@inerrata-corporation/errata 2.0.14-dev.3081 → 2.0.14-dev.3125

package/consolidate-worker.mjs

@@ -16188,6 +16188,71 @@ function installHistoryCacheFloor(db) {
   });
 }
 
+// ../../packages/local-graph/src/session-evidence.ts
+function repairSessionEvidence(input, aliases = /* @__PURE__ */ new Map()) {
+  const mapping = new Map(aliases);
+  const uuid3 = "[a-f0-9]{8}(?:-[a-f0-9]{4}){3}-[a-f0-9]{12}";
+  const codex = new RegExp(`^codex:(?:rollout-.*?)?(${uuid3})$`, "i");
+  const arrays = /* @__PURE__ */ new Set(["sources", "recurrenceSources", "contributors", "inferredContributors", "citeSessions"]);
+  const scalars = /* @__PURE__ */ new Set(["discriminatorSource", "originSession", "sessionId", "sourceSession"]);
+  const discover = (value, key = "") => {
+    if (typeof value === "string" && (arrays.has(key) || scalars.has(key) || key === "citeAnchorHints")) {
+      const match = value.match(codex);
+      if (match) {
+        const canonical = `codex:${match[1].toLowerCase()}`;
+        mapping.set(value, canonical);
+        mapping.set(match[1].toLowerCase(), canonical);
+      }
+    } else if (Array.isArray(value)) value.forEach((v) => discover(v, key));
+    else if (value && typeof value === "object") {
+      for (const [k, v] of Object.entries(value)) discover(v, key === "citeAnchorHints" ? key : k);
+    }
+  };
+  discover(input);
+  const rewrite = (value, key = "") => {
+    if (typeof value === "string" && (arrays.has(key) || scalars.has(key) || key === "citeAnchorHints")) {
+      return mapping.get(value) ?? mapping.get(value.toLowerCase()) ?? value;
+    }
+    if (Array.isArray(value)) {
+      const values = value.map((v) => rewrite(v, key));
+      return arrays.has(key) || key === "citeAnchorHints" ? [...new Set(values)] : values;
+    }
+    if (!value || typeof value !== "object") return value;
+    const before = value;
+    const after = Object.fromEntries(Object.entries(before).map(([k, v]) => [k, rewrite(v, key === "citeAnchorHints" ? key : k)]));
+    for (const field of ["sources", "contributors"]) {
+      const old = before[field], next = after[field];
+      if (!Array.isArray(old) || !Array.isArray(next) || old.length <= next.length) continue;
+      after["sessionAliasRepair"] = { originalCount: old.length, distinctCount: next.length };
+      if (field === "sources" && typeof after["corroborations"] === "number") {
+        after["corroborations"] = Math.min(after["corroborations"], Math.max(0, next.length - 1));
+        if (after["corroborations"] === 0) after["provisional"] = true;
+      }
+      if (field === "contributors" && typeof after["confirmed"] === "number") {
+        after["preAliasRepairConfirmed"] = after["confirmed"];
+        after["confirmed"] = Math.min(after["confirmed"], next.length);
+      }
+    }
+    return after;
+  };
+  const repaired = rewrite(input);
+  const source = repaired["discriminatorSource"];
+  if (typeof source === "string") {
+    const global = repaired["perContext"]?.["*"];
+    const contributors = Array.isArray(global?.["contributors"]) ? global["contributors"] : [];
+    const inferred = new Set(Array.isArray(global?.["inferredContributors"]) ? global["inferredContributors"] : []);
+    if (contributors.includes(source) || contributors.filter((id) => !inferred.has(id)).length < 2) {
+      repaired["withdrawnDiscriminator"] = repaired["discriminator"];
+      repaired["discriminatorWithdrawalReason"] = "insufficient-independent-witnesses";
+      repaired["provisional"] = true;
+      delete repaired["discriminator"];
+      delete repaired["discriminatorSource"];
+      delete repaired["discriminatorAsked"];
+    }
+  }
+  return repaired;
+}
+
 // ../../packages/local-graph/src/store.ts
 var LOCAL_RULE_OVERRIDES = {
   ANCHORED_AT: {
@@ -16432,6 +16497,12 @@ var SqliteGraphStore = class {
     }
     this.db.exec(TEMPORAL_INDEX_SQL);
     installHistoryCacheFloor(this.db);
+    if (!this.db.prepare("SELECT value FROM store_meta WHERE key = 'session-evidence-v1'").get()) {
+      this.db.transaction(() => {
+        this.repairSessionAliases();
+        this.db.prepare("INSERT OR REPLACE INTO store_meta (key, value) VALUES ('session-evidence-v1', 'done')").run();
+      });
+    }
     this.stmts = {
       insertNode: this.db.prepare(`
         INSERT INTO nodes (
@@ -16680,6 +16751,23 @@ var SqliteGraphStore = class {
       this.db.prepare("UPDATE schema_version SET version = ?").run(SCHEMA_VERSION);
     });
   }
+  repairSessionAliases(canonical, aliases = []) {
+    const mapping = new Map(aliases.map((alias) => [alias, canonical]));
+    let changed = 0;
+    for (const table of ["nodes", "edges"]) {
+      const predicates = canonical ? aliases.map(() => "instr(attrs_json, ?) > 0") : ["instr(attrs_json, 'codex:') > 0", "instr(attrs_json, 'discriminatorSource') > 0"];
+      if (!predicates.length) continue;
+      const rows = this.db.prepare(`SELECT id, attrs_json FROM ${table} WHERE ${predicates.join(" OR ")}`).all(...canonical ? aliases : []);
+      const update = this.db.prepare(`UPDATE ${table} SET attrs_json = ?${table === "edges" ? ", type = CASE WHEN type = 'CONFIRMS' AND json_extract(?, '$.provisional') = 1 THEN 'INDICATES' ELSE type END" : ""} WHERE id = ?`);
+      for (const row of rows) {
+        const attrs = JSON.stringify(repairSessionEvidence(JSON.parse(row.attrs_json), mapping));
+        if (attrs === row.attrs_json) continue;
+        update.run(...table === "edges" ? [attrs, attrs, row.id] : [attrs, row.id]);
+        changed++;
+      }
+    }
+    return changed;
+  }
   deleteNode(id) {
     this.stmts.deleteNode.run(id);
   }
@@ -17761,6 +17849,7 @@ function recordTriageObservation(l2, obs, ts) {
     }
     const discriminator = obs.discriminator ?? existing?.attrs["discriminator"];
     const attrs = {
+      ...existing?.attrs,
       driftKind: obs.driftKind ?? existing?.attrs["driftKind"] ?? DRIFT_KIND.RELOCATION,
       perContext,
       // A discriminator (now or previously supplied) promotes the route to a router.

package/errata.mjs

@@ -15495,10 +15495,9 @@ function looksLikeSecretValue(raw2, quoted) {
   if (quoted) return raw2.length > 0;
   const lower = raw2.toLowerCase();
   if (ASSIGNMENT_STOPWORDS.has(lower)) return false;
-  if (!/^[A-Za-z0-9+/=_-]{8,}$/.test(raw2)) return false;
-  if (/\d/.test(raw2)) return true;
-  if (raw2.length >= 12) return true;
-  return /[a-z]/.test(raw2) && /[A-Z]/.test(raw2);
+  if (/^(?:process\.env\.|os\.environ(?:\[|\.)|(?:request|response|config|settings|options)\.)/.test(raw2)) return false;
+  if (/^[A-Za-z_$][\w$]*(?:\.[A-Za-z_$][\w$]*)*\(/.test(raw2)) return false;
+  return raw2.length > 0;
 }
 function applyRule(text, rule, removed) {
   let count = 0;
@@ -15564,7 +15563,7 @@ var HISTORY_SCRUBBER_VERSION, REDACTED_CREDENTIAL, REDACTED_EMAIL, cred, ASSIGNM
 var init_history_text = __esm({
   "../../packages/shared/src/history-text.ts"() {
     "use strict";
-    HISTORY_SCRUBBER_VERSION = "history-scrub-3";
+    HISTORY_SCRUBBER_VERSION = "history-scrub-4";
     REDACTED_CREDENTIAL = "[redacted:credential]";
     REDACTED_EMAIL = "[redacted:email]";
     cred = () => REDACTED_CREDENTIAL;
@@ -15639,9 +15638,15 @@ var init_history_text = __esm({
       },
       // Userinfo in connection URLs must be removed before the email rule runs.
       {
-        re: /\b([a-z][a-z0-9+.-]*:\/\/)([^\s/@:]+):([^\s/@]+)@/gi,
+        re: /\b([a-z][a-z0-9+.-]*:\/\/)([^\s/@:]*):([^\s/@]+)@/gi,
         replace: (m) => m[2] === "[redacted" && m[3] === "credential]" ? null : `${m[1]}${REDACTED_CREDENTIAL}@`
       },
+      // MySQL's short password option attaches the value directly to -p; other
+      // command flags (such as a port) must not be treated as passwords.
+      {
+        re: /\b((?:mysql|mariadb)(?:\s+[^\s]+)*?\s+-p)([^\s"'`,;)}\]]+)/gi,
+        replace: (m) => m[2]?.startsWith("[redacted:") ? null : `${m[1]}${REDACTED_CREDENTIAL}`
+      },
       // Seeded login prose commonly writes email/password without an assignment.
       {
         re: /(\b[A-Za-z0-9._%+-]+@[A-Za-z0-9-]+(?:\.[A-Za-z0-9-]+)+|\[redacted:email\])(\s*\/\s*)(["'\x60]?)([^\s"'\x60,;)}\]]+)/gi,
@@ -18002,6 +18007,76 @@ var init_history_cache_floor = __esm({
   }
 });
 
+// ../../packages/local-graph/src/session-evidence.ts
+function repairSessionEvidence(input, aliases = /* @__PURE__ */ new Map()) {
+  const mapping = new Map(aliases);
+  const uuid3 = "[a-f0-9]{8}(?:-[a-f0-9]{4}){3}-[a-f0-9]{12}";
+  const codex = new RegExp(`^codex:(?:rollout-.*?)?(${uuid3})$`, "i");
+  const arrays = /* @__PURE__ */ new Set(["sources", "recurrenceSources", "contributors", "inferredContributors", "citeSessions"]);
+  const scalars = /* @__PURE__ */ new Set(["discriminatorSource", "originSession", "sessionId", "sourceSession"]);
+  const discover = (value, key = "") => {
+    if (typeof value === "string" && (arrays.has(key) || scalars.has(key) || key === "citeAnchorHints")) {
+      const match2 = value.match(codex);
+      if (match2) {
+        const canonical = `codex:${match2[1].toLowerCase()}`;
+        mapping.set(value, canonical);
+        mapping.set(match2[1].toLowerCase(), canonical);
+      }
+    } else if (Array.isArray(value)) value.forEach((v) => discover(v, key));
+    else if (value && typeof value === "object") {
+      for (const [k, v] of Object.entries(value)) discover(v, key === "citeAnchorHints" ? key : k);
+    }
+  };
+  discover(input);
+  const rewrite = (value, key = "") => {
+    if (typeof value === "string" && (arrays.has(key) || scalars.has(key) || key === "citeAnchorHints")) {
+      return mapping.get(value) ?? mapping.get(value.toLowerCase()) ?? value;
+    }
+    if (Array.isArray(value)) {
+      const values = value.map((v) => rewrite(v, key));
+      return arrays.has(key) || key === "citeAnchorHints" ? [...new Set(values)] : values;
+    }
+    if (!value || typeof value !== "object") return value;
+    const before = value;
+    const after = Object.fromEntries(Object.entries(before).map(([k, v]) => [k, rewrite(v, key === "citeAnchorHints" ? key : k)]));
+    for (const field of ["sources", "contributors"]) {
+      const old = before[field], next = after[field];
+      if (!Array.isArray(old) || !Array.isArray(next) || old.length <= next.length) continue;
+      after["sessionAliasRepair"] = { originalCount: old.length, distinctCount: next.length };
+      if (field === "sources" && typeof after["corroborations"] === "number") {
+        after["corroborations"] = Math.min(after["corroborations"], Math.max(0, next.length - 1));
+        if (after["corroborations"] === 0) after["provisional"] = true;
+      }
+      if (field === "contributors" && typeof after["confirmed"] === "number") {
+        after["preAliasRepairConfirmed"] = after["confirmed"];
+        after["confirmed"] = Math.min(after["confirmed"], next.length);
+      }
+    }
+    return after;
+  };
+  const repaired = rewrite(input);
+  const source = repaired["discriminatorSource"];
+  if (typeof source === "string") {
+    const global2 = repaired["perContext"]?.["*"];
+    const contributors = Array.isArray(global2?.["contributors"]) ? global2["contributors"] : [];
+    const inferred = new Set(Array.isArray(global2?.["inferredContributors"]) ? global2["inferredContributors"] : []);
+    if (contributors.includes(source) || contributors.filter((id) => !inferred.has(id)).length < 2) {
+      repaired["withdrawnDiscriminator"] = repaired["discriminator"];
+      repaired["discriminatorWithdrawalReason"] = "insufficient-independent-witnesses";
+      repaired["provisional"] = true;
+      delete repaired["discriminator"];
+      delete repaired["discriminatorSource"];
+      delete repaired["discriminatorAsked"];
+    }
+  }
+  return repaired;
+}
+var init_session_evidence = __esm({
+  "../../packages/local-graph/src/session-evidence.ts"() {
+    "use strict";
+  }
+});
+
 // ../../packages/local-graph/src/store.ts
 function localEdgeViolation(fromLabel, type, toLabel) {
   if (type in LOCAL_RULE_OVERRIDES) {
@@ -18085,6 +18160,7 @@ var init_store = __esm({
     init_src2();
     init_src();
     init_history_cache_floor();
+    init_session_evidence();
     LOCAL_RULE_OVERRIDES = {
       ANCHORED_AT: {
         from: EDGE_RULES["ANCHORED_AT"]?.from,
@@ -18256,6 +18332,12 @@ CREATE INDEX IF NOT EXISTS nodes_anchor_hint_path ON nodes(json_extract(attrs_js
         }
         this.db.exec(TEMPORAL_INDEX_SQL);
         installHistoryCacheFloor(this.db);
+        if (!this.db.prepare("SELECT value FROM store_meta WHERE key = 'session-evidence-v1'").get()) {
+          this.db.transaction(() => {
+            this.repairSessionAliases();
+            this.db.prepare("INSERT OR REPLACE INTO store_meta (key, value) VALUES ('session-evidence-v1', 'done')").run();
+          });
+        }
         this.stmts = {
           insertNode: this.db.prepare(`
         INSERT INTO nodes (
@@ -18504,6 +18586,23 @@ CREATE INDEX IF NOT EXISTS nodes_anchor_hint_path ON nodes(json_extract(attrs_js
           this.db.prepare("UPDATE schema_version SET version = ?").run(SCHEMA_VERSION);
         });
       }
+      repairSessionAliases(canonical, aliases = []) {
+        const mapping = new Map(aliases.map((alias) => [alias, canonical]));
+        let changed = 0;
+        for (const table of ["nodes", "edges"]) {
+          const predicates = canonical ? aliases.map(() => "instr(attrs_json, ?) > 0") : ["instr(attrs_json, 'codex:') > 0", "instr(attrs_json, 'discriminatorSource') > 0"];
+          if (!predicates.length) continue;
+          const rows = this.db.prepare(`SELECT id, attrs_json FROM ${table} WHERE ${predicates.join(" OR ")}`).all(...canonical ? aliases : []);
+          const update = this.db.prepare(`UPDATE ${table} SET attrs_json = ?${table === "edges" ? ", type = CASE WHEN type = 'CONFIRMS' AND json_extract(?, '$.provisional') = 1 THEN 'INDICATES' ELSE type END" : ""} WHERE id = ?`);
+          for (const row of rows) {
+            const attrs = JSON.stringify(repairSessionEvidence(JSON.parse(row.attrs_json), mapping));
+            if (attrs === row.attrs_json) continue;
+            update.run(...table === "edges" ? [attrs, attrs, row.id] : [attrs, row.id]);
+            changed++;
+          }
+        }
+        return changed;
+      }
       deleteNode(id) {
         this.stmts.deleteNode.run(id);
       }
@@ -23022,6 +23121,7 @@ function recordTriageObservation(l2, obs, ts) {
     }
     const discriminator = obs.discriminator ?? existing?.attrs["discriminator"];
     const attrs = {
+      ...existing?.attrs,
       driftKind: obs.driftKind ?? existing?.attrs["driftKind"] ?? DRIFT_KIND.RELOCATION,
       perContext,
       // A discriminator (now or previously supplied) promotes the route to a router.
@@ -23260,7 +23360,7 @@ function induceTriage(l2, opts) {
   return report;
 }
 function pendingDiscriminators(l2, opts = {}) {
-  const minSources = opts.minSources ?? 1;
+  const minSources = opts.minSources ?? 2;
   const minObservations = opts.minObservations ?? 2;
   const out2 = [];
   for (const triage of l2.findNodesByLabel("Triage")) {
@@ -23295,6 +23395,12 @@ function promoteRouteWithDiscriminator(l2, routeId, discriminator, ts, source) {
   if (isUnfilledPlaceholder(test)) return false;
   const existing = l2.getEdge(routeId);
   if (!existing || !ROUTE_EDGE_TYPES.includes(existing.type)) return false;
+  const global2 = (existing.attrs["perContext"] ?? {})[TRIAGE_GLOBAL_BUCKET] ?? {};
+  const contributors = new Set(global2.contributors ?? []);
+  const inferred = new Set(global2.inferredContributors ?? []);
+  const witnesses = [...contributors].filter((id) => !inferred.has(id));
+  if (!source || contributors.has(source) || witnesses.length < 2) return false;
+  if (existing.attrs["discriminator"] && existing.attrs["discriminator"] !== test) return false;
   const attrs = {
     ...existing.attrs,
     discriminator: test,
@@ -24860,8 +24966,8 @@ var init_src5 = __esm({
 });
 
 // ../../packages/context-writer/src/render.ts
-function isPassiveInjectable(node2) {
-  if (!historyReadPolicy(node2, { mode: "passive" }).allow) return false;
+function isPassiveInjectable(node2, atCommit) {
+  if (!historyReadPolicy(node2, { mode: "passive", atCommit }).allow) return false;
   if (node2.label === "Pattern" || node2.label === "Technique" || node2.label === "AntiPattern") {
     return true;
   }
@@ -24871,7 +24977,7 @@ function isPassiveInjectable(node2) {
   return false;
 }
 function buildSnapshot(opts) {
-  const problems = opts.store.findNodesByLabel("Problem").filter((p) => p.attrs["mergedInto"] === void 0 && historyReadPolicy(p, { mode: "passive" }).allow);
+  const problems = opts.store.findNodesByLabel("Problem").filter((p) => p.attrs["mergedInto"] === void 0 && historyReadPolicy(p, { mode: "passive", atCommit: opts.atCommit }).allow);
   const stillOpen = problems.filter((p) => p.attrs["resolvedAt"] == null);
   const allProblems = stillOpen.filter((p) => !isConstraintProblem(p));
   allProblems.sort((a, b) => b.lastUpdatedAt - a.lastUpdatedAt);
@@ -24901,11 +25007,11 @@ function buildSnapshot(opts) {
     ...opts.store.findNodesByLabel("Pattern"),
     ...opts.store.findNodesByLabel("Technique"),
     ...opts.store.findNodesByLabel("AntiPattern")
-  ].filter((n) => historyReadPolicy(n, { mode: "passive" }).allow).sort((a, b) => b.pageRank - a.pageRank).slice(0, 10);
-  const workingFile = opts.workingFile ? sliceForFile(opts.store, opts.workingFile) : void 0;
+  ].filter((n) => historyReadPolicy(n, { mode: "passive", atCommit: opts.atCommit }).allow).sort((a, b) => b.pageRank - a.pageRank).slice(0, 10);
+  const workingFile = opts.workingFile ? sliceForFile(opts.store, opts.workingFile, opts.atCommit) : void 0;
   const byEpisode = /* @__PURE__ */ new Map();
   for (const sol of opts.store.findNodesByLabel("Solution")) {
-    if (!historyReadPolicy(sol, { mode: "passive" }).allow) continue;
+    if (!historyReadPolicy(sol, { mode: "passive", atCommit: opts.atCommit }).allow) continue;
     if (sol.attrs["enrichmentPending"] !== true) continue;
     const ep = sol.attrs["episodeId"] ?? sol.id;
     const list = byEpisode.get(ep) ?? [];
@@ -24977,7 +25083,7 @@ function buildSnapshot(opts) {
     generatedAt: (opts.now ?? /* @__PURE__ */ new Date()).toISOString()
   };
 }
-function sliceForFile(store, relPath) {
+function sliceForFile(store, relPath, atCommit) {
   const candidates = store.findNodesByLabel("File");
   const file2 = candidates.find((n) => n.description === relPath);
   if (!file2) return void 0;
@@ -25016,7 +25122,7 @@ function sliceForFile(store, relPath) {
   }
   const fp = priorsForFile(store, relPath);
   if (fp) {
-    const allowed = (n) => historyReadPolicy(n, { mode: "passive" }).allow;
+    const allowed = (n) => historyReadPolicy(n, { mode: "passive", atCommit }).allow;
     fp.openProblems = fp.openProblems.filter(allowed);
     fp.constraints = fp.constraints.filter(allowed);
     fp.resolvedProblems = fp.resolvedProblems.filter(allowed);
@@ -25426,6 +25532,7 @@ function budgetSnapshot(s, maxChars) {
 function assembleAgentContext(opts) {
   const snapshot = opts.snapshot ?? buildSnapshot({
     store: opts.store,
+    atCommit: opts.atCommit,
     profile: opts.profile,
     reviewCount: opts.reviewCount,
     reviewUiUrl: opts.reviewUiUrl,
@@ -25441,7 +25548,7 @@ function assembleAgentContext(opts) {
   if (opts.remote && opts.remote.length > 0) {
     const seen = /* @__PURE__ */ new Set();
     const remote = opts.remote.filter((n) => {
-      if (!isPassiveInjectable(n)) return false;
+      if (!isPassiveInjectable(n, opts.atCommit)) return false;
       if (opts.store.getNode(n.id)) return false;
       if (seen.has(n.id)) return false;
       seen.add(n.id);
@@ -25643,7 +25750,7 @@ function selectDurableMemory(store, profile, opts = {}) {
   const minContributors = opts.minContributors ?? 1;
   const wsLangs = new Set(profile.languages.map((l) => l.toLowerCase()));
   return store.findNodesByLabel("Claim").filter(
-    (n) => historyReadPolicy(n, { mode: "passive" }).allow && Number(n.attrs["abstractionLevel"] ?? ABSTRACTION_LEVEL.CONCRETE) === ABSTRACTION_LEVEL.PRINCIPLE && n.attrs["provisional"] === false && contributorsOf(n) >= minContributors && // Lang-relevance: universal principles (no scope.lang) bleed everywhere; a
+    (n) => historyReadPolicy(n, { mode: "passive", atCommit: opts.atCommit }).allow && Number(n.attrs["abstractionLevel"] ?? ABSTRACTION_LEVEL.CONCRETE) === ABSTRACTION_LEVEL.PRINCIPLE && n.attrs["provisional"] === false && contributorsOf(n) >= minContributors && // Lang-relevance: universal principles (no scope.lang) bleed everywhere; a
     // language-scoped principle only bleeds into repos that USE that language —
     // so a Python principle never lands a dead `**/*.py` rule in a TS repo.
     (scopeLangOf(n) == null || wsLangs.has(scopeLangOf(n)))
@@ -31158,26 +31265,26 @@ function buildFileLexicon(store) {
   for (const n of store.findNodesByLabel("File")) {
     const relPath = typeof n.attrs["relPath"] === "string" && n.attrs["relPath"].length > 0 ? n.attrs["relPath"] : n.description;
     if (!relPath) continue;
-    const basename8 = relPath.split("/").pop();
-    if (!basename8.includes(".")) continue;
-    entries.push({ relPath, basename: basename8 });
-    basenameCount.set(basename8, (basenameCount.get(basename8) ?? 0) + 1);
-    const stem = basename8.slice(0, basename8.indexOf("."));
+    const basename9 = relPath.split("/").pop();
+    if (!basename9.includes(".")) continue;
+    entries.push({ relPath, basename: basename9 });
+    basenameCount.set(basename9, (basenameCount.get(basename9) ?? 0) + 1);
+    const stem = basename9.slice(0, basename9.indexOf("."));
     if (isBareMatchableStem(stem)) {
       let s = stemRelPaths.get(stem);
       if (!s) stemRelPaths.set(stem, s = /* @__PURE__ */ new Set());
       s.add(relPath);
     }
   }
-  for (const { relPath, basename: basename8 } of entries) {
+  for (const { relPath, basename: basename9 } of entries) {
     const entry = { relPath };
-    if (relPath !== basename8) byKey.set(relPath, entry);
-    const conventional = CONVENTION_FILENAMES.has(basename8) || (basenameCount.get(basename8) ?? 0) >= CONVENTION_BASENAME_MIN_FILES;
-    if (!conventional && !byKey.has(basename8)) byKey.set(basename8, entry);
-    const list = byBasename.get(basename8);
+    if (relPath !== basename9) byKey.set(relPath, entry);
+    const conventional = CONVENTION_FILENAMES.has(basename9) || (basenameCount.get(basename9) ?? 0) >= CONVENTION_BASENAME_MIN_FILES;
+    if (!conventional && !byKey.has(basename9)) byKey.set(basename9, entry);
+    const list = byBasename.get(basename9);
     if (list) list.push(entry);
-    else byBasename.set(basename8, [entry]);
-    const stem = basename8.slice(0, basename8.indexOf("."));
+    else byBasename.set(basename9, [entry]);
+    const stem = basename9.slice(0, basename9.indexOf("."));
     if (isBareMatchableStem(stem) && !CONVENTION_STEMS.has(stem) && !byStem.has(stem)) {
       const dirStems = new Set(
         [...stemRelPaths.get(stem) ?? []].map((p) => {
@@ -31194,8 +31301,8 @@ function resolveFileToken(token, lexicon) {
   const exact = lexicon.byKey.get(token);
   if (exact) return exact;
   if (!token.includes("/")) return null;
-  const basename8 = token.split("/").pop();
-  for (const entry of lexicon.byBasename.get(basename8) ?? []) {
+  const basename9 = token.split("/").pop();
+  for (const entry of lexicon.byBasename.get(basename9) ?? []) {
     if (entry.relPath === token || entry.relPath.endsWith(`/${token}`)) return entry;
   }
   return null;
@@ -31220,9 +31327,9 @@ function fileRolePhrase(relPath, level = 1) {
   return "a source file";
 }
 function isSourceFileToken(token) {
-  const basename8 = token.split(/[/\\]/).pop() ?? token;
-  if (CONVENTION_FILENAMES.has(basename8)) return false;
-  const ext = basename8.split(".").pop();
+  const basename9 = token.split(/[/\\]/).pop() ?? token;
+  if (CONVENTION_FILENAMES.has(basename9)) return false;
+  const ext = basename9.split(".").pop();
   return ext !== void 0 && SOURCE_EXTENSIONS.has(ext.toLowerCase());
 }
 function generalizeFileRefs(text, fileLexicon, level = 1) {
@@ -72758,7 +72865,7 @@ init_config();
 // src/engine.ts
 import { execFileSync as execFileSync4 } from "node:child_process";
 import { existsSync as existsSync25, statSync as statSync8, appendFileSync as appendFileSync4, readdirSync as readdirSync10, renameSync as renameSync3, readFileSync as readFileSync28, writeFileSync as writeFileSync21 } from "node:fs";
-import { join as join34, relative as relative6, sep as sep4 } from "node:path";
+import { basename as basename7, join as join34, relative as relative6, sep as sep4 } from "node:path";
 
 // src/source-watcher.ts
 import { EventEmitter as EventEmitter2 } from "node:events";
@@ -72918,10 +73025,10 @@ var ReaddirpStream = class extends Readable2 {
   }
   async _formatEntry(dirent, path2) {
     let entry;
-    const basename8 = this._isDirent ? dirent.name : dirent;
+    const basename9 = this._isDirent ? dirent.name : dirent;
     try {
-      const fullPath = presolve(pjoin(path2, basename8));
-      entry = { path: prelative(this._root, fullPath), fullPath, basename: basename8 };
+      const fullPath = presolve(pjoin(path2, basename9));
+      entry = { path: prelative(this._root, fullPath), fullPath, basename: basename9 };
       entry[this._statsProp] = this._isDirent ? dirent : await this._stat(fullPath);
     } catch (err2) {
       this._onError(err2);
@@ -73460,9 +73567,9 @@ var NodeFsHandler = class {
   _watchWithNodeFs(path2, listener) {
     const opts = this.fsw.options;
     const directory = sysPath.dirname(path2);
-    const basename8 = sysPath.basename(path2);
+    const basename9 = sysPath.basename(path2);
     const parent = this.fsw._getWatchedDir(directory);
-    parent.add(basename8);
+    parent.add(basename9);
     const absolutePath = sysPath.resolve(path2);
     const options = {
       persistent: opts.persistent
@@ -73472,7 +73579,7 @@ var NodeFsHandler = class {
     let closer;
     if (opts.usePolling) {
       const enableBin = opts.interval !== opts.binaryInterval;
-      options.interval = enableBin && isBinaryPath(basename8) ? opts.binaryInterval : opts.interval;
+      options.interval = enableBin && isBinaryPath(basename9) ? opts.binaryInterval : opts.interval;
       closer = setFsWatchFileListener(path2, absolutePath, options, {
         listener,
         rawEmitter: this.fsw._emitRaw
@@ -73495,10 +73602,10 @@ var NodeFsHandler = class {
       return;
     }
     const dirname14 = sysPath.dirname(file2);
-    const basename8 = sysPath.basename(file2);
+    const basename9 = sysPath.basename(file2);
     const parent = this.fsw._getWatchedDir(dirname14);
     let prevStats = stats;
-    if (parent.has(basename8))
+    if (parent.has(basename9))
       return;
     const listener = async (path2, newStats) => {
       if (!this.fsw._throttle(THROTTLE_MODE_WATCH, file2, 5))
@@ -73523,9 +73630,9 @@ var NodeFsHandler = class {
             prevStats = newStats2;
           }
         } catch (error48) {
-          this.fsw._remove(dirname14, basename8);
+          this.fsw._remove(dirname14, basename9);
         }
-      } else if (parent.has(basename8)) {
+      } else if (parent.has(basename9)) {
         const at = newStats.atimeMs;
         const mt = newStats.mtimeMs;
         if (!at || at <= mt || mt !== prevStats.mtimeMs) {
@@ -74805,6 +74912,16 @@ import { closeSync, existsSync as existsSync16, fstatSync, openSync, readdirSync
 import { basename as basename5, delimiter, dirname as dirname10, join as join20, normalize as normalize3 } from "node:path";
 import { homedir as homedir4 } from "node:os";
 import { createHash as createHash16 } from "node:crypto";
+function completeJsonlPrefix(buf) {
+  const end = buf.lastIndexOf(10) + 1;
+  if (end === buf.length) return end;
+  try {
+    JSON.parse(buf.subarray(end).toString("utf8"));
+    return buf.length;
+  } catch {
+    return end;
+  }
+}
 function readFrom(path2, fromByte, maxBytes) {
   let fd;
   try {
@@ -74821,11 +74938,12 @@ function readFrom(path2, fromByte, maxBytes) {
     for (; ; ) {
       const len = Math.min(cap, remaining);
       const buf = Buffer.allocUnsafe(len);
-      readSync(fd, buf, 0, len, start2);
-      if (len >= remaining) {
-        return { text: buf.toString("utf8"), nextOffset: size, more: false, ioFailed: false };
+      const read2 = readSync(fd, buf, 0, len, start2);
+      if (len >= remaining || read2 < len) {
+        const end = completeJsonlPrefix(buf.subarray(0, read2));
+        return { text: buf.subarray(0, end).toString("utf8"), nextOffset: start2 + end, more: false, ioFailed: false };
       }
-      const nl = buf.lastIndexOf(10);
+      const nl = buf.subarray(0, read2).lastIndexOf(10);
       if (nl >= 0) {
         return {
           text: buf.subarray(0, nl + 1).toString("utf8"),
@@ -74842,41 +74960,30 @@ function readFrom(path2, fromByte, maxBytes) {
     closeSync(fd);
   }
 }
-function transcriptSize(path2) {
-  try {
-    const fd = openSync(path2, "r");
-    try {
-      return fstatSync(fd).size;
-    } finally {
-      closeSync(fd);
-    }
-  } catch {
-    return 0;
-  }
-}
 function readTail(path2, maxBytes) {
   return readTailWithLosses(path2, maxBytes).text;
 }
-function readTailWithLosses(path2, maxBytes) {
+function readTailWithLosses(path2, maxBytes, completeLinesOnly = false) {
   let fd;
   try {
     fd = openSync(path2, "r");
   } catch {
-    return { text: "", bytesUnreachable: 0, parseStartByte: 0, ioFailed: true };
+    return { text: "", bytesUnreachable: 0, parseStartByte: 0, ioFailed: true, nextOffset: 0 };
   }
   try {
     const size = fstatSync(fd).size;
     const start2 = Math.max(0, size - maxBytes);
     const len = size - start2;
-    if (len <= 0) return { text: "", bytesUnreachable: 0, parseStartByte: 0, ioFailed: false };
+    if (len <= 0) return { text: "", bytesUnreachable: 0, parseStartByte: 0, ioFailed: false, nextOffset: 0 };
     const buf = Buffer.allocUnsafe(len);
-    readSync(fd, buf, 0, len, start2);
-    const text = buf.toString("utf8");
+    const read2 = readSync(fd, buf, 0, len, start2);
+    const end = completeLinesOnly ? completeJsonlPrefix(buf.subarray(0, read2)) : read2;
+    const text = buf.subarray(0, end).toString("utf8");
     const firstNewline = buf.indexOf(10);
     const parseStartByte = firstNewline < 0 ? start2 : start2 + firstNewline + 1 - Buffer.byteLength(buf.subarray(0, firstNewline + 1).toString("utf8"));
-    return { text, bytesUnreachable: start2, parseStartByte, ioFailed: false };
+    return { text, bytesUnreachable: start2, parseStartByte, ioFailed: false, nextOffset: start2 + end };
   } catch {
-    return { text: "", bytesUnreachable: 0, parseStartByte: 0, ioFailed: true };
+    return { text: "", bytesUnreachable: 0, parseStartByte: 0, ioFailed: true, nextOffset: 0 };
   } finally {
     closeSync(fd);
   }
@@ -74939,10 +75046,11 @@ function isUserTurnBoundary(obj) {
   return blocks.some((b) => b["type"] === "text");
 }
 function readAssistantTurnsWithLosses(transcriptPath, includeThinking = true, maxBytes = 2e6) {
-  const tail = readTailWithLosses(transcriptPath, maxBytes);
+  const tail = readTailWithLosses(transcriptPath, maxBytes, true);
   const parsed = parseAssistantTurns(tail.text, includeThinking, false, tail.parseStartByte);
   return {
     turns: parsed.turns,
+    nextOffset: tail.nextOffset,
     losses: {
       parseFailures: parsed.parseFailures,
       ioFailed: tail.ioFailed,
@@ -75253,7 +75361,13 @@ function codexSessionRoots(env2 = process.env, home = homedir4()) {
   roots.add(join20(home, ".codex", "sessions"));
   return [...roots];
 }
-function readCodexRolloutCwd(path2) {
+function readCodexRolloutIdentity(path2) {
+  const legacy = `codex:${basename5(path2, ".jsonl")}`;
+  const identity = (cwd, id) => {
+    const uuid3 = typeof id === "string" && /^[a-f0-9]{8}(?:-[a-f0-9]{4}){3}-[a-f0-9]{12}$/i.test(id) ? id.toLowerCase() : basename5(path2, ".jsonl").match(/([a-f0-9]{8}(?:-[a-f0-9]{4}){3}-[a-f0-9]{12})$/i)?.[1]?.toLowerCase();
+    const sessionId = uuid3 ? `codex:${uuid3}` : legacy;
+    return { cwd, sessionId, aliases: [legacy, ...uuid3 ? [uuid3] : []].filter((s) => s !== sessionId) };
+  };
   let fd;
   try {
     fd = openSync(path2, "r");
@@ -75276,11 +75390,11 @@ function readCodexRolloutCwd(path2) {
       const o = JSON.parse(firstLine);
       const meta3 = o?.type === "session_meta" ? o.payload ?? o : o.payload ?? o;
       const cwd = meta3?.cwd ?? o?.cwd;
-      if (typeof cwd === "string") return cwd;
+      if (typeof cwd === "string") return identity(cwd, o.type === "session_meta" ? meta3.id : void 0);
     } catch {
     }
     const m = firstLine.match(/"cwd"\s*:\s*"((?:[^"\\]|\\.)*)"/);
-    return m ? JSON.parse(`"${m[1]}"`) : null;
+    return m ? identity(JSON.parse(`"${m[1]}"`)) : null;
   } catch {
     return null;
   } finally {
@@ -75338,15 +75452,16 @@ function codexRolloutsForCwd(cwd, opts = {}) {
         );
         activity.set(full, { size: st.size, activeAt: activityAtMs });
         if (activityAtMs < sinceMs) continue;
-        const sessionCwd = readCodexRolloutCwd(full);
-        if (sessionCwd === null) continue;
+        const identity = readCodexRolloutIdentity(full);
+        if (identity === null) continue;
+        const sessionCwd = identity.cwd;
         let sessionOwner = owners.get(sessionCwd);
         if (sessionOwner === void 0) {
           sessionOwner = checkoutRootOf(sessionCwd);
           owners.set(sessionCwd, sessionOwner);
         }
         if (sessionOwner !== owner) continue;
-        out2.push({ path: full, sessionId: `codex:${basename5(name2, ".jsonl")}`, mtimeMs: st.mtimeMs, activityAtMs });
+        out2.push({ path: full, sessionId: identity.sessionId, mtimeMs: st.mtimeMs, activityAtMs });
       }
     }
     for (const path2 of activity.keys()) if (!observed.has(path2)) activity.delete(path2);
@@ -80912,7 +81027,7 @@ function createWatchBreaker(deps) {
 }
 
 // src/engine.ts
-var DAEMON_VERSION = true ? "2.0.14-dev.3081" : "2.0.0-alpha.0";
+var DAEMON_VERSION = true ? "2.0.14-dev.3125" : "2.0.0-alpha.0";
 var IGNORED_PATH = /[\\/](?:\.git|node_modules|\.errata|\.claude|\.codex|\.cursor|\.turbo|\.next|dist|coverage|test-results|playwright-report|__pycache__)(?:[\\/]|$)/;
 var IGNORED_NOISE = /castalia\.db|eventlog\.sqlite|turn-cursors/;
 var GIT_OP_MUTE_MS = 4e3;
@@ -81368,6 +81483,7 @@ function createWorkspaceEngine(opts) {
     const elicit = isEdgeElicitationEnabled();
     const snapOpts = {
       profile,
+      atCommit: readGitRefState(join34(opts.workspaceRoot, ".git")).sha ?? void 0,
       reviewCount: pendingCount(paths),
       reviewUiUrl: opts.reviewUrl(),
       workingFile: workingFiles.mostRecent() ?? void 0,
@@ -81381,6 +81497,10 @@ function createWorkspaceEngine(opts) {
       );
       return null;
     }) : null;
+    if (snapOpts.atCommit !== (readGitRefState(join34(opts.workspaceRoot, ".git")).sha ?? void 0)) {
+      contextDirty = true;
+      return;
+    }
     const doneRender = markPass(`${prebuilt ? "context-render" : "context-render-inline"}:${profile.name}`);
     const pendingUpdate = opts.pendingUpdate?.() ?? null;
     const daemonDistress = opts.daemonDistress?.() ?? null;
@@ -82640,7 +82760,7 @@ function createWorkspaceEngine(opts) {
       readLosses.sliceGuardHits = 0;
     }
   };
-  const harvestTurns = async (sessionId, transcriptPath) => {
+  const harvestTurnsUnqueued = async (sessionId, transcriptPath) => {
     const known = turnOffset.get(sessionId);
     let turns;
     let nextOffset;
@@ -82648,7 +82768,7 @@ function createWorkspaceEngine(opts) {
       if (known === void 0) {
         const first = readAssistantTurnsWithLosses(transcriptPath);
         turns = first.turns;
-        nextOffset = transcriptSize(transcriptPath);
+        nextOffset = first.nextOffset;
         readLosses.bytesUnreachable += first.losses.bytesUnreachable;
         readLosses.parseFailures += first.losses.parseFailures;
         if (first.losses.ioFailed) readLosses.ioFailures++;
@@ -82708,6 +82828,37 @@ function createWorkspaceEngine(opts) {
     }
     setImmediate(() => void harvestTexts(e.sessionId, [{ text: e.text }]));
   };
+  const harvestInFlight = /* @__PURE__ */ new Map();
+  const repairedSessions = /* @__PURE__ */ new Set();
+  const harvestTurns = async (inputSessionId, transcriptPath) => {
+    const identity = basename7(transcriptPath).startsWith("rollout-") ? readCodexRolloutIdentity(transcriptPath) : null;
+    const sessionId = identity?.sessionId ?? inputSessionId;
+    const work = (harvestInFlight.get(sessionId) ?? Promise.resolve()).catch(() => {
+    }).then(async () => {
+      if (identity && !repairedSessions.has(sessionId)) {
+        store.repairSessionAliases(sessionId, identity.aliases);
+        opts.sharedStore?.repairSessionAliases(sessionId, identity.aliases);
+        repairedSessions.add(sessionId);
+      }
+      for (const alias of identity?.aliases ?? []) {
+        const offset = turnOffset.get(alias);
+        if (offset !== void 0 && offset > (turnOffset.get(sessionId) ?? -1)) {
+          turnOffset.set(sessionId, offset);
+          const uuid3 = lastTurnUuid.get(alias);
+          if (uuid3) lastTurnUuid.set(sessionId, uuid3);
+        }
+        turnOffset.delete(alias);
+        lastTurnUuid.delete(alias);
+      }
+      await harvestTurnsUnqueued(sessionId, transcriptPath);
+    });
+    harvestInFlight.set(sessionId, work);
+    try {
+      await work;
+    } finally {
+      if (harvestInFlight.get(sessionId) === work) harvestInFlight.delete(sessionId);
+    }
+  };
   const harvestSession = async (sessionId, transcriptPath) => {
     await harvestTurns(sessionId, transcriptPath);
     for (const sub of subagentTranscripts(transcriptPath, sessionId)) {
@@ -85384,12 +85535,12 @@ var GENERATED_PATH_RES = [
 ];
 var RELEASE_SUBJECT_RE = /^(release|bump|chore\(release\)|v?\d+\.\d+\.\d+)/i;
 var RELEASE_TAG_RE = /^v?\d+\.\d+/;
-function basename7(path2) {
+function basename8(path2) {
   const i2 = path2.lastIndexOf("/");
   return i2 < 0 ? path2 : path2.slice(i2 + 1);
 }
 function isLockfilePath(path2) {
-  const name2 = basename7(path2);
+  const name2 = basename8(path2);
   return LOCKFILE_NAMES.has(name2) || LOCKFILE_SUFFIX_RE.test(name2);
 }
 function isGeneratedPath(path2) {
@@ -89408,7 +89559,7 @@ function buildCodexHooksToml(port, options) {
   const quote = (value) => {
     if (platform === "win32") {
       if (/["\r\n]/.test(value)) throw new Error("Unsupported character in Codex hook path");
-      return "'" + value.replace(/'/g, "''") + "'";
+      return "'" + value.replace(/['\u2018-\u201B]/g, (quote2) => quote2 + quote2) + "'";
     }
     return "'" + value.replace(/'/g, "'\\''") + "'";
   };
@@ -89426,6 +89577,9 @@ import { readFileSync } from 'node:fs';
 
 try {
   const payload = JSON.parse(readFileSync(0, 'utf8') || '{}');
+  if (typeof payload.session_id === 'string' && /^[a-f0-9]{8}(?:-[a-f0-9]{4}){3}-[a-f0-9]{12}$/i.test(payload.session_id)) {
+    payload.session_id = 'codex:' + payload.session_id.toLowerCase();
+  }
   const port = Number(process.argv[2]);
   const event = payload.hook_event_name;
   if (!Number.isInteger(port) || port < 1 || port > 65535) process.exit(0);
@@ -92739,7 +92893,9 @@ async function cmdDash(args2) {
     for (const r of handle2.records) {
       await yieldToLoop2();
       try {
-        const items = selectDurableMemory(handle2.sharedStore, r.engine.profile);
+        const items = selectDurableMemory(handle2.sharedStore, r.engine.profile, {
+          atCommit: readGitRefState(join43(r.root, ".git")).sha ?? void 0
+        });
         const res = bleedRules(join43(r.root, ".claude", "rules"), items);
         if (res.written || res.pruned) {
           console.log(

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@inerrata-corporation/errata",
-  "version": "2.0.14-dev.3081",
+  "version": "2.0.14-dev.3125",
   "description": "errata - local-first observation engine for AI coding agents",
   "type": "module",
   "bin": {

package/pass-worker.mjs

@@ -24605,6 +24605,71 @@ function installHistoryCacheFloor(db) {
   });
 }
 
+// ../../packages/local-graph/src/session-evidence.ts
+function repairSessionEvidence(input, aliases = /* @__PURE__ */ new Map()) {
+  const mapping = new Map(aliases);
+  const uuid3 = "[a-f0-9]{8}(?:-[a-f0-9]{4}){3}-[a-f0-9]{12}";
+  const codex = new RegExp(`^codex:(?:rollout-.*?)?(${uuid3})$`, "i");
+  const arrays = /* @__PURE__ */ new Set(["sources", "recurrenceSources", "contributors", "inferredContributors", "citeSessions"]);
+  const scalars = /* @__PURE__ */ new Set(["discriminatorSource", "originSession", "sessionId", "sourceSession"]);
+  const discover = (value, key = "") => {
+    if (typeof value === "string" && (arrays.has(key) || scalars.has(key) || key === "citeAnchorHints")) {
+      const match = value.match(codex);
+      if (match) {
+        const canonical = `codex:${match[1].toLowerCase()}`;
+        mapping.set(value, canonical);
+        mapping.set(match[1].toLowerCase(), canonical);
+      }
+    } else if (Array.isArray(value)) value.forEach((v) => discover(v, key));
+    else if (value && typeof value === "object") {
+      for (const [k, v] of Object.entries(value)) discover(v, key === "citeAnchorHints" ? key : k);
+    }
+  };
+  discover(input);
+  const rewrite = (value, key = "") => {
+    if (typeof value === "string" && (arrays.has(key) || scalars.has(key) || key === "citeAnchorHints")) {
+      return mapping.get(value) ?? mapping.get(value.toLowerCase()) ?? value;
+    }
+    if (Array.isArray(value)) {
+      const values = value.map((v) => rewrite(v, key));
+      return arrays.has(key) || key === "citeAnchorHints" ? [...new Set(values)] : values;
+    }
+    if (!value || typeof value !== "object") return value;
+    const before = value;
+    const after = Object.fromEntries(Object.entries(before).map(([k, v]) => [k, rewrite(v, key === "citeAnchorHints" ? key : k)]));
+    for (const field of ["sources", "contributors"]) {
+      const old = before[field], next = after[field];
+      if (!Array.isArray(old) || !Array.isArray(next) || old.length <= next.length) continue;
+      after["sessionAliasRepair"] = { originalCount: old.length, distinctCount: next.length };
+      if (field === "sources" && typeof after["corroborations"] === "number") {
+        after["corroborations"] = Math.min(after["corroborations"], Math.max(0, next.length - 1));
+        if (after["corroborations"] === 0) after["provisional"] = true;
+      }
+      if (field === "contributors" && typeof after["confirmed"] === "number") {
+        after["preAliasRepairConfirmed"] = after["confirmed"];
+        after["confirmed"] = Math.min(after["confirmed"], next.length);
+      }
+    }
+    return after;
+  };
+  const repaired = rewrite(input);
+  const source = repaired["discriminatorSource"];
+  if (typeof source === "string") {
+    const global = repaired["perContext"]?.["*"];
+    const contributors = Array.isArray(global?.["contributors"]) ? global["contributors"] : [];
+    const inferred = new Set(Array.isArray(global?.["inferredContributors"]) ? global["inferredContributors"] : []);
+    if (contributors.includes(source) || contributors.filter((id) => !inferred.has(id)).length < 2) {
+      repaired["withdrawnDiscriminator"] = repaired["discriminator"];
+      repaired["discriminatorWithdrawalReason"] = "insufficient-independent-witnesses";
+      repaired["provisional"] = true;
+      delete repaired["discriminator"];
+      delete repaired["discriminatorSource"];
+      delete repaired["discriminatorAsked"];
+    }
+  }
+  return repaired;
+}
+
 // ../../packages/local-graph/src/store.ts
 var LOCAL_RULE_OVERRIDES = {
   ANCHORED_AT: {
@@ -24849,6 +24914,12 @@ var SqliteGraphStore = class {
     }
     this.db.exec(TEMPORAL_INDEX_SQL);
     installHistoryCacheFloor(this.db);
+    if (!this.db.prepare("SELECT value FROM store_meta WHERE key = 'session-evidence-v1'").get()) {
+      this.db.transaction(() => {
+        this.repairSessionAliases();
+        this.db.prepare("INSERT OR REPLACE INTO store_meta (key, value) VALUES ('session-evidence-v1', 'done')").run();
+      });
+    }
     this.stmts = {
       insertNode: this.db.prepare(`
         INSERT INTO nodes (
@@ -25097,6 +25168,23 @@ var SqliteGraphStore = class {
       this.db.prepare("UPDATE schema_version SET version = ?").run(SCHEMA_VERSION);
     });
   }
+  repairSessionAliases(canonical, aliases = []) {
+    const mapping = new Map(aliases.map((alias) => [alias, canonical]));
+    let changed = 0;
+    for (const table of ["nodes", "edges"]) {
+      const predicates = canonical ? aliases.map(() => "instr(attrs_json, ?) > 0") : ["instr(attrs_json, 'codex:') > 0", "instr(attrs_json, 'discriminatorSource') > 0"];
+      if (!predicates.length) continue;
+      const rows = this.db.prepare(`SELECT id, attrs_json FROM ${table} WHERE ${predicates.join(" OR ")}`).all(...canonical ? aliases : []);
+      const update = this.db.prepare(`UPDATE ${table} SET attrs_json = ?${table === "edges" ? ", type = CASE WHEN type = 'CONFIRMS' AND json_extract(?, '$.provisional') = 1 THEN 'INDICATES' ELSE type END" : ""} WHERE id = ?`);
+      for (const row of rows) {
+        const attrs = JSON.stringify(repairSessionEvidence(JSON.parse(row.attrs_json), mapping));
+        if (attrs === row.attrs_json) continue;
+        update.run(...table === "edges" ? [attrs, attrs, row.id] : [attrs, row.id]);
+        changed++;
+      }
+    }
+    return changed;
+  }
   deleteNode(id) {
     this.stmts.deleteNode.run(id);
   }
@@ -27543,7 +27631,7 @@ var AGENTS_POINTER_BODY = [
 init_src2();
 init_src();
 function buildSnapshot(opts) {
-  const problems = opts.store.findNodesByLabel("Problem").filter((p) => p.attrs["mergedInto"] === void 0 && historyReadPolicy(p, { mode: "passive" }).allow);
+  const problems = opts.store.findNodesByLabel("Problem").filter((p) => p.attrs["mergedInto"] === void 0 && historyReadPolicy(p, { mode: "passive", atCommit: opts.atCommit }).allow);
   const stillOpen = problems.filter((p) => p.attrs["resolvedAt"] == null);
   const allProblems = stillOpen.filter((p) => !isConstraintProblem(p));
   allProblems.sort((a, b) => b.lastUpdatedAt - a.lastUpdatedAt);
@@ -27573,11 +27661,11 @@ function buildSnapshot(opts) {
     ...opts.store.findNodesByLabel("Pattern"),
     ...opts.store.findNodesByLabel("Technique"),
     ...opts.store.findNodesByLabel("AntiPattern")
-  ].filter((n) => historyReadPolicy(n, { mode: "passive" }).allow).sort((a, b) => b.pageRank - a.pageRank).slice(0, 10);
-  const workingFile = opts.workingFile ? sliceForFile(opts.store, opts.workingFile) : void 0;
+  ].filter((n) => historyReadPolicy(n, { mode: "passive", atCommit: opts.atCommit }).allow).sort((a, b) => b.pageRank - a.pageRank).slice(0, 10);
+  const workingFile = opts.workingFile ? sliceForFile(opts.store, opts.workingFile, opts.atCommit) : void 0;
   const byEpisode = /* @__PURE__ */ new Map();
   for (const sol of opts.store.findNodesByLabel("Solution")) {
-    if (!historyReadPolicy(sol, { mode: "passive" }).allow) continue;
+    if (!historyReadPolicy(sol, { mode: "passive", atCommit: opts.atCommit }).allow) continue;
     if (sol.attrs["enrichmentPending"] !== true) continue;
     const ep = sol.attrs["episodeId"] ?? sol.id;
     const list = byEpisode.get(ep) ?? [];
@@ -27649,7 +27737,7 @@ function buildSnapshot(opts) {
     generatedAt: (opts.now ?? /* @__PURE__ */ new Date()).toISOString()
   };
 }
-function sliceForFile(store2, relPath) {
+function sliceForFile(store2, relPath, atCommit) {
   const candidates = store2.findNodesByLabel("File");
   const file2 = candidates.find((n) => n.description === relPath);
   if (!file2) return void 0;
@@ -27688,7 +27776,7 @@ function sliceForFile(store2, relPath) {
   }
   const fp = priorsForFile(store2, relPath);
   if (fp) {
-    const allowed = (n) => historyReadPolicy(n, { mode: "passive" }).allow;
+    const allowed = (n) => historyReadPolicy(n, { mode: "passive", atCommit }).allow;
     fp.openProblems = fp.openProblems.filter(allowed);
     fp.constraints = fp.constraints.filter(allowed);
     fp.resolvedProblems = fp.resolvedProblems.filter(allowed);
@@ -27913,6 +28001,7 @@ function runPass(msg) {
       const p = msg.payload;
       return buildSnapshot({
         store,
+        atCommit: p.atCommit,
         profile: p.profile,
         reviewCount: p.reviewCount,
         reviewUiUrl: p.reviewUiUrl,