@gkorepanov/ccodex 0.4.8 → 0.4.10

package/dist/handoff/service.js

@@ -1,11 +1,33 @@
 import { DEFAULT_RENAME_PROMPT } from "../config/config.js";
-import { projectRpcToBackendThread, projectRpcToPublicThread } from "../gateway/logicalThreadProjection.js";
+import { projectItemIds, projectRpcToBackendThread, projectRpcToPublicThread, } from "../gateway/logicalThreadProjection.js";
 import { invalidParams } from "../protocol/errors.js";
 import { filterSortThreads } from "../store/threadFilter.js";
 import { v7 as uuidv7 } from "uuid";
-import { ProviderEpochs } from "./providerEpochs.js";
+import { stockSwitchThreadSource, ProviderEpochs, } from "./providerEpochs.js";
+import { LineageStore } from "./lineageStore.js";
 import { normalizedTitlePayload, rewrittenTitlePrompt, titlePrompt } from "./titleGeneration.js";
 export const HANDOFF_DAEMON_CONNECTION_ID = "ccodex-handoff-daemon";
+function testLineage(store) {
+    const mappings = store.listBackendMappings();
+    const snapshots = {
+        threads: new Map(mappings.flatMap((mapping) => {
+            const thread = store.getLogicalThread(mapping.publicThreadId)?.thread;
+            return thread ? [[mapping.publicThreadId, thread]] : [];
+        })),
+        epochs: new Map(mappings.flatMap((mapping) => {
+            const epoch = store.getEpoch(mapping.epochId);
+            return epoch ? [[mapping.epochId, epoch]] : [];
+        })),
+    };
+    const lineage = new LineageStore(store.path);
+    if (lineage.needsLegacyMigration()) {
+        const refs = lineage.legacyBackendRefs();
+        // Tests which omit an explicit LineageStore use an isolated temporary DB.
+        // Production always supplies the provider-validated store from startupMigration.
+        lineage.finalizeLegacyMigration(new Set(refs.map((ref) => `${ref.provider}:${ref.backendThreadId}`)));
+    }
+    return { lineage, snapshots };
+}
 const SUMMARY_INSTRUCTIONS = `Create a compact, portable handoff for another coding agent/provider.
 Return plain text only. Preserve: user goal, important decisions and constraints, repository/cwd, files and symbols touched,
 commands and tests run, current state, unresolved bugs, and exact next steps. Do not call tools. Do not continue the task.
@@ -26,12 +48,73 @@ function handoffInstructions(original, summary) {
     return [original?.trim(), `[Cross-provider compact handoff]\n${summary}\n[End cross-provider compact handoff]`]
         .filter(Boolean).join("\n\n");
 }
-function sandboxMode(policy) {
-    if (policy.type === "dangerFullAccess")
-        return "danger-full-access";
-    if (policy.type === "readOnly")
-        return "read-only";
-    return "workspace-write";
+function value(...candidates) {
+    return candidates.find((candidate) => candidate !== undefined && candidate !== null);
+}
+function object(value) {
+    return value && typeof value === "object" && !Array.isArray(value)
+        ? value
+        : undefined;
+}
+function sandboxPermission(value) {
+    if (value === "danger-full-access")
+        return ":danger-full-access";
+    if (value === "read-only")
+        return ":read-only";
+    if (value === "workspace-write")
+        return ":workspace";
+    const type = object(value)?.type;
+    if (type === "dangerFullAccess")
+        return ":danger-full-access";
+    if (type === "readOnly")
+        return ":read-only";
+    if (type === "workspaceWrite" || type === "externalSandbox")
+        return ":workspace";
+    return undefined;
+}
+function activePermission(value) {
+    const id = object(value)?.id;
+    return typeof id === "string" ? id : undefined;
+}
+function explicitPermissions(source, staged = {}, turn = {}) {
+    const permissions = value(typeof turn.permissions === "string" ? turn.permissions : undefined, sandboxPermission(turn.sandboxPolicy), typeof staged.permissions === "string" ? staged.permissions : undefined, sandboxPermission(staged.sandboxPolicy), typeof source.permissions === "string" ? source.permissions : undefined, activePermission(source.activePermissionProfile), sandboxPermission(source.sandboxPolicy), sandboxPermission(source.sandbox)) ?? ":workspace";
+    return {
+        approvalPolicy: value(turn.approvalPolicy, staged.approvalPolicy, source.approvalPolicy) ?? (permissions === ":danger-full-access" ? "never" : "on-request"),
+        approvalsReviewer: value(turn.approvalsReviewer, staged.approvalsReviewer, source.approvalsReviewer) ?? "user",
+        permissions,
+    };
+}
+function explicitPermissionParams(params, permissions) {
+    const { sandbox: _sandbox, sandboxPolicy: _sandboxPolicy, ...rest } = params;
+    return { ...rest, ...permissions };
+}
+function permissionSandbox(permissions, cwd, fallback) {
+    if (permissions === ":danger-full-access")
+        return { type: "dangerFullAccess" };
+    if (permissions === ":read-only")
+        return { type: "readOnly", networkAccess: false };
+    if (permissions === ":workspace") {
+        return {
+            type: "workspaceWrite",
+            writableRoots: [cwd],
+            networkAccess: false,
+            excludeTmpdirEnvVar: false,
+            excludeSlashTmp: false,
+        };
+    }
+    return fallback;
+}
+function canonicalSettings(source, staged, turn, cwd) {
+    const permissions = explicitPermissions(source, staged, turn);
+    const { threadId: _threadId, ...merged } = { ...source, ...staged };
+    const sandbox = permissionSandbox(permissions.permissions, cwd, turn.sandboxPolicy ?? staged.sandboxPolicy ?? source.sandboxPolicy ?? source.sandbox);
+    return {
+        ...merged,
+        ...permissions,
+        sandbox,
+        sandboxPolicy: sandbox,
+        activePermissionProfile: { id: permissions.permissions, extends: null },
+    };
 }
 function agentText(turn) {
     return turn.items.flatMap((item) => item.type === "agentMessage" ? [item.text] : []).join("\n").trim();
@@ -52,12 +135,15 @@ function stagedSettings(base, pending) {
     const settings = pending.settings;
     const effort = settings.effort === undefined ? base.effort : settings.effort;
     const collaborationMode = settings.collaborationMode ?? base.collaborationMode;
+    const permissions = explicitPermissions(base, settings);
+    const sandbox = permissionSandbox(permissions.permissions, settings.cwd ?? base.cwd, settings.sandboxPolicy ?? base.sandboxPolicy);
     return {
         ...base,
         ...(settings.cwd !== undefined && settings.cwd !== null ? { cwd: settings.cwd } : {}),
-        ...(settings.approvalPolicy !== undefined && settings.approvalPolicy !== null ? { approvalPolicy: settings.approvalPolicy } : {}),
-        ...(settings.approvalsReviewer !== undefined && settings.approvalsReviewer !== null ? { approvalsReviewer: settings.approvalsReviewer } : {}),
-        ...(settings.sandboxPolicy !== undefined && settings.sandboxPolicy !== null ? { sandboxPolicy: settings.sandboxPolicy } : {}),
+        approvalPolicy: permissions.approvalPolicy,
+        approvalsReviewer: permissions.approvalsReviewer,
+        sandboxPolicy: sandbox,
+        activePermissionProfile: { id: permissions.permissions, extends: null },
         model: pending.targetModel,
         modelProvider: pending.targetProvider === "claude" ? "claude" : "openai",
         serviceTier: settings.serviceTier === undefined ? base.serviceTier : settings.serviceTier,
@@ -98,7 +184,9 @@ function pageItems(turns, params) {
     const offset = params.cursor ? Number(params.cursor.slice("hyb-overlay-item:".length)) : 0;
     if (!Number.isInteger(offset) || offset < 0)
         throw invalidParams("Invalid handoff item cursor.");
-    const items = turns.flatMap((turn) => params.turnId && turn.id !== params.turnId ? [] : turn.items);
+    const items = turns.flatMap((turn) => params.turnId && turn.id !== params.turnId
+        ? []
+        : turn.items.map((item) => ({ turnId: turn.id, item })));
     const ordered = params.sortDirection === "desc" ? [...items].reverse() : items;
     const limit = Math.max(1, Math.min(params.limit ?? 50, 100));
     const data = ordered.slice(offset, offset + limit);
@@ -142,20 +230,29 @@ export class CrossProviderForks {
     stockServerRequests = new Map();
     stockServerRequestAliases = new Map();
     recentDurableProviders = new Map();
+    adminTails = new Map();
+    lineage;
+    legacyMirror;
     daemonStock;
     subscriptions;
     jobTail = Promise.resolve();
-    constructor(store, claude, renamePrompt = DEFAULT_RENAME_PROMPT) {
+    constructor(store, claude, renamePrompt = DEFAULT_RENAME_PROMPT, lineage) {
         this.store = store;
         this.claude = claude;
         this.renamePrompt = renamePrompt;
-        this.epochs = new ProviderEpochs(store);
+        const fallback = lineage ? undefined : testLineage(store);
+        const providerLineage = lineage ?? fallback.lineage;
+        this.lineage = providerLineage;
+        this.legacyMirror = lineage === undefined;
+        this.epochs = new ProviderEpochs(providerLineage, this.legacyMirror ? store : undefined, fallback?.snapshots);
     }
     pending(threadId) { return this.store.getPending(threadId); }
     logical(threadId) { return this.epochs.resolve(threadId); }
     hiddenBackendIds(provider) { return this.epochs.hiddenBackendIds(provider); }
-    sideSnapshot(params, targetThreadId) {
-        const source = this.epochs.resolve(params.threadId);
+    catalogTombstones() { return this.store.remoteCatalogTombstones(); }
+    async sideSnapshot(params, targetThreadId) {
+        const unresolved = this.epochs.resolve(params.threadId);
+        const source = unresolved && await this.hydrate(unresolved, this.daemonStock);
         if (!source)
             return undefined;
         const settings = source.epoch.settings;
@@ -191,7 +288,7 @@ export class CrossProviderForks {
     }
     projectThreadCatalog(stockThreads, claudeThreads, params = {}) {
         const physical = new Map([...stockThreads, ...claudeThreads].map((thread) => [thread.id, thread]));
-        const mappings = this.store.listBackendMappings();
+        const mappings = this.epochs.mappings();
         const hidden = new Set([
             ...mappings.map((mapping) => mapping.backendThreadId),
             ...this.store.hiddenProviderSwitchTargetIds(),
@@ -215,7 +312,7 @@ export class CrossProviderForks {
     }
     projectLoadedThreadIds(stockIds, claudeIds) {
         const loaded = new Set([...stockIds, ...claudeIds]);
-        const mappings = this.store.listBackendMappings();
+        const mappings = this.epochs.mappings();
         const hidden = new Set([
             ...mappings.map((mapping) => mapping.backendThreadId),
             ...this.store.hiddenProviderSwitchTargetIds(),
@@ -231,7 +328,7 @@ export class CrossProviderForks {
         const backendThreadId = messageThreadId({ params: message.params });
         if (!backendThreadId)
             return false;
-        const epoch = this.store.findEpochByBackend("stock", backendThreadId);
+        const epoch = this.lineage.findEpoch("stock", backendThreadId);
         if (!epoch || epoch.state !== "current" || !this.subscriptions)
             return false;
         if (message.method === "serverRequest/resolved" && message.params && typeof message.params === "object") {
@@ -264,7 +361,7 @@ export class CrossProviderForks {
     }
     ownsStockBackendMessage(message) {
         const backendThreadId = messageThreadId(message);
-        return backendThreadId !== undefined && this.store.findEpochByBackend("stock", backendThreadId) !== undefined;
+        return backendThreadId !== undefined && this.lineage.findEpoch("stock", backendThreadId) !== undefined;
     }
     async resolveStockServerRequest(requestId, result) {
         const stockRequestId = this.stockServerRequests.get(requestId);
@@ -278,11 +375,24 @@ export class CrossProviderForks {
         const publicThreadId = publicParams.threadId;
         if (typeof publicThreadId !== "string")
             throw invalidParams("Logical thread request has no threadId.");
-        const resolved = this.epochs.resolve(publicThreadId);
-        if (!resolved)
+        const unresolved = this.epochs.resolve(publicThreadId);
+        if (!unresolved)
             throw invalidParams(`Unknown logical thread '${publicThreadId}'.`);
-        const owner = { publicThreadId, backendThreadId: resolved.epoch.backendThreadId };
-        const params = projectRpcToBackendThread({ params: publicParams }, owner).params;
+        // An archived stock backend rejects read/resume, so unarchive must reach the
+        // provider before metadata hydration. The lineage mapping is sufficient to
+        // route this lifecycle operation.
+        const resolved = method === "thread/unarchive"
+            ? unresolved
+            : await this.hydrate(unresolved, this.daemonStock ?? clientStock);
+        const owner = {
+            publicThreadId,
+            backendThreadId: resolved.epoch.backendThreadId,
+            itemNamespace: resolved.epoch.id,
+        };
+        let params = projectRpcToBackendThread({ params: publicParams }, owner).params;
+        if (method === "thread/settings/update" || method === "turn/start") {
+            params = explicitPermissionParams(params, explicitPermissions(resolved.epoch.settings, publicParams, method === "turn/start" ? publicParams : {}));
+        }
         if (method === "thread/delete") {
             await this.deleteLogicalThread(publicThreadId, clientStock);
             return { provider: resolved.epoch.provider, result: {} };
@@ -299,6 +409,10 @@ export class CrossProviderForks {
         }
         if (resolved.epoch.provider === "stock") {
             const stock = this.daemonStock ?? clientStock;
+            if (method === "thread/name/set") {
+                const result = await this.withAdminLock(publicThreadId, () => stock.request(method, params));
+                return { provider: "stock", result: projectRpcToPublicThread({ result }, owner).result };
+            }
             if (method === "thread/read" || method === "thread/resume") {
                 const result = await stock.request(method, params);
                 const resume = method === "thread/resume" ? params : undefined;
@@ -312,7 +426,7 @@ export class CrossProviderForks {
                     })).thread.turns
                     : result.thread.turns;
                 const initialTurnsPage = resume?.initialTurnsPage
-                    ? pageTurns(this.epochs.visibleTurns(publicThreadId, backendTurns), {
+                    ? pageTurns(await this.visibleTurns(publicThreadId, backendTurns, stock), {
                         threadId: publicThreadId,
                         ...resume.initialTurnsPage,
                     })
@@ -321,7 +435,7 @@ export class CrossProviderForks {
                     provider: "stock",
                     result: {
                         ...result,
-                        thread: this.epochs.projectThread(publicThreadId, result.thread, includeTurns),
+                        thread: this.epochs.projectThread(publicThreadId, projectItemIds(result.thread, resolved.epoch.id), includeTurns, includeTurns ? (await this.historicalTurns(publicThreadId, stock)).map((entry) => entry.turn) : []),
                         ...(resume ? { initialTurnsPage } : {}),
                     },
                 };
@@ -331,7 +445,7 @@ export class CrossProviderForks {
                     threadId: resolved.epoch.backendThreadId,
                     includeTurns: true,
                 });
-                const turns = this.epochs.visibleTurns(publicThreadId, read.thread.turns);
+                const turns = await this.visibleTurns(publicThreadId, read.thread.turns, stock);
                 return {
                     provider: "stock",
                     result: method === "thread/turns/list"
@@ -343,9 +457,6 @@ export class CrossProviderForks {
             if (method === "thread/settings/update" || method === "turn/start") {
                 this.updateLogicalEpochFromParams(resolved, publicParams);
             }
-            if (method === "thread/name/set" && typeof publicParams.name === "string") {
-                this.patchLogicalThread(publicThreadId, { name: publicParams.name });
-            }
             return {
                 provider: "stock",
                 result: projectRpcToPublicThread({ result }, owner).result,
@@ -354,14 +465,18 @@ export class CrossProviderForks {
         const threadId = resolved.epoch.backendThreadId;
         if (method === "thread/read") {
             const includeTurns = params.includeTurns ?? false;
-            const thread = this.epochs.projectThread(publicThreadId, this.claude.readThread(threadId, includeTurns).thread, includeTurns);
+            const thread = this.epochs.projectThread(publicThreadId, projectItemIds(this.claude.readThread(threadId, includeTurns).thread, resolved.epoch.id), includeTurns, includeTurns
+                ? (await this.historicalTurns(publicThreadId, this.daemonStock ?? clientStock)).map((entry) => entry.turn)
+                : []);
             return { provider: "claude", result: { thread } };
         }
         if (method === "thread/resume") {
             const resume = params;
             const prepared = await this.claude.prepareResume(resume);
             const response = prepared.response;
-            const thread = this.epochs.projectThread(publicThreadId, response.thread, !resume.excludeTurns);
+            const thread = this.epochs.projectThread(publicThreadId, projectItemIds(response.thread, resolved.epoch.id), !resume.excludeTurns, !resume.excludeTurns
+                ? (await this.historicalTurns(publicThreadId, this.daemonStock ?? clientStock)).map((entry) => entry.turn)
+                : []);
             const backendTurns = resume.initialTurnsPage && resume.excludeTurns
                 ? this.claude.readThread(threadId, true).thread.turns
                 : response.thread.turns;
@@ -371,7 +486,7 @@ export class CrossProviderForks {
                     ...response,
                     thread,
                     ...(resume.initialTurnsPage ? {
-                        initialTurnsPage: pageTurns(this.epochs.visibleTurns(publicThreadId, backendTurns), {
+                        initialTurnsPage: pageTurns(await this.visibleTurns(publicThreadId, backendTurns, this.daemonStock ?? clientStock), {
                             threadId: publicThreadId,
                             ...resume.initialTurnsPage,
                         }),
@@ -386,14 +501,14 @@ export class CrossProviderForks {
             const read = this.claude.readThread(threadId, true).thread;
             return {
                 provider: "claude",
-                result: pageTurns(this.epochs.visibleTurns(publicThreadId, read.turns), publicParams),
+                result: pageTurns(await this.visibleTurns(publicThreadId, read.turns, this.daemonStock ?? clientStock), publicParams),
             };
         }
         if (method === "thread/items/list") {
             const read = this.claude.readThread(threadId, true).thread;
             return {
                 provider: "claude",
-                result: pageItems(this.epochs.visibleTurns(publicThreadId, read.turns), publicParams),
+                result: pageItems(await this.visibleTurns(publicThreadId, read.turns, this.daemonStock ?? clientStock), publicParams),
             };
         }
         if (method === "thread/settings/update") {
@@ -405,10 +520,15 @@ export class CrossProviderForks {
             };
         }
         if (method === "thread/name/set") {
-            const result = await this.claude.setThreadName(params);
-            if (typeof publicParams.name === "string")
-                this.patchLogicalThread(publicThreadId, { name: publicParams.name });
-            return { provider: "claude", result };
+            const buffer = this.subscriptions?.bufferLifecycle(threadId, ["thread/name/updated"]);
+            try {
+                const result = await this.withAdminLock(publicThreadId, () => this.claude.setThreadName(params));
+                return { provider: "claude", result, after: () => buffer?.flush() };
+            }
+            catch (error) {
+                buffer?.discard();
+                throw error;
+            }
         }
         if (method === "thread/metadata/update") {
             return {
@@ -417,10 +537,26 @@ export class CrossProviderForks {
             };
         }
         if (method === "thread/archive") {
-            return { provider: "claude", result: await this.claude.archiveThread(threadId) };
+            const buffer = this.subscriptions?.bufferLifecycle(threadId, ["thread/archived"]);
+            try {
+                const result = await this.claude.archiveThread(threadId);
+                return { provider: "claude", result, after: () => buffer?.flush() };
+            }
+            catch (error) {
+                buffer?.discard();
+                throw error;
+            }
         }
         if (method === "thread/unarchive") {
-            return { provider: "claude", result: await this.claude.unarchiveThread(threadId) };
+            const buffer = this.subscriptions?.bufferLifecycle(threadId, ["thread/unarchived"]);
+            try {
+                const result = await this.claude.unarchiveThread(threadId);
+                return { provider: "claude", result, after: () => buffer?.flush() };
+            }
+            catch (error) {
+                buffer?.discard();
+                throw error;
+            }
         }
         if (method === "thread/compact/start") {
             return { provider: "claude", result: await this.claude.compactThread(threadId) };
@@ -536,23 +672,25 @@ export class CrossProviderForks {
         throw invalidParams("This fork is waiting for Codex App to select a completed history boundary.");
     }
     async forkLogical(params, clientStock, connectionId) {
-        const source = this.epochs.resolve(params.threadId);
-        if (!source)
+        const unresolvedSource = this.epochs.resolve(params.threadId);
+        if (!unresolvedSource)
             throw invalidParams(`Unknown logical thread '${params.threadId}'.`);
+        const source = await this.hydrate(unresolvedSource, this.daemonStock ?? clientStock);
         if (params.model && providerForModel(this.claude, params.model) !== source.epoch.provider) {
             throw invalidParams("Fork is same-provider only. Change the model and send a message to switch provider.");
         }
         const currentTurns = await this.currentBackendTurns(source, this.daemonStock ?? clientStock);
-        const visible = this.epochs.snapshotTurns(params.threadId, currentTurns);
+        const visible = await this.snapshotTurns(params.threadId, currentTurns, this.daemonStock ?? clientStock);
         const boundaryIndex = visible.findLastIndex((turn) => turn.turn.status === "completed" && turn.epochId && turn.providerTurnId);
         const boundary = visible[boundaryIndex];
         if (!boundary?.epochId || !boundary.providerTurnId) {
             throw invalidParams("Cannot fork before the task has a completed provider turn.");
         }
-        const selectedEpoch = this.store.getEpoch(boundary.epochId);
-        if (!selectedEpoch || !this.store.epochBelongsToLineage(params.threadId, selectedEpoch.id)) {
+        const selectedBoundary = this.lineage.getEpoch(boundary.epochId);
+        if (!selectedBoundary || !this.lineage.epochBelongsToLineage(params.threadId, selectedBoundary.epochId)) {
             throw invalidParams("Fork boundary is outside the task's provider lineage.");
         }
+        const selectedEpoch = await this.hydrateEpoch(selectedBoundary.epochId, this.daemonStock ?? clientStock);
         const targetId = uuidv7();
         let forked;
         let stockBuildOwner;
@@ -604,21 +742,13 @@ export class CrossProviderForks {
             turns: [],
         };
         try {
-            const target = this.store.createLogicalThread({
-                thread,
-                epoch: {
-                    id: uuidv7(),
-                    provider: selectedEpoch.provider,
-                    backendThreadId: forked.thread.id,
-                    model: selectedEpoch.model,
-                    settings: selectedEpoch.settings,
-                },
-            });
-            const inherited = visible.slice(0, boundaryIndex + 1).filter((turn) => turn.epochId !== selectedEpoch.id);
-            if (inherited.length > 0 && !this.store.replaceLogicalTurns(targetId, target.revision, inherited)) {
-                throw new Error("Failed to persist logical fork history.");
-            }
-            this.subscriptions?.aliasThread(forked.thread.id, targetId);
+            const sourceSegments = this.lineage.listSegments(params.threadId);
+            const selectedSegment = sourceSegments.findIndex((segment) => segment.kind === "provider" && segment.epochId === selectedEpoch.id);
+            const inheritedSegments = (selectedSegment < 0 ? sourceSegments : sourceSegments.slice(0, selectedSegment))
+                .map(({ position: _position, ...segment }) => segment);
+            this.epochs.createFork(thread, forked.thread.id, selectedEpoch.provider, selectedEpoch.model, selectedEpoch.settings, inheritedSegments);
+            const targetEpochId = this.epochs.resolve(targetId).epoch.id;
+            this.subscriptions?.aliasThread(forked.thread.id, targetId, targetEpochId);
             if (stockBuildOwner)
                 this.stockTargetBuilds.delete(stockBuildOwner);
             if (selectedEpoch.provider === "claude") {
@@ -626,13 +756,15 @@ export class CrossProviderForks {
             }
             else {
                 this.subscriptions?.emitPublic(targetId, "thread/started", {
-                    thread: this.epochs.projectThread(targetId, forked.thread, false),
+                    thread: this.epochs.projectThread(targetId, projectItemIds(forked.thread, targetEpochId), false),
                 });
             }
             const settings = selectedEpoch.settings;
             return {
                 ...forked,
-                thread: this.epochs.projectThread(targetId, forked.thread, !params.excludeTurns),
+                thread: this.epochs.projectThread(targetId, projectItemIds(forked.thread, targetEpochId), !params.excludeTurns, !params.excludeTurns
+                    ? (await this.historicalTurns(targetId, this.daemonStock ?? clientStock)).map((entry) => entry.turn)
+                    : []),
                 model: selectedEpoch.model,
                 modelProvider: selectedEpoch.provider === "claude" ? "claude" : "openai",
                 serviceTier: typeof settings.serviceTier === "string" ? settings.serviceTier : null,
@@ -641,7 +773,9 @@ export class CrossProviderForks {
         catch (error) {
             if (stockBuildOwner)
                 this.stockTargetBuilds.delete(stockBuildOwner);
-            this.store.deleteLogicalThread(targetId);
+            this.lineage.deleteTask(targetId);
+            if (this.legacyMirror)
+                this.store.deleteLogicalThread(targetId);
             if (!forked?.thread.id)
                 throw error;
             if (selectedEpoch.provider === "claude") {
@@ -655,15 +789,16 @@ export class CrossProviderForks {
     }
     async rollbackLogicalThread(params, clientStock, connectionId) {
         const selection = this.store.getForkSelection(params.threadId);
-        const target = this.epochs.resolve(params.threadId);
-        if (!target)
+        const unresolvedTarget = this.epochs.resolve(params.threadId);
+        if (!unresolvedTarget)
             throw invalidParams(`Unknown logical thread '${params.threadId}'.`);
+        const target = await this.hydrate(unresolvedTarget, this.daemonStock ?? clientStock);
         if (!Number.isInteger(params.numTurns) || params.numTurns < 0) {
             throw invalidParams("numTurns must be a non-negative integer.");
         }
         const pendingFork = selection?.status === "pending" ? selection : undefined;
         const currentTurns = await this.currentBackendTurns(target, this.daemonStock ?? clientStock);
-        const turns = this.epochs.snapshotTurns(params.threadId, currentTurns);
+        const turns = await this.snapshotTurns(params.threadId, currentTurns, this.daemonStock ?? clientStock);
         const keep = turns.length - params.numTurns;
         if (keep <= 0)
             throw invalidParams("Rollback removed every provider turn.");
@@ -672,11 +807,12 @@ export class CrossProviderForks {
         if (!boundary?.epochId || !boundary.providerTurnId) {
             throw invalidParams("Rollback has no provider-backed turn boundary.");
         }
-        const selectedEpoch = this.store.getEpoch(boundary.epochId);
+        const selectedBoundary = this.lineage.getEpoch(boundary.epochId);
         const selectedLineage = pendingFork?.sourcePublicThreadId ?? params.threadId;
-        if (!selectedEpoch || !this.store.epochBelongsToLineage(selectedLineage, selectedEpoch.id)) {
+        if (!selectedBoundary || !this.lineage.epochBelongsToLineage(selectedLineage, selectedBoundary.epochId)) {
             throw invalidParams("Rollback points outside the thread's provider lineage.");
         }
+        const selectedEpoch = await this.hydrateEpoch(selectedBoundary.epochId, this.daemonStock ?? clientStock);
         if (!pendingFork && selectedEpoch.id === target.epoch.id) {
             if (params.numTurns === 0) {
                 const backend = target.epoch.provider === "claude"
@@ -685,7 +821,7 @@ export class CrossProviderForks {
                         threadId: target.epoch.backendThreadId,
                         includeTurns: true,
                     })).thread;
-                return { thread: this.epochs.projectThread(params.threadId, backend, true) };
+                return { thread: this.epochs.projectThread(params.threadId, projectItemIds(backend, target.epoch.id), true, (await this.historicalTurns(params.threadId, this.daemonStock ?? clientStock)).map((entry) => entry.turn)) };
             }
             const rolled = target.epoch.provider === "claude"
                 ? await this.claude.rollbackThread({
@@ -696,7 +832,7 @@ export class CrossProviderForks {
                     threadId: target.epoch.backendThreadId,
                     numTurns: params.numTurns,
                 });
-            return { thread: this.epochs.projectThread(params.threadId, rolled.thread, true) };
+            return { thread: this.epochs.projectThread(params.threadId, projectItemIds(rolled.thread, target.epoch.id), true, (await this.historicalTurns(params.threadId, this.daemonStock ?? clientStock)).map((entry) => entry.turn)) };
         }
         let forked;
         let stockBuildOwner;
@@ -743,13 +879,25 @@ export class CrossProviderForks {
             name: target.logical.thread.name,
             turns: [],
         };
-        const committed = this.store.commitLogicalRollback({
+        const targetEpochId = uuidv7();
+        const sourceSegments = this.lineage.listSegments(selectedLineage);
+        const selectedSegment = sourceSegments.findIndex((segment) => segment.kind === "provider" && segment.epochId === selectedEpoch.id);
+        const retainedSegments = (selectedSegment < 0 ? sourceSegments : sourceSegments.slice(0, selectedSegment))
+            .map(({ position: _position, ...segment }) => segment);
+        const lineageCommitted = this.lineage.commitRollback(params.threadId, target.epoch.id, target.logical.revision, {
+            epochId: targetEpochId,
+            provider: selectedEpoch.provider,
+            backendThreadId: forked.thread.id,
+        }, retainedSegments);
+        if (!lineageCommitted)
+            throw new Error("Logical rollback lost its lineage CAS boundary.");
+        const committed = !this.legacyMirror || this.store.commitLogicalRollback({
             targetPublicThreadId: params.threadId,
             expectedCurrentEpochId: target.epoch.id,
             expectedThreadRevision: target.logical.revision,
             selectedEpochId: selectedEpoch.id,
             targetEpoch: {
-                id: uuidv7(),
+                id: targetEpochId,
                 provider: selectedEpoch.provider,
                 backendThreadId: forked.thread.id,
                 model: selectedEpoch.model,
@@ -770,7 +918,7 @@ export class CrossProviderForks {
             throw new Error("Logical rollback lost its atomic commit boundary.");
         }
         this.subscriptions?.suppress(target.epoch.backendThreadId);
-        this.subscriptions?.aliasThread(forked.thread.id, params.threadId);
+        this.subscriptions?.aliasThread(forked.thread.id, params.threadId, targetEpochId);
         if (stockBuildOwner)
             this.stockTargetBuilds.delete(stockBuildOwner);
         if (pendingFork) {
@@ -778,7 +926,7 @@ export class CrossProviderForks {
                 await this.claude.announceThread(forked.thread);
             else
                 this.subscriptions?.emitPublic(params.threadId, "thread/started", {
-                    thread: this.epochs.projectThread(params.threadId, forked.thread, true),
+                    thread: this.epochs.projectThread(params.threadId, projectItemIds(forked.thread, targetEpochId), true, (await this.historicalTurns(params.threadId, this.daemonStock ?? clientStock)).map((entry) => entry.turn)),
                 });
         }
         this.subscriptions?.emitPublic(params.threadId, "thread/settings/updated", {
@@ -789,10 +937,11 @@ export class CrossProviderForks {
                 modelProvider: selectedEpoch.provider === "claude" ? "claude" : "openai",
             },
         });
-        return { thread: this.epochs.projectThread(params.threadId, forked.thread, true) };
+        return { thread: this.epochs.projectThread(params.threadId, projectItemIds(forked.thread, targetEpochId), true, (await this.historicalTurns(params.threadId, this.daemonStock ?? clientStock)).map((entry) => entry.turn)) };
     }
     configureDaemonStock(stock) {
         this.daemonStock = stock;
+        void this.settlePendingStockArchives(stock);
         for (const job of this.store.recoverableJobs()) {
             const targetId = job.target?.thread && typeof job.target.thread === "object"
                 ? job.target.thread.id
@@ -808,9 +957,10 @@ export class CrossProviderForks {
     }
     configureSubscriptions(subscriptions) {
         this.subscriptions = subscriptions;
-        for (const mapping of this.store.listBackendMappings()) {
-            if (mapping.state === "current")
-                subscriptions.aliasThread(mapping.backendThreadId, mapping.publicThreadId);
+        for (const mapping of this.lineage.listMappings()) {
+            if (mapping.state === "current") {
+                subscriptions.aliasThread(mapping.backendThreadId, mapping.publicThreadId, mapping.epochId);
+            }
             else
                 subscriptions.suppress(mapping.backendThreadId);
         }
@@ -833,6 +983,7 @@ export class CrossProviderForks {
             publicThreadId: params.threadId,
             expectedEpochId: seeded.epoch.id,
             pendingRevision: pending.revision,
+            expectedThreadRevision: seeded.logical.revision,
             targetProvider: pending.targetProvider,
             targetModel: pending.targetModel,
             settings: pending.settings,
@@ -852,21 +1003,24 @@ export class CrossProviderForks {
             const workerConnectionId = this.daemonStock
                 ? `${HANDOFF_DAEMON_CONNECTION_ID}:switch:${job.id}`
                 : connectionId;
-            const { source, summary, sourceTurns, developerInstructions, targetSettings } = await this.providerSwitchMaterial(job, stock, workerConnectionId);
+            const { source, summary, sourceTurns, developerInstructions, targetSettings, permissionSettings } = await this.providerSwitchMaterial(job, stock, workerConnectionId);
             if (job.targetProvider === "claude") {
-                const started = await this.claude.startHiddenThread(this.targetThreadStart(job, source.thread, developerInstructions));
+                const started = await this.claude.startHiddenThread(this.targetThreadStart(job, source.thread, developerInstructions, permissionSettings));
                 target = { provider: "claude", threadId: started.thread.id };
                 if (!this.store.checkpointProviderSwitchTarget(job.id, {
                     backendThreadId: started.thread.id,
                     summary,
                 }))
                     throw new Error("Provider switch target lost its durable checkpoint.");
-                await this.claude.updateThreadSettings({
+                await this.claude.updateThreadSettings(explicitPermissionParams({
                     ...job.settings,
                     threadId: started.thread.id,
                     model: job.targetModel,
-                });
-                const prepared = await this.claude.prepareTurn({ ...params, threadId: started.thread.id });
+                }, permissionSettings));
+                const prepared = await this.claude.prepareTurn(explicitPermissionParams({
+                    ...params,
+                    threadId: started.thread.id,
+                }, permissionSettings));
                 await prepared.startAndWait();
                 if (!this.store.checkpointProviderSwitchTarget(job.id, {
                     backendThreadId: started.thread.id,
@@ -874,8 +1028,9 @@ export class CrossProviderForks {
                 }))
                     throw new Error("Provider switch target delivery lost its durable checkpoint.");
                 this.subscriptions?.hideUserMessages(started.thread.id, prepared.response.turn.id);
-                this.commitProviderSwitch(job, started.thread, targetSettings, sourceTurns);
+                const sealed = await this.finalizeProviderSwitch(job, started.thread, targetSettings, sourceTurns, stock);
                 committed = true;
+                await this.archiveSealedStockEpoch(sealed, stock).catch(() => undefined);
                 compacted();
                 await prepared.announce();
                 return;
@@ -884,40 +1039,50 @@ export class CrossProviderForks {
                 awaitingStart: true,
                 threadIds: new Set(),
                 messages: [],
+                expectedThreadSource: stockSwitchThreadSource(job.id, source.thread.threadSource),
             };
             this.stockTargetBuilds.set(workerConnectionId, build);
-            const started = await stock.request("thread/start", this.targetThreadStart(job, source.thread, developerInstructions));
+            const started = await stock.request("thread/start", {
+                ...this.targetThreadStart(job, source.thread, developerInstructions, permissionSettings),
+                threadSource: build.expectedThreadSource,
+            });
             target = { provider: "stock", threadId: started.thread.id };
             if (build.awaitingStart)
                 build.awaitingStart = false;
             build.threadIds.add(started.thread.id);
-            await stock.request("thread/settings/update", {
+            await stock.request("thread/settings/update", explicitPermissionParams({
                 ...job.settings,
                 threadId: started.thread.id,
                 model: job.targetModel,
-            });
+            }, permissionSettings));
             if (!this.store.checkpointProviderSwitchTarget(job.id, {
                 backendThreadId: started.thread.id,
                 summary,
             }))
                 throw new Error("Provider switch target lost its durable checkpoint.");
-            const delivered = await stock.request("turn/start", {
+            const delivered = await stock.request("turn/start", explicitPermissionParams({
                 ...params,
                 threadId: started.thread.id,
-            });
+            }, permissionSettings));
             if (!this.store.checkpointProviderSwitchTarget(job.id, {
                 backendThreadId: started.thread.id,
                 providerTurnId: delivered.turn.id,
             }))
                 throw new Error("Provider switch target delivery lost its durable checkpoint.");
             this.subscriptions?.hideUserMessages(started.thread.id, delivered.turn.id);
-            this.commitProviderSwitch(job, started.thread, targetSettings, sourceTurns);
+            const sealed = await this.finalizeProviderSwitch(job, started.thread, targetSettings, sourceTurns, stock);
             committed = true;
+            await this.archiveSealedStockEpoch(sealed, stock).catch(() => undefined);
             compacted();
             this.flushStockTargetBuild(workerConnectionId);
         }
         catch (error) {
             const failure = error instanceof Error ? error : new Error(String(error));
+            const current = this.lineage.getTask(job.publicThreadId);
+            const currentEpoch = current && this.lineage.getEpoch(current.currentEpochId);
+            if (target && currentEpoch?.backendThreadId === target.threadId
+                && currentEpoch.provider === target.provider)
+                committed = true;
             if (committed)
                 return;
             this.store.failProviderSwitch(job.id, failure.message);
@@ -939,6 +1104,21 @@ export class CrossProviderForks {
         }
     }
     async recoverProviderSwitch(job, stock) {
+        const currentTask = this.lineage.getTask(job.publicThreadId);
+        const currentEpoch = currentTask && this.lineage.getEpoch(currentTask.currentEpochId);
+        if (job.targetBackendThreadId && currentEpoch?.backendThreadId === job.targetBackendThreadId
+            && currentEpoch.provider === job.targetProvider) {
+            this.store.completeProviderSwitch(job.id);
+            const source = this.lineage.getEpoch(job.expectedEpochId);
+            if (source?.provider === "stock" && source.archivePending) {
+                await stock.request("thread/archive", { threadId: source.backendThreadId }).then(() => {
+                    this.lineage.markStockArchived(source.epochId);
+                    if (this.legacyMirror)
+                        this.store.markStockArchived(source.epochId);
+                }, () => undefined);
+            }
+            return;
+        }
         if (job.targetProvider === "claude" && job.targetBackendThreadId) {
             this.subscriptions?.suppress(job.targetBackendThreadId);
         }
@@ -951,7 +1131,8 @@ export class CrossProviderForks {
                 })).thread;
             if (target.turns.some((turn) => turn.id === job.targetProviderTurnId)) {
                 const material = await this.providerSwitchMaterial(job, stock, `${HANDOFF_DAEMON_CONNECTION_ID}:recovery:${job.id}`);
-                this.commitProviderSwitch(job, target, material.targetSettings, material.sourceTurns);
+                const sealed = await this.finalizeProviderSwitch(job, target, material.targetSettings, material.sourceTurns, stock);
+                await this.archiveSealedStockEpoch(sealed, stock).catch(() => undefined);
                 return;
             }
         }
@@ -1241,14 +1422,22 @@ export class CrossProviderForks {
             return false;
         if (message.method === "thread/started" && this.systemEphemeralThreads.get(connectionId)?.has(threadId))
             return true;
-        if (message.method === "thread/started" && this.store.findEpochByBackend("stock", threadId))
+        if (message.method === "thread/started" && this.lineage.findEpoch("stock", threadId))
             return true;
         const direct = this.stockTargetBuilds.get(connectionId);
         if (direct && message.method === "thread/started" && direct.awaitingStart
-            && (direct.expectedForkedFromId === undefined || nestedThread?.forkedFromId === direct.expectedForkedFromId)) {
+            && (direct.expectedForkedFromId === undefined || nestedThread?.forkedFromId === direct.expectedForkedFromId)
+            && (direct.expectedThreadSource === undefined || nestedThread?.threadSource === direct.expectedThreadSource)) {
             direct.awaitingStart = false;
             direct.threadIds.add(threadId);
         }
+        const tagged = message.method === "thread/started" && typeof nestedThread?.threadSource === "string"
+            ? [...this.stockTargetBuilds.values()].find((candidate) => candidate.expectedThreadSource === nestedThread.threadSource)
+            : undefined;
+        if (tagged) {
+            tagged.awaitingStart = false;
+            tagged.threadIds.add(threadId);
+        }
         const pendingFork = message.method === "thread/started"
             ? [...this.stockTargetBuilds.values()].find((candidate) => candidate.awaitingStart
                 && candidate.expectedForkedFromId !== undefined
@@ -1260,7 +1449,7 @@ export class CrossProviderForks {
         }
         const build = direct?.threadIds.has(threadId)
             ? direct
-            : pendingFork ?? [...this.stockTargetBuilds.values()].find((candidate) => candidate.threadIds.has(threadId));
+            : tagged ?? pendingFork ?? [...this.stockTargetBuilds.values()].find((candidate) => candidate.threadIds.has(threadId));
         if (!build)
             return false;
         if (!build.threadIds.has(threadId))
@@ -1365,7 +1554,10 @@ export class CrossProviderForks {
         this.store.clearPending(threadId);
         this.store.clearOverlay(threadId);
     }
-    close() { this.store.close(); }
+    close() {
+        this.lineage.close();
+        this.store.close();
+    }
     async seedProviderSwitch(threadId, stock) {
         let resolved = this.epochs.resolve(threadId);
         const pending = this.store.getPending(threadId);
@@ -1387,12 +1579,7 @@ export class CrossProviderForks {
         if (resolved.epoch.provider !== pending.sourceProvider) {
             throw new Error("Provider switch source changed before it could be staged.");
         }
-        const staged = this.store.stageProviderSwitch({
-            pending: { ...pending, expectedEpochId: resolved.epoch.id },
-            expectedEpochId: resolved.epoch.id,
-        });
-        if (!staged)
-            throw new Error("Provider switch lost its current provider epoch.");
+        this.store.setPending({ ...pending, expectedEpochId: resolved.epoch.id });
         return this.epochs.resolve(threadId);
     }
     async currentBackendTurns(resolved, stock) {
@@ -1407,39 +1594,183 @@ export class CrossProviderForks {
         });
         return read.thread.turns;
     }
+    async hydrate(resolved, stock) {
+        if (resolved.epoch.backendThreadId.startsWith("ccodex-provisional:"))
+            return resolved;
+        if (resolved.epoch.provider === "claude") {
+            if (this.legacyMirror && (typeof this.claude.readThread !== "function"
+                || typeof this.claude.currentThreadSettings !== "function"))
+                return resolved;
+            const thread = this.claude.readThread(resolved.epoch.backendThreadId, false).thread;
+            const settings = this.claude.currentThreadSettings(resolved.epoch.backendThreadId);
+            return {
+                logical: {
+                    ...resolved.logical,
+                    thread: this.epochs.projectThread(resolved.logical.publicThreadId, thread, false),
+                },
+                epoch: {
+                    ...resolved.epoch,
+                    model: settings.model,
+                    settings: settings,
+                },
+            };
+        }
+        if (!stock)
+            throw new Error("Stock provider metadata requires the daemon stock connection.");
+        const [read, resume] = await Promise.all([
+            stock.request("thread/read", {
+                threadId: resolved.epoch.backendThreadId,
+                includeTurns: false,
+            }),
+            stock.request("thread/resume", {
+                threadId: resolved.epoch.backendThreadId,
+                excludeTurns: true,
+            }),
+        ]);
+        return {
+            logical: {
+                ...resolved.logical,
+                thread: this.epochs.projectThread(resolved.logical.publicThreadId, read.thread, false),
+            },
+            epoch: {
+                ...resolved.epoch,
+                model: resume.model,
+                settings: resume,
+            },
+        };
+    }
+    async hydrateEpoch(epochId, stock) {
+        const configured = this.epochs.configuredEpoch(epochId);
+        const boundary = this.lineage.getEpoch(epochId);
+        if (!boundary)
+            throw new Error(`Unknown provider epoch '${epochId}'.`);
+        const settings = boundary.provider === "claude"
+            ? typeof this.claude.currentThreadSettings === "function"
+                ? this.claude.currentThreadSettings(boundary.backendThreadId)
+                : configured?.settings ?? {}
+            : await stock.request("thread/resume", {
+                threadId: boundary.backendThreadId,
+                excludeTurns: true,
+            });
+        return {
+            id: boundary.epochId,
+            publicThreadId: boundary.publicThreadId,
+            ordinal: boundary.ordinal,
+            provider: boundary.provider,
+            backendThreadId: boundary.backendThreadId,
+            model: typeof settings.model === "string" ? settings.model : "",
+            settings,
+            state: boundary.state,
+            createdAt: 0,
+            archivePending: boundary.archivePending,
+            deleteDone: boundary.deleteDone,
+        };
+    }
+    async historicalTurns(publicThreadId, stock) {
+        const loaded = new Map();
+        const result = [];
+        for (const segment of this.lineage.listSegments(publicThreadId)) {
+            if (segment.kind === "synthetic") {
+                result.push({
+                    publicTurnId: segment.publicTurnId,
+                    turn: projectItemIds(segment.turn, segment.publicTurnId),
+                    kind: "migrationCompact",
+                });
+                continue;
+            }
+            const epoch = this.lineage.getEpoch(segment.epochId);
+            if (!epoch)
+                throw new Error(`Provider epoch '${segment.epochId}' is missing from lineage.`);
+            let turns = loaded.get(epoch.epochId);
+            if (!turns) {
+                turns = epoch.provider === "claude"
+                    ? this.claude.readThread(epoch.backendThreadId, true).thread.turns
+                    : (await stock.request("thread/read", {
+                        threadId: epoch.backendThreadId,
+                        includeTurns: true,
+                    })).thread.turns;
+                loaded.set(epoch.epochId, turns);
+            }
+            const start = turns.findIndex((turn) => turn.id === segment.startTurnId);
+            const end = turns.findIndex((turn) => turn.id === segment.endTurnId);
+            if (start < 0 || end < start) {
+                throw new Error(`Provider transcript no longer contains lineage boundary '${segment.startTurnId}'..'${segment.endTurnId}'.`);
+            }
+            result.push(...turns.slice(start, end + 1).map((turn) => ({
+                publicTurnId: turn.id,
+                epochId: epoch.epochId,
+                providerTurnId: turn.id,
+                turn: projectItemIds(turn, epoch.epochId),
+                kind: "provider",
+            })));
+        }
+        return result;
+    }
+    async visibleTurns(publicThreadId, currentBackendTurns, stock) {
+        const currentEpochId = this.epochs.resolve(publicThreadId)?.epoch.id;
+        if (!currentEpochId)
+            throw new Error(`Unknown logical thread '${publicThreadId}'.`);
+        return [
+            ...(await this.historicalTurns(publicThreadId, stock)).map((entry) => entry.turn),
+            ...currentBackendTurns.map((turn) => projectItemIds(turn, currentEpochId)),
+        ];
+    }
+    async snapshotTurns(publicThreadId, currentBackendTurns, stock) {
+        const resolved = this.epochs.resolve(publicThreadId);
+        if (!resolved)
+            throw new Error(`Unknown logical thread '${publicThreadId}'.`);
+        return [
+            ...await this.historicalTurns(publicThreadId, stock),
+            ...currentBackendTurns.map((turn) => ({
+                publicTurnId: turn.id,
+                epochId: resolved.epoch.id,
+                providerTurnId: turn.id,
+                turn: projectItemIds(turn, resolved.epoch.id),
+                kind: "provider",
+            })),
+        ];
+    }
     patchLogicalThread(publicThreadId, patch) {
+        if (!this.legacyMirror)
+            return;
         const logical = this.store.getLogicalThread(publicThreadId);
         if (!logical || !this.store.updateLogicalThread(publicThreadId, logical.revision, { ...logical.thread, ...patch, id: publicThreadId, turns: [] }))
             throw new Error(`Logical thread '${publicThreadId}' changed while metadata was being updated.`);
     }
     updateLogicalEpochFromParams(resolved, params) {
-        const settings = { ...params };
-        delete settings.threadId;
-        delete settings.input;
-        delete settings.clientUserMessageId;
-        const model = typeof params.model === "string" ? params.model : undefined;
-        if (!this.store.updateCurrentEpoch(resolved.logical.publicThreadId, resolved.epoch.id, {
-            ...(model ? { model } : {}),
-            settings,
-        }))
-            throw new Error("Current provider epoch changed while settings were being applied.");
+        // The provider request above has already updated the native provider store.
+        // Lineage deliberately does not cache provider-owned settings.
+        void resolved;
+        void params;
     }
     async deleteLogicalThread(publicThreadId, clientStock) {
         const stock = this.daemonStock ?? clientStock;
         this.store.cancelProviderSwitches(publicThreadId, "Task deleted.");
-        const mappings = this.store.listBackendMappings()
-            .filter((mapping) => mapping.publicThreadId === publicThreadId
-            && !mapping.backendThreadId.startsWith("ccodex-provisional:"));
-        for (const mapping of mappings)
-            this.subscriptions?.suppress(mapping.backendThreadId);
-        this.store.deleteLogicalThread(publicThreadId);
-        this.subscriptions?.threadDeleted(publicThreadId);
-        await Promise.allSettled(mappings.map((mapping) => mapping.provider === "claude"
-            ? this.claude.deleteThread(mapping.backendThreadId)
-            : stock.request("thread/delete", { threadId: mapping.backendThreadId })));
-        for (const mapping of mappings) {
-            this.subscriptions?.unaliasThread(mapping.backendThreadId);
-        }
+        const epochs = this.lineage.taskEpochs(publicThreadId)
+            .filter((epoch) => !epoch.backendThreadId.startsWith("ccodex-provisional:")
+            && this.lineage.epochReferenceCount(epoch.epochId) <= 1);
+        for (const epoch of epochs)
+            this.subscriptions?.suppress(epoch.backendThreadId);
+        for (const epoch of epochs) {
+            if (epoch.deleteDone)
+                continue;
+            if (epoch.provider === "claude")
+                await this.claude.deleteThread(epoch.backendThreadId);
+            else
+                await stock.request("thread/delete", { threadId: epoch.backendThreadId });
+            this.lineage.markEpochDeleted(epoch.epochId);
+            if (this.legacyMirror)
+                this.store.markEpochDeleted(epoch.epochId);
+        }
+        this.store.addRemoteCatalogTombstone(publicThreadId);
+        if (!this.lineage.deleteTask(publicThreadId)) {
+            throw new Error(`Logical task '${publicThreadId}' disappeared during deletion.`);
+        }
+        if (this.legacyMirror)
+            this.store.deleteLogicalThread(publicThreadId);
+        for (const epoch of epochs)
+            this.subscriptions?.unaliasThread(epoch.backendThreadId);
+        this.subscriptions?.publicThreadDeleted(publicThreadId);
     }
     async providerSwitchSource(job, stock, _connectionId) {
         const resolved = this.epochs.resolve(job.publicThreadId);
@@ -1451,7 +1782,7 @@ export class CrossProviderForks {
             return {
                 thread: source.thread,
                 backendTurns: source.turns,
-                turns: this.epochs.visibleTurns(job.publicThreadId, source.turns),
+                turns: await this.visibleTurns(job.publicThreadId, source.turns, stock),
                 settings: source.settings,
             };
         }
@@ -1468,7 +1799,7 @@ export class CrossProviderForks {
         return {
             thread: read.thread,
             backendTurns: read.thread.turns,
-            turns: this.epochs.visibleTurns(job.publicThreadId, read.thread.turns),
+            turns: await this.visibleTurns(job.publicThreadId, read.thread.turns, stock),
             settings: resume,
         };
     }
@@ -1476,6 +1807,8 @@ export class CrossProviderForks {
         const source = await this.providerSwitchSource(job, stock, connectionId);
         const summary = job.summary
             ?? await this.providerSwitchSummary(job, source.turns, stock, connectionId);
+        const cwd = job.turnParams.cwd ?? job.settings.cwd ?? source.thread.cwd;
+        const permissionSettings = explicitPermissions(source.settings, job.settings, job.turnParams);
         const completedAt = Math.floor(Date.now() / 1_000);
         const compactTurn = {
             ...job.compactionTurn,
@@ -1489,22 +1822,23 @@ export class CrossProviderForks {
             source,
             summary,
             sourceTurns: [
-                ...this.epochs.snapshotTurns(job.publicThreadId, source.backendTurns),
+                ...await this.snapshotTurns(job.publicThreadId, source.backendTurns, stock),
                 { publicTurnId: compactTurn.id, turn: compactTurn, kind: "migrationCompact" },
             ],
             developerInstructions: handoffInstructions(source.developerInstructions, summary),
             targetSettings: {
-                ...source.settings,
-                ...job.settings,
+                ...canonicalSettings(source.settings, job.settings, job.turnParams, cwd),
                 model: job.targetModel,
                 modelProvider: job.targetProvider === "claude" ? "claude" : "openai",
             },
+            permissionSettings,
         };
     }
     async providerSwitchSummary(job, turns, stock, connectionId) {
-        const resolved = this.epochs.resolve(job.publicThreadId);
-        if (!resolved)
+        const unresolved = this.epochs.resolve(job.publicThreadId);
+        if (!unresolved)
             throw new Error(`Unknown logical thread '${job.publicThreadId}'.`);
+        const resolved = await this.hydrate(unresolved, stock);
         if (resolved.epoch.provider === "claude") {
             const hidden = await this.claude.forkThread({
                 threadId: resolved.epoch.backendThreadId,
@@ -1528,69 +1862,156 @@ export class CrossProviderForks {
         }
         return (await this.summarizeStock({ threadId: resolved.epoch.backendThreadId }, turns, resolved.epoch.model, stock, connectionId)).summary;
     }
-    targetThreadStart(job, source, developerInstructions) {
+    targetThreadStart(job, source, developerInstructions, permissionSettings) {
         const turn = job.turnParams;
         const settings = job.settings;
-        const sandbox = turn.sandboxPolicy ?? settings.sandboxPolicy;
         return {
             model: job.targetModel,
             modelProvider: job.targetProvider === "claude" ? "claude" : "openai",
             cwd: turn.cwd ?? settings.cwd ?? source.cwd,
             developerInstructions,
+            ...permissionSettings,
             ...(turn.serviceTier !== undefined
                 ? { serviceTier: turn.serviceTier }
                 : settings.serviceTier !== undefined ? { serviceTier: settings.serviceTier } : {}),
-            ...(turn.approvalPolicy !== undefined
-                ? { approvalPolicy: turn.approvalPolicy }
-                : settings.approvalPolicy !== undefined ? { approvalPolicy: settings.approvalPolicy } : {}),
-            ...(turn.approvalsReviewer !== undefined
-                ? { approvalsReviewer: turn.approvalsReviewer }
-                : settings.approvalsReviewer !== undefined ? { approvalsReviewer: settings.approvalsReviewer } : {}),
-            ...(turn.permissions !== undefined
-                ? { permissions: turn.permissions }
-                : settings.permissions !== undefined ? { permissions: settings.permissions } : {}),
-            ...(sandbox && turn.permissions === undefined && settings.permissions === undefined
-                ? { sandbox: sandboxMode(sandbox) }
-                : {}),
             ephemeral: false,
             threadSource: source.threadSource,
         };
     }
+    async finalizeProviderSwitch(job, target, settings, sourceTurns, stock) {
+        return this.withAdminLock(job.publicThreadId, async () => {
+            const source = this.epochs.resolve(job.publicThreadId);
+            if (!source || source.epoch.id !== job.expectedEpochId) {
+                throw new Error("Provider switch source changed before final cutover.");
+            }
+            const sourceThread = source.epoch.provider === "claude"
+                ? this.claude.readThread(source.epoch.backendThreadId, false).thread
+                : (await stock.request("thread/read", {
+                    threadId: source.epoch.backendThreadId,
+                    includeTurns: false,
+                })).thread;
+            let confirmed = target;
+            if (sourceThread.name !== null && target.name !== sourceThread.name) {
+                if (job.targetProvider === "claude") {
+                    await this.claude.setThreadName({ threadId: target.id, name: sourceThread.name });
+                }
+                else {
+                    await stock.request("thread/name/set", { threadId: target.id, name: sourceThread.name });
+                }
+                confirmed = { ...target, name: sourceThread.name };
+            }
+            return this.commitProviderSwitch(job, confirmed, settings, sourceTurns);
+        });
+    }
     commitProviderSwitch(job, target, settings, sourceTurns) {
-        const logical = this.store.getLogicalThread(job.publicThreadId);
-        if (!logical)
-            throw new Error(`Unknown logical thread '${job.publicThreadId}'.`);
-        const publicThread = {
-            ...target,
-            id: job.publicThreadId,
-            sessionId: logical.thread.sessionId,
-            forkedFromId: logical.thread.forkedFromId,
-            parentThreadId: logical.thread.parentThreadId,
-            createdAt: logical.thread.createdAt,
-            name: logical.thread.name,
-            turns: [],
+        const targetEpochId = uuidv7();
+        const sourceProviderTurns = sourceTurns.filter((turn) => turn.kind === "provider" && turn.epochId === job.expectedEpochId && turn.providerTurnId);
+        const firstSourceTurn = sourceProviderTurns[0]?.providerTurnId;
+        const lastSourceTurn = sourceProviderTurns.at(-1)?.providerTurnId;
+        if (!firstSourceTurn || !lastSourceTurn) {
+            throw new Error("Provider switch source has no provider-backed lineage boundary.");
+        }
+        const migrationCompact = sourceTurns.at(-1);
+        if (migrationCompact?.kind !== "migrationCompact"
+            || migrationCompact.publicTurnId !== job.compactionTurn.id) {
+            throw new Error("Provider switch source is missing its current migration-compaction boundary.");
+        }
+        const lineageCommitted = this.lineage.commitEpoch(job.publicThreadId, job.expectedEpochId, job.expectedThreadRevision, { startTurnId: firstSourceTurn, endTurnId: lastSourceTurn }, {
+            epochId: targetEpochId,
+            provider: job.targetProvider,
+            backendThreadId: target.id,
+        }, [{ publicTurnId: migrationCompact.publicTurnId, turn: migrationCompact.turn }]);
+        if (!lineageCommitted)
+            throw new Error("Provider switch lost its lineage CAS during commit.");
+        if (this.legacyMirror) {
+            const task = this.lineage.getTask(job.publicThreadId);
+            const identity = this.epochs.resolve(job.publicThreadId).logical.thread;
+            if (!this.store.commitProviderSwitch({
+                jobId: job.id,
+                targetEpoch: {
+                    id: targetEpochId,
+                    provider: job.targetProvider,
+                    backendThreadId: target.id,
+                    model: job.targetModel,
+                    settings,
+                },
+                sourceTurns,
+                thread: { ...target, ...identity, id: task.publicThreadId, name: target.name, turns: [] },
+            }))
+                throw new Error("Legacy provider-switch mirror failed to settle.");
+        }
+        else if (!this.store.completeProviderSwitch(job.id)) {
+            throw new Error("Provider switch committed lineage but failed to settle its operation journal.");
+        }
+        const sourceBoundary = this.lineage.getEpoch(job.expectedEpochId);
+        const source = {
+            id: sourceBoundary.epochId,
+            publicThreadId: sourceBoundary.publicThreadId,
+            ordinal: sourceBoundary.ordinal,
+            provider: sourceBoundary.provider,
+            backendThreadId: sourceBoundary.backendThreadId,
+            model: "",
+            settings: {},
+            state: sourceBoundary.state,
+            createdAt: 0,
+            archivePending: sourceBoundary.archivePending,
+            deleteDone: sourceBoundary.deleteDone,
         };
-        const committed = this.store.commitProviderSwitch({
-            jobId: job.id,
-            targetEpoch: {
-                id: uuidv7(),
-                provider: job.targetProvider,
-                backendThreadId: target.id,
-                model: job.targetModel,
-                settings,
-            },
-            sourceTurns,
-            thread: publicThread,
-        });
-        if (!committed)
-            throw new Error("Provider switch lost its atomic commit boundary.");
-        const source = this.store.getEpoch(job.expectedEpochId);
         this.subscriptions?.suppress(source.backendThreadId);
-        this.subscriptions?.revealAs(target.id, job.publicThreadId);
+        this.subscriptions?.revealAs(target.id, job.publicThreadId, targetEpochId);
+        this.subscriptions?.emitPublic(job.publicThreadId, "thread/started", {
+            thread: this.epochs.projectThread(job.publicThreadId, projectItemIds(target, targetEpochId), false),
+        });
+        this.subscriptions?.emitPublic(job.publicThreadId, "thread/name/updated", {
+            threadId: job.publicThreadId,
+            ...(target.name === null ? {} : { threadName: target.name }),
+        });
         this.subscriptions?.emitPublic(job.publicThreadId, "thread/settings/updated", {
             threadId: job.publicThreadId,
             threadSettings: settings,
         });
+        return source;
+    }
+    async archiveSealedStockEpoch(epoch, stock) {
+        if (epoch.provider !== "stock" || !epoch.archivePending)
+            return;
+        await stock.request("thread/archive", { threadId: epoch.backendThreadId });
+        this.lineage.markStockArchived(epoch.id);
+        if (this.legacyMirror)
+            this.store.markStockArchived(epoch.id);
+    }
+    async settlePendingStockArchives(stock) {
+        for (const boundary of this.lineage.pendingStockArchives()) {
+            await this.archiveSealedStockEpoch({
+                id: boundary.epochId,
+                publicThreadId: boundary.publicThreadId,
+                ordinal: boundary.ordinal,
+                provider: boundary.provider,
+                backendThreadId: boundary.backendThreadId,
+                model: "",
+                settings: {},
+                state: boundary.state,
+                createdAt: 0,
+                archivePending: boundary.archivePending,
+                deleteDone: boundary.deleteDone,
+            }, stock).catch(() => undefined);
+        }
+    }
+    async withAdminLock(threadId, action) {
+        const previous = this.adminTails.get(threadId) ?? Promise.resolve();
+        let release;
+        const gate = new Promise((resolve) => { release = resolve; });
+        const tail = previous.then(() => gate);
+        this.adminTails.set(threadId, tail);
+        await previous;
+        try {
+            return await action();
+        }
+        finally {
+            release();
+            if (this.adminTails.get(threadId) === tail)
+                this.adminTails.delete(threadId);
+        }
     }
     async summarizeStock(params, inheritedTurns, sourceModel, stock, connectionId) {
         const build = {