError(error) || error instanceof ProjectRegistrationError)
       return null;
@@ -4351,7 +4598,7 @@ async function readRegisteredProject(path) {
 }
 async function readProjectWorkspace(path) {
   try {
-    return parseProjectWorkspace(JSON.parse(await readFile5(path, "utf8")));
+    return parseProjectWorkspace(JSON.parse(await readFile6(path, "utf8")));
   } catch (error) {
     if (isNotFoundError(error) || error instanceof ProjectRegistrationError)
       return null;
@@ -4360,7 +4607,7 @@ async function readProjectWorkspace(path) {
 }
 async function readProjectAlias(path) {
   try {
-    return parseProjectAlias(JSON.parse(await readFile5(path, "utf8")));
+    return parseProjectAlias(JSON.parse(await readFile6(path, "utf8")));
   } catch (error) {
     if (isNotFoundError(error) || error instanceof ProjectRegistrationError)
       return null;
@@ -4439,7 +4686,7 @@ async function listLegacyHookBindings(homeDir) {
   for (const root of roots) {
     for (const sessionDir of await listDirectoryNames3(root)) {
       try {
-        const value = JSON.parse(await readFile5(join8(root, sessionDir, "binding.json"), "utf8"));
+        const value = JSON.parse(await readFile6(join8(root, sessionDir, "binding.json"), "utf8"));
         if (value === null || value.target !== "claude" && value.target !== "codex" || !isNonEmptyString(value.sessionKey) || !(value.cwd === null || isAbsoluteString(value.cwd)) || !isNonEmptyString(value.updatedAt)) {
           continue;
         }
@@ -4560,6 +4807,7 @@ async function createSegment(input) {
     String(toLine),
     input.signals.at(-1)?.eventId ?? input.now
   ]);
+  const rawSha256 = sha256Hex(truncated.content);
   return {
     schemaVersion: 1,
     kind: "session-evidence-segment",
@@ -4572,6 +4820,13 @@ async function createSegment(input) {
     createdAt: input.now,
     reason: input.reason,
     strength: input.strength,
+    retention: {
+      policyDays: input.state.policy.retentionDays,
+      expiresAt: addDays2(input.now, input.state.policy.retentionDays),
+      rawState: "available",
+      rawPurgedAt: null,
+      originalRawSha256: rawSha256
+    },
     source: {
       traceRefId: input.cursor.traceRefId,
       sourcePath: input.paths.eventsPath,
@@ -4589,7 +4844,7 @@ async function createSegment(input) {
       content: truncated.content,
       truncated: raw.truncated || truncated.truncated,
       byteLength: Buffer.byteLength(truncated.content, "utf8"),
-      sha256: sha256Hex(truncated.content)
+      sha256: rawSha256
     },
     normalized: {
       summary: createSegmentSummary(input.reason, input.strength, signalSummaries),
@@ -4618,6 +4873,12 @@ async function createSegment(input) {
     }
   };
 }
+function addDays2(value, days) {
+  const timestamp = Date.parse(value);
+  if (!Number.isFinite(timestamp))
+    throw new Error("Invalid Session Evidence retention timestamp.");
+  return new Date(timestamp + days * 24 * 60 * 60 * 1000).toISOString();
+}
 function estimateTokenCount(rawPayloadJson, summary) {
   return Math.max(1, Math.ceil((rawPayloadJson.length + summary.length) / 4));
 }
@@ -4832,8 +5093,8 @@ async function updateSessionMemoryFromHook(input) {
   const cwd = optionalString(input.rawPayload.cwd);
   const workspace = team === null && cwd !== null ? await resolveProjectWorkspaceFromCwd({ homeDir: input.homeDir, cwd }) : null;
   const projectKey = sanitizeStorageId(team?.projectKey ?? workspace?.projectKey ?? resolveProjectLogKey(input.homeDir, cwd ?? input.homeDir), "project");
-  const sessionKey = sanitizeStorageId(resolveTraceSessionKey(input.rawPayload), "session");
-  const paths = resolveSessionMemoryPaths({ homeDir: input.homeDir, projectKey, sessionKey });
+  const sessionKey2 = sanitizeStorageId(resolveTraceSessionKey(input.rawPayload), "session");
+  const paths = resolveSessionMemoryPaths({ homeDir: input.homeDir, projectKey, sessionKey: sessionKey2 });
   const now = normalizeTimestamp(input.receivedAt ?? input.event.time.receivedAt);
   const existingState = await readSessionState(paths.statePath);
   if (existingState === null && input.event.type !== "UserPromptSubmit") {
@@ -4845,7 +5106,7 @@ async function updateSessionMemoryFromHook(input) {
   const currentSignal = createSignal(input, rawEvent, appended.lineNumber);
   const state = existingState ?? createInitialState({
     projectKey,
-    sessionKey,
+    sessionKey: sessionKey2,
     target: input.target,
     runId: team?.runId ?? null,
     roleId: team?.roleId ?? null,
@@ -4854,7 +5115,7 @@ async function updateSessionMemoryFromHook(input) {
     eventId: input.event.eventId,
     tokenEstimate
   });
-  const cursor = await readSessionCursor(paths.cursorPath, sessionKey, paths.eventsPath, now);
+  const cursor = await readSessionCursor(paths.cursorPath, sessionKey2, paths.eventsPath, now);
   const previous = cloneState(state);
   applyEventToState(state, {
     input,
@@ -4896,21 +5157,24 @@ async function updateSessionMemoryFromHook(input) {
     segmentPath = paths.segmentPath(segment.id);
     await writeJson(segmentPath, segment);
     await writeSessionIndex(paths, state, segment, now);
-    const trigger = await enqueueSegmentEvolutionTrigger({
-      homeDir: input.homeDir,
-      projectKey: segment.projectKey,
-      sessionKey: segment.sessionKey,
-      runId: segment.runId,
-      roleId: segment.roleId,
-      segmentId: segment.id,
-      segmentPath,
-      strength: segment.strength,
-      reason: segment.reason,
-      summary: segment.normalized.summary,
-      now
-    });
-    queuedSegmentTriggerId = trigger.id;
-    cursor.lastCapturedLine = appended.lineNumber;
+    if (shouldQueueSegmentForEvolution(segment)) {
+      const trigger = await enqueueSegmentEvolutionTrigger({
+        homeDir: input.homeDir,
+        projectKey: segment.projectKey,
+        sessionKey: segment.sessionKey,
+        runId: segment.runId,
+        roleId: segment.roleId,
+        segmentId: segment.id,
+        segmentPath,
+        strength: segment.strength,
+        reason: segment.reason,
+        summary: segment.normalized.summary,
+        now
+      });
+      queuedSegmentTriggerId = trigger.id;
+    }
+    await resetSessionRawEvents(paths.eventsPath);
+    cursor.lastCapturedLine = 0;
     cursor.lastCapturedEventId = input.event.eventId;
     cursor.updatedAt = now;
     state.lastSegmentId = segment.id;
@@ -4936,6 +5200,9 @@ async function updateSessionMemoryFromHook(input) {
     queuedSegmentTriggerId
   };
 }
+function shouldQueueSegmentForEvolution(segment) {
+  return segment.reason !== "session-memory-threshold" && segment.reason !== "session-memory-init";
+}
 function emptyResult() {
   return {
     state: null,
@@ -4947,12 +5214,12 @@ function emptyResult() {
   };
 }
 // packages/core/src/hooks/index.ts
-import { mkdir as mkdir6, readFile as readFile7, writeFile as writeFile5 } from "node:fs/promises";
+import { mkdir as mkdir6, readFile as readFile8, writeFile as writeFile5 } from "node:fs/promises";
 import { dirname as dirname7, join as join11 } from "node:path";
 
 // packages/core/src/team/index.ts
 import { spawn } from "node:child_process";
-import { appendFile as appendFile3, cp, mkdir as mkdir5, readFile as readFile6, readdir as readdir6, stat as stat3, writeFile as writeFile4 } from "node:fs/promises";
+import { appendFile as appendFile3, cp, mkdir as mkdir5, readFile as readFile7, readdir as readdir6, stat as stat3, writeFile as writeFile4 } from "node:fs/promises";
 import { basename as basename3, dirname as dirname6, extname, isAbsolute as isAbsolute4, join as join10, relative as relative3, resolve as resolve3 } from "node:path";
 
 // packages/core/src/team/prompts.ts
@@ -5163,7 +5430,7 @@ function createTeamRunStore(homeDir) {
     },
     async readRun(runId) {
       await migrateLegacyRunDirIfNeeded(paths2, runId);
-      return parseTeamRunRecord(JSON.parse(await readFile6(paths2.runPath(runId), "utf8")));
+      return parseTeamRunRecord(JSON.parse(await readFile7(paths2.runPath(runId), "utf8")));
     },
     async writeLatestRunId(runId) {
       await mkdir5(paths2.runsDir, { recursive: true });
@@ -5171,13 +5438,13 @@ function createTeamRunStore(homeDir) {
     },
     async readLatestRunId() {
       try {
-        const latest = JSON.parse(await readFile6(paths2.latestRunPath, "utf8"));
+        const latest = JSON.parse(await readFile7(paths2.latestRunPath, "utf8"));
         if (latest?.version === 1 && typeof latest.runId === "string")
           return latest.runId;
         return null;
       } catch {
         try {
-          const latest = JSON.parse(await readFile6(paths2.legacyLatestRunPath, "utf8"));
+          const latest = JSON.parse(await readFile7(paths2.legacyLatestRunPath, "utf8"));
           if (latest?.version === 1 && typeof latest.runId === "string") {
             await migrateLegacyRunDirIfNeeded(paths2, latest.runId);
             await this.writeLatestRunId(latest.runId);
@@ -5195,13 +5462,13 @@ function createTeamRunStore(homeDir) {
     },
     async readAgent(runId, roleId) {
       await migrateLegacyRunDirIfNeeded(paths2, runId);
-      return parseTeamAgentRecord(JSON.parse(await readFile6(paths2.agentPath(runId, roleId), "utf8")));
+      return parseTeamAgentRecord(JSON.parse(await readFile7(paths2.agentPath(runId, roleId), "utf8")));
     },
     async readAgents(runId) {
       await migrateLegacyRunDirIfNeeded(paths2, runId);
       try {
         const entries = await readdir6(paths2.agentsDir(runId));
-        const agents = await Promise.all(entries.filter((entry) => entry.endsWith(".json")).map((entry) => readFile6(join10(paths2.agentsDir(runId), entry), "utf8").then((raw) => parseTeamAgentRecord(JSON.parse(raw)))));
+        const agents = await Promise.all(entries.filter((entry) => entry.endsWith(".json")).map((entry) => readFile7(join10(paths2.agentsDir(runId), entry), "utf8").then((raw) => parseTeamAgentRecord(JSON.parse(raw)))));
         return agents.sort((left, right) => left.roleId.localeCompare(right.roleId));
       } catch {
         return [];
@@ -5218,7 +5485,7 @@ function createTeamRunStore(homeDir) {
     async readMessageList(runId) {
       await migrateLegacyRunDirIfNeeded(paths2, runId);
       try {
-        const file = parseTeamMessageListFile(JSON.parse(await readFile6(paths2.messageListPath(runId), "utf8")));
+        const file = parseTeamMessageListFile(JSON.parse(await readFile7(paths2.messageListPath(runId), "utf8")));
         return file.messages;
       } catch (error) {
         if (isNotFoundError2(error))
@@ -6157,7 +6424,7 @@ async function resolveTeamOverlay(input) {
     return {
       source: "repo",
       teamPath: repoTeamPath,
-      definition: parseTeamDefinitionMarkdown(await readFile6(repoTeamPath, "utf8"))
+      definition: parseTeamDefinitionMarkdown(await readFile7(repoTeamPath, "utf8"))
     };
   }
   const globalTeamPath = resolveGlobalTeamMarkdownPath(input.homeDir);
@@ -6165,7 +6432,7 @@ async function resolveTeamOverlay(input) {
     return {
       source: "global",
       teamPath: globalTeamPath,
-      definition: parseTeamDefinitionMarkdown(await readFile6(globalTeamPath, "utf8"))
+      definition: parseTeamDefinitionMarkdown(await readFile7(globalTeamPath, "utf8"))
     };
   }
   return {
@@ -6180,7 +6447,7 @@ async function ensureDefaultTeamOverlay(input) {
   const files = [];
   for (const asset of assets) {
     const targetPath = asset.kind === "team" ? join10(paths2.rootDir, "team", "team.md") : join10(paths2.rootDir, "team", "agents", asset.name);
-    const content = await readFile6(asset.sourcePath, "utf8");
+    const content = await readFile7(asset.sourcePath, "utf8");
     files.push({
       sourcePath: asset.sourcePath,
       targetPath,
@@ -6727,13 +6994,13 @@ async function createScopedTeamStartupContext(input) {
   });
   if (pack === null)
     return null;
-  const sessionKey = `team-${input.runId}-${input.role.roleId}`;
-  if (await hasContextInjectionReceipt({ homeDir, sessionKey, contextPackId: pack.id })) {
+  const sessionKey2 = `team-${input.runId}-${input.role.roleId}`;
+  if (await hasContextInjectionReceipt({ homeDir, sessionKey: sessionKey2, contextPackId: pack.id })) {
     return null;
   }
   await writeContextInjectionReceipt({
     homeDir,
-    sessionKey,
+    sessionKey: sessionKey2,
     pack,
     trigger: "team-startup",
     hookEventId: null,
@@ -6852,7 +7119,7 @@ function recoveredHandle(input, window, paneId) {
 async function readSettingsOrDefault(homeDir) {
   const settingsPath = resolveEvoDevPaths(homeDir).settingsPath;
   try {
-    return parseSettings(JSON.parse(await readFile6(settingsPath, "utf8")));
+    return parseSettings(JSON.parse(await readFile7(settingsPath, "utf8")));
   } catch {
     return createDefaultSettings();
   }
@@ -6930,7 +7197,7 @@ async function assertReadableFile(path, label) {
 }
 async function writeTextFileIfMissing(path, content) {
   try {
-    await readFile6(path, "utf8");
+    await readFile7(path, "utf8");
     return false;
   } catch (error) {
     if (!isNotFoundError2(error)) {
@@ -6963,7 +7230,7 @@ async function readTeamAgentMarkdown(reference) {
     throw new Error(`Team agent file for ${reference.roleId} must be Markdown.`);
   }
   try {
-    return await readFile6(reference.sourcePath, "utf8");
+    return await readFile7(reference.sourcePath, "utf8");
   } catch (error) {
     if (isNotFoundError2(error)) {
       throw new Error(`Team agent file not found for ${reference.roleId}: ${reference.sourcePath}`);
@@ -7299,7 +7566,7 @@ function defaultRolePrompt(roleId) {
 }
 async function readRoleCandidate(path, source) {
   try {
-    const raw = await readFile6(path, "utf8");
+    const raw = await readFile7(path, "utf8");
     return { value: JSON.parse(raw), path, source };
   } catch (error) {
     if (isNotFoundError2(error))
@@ -7335,7 +7602,7 @@ function resolveTeamBindingWritePath(input) {
 }
 async function readTeamBindingConfig(path) {
   try {
-    const raw = await readFile6(path, "utf8");
+    const raw = await readFile7(path, "utf8");
     return parseTeamBindingConfig(JSON.parse(raw));
   } catch (error) {
     if (isNotFoundError2(error)) {
@@ -7412,7 +7679,7 @@ async function appendJsonLine2(path, value) {
 }
 async function readJsonLines(path, parse2) {
   try {
-    const text2 = await readFile6(path, "utf8");
+    const text2 = await readFile7(path, "utf8");
     return text2.split(`
 `).filter((line) => line.trim() !== "").map((line) => parse2(JSON.parse(line)));
   } catch (error) {
@@ -7739,8 +8006,20 @@ async function handleHookRuntime(input) {
   const evolutionDiagnostics = sessionMemoryDiagnostics.queuedSegmentTriggerId !== null || shouldSuppressLegacyEvolutionTrigger(input.event.type) ? { stateWrites: [], warnings: [] } : await recordEvolutionTriggerFromHook(input);
   const messageDiagnostics = await deliverPendingTeamMessagesFromHook(input, result);
   const scopedContextDiagnostics = await injectScopedKnowledgeContextFromHook(input, result);
+  const knowledgeOutcomeDiagnostics = await recordKnowledgeOutcomeFromHook(input);
   const teamStateDiagnostics = await recordTeamAgentHookStateFromHook(input);
-  const completed = appendRuntimeDiagnostics(appendRuntimeDiagnostics(appendRuntimeDiagnostics(appendRuntimeDiagnostics(appendRuntimeDiagnostics(appendRuntimeDiagnostics(appendRuntimeDiagnostics(result, diagnostics), projectDiagnostics), sessionMemoryDiagnostics), evolutionDiagnostics), messageDiagnostics), scopedContextDiagnostics), teamStateDiagnostics);
+  let completed = appendRuntimeDiagnostics(result, diagnostics);
+  for (const entry of [
+    projectDiagnostics,
+    sessionMemoryDiagnostics,
+    evolutionDiagnostics,
+    messageDiagnostics,
+    scopedContextDiagnostics,
+    knowledgeOutcomeDiagnostics,
+    teamStateDiagnostics
+  ]) {
+    completed = appendRuntimeDiagnostics(completed, entry);
+  }
   return appendDevelopmentHookDiagnostics(input, completed);
 }
 function formatHookRuntimeOutput(result) {
@@ -7927,7 +8206,9 @@ async function injectScopedKnowledgeContextFromHook(input, result) {
     environment: input.environment,
     payload: input.rawPayload
   });
-  if (team === null || team.roleId !== "main")
+  if (team === null)
+    return injectOrdinarySessionKnowledge(input, result);
+  if (team.roleId !== "main")
     return { stateWrites: [], warnings: [] };
   try {
     if (input.runtimeInjectionEnabled === false)
@@ -7939,17 +8220,17 @@ async function injectScopedKnowledgeContextFromHook(input, result) {
     });
     if (pack === null)
       return { stateWrites: [], warnings: [] };
-    const sessionKey = resolveHookSessionKey(input.rawPayload);
+    const sessionKey2 = resolveHookSessionKey(input.rawPayload);
     if (await hasContextInjectionReceipt({
       homeDir: input.homeDir,
-      sessionKey,
+      sessionKey: sessionKey2,
       contextPackId: pack.id
     })) {
       return { stateWrites: [], warnings: [] };
     }
     const receipt = await writeContextInjectionReceipt({
       homeDir: input.homeDir,
-      sessionKey,
+      sessionKey: sessionKey2,
       pack,
       trigger: "hook-safe-point",
       hookEventId: input.event.eventId,
@@ -7964,6 +8245,102 @@ async function injectScopedKnowledgeContextFromHook(input, result) {
     };
   }
 }
+async function injectOrdinarySessionKnowledge(input, result) {
+  if (input.event.type !== "UserPromptSubmit" || input.runtimeInjectionEnabled === false) {
+    return { stateWrites: [], warnings: [] };
+  }
+  const cwd = optionalPayloadString(input.rawPayload.cwd);
+  if (cwd === null)
+    return { stateWrites: [], warnings: [] };
+  const sessionKey2 = resolveHookSessionKey(input.rawPayload);
+  const paths2 = resolveHookRuntimeSessionPaths({ homeDir: input.homeDir, sessionKey: sessionKey2 });
+  const binding = await readSessionBinding(input.homeDir, input.rawPayload);
+  if (binding?.knowledgeContextDeliveredAt !== undefined && binding.knowledgeContextDeliveredAt !== null) {
+    return { stateWrites: [], warnings: [] };
+  }
+  try {
+    const workspace = await resolveProjectWorkspaceFromCwd({ homeDir: input.homeDir, cwd });
+    if (workspace === null)
+      return { stateWrites: [], warnings: [] };
+    const queryText = readKnowledgeQueryText(input.rawPayload);
+    const pack = await createScopedKnowledgeContextPack({
+      homeDir: input.homeDir,
+      projectKey: workspace.projectKey,
+      roleId: input.target,
+      ...queryText === null ? {} : { queryText },
+      limit: 3,
+      inlineOnly: true
+    });
+    const deliveredAt = input.receivedAt ?? new Date().toISOString();
+    const nextBinding = {
+      version: 1,
+      target: input.target,
+      sessionKey: sessionKey2,
+      cwd,
+      teamRuntimeContextDeliveredAt: binding?.teamRuntimeContextDeliveredAt ?? null,
+      knowledgeContextDeliveredAt: deliveredAt,
+      updatedAt: deliveredAt
+    };
+    await writeJsonFile2(paths2.bindingPath, nextBinding);
+    if (pack === null)
+      return { stateWrites: [paths2.bindingPath], warnings: [] };
+    const receipt = await writeContextInjectionReceipt({
+      homeDir: input.homeDir,
+      sessionKey: sessionKey2,
+      pack,
+      trigger: "ordinary-session",
+      hookEventId: input.event.eventId,
+      injectedAt: deliveredAt
+    });
+    result.output = appendAdditionalContext(result.output, input.event.type, formatScopedKnowledgePromptBlock(pack));
+    return { stateWrites: [paths2.bindingPath, receipt.path], warnings: [] };
+  } catch {
+    return {
+      stateWrites: [],
+      warnings: ["Ordinary-session knowledge context could not be injected."]
+    };
+  }
+}
+function readKnowledgeQueryText(payload) {
+  for (const value of [
+    payload.prompt,
+    payload.user_prompt,
+    payload.userPrompt,
+    payload.query,
+    payload.message,
+    payload.text
+  ]) {
+    if (typeof value === "string" && value.trim() !== "")
+      return value.trim().slice(0, 4000);
+  }
+  return null;
+}
+async function recordKnowledgeOutcomeFromHook(input) {
+  if (!isKnowledgeOutcomeSignal(input.event))
+    return { stateWrites: [], warnings: [] };
+  try {
+    const paths2 = await recordContextInjectionOutcome({
+      homeDir: input.homeDir,
+      sessionKey: resolveHookSessionKey(input.rawPayload),
+      eventId: input.event.eventId,
+      observedAt: input.receivedAt ?? input.event.time.receivedAt ?? new Date().toISOString(),
+      summary: input.event.payload.summary
+    });
+    return { stateWrites: paths2, warnings: [] };
+  } catch {
+    return {
+      stateWrites: [],
+      warnings: ["Knowledge delivery outcome metadata could not be recorded."]
+    };
+  }
+}
+function isKnowledgeOutcomeSignal(event) {
+  if (event.type !== "PostToolUse")
+    return false;
+  if (event.payload.metadata.commandClass === "test-command")
+    return true;
+  return /\b(?:test|lint|typecheck|build|verify|check)\b/iu.test(event.payload.summary);
+}
 function canDeliverTeamMessagesFromHook(target, eventType) {
   if (!TEAM_MESSAGE_DELIVERY_EVENTS.has(eventType))
     return false;
@@ -8011,17 +8388,18 @@ async function handleSessionStart(input) {
   });
 }
 async function handleUserPromptSubmit(input) {
-  const sessionKey = resolveHookSessionKey(input.rawPayload);
-  const paths2 = resolveHookRuntimeSessionPaths({ homeDir: input.homeDir, sessionKey });
+  const sessionKey2 = resolveHookSessionKey(input.rawPayload);
+  const paths2 = resolveHookRuntimeSessionPaths({ homeDir: input.homeDir, sessionKey: sessionKey2 });
   const previousBinding = await readSessionBinding(input.homeDir, input.rawPayload);
   const teamRuntimeContext = previousBinding?.teamRuntimeContextDeliveredAt === undefined || previousBinding.teamRuntimeContextDeliveredAt === null ? await createTeamRuntimeContextForUserPrompt(input) : null;
   const teamRuntimeContextDeliveredAt = teamRuntimeContext !== null ? input.receivedAt ?? new Date().toISOString() : previousBinding?.teamRuntimeContextDeliveredAt ?? null;
   const binding = {
     version: 1,
     target: input.target,
-    sessionKey,
+    sessionKey: sessionKey2,
     cwd: optionalPayloadString(input.rawPayload.cwd),
     teamRuntimeContextDeliveredAt,
+    knowledgeContextDeliveredAt: previousBinding?.knowledgeContextDeliveredAt ?? null,
     updatedAt: input.receivedAt ?? new Date().toISOString()
   };
   await writeJsonFile2(paths2.bindingPath, binding);
@@ -8179,10 +8557,10 @@ function truncateTeamMessageBody(value) {
   return `${value.slice(0, 4000)}...[truncated:${value.length - 4000}]`;
 }
 async function readSessionBinding(homeDir, payload) {
-  const sessionKey = resolveHookSessionKey(payload);
-  const paths2 = resolveHookRuntimeSessionPaths({ homeDir, sessionKey });
+  const sessionKey2 = resolveHookSessionKey(payload);
+  const paths2 = resolveHookRuntimeSessionPaths({ homeDir, sessionKey: sessionKey2 });
   try {
-    return JSON.parse(await readFile7(paths2.bindingPath, "utf8"));
+    return JSON.parse(await readFile8(paths2.bindingPath, "utf8"));
   } catch (error) {
     if (isNotFoundError3(error))
       return null;
@@ -8457,7 +8835,7 @@ function mergeSettings(existing, defaults = createDefaultSettings()) {
 async function readRuntimeInjectionSettings(homeDir) {
   const paths2 = resolveEvoDevPaths(homeDir);
   try {
-    return parseSettings(JSON.parse(await readFile8(paths2.settingsPath, "utf8"))).memory;
+    return parseSettings(JSON.parse(await readFile9(paths2.settingsPath, "utf8"))).memory;
   } catch (error) {
     if (isNotFoundError4(error))
       return createDefaultMemorySettings();
@@ -8610,7 +8988,7 @@ import { createHash as createHash3, randomUUID as randomUUID2 } from "node:crypt
 import {
   appendFile as appendFile4,
   mkdir as mkdir7,
-  readFile as readFile9,
+  readFile as readFile10,
   readdir as readdir7,
   rename as rename2,
   rm as rm3,
@@ -8708,7 +9086,7 @@ async function listOkfKnowledgeChangeCandidates(input) {
   for (const projectKey of projectKeys) {
     const paths2 = resolveKnowledgeChangePaths(input.homeDir, projectKey);
     for (const name of await listJsonFileNames(paths2.candidatesDir)) {
-      const value = JSON.parse(await readFile9(join12(paths2.candidatesDir, name), "utf8"));
+      const value = JSON.parse(await readFile10(join12(paths2.candidatesDir, name), "utf8"));
       const change = parseOkfKnowledgeChangeCandidate(value);
       if (input.state === undefined || change.state === input.state)
         changes.push(change);
@@ -8724,7 +9102,7 @@ async function readOkfKnowledgeChangeCandidate(input) {
   if (input.projectKey !== undefined) {
     const paths3 = resolveKnowledgeChangePaths(input.homeDir, input.projectKey);
     const path = join12(paths3.candidatesDir, `${changeId}.json`);
-    const change2 = parseOkfKnowledgeChangeCandidate(JSON.parse(await readFile9(path, "utf8")));
+    const change2 = parseOkfKnowledgeChangeCandidate(JSON.parse(await readFile10(path, "utf8")));
     return { path, change: change2 };
   }
   const matches = await listOkfKnowledgeChangeCandidates({ homeDir: input.homeDir });
@@ -8745,7 +9123,7 @@ async function replaceOkfKnowledgeChangeCandidate(input) {
   }
   const paths2 = resolveKnowledgeChangePaths(input.homeDir, input.next.projectKey);
   const path = join12(paths2.candidatesDir, `${input.next.id}.json`);
-  const current = parseOkfKnowledgeChangeCandidate(JSON.parse(await readFile9(path, "utf8")));
+  const current = parseOkfKnowledgeChangeCandidate(JSON.parse(await readFile10(path, "utf8")));
   if (current.state !== input.previous.state || current.updatedAt !== input.previous.updatedAt || current.candidate.revision !== input.previous.candidate.revision) {
     throw new Error("Knowledge change was modified by another decision.");
   }
@@ -8854,7 +9232,7 @@ function resolveKnowledgeChangePaths(homeDir, projectKey) {
 }
 async function readKnowledgeChangeLockToken(path) {
   try {
-    const value = JSON.parse(await readFile9(path, "utf8"));
+    const value = JSON.parse(await readFile10(path, "utf8"));
     return isRecord6(value) && typeof value.token === "string" ? value.token : null;
   } catch {
     return null;
@@ -8885,7 +9263,7 @@ async function recoverStaleKnowledgeChangeLock(path) {
 }
 async function readKnowledgeChangeLockOwner(path) {
   try {
-    const value = JSON.parse(await readFile9(path, "utf8"));
+    const value = JSON.parse(await readFile10(path, "utf8"));
     if (!isRecord6(value))
       return null;
     return {
@@ -9010,6 +9388,7 @@ function createOkfKnowledgeRuntimeProjectionFromCandidate(candidate) {
       pathScopes: candidate.pathScopes
     },
     relatedConceptLinks: candidate.relatedConceptLinks,
+    supportRef: candidate.supportRef ?? null,
     lifecycle: {
       status: candidate.decision === "revoke" ? "revoked" : "active",
       supersedes: [],
@@ -9043,6 +9422,7 @@ function createOkfKnowledgeRuntimeProjectionFromConcept(concept) {
       pathScopes: concept.pathScopes
     },
     relatedConceptLinks: readSectionList(sections, "Related Concepts").filter((item) => item !== "No related concepts yet."),
+    supportRef: concept.supportRef ?? null,
     lifecycle: {
       status: concept.lifecycle.status,
       supersedes: concept.lifecycle.supersedes,
@@ -9208,6 +9588,7 @@ function normalizeRuntimeProjection(value) {
       pathScopes: normalizeArray(value.scopes.pathScopes)
     },
     relatedConceptLinks: normalizeArray(value.relatedConceptLinks),
+    supportRef: value.supportRef,
     lifecycle: {
       status: value.lifecycle.status,
       supersedes: normalizeArray(value.lifecycle.supersedes),
@@ -9235,6 +9616,7 @@ function listChangedProjectionFields(base, candidate) {
     ["scopes.workflowTags", base.scopes.workflowTags, candidate.scopes.workflowTags],
     ["scopes.pathScopes", base.scopes.pathScopes, candidate.scopes.pathScopes],
     ["relatedConceptLinks", base.relatedConceptLinks, candidate.relatedConceptLinks],
+    ["supportRef", base.supportRef, candidate.supportRef],
     ["lifecycle", base.lifecycle, candidate.lifecycle]
   ];
   return fields.filter(([, left, right]) => stableJsonStringify(left) !== stableJsonStringify(right)).map(([field]) => field);
@@ -9301,36 +9683,103 @@ function stableJsonStringify(value) {
   return `{${entries.map(([key, child]) => `${JSON.stringify(key)}:${stableJsonStringify(child)}`).join(",")}}`;
 }
 
-// packages/core/src/evolution/knowledge/freshness.ts
-function deriveOkfKnowledgeFreshness(input) {
+// packages/core/src/evolution/knowledge/support.ts
+function resolveOkfKnowledgeRuntimeEligibility(input) {
   const now = normalizeNow(input.now);
-  const concept = input.concept;
-  if (input.verifiedContradiction === true || concept.lifecycle.status === "stale" || concept.lifecycle.status === "deprecated" || concept.lifecycle.status === "revoked" || concept.lifecycle.status === "superseded" || concept.reviewState === "stale" || concept.reviewState === "deprecated" || concept.reviewState === "revoked" || concept.reviewState === "superseded" || isDue(concept.lifecycle.staleAfter, now)) {
+  if (input.verifiedContradiction === true || input.lifecycle.status === "stale" || input.lifecycle.status === "deprecated" || input.lifecycle.status === "revoked" || input.lifecycle.status === "superseded" || input.reviewState === "stale" || input.reviewState === "deprecated" || input.reviewState === "revoked" || input.reviewState === "superseded" || isDue(input.lifecycle.staleAfter, now)) {
     return {
+      delivery: "blocked",
       freshness: "stale",
-      reason: input.verifiedContradiction === true ? "Verified evidence contradicts the active claim." : "Lifecycle status or staleAfter excludes this concept from new runtime context."
+      reason: input.verifiedContradiction === true ? "Verified evidence contradicts the active claim." : "Lifecycle state excludes this knowledge from runtime context."
     };
   }
-  if (concept.verificationSnapshot === null) {
+  if (input.reviewState !== "accepted" && input.reviewState !== "auto-accepted") {
     return {
+      delivery: "blocked",
       freshness: "unknown",
-      reason: "No verifiable knowledge snapshot is stored for this legacy concept."
+      reason: "Knowledge has not passed an active-compatible review state."
     };
   }
-  if (input.repositoryFingerprintChanged === true || isDue(concept.lifecycle.reviewAfter, now)) {
+  if (input.sourceStatus === "changed") {
     return {
+      delivery: "blocked",
       freshness: "review-due",
-      reason: input.repositoryFingerprintChanged === true ? "A checked repository path changed after the last verification." : `Review was due at ${concept.lifecycle.reviewAfter}.`
+      reason: "The supporting source changed and requires revalidation."
+    };
+  }
+  if (isDue(input.lifecycle.reviewAfter, now)) {
+    return {
+      delivery: "reference",
+      freshness: "review-due",
+      reason: `Review was due at ${input.lifecycle.reviewAfter}.`
+    };
+  }
+  if (input.supportRef === null) {
+    return {
+      delivery: "reference",
+      freshness: "unknown",
+      reason: "Legacy knowledge has no structured support reference."
+    };
+  }
+  if (input.supportRef.kind === "semantic-inference") {
+    if (input.reviewState === "accepted") {
+      return {
+        delivery: "inline",
+        freshness: "verified",
+        reason: "A human-accepted inference is runtime-eligible as an explicit decision."
+      };
+    }
+    return {
+      delivery: "reference",
+      freshness: "unknown",
+      reason: "Model-inferred knowledge remains on-demand until supported by a direct source."
+    };
+  }
+  if ((input.supportRef.kind === "repo-policy" || input.supportRef.kind === "state-observation") && input.sourceStatus !== "current") {
+    return {
+      delivery: "reference",
+      freshness: "unknown",
+      reason: "The supporting repository source has not been revalidated for this query."
     };
   }
   return {
+    delivery: "inline",
     freshness: "verified",
-    reason: `Verified at ${concept.verificationSnapshot.verifiedAt}.`
+    reason: `Runtime-eligible through ${input.supportRef.kind}.`
+  };
+}
+function isDirectKnowledgeSupport(supportRef) {
+  return supportRef !== undefined && supportRef !== null && supportRef.kind !== "semantic-inference";
+}
+function normalizeNow(value) {
+  if (value instanceof Date && Number.isFinite(value.getTime()))
+    return value;
+  if (typeof value === "string" && Number.isFinite(Date.parse(value)))
+    return new Date(value);
+  return new Date;
+}
+function isDue(value, now) {
+  const timestamp = Date.parse(value);
+  return Number.isFinite(timestamp) && timestamp <= now.getTime();
+}
+
+// packages/core/src/evolution/knowledge/freshness.ts
+function deriveOkfKnowledgeFreshness(input) {
+  const eligibility = resolveOkfKnowledgeRuntimeEligibility({
+    reviewState: input.concept.reviewState,
+    lifecycle: input.concept.lifecycle,
+    supportRef: input.concept.supportRef ?? null,
+    now: input.now,
+    sourceStatus: input.repositoryFingerprintChanged === true ? "changed" : input.repositoryFingerprintChanged === false ? "current" : undefined,
+    verifiedContradiction: input.verifiedContradiction
+  });
+  return {
+    freshness: eligibility.freshness,
+    reason: eligibility.reason
   };
 }
 function createOkfKnowledgeVerificationSnapshot(input) {
-  const hasVerification = input.candidate.bodySections.verification.length > 0 || input.candidate.verificationNotApplicableReason !== undefined;
-  if (!hasVerification)
+  if (!isDirectKnowledgeSupport(input.candidate.supportRef))
     return null;
   const verifiedAt = normalizeIso(input.verifiedAt);
   if (verifiedAt === null)
@@ -9342,20 +9791,6 @@ function createOkfKnowledgeVerificationSnapshot(input) {
     repository: null
   };
 }
-function normalizeNow(value) {
-  if (value instanceof Date && Number.isFinite(value.getTime()))
-    return value;
-  if (typeof value === "string") {
-    const normalized = normalizeIso(value);
-    if (normalized !== null)
-      return new Date(normalized);
-  }
-  return new Date;
-}
-function isDue(value, now) {
-  const normalized = normalizeIso(value);
-  return normalized !== null && Date.parse(normalized) <= now.getTime();
-}
 function normalizeIso(value) {
   const time2 = Date.parse(value);
   return Number.isFinite(time2) ? new Date(time2).toISOString() : null;
@@ -9731,6 +10166,7 @@ function normalizePlanCandidate(value, path) {
     scores: normalizeScores(input.scores, `${path}.scores`),
     decisionReason: sanitizeOkfText(readRequiredString(input.decisionReason, `${path}.decisionReason`)),
     evidenceRefs: readStringArray(input.evidenceRefs, `${path}.evidenceRefs`).map(sanitizeOkfText),
+    supportRef: input.supportRef === undefined ? undefined : normalizeKnowledgeSupportRef(input.supportRef, `${path}.supportRef`),
     reviewState: parseOkfReviewState(readRequiredString(input.reviewState, `${path}.reviewState`)),
     verificationNotApplicableReason: typeof input.verificationNotApplicableReason === "string" ? sanitizeOkfText(input.verificationNotApplicableReason) : undefined,
     evalSetRefs: input.evalSetRefs === undefined ? undefined : readStringArray(input.evalSetRefs, `${path}.evalSetRefs`).map(sanitizeOkfText),
@@ -9790,6 +10226,7 @@ function validateCandidateContract(candidate, path, evalSetIds, add, options) {
   validateStringArrayValue(candidate.pathScopes, `${path}.pathScopes`, add);
   validateStringArrayValue(candidate.relatedConceptLinks, `${path}.relatedConceptLinks`, add);
   validateStringArrayValue(candidate.evidenceRefs, `${path}.evidenceRefs`, add);
+  validateKnowledgeSupportRefValue(candidate.supportRef, `${path}.supportRef`, add);
   validateOverlayUpdatesValue(candidate.overlayUpdates, `${path}.overlayUpdates`, add);
   validateScoresValue(candidate.scores, `${path}.scores`, add);
   validatePrivacyCheckValue(candidate.privacyCheck, `${path}.privacyCheck`, add);
@@ -10004,6 +10441,24 @@ function normalizeBasis(value) {
     throw new Error("Candidate basis is invalid.");
   return value;
 }
+function normalizeKnowledgeSupportRef(value, path) {
+  const input = assertRecordValue(value, path);
+  const kind = readRequiredString(input.kind, `${path}.kind`);
+  if (kind !== "user-declaration" && kind !== "repo-policy" && kind !== "state-observation" && kind !== "verified-outcome" && kind !== "semantic-inference") {
+    throw new Error(`${path}.kind is invalid.`);
+  }
+  const observedAt = readRequiredString(input.observedAt, `${path}.observedAt`);
+  if (!Number.isFinite(Date.parse(observedAt)))
+    throw new Error(`${path}.observedAt is invalid.`);
+  const subjectFingerprint = input.subjectFingerprint === null ? null : sanitizeOkfText(readRequiredString(input.subjectFingerprint, `${path}.subjectFingerprint`));
+  return {
+    id: sanitizeOkfText(readRequiredString(input.id, `${path}.id`)),
+    kind,
+    sourceRefId: sanitizeOkfText(readRequiredString(input.sourceRefId, `${path}.sourceRefId`)),
+    subjectFingerprint,
+    observedAt: new Date(observedAt).toISOString()
+  };
+}
 function normalizeEvalSetDecision(value) {
   const normalized = value === "no-write" ? "no_write" : value;
   if (normalized !== "create" && normalized !== "needs-human" && normalized !== "no_write" && normalized !== "skip") {
@@ -10126,6 +10581,28 @@ function validateStringArrayValue(value, path, add) {
       add(`${path}[${index}]`, "array.string", "Array items must be non-empty strings.");
   });
 }
+function validateKnowledgeSupportRefValue(value, path, add) {
+  if (value === undefined)
+    return;
+  if (!isRecord7(value)) {
+    add(path, "supportRef.object", "Candidate supportRef must be an object.");
+    return;
+  }
+  if (!isNonEmptyString2(value.id))
+    add(`${path}.id`, "supportRef.id", "supportRef id is required.");
+  if (value.kind !== "user-declaration" && value.kind !== "repo-policy" && value.kind !== "state-observation" && value.kind !== "verified-outcome" && value.kind !== "semantic-inference") {
+    add(`${path}.kind`, "supportRef.kind", "supportRef kind is invalid.");
+  }
+  if (!isNonEmptyString2(value.sourceRefId)) {
+    add(`${path}.sourceRefId`, "supportRef.sourceRefId", "supportRef sourceRefId is required.");
+  }
+  if (value.subjectFingerprint !== null && !isNonEmptyString2(value.subjectFingerprint)) {
+    add(`${path}.subjectFingerprint`, "supportRef.subjectFingerprint", "supportRef subjectFingerprint must be null or a non-empty string.");
+  }
+  if (!isNonEmptyString2(value.observedAt) || !Number.isFinite(Date.parse(value.observedAt))) {
+    add(`${path}.observedAt`, "supportRef.observedAt", "supportRef observedAt must be an ISO timestamp.");
+  }
+}
 function validateOverlayUpdatesValue(value, path, add) {
   if (!Array.isArray(value)) {
     add(path, "overlayUpdates.array", "Overlay updates must be an array.");
@@ -10329,7 +10806,7 @@ function decideOkfKnowledgeCandidate(candidate, context) {
   const localActiveTarget = sanitized.targetStore === "okf" || sanitized.kind === "evos-case";
   const hasScopeTags = sanitized.repoTags.length > 0 && sanitized.roleTags.length > 0;
   const highRiskRequiresHuman = hasHighRiskHumanReviewSignal(candidate) || hasHighRiskHumanReviewSignal(sanitized);
-  const autoAcceptEligible = !highRiskRequiresHuman && !isLegacyTemplateKnowledge(sanitized) && !hasEphemeralKnowledgeIdentity(sanitized) && hasReusableSemanticShape(sanitized) && conflict === null && localActiveTarget && sanitized.targetStore === "okf" && sanitized.basis === "direct" && sanitized.metadataOnlyEvidence && hasVerification && hasScopeTags && scores.evidenceStrength >= 4 && scores.reuseValue >= 3 && scores.actionability >= 3 && scores.stability >= 3 && scores.privacyRisk <= 2 && scores.duplicationRisk <= 2;
+  const autoAcceptEligible = !highRiskRequiresHuman && !isLegacyTemplateKnowledge(sanitized) && !hasEphemeralKnowledgeIdentity(sanitized) && hasReusableSemanticShape(sanitized) && conflict === null && localActiveTarget && sanitized.targetStore === "okf" && sanitized.basis === "direct" && isDirectKnowledgeSupport(sanitized.supportRef) && sanitized.metadataOnlyEvidence && hasVerification && hasScopeTags && scores.evidenceStrength >= 4 && scores.reuseValue >= 3 && scores.actionability >= 3 && scores.stability >= 3 && scores.privacyRisk <= 2 && scores.duplicationRisk <= 2;
   if (autoAcceptEligible) {
     return {
       ...sanitized,
@@ -10656,7 +11133,7 @@ async function preflightOkfConceptTargets(okfDir, candidates) {
       targets.set(targetPath, { action: "write", candidateId: candidate.id });
       continue;
     }
-    const existing = parseOkfConceptFile(okfDir, targetPath, await readFile10(targetPath, "utf8"));
+    const existing = parseOkfConceptFile(okfDir, targetPath, await readFile11(targetPath, "utf8"));
     if (existing === null) {
       throw new Error(`OKF concept target is occupied by an unrecognized file: ${candidate.targetPath}`);
     }
@@ -10707,7 +11184,7 @@ async function writeFailedOkfKnowledgePlanArtifact(input) {
 }
 async function readFailedOkfKnowledgePlanArtifact(input) {
   const path = resolveFailedPlanPath(input.homeDir, input.projectKey, input.runId);
-  const value = JSON.parse(await readFile10(path, "utf8"));
+  const value = JSON.parse(await readFile11(path, "utf8"));
   if (isRecord7(value) && value.kind === "okf-knowledge-failed-plan") {
     const artifact = value;
     validateFailedPlanArtifact(artifact);
@@ -10893,7 +11370,7 @@ async function listOkfKnowledgeConcepts(input) {
   for (const file of files) {
     if (RESERVED_OKF_FILENAMES.has(file.name))
       continue;
-    const content = await readFile10(file.path, "utf8");
+    const content = await readFile11(file.path, "utf8");
     const parsed = parseOkfConceptFile(okfDir, file.path, content);
     if (parsed !== null)
       concepts.push(parsed);
@@ -10932,7 +11409,7 @@ async function queryOkfKnowledge(input) {
   for (const file of files) {
     if (RESERVED_OKF_FILENAMES.has(file.name))
       continue;
-    const content = await readFile10(file.path, "utf8");
+    const content = await readFile11(file.path, "utf8");
     const sourceLink = toOkfLink(okfDir, file.path);
     if (isUnsafeOkfQueryContent(content)) {
       warnings.push(`Omitted unsafe OKF knowledge item: ${sourceLink}. Run evodev knowledge lint.`);
@@ -11209,8 +11686,8 @@ function mergeAcceptedEvosCasesIntoKnowledgeQuery(result, cases, warnings = [],
         score: structuredScore + lexical.score,
         title: evosCase.title,
         summary: evosCase.expectedFutureBehavior || evosCase.result.summary || evosCase.title,
-        freshness: "verified",
-        runtimeExcerpt: sanitizeOkfText(evosCase.expectedFutureBehavior || evosCase.result.summary || evosCase.title).slice(0, 1200),
+        freshness: "unknown",
+        runtimeExcerpt: null,
         matchReasons: lexical.reasons.length === 0 ? structuredReasons : [...structuredReasons, ...lexical.reasons]
       }
     ];
@@ -11223,8 +11700,12 @@ function mergeAcceptedEvosCasesIntoKnowledgeQuery(result, cases, warnings = [],
   };
 }
 async function createScopedKnowledgeContextPack(input) {
-  const result = await queryScopedOkfKnowledgeContext(input);
-  if (result.items.length === 0)
+  const result = await queryScopedOkfKnowledgeContext({
+    ...input,
+    limit: input.inlineOnly === true ? Math.max(input.limit ?? 3, 50) : input.limit
+  });
+  const selectedItems = input.inlineOnly === true ? result.items.filter((item) => item.runtimeExcerpt !== null).slice(0, input.limit ?? 3) : result.items;
+  if (selectedItems.length === 0)
     return null;
   const scope = {
     ...result.projectKey === undefined ? {} : { projectKey: result.projectKey },
@@ -11232,7 +11713,7 @@ async function createScopedKnowledgeContextPack(input) {
     ...result.workflowId === undefined ? {} : { workflowId: result.workflowId },
     paths: result.paths
   };
-  const items = result.items.map((item) => ({
+  const items = selectedItems.map((item) => ({
     id: item.id,
     sourceType: item.sourceType,
     sourceLink: item.sourceLink,
@@ -11249,10 +11730,11 @@ async function createScopedKnowledgeContextPack(input) {
   }));
   const okfIndexRevision = createKnowledgeContextRevision(items);
   const queryText = normalizeKnowledgeQueryText(result.queryText);
+  const queryHash = queryText === undefined ? undefined : sha256Short2(queryText);
   const packSeed = stableJsonStringify2({
     okfIndexRevision,
     scope,
-    queryText: queryText ?? null,
+    queryHash: queryHash ?? null,
     items: items.map((item) => ({
       id: item.id,
       sourceType: item.sourceType,
@@ -11270,7 +11752,7 @@ async function createScopedKnowledgeContextPack(input) {
     id: `ctxpack-${sha256Short2(packSeed)}`,
     okfIndexRevision,
     scope,
-    ...queryText === undefined ? {} : { queryText },
+    ...queryHash === undefined ? {} : { queryHash },
     items,
     warnings: result.warnings.length === 0 ? [] : [
       "Some scoped knowledge items were omitted because they failed safety validation; run evodev knowledge lint."
@@ -11285,7 +11767,6 @@ function formatScopedKnowledgePromptBlock(pack) {
     `Project: ${pack.scope.projectKey ?? "all"}`,
     `Role: ${pack.scope.roleId ?? "any"}`,
     `Workflow: ${pack.scope.workflowId ?? "any"}`,
-    ...pack.queryText === undefined ? [] : [`Query: ${sanitizeOkfText(pack.queryText)}`],
     `Paths: ${pack.scope.paths.length === 0 ? "all" : pack.scope.paths.join(", ")}`,
     "Raw content stored: false",
     "Freshness is determined by EvoDev lifecycle and verification metadata; do not infer validity from timestamps.",
@@ -11323,9 +11804,11 @@ async function writeContextInjectionReceipt(input) {
     okfIndexRevision: input.pack.okfIndexRevision,
     scope: input.pack.scope,
     itemIds: input.pack.items.map((item) => item.id),
+    queryHash: input.pack.queryHash ?? null,
     injectedAt: input.injectedAt ?? new Date().toISOString(),
     hookEventId: input.hookEventId ?? null,
     trigger: input.trigger,
+    outcome: null,
     rawContentStored: false
   };
   const path = resolveContextInjectionReceiptPath({
@@ -11336,6 +11819,42 @@ async function writeContextInjectionReceipt(input) {
   await writeJson3(path, receipt, { overwrite: true });
   return { path, receipt };
 }
+async function recordContextInjectionOutcome(input) {
+  const stateDir = resolveEvoDevPaths(input.homeDir).stateDir;
+  const directory = join13(stateDir, "context-injections", sanitizeReceiptPathSegment(input.sessionKey));
+  let names;
+  try {
+    names = await readdir8(directory);
+  } catch {
+    return [];
+  }
+  const paths2 = [];
+  for (const name of names.filter((item) => item.endsWith(".json")).sort()) {
+    const path = join13(directory, name);
+    let receipt;
+    try {
+      receipt = JSON.parse(await readFile11(path, "utf8"));
+    } catch {
+      continue;
+    }
+    if (receipt.version !== 1 || receipt.rawContentStored !== false || receipt.outcome !== null && receipt.outcome !== undefined) {
+      continue;
+    }
+    const updated = {
+      ...receipt,
+      outcome: {
+        status: "verified",
+        eventId: sanitizeReceiptPathSegment(input.eventId),
+        observedAt: normalizeTimestamp(input.observedAt),
+        summaryHash: sha256Short2(input.summary),
+        rawContentStored: false
+      }
+    };
+    await writeJson3(path, updated, { overwrite: true });
+    paths2.push(path);
+  }
+  return paths2;
+}
 async function markOkfKnowledgeConceptStale(input) {
   const target = await readMutableOkfConcept(input.homeDir, input.conceptId);
   const lifecycle = {
@@ -11432,7 +11951,7 @@ async function readMutableOkfConcept(homeDir, conceptId) {
   for (const file of files) {
     if (RESERVED_OKF_FILENAMES.has(file.name))
       continue;
-    const content = await readFile10(file.path, "utf8");
+    const content = await readFile11(file.path, "utf8");
     const concept = parseOkfConceptFile(paths2.okfDir, file.path, content);
     if (concept === null)
       continue;
@@ -11544,7 +12063,7 @@ async function lintOkfKnowledge(input) {
   const knownConceptIds = new Set(files.filter((file) => !RESERVED_OKF_FILENAMES.has(file.name)).map((file) => toOkfRelativePath(paths2.okfDir, file.path).replace(/\.md$/, "")));
   for (const file of files) {
     const rel = displayOkfPath(paths2.okfDir, file.path);
-    const content = await readFile10(file.path, "utf8");
+    const content = await readFile11(file.path, "utf8");
     if (file.name === "index.md") {
       if (file.path !== join13(paths2.okfDir, "index.md") && hasFrontmatter(content)) {
         errors2.push(`Non-root index.md must not have frontmatter: ${rel}`);
@@ -11890,6 +12409,9 @@ function explainAutomaticNoWriteDecision(candidate, scores, hasVerification, has
     reasons.push("target is not user-local OKF");
   if (candidate.basis !== "direct")
     reasons.push("basis is inferred");
+  if (!isDirectKnowledgeSupport(candidate.supportRef)) {
+    reasons.push("structured direct support is missing");
+  }
   if (!candidate.metadataOnlyEvidence)
     reasons.push("evidence is not metadata-only");
   if (!hasVerification)
@@ -12033,7 +12555,7 @@ async function ensureOverlayConcept(input) {
   const exists = await pathExists3(input.overlayPath);
   const linkLine = `- [${input.candidate.title}](${input.link}) - ${input.candidate.description}`;
   if (exists) {
-    const current = await readFile10(input.overlayPath, "utf8");
+    const current = await readFile11(input.overlayPath, "utf8");
     if (current.includes(input.link))
       return;
     await writeFile7(input.overlayPath, `${current.trimEnd()}
@@ -12140,6 +12662,7 @@ function renderOkfConcept(candidate, plan, existing) {
     `  stableKey: ${yamlString(candidate.stableKey)}`,
     `  reviewState: ${yamlString(reviewState)}`,
     renderLifecycleYaml("  ", lifecycle),
+    renderKnowledgeSupportRefYaml("  ", candidate.supportRef ?? null),
     renderVerificationSnapshotYaml("  ", verificationSnapshot),
     "  source:",
     `    kind: ${yamlString("trace-distillation")}`,
@@ -12257,7 +12780,7 @@ async function regenerateOkfDirectoryIndexes(okfDir) {
         continue;
       }
       const filePath = join13(directory, entry.name);
-      const concept = parseOkfConceptFile(okfDir, filePath, await readFile10(filePath, "utf8"));
+      const concept = parseOkfConceptFile(okfDir, filePath, await readFile11(filePath, "utf8"));
       if (concept !== null && !isActiveOkfConcept(concept))
         continue;
       const title = concept?.title ?? titleFromSlug(entry.name.replace(/\.md$/, ""));
@@ -12313,7 +12836,7 @@ async function appendOkfLog(okfDir, entry) {
 async function prependLogEntry(logPath, entry) {
   await mkdir8(dirname9(logPath), { recursive: true });
   const date = todayIsoDate();
-  const existing = await pathExists3(logPath) ? await readFile10(logPath, "utf8") : `# Directory Update Log
+  const existing = await pathExists3(logPath) ? await readFile11(logPath, "utf8") : `# Directory Update Log
 `;
   const line = `* ${entry}`;
   if (existing.includes(`## ${date}`)) {
@@ -12363,6 +12886,7 @@ function parseOkfConceptFile(okfDir, filePath, content) {
     lifecycle: lifecycleParsed.lifecycle,
     lifecyclePersisted: lifecycleParsed.persisted,
     verificationSnapshot: parseOkfVerificationSnapshot(frontmatter),
+    supportRef: parseOkfKnowledgeSupportRef(frontmatter),
     title,
     description,
     tags,
@@ -12373,6 +12897,22 @@ function parseOkfConceptFile(okfDir, filePath, content) {
     body: parsed.body
   };
 }
+function parseOkfKnowledgeSupportRef(frontmatter) {
+  const block = extractNestedYamlBlock(frontmatter, "evodev", "supportRef");
+  if (block === null)
+    return null;
+  try {
+    return normalizeKnowledgeSupportRef({
+      id: readIndentedYamlScalar(block, "id"),
+      kind: readIndentedYamlScalar(block, "kind"),
+      sourceRefId: readIndentedYamlScalar(block, "sourceRefId"),
+      subjectFingerprint: readNullableLifecycleString(readIndentedYamlScalar(block, "subjectFingerprint")),
+      observedAt: readIndentedYamlScalar(block, "observedAt")
+    }, "evodev.supportRef");
+  } catch {
+    return null;
+  }
+}
 function parseOkfVerificationSnapshot(frontmatter) {
   const block = extractNestedYamlBlock(frontmatter, "evodev", "verificationSnapshot");
   if (block === null)
@@ -12946,6 +13486,19 @@ function renderVerificationSnapshotYaml(indent, snapshot) {
   ].join(`
 `);
 }
+function renderKnowledgeSupportRefYaml(indent, supportRef) {
+  if (supportRef === null)
+    return `${indent}supportRef: null`;
+  return [
+    `${indent}supportRef:`,
+    `${indent}  id: ${yamlString(supportRef.id)}`,
+    `${indent}  kind: ${yamlString(supportRef.kind)}`,
+    `${indent}  sourceRefId: ${yamlString(supportRef.sourceRefId)}`,
+    `${indent}  subjectFingerprint: ${yamlNullableString(supportRef.subjectFingerprint)}`,
+    `${indent}  observedAt: ${yamlString(supportRef.observedAt)}`
+  ].join(`
+`);
+}
 function lifecycleStatusFromReviewState(reviewState) {
   if (reviewState === "stale")
     return "stale";
@@ -13111,7 +13664,7 @@ async function createLegacyGeneratedKnowledgeCleanupPlan(homeDir, generatedAt) {
   for (const file of await listMarkdownFiles(conceptRoot)) {
     if (RESERVED_OKF_FILENAMES.has(file.name))
       continue;
-    const content = await readFile10(file.path, "utf8");
+    const content = await readFile11(file.path, "utf8");
     if (!isLegacyGeneratedOkfConcept(file.name, content))
       continue;
     concepts.push(createLegacyCleanupArtifact({
@@ -13124,7 +13677,7 @@ async function createLegacyGeneratedKnowledgeCleanupPlan(homeDir, generatedAt) {
   }
   const evosCases = [];
   for (const file of await listJsonFiles2(evoDevPaths.evosCasesDir)) {
-    const content = await readFile10(file.path, "utf8");
+    const content = await readFile11(file.path, "utf8");
     if (!isLegacyGeneratedEvosCase(content))
       continue;
     evosCases.push(createLegacyCleanupArtifact({
@@ -13145,7 +13698,7 @@ async function createLegacyGeneratedKnowledgeCleanupPlan(homeDir, generatedAt) {
     for (const file of await listMarkdownFiles(join13(okfPaths.okfDir, root))) {
       if (RESERVED_OKF_FILENAMES.has(file.name))
         continue;
-      const content = await readFile10(file.path, "utf8");
+      const content = await readFile11(file.path, "utf8");
       const cleanedContent = removeLegacyOverlayLinks(content, conceptLinks);
       if (cleanedContent === content)
         continue;
@@ -13458,7 +14011,7 @@ function parseAgentProfile(value) {
   return { ...profile, permissions };
 }
 async function readAgentProfile(path) {
-  return parseAgentProfile(JSON.parse(await readFile11(path, "utf8")));
+  return parseAgentProfile(JSON.parse(await readFile12(path, "utf8")));
 }
 function loadAgentContextDryRun(profile) {
   const parsed = parseAgentProfile(profile);
@@ -13635,7 +14188,7 @@ function expectRelativePath(value, path) {
   return text2;
 }
 // packages/core/src/assets/scanner.ts
-import { readFile as readFile12, readdir as readdir9, stat as stat6 } from "node:fs/promises";
+import { readFile as readFile13, readdir as readdir9, stat as stat6 } from "node:fs/promises";
 import { join as join14, relative as relative5 } from "node:path";
 async function scanAssets(paths2) {
   const [skills, agents] = await Promise.all([
@@ -13692,7 +14245,7 @@ async function readScannedAsset(rootDir, manifestPath, parseManifest) {
 async function readManifestJson(manifestPath) {
   let raw;
   try {
-    raw = await readFile12(manifestPath, "utf8");
+    raw = await readFile13(manifestPath, "utf8");
   } catch (error) {
     throw new EvoDevAssetError(`Cannot read manifest (${describeFileError(error)})`, manifestPath);
   }
@@ -13751,7 +14304,7 @@ function isNodeError(error) {
   return error instanceof Error && "code" in error;
 }
 // packages/core/src/code-agent-traces/index.ts
-import { mkdir as mkdir9, readFile as readFile13, readdir as readdir10, stat as stat7, writeFile as writeFile8 } from "node:fs/promises";
+import { mkdir as mkdir9, readFile as readFile14, readdir as readdir10, stat as stat7, writeFile as writeFile8 } from "node:fs/promises";
 import { dirname as dirname10, isAbsolute as isAbsolute6, join as join15, normalize, relative as relative6 } from "node:path";
 var CODE_AGENT_TRACE_TARGETS = ["claude", "codex"];
 var CODE_AGENT_TRACE_REF_SOURCES = [
@@ -13771,7 +14324,7 @@ function resolveCodeAgentTraceRefPaths(homeDir) {
   };
 }
 function createCodeAgentTraceRef(input) {
-  const sessionKey = sanitizePersistentIdentifier2(input.sessionKey, "session");
+  const sessionKey2 = sanitizePersistentIdentifier2(input.sessionKey, "session");
   const nativeSessionId = input.nativeSessionId ?? null;
   const nativeSessionIdHash = input.nativeSessionIdHash === undefined ? hashOptionalIdentifier2(nativeSessionId) : sanitizeHashMetadata(input.nativeSessionIdHash);
   const cwdHash = input.cwdHash === undefined ? hashOptionalIdentifier2(input.cwd ?? null) : sanitizeHashMetadata(input.cwdHash);
@@ -13782,9 +14335,9 @@ function createCodeAgentTraceRef(input) {
   });
   return {
     version: 1,
-    id: `trace-ref-${input.target}-${sessionKey}`,
+    id: `trace-ref-${input.target}-${sessionKey2}`,
     target: input.target,
-    sessionKey,
+    sessionKey: sessionKey2,
     nativeSessionIdHash,
     projectKey: input.projectKey === undefined || input.projectKey === null ? null : sanitizePersistentIdentifier2(input.projectKey, "project"),
     runId: input.runId === undefined || input.runId === null ? null : sanitizePersistentIdentifier2(input.runId, "run"),
@@ -13852,7 +14405,7 @@ async function readCodeAgentTraceRef(input) {
     target: targetAndSession.target,
     sessionKey: targetAndSession.sessionKey
   });
-  const ref = sanitizeCodeAgentTraceRefForWrite(parseCodeAgentTraceRef(JSON.parse(await readFile13(path, "utf8"))));
+  const ref = sanitizeCodeAgentTraceRefForWrite(parseCodeAgentTraceRef(JSON.parse(await readFile14(path, "utf8"))));
   if (ref.id !== input.id)
     throw new Error(`Code Agent trace ref id mismatch: ${input.id}`);
   return { ref, path };
@@ -13867,7 +14420,7 @@ async function listCodeAgentTraceRefs(input) {
       if (!entry.isFile() || !entry.name.endsWith(".json"))
         continue;
       const path = join15(dir, entry.name);
-      const ref = sanitizeCodeAgentTraceRefForWrite(parseCodeAgentTraceRef(JSON.parse(await readFile13(path, "utf8"))));
+      const ref = sanitizeCodeAgentTraceRefForWrite(parseCodeAgentTraceRef(JSON.parse(await readFile14(path, "utf8"))));
       if (input.projectKey !== undefined && ref.projectKey !== input.projectKey)
         continue;
       if (input.runId !== undefined && ref.runId !== input.runId)
@@ -14228,7 +14781,7 @@ function expectNonNegativeInteger(value, path) {
   return value;
 }
 // packages/core/src/config/store.ts
-import { mkdir as mkdir10, readFile as readFile14, writeFile as writeFile9 } from "node:fs/promises";
+import { mkdir as mkdir10, readFile as readFile15, writeFile as writeFile9 } from "node:fs/promises";
 import { dirname as dirname11 } from "node:path";
 function createCoreConfigStore(homeDir) {
   const paths2 = resolveEvoDevPaths(homeDir);
@@ -14352,7 +14905,7 @@ async function ensureKnowledgeBaseFiles(paths2) {
 async function readJsonFile2(filePath, parse2) {
   let raw;
   try {
-    raw = await readFile14(filePath, "utf8");
+    raw = await readFile15(filePath, "utf8");
   } catch (error) {
     throw new EvoDevConfigError(`Cannot read config file (${describeFileError2(error)})`, filePath);
   }
@@ -14384,7 +14937,7 @@ async function readJsonFileOrDefault(filePath, parse2, fallback) {
 async function writeIndexIfMissingOrMigrate(filePath, kind, defaults) {
   let raw;
   try {
-    raw = await readFile14(filePath, "utf8");
+    raw = await readFile15(filePath, "utf8");
   } catch (error) {
     if (isNodeError2(error) && error.code === "ENOENT") {
       await writeJsonFile3(filePath, defaults);
@@ -14407,7 +14960,7 @@ async function writeIndexIfMissingOrMigrate(filePath, kind, defaults) {
 }
 async function writeTextIfMissing2(filePath, value) {
   try {
-    await readFile14(filePath, "utf8");
+    await readFile15(filePath, "utf8");
   } catch (error) {
     if (isNodeError2(error) && error.code === "ENOENT") {
       await mkdir10(dirname11(filePath), { recursive: true });
@@ -14436,7 +14989,7 @@ function isRecord10(value) {
 }
 // packages/core/src/daemon/index.ts
 import { randomBytes } from "node:crypto";
-import { mkdir as mkdir13, readFile as readFile18, readdir as readdir13, rm as rm6, stat as stat10, writeFile as writeFile11 } from "node:fs/promises";
+import { mkdir as mkdir13, readFile as readFile19, readdir as readdir13, rm as rm6, stat as stat10, writeFile as writeFile11 } from "node:fs/promises";
 import { createServer } from "node:http";
 import { dirname as dirname14, join as join20 } from "node:path";
 
@@ -14549,7 +15102,7 @@ function formatEvolutionReviewSnapshot(snapshot) {
 `);
 }
 // packages/core/src/evolution/evidence/analysis.ts
-import { readFile as readFile15, readdir as readdir11 } from "node:fs/promises";
+import { readFile as readFile16, readdir as readdir11 } from "node:fs/promises";
 import { basename as basename4, join as join16 } from "node:path";
 async function analyzeEvolutionRun(input) {
   const projectKey = resolveEvolutionProjectKey(input);
@@ -14665,7 +15218,7 @@ async function analyzeEvolutionRun(input) {
   };
 }
 async function readExecutionEvidenceEvents(input) {
-  const raw = await readFile15(input.path, "utf8");
+  const raw = await readFile16(input.path, "utf8");
   const lines = raw.split(`
 `);
   const events = [];
@@ -14735,7 +15288,7 @@ function createEvidenceEventFromExecutionEvent(input) {
   };
 }
 async function readTraceEvidenceEvents(input) {
-  const raw = await readFile15(input.path, "utf8");
+  const raw = await readFile16(input.path, "utf8");
   const lines = raw.split(`
 `);
   const events = [];
@@ -15220,7 +15773,7 @@ function createProvenance(evidenceWindow, createdAt, sourceRefs) {
 }
 // packages/core/src/evolution/processor/process.ts
 import { randomUUID as randomUUID3 } from "node:crypto";
-import { mkdir as mkdir11, open as open2, readFile as readFile16, rm as rm5, stat as stat8 } from "node:fs/promises";
+import { mkdir as mkdir11, open as open2, readFile as readFile17, rm as rm5, stat as stat8 } from "node:fs/promises";
 import { dirname as dirname12, join as join18 } from "node:path";
 var PROCESS_LOCK_STALE_MS2 = 5 * 60 * 1000;
 var PROCESS_LOCK_HEARTBEAT_MS = 30 * 1000;
@@ -15646,7 +16199,7 @@ async function assertEvolutionProcessLockOwned(lock) {
 }
 async function evolutionProcessLockIsOwned(lock) {
   try {
-    const value = JSON.parse(await readFile16(lock.path, "utf8"));
+    const value = JSON.parse(await readFile17(lock.path, "utf8"));
     return value.ownerId === lock.ownerId;
   } catch {
     return false;
@@ -15709,7 +16262,7 @@ function isTransientEvolutionError(error) {
   return /(?:timed?\s*out|timeout|rate[\s-]*limit|too many requests|\b429\b|network|econn(?:reset|refused|aborted)|eai_again|etimedout|socket|temporar|service unavailable|\b50[0234]\b|fetch failed)/u.test(message);
 }
 // packages/core/src/observability/index.ts
-import { mkdir as mkdir12, readFile as readFile17, readdir as readdir12, stat as stat9, writeFile as writeFile10 } from "node:fs/promises";
+import { mkdir as mkdir12, readFile as readFile18, readdir as readdir12, stat as stat9, writeFile as writeFile10 } from "node:fs/promises";
 import { dirname as dirname13, join as join19 } from "node:path";
 var EVENT_TYPE_TO_DIR = {
   "verification.completed": "verification",
@@ -15761,7 +16314,7 @@ async function listObservabilityEvents(homeDir, type) {
     const path = resolveObservabilityStorePaths(homeDir, eventType).eventsPath;
     if (!await pathExists5(path))
       continue;
-    const lines = (await readFile17(path, "utf8")).split(`
+    const lines = (await readFile18(path, "utf8")).split(`
 `).filter(Boolean);
     for (const line of lines) {
       const event = JSON.parse(line);
@@ -15916,7 +16469,7 @@ async function readDaemonLock(homeDir) {
   const paths2 = resolveDaemonPaths(homeDir);
   if (!await pathExists6(paths2.lockPath))
     return null;
-  const lock = JSON.parse(await readFile18(paths2.lockPath, "utf8"));
+  const lock = JSON.parse(await readFile19(paths2.lockPath, "utf8"));
   if (lock.version !== 1 || lock.component !== "evodev-daemon")
     throw new Error("Invalid daemon lock.");
   return lock;
@@ -15925,7 +16478,7 @@ async function readDaemonToken(homeDir) {
   const paths2 = resolveDaemonPaths(homeDir);
   if (!await pathExists6(paths2.tokenPath))
     return null;
-  return (await readFile18(paths2.tokenPath, "utf8")).trim();
+  return (await readFile19(paths2.tokenPath, "utf8")).trim();
 }
 async function cleanupDaemonState(homeDir, token) {
   const paths2 = resolveDaemonPaths(homeDir);
@@ -16131,7 +16684,7 @@ async function collectLearningCandidateSummaries(homeDir, warnings) {
     warnings.push("Learning candidate store not found; returning empty candidates.");
     return [];
   }
-  const lines = (await readFile18(path, "utf8")).split(`
+  const lines = (await readFile19(path, "utf8")).split(`
 `).filter(Boolean);
   return lines.map((line) => {
     const candidate = JSON.parse(line);
@@ -16438,7 +16991,7 @@ async function readDaemonEvolutionProcessError(homeDir) {
   const path = resolveDaemonEvolutionProcessErrorPath(homeDir);
   if (!await pathExists6(path))
     return null;
-  const value = JSON.parse(await readFile18(path, "utf8"));
+  const value = JSON.parse(await readFile19(path, "utf8"));
   return typeof value.summary === "string" && value.summary.length > 0 ? value.summary : null;
 }
 function describeError3(error) {
@@ -16886,7 +17439,7 @@ function assertDescendant(rootDir, candidate) {
 }
 // packages/core/src/evolution/imports/storage.ts
 import { randomUUID as randomUUID4 } from "node:crypto";
-import { chmod as chmod2, link as link2, lstat as lstat3, mkdir as mkdir14, open as open3, readFile as readFile19, rename as rename4, rm as rm7 } from "node:fs/promises";
+import { chmod as chmod2, link as link2, lstat as lstat3, mkdir as mkdir14, open as open3, readFile as readFile20, rename as rename4, rm as rm7 } from "node:fs/promises";
 import { dirname as dirname15, join as join22 } from "node:path";
 var PRIVATE_DIRECTORY_MODE = 448;
 var PRIVATE_FILE_MODE = 384;
@@ -17066,7 +17619,7 @@ async function writeTrajectoryImportManifest(paths2, manifest) {
 }
 async function readTrajectoryImportIndex(path) {
   await assertRegularStateFile(path);
-  const content = await readFile19(path, "utf8");
+  const content = await readFile20(path, "utf8");
   const lines = content.endsWith(`
 `) ? content.slice(0, -1).split(`
 `) : content.split(`
@@ -17166,7 +17719,7 @@ async function heartbeatTrajectoryImportSourceLock(lock) {
 }
 async function trajectoryImportSourceLockIsOwned(lock) {
   try {
-    const value = JSON.parse(await readFile19(lock.ownerPath, "utf8"));
+    const value = JSON.parse(await readFile20(lock.ownerPath, "utf8"));
     return value.ownerToken === lock.ownerToken;
   } catch {
     return false;
@@ -17250,7 +17803,7 @@ async function restoreQuarantinedLock(quarantinePath, targetPath) {
 }
 async function removeOwnedControlFile(path, ownerToken) {
   try {
-    const value = JSON.parse(await readFile19(path, "utf8"));
+    const value = JSON.parse(await readFile20(path, "utf8"));
     if (value.ownerToken === ownerToken)
       await rm7(path, { force: true });
   } catch {}
@@ -17277,7 +17830,7 @@ async function writePrivateImmutableFile(path, content) {
       if (!hasErrorCode(error, "EEXIST"))
         throw error;
       await assertRegularStateFile(path);
-      const existing = await readFile19(path, "utf8");
+      const existing = await readFile20(path, "utf8");
       if (existing !== content) {
         throw new Error("Trajectory import immutable state digest conflict.");
       }
@@ -17332,7 +17885,7 @@ async function createPrivateExclusiveFile(path, content) {
 async function readOptionalJson(path, parser) {
   try {
     await assertRegularStateFile(path);
-    const content = await readFile19(path, "utf8");
+    const content = await readFile20(path, "utf8");
     return parser(JSON.parse(content));
   } catch (error) {
     if (hasErrorCode(error, "ENOENT"))
@@ -17940,8 +18493,8 @@ function createHistoricalSessionEvidenceSegments(input) {
     throw new Error("Historical materialization requires a projectKey.");
   }
   const createdAt = normalizeIsoTimestamp(input.createdAt);
-  const expiresAt = addDays(createdAt, input.plan.policy.retentionDays);
-  const sessionKey = `historical-${input.plan.preview.sourceKey}`;
+  const expiresAt = addDays3(createdAt, input.plan.policy.retentionDays);
+  const sessionKey2 = `historical-${input.plan.preview.sourceKey}`;
   const target = sourceTarget(input.plan.preview.source);
   return input.plan.preparedSegments.map((prepared) => ({
     schemaVersion: 1,
@@ -17950,7 +18503,7 @@ function createHistoricalSessionEvidenceSegments(input) {
     projectKey,
     runId: null,
     roleId: input.plan.preview.scope.roleId,
-    sessionKey,
+    sessionKey: sessionKey2,
     target,
     createdAt,
     reason: "historical-import",
@@ -18348,7 +18901,7 @@ function normalizeIsoTimestamp(value) {
   }
   return new Date(value).toISOString();
 }
-function addDays(value, days) {
+function addDays3(value, days) {
   return new Date(Date.parse(value) + days * 24 * 60 * 60 * 1000).toISOString();
 }
 // packages/core/src/evolution/imports/apply.ts
@@ -18395,13 +18948,13 @@ async function applyTrajectoryImport(input) {
       plan: input.plan,
       createdAt: staged.receipt.createdAt
     });
-    const sessionKey = `historical-${input.plan.preview.sourceKey}`;
+    const sessionKey2 = `historical-${input.plan.preview.sourceKey}`;
     const sessionPaths = resolveSessionMemoryPaths({
       homeDir: input.homeDir,
       projectKey,
-      sessionKey
+      sessionKey: sessionKey2
     });
-    const expectedTriggerIds = segments.map((segment) => createStableId("segment-trigger", [projectKey, sessionKey, segment.id]));
+    const expectedTriggerIds = segments.map((segment) => createStableId("segment-trigger", [projectKey, sessionKey2, segment.id]));
     let progress = await resolveMaterializationProgress({
       path: paths2.materializationPath,
       previewId: input.plan.preview.id,
@@ -18434,7 +18987,7 @@ async function applyTrajectoryImport(input) {
         homeDir: input.homeDir,
         paths: sessionPaths,
         projectKey,
-        sessionKey,
+        sessionKey: sessionKey2,
         target: segments[0]?.target ?? "unknown",
         roleId: input.plan.preview.scope.roleId,
         policy: input.plan.policy,
@@ -18447,7 +19000,7 @@ async function applyTrajectoryImport(input) {
       const trigger = await enqueueSegmentEvolutionTrigger({
         homeDir: input.homeDir,
         projectKey,
-        sessionKey,
+        sessionKey: sessionKey2,
         runId: null,
         roleId: input.plan.preview.scope.roleId,
         segmentId: segment.id,
@@ -18472,7 +19025,7 @@ async function applyTrajectoryImport(input) {
     await verifyMaterializedSegments({
       homeDir: input.homeDir,
       projectKey,
-      sessionKey,
+      sessionKey: sessionKey2,
       segmentIds: progress.expectedSegmentIds
     });
     if (progress.completedSegmentIds.length !== progress.expectedSegmentIds.length || progress.completedTriggerIds.length !== progress.expectedTriggerIds.length) {
@@ -18545,17 +19098,17 @@ async function readCompletedApplyResult(input, manifest) {
   if (progress.completedSegmentIds.length !== progress.expectedSegmentIds.length || progress.completedTriggerIds.length !== progress.expectedTriggerIds.length) {
     throw new Error("Completed trajectory import has incomplete materialization progress.");
   }
-  const sessionKey = `historical-${manifest.sourceKey}`;
+  const sessionKey2 = `historical-${manifest.sourceKey}`;
   await verifyMaterializedSegments({
     homeDir: input.homeDir,
     projectKey,
-    sessionKey,
+    sessionKey: sessionKey2,
     segmentIds: progress.expectedSegmentIds
   });
   const triggerIds = new Set((await listSegmentEvolutionTriggers({
     homeDir: input.homeDir,
     projectKey
-  })).filter((trigger) => trigger.sessionKey === sessionKey && progress.expectedSegmentIds.includes(trigger.segmentId)).map((trigger) => trigger.id));
+  })).filter((trigger) => trigger.sessionKey === sessionKey2 && progress.expectedSegmentIds.includes(trigger.segmentId)).map((trigger) => trigger.id));
   if (progress.expectedTriggerIds.some((id) => !triggerIds.has(id))) {
     throw new Error("Completed trajectory import is missing a materialized trigger.");
   }
@@ -18931,7 +19484,7 @@ function isBaseRevisionConflict(error) {
   return typeof error === "object" && error !== null && "code" in error && error.code === "KNOWLEDGE_BASE_REVISION_CONFLICT";
 }
 // packages/core/src/evolution/review/index.ts
-import { mkdir as mkdir15, readFile as readFile20, stat as stat11, writeFile as writeFile12 } from "node:fs/promises";
+import { mkdir as mkdir15, readFile as readFile21, stat as stat11, writeFile as writeFile12 } from "node:fs/promises";
 import { dirname as dirname16, join as join23 } from "node:path";
 var LEARNING_CANDIDATE_KINDS = [
   "lesson",
@@ -19282,7 +19835,7 @@ function requiredFields(candidate) {
   ];
 }
 async function parseJsonOrJsonlFile(path, parseItem) {
-  const raw = await readFile20(path, "utf8");
+  const raw = await readFile21(path, "utf8");
   if (raw.trim() === "")
     return [];
   if (path.endsWith(".jsonl")) {
@@ -19360,7 +19913,7 @@ function isRecord11(value) {
   return typeof value === "object" && value !== null && !Array.isArray(value);
 }
 // packages/core/src/pack/index.ts
-import { readFile as readFile21, readdir as readdir14, stat as stat12 } from "node:fs/promises";
+import { readFile as readFile22, readdir as readdir14, stat as stat12 } from "node:fs/promises";
 import { isAbsolute as isAbsolute8, join as join24, relative as relative8, sep as sep2 } from "node:path";
 
 // packages/core/src/protected-zones/index.ts
@@ -19511,7 +20064,7 @@ async function validatePack(packPath) {
   let assets = [];
   let scannedPaths = [];
   try {
-    manifest = parsePackManifest(JSON.parse(await readFile21(manifestPath, "utf8")));
+    manifest = parsePackManifest(JSON.parse(await readFile22(manifestPath, "utf8")));
   } catch (error) {
     findings.push({
       severity: "error",
@@ -20042,7 +20595,7 @@ function formatError(error) {
   return error instanceof Error ? error.message : String(error);
 }
 // packages/core/src/plugins/capabilities.ts
-import { mkdir as mkdir16, readFile as readFile22, writeFile as writeFile13 } from "node:fs/promises";
+import { mkdir as mkdir16, readFile as readFile23, writeFile as writeFile13 } from "node:fs/promises";
 import { dirname as dirname17, join as join25 } from "node:path";
 async function createCodexCapabilityVerificationArtifact(input) {
   const timestamp = input.createdAt ?? new Date().toISOString();
@@ -20712,7 +21265,7 @@ function describeError4(error) {
   return error instanceof Error ? error.message : String(error);
 }
 // packages/core/src/workflow/index.ts
-import { readFile as readFile23, readdir as readdir15 } from "node:fs/promises";
+import { readFile as readFile24, readdir as readdir15 } from "node:fs/promises";
 import { join as join27 } from "node:path";
 async function scanWorkflowManifests(workflowsDir) {
   const manifests = [];
@@ -20721,7 +21274,7 @@ async function scanWorkflowManifests(workflowsDir) {
     if (!entry.isDirectory())
       continue;
     const manifestPath = join27(workflowsDir, entry.name, "WORKFLOW.json");
-    manifests.push(parseWorkflowManifest(JSON.parse(await readFile23(manifestPath, "utf8"))));
+    manifests.push(parseWorkflowManifest(JSON.parse(await readFile24(manifestPath, "utf8"))));
   }
   return manifests.sort((left, right) => left.id.localeCompare(right.id));
 }
@@ -25247,7 +25800,7 @@ var dist_default5 = createPrompt((config2, done) => {
   return `${lines}${cursorHide}`;
 });
 // packages/plugin/hooks/codex.ts
-import { mkdir as mkdir20, readFile as readFile26, readdir as readdir18, stat as stat16, writeFile as writeFile18 } from "node:fs/promises";
+import { mkdir as mkdir20, readFile as readFile27, readdir as readdir18, stat as stat16, writeFile as writeFile18 } from "node:fs/promises";
 import { dirname as dirname23 } from "node:path";
 
 // packages/plugin/hooks/command-runner.ts
@@ -25275,7 +25828,7 @@ async function runNodeCommand(command, args) {
 }
 
 // packages/plugin/hooks/hooks.ts
-import { copyFile, mkdir as mkdir18, readFile as readFile24, readdir as readdir16, stat as stat14, writeFile as writeFile16 } from "node:fs/promises";
+import { copyFile, mkdir as mkdir18, readFile as readFile25, readdir as readdir16, stat as stat14, writeFile as writeFile16 } from "node:fs/promises";
 import { dirname as dirname21, join as join30 } from "node:path";
 import { fileURLToPath as fileURLToPath3 } from "node:url";
 
@@ -25597,7 +26150,7 @@ function createClaudeHookConfig(command = CLAUDE_HOOK_RUNTIME_COMMAND) {
 }
 async function readTextIfExists(path2) {
   try {
-    return await readFile24(path2, "utf8");
+    return await readFile25(path2, "utf8");
   } catch (error) {
     if (isNotFoundError8(error))
       return null;
@@ -25822,7 +26375,7 @@ function tomlString(value) {
 }
 
 // packages/plugin/hooks/workspace-core.ts
-import { cp as cp2, mkdir as mkdir19, readFile as readFile25, readdir as readdir17, rm as rm9, stat as stat15, writeFile as writeFile17 } from "node:fs/promises";
+import { cp as cp2, mkdir as mkdir19, readFile as readFile26, readdir as readdir17, rm as rm9, stat as stat15, writeFile as writeFile17 } from "node:fs/promises";
 import { dirname as dirname22 } from "node:path";
 async function hydrateWorkspaceCoreDependency(input) {
   const warnings = [];
@@ -25889,7 +26442,7 @@ async function writeRuntimeCorePackage(input) {
       recursive: true
     });
   }
-  const sourcePackageJson = JSON.parse(await readFile25(sourcePackagePath, "utf8"));
+  const sourcePackageJson = JSON.parse(await readFile26(sourcePackagePath, "utf8"));
   const runtimePackageJson = {
     ...sourcePackageJson,
     files: ["src", "assets", "package.json"]
@@ -25943,7 +26496,7 @@ var CODEX_CAPABILITY_HOOK_EVENTS = [
 ];
 var nodeSyncFileSystem = {
   async readFile(path2) {
-    return readFile26(path2, "utf8");
+    return readFile27(path2, "utf8");
   },
   async writeFile(path2, content, options = {}) {
     await writeFile18(path2, content, {
@@ -26380,7 +26933,7 @@ function summarizeHookCommand(command) {
 }
 async function readTextFileIfExists(path2) {
   try {
-    return await readFile26(path2, "utf8");
+    return await readFile27(path2, "utf8");
   } catch (error) {
     if (isNotFoundError10(error))
       return null;
@@ -26581,7 +27134,7 @@ function describeError7(error) {
 }
 // packages/plugin/hooks/plugin.ts
 import { constants } from "node:fs";
-import { access, mkdir as mkdir21, readFile as readFile27, stat as stat17, writeFile as writeFile19 } from "node:fs/promises";
+import { access, mkdir as mkdir21, readFile as readFile28, stat as stat17, writeFile as writeFile19 } from "node:fs/promises";
 import { dirname as dirname24 } from "node:path";
 
 // packages/plugin/hooks/transform-skill.ts
@@ -26661,7 +27214,7 @@ function createClaudePlugin(options = {}) {
 }
 var nodeSyncFileSystem2 = {
   async readFile(path2) {
-    return readFile27(path2, "utf8");
+    return readFile28(path2, "utf8");
   },
   async writeFile(path2, content, options = {}) {
     await writeFile19(path2, content, {
@@ -27256,7 +27809,7 @@ function defaultSleep(ms) {
 }
 
 // packages/cli/src/version.ts
-var CLI_VERSION = "0.0.1-alpha.19";
+var CLI_VERSION = "0.0.1-alpha.20";
 
 // packages/cli/src/init.ts
 var DEFAULT_CODE_AGENT_MARKETPLACE_SOURCE = "limerickgds/evodev";
@@ -28292,29 +28845,29 @@ async function runDoctor(options = {}) {
 }
 async function runHistoricalEvidenceRetentionCheck(homeDir) {
   try {
-    const retention2 = await inspectHistoricalSessionEvidenceRetention({ homeDir });
-    if (retention2.overdue === 0) {
+    const retention2 = await inspectSessionEvidenceRetention({ homeDir });
+    if (retention2.overdue === 0 && retention2.legacyOverdue === 0) {
       return {
         id: "evodev.historical-evidence-retention",
         group: "EvoDev",
-        label: "historical evidence retention",
+        label: "session evidence retention",
         status: "pass",
-        message: `${retention2.available} raw segment(s) available; none overdue`
+        message: `${retention2.available} managed raw segment(s) available; ${retention2.legacyWithoutRetention} legacy segment(s); none overdue`
       };
     }
     return {
       id: "evodev.historical-evidence-retention",
       group: "EvoDev",
-      label: "historical evidence retention",
+      label: "session evidence retention",
       status: "warn",
-      message: `${retention2.overdue} raw segment(s) overdue (${retention2.purgeEligible} purge eligible, ${retention2.protected} protected by pending processing or review)`,
-      fix: retention2.purgeEligible > 0 ? "Run a normal write or scheduled evolution command to perform bounded local retention maintenance." : "Finish or explicitly reject/defer pending historical evidence processing and review."
+      message: `${retention2.overdue + retention2.legacyOverdue} raw segment(s) overdue (${retention2.purgeEligible} purge eligible, ${retention2.protected} protected by pending processing or review)`,
+      fix: retention2.purgeEligible > 0 ? "Preview with evodev evo retention, then apply legacy retention explicitly when ready." : "Finish or explicitly reject/defer pending Session Evidence processing and review."
     };
   } catch (error) {
     return {
       id: "evodev.historical-evidence-retention",
       group: "EvoDev",
-      label: "historical evidence retention",
+      label: "session evidence retention",
       status: "warn",
       message: describeError9(error),
       fix: "Inspect local Session Evidence and evolution trigger state."
@@ -28846,14 +29399,14 @@ function throwReviewWriteError(error) {
 // packages/cli/src/session-knowledge.ts
 import { spawn as spawn3 } from "node:child_process";
 import { createHash as createHash8 } from "node:crypto";
-import { mkdtemp, readFile as readFile29, realpath as realpath4, rm as rm10, stat as stat21, writeFile as writeFile20 } from "node:fs/promises";
+import { mkdtemp, readFile as readFile30, realpath as realpath4, rm as rm10, stat as stat21, writeFile as writeFile20 } from "node:fs/promises";
 import { tmpdir as tmpdir2 } from "node:os";
 import { dirname as dirname25, join as join32, resolve as resolve11 } from "node:path";
 
 // packages/cli/src/ui/session-evidence.ts
 import { createHash as createHash7 } from "node:crypto";
 import { createReadStream } from "node:fs";
-import { readFile as readFile28, realpath as realpath3, stat as stat20 } from "node:fs/promises";
+import { readFile as readFile29, realpath as realpath3, stat as stat20 } from "node:fs/promises";
 import { isAbsolute as isAbsolute10, relative as relative11 } from "node:path";
 import { createInterface as createInterface3 } from "node:readline";
 var MAX_TRANSCRIPT_BYTES = 32 * 1024 * 1024;
@@ -29111,7 +29664,7 @@ async function readTranscriptRecords(path2, target, pointer) {
   if (!info.isFile())
     throw new Error("Native transcript is not a regular file.");
   if (info.size <= MAX_TRANSCRIPT_BYTES) {
-    return { records: parseJsonLines(await readFile28(path2, "utf8")), truncated: false };
+    return { records: parseJsonLines(await readFile29(path2, "utf8")), truncated: false };
   }
   return {
     records: await readLargeTranscriptWindow(path2, target, pointer),
@@ -29562,7 +30115,7 @@ function createCodexSessionKnowledgeAnalyzer(input = {}) {
         prompt: redactSessionMemoryCredentialText(createAnalyzerPrompt(evidence)).value,
         timeoutMs: input.timeoutMs ?? MODEL_TIMEOUT_MS
       });
-      return parseSemanticKnowledgeAnalysis(JSON.parse(await readFile29(outputPath, "utf8")));
+      return parseSemanticKnowledgeAnalysis(JSON.parse(await readFile30(outputPath, "utf8")));
     } finally {
       await rm10(workDir, { recursive: true, force: true });
     }
@@ -29632,7 +30185,8 @@ function buildKnowledgeDistillationOutput(input, analysis3) {
     const category = categoryForKind(candidate.kind);
     const targetPath = `concepts/${category}/${slugify(candidate.title)}.md`;
     const roleTags = uniqueSlugs(candidate.roleTags.length > 0 ? candidate.roleTags : [input.segment.roleId ?? input.segment.target]);
-    const requiresHumanReview = candidate.operation === "revoke" || candidate.requiresHumanReview || candidate.basis === "inferred" || /security|privacy|release|architecture|cross[-_ ]?repo/i.test(`${candidate.kind} ${candidate.title} ${candidate.claim}`);
+    const supportRef = createCandidateSupportRef(input, candidate, sourceId);
+    const requiresHumanReview = candidate.operation === "revoke" || candidate.requiresHumanReview || candidate.basis === "inferred" || supportRef.kind === "semantic-inference" || /security|privacy|release|architecture|cross[-_ ]?repo/i.test(`${candidate.kind} ${candidate.title} ${candidate.claim}`);
     const decision = candidate.operation === "revoke" ? "revoke" : requiresHumanReview ? "needs-human" : "create";
     const reviewState = requiresHumanReview ? "needs-human" : "accepted";
     const evalId = `eval-${id}`;
@@ -29668,6 +30222,7 @@ function buildKnowledgeDistillationOutput(input, analysis3) {
       },
       decisionReason: candidate.operation === "revoke" ? "Verified evidence proposes revoking existing knowledge; human review is required." : requiresHumanReview ? "Requires human review before activation." : "Curator candidate pending local evidence, quality, privacy, scope, and duplicate gates.",
       evidenceRefs: [sourceId],
+      supportRef,
       reviewState,
       ...candidate.verification.length === 0 && candidate.verificationNotApplicableReason.trim() !== "" ? { verificationNotApplicableReason: candidate.verificationNotApplicableReason } : {},
       evalSetRefs: [evalId],
@@ -29734,6 +30289,18 @@ function buildKnowledgeDistillationOutput(input, analysis3) {
     privacyCheck
   };
 }
+function createCandidateSupportRef(input, candidate, sourceRefId) {
+  const userDerived = candidate.basis === "direct" && (input.segment.reason === "explicit-memory-intent" || input.segment.reason === "user-interruption" || input.segment.reason === "intent-refinement");
+  const verifiedOutcome = candidate.basis === "direct" && input.segment.reason === "verification-after-fix" && input.segment.normalized.verifications.length > 0;
+  const kind = verifiedOutcome ? "verified-outcome" : userDerived ? "user-declaration" : "semantic-inference";
+  return {
+    id: createLocalStableId("support", [input.segment.id, sourceRefId, kind]),
+    kind,
+    sourceRefId,
+    subjectFingerprint: input.segment.rawExcerpt.sha256,
+    observedAt: input.segment.createdAt
+  };
+}
 function createNoWritePlan(input, reason) {
   return finalizeCuratedKnowledgePlan({
     homeDir: input.homeDir,
@@ -32865,8 +33432,97 @@ async function runEvoCommand(argv, options = {}) {
       write
     });
   }
+  if (subcommand === "retention") {
+    const flags = parseEvoRetentionFlags(argv.slice(1));
+    if (flags.apply) {
+      const result = await migrateLegacySessionEvidenceRetention({
+        homeDir,
+        projectKey: flags.projectKey,
+        now: resolveNow2(options)
+      });
+      write(formatRetentionMigration(result));
+      return 0;
+    }
+    const inspection = await inspectSessionEvidenceRetention({
+      homeDir,
+      projectKey: flags.projectKey,
+      now: resolveNow2(options)
+    });
+    write(formatRetentionPreview(inspection));
+    return 0;
+  }
   throw new Error(`Unknown evo command: ${subcommand ?? ""}`.trim());
 }
+function parseEvoRetentionFlags(argv) {
+  let projectKey;
+  let apply2 = false;
+  let dryRun = false;
+  let yes = false;
+  for (let index = 0;index < argv.length; index += 1) {
+    const arg = argv[index];
+    if (arg === "--project") {
+      const value = argv[index + 1];
+      if (value === undefined || value.startsWith("--")) {
+        throw new Error("Missing value for --project");
+      }
+      projectKey = value;
+      index += 1;
+      continue;
+    }
+    if (arg === "--apply") {
+      apply2 = true;
+      continue;
+    }
+    if (arg === "--dry-run") {
+      dryRun = true;
+      continue;
+    }
+    if (arg === "--yes") {
+      yes = true;
+      continue;
+    }
+    throw new Error(`Unknown evo retention option: ${arg}`);
+  }
+  if (apply2 && dryRun)
+    throw new Error("Use only one of --dry-run or --apply");
+  if (apply2 && !yes)
+    throw new Error("evo retention --apply requires --yes");
+  if (!apply2 && yes)
+    throw new Error("evo retention --yes requires --apply");
+  return { projectKey, apply: apply2 };
+}
+function formatRetentionPreview(result) {
+  return [
+    "EvoDev Session Evidence retention preview",
+    "",
+    `Managed available: ${result.available}`,
+    `Managed overdue: ${result.overdue}`,
+    `Legacy without retention: ${result.legacyWithoutRetention}`,
+    `Legacy overdue: ${result.legacyOverdue}`,
+    `Legacy raw bytes: ${result.legacyRawBytes}`,
+    `Legacy overdue raw bytes: ${result.legacyOverdueRawBytes}`,
+    `Expired captured event payloads: ${result.expiredCapturedEventPayloads}`,
+    `Expired captured event raw bytes: ${result.expiredCapturedEventRawBytes}`,
+    `Purge eligible: ${result.purgeEligible}`,
+    `Protected: ${result.protected}`,
+    "No files changed.",
+    "Apply with: evodev evo retention --apply --yes"
+  ].join(`
+`);
+}
+function formatRetentionMigration(result) {
+  return [
+    "EvoDev Session Evidence retention migration completed",
+    "",
+    `Eligible legacy segments migrated: ${result.migrated}`,
+    `Captured event payloads expired: ${result.expiredCapturedEventPayloads}`,
+    `Captured event raw bytes removed: ${result.expiredCapturedEventRawBytes}`,
+    `Due segments scanned: ${result.purge.due}`,
+    `Raw segments purged: ${result.purge.purged}`,
+    `Protected: ${result.purge.protected.length}`
+  ].join(`
+`);
+}
 async function runEvoReviewDecision(argv, input) {
   const flags = parseEvoReviewDecisionFlags(argv);
   if (!flags.yes && !flags.dryRun) {
@@ -33300,7 +33956,7 @@ function resolveNow2(options) {
 }
 
 // packages/cli/src/hook.ts
-import { readFile as readFile30, stat as stat22 } from "node:fs/promises";
+import { readFile as readFile31, stat as stat22 } from "node:fs/promises";
 var MAX_HOOK_FIXTURE_BYTES = 64 * 1024;
 async function runHookCommand(argv, options = {}) {
   const subcommand = argv[0];
@@ -33337,7 +33993,7 @@ async function runHookCommand(argv, options = {}) {
     if (payloadStat.size > MAX_HOOK_FIXTURE_BYTES) {
       throw new Error(`Hook fixture payload exceeds ${MAX_HOOK_FIXTURE_BYTES} byte limit.`);
     }
-    const payload = JSON.parse(await readFile30(flags.from, "utf8"));
+    const payload = JSON.parse(await readFile31(flags.from, "utf8"));
     const event = flags.target === "codex" ? normalizeCodexHookPayload({ type: flags.type, payload, receivedAt: "dry-run" }) : normalizeClaudeHookPayload({ type: flags.type, payload, receivedAt: "dry-run" });
     write(formatHookEventDryRun(event));
     return event.decision.action === "warn" ? 1 : 0;
@@ -33530,7 +34186,7 @@ async function readHookSettings(homeDir) {
 }
 async function appendExecutionEventSafely(input) {
   try {
-    const sessionKey = input.payload === null ? "session-local" : resolveTraceSessionKey(input.payload);
+    const sessionKey2 = input.payload === null ? "session-local" : resolveTraceSessionKey(input.payload);
     const team2 = resolveTraceTeamContext({
       homeDir: input.homeDir,
       environment: input.environment,
@@ -33541,7 +34197,7 @@ async function appendExecutionEventSafely(input) {
       eventId: input.event?.eventId,
       target: input.target,
       eventType: input.event?.type ?? runtimePhaseEventType(input.phase),
-      sessionKey,
+      sessionKey: sessionKey2,
       projectKey: team2?.projectKey ?? null,
       runId: team2?.runId ?? null,
       roleId: team2?.roleId ?? null,
@@ -34101,7 +34757,7 @@ function formatKnowledgeLifecycleMutationResult(result) {
 }
 
 // packages/cli/src/lazy-evolution.ts
-import { mkdir as mkdir22, readFile as readFile31, writeFile as writeFile21 } from "node:fs/promises";
+import { mkdir as mkdir22, readFile as readFile32, writeFile as writeFile21 } from "node:fs/promises";
 import { dirname as dirname26, join as join33 } from "node:path";
 var DEFAULT_LAZY_EVOLUTION_LIMIT = 3;
 var DEFAULT_LAZY_EVOLUTION_INTERVAL_MS = 5 * 60 * 1000;
@@ -34233,7 +34889,7 @@ function resolveNow3(options) {
 }
 async function readLazyEvolutionState(path2) {
   try {
-    return parseLazyEvolutionState(JSON.parse(await readFile31(path2, "utf8")));
+    return parseLazyEvolutionState(JSON.parse(await readFile32(path2, "utf8")));
   } catch (error) {
     if (isMissingFileError(error))
       return null;
@@ -34418,7 +35074,7 @@ function resolveHomeDir8(homeDir) {
 var DEFAULT_POST_COMMAND_RETENTION_LIMIT = 3;
 async function runPostCommandMaintenance(input) {
   return {
-    historicalEvidence: await purgeExpiredHistoricalSessionEvidence({
+    sessionEvidence: await purgeExpiredSessionEvidence({
       homeDir: resolveHomeDir9(input.homeDir),
       now: input.now?.(),
       limit: input.retentionLimit ?? DEFAULT_POST_COMMAND_RETENTION_LIMIT
@@ -34684,7 +35340,7 @@ function resolveHomeDir11(homeDir) {
 
 // packages/cli/src/daily-schedule.ts
 import { randomUUID as randomUUID6 } from "node:crypto";
-import { mkdir as mkdir23, readFile as readFile32, rename as rename6, rm as rm11, writeFile as writeFile22 } from "node:fs/promises";
+import { mkdir as mkdir23, readFile as readFile33, rename as rename6, rm as rm11, writeFile as writeFile22 } from "node:fs/promises";
 import { dirname as dirname27, join as join34 } from "node:path";
 async function prepareDailyEvolutionSchedule(input) {
   const now = asDate(input.now);
@@ -34750,7 +35406,7 @@ async function readDailyEvolutionScheduleStatus(input) {
 }
 async function readDailyEvolutionScheduleState(homeDir) {
   try {
-    const value = JSON.parse(await readFile32(resolveDailyScheduleStatePath(homeDir), "utf8"));
+    const value = JSON.parse(await readFile33(resolveDailyScheduleStatePath(homeDir), "utf8"));
     if (value.schemaVersion !== 1 || value.kind !== "daily-evolution-schedule-state" || typeof value.configuredTime !== "string" || typeof value.configuredAt !== "string" || typeof value.notBefore !== "string" || !isIsoTimestamp(value.configuredAt) || !isIsoTimestamp(value.notBefore) || !isNullableLocalDay(value.lastRunDay) || !isNullableTimestamp(value.lastRunAt) || !isNullableString(value.lastJobId) || !isEvolutionJobStatus(value.lastJobStatus)) {
       return null;
     }
@@ -34844,12 +35500,12 @@ async function writeState(homeDir, state) {
 
 // packages/cli/src/evolution-job.ts
 import { randomUUID as randomUUID8 } from "node:crypto";
-import { mkdir as mkdir26, readFile as readFile36, readdir as readdir21, rename as rename8, rm as rm15, stat as stat26, utimes, writeFile as writeFile26 } from "node:fs/promises";
+import { mkdir as mkdir26, readFile as readFile37, readdir as readdir21, rename as rename8, rm as rm15, stat as stat26, utimes, writeFile as writeFile26 } from "node:fs/promises";
 import { dirname as dirname30, join as join38 } from "node:path";
 
 // packages/cli/src/improvement-eval.ts
 import { spawn as spawn4 } from "node:child_process";
-import { mkdtemp as mkdtemp2, readFile as readFile33, realpath as realpath5, rm as rm12, stat as stat23, writeFile as writeFile23 } from "node:fs/promises";
+import { mkdtemp as mkdtemp2, readFile as readFile34, realpath as realpath5, rm as rm12, stat as stat23, writeFile as writeFile23 } from "node:fs/promises";
 import { tmpdir as tmpdir3 } from "node:os";
 import { join as join35 } from "node:path";
 var DEFAULT_EVAL_LIMIT = 1;
@@ -35018,7 +35674,7 @@ function createCodexImprovementEvalAnalyzer(input = {}) {
         timeoutMs: input.timeoutMs ?? MODEL_TIMEOUT_MS2
       });
       return {
-        ...parseImprovementEvalReplayAnalysis(JSON.parse(await readFile33(outputPath, "utf8"))),
+        ...parseImprovementEvalReplayAnalysis(JSON.parse(await readFile34(outputPath, "utf8"))),
         metrics
       };
     } finally {
@@ -35339,7 +35995,7 @@ import {
   mkdir as mkdir25,
   mkdtemp as mkdtemp3,
   open as open6,
-  readFile as readFile35,
+  readFile as readFile36,
   readdir as readdir20,
   realpath as realpath7,
   rm as rm14,
@@ -35352,7 +36008,7 @@ import { basename as basename8, dirname as dirname29, isAbsolute as isAbsolute13
 // packages/cli/src/proposal-execution.ts
 import { spawn as spawn5 } from "node:child_process";
 import { createHash as createHash11, randomBytes as randomBytes3 } from "node:crypto";
-import { mkdir as mkdir24, readFile as readFile34, readdir as readdir19, realpath as realpath6, rename as rename7, rm as rm13, stat as stat24, writeFile as writeFile24 } from "node:fs/promises";
+import { mkdir as mkdir24, readFile as readFile35, readdir as readdir19, realpath as realpath6, rename as rename7, rm as rm13, stat as stat24, writeFile as writeFile24 } from "node:fs/promises";
 import { dirname as dirname28, isAbsolute as isAbsolute12, join as join36, relative as relative13, resolve as resolve13 } from "node:path";
 var MAX_COMMAND_OUTPUT_BYTES = 1024 * 1024;
 var MAX_DIRTY_FILES_IN_RESPONSE = 20;
@@ -35680,7 +36336,7 @@ async function listRepoProposalExecutionRecords(input) {
   const records = [];
   for (const file of files) {
     try {
-      records.push(parseExecutionRecord(JSON.parse(await readFile34(join36(dir, file), "utf8"))));
+      records.push(parseExecutionRecord(JSON.parse(await readFile35(join36(dir, file), "utf8"))));
     } catch {}
   }
   return records.sort((left2, right2) => left2.startedAt.localeCompare(right2.startedAt));
@@ -36064,7 +36720,7 @@ async function acquireExecutionLock(path2, latest) {
 }
 async function isExecutionLockOwnerAlive(path2) {
   try {
-    const value = JSON.parse(await readFile34(path2, "utf8"));
+    const value = JSON.parse(await readFile35(path2, "utf8"));
     return isRecord21(value) && typeof value.pid === "number" && isProcessAlive2(value.pid);
   } catch {
     return false;
@@ -36531,7 +37187,7 @@ function createCodexSessionProposalAnalyzer(input = {}) {
         prompt: redactSessionMemoryCredentialText(createAnalyzerPrompt2(evidence)).value,
         timeoutMs: input.timeoutMs ?? MODEL_TIMEOUT_MS3
       });
-      return parseSessionProposalAnalysis(JSON.parse(await readFile35(outputPath, "utf8")));
+      return parseSessionProposalAnalysis(JSON.parse(await readFile36(outputPath, "utf8")));
     } finally {
       await rm14(workDir, { recursive: true, force: true });
     }
@@ -36891,7 +37547,7 @@ async function releaseScanLock(lock) {
 }
 async function readScanLockOwner(path2) {
   try {
-    const value = JSON.parse(await readFile35(path2, "utf8"));
+    const value = JSON.parse(await readFile36(path2, "utf8"));
     return isRecord22(value) && typeof value.ownerId === "string" ? value.ownerId : null;
   } catch {
     return null;
@@ -36970,7 +37626,7 @@ function selectIndependentCandidateReceipts(candidates2) {
 }
 async function readReceipt(path2) {
   try {
-    const value = JSON.parse(await readFile35(path2, "utf8"));
+    const value = JSON.parse(await readFile36(path2, "utf8"));
     return isRecord22(value) && value.kind === "session-repo-proposal-receipt" ? value : null;
   } catch {
     return null;
@@ -36978,7 +37634,7 @@ async function readReceipt(path2) {
 }
 async function readDailyState(path2) {
   try {
-    const value = JSON.parse(await readFile35(path2, "utf8"));
+    const value = JSON.parse(await readFile36(path2, "utf8"));
     return isRecord22(value) && value.kind === "session-repo-proposal-daily-state" ? value : null;
   } catch {
     return null;
@@ -37428,14 +38084,14 @@ class EvolutionJobService {
       });
       await persist();
       try {
-        const retention2 = await purgeExpiredHistoricalSessionEvidence({
+        const retention2 = await purgeExpiredSessionEvidence({
           homeDir: this.#options.homeDir,
           now: this.#now(),
           limit: EVOLUTION_JOB_RETENTION_LIMIT
         });
         job = updateStage(job, "finalize", {
           status: "completed",
-          detail: `Evolution results are ready; ${retention2.purged} expired historical evidence segment(s) were purged.`,
+          detail: `Evolution results are ready; ${retention2.purged} expired evidence segment(s) were purged.`,
           counts: {
             retentionScanned: retention2.scanned,
             retentionDue: retention2.due,
@@ -37444,10 +38100,10 @@ class EvolutionJobService {
           }
         });
         if (retention2.protected.length > 0) {
-          job = addJobWarning(job, `${retention2.protected.length} overdue historical evidence segment(s) remain protected by pending processing or review.`);
+          job = addJobWarning(job, `${retention2.protected.length} overdue evidence segment(s) remain protected by pending processing or review.`);
         }
       } catch (error) {
-        job = addJobWarning(job, `Historical evidence retention failed: ${safeError3(error)}`);
+        job = addJobWarning(job, `Session Evidence retention failed: ${safeError3(error)}`);
         job = updateStage(job, "finalize", {
           status: "completed",
           detail: "Evolution results are ready; retention maintenance reported a warning."
@@ -37649,7 +38305,7 @@ async function writeAtomicJson(path2, value) {
 }
 async function readJobFile(path2) {
   try {
-    const value = JSON.parse(await readFile36(path2, "utf8"));
+    const value = JSON.parse(await readFile37(path2, "utf8"));
     if (!isEvolutionJob(value))
       return null;
     return {
@@ -37708,7 +38364,7 @@ async function releaseEvolutionJobLock(lock) {
 }
 async function evolutionJobLockIsOwned(lock) {
   try {
-    const value = JSON.parse(await readFile36(lock.path, "utf8"));
+    const value = JSON.parse(await readFile37(lock.path, "utf8"));
     return value.jobId === lock.jobId;
   } catch {
     return false;
@@ -37752,7 +38408,7 @@ async function reconcileEvolutionJob(homeDir, job, now2) {
 async function hasLiveEvolutionJobLock(homeDir, jobId) {
   const path2 = join38(resolveEvoDevPaths(homeDir).stateDir, "evolution", ".job.lock");
   try {
-    const [value, info] = await Promise.all([readFile36(path2, "utf8"), stat26(path2)]);
+    const [value, info] = await Promise.all([readFile37(path2, "utf8"), stat26(path2)]);
     const lock = JSON.parse(value);
     return lock.jobId === jobId && Date.now() - info.mtimeMs <= EVOLUTION_JOB_LOCK_STALE_MS;
   } catch {
@@ -37777,7 +38433,7 @@ import {
   access as access2,
   chmod as chmod3,
   mkdir as mkdir27,
-  readFile as readFile37,
+  readFile as readFile38,
   realpath as realpath8,
   rename as rename9,
   rm as rm16,
@@ -37995,7 +38651,7 @@ function createStatus(state, path2, schedule = {
 }
 async function readInstalledSchedule(path2) {
   try {
-    const plist = await readFile37(path2, "utf8");
+    const plist = await readFile38(path2, "utf8");
     const hour = /<key>Hour<\/key>\s*<integer>(\d{1,2})<\/integer>/u.exec(plist)?.[1];
     const minute = /<key>Minute<\/key>\s*<integer>(\d{1,2})<\/integer>/u.exec(plist)?.[1];
     if (plist.includes("<key>StartCalendarInterval</key>") && hour !== undefined) {
@@ -39342,7 +39998,7 @@ function safeError4(error) {
 }
 
 // packages/cli/src/ui/assets.ts
-import { readFile as readFile38 } from "node:fs/promises";
+import { readFile as readFile39 } from "node:fs/promises";
 import { dirname as dirname32, join as join40 } from "node:path";
 import { fileURLToPath as fileURLToPath4 } from "node:url";
 var cachedAssets = null;
@@ -39375,15 +40031,15 @@ async function loadUiWebAssetsUncached() {
   }
   const distAssetsDir = join40(moduleDir, "ui");
   return {
-    script: await readFile38(join40(distAssetsDir, "app.js"), "utf8"),
-    styles: await readFile38(join40(distAssetsDir, "styles.css"), "utf8")
+    script: await readFile39(join40(distAssetsDir, "app.js"), "utf8"),
+    styles: await readFile39(join40(distAssetsDir, "styles.css"), "utf8")
   };
 }
 async function compileUiStyles(inputPath, options = {}) {
   const [{ default: postcss }, { default: tailwindcss }, source] = await Promise.all([
     import("postcss"),
     import("@tailwindcss/postcss"),
-    readFile38(inputPath, "utf8")
+    readFile39(inputPath, "utf8")
   ]);
   const result = await postcss([
     tailwindcss({
@@ -39396,7 +40052,7 @@ async function compileUiStyles(inputPath, options = {}) {
 }
 async function fileExists2(path2) {
   try {
-    await readFile38(path2, "utf8");
+    await readFile39(path2, "utf8");
     return true;
   } catch {
     return false;
@@ -39404,7 +40060,7 @@ async function fileExists2(path2) {
 }
 
 // packages/cli/src/ui/knowledge-detail.ts
-import { lstat as lstat5, readFile as readFile39, realpath as realpath9 } from "node:fs/promises";
+import { lstat as lstat5, readFile as readFile40, realpath as realpath9 } from "node:fs/promises";
 import { isAbsolute as isAbsolute14, relative as relative15 } from "node:path";
 class UiKnowledgeDetailError extends Error {
   code;
@@ -39429,7 +40085,7 @@ async function readUiKnowledgeConceptDetail(input) {
     homeDir: input.homeDir,
     path: concept.path
   });
-  const markdown = await readFile39(path2, "utf8");
+  const markdown = await readFile40(path2, "utf8");
   if (detectSessionMemorySensitivity(markdown).classification === "credential") {
     throw new UiKnowledgeDetailError("unsafe", "Knowledge detail is unavailable because the local file contains credential-like content.");
   }
@@ -39774,7 +40430,7 @@ function isExecFileExitError(error) {
 }
 
 // packages/cli/src/ui/runtime.ts
-import { mkdir as mkdir28, readFile as readFile40, rm as rm17, writeFile as writeFile28 } from "node:fs/promises";
+import { mkdir as mkdir28, readFile as readFile41, rm as rm17, writeFile as writeFile28 } from "node:fs/promises";
 import { join as join41 } from "node:path";
 function resolveUiRuntimePaths(homeDir) {
   const rootDir = join41(resolveEvoDevPaths(homeDir).stateDir, "ui");
@@ -39887,7 +40543,7 @@ function parseUiRuntimeToken(value) {
 }
 async function readOptionalFile(path2) {
   try {
-    return await readFile40(path2, "utf8");
+    return await readFile41(path2, "utf8");
   } catch (error) {
     if (isNodeError5(error) && error.code === "ENOENT")
       return null;
@@ -39900,7 +40556,7 @@ function isNodeError5(error) {
 
 // packages/cli/src/runtime-discovery.ts
 import { spawn as spawn10 } from "node:child_process";
-import { readFile as readFile41, stat as stat28 } from "node:fs/promises";
+import { readFile as readFile42, stat as stat28 } from "node:fs/promises";
 import { join as join42 } from "node:path";
 var MAX_CODEX_CONFIG_BYTES = 1024 * 1024;
 var MAX_CODEX_CATALOG_BYTES = 8 * 1024 * 1024;
@@ -39973,7 +40629,7 @@ async function readAllowlistedCodexDefaults(codexHome) {
     if (!metadata.isFile() || metadata.size > MAX_CODEX_CONFIG_BYTES) {
       return { model: null, reasoningEffort: null };
     }
-    const config2 = await readFile41(path2, "utf8");
+    const config2 = await readFile42(path2, "utf8");
     if (Buffer.byteLength(config2, "utf8") > MAX_CODEX_CONFIG_BYTES) {
       return { model: null, reasoningEffort: null };
     }
@@ -42279,15 +42935,15 @@ async function startUiServer(input) {
           return;
         }
         const projectKey = evidenceMatch[1];
-        const sessionKey = evidenceMatch[2];
+        const sessionKey2 = evidenceMatch[2];
         const segmentId = evidenceMatch[3];
-        if (projectKey === undefined || sessionKey === undefined || segmentId === undefined) {
+        if (projectKey === undefined || sessionKey2 === undefined || segmentId === undefined) {
           throw new UiRequestError(400, "session evidence identity is invalid");
         }
         const detail = await readUiSessionEvidenceDetail({
           homeDir: input.homeDir,
           projectKey,
-          sessionKey,
+          sessionKey: sessionKey2,
           segmentId
         });
         writeJsonResponse(response, 200, { ok: true, data: detail });
@@ -43099,6 +43755,7 @@ function getHelpText() {
     "  evo review         Start a local-only evolution review snapshot server",
     "  evo review decide  Record a concrete repo-proposal decision with --yes",
     "  evo process --once Consume queued evolution triggers",
+    "  evo retention [--dry-run|--apply --yes]  Preview or apply Session Evidence retention",
     "  evo import --source <source> --path <file> [--project <key>] (--dry-run [--json] | --apply <preview-id> --yes)  Preview or apply bounded historical evidence",
     "  schedule status    Show OS schedule, automation settings, and pending work",
     "  schedule install|uninstall  Manage the daily macOS user evolution LaunchAgent",
@@ -43110,7 +43767,7 @@ function getHelpText() {
     "  config set evolution.automation.recommendations true|false  Toggle scheduled model-backed recommendations",
     "  config set evolution.schedule.dailyTime HH:MM  Set the system-local daily trigger time",
     "  config set memory.reviewKnowledgeUpdates true|false  Review runtime-affecting knowledge updates",
-    "  config set memory.runtimeInjection true|false  Toggle verified knowledge runtime delivery",
+    "  config set memory.runtimeInjection true|false  Toggle support-backed knowledge runtime delivery",
     "  config set memory.staleReview true|false  Toggle review-due reminders",
     "  config set teamRuntime.defaultRuntime codex|claude  Set the fallback for future team roles",
     "  config set teamRuntime.defaultModel <model>|default  Set the future team model fallback",
@@ -43543,20 +44200,20 @@ async function runPostCommandMaintenanceSafely(argv, options, debug) {
     await appendDebugLogSafely(options, debug, {
       level: "info",
       category: "maintenance.retention",
-      message: "historical evidence retention maintenance completed",
+      message: "session evidence retention maintenance completed",
       argv,
       data: {
-        scanned: result.historicalEvidence.scanned,
-        due: result.historicalEvidence.due,
-        purged: result.historicalEvidence.purged,
-        protected: result.historicalEvidence.protected.length
+        scanned: result.sessionEvidence.scanned,
+        due: result.sessionEvidence.due,
+        purged: result.sessionEvidence.purged,
+        protected: result.sessionEvidence.protected.length
       }
     });
   } catch (error) {
     await appendDebugLogSafely(options, debug, {
       level: "warn",
       category: "maintenance.retention",
-      message: "historical evidence retention maintenance failed",
+      message: "session evidence retention maintenance failed",
       argv,
       data: {
         error: formatCommandError(error)