@maudecode/talaria-web 1.18.0 → 1.20.0

package/dist/sessions/recovery.js

@@ -1,6 +1,6 @@
 /**
  * Session recovery audit and safe repair (Python `api/session_recovery.py`, TAL-259). The store writes
- * `<sid>.json.bak` before any save that shrinks a transcript; the audit classifies every backup, index row, WebUI-origin
+ * a shrink backup before any save that shrinks a transcript; the audit classifies every backup, index row, WebUI-origin
  * state.db row without a sidecar, and pending turn-journal entry as `repairable` or `unsafe_to_repair`, and safe repair
  * restores, materializes, and reindexes only what is repairable.
  *
@@ -9,141 +9,42 @@
  * `recovery_stamping_since` marker may predate that provenance, so next to a readable live transcript it goes to manual
  * review instead.
  */
-import { closeSync, existsSync, fsyncSync, linkSync, mkdirSync, openSync, readdirSync, readFileSync, renameSync, statSync, unlinkSync } from 'node:fs';
-import { join } from 'node:path';
-import { atomicWriteText, writeFully } from '../fs/atomic.js';
+import { existsSync } from 'node:fs';
+import { DatabaseSync } from 'node:sqlite';
+import { updateDocument } from './storage/document.js';
 import { str } from '../util.js';
-import { isContextCompressionMarker } from './merge.js';
 import { isSafeSessionId, Session } from './session.js';
-import { normalizeAgentSessionSource, openStateDbReadonly } from './state-db.js';
-const STAMPING_MARKER = 'recovery_stamping_since';
+import { normalizeAgentSessionSource } from './state-db.js';
 /** Python `STATE_DB_RECOVERY_BUSY_TIMEOUT_MS`: a recovery scan waits out a writer rather than read a lock as "nothing missing". */
 const STATE_DB_RECOVERY_BUSY_TIMEOUT_MS = 5000;
-const SHRINK_GENERATION_RE = /^[0-9a-f]{12}4[0-9a-f]{3}[89ab][0-9a-f]{15}$/;
-const TURN_JOURNAL_DIR = '_turn_journal';
-const TURN_JOURNAL_ID_RE = /^[A-Za-z0-9_.-]+$/;
 const TERMINAL_TURN_EVENTS = new Set(['completed', 'interrupted']);
+const createdAt = (event) => { const value = Number(event.created_at ?? 0); return Number.isFinite(value) ? value : 0; };
 const WORKTREE_FIELDS = ['worktree_path', 'worktree_branch', 'worktree_repo_root', 'worktree_created_at'];
-let tmpCounter = 0;
 const isDict = (v) => Boolean(v) && typeof v === 'object' && !Array.isArray(v);
-const isEmptyList = (v) => Array.isArray(v) && v.length === 0;
 /**
  * Epoch seconds since which this server stamps every deliberate shrink, recorded in the state directory on first start.
  * A missing or unreadable marker is recorded anew: a later marker only sends more backups to manual review.
  */
-export function recoveryStampingSince(stateDir) {
-    const path = join(stateDir, STAMPING_MARKER);
-    try {
-        const value = Number(readFileSync(path, 'utf8').trim());
-        if (Number.isFinite(value) && value > 0)
-            return value;
-    }
-    catch { /* record it below */ }
-    const now = Date.now() / 1000;
-    mkdirSync(stateDir, { recursive: true });
-    atomicWriteText(path, `${String(now)}\n`);
-    return now;
-}
-function readDoc(path) {
-    try {
-        const value = JSON.parse(readFileSync(path, 'utf8'));
-        return isDict(value) ? value : null;
-    }
-    catch {
-        return null;
-    }
-}
-/** Python `_msg_count`: the transcript length, or -1 when the file is missing, unparseable, or not a session. */
-function messageCount(doc) {
-    return doc && Array.isArray(doc.messages) ? doc.messages.length : -1;
-}
-// ── deliberate-shrink provenance ─────────────────────────────────────────
-/**
- * Python `_session_records_clear_sentinel` / `_live_supersedes_backup_by_clear_generation`: the live sidecar carries a
- * clear generation the backup lacks and the clear's boundary reset, and is either the exact cleared shape or has new
- * messages since.
- */
-function clearedAfterBackup(live, bak) {
-    const generation = live.clear_generation;
-    if (typeof generation !== 'string' || !generation || bak.clear_generation === generation)
-        return false;
-    if (live.truncation_watermark !== 0 || live.truncation_boundary !== 0)
-        return false;
-    if (Array.isArray(live.messages) && live.messages.length > 0)
-        return true;
-    const nulls = ['active_stream_id', 'pending_user_message', 'pending_started_at', 'pending_user_source'];
-    const lists = ['messages', 'context_messages', 'pending_attachments'];
-    return nulls.every((k) => k in live && live[k] === null) && lists.every((k) => isEmptyList(live[k]));
-}
-/** Python `_session_records_intentional_compress_shrink`: the live sidecar records a context compression. */
-function recordsCompression(live) {
-    if (str(live.compression_anchor_mode).trim().toLowerCase() === 'manual')
-        return true;
-    const shorter = Array.isArray(live.context_messages) && Array.isArray(live.messages) && live.context_messages.length < live.messages.length;
-    if (!shorter)
-        return false;
-    const anchored = str(live.compression_anchor_summary).trim() !== '' && live.compression_anchor_message_key !== null && live.compression_anchor_message_key !== undefined;
-    return anchored || (live.truncation_watermark !== null && live.truncation_watermark !== undefined);
-}
-/**
- * Python `_backup_predates_intentional_shrink`: the backup still holds the uncompressed context. A backup whose context
- * carries the compaction marker was written after the compression and stays recoverable.
- */
-function backupPredatesCompression(live, bak) {
-    const bakContext = Array.isArray(bak.context_messages) ? bak.context_messages : [];
-    if (bakContext.some(isContextCompressionMarker))
-        return false;
-    return bakContext.length > (Array.isArray(live.context_messages) ? live.context_messages.length : 0);
-}
-/** Python `_session_records_intentional_message_shrink`: truncate, retry, or undo stamped a generation the backup lacks. */
-function recordsMessageShrink(live, bak) {
-    const isGeneration = (v) => typeof v === 'string' && SHRINK_GENERATION_RE.test(v);
-    if (!isGeneration(live.intentional_shrink_generation))
-        return false;
-    const backup = bak.intentional_shrink_generation;
-    if (backup === undefined || backup === null)
-        return true;
-    return isGeneration(backup) && backup !== live.intentional_shrink_generation;
-}
-/** Python `inspect_session_recovery_status`: whether `<sid>.json.bak` should replace `<sid>.json`. */
-function inspectBackup(dir, sid, stampingSince) {
-    const livePath = join(dir, `${sid}.json`);
-    let bakMtime;
-    try {
-        bakMtime = statSync(`${livePath}.bak`).mtimeMs / 1000;
-    }
-    catch {
-        return { session_id: sid, live_messages: messageCount(readDoc(livePath)), bak_messages: -1, recommend: 'no_backup' };
-    }
-    const live = readDoc(livePath);
-    const bak = readDoc(`${livePath}.bak`);
-    const base = { session_id: sid, live_messages: messageCount(live), bak_messages: messageCount(bak) };
-    if (base.bak_messages <= base.live_messages)
-        return { ...base, recommend: 'no_action' };
-    // Every guard needs both documents; an unreadable live file is a real loss and restores.
-    if (live && bak) {
-        if (clearedAfterBackup(live, bak))
-            return { ...base, recommend: 'no_action', reason: 'intentional_clear_truncate' };
-        if (recordsCompression(live) && backupPredatesCompression(live, bak))
-            return { ...base, recommend: 'no_action', reason: 'intentional_compress_shrink' };
-        if (recordsMessageShrink(live, bak))
-            return { ...base, recommend: 'no_action', reason: 'intentional_message_shrink' };
-        if (base.live_messages >= 0 && bakMtime < stampingSince)
-            return { ...base, recommend: 'manual_review', reason: 'unstamped_legacy_backup' };
-    }
-    return { ...base, recommend: 'restore' };
+export async function recoveryStampingSince(documents) {
+    return (await updateDocument(documents, 'recovery', 'stamping-since', (value) => {
+        const stored = Number(typeof value === 'string' ? value.trim() : '');
+        if (Number.isFinite(stored) && stored > 0)
+            return { value, result: stored };
+        const now = Date.now() / 1000;
+        return { value: `${String(now)}\n`, result: now };
+    }, { replaceInvalid: true }));
 }
 function columns(db, table) {
     return new Set(db.prepare(`PRAGMA table_info(${table})`).all().map((r) => r.name));
 }
 /** Python `_read_state_db_missing_sidecar_rows` (with empty rows) plus the session ids, from one read-only handle. */
-function readStateDb(path, sessionDir) {
+function readStateDb(path, persisted) {
     const absent = { has: () => true, missing: [], unreadable: false };
     if (!existsSync(path))
         return absent;
     let db;
     try {
-        db = openStateDbReadonly(path, STATE_DB_RECOVERY_BUSY_TIMEOUT_MS);
+        db = new DatabaseSync(path, { readOnly: true, timeout: STATE_DB_RECOVERY_BUSY_TIMEOUT_MS });
     }
     catch {
         return { ...absent, unreadable: true };
@@ -166,7 +67,7 @@ function readStateDb(path, sessionDir) {
             : null;
         for (const row of rows) {
             const sid = str(row.id).trim();
-            if (!isSafeSessionId(sid) || existsSync(join(sessionDir, `${sid}.json`)))
+            if (!isSafeSessionId(sid) || persisted.has(sid))
                 continue;
             const transcript = (messages?.all(sid) ?? []).map((m) => ({ role: m.role, content: m.content || '', ...(m.timestamp !== null ? { timestamp: m.timestamp } : {}) }));
             view.missing.push({ ...row, id: sid, messages: transcript });
@@ -181,7 +82,7 @@ function readStateDb(path, sessionDir) {
     }
 }
 /** Python `_state_db_row_to_sidecar`, through `Session` so the document matches every field the store persists. */
-function sidecarFromStateDbRow(row, store, profile) {
+async function sidecarFromStateDbRow(row, store, profile) {
     const source = 'webui'; // the scan reads only WebUI-origin rows
     const started = Number(row.started_at) || 0;
     const last = Number(row.messages.at(-1)?.timestamp) || 0;
@@ -191,60 +92,10 @@ function sidecarFromStateDbRow(row, store, profile) {
         session_id: row.id, title: str(row.title) || 'Recovered WebUI Session', ...workspace, model: str(row.model) || 'unknown', profile,
         created_at: started, updated_at: last || started, parent_session_id: row.parent_session_id ?? null, ...worktree,
         source_tag: source, ...normalizeAgentSessionSource(source), messages: row.messages,
-    }, store.deps.defaults(profile));
+    }, (await store.deps.defaults(profile)));
     return session.toDocument();
 }
 // ── turn journal (read-only) ─────────────────────────────────────────────
-const createdAt = (event) => { const n = Number(event.created_at ?? 0); return Number.isFinite(n) ? n : 0; };
-/**
- * Python `iter_turn_journal_session_ids` + `read_turn_journal`: each session's events across its pid shards
- * (`<sid>~<pid>.jsonl`) and legacy file, oldest first. Only journals an earlier backend left behind exist; this server
- * never writes one.
- */
-function readTurnJournals(sessionDir) {
-    const dir = join(sessionDir, TURN_JOURNAL_DIR);
-    const out = new Map();
-    let names;
-    try {
-        names = readdirSync(dir).sort();
-    }
-    catch {
-        return out;
-    }
-    for (const name of names) {
-        if (!name.endsWith('.jsonl'))
-            continue;
-        const stem = name.slice(0, -'.jsonl'.length);
-        const tilde = stem.indexOf('~');
-        const sid = tilde > 0 ? stem.slice(0, tilde) : stem;
-        if (!TURN_JOURNAL_ID_RE.test(sid))
-            continue;
-        let text;
-        try {
-            if (!statSync(join(dir, name)).isFile())
-                continue;
-            text = readFileSync(join(dir, name), 'utf8');
-        }
-        catch {
-            continue;
-        }
-        const events = out.get(sid) ?? [];
-        for (const line of text.split('\n')) {
-            if (!line.trim())
-                continue;
-            try {
-                const event = JSON.parse(line);
-                if (isDict(event))
-                    events.push(event);
-            }
-            catch { /* a torn line */ }
-        }
-        out.set(sid, events);
-    }
-    for (const events of out.values())
-        events.sort((a, b) => createdAt(a) - createdAt(b));
-    return out;
-}
 /** What a turn sent: its trimmed text and attachment names, or null when it sent nothing identifiable. */
 function turnKey(content, attachments) {
     const text = str(content || '').trim();
@@ -258,7 +109,7 @@ const TURN_ROW_CLOCK_SLACK_S = 5;
  * turn's id (or stream id) is that turn; otherwise rows and turns with the same text and attachments pair up in order,
  * one row per turn, so a repeated message ("continue") or an attachment-only turn still counts as missing.
  */
-function pendingJournalTurns(sessionDir, sid, events) {
+function pendingJournalTurns(live, sid, events) {
     const turns = new Map();
     for (const event of events) {
         const id = str(event.turn_id).trim();
@@ -275,7 +126,6 @@ function pendingJournalTurns(sessionDir, sid, events) {
     }
     if (!turns.size)
         return [];
-    const live = readDoc(join(sessionDir, `${sid}.json`));
     const rows = (Array.isArray(live?.messages) ? live.messages : []).filter((m) => isDict(m) && m.role === 'user');
     const rowTurnIds = new Set(rows.map((m) => str(m._turn_id)).filter(Boolean));
     const journaled = new Set([...turns.values()].flatMap((t) => [...t.ids]));
@@ -294,7 +144,7 @@ function pendingJournalTurns(sessionDir, sid, events) {
     for (const turn of [...missing].sort((a, b) => (a.id < b.id ? -1 : a.id > b.id ? 1 : 0))) {
         if (TERMINAL_TURN_EVENTS.has(str(turn.latest.event)))
             continue;
-        items.push({ ...item(sid, 'turn_journal_pending_turn', 'repairable', 'audit_only_pending_turn_journal', messageCount(live)), turn_id: turn.id, event: str(turn.latest.event) });
+        items.push({ ...item(sid, 'turn_journal_pending_turn', 'repairable', 'audit_only_pending_turn_journal', Array.isArray(live?.messages) ? live.messages.length : -1), turn_id: turn.id, event: str(turn.latest.event) });
     }
     return items;
 }
@@ -302,57 +152,51 @@ function pendingJournalTurns(sessionDir, sid, events) {
 function item(session_id, kind, category, recommendation, live_messages = -1, bak_messages = -1) {
     return { session_id, kind, category, recommendation, live_messages, bak_messages };
 }
-function scan(deps) {
-    const dir = deps.store.sessionDir;
-    let names = [];
-    try {
-        names = readdirSync(dir).sort();
+async function scan(deps) {
+    const persisted = await deps.store.persistedIds();
+    return { liveIds: [...persisted].sort(), issues: await deps.store.diagnose(), db: readStateDb(deps.stateDbPath, persisted), tombstoned: await deps.store.loadDeletedTombstone() };
+}
+async function readOnlyRecovery(deps, sid, profile) {
+    if (profile === undefined) {
+        try {
+            profile = (await deps.store.loadMetadataOnly(sid))?.profile ?? deps.profile;
+        }
+        catch {
+            profile = deps.profile;
+        }
     }
-    catch { /* no sessions yet; state.db may still hold some */ }
-    const ids = (suffix) => names.filter((n) => n.endsWith(suffix) && !n.startsWith('_')).map((n) => n.slice(0, -suffix.length));
-    return { dir, liveIds: ids('.json'), backupIds: ids('.json.bak'), db: readStateDb(deps.stateDbPath, dir), tombstoned: deps.store.loadDeletedTombstone() };
+    return await deps.isReadOnly(sid, profile);
 }
-/** Python `audit_session_recovery`: a read-only classification of every recovery finding. */
-export function auditSessionRecovery(deps) {
-    const s = scan(deps);
+export async function auditSessionRecovery(deps) {
+    const s = await scan(deps);
     const items = [];
-    const live = new Set(s.liveIds);
-    for (const sid of s.backupIds.filter((id) => live.has(id))) {
-        const status = inspectBackup(s.dir, sid, deps.stampingSince);
-        if (status.recommend === 'restore')
-            items.push(item(sid, 'shrunken_live', 'repairable', 'restore_from_bak', status.live_messages, status.bak_messages));
-        if (status.recommend === 'manual_review')
-            items.push(item(sid, 'unstamped_legacy_backup', 'unsafe_to_repair', 'manual_review', status.live_messages, status.bak_messages));
-    }
-    // A deleted session with both a surviving backup and a state.db row is reported once (#5504).
     const reportedDeleted = new Set();
-    for (const sid of s.backupIds.filter((id) => !live.has(id))) {
-        const bakMessages = messageCount(readDoc(join(s.dir, `${sid}.json.bak`)));
-        if (bakMessages < 0 || !isSafeSessionId(sid))
-            items.push(item(sid, 'malformed_orphan_backup', 'unsafe_to_repair', 'manual_review', -1, bakMessages));
-        else if (s.tombstoned.has(sid)) {
-            reportedDeleted.add(sid);
-            items.push(item(sid, 'state_db_deleted_webui_tombstone', 'unsafe_to_repair', 'deleted_session_skipped', -1, bakMessages));
-        }
-        else if (s.db.has(sid))
-            items.push(item(sid, 'orphan_backup', 'repairable', 'restore_from_bak', -1, bakMessages));
-        else
-            items.push(item(sid, 'orphan_backup_without_state_row', 'unsafe_to_repair', 'manual_review', -1, bakMessages));
-    }
-    if (existsSync(deps.store.indexFile)) {
-        let indexed = null;
-        try {
-            indexed = new Set(deps.store.readIndexEntries().map((e) => e.session_id).filter((id) => typeof id === 'string'));
+    for (const issue of s.issues) {
+        const { profile } = issue;
+        const finding = { ...issue };
+        delete finding.profile;
+        delete finding.revision;
+        delete finding.backupRevision;
+        if (finding.kind === 'index_missing_file' && s.tombstoned.has(finding.session_id))
+            continue;
+        if (finding.kind === 'orphan_backup') {
+            if (s.tombstoned.has(finding.session_id)) {
+                reportedDeleted.add(finding.session_id);
+                finding.kind = 'state_db_deleted_webui_tombstone';
+                finding.category = 'unsafe_to_repair';
+                finding.recommendation = 'deleted_session_skipped';
+            }
+            else if (!s.db.has(finding.session_id)) {
+                finding.kind = 'orphan_backup_without_state_row';
+                finding.category = 'unsafe_to_repair';
+                finding.recommendation = 'manual_review';
+            }
         }
-        catch {
-            items.push(item('', 'index_unreadable', 'repairable', 'rebuild_index'));
+        if (finding.recommendation === 'restore_from_bak' && await readOnlyRecovery(deps, finding.session_id, profile)) {
+            finding.category = 'unsafe_to_repair';
+            finding.recommendation = 'manual_review';
         }
-        if (indexed)
-            for (const sid of [...indexed].filter((id) => !live.has(id) && !s.tombstoned.has(id)).sort())
-                items.push(item(sid, 'index_missing_file', 'repairable', 'rebuild_index'));
-        if (indexed)
-            for (const sid of s.liveIds.filter((id) => !indexed.has(id)))
-                items.push(item(sid, 'index_missing_entry', 'repairable', 'rebuild_index', messageCount(readDoc(join(s.dir, `${sid}.json`)))));
+        items.push(finding);
     }
     for (const row of s.db.missing) {
         if (reportedDeleted.has(row.id))
@@ -366,72 +210,49 @@ export function auditSessionRecovery(deps) {
     }
     if (s.db.unreadable)
         items.push(item('', 'state_db_unreadable', 'unsafe_to_repair', 'manual_review'));
-    for (const [sid, events] of readTurnJournals(s.dir))
-        items.push(...pendingJournalTurns(s.dir, sid, events));
-    const summary = { ok: s.liveIds.length, repairable: 0, unsafe_to_repair: 0 };
-    for (const i of items)
-        summary[i.category] += 1;
-    return { status: summary.unsafe_to_repair ? 'needs_manual_review' : summary.repairable ? 'warn' : 'ok', summary, items };
-}
-// ── repair ───────────────────────────────────────────────────────────────
-/** Write `text` to a synced sibling temp file and publish it: replace `target`, or with `create` only when it is absent. */
-function publish(target, text, create) {
-    const tmp = `${target}.recover.tmp.${String(process.pid)}.${String(++tmpCounter)}`;
-    try {
-        const fd = openSync(tmp, 'w');
-        try {
-            writeFully(fd, text);
-            fsyncSync(fd);
-        }
-        finally {
-            closeSync(fd);
-        }
-        if (!create) {
-            renameSync(tmp, target);
-            return true;
-        }
-        // A link never replaces a sidecar a concurrent save created after the check.
+    for (const [sid, events] of await deps.store.deps.storage.journals.recoveryEvents()) {
+        let doc = null;
         try {
-            linkSync(tmp, target);
-            return true;
-        }
-        catch (error) {
-            if (error.code === 'EEXIST')
-                return false;
-            throw error;
+            if (await deps.store.exists(sid))
+                doc = { messages: await deps.store.readMessages(sid, { start: 0, end: Infinity }) };
         }
+        catch { /* corrupt */ }
+        items.push(...pendingJournalTurns(doc, sid, events));
     }
-    finally {
-        try {
-            unlinkSync(tmp);
+    for (const finding of items)
+        if (finding.recommendation === 'materialize_from_state_db' && await readOnlyRecovery(deps, finding.session_id)) {
+            finding.category = 'unsafe_to_repair';
+            finding.recommendation = 'manual_review';
         }
-        catch { /* renamed */ }
-    }
+    const summary = { ok: s.liveIds.length, repairable: 0, unsafe_to_repair: 0 };
+    for (const i of items)
+        summary[i.category] += 1;
+    return { status: summary.unsafe_to_repair ? 'needs_manual_review' : summary.repairable ? 'warn' : 'ok', summary, items };
 }
-/** A resident session with a live turn would overwrite any restored file on its next save. */
 function busy(store, sid) {
     const s = store.sessions.get(sid);
     return Boolean(s && (s.active_stream_id || s.pending_user_message || s.pending_started_at));
 }
-/** Restore shrunken and orphaned sidecars from their backups, each re-checked under the session lock. */
 async function restoreBackups(deps, s) {
     const { store } = deps;
-    const live = new Set(s.liveIds);
-    const orphans = s.backupIds.filter((sid) => !live.has(sid) && isSafeSessionId(sid) && !s.tombstoned.has(sid) && s.db.has(sid) && messageCount(readDoc(join(s.dir, `${sid}.json.bak`))) >= 0);
+    const orphans = s.issues.filter((i) => i.kind === 'orphan_backup' && !s.tombstoned.has(i.session_id) && s.db.has(i.session_id));
     const result = { scanned: s.liveIds.length + orphans.length, restored: 0, orphaned_backups: orphans.length, details: [] };
-    for (const sid of [...s.backupIds.filter((id) => live.has(id) && isSafeSessionId(id)), ...orphans]) {
-        await store.withLock(sid, () => {
-            const status = inspectBackup(s.dir, sid, deps.stampingSince);
-            const path = store.pathFor(sid);
-            if (status.recommend !== 'restore' || (!existsSync(path) && store.wasDeleted(sid)))
+    for (const issue of [...s.issues.filter((i) => i.kind === 'shrunken_live'), ...orphans]) {
+        const sid = issue.session_id;
+        await store.withLock(sid, async () => {
+            if (!await store.exists(sid) && await store.wasDeleted(sid))
+                return;
+            const counts = { live_messages: issue.live_messages, bak_messages: issue.bak_messages };
+            if (await readOnlyRecovery(deps, sid, issue.profile)) {
+                result.details.push({ session_id: sid, restored: false, ...counts, skipped: 'read_only' });
                 return;
-            const counts = { live_messages: status.live_messages, bak_messages: status.bak_messages };
+            }
             if (busy(store, sid)) {
                 result.details.push({ session_id: sid, restored: false, ...counts, skipped: 'session_active' });
                 return;
             }
             try {
-                if (!publish(path, readFileSync(`${path}.bak`, 'utf8'), !existsSync(path))) {
+                if (!await store.repair(issue)) {
                     result.details.push({ session_id: sid, restored: false, ...counts, skipped: 'sidecar_appeared' });
                     return;
                 }
@@ -440,66 +261,62 @@ async function restoreBackups(deps, s) {
                 result.details.push({ session_id: sid, restored: false, ...counts, error: error.message });
                 return;
             }
-            store.sessions.delete(sid);
-            store.invalidatePersistedIds();
             result.restored += 1;
             result.details.push({ session_id: sid, restored: true, ...counts });
-            deps.log(`[webui] WARNING: session recovery restored ${sid} from .bak (live=${String(status.live_messages)} -> bak=${String(status.bak_messages)} messages)`);
+            deps.log(`[webui] WARNING: session recovery restored ${sid} from its backup (live=${String(issue.live_messages)} -> bak=${String(issue.bak_messages)} messages)`);
         });
     }
     return result;
 }
-/** Python `recover_missing_sidecars_from_state_db`: create each missing WebUI sidecar that state.db can rebuild. */
 async function materializeSidecars(deps, s) {
     const { store } = deps;
     const rows = s.db.missing.filter((row) => row.messages.length && !s.tombstoned.has(row.id));
     const result = { scanned: rows.length, materialized: 0, details: [] };
     for (const row of rows) {
-        await store.withLock(row.id, () => {
-            if (store.wasDeleted(row.id))
+        await store.withLock(row.id, async () => {
+            if (await store.wasDeleted(row.id))
+                return;
+            if (await readOnlyRecovery(deps, row.id)) {
+                result.details.push({ session_id: row.id, materialized: false, skipped: 'read_only' });
                 return;
+            }
             if (busy(store, row.id)) {
                 result.details.push({ session_id: row.id, materialized: false, skipped: 'session_active' });
                 return;
             }
             try {
-                mkdirSync(s.dir, { recursive: true });
-                if (!publish(store.pathFor(row.id), JSON.stringify(sidecarFromStateDbRow(row, store, deps.profile), null, 2), true)) {
+                if (await store.exists(row.id)) {
                     result.details.push({ session_id: row.id, materialized: false, skipped: 'sidecar_appeared_during_reconcile' });
                     return;
                 }
+                await store.save(new Session((await sidecarFromStateDbRow(row, store, deps.profile)), (await store.deps.defaults(deps.profile))), { touchUpdatedAt: false, skipIndex: true });
             }
             catch (error) {
                 result.details.push({ session_id: row.id, materialized: false, error: error.message });
                 return;
             }
             store.sessions.delete(row.id);
-            store.invalidatePersistedIds();
             result.materialized += 1;
             result.details.push({ session_id: row.id, materialized: true, messages: row.messages.length });
         });
     }
     return result;
 }
-/**
- * Python `repair_safe_session_recovery`: restore repairable backups, materialize missing sidecars from state.db, rebuild
- * the index from the sidecars on disk, and audit again. `clean` holds only when the second audit has no finding.
- */
 export async function repairSafeSessionRecovery(deps) {
-    const before = auditSessionRecovery(deps);
-    const s = scan(deps);
+    const before = await auditSessionRecovery(deps);
+    const s = await scan(deps);
     const backupRepair = await restoreBackups(deps, s);
     const sidecarRepair = await materializeSidecars(deps, s);
-    const reindex = backupRepair.restored || sidecarRepair.materialized || !existsSync(deps.store.indexFile) || before.items.some((i) => i.recommendation === 'rebuild_index');
-    if (reindex && existsSync(s.dir)) {
+    const reindex = backupRepair.restored || sidecarRepair.materialized || !await deps.store.hasIndex() || before.items.some((i) => i.recommendation === 'rebuild_index');
+    if (reindex) {
         try {
-            deps.store.rebuildIndex({ diskOnly: true });
+            await deps.store.rebuildIndex({ diskOnly: true });
         }
         catch (error) {
             deps.log(`[webui] WARNING: session recovery index rebuild failed: ${error.message}`);
         }
     }
-    const after = auditSessionRecovery(deps);
+    const after = await auditSessionRecovery(deps);
     const clean = after.summary.repairable === 0 && after.summary.unsafe_to_repair === 0;
     return { clean, ok: clean, repaired: backupRepair.restored + sidecarRepair.materialized, before, backup_repair: backupRepair, sidecar_repair: sidecarRepair, after };
 }