@morlay/ui-conversation-message-actions 0.0.14-alpha.0 → 0.0.14-alpha.2

package/dist/testing.mjs

@@ -1,10 +1,10 @@
-import { n as SessionEditor } from "./src-Da2ZVKlq.mjs";
+import { n as SessionEditor } from "./src-DqUEYw-N.mjs";
 import { createRequire } from "node:module";
 import { Context, Service } from "@deepseek-ai/cordis";
+import { KNOWN_SESSION_EVENT_TYPES, SESSION_FORMAT_VERSION, Session, Session as Session$1, SessionId, SessionId as SessionIdBrand, SessionLogOffset, SessionSeq, SessionSeq as SessionSeq$1, SessionStore } from "@deepseek-ai/dsh-session";
 import { SessionBranch, SessionBranchError, balanceRewindPrefix, buildTimeline } from "@morlay/session-branch";
-import crypto, { randomUUID } from "node:crypto";
+import crypto, { createHash, randomUUID } from "node:crypto";
 import { TokenMeter } from "@deepseek-ai/dsh-token-meter";
-import { KNOWN_SESSION_EVENT_TYPES, SESSION_FORMAT_VERSION, Session, Session as Session$1, SessionId, SessionId as SessionIdBrand, SessionLogOffset, SessionSeq, SessionSeq as SessionSeq$1, SessionStore } from "@deepseek-ai/dsh-session";
 import SessionProjectionRegistry from "@deepseek-ai/dsh-session-projection";
 import { SessionAlreadyExistsError, SessionAlreadyOwnedError, SessionHandleClosedError, SessionPersistence, SessionPersistenceNotFoundError, SessionPersistenceRevision, SessionReadOnlyError, assertContiguous, assertVersion, materializeAppendBatch, materializeCreateHeader, validateStoredEvents } from "@deepseek-ai/dsh-session-persistence";
 import { dirname, isAbsolute, join, resolve } from "node:path";
@@ -14130,7 +14130,7 @@ var CompiledSessionFormatChain = class {
 	}
 	createStream(sourceHeader, sourceCut, output) {
 		let header = sourceHeader;
-		const validatedSourceCut = sessionFormatCount(sourceCut, "Session inherited event count");
+		const validatedSourceCut = sourceCut === void 0 ? void 0 : sessionFormatCount(sourceCut, "Session inherited event count");
 		let inheritedEventCount = validatedSourceCut;
 		const stages = [];
 		const plan = this.plan(header.version);
@@ -14152,11 +14152,7 @@ var CompiledSessionFormatChain = class {
 				migration,
 				stage
 			});
-			if (index + 1 < plan.length) {
-				const targetCut = stage.headerInheritedEventCount;
-				if (targetCut === void 0) throw new SessionFormatError(`${migration.name} must expose its inherited cut before the next migration`);
-				inheritedEventCount = targetCut;
-			}
+			inheritedEventCount = stage.headerInheritedEventCount;
 		}
 		return new CompiledSessionFormatMigrationStream(header, validatedSourceCut, stages, output);
 	}
@@ -14243,7 +14239,7 @@ var CompiledSessionFormatMigrationStream = class {
 	finish() {
 		let inheritedEventCount = this.sourceInheritedEventCount;
 		for (const stage of this.stages) inheritedEventCount = stage.finish();
-		return inheritedEventCount;
+		return sessionFormatCount(inheritedEventCount, "finished Session inherited event count");
 	}
 };
 function throwUnsupportedRefusal(migration, error, subject = "Session") {
@@ -14348,7 +14344,7 @@ function createSessionFormatCatalog(options) {
 		const sourceCut = decoder.headerInheritedEventCount;
 		if (storedVersion === chain.currentVersion) return new CurrentSessionFormatRestore(decoder, sourceCut, restoreOptions.validation === "current" ? options.restoreCurrent : identityArtifact, chain.currentVersion);
 		const collector = new SessionFormatEventCollector();
-		return new MigratingSessionFormatRestore(decoder, sourceCut, chain.createStream(decoder.header, requiredHistoricalCut(storedVersion, sourceCut), collector), collector, restoreOptions.validation === "current" ? options.restoreCurrent : options.restoreTransformedCurrent, restoreOptions.validation, storedVersion, chain.currentVersion);
+		return new MigratingSessionFormatRestore(decoder, sourceCut, chain.createStream(decoder.header, sourceCut, collector), collector, restoreOptions.validation === "current" ? options.restoreCurrent : options.restoreTransformedCurrent, restoreOptions.validation, storedVersion, chain.currentVersion);
 	}
 	return Object.freeze({
 		currentVersion: chain.currentVersion,
@@ -14444,10 +14440,6 @@ function restoreCurrentVersion(artifact, currentVersion) {
 function identityArtifact(artifact) {
 	return artifact;
 }
-function requiredHistoricalCut(version, cut) {
-	if (cut === void 0) throw new SessionFormatError(`format v${version} decoder must expose its inherited cut before migration`);
-	return cut;
-}
 function malformed(targetVersion, error, storedVersion) {
 	return Object.freeze({
 		status: "malformed",
@@ -15918,6 +15910,39 @@ function assertReleasedV1Header(header) {
 	assertReleasedSessionFormatHeader(header, 1);
 }
 /**
+* Validate shared-layout surface references for one released generation.
+* @param record - exact event envelope.
+* @param seq - event position used for earlier-reference checks.
+* @param type - surface event type used in diagnostics.
+* @param assistantSources - whether this generation admits empty Assistant chunk provenance.
+*/
+function assertReleasedSurfaceMetadata(record, seq, type, assistantSources) {
+	const sources = record["sourceEventSeqs"];
+	if (type === "assistant/message" && sources !== void 0 && assistantSources === "forbid-assistant") throw new SessionFormatError(`assistant/message ${seq} retains obsolete chunk provenance`);
+	if (sources !== void 0) {
+		if (!Array.isArray(sources)) throw new SessionFormatError(`${type} ${seq} sourceEventSeqs must be an array`);
+		const seen = /* @__PURE__ */ new Set();
+		for (const source of sources) {
+			const current = sessionFormatCount(source, `${type} ${seq} sourceEventSeqs member`);
+			if (current >= seq || seen.has(current)) throw new SessionFormatError(`${type} ${seq} sourceEventSeqs must be unique earlier seqs`);
+			seen.add(current);
+		}
+		if (sources.length === 0 && type !== "assistant/message") throw new SessionFormatError(`${type} ${seq} sourceEventSeqs must be non-empty`);
+	}
+	const operation = record["surfaceOp"];
+	if (operation === void 0 || operation === "append") return;
+	const replacement = releasedV0Record(operation, `${type} ${seq} surfaceOp`);
+	assertReleasedV0Keys(replacement, [
+		"op",
+		"start",
+		"end"
+	], [], `${type} ${seq} surfaceOp`);
+	if (replacement["op"] !== "replace") throw new SessionFormatError(`${type} ${seq} surfaceOp must replace`);
+	const start = sessionFormatCount(replacement["start"], `${type} ${seq} surface start`);
+	const end = sessionFormatCount(replacement["end"], `${type} ${seq} surface end`);
+	if (start >= seq || end >= seq) throw new SessionFormatError(`${type} ${seq} has an invalid surface replacement`);
+}
+/**
 * Validate one exact known payload after legacy normalization.
 * @param event - known event to validate.
 * @param version - payload generation controlling versioned members.
@@ -16232,7 +16257,7 @@ var ReleasedV0ToV1Stage = class {
 	constructor(input) {
 		this.input = input;
 		assertHeaderVersion(input.sourceHeader, 0);
-		this.headerInheritedEventCount = input.sourceInheritedEventCount;
+		this.headerInheritedEventCount = sessionFormatCount(input.sourceInheritedEventCount, "format v0 inherited event count");
 	}
 	transformEvent(event, context) {
 		const normalized = normalizeReleasedV0Event(event, this.input.sourceHeader.id, this.state);
@@ -16247,7 +16272,7 @@ var ReleasedV0ToV1Stage = class {
 		for (const event of run.expand()) this.transformEvent(event, context);
 	}
 	finish(_context) {
-		return this.input.sourceInheritedEventCount;
+		return this.headerInheritedEventCount;
 	}
 };
 function assertHeaderVersion(header, version) {
@@ -16287,7 +16312,7 @@ function assertSourceDeliveryMarker$1(event, input) {
 	if (event.type !== "session-log-deepseek/delivery-accepted") return;
 	const data = releasedV0Record(event.data, `${event.type} ${event.seq} data`);
 	const acceptedVersion = data["sessionFormatVersion"] ?? 0;
-	const inherited = input.sourceHeader.parentSession !== void 0 && event.seq < input.sourceInheritedEventCount;
+	const inherited = input.sourceHeader.parentSession !== void 0 && event.seq < sessionFormatCount(input.sourceInheritedEventCount, "format v0 inherited event count");
 	if (acceptedVersion === 0 && !inherited && data["sessionId"] !== input.sourceHeader.id) throw new SessionFormatError("current-generation delivery marker names the wrong Session");
 }
 function normalizeLegacyRetry(event, sessionId, retryIds) {
@@ -16597,7 +16622,7 @@ function legacyMessageId(sessionId, seq) {
 function malformedLegacy(sessionId, type, seq) {
 	return new SessionFormatError(`session ${JSON.stringify(sessionId)} contains malformed pre-react-loop ${type} at seq ${seq}`);
 }
-const SURFACE_TYPES$1 = /* @__PURE__ */ new Set([
+const SURFACE_TYPES$2 = /* @__PURE__ */ new Set([
 	"user/message",
 	"assistant/message",
 	"tool/result"
@@ -16626,7 +16651,7 @@ function assertReleasedArtifactRelationships(artifact, extensions = {}) {
 		const extensionStepEvent = extensions.stepEvents?.has(event.type) === true;
 		if (RELEASED_V0_EVENT_DISPOSITIONS[event.type] === void 0 && !extensionStepEvent) continue;
 		const data = releasedV0Record(event.data, `${event.type} ${event.seq} data`);
-		if (SURFACE_TYPES$1.has(event.type)) surface = applySurface(surface, event);
+		if (SURFACE_TYPES$2.has(event.type)) surface = applySurface(surface, event);
 		if ((event.type === "turn/start" || event.type === "turn/end") && openCompaction !== void 0 && !staleCompactionStarts.has(openCompaction.startSeq)) throw new SessionFormatError(`${event.type} crosses an open compaction`);
 		if (extensionStepEvent) {
 			requireOpenStep(event, data, openTurn, openStep);
@@ -16959,7 +16984,7 @@ const EVENT_REQUIRED$1 = [
 	"time",
 	"data"
 ];
-const SURFACE_TYPES = /* @__PURE__ */ new Set([
+const SURFACE_TYPES$1 = /* @__PURE__ */ new Set([
 	"user/message",
 	"assistant/message",
 	"tool/result"
@@ -16991,7 +17016,7 @@ function assertReleasedV2Header(header) {
 	for (const key of ["parentSession", "agentPreset"]) if (record[key] !== void 0 && typeof record[key] !== "string") throw new SessionFormatError(`format v2 header ${key} must be a string`);
 	if (record["origin"] !== void 0 && record["origin"] !== "subagent") throw new SessionFormatError("format v2 header origin must be \"subagent\"");
 }
-function validateReleasedV2Artifact(artifact, mode, knownEventTypes) {
+function validateReleasedV2Artifact(artifact, mode, knownEventTypes, relationshipHeaderVersion = artifact.header.version) {
 	assertReleasedV2Header(artifact.header);
 	const cut = sessionFormatCount(artifact.inheritedEventCount, "format v2 inherited event count");
 	if (cut > artifact.events.length) throw new SessionFormatError("format v2 inherited event count exceeds its events");
@@ -17005,7 +17030,7 @@ function validateReleasedV2Artifact(artifact, mode, knownEventTypes) {
 		const installed = knownEventTypes?.has(type) === true;
 		const ignorableUnknown = disposition === void 0 && record["ignorable"] === true;
 		if (mode === "current" && disposition === void 0 && !installed && !ignorableUnknown) throw new SessionFormatUnsupportedMigrationError(`format v2 contains unknown event type ${JSON.stringify(type)} at seq ${index}`);
-		const surface = disposition !== void 0 && SURFACE_TYPES.has(type);
+		const surface = disposition !== void 0 && SURFACE_TYPES$1.has(type);
 		assertReleasedV2Keys(record, EVENT_REQUIRED$1, mode === "physical" || disposition === void 0 ? SURFACE_OPTIONAL : surface ? SURFACE_OPTIONAL : LOG_OPTIONAL, `format v2 event ${index}`);
 		if (record["seq"] !== index) throw new SessionFormatError(`format v2 event ${index} is not dense`);
 		sessionFormatSafeInteger(record["time"], `format v2 event ${index} time`);
@@ -17016,7 +17041,13 @@ function validateReleasedV2Artifact(artifact, mode, knownEventTypes) {
 	}
 	if (artifact.header.isSeeded && lastInheritedMarker !== cut) throw new SessionFormatError("format v2 seeded header disagrees with its last inherited end-seed marker");
 	if (!artifact.header.isSeeded && lastInheritedMarker !== void 0) throw new SessionFormatError("format v2 unseeded Session contains an inherited end-seed marker");
-	if (mode === "current") assertReleasedArtifactRelationships(artifact, RELEASED_V2_RELATIONSHIP_EXTENSIONS);
+	if (mode === "current") assertReleasedArtifactRelationships({
+		...artifact,
+		header: {
+			...artifact.header,
+			version: relationshipHeaderVersion
+		}
+	}, RELEASED_V2_RELATIONSHIP_EXTENSIONS);
 }
 /**
 * Require one released-v2 value to be a JSON object.
@@ -17046,10 +17077,11 @@ function assertReleasedV2Keys(value, required, optional, label) {
 * Restore and validate one decoded released-v2 artifact.
 * @param artifact - detached vocabulary-restored artifact.
 * @param knownEventTypes - event types understood by the installed current Session package.
+* @param relationshipHeaderVersion - logical generation whose version-sensitive relationships are checked.
 * @returns the same validated artifact.
 */
-function restoreReleasedV2Artifact(artifact, knownEventTypes) {
-	validateReleasedV2Artifact(artifact, "current", knownEventTypes);
+function restoreReleasedV2Artifact(artifact, knownEventTypes, relationshipHeaderVersion = artifact.header.version) {
+	validateReleasedV2Artifact(artifact, "current", knownEventTypes, relationshipHeaderVersion);
 	return artifact;
 }
 const HEADER_REQUIRED = [
@@ -17292,7 +17324,7 @@ var TransformedReleasedV1ToV2Stage = class {
 		assertReleasedV1Header(input.sourceHeader);
 		this.state = {
 			sourceHeader: input.sourceHeader,
-			sourceCut: input.sourceInheritedEventCount,
+			sourceCut: sessionFormatCount(input.sourceInheritedEventCount, "format v1 inherited event count"),
 			mapping: /* @__PURE__ */ new Map(),
 			legacyTurns: legacyTurnState(),
 			pending: void 0,
@@ -17321,7 +17353,7 @@ function transformReleasedEvent(state, event, context) {
 	if (event.type === "assistant/chunk") assertChunkEnvelope(event);
 	if (RELEASED_V0_EVENT_DISPOSITIONS[event.type] === void 0) throw refusal(`format v1 contains unknown event type ${JSON.stringify(event.type)} at seq ${event.seq}`);
 	const interrupted = legacyInterruptedTurn(state.legacyTurns, event);
-	if (event.type === "turn/start" && state.legacyTurns.openTurn !== null && interrupted === void 0) throw refusal(`turn/start ${JSON.stringify(record(event.data)["turn"])} does not close the prior turn`);
+	if (event.type === "turn/start" && state.legacyTurns.openTurn !== null && interrupted === void 0) throw refusal(`turn/start ${JSON.stringify(record$1(event.data)["turn"])} does not close the prior turn`);
 	assertSourceDeliveryMarker(state, event);
 	observeLegacyTurn(state.legacyTurns, event);
 	state.lastTime = event.time;
@@ -17363,7 +17395,7 @@ function assertChunkEnvelope(event) {
 }
 function assertSourceDeliveryMarker(state, event) {
 	if (event.type !== "session-log-deepseek/delivery-accepted") return;
-	const data = record(event.data);
+	const data = record$1(event.data);
 	const inherited = state.sourceHeader.parentSession !== void 0 && event.seq < state.sourceCut;
 	if (data["sessionFormatVersion"] === 1 && !inherited && data["sessionId"] !== state.sourceHeader.id) throw refusal("current-generation delivery marker names the wrong Session");
 }
@@ -17400,10 +17432,10 @@ function finishMigration(state, context) {
 	return state.targetCut;
 }
 function transformChunk(state, event, context) {
-	const data = record(event.data);
+	const data = record$1(event.data);
 	const turn = coordinate(data["turn"]);
 	const step = coordinate(data["step"]);
-	const chunk = record(data["chunk"]);
+	const chunk = record$1(data["chunk"]);
 	if (state.pending !== void 0 && (state.pending.group.terminal || state.pending.group.turn !== turn || state.pending.group.step !== step)) finishAttempt(state, context);
 	else if (state.pending !== void 0) flushBuffered(state, state.pending, context);
 	state.pending ??= {
@@ -17420,7 +17452,7 @@ function transformChunk(state, event, context) {
 	if (chunk["type"] === "finish") state.pending.group.terminal = true;
 }
 function transformMessage(state, event, context) {
-	const data = record(event.data);
+	const data = record$1(event.data);
 	const turn = coordinate(data["turn"]);
 	const step = coordinate(data["step"]);
 	const sources = event.sourceEventSeqs;
@@ -17500,8 +17532,8 @@ function legacyTurnState() {
 	};
 }
 function legacyInterruptedTurn(state, event) {
-	if (event.type !== "turn/start" || state.openTurn === null || state.openStep !== null || coordinate(record(event.data)["turn"]) !== state.openTurn + 1 || state.previous?.type !== "agent/inbox/spliced") return void 0;
-	const splice = record(state.previous.data);
+	if (event.type !== "turn/start" || state.openTurn === null || state.openStep !== null || coordinate(record$1(event.data)["turn"]) !== state.openTurn + 1 || state.previous?.type !== "agent/inbox/spliced") return void 0;
+	const splice = record$1(state.previous.data);
 	if (splice["target"] !== "next-turn" || !Array.isArray(splice["inserted"]) || splice["inserted"].length === 0) return;
 	return {
 		type: "turn/end",
@@ -17514,7 +17546,7 @@ function legacyInterruptedTurn(state, event) {
 	};
 }
 function observeLegacyTurn(state, event) {
-	const data = record(event.data);
+	const data = record$1(event.data);
 	if (event.type === "turn/start") {
 		state.openTurn = coordinate(data["turn"]);
 		state.openStep = null;
@@ -17527,8 +17559,8 @@ function observeLegacyTurn(state, event) {
 }
 function splitLegacyGoalChange(event) {
 	if (event.type !== "user/message") return void 0;
-	const data = record(event.data);
-	const source = record(data["source"]);
+	const data = record$1(event.data);
+	const source = record$1(data["source"]);
 	if (source["kind"] !== "goal" || source["change"] === void 0) return void 0;
 	return {
 		change: {
@@ -17647,7 +17679,7 @@ function streamOf(group) {
 	return group.stream.map(({ record }) => record);
 }
 function messageEvent(source, group) {
-	const data = record(source.data);
+	const data = record$1(source.data);
 	const { sourceEventSeqs: _sourceEventSeqs, ...event } = source;
 	return {
 		...event,
@@ -17674,7 +17706,7 @@ function remapReferences(source, targetSeq, mapping) {
 	const sources = sourceEventSeqs === void 0 ? {} : { sourceEventSeqs: mapList(numberArray(sourceEventSeqs), mapping, `${source.type} ${source.seq} sources`) };
 	let operation = surfaceOp;
 	if (surfaceOp !== void 0 && surfaceOp !== "append") {
-		const replacement = record(surfaceOp);
+		const replacement = record$1(surfaceOp);
 		operation = {
 			op: "replace",
 			start: mapOne(coordinate(replacement["start"]), mapping, `${source.type} ${source.seq} surface start`),
@@ -17690,7 +17722,7 @@ function remapReferences(source, targetSeq, mapping) {
 	};
 }
 function remapPayloadReferences(event, mapping) {
-	const data = record(event.data);
+	const data = record$1(event.data);
 	switch (event.type) {
 		case "command/done": return data["sourceEventSeq"] === void 0 ? data : {
 			...data,
@@ -17698,7 +17730,7 @@ function remapPayloadReferences(event, mapping) {
 		};
 		case "compaction/prune":
 		case "compaction/summary": {
-			const range = record(data["shadowedRange"]);
+			const range = record$1(data["shadowedRange"]);
 			return {
 				...data,
 				shadowedRange: {
@@ -17724,7 +17756,7 @@ function mapOne(value, mapping, label) {
 	if (mapped === void 0) throw refusal(`${label} targets consumed assistant/chunk ${value}`);
 	return mapped;
 }
-function record(value) {
+function record$1(value) {
 	return value;
 }
 function numberArray(value) {
@@ -17737,6 +17769,860 @@ function refusal(message) {
 	return new SessionFormatUnsupportedMigrationError(message);
 }
 //#endregion
+//#region ../../vendor/deepseek-harness/packages/session/session-format-v2-to-v3/lib/index.js
+/** Audited V2 migration admission and V3 payload validation, independent of installed core Session types. */
+/** Audited surface event names; all other admitted events are log-only. */
+const SURFACE_TYPES = /* @__PURE__ */ new Set([
+	"system/message",
+	"user/message",
+	"assistant/message",
+	"tool/result"
+]);
+const SOURCE_KINDS = /* @__PURE__ */ new Set([
+	"user",
+	"plugin",
+	"model",
+	"tool",
+	"agent-instructions",
+	"session-reference",
+	"team-message",
+	"goal",
+	"skill-invocation",
+	"skill-catalog",
+	"coordinator",
+	"subagent-report",
+	"subagent-settled",
+	"webhook",
+	"agent-message"
+]);
+/**
+* Require a JSON object at the durable input boundary.
+* @param value - decoded value.
+* @param label - diagnostic subject.
+* @returns the narrowed object.
+*/
+function record(value, label) {
+	if (!isSessionFormatJsonObject(value)) throw new SessionFormatError(label + " must be an object");
+	return value;
+}
+/**
+* Reject missing and unaudited members rather than guessing whether they contain coordinates.
+* @param value - decoded record.
+* @param required - required member names.
+* @param optional - additional admitted names.
+* @param label - diagnostic subject.
+*/
+function keys(value, required, optional, label) {
+	const missing = required.find((key) => !Object.hasOwn(value, key));
+	const unexpected = Object.keys(value).find((key) => !required.includes(key) && !optional.includes(key));
+	if (missing !== void 0) throw new SessionFormatError(label + " lacks required field " + missing);
+	if (unexpected !== void 0) throw new SessionFormatError(label + " has unexpected field " + unexpected);
+}
+/**
+* Validate classified payloads before migration, or native V3 system/header payloads.
+* @param event - decoded logical event.
+* @param version - source or target generation.
+*/
+function assertEvent(event, version) {
+	if (version === 3) {
+		assertV3Event(event);
+		return;
+	}
+	const disposition = RELEASED_V2_EVENT_DISPOSITIONS[event.type];
+	const feedback = event.type === "feedback/message-put" || event.type === "feedback/message-delete";
+	if (disposition === void 0 && !feedback) throw new SessionFormatUnsupportedMigrationError("format v2 to v3 cannot safely transform unclassified event " + event.type);
+	const surface = SURFACE_TYPES.has(event.type);
+	keys(event, [
+		"type",
+		"seq",
+		"time",
+		"data"
+	], surface ? [
+		"ignorable",
+		"sourceEventSeqs",
+		"surfaceOp"
+	] : ["ignorable"], event.type);
+	sessionFormatCount(event.seq, "event seq");
+	sessionFormatSafeInteger(event.time, "event time");
+	if (event["ignorable"] !== void 0 && event["ignorable"] !== true) throw new SessionFormatError("ignorable must be true");
+	if (surface) {
+		assertReleasedSurfaceMetadata(event, event.seq, event.type, "forbid-assistant");
+		if (event["surfaceOp"] === void 0) throw new SessionFormatError(event.type + " requires surfaceOp");
+	}
+	const data = record(event.data, event.type + " data");
+	if (feedback) {
+		assertFeedback(event.type, data);
+		return;
+	}
+	const admitted = disposition;
+	keys(data, admitted.required, admitted.optional, event.type + " data");
+	assertOwnedContent(event, data);
+	if (event.type !== "assistant/attempt") assertReleasedPayloadSemantics(event, version);
+	if (event.type === "assistant/message" || event.type === "assistant/attempt") {
+		for (const coordinate of ["turn", "step"]) if (sessionFormatCount(data[coordinate], coordinate) === 0) throw new SessionFormatError(coordinate + " must be positive");
+	}
+	if (event.type === "session/end-seed" && data["inherited"] !== void 0 && data["inherited"] !== true) throw new SessionFormatError("session/end-seed inherited must be true");
+	if (event.type === "user/message") assertSource(data);
+	if (event.type === "assistant/message" || event.type === "tool/result") assertSource(record(data["message"], "message"));
+	if (event.type === "tool/result" && isSessionFormatJsonObject(data["error"]) && data["error"]["code"] === "TOOL_NOT_STARTED") {
+		const message = record(data["message"], "tool result message");
+		const source = record(message["source"], "tool result source");
+		if (!isRepairIdentity(message["id"], source["callId"])) throw new SessionFormatError("TOOL_NOT_STARTED repair requires its canonical historical message id");
+	}
+	if (event.type === "agent/inbox/spliced" || event.type === "session/title-llm-request") {
+		const messages = data[event.type === "agent/inbox/spliced" ? "inserted" : "messages"];
+		for (const message of messages) assertSource(message);
+	}
+}
+/**
+* Recognize stable generated repair IDs without interpreting their historical suffix as a current coordinate.
+* @param id - durable message identity.
+* @param callId - advertised tool identity.
+* @returns whether the identity has the canonical historical repair form.
+*/
+function isRepairIdentity(id, callId) {
+	if (typeof callId !== "string") return false;
+	const prefix = "interrupted-tool-result-" + callId + "-";
+	if (typeof id !== "string" || !id.startsWith(prefix)) return false;
+	const suffix = id.slice(prefix.length);
+	return /^(0|[1-9]\d*)$/.test(suffix) && Number.isSafeInteger(Number(suffix));
+}
+function assertSource(message) {
+	const source = record(message["source"], "message source");
+	if (typeof source["kind"] !== "string" || !SOURCE_KINDS.has(source["kind"])) throw new SessionFormatUnsupportedMigrationError("cannot safely transform unclassified message source");
+	if (source["kind"] === "agent-message") {
+		keys(source, [
+			"kind",
+			"form",
+			"senderSessionId"
+		], [], "agent-message source");
+		if (source["form"] !== "relay" || typeof source["senderSessionId"] !== "string" || source["senderSessionId"].length === 0) throw new SessionFormatError("agent-message source requires relay form and senderSessionId");
+	}
+}
+const CONTENT_KINDS = /* @__PURE__ */ new Set([
+	"text",
+	"reasoning",
+	"image",
+	"file",
+	"tool-call",
+	"tool-result"
+]);
+function contentArray(value, label) {
+	if (!Array.isArray(value)) throw new SessionFormatError(label + ": content must be an array");
+	return value;
+}
+function assertOwnedContent(event, data) {
+	const label = "format v2 " + event.type + " at seq " + String(event.seq) + " data";
+	switch (event.type) {
+		case "user/message":
+		case "tool/code-dispatch":
+			assertContentKinds(data["content"], label + ".content");
+			break;
+		case "assistant/message":
+		case "tool/result":
+		case "team/message/queued":
+			assertContentKinds(record(data["message"], label + ".message")["content"], label + ".message.content");
+			break;
+		case "agent/inbox/spliced":
+		case "session/title-llm-request": {
+			const field = event.type === "agent/inbox/spliced" ? "inserted" : "messages";
+			for (const [index, value] of contentArray(data[field], label + "." + field).entries()) {
+				const path = label + "." + field + "[" + String(index) + "]";
+				assertContentKinds(record(value, path)["content"], path + ".content");
+			}
+			break;
+		}
+		case "compaction/summary":
+			assertContentKinds(data["summary"], label + ".summary");
+			if (data["rawOutput"] !== void 0) assertContentKinds(data["rawOutput"], label + ".rawOutput");
+	}
+	if (event.type === "assistant/message" || event.type === "assistant/attempt") for (const [index, value] of contentArray(data["stream"], label + ".stream").entries()) {
+		const path = label + ".stream[" + String(index) + "]";
+		const entry = record(value, path);
+		if (entry["type"] !== "chunk") continue;
+		const chunk = record(entry["chunk"], path + ".chunk");
+		if (chunk["type"] === "block-end") assertContentBlock(chunk["block"], path + ".chunk.block");
+		if (chunk["type"] === "block-start") assertContentKind(chunk["blockType"], path + ".chunk.blockType");
+	}
+}
+function assertContentKind(kind, label) {
+	if (typeof kind !== "string" || !CONTENT_KINDS.has(kind)) throw new SessionFormatUnsupportedMigrationError(label + ": cannot safely transform unclassified message content kind " + JSON.stringify(kind));
+}
+function assertContentKinds(content, label) {
+	for (const [index, value] of contentArray(content, label).entries()) assertContentBlock(value, label + "[" + String(index) + "]");
+}
+function assertContentBlock(value, label) {
+	const block = record(value, label);
+	assertContentKind(block["type"], label);
+	if (block["type"] === "tool-result") {
+		if (!Array.isArray(block["content"])) throw new SessionFormatError(label + ".content: invalid message content kind \"tool-result\": content must be an array");
+		assertContentKinds(block["content"], label + ".content");
+	}
+	if (block["type"] === "file") {
+		keys(block, ["type", "attachment"], [], label + " kind \"file\"");
+		const attachment = record(block["attachment"], label + " kind \"file\" attachment");
+		keys(attachment, [
+			"attachmentId",
+			"name",
+			"bytes"
+		], [], label + " kind \"file\" attachment");
+		if (typeof attachment["attachmentId"] !== "string" || attachment["attachmentId"].length === 0 || typeof attachment["name"] !== "string") throw new SessionFormatError(label + " kind \"file\": file attachment requires attachmentId and name");
+		sessionFormatCount(attachment["bytes"], label + " kind \"file\" attachment bytes");
+		return;
+	}
+	const probe = {
+		type: "user/message",
+		seq: 0,
+		time: 0,
+		data: {
+			id: "content-admission",
+			role: "user",
+			source: { kind: "user" },
+			content: [block["type"] === "tool-result" ? {
+				...block,
+				content: []
+			} : block]
+		}
+	};
+	try {
+		assertReleasedPayloadSemantics(probe, 2);
+	} catch (error) {
+		throw new SessionFormatError(label + ": invalid message content kind " + JSON.stringify(block["type"]) + ": " + String(error));
+	}
+}
+/**
+* Reject V3 structural payload violations even beyond a recoverable physical-row failure.
+* @param value - raw physical row; ordinary rows retain the frozen decoder's recovery policy.
+*/
+function assertV3StructuralRow(value) {
+	if (typeof value !== "object" || value === null || Array.isArray(value)) return;
+	const row = value;
+	if (row["type"] === "request/header") {
+		const data = record(row["data"], "request/header data");
+		if (Object.hasOwn(record(data["header"], "request header"), "system")) throw new SessionFormatUnsupportedMigrationError("format v3 request/header rejects retired header.system");
+	} else if (row["type"] === "system/message") {
+		const data = record(row["data"], "system/message data");
+		assertSystem({
+			type: "system/message",
+			seq: 0,
+			time: 0,
+			data
+		}, data);
+	}
+}
+function assertSystem(event, data) {
+	keys(data, [
+		"turn",
+		"step",
+		"message"
+	], [], "system/message data");
+	for (const coordinate of ["turn", "step"]) if (sessionFormatCount(data[coordinate], coordinate) === 0) throw new SessionFormatError(coordinate + " must be positive");
+	const message = record(data["message"], "system message");
+	keys(message, [
+		"id",
+		"role",
+		"source",
+		"content"
+	], [], "system message");
+	if (typeof message["id"] !== "string" || message["id"].length === 0 || message["role"] !== "system") throw new SessionFormatError("system message requires an id and system role");
+	const source = record(message["source"], "system source");
+	if (source["kind"] !== "plugin" || typeof source["plugin"] !== "string" || source["plugin"].length === 0) throw new SessionFormatError("system message requires plugin source");
+	assertReleasedPayloadSemantics({
+		...event,
+		type: "user/message",
+		data: {
+			...message,
+			role: "user"
+		}
+	}, 3);
+}
+function assertFeedback(type, data) {
+	keys(data, type === "feedback/message-put" ? ["sessionId", "item"] : ["sessionId", "messageId"], [], type);
+	if (typeof data["sessionId"] !== "string") throw new SessionFormatError("feedback sessionId must be a string");
+	if (type === "feedback/message-delete") {
+		if (typeof data["messageId"] !== "string") throw new SessionFormatError("feedback messageId must be a string");
+		return;
+	}
+	const item = record(data["item"], "feedback item");
+	keys(item, [
+		"messageId",
+		"rating",
+		"version",
+		"createdAt",
+		"updatedAt"
+	], ["note"], "feedback item");
+	for (const key of ["messageId", "version"]) if (typeof item[key] !== "string") throw new SessionFormatError("feedback " + key + " must be a string");
+	if (item["rating"] !== "positive" && item["rating"] !== "negative") throw new SessionFormatError("invalid feedback rating");
+	if (item["note"] !== void 0 && typeof item["note"] !== "string") throw new SessionFormatError("feedback note must be a string");
+	sessionFormatCount(item["createdAt"], "feedback createdAt");
+	sessionFormatCount(item["updatedAt"], "feedback updatedAt");
+}
+/**
+* Validate one canonical V3 event without interpreting plugin-owned payloads or log relationships.
+* Unclassified metadata is deferred to vocabulary-aware restoration; unknown required types must not become recoverable corruption.
+* @param event - decoded logical event.
+* @param knownEventTypes - additional installed event types whose envelopes are interpreted.
+*/
+function assertV3Event(event, knownEventTypes) {
+	const value = record(event, "format v3 event");
+	const subject = `format v3 ${event.type} at seq ${event.seq}`;
+	const opaque = !(!(event.type === "tool/code-dispatch-start" || event.type === "tool/code-dispatch") && (SURFACE_TYPES.has(event.type) || RELEASED_V2_EVENT_DISPOSITIONS[event.type] !== void 0 || event.type === "tool/ptc-dispatch-start" || event.type === "tool/ptc-dispatch" || event.type === "feedback/message-put" || event.type === "feedback/message-delete" || knownEventTypes?.has(event.type) === true));
+	keys(value, [
+		"type",
+		"seq",
+		"time",
+		"data"
+	], SURFACE_TYPES.has(event.type) || opaque ? [
+		"ignorable",
+		"surfaceOp",
+		"sourceEventSeqs"
+	] : ["ignorable"], subject);
+	if (typeof event.type !== "string") throw new SessionFormatError(`${subject} type must be a string`);
+	sessionFormatCount(event.seq, `${subject} seq`);
+	sessionFormatSafeInteger(event.time, `${subject} time`);
+	if (Object.hasOwn(value, "ignorable") && value["ignorable"] !== true) throw new SessionFormatError(`${subject} ignorable must be true when present`);
+	if (SURFACE_TYPES.has(event.type)) {
+		const operation = value["surfaceOp"];
+		if (operation === void 0) throw new SessionFormatError(`${subject} requires a surfaceOp marker`);
+		if (operation !== "append") {
+			const replace = record(operation, `${subject} surfaceOp`);
+			if (Object.keys(replace).length !== 3 || replace["op"] !== "replace" || !Object.hasOwn(replace, "startSeq") || !Object.hasOwn(replace, "endSeq")) throw new SessionFormatError(`${subject} requires exact replace fields op/startSeq/endSeq`);
+			for (const key of ["startSeq", "endSeq"]) if (sessionFormatCount(replace[key], `${subject} surfaceOp ${key}`) >= event.seq) throw new SessionFormatError(`${subject} replacement endpoints must reference earlier events`);
+		}
+		const sources = value["sourceEventSeqs"];
+		if (event.type === "assistant/message" && sources !== void 0) throw new SessionFormatError(`${subject} embeds its stream and cannot carry sourceEventSeqs`);
+		if (sources !== void 0) {
+			if (!Array.isArray(sources) || sources.length === 0) throw new SessionFormatError(`${subject} sourceEventSeqs must be a non-empty array`);
+			const seen = /* @__PURE__ */ new Set();
+			for (const source of sources) {
+				const seq = sessionFormatCount(source, `${subject} sourceEventSeqs member`);
+				if (seq >= event.seq || seen.has(seq)) throw new SessionFormatError(`${subject} sourceEventSeqs must be unique earlier seqs`);
+				seen.add(seq);
+			}
+		}
+	}
+	assertV3StructuralRow(event);
+	assertCanonicalPayload(event);
+}
+function assertCanonicalPayload(event) {
+	const subject = `format v3 ${event.type} at seq ${event.seq}`;
+	if (event.type === "request/header") {
+		const header = record(record(event.data, `${subject} data`)["header"], `${subject} header`);
+		if (Array.isArray(header["tools"]) && header["tools"].length === 0 || isSessionFormatJsonObject(header["adapterDefaults"]) && Object.keys(header["adapterDefaults"]).length === 0) throw new SessionFormatError(`${subject} empty optional header fields must be omitted`);
+	}
+	if (event.type !== "tool/result") return;
+	const data = record(event.data, `${subject} data`);
+	if (data["error"] === void 0) return;
+	const content = record(data["message"], `${subject} message`)["content"];
+	if (!Array.isArray(content) || content.length !== 1 || !isSessionFormatJsonObject(content[0]) || content[0]["type"] !== "tool-result" || content[0]["isError"] !== true) throw new SessionFormatError(`${subject} carries error metadata for a non-error tool result`);
+}
+/**
+* Canonicalize structurally transformed events without changing their target coordinates.
+* @param event - transformed event using released replacement names and target coordinates.
+* @returns a V3 event sharing all unchanged payloads and reference values.
+*/
+function canonicalizeTransformedEvent(event) {
+	let target = event;
+	const operation = event["surfaceOp"];
+	if (operation !== void 0 && operation !== "append") {
+		const replace = record(operation, `format v2 ${event.type} at seq ${event.seq} surfaceOp`);
+		if (Object.keys(replace).length !== 3 || replace["op"] !== "replace" || !Object.hasOwn(replace, "start") || !Object.hasOwn(replace, "end")) throw new SessionFormatError(`format v2 ${event.type} at seq ${event.seq} requires exact replace fields op/start/end`);
+		target = {
+			...event,
+			surfaceOp: {
+				op: "replace",
+				startSeq: sessionFormatCount(replace["start"], `format v2 ${event.type} at seq ${event.seq} replace start`),
+				endSeq: sessionFormatCount(replace["end"], `format v2 ${event.type} at seq ${event.seq} replace end`)
+			}
+		};
+	}
+	if (event.type === "request/header") {
+		const data = record(event.data, `format v2 request/header at seq ${event.seq} data`);
+		const header = record(data["header"], `format v2 request/header at seq ${event.seq} header`);
+		const empty = Object.keys(header).filter((key) => key === "tools" && Array.isArray(header[key]) && header[key].length === 0 || key === "adapterDefaults" && isSessionFormatJsonObject(header[key]) && Object.keys(header[key]).length === 0);
+		if (empty.length > 0) {
+			const canonical = Object.fromEntries(Object.entries(header).filter(([key]) => !empty.includes(key)));
+			target = {
+				...target,
+				data: {
+					...data,
+					header: canonical
+				}
+			};
+		}
+	}
+	assertV3Event(target);
+	return target;
+}
+/** Native V3 system-head validation with a private view for frozen non-system relationships. */
+/**
+* Validate v3 logical metadata with the released-v2 fields.
+* @param header - decoded v3 Session header.
+*/
+function assertReleasedV3Header(header) {
+	if (header.version !== 3) throw new SessionFormatError("expected format v3 header");
+	assertReleasedV2Header({
+		...header,
+		version: 2
+	});
+}
+/**
+* Validate system ownership, protected-head operations, ordinary relationships, and inherited cut.
+* The private relationship view never escapes; the returned artifact and its messages are unchanged.
+* @param artifact - detached v3 artifact.
+* @param knownEventTypes - event types understood by the installed Session package.
+* @returns the same validated artifact.
+*/
+function restoreReleasedV3Artifact(artifact, knownEventTypes) {
+	assertReleasedV3Header(artifact.header);
+	let step;
+	let head;
+	let hasSurface = false;
+	const events = artifact.events.map((event) => {
+		assertV3EventAdmission(event);
+		assertV3Event(event, knownEventTypes);
+		const system = event.type === "system/message";
+		if (event.type === "step/start") {
+			const data = record(event.data, event.type);
+			step = {
+				turn: data["turn"],
+				step: data["step"]
+			};
+		} else if (event.type === "step/end" || event.type === "turn/end") step = void 0;
+		if (system) {
+			const data = record(event.data, "system/message");
+			if (step === void 0 || step.turn !== data["turn"] || step.step !== data["step"]) throw new SessionFormatError("system/message does not match an open step");
+			const operation = event["surfaceOp"];
+			if (hasSurface && head === void 0) throw new SessionFormatError("system/message requires a protected first surface head");
+			if (operation === "append") {
+				if (!hasSurface) head = event.seq;
+			} else {
+				const replace = record(operation, "system replacement");
+				if (replace["startSeq"] === head || replace["endSeq"] === head) {
+					if (replace["startSeq"] !== head || replace["endSeq"] !== head) throw new SessionFormatError("system/message must replace exactly the current system head");
+					head = event.seq;
+				}
+			}
+		} else if (SURFACE_TYPES.has(event.type) && event["surfaceOp"] !== "append") {
+			const replace = record(event["surfaceOp"], "surface replacement");
+			if (replace["startSeq"] === head || replace["endSeq"] === head) throw new SessionFormatError("surface replacement cannot shadow the protected system head");
+		}
+		if (event.type === "compaction/prune" || event.type === "compaction/summary") {
+			const seqs = record(event.data, event.type)["shadowedSeqs"];
+			if (Array.isArray(seqs) && seqs.some((seq) => seq === head)) throw new SessionFormatError("compaction cannot shadow the protected system head");
+		}
+		if (SURFACE_TYPES.has(event.type)) hasSurface = true;
+		const projected = relationshipEvent(event);
+		if (!SURFACE_TYPES.has(event.type) || event["surfaceOp"] === "append") return projected;
+		const replacement = event["surfaceOp"];
+		return {
+			...projected,
+			surfaceOp: {
+				op: "replace",
+				start: replacement.startSeq,
+				end: replacement.endSeq
+			}
+		};
+	});
+	restoreReleasedV2Artifact({
+		...artifact,
+		header: {
+			...artifact.header,
+			version: 2
+		},
+		events
+	}, knownEventTypes, 3);
+	return artifact;
+}
+/**
+* Refuse required predecessor PTC tags without interpreting native extension payloads.
+* @param event - event envelope whose type and ignorable admission markers are available.
+*/
+function assertV3EventAdmission(event) {
+	if ((event.type === "tool/code-dispatch-start" || event.type === "tool/code-dispatch") && event["ignorable"] !== true) throw new SessionFormatUnsupportedMigrationError("format v3 contains unknown event type " + JSON.stringify(event.type) + " at seq " + String(event.seq));
+}
+function relationshipEvent(event) {
+	switch (event.type) {
+		case "tool/ptc-dispatch-start": return {
+			...event,
+			type: "tool/code-dispatch-start"
+		};
+		case "tool/ptc-dispatch": return {
+			...event,
+			type: "tool/code-dispatch"
+		};
+		case "tool/code-dispatch-start":
+		case "tool/code-dispatch":
+			assertV3EventAdmission(event);
+			return {
+				...event,
+				type: "v3/opaque-released-event"
+			};
+	}
+	if (event.type === "system/message") {
+		const message = record(record(event.data, "system data")["message"], "system message");
+		return {
+			...event,
+			type: "user/message",
+			data: {
+				...message,
+				role: "user"
+			}
+		};
+	}
+	if (event.type !== "tool/result") return event;
+	const data = record(event.data, "tool result");
+	if (data["error"] === void 0) return event;
+	if (record(data["error"], "tool error")["code"] !== "TOOL_NOT_STARTED") return event;
+	const message = record(data["message"], "tool message");
+	const callId = record(message["source"], "tool source")["callId"];
+	const id = message["id"];
+	if (!isRepairIdentity(id, callId)) return event;
+	const prefix = "interrupted-tool-result-" + callId + "-";
+	return {
+		...event,
+		data: {
+			...data,
+			message: {
+				...message,
+				id: `${prefix}${event.seq}`
+			}
+		}
+	};
+}
+/** V3 framing with hard structural admission and recoverable canonical event validation. */
+/** V3 codec validates structural rows before recovery and logical envelopes after provenance decoding. */
+const releasedV3SessionFormatCodec = Object.freeze({
+	version: 3,
+	decodeHeader(value) {
+		return {
+			...releasedV2SessionFormatCodec.decodeHeader(v2PhysicalHeader(value)),
+			version: 3
+		};
+	},
+	createDecoder(value, recovery) {
+		const decoder = releasedV2SessionFormatCodec.createDecoder(v2PhysicalHeader(value), recovery);
+		let issue;
+		let acceptedInheritedCut;
+		return {
+			header: {
+				...decoder.header,
+				version: 3
+			},
+			decodeRow(row, context) {
+				assertV3RowAdmission(row);
+				decoder.decodeRow(row, {
+					emitRun: context.emitRun.bind(context),
+					emitEvent(event) {
+						assertV3EventAdmission(event);
+						if (issue === void 0) try {
+							assertV3Event(event);
+						} catch (error) {
+							const invalid = error;
+							if (recovery === "strict") throw invalid;
+							issue = invalid;
+						}
+						if (issue !== void 0) {
+							if (event.type === "turn/end") throw issue;
+							return;
+						}
+						if (event.type === "session/end-seed" && isSessionFormatJsonObject(event.data) && event.data["inherited"] === true) acceptedInheritedCut = event.seq;
+						context.emitEvent(event);
+					}
+				});
+			},
+			finish(context) {
+				if (issue === void 0) return decoder.finish(context);
+				if (decoder.header.isSeeded && acceptedInheritedCut === void 0) throw new SessionFormatError("format v3 seeded Session lacks an accepted inherited end-seed marker");
+				if (!decoder.header.isSeeded && acceptedInheritedCut !== void 0) throw new SessionFormatError("format v3 unseeded Session contains an inherited end-seed marker");
+				return acceptedInheritedCut ?? 0;
+			}
+		};
+	},
+	encodeHeader(header, inheritedEventCount) {
+		assertReleasedV3Header(header);
+		return {
+			...releasedV2SessionFormatCodec.encodeHeader({
+				...header,
+				version: 2
+			}, inheritedEventCount),
+			version: 3
+		};
+	},
+	encodeEvent(event) {
+		assertV3EventAdmission(event);
+		assertV3Event(event);
+		return releasedV2SessionFormatCodec.encodeEvent(event);
+	}
+});
+/**
+* Validate owned V3 admission rules before a scanner or codec can discard a recoverable tail.
+* This checks only identified structural payloads; physical provenance still belongs to decoding.
+* @param row - parsed physical row, before envelope or compressed-range decoding.
+*/
+function assertV3RowAdmission(row) {
+	assertV3StructuralRow(row);
+	if (typeof row === "object" && row !== null && !Array.isArray(row)) assertV3EventAdmission(row);
+}
+function v2PhysicalHeader(value) {
+	const header = snapshotSessionFormatJson(value, "format v3 physical header");
+	if (!isSessionFormatJsonObject(header) || header["version"] !== 3) throw new SessionFormatError("expected format v3 physical Session header");
+	return {
+		...header,
+		version: 2
+	};
+}
+/** Explicit local-coordinate remapping; captured generations and owner-local counters remain opaque. */
+/**
+* Remap only audited same-artifact references, preserving IDs and embedded model input.
+* @param event - validated source event.
+* @param seq - output event position.
+* @param mapping - earlier source positions mapped to output positions.
+* @returns the event in target coordinates.
+*/
+function remapEvent(event, seq, mapping) {
+	const one = (value) => {
+		const source = sessionFormatCount(value, "source event reference");
+		const target = mapping[source];
+		if (source >= event.seq || target === void 0) throw new SessionFormatError("reference must name an earlier source event");
+		return target;
+	};
+	const list = (value) => {
+		if (!Array.isArray(value)) throw new SessionFormatError("sequence references must be an array");
+		return value.map(one);
+	};
+	const range = (value) => {
+		const source = record(value, "sequence range");
+		return {
+			...source,
+			start: one(source["start"]),
+			end: one(source["end"])
+		};
+	};
+	let data = record(event.data, event.type);
+	switch (event.type) {
+		case "command/done":
+			if (data["sourceEventSeq"] !== void 0) data = {
+				...data,
+				sourceEventSeq: one(data["sourceEventSeq"])
+			};
+			break;
+		case "compaction/summary":
+		case "compaction/prune":
+			data = {
+				...data,
+				shadowedRange: range(data["shadowedRange"]),
+				shadowedSeqs: list(data["shadowedSeqs"])
+			};
+			break;
+		case "session/title":
+		case "session/title-llm-request": data = {
+			...data,
+			messageSeqs: list(data["messageSeqs"])
+		};
+	}
+	return {
+		...event,
+		seq,
+		data,
+		...event["sourceEventSeqs"] === void 0 ? {} : { sourceEventSeqs: list(event["sourceEventSeqs"]) },
+		...event["surfaceOp"] === void 0 || event["surfaceOp"] === "append" ? {} : { surfaceOp: range(event["surfaceOp"]) }
+	};
+}
+/** Streaming system-prompt promotion followed by canonical V3 envelope conversion. */
+/** Promote system prompts, remap audited references, and canonicalize envelopes and PTC vocabulary. */
+const sessionFormatV2ToV3 = defineSessionFormatMigration({
+	name: "@deepseek-ai/dsh-session-format-v2-to-v3",
+	fromVersion: 2,
+	toVersion: 3,
+	migrateHeader(header) {
+		assertReleasedV2Header(header);
+		return {
+			...header,
+			version: 3,
+			...header.agentPreset === "code" ? { agentPreset: "ptc" } : {}
+		};
+	},
+	createStage(input) {
+		return new ReleasedV2ToV3Stage(input);
+	},
+	validateTargetHeader: assertReleasedV3Header
+});
+var ReleasedV2ToV3Stage = class {
+	input;
+	headerInheritedEventCount;
+	mapping = [];
+	originalIds = /* @__PURE__ */ new Set();
+	generatedIds = /* @__PURE__ */ new Set();
+	targetSeq = 0;
+	sourceCut;
+	targetCut;
+	lastForeignDeliverySeq;
+	step;
+	head;
+	prompt = "";
+	constructor(input) {
+		this.input = input;
+		assertReleasedV2Header(input.sourceHeader);
+		this.sourceCut = input.sourceHeader.isSeeded ? void 0 : 0;
+		this.targetCut = input.sourceHeader.isSeeded ? void 0 : 0;
+		if (!input.sourceHeader.isSeeded) this.headerInheritedEventCount = 0;
+	}
+	transformEvent(event, context) {
+		if (event.seq !== this.mapping.length) throw new SessionFormatError("format v2 source events must be dense");
+		assertEvent(event, 2);
+		this.observeMessageIds(event);
+		let source = event;
+		const data = record(event.data, event.type);
+		if (event.type === "request/header") {
+			const { system, ...header } = record(data["header"], "request header");
+			const prompt = typeof system === "string" ? system : "";
+			if (prompt !== this.prompt) this.emitSystem(prompt, event, context);
+			source = {
+				...event,
+				data: {
+					...data,
+					header
+				}
+			};
+		}
+		if (SURFACE_TYPES.has(event.type) && this.head === void 0) throw new SessionFormatUnsupportedMigrationError("format v2 surface before first step cannot acquire a system head without changing chronology");
+		if (event.type === "session/end-seed" && data["inherited"] === true) {
+			if (!this.input.sourceHeader.isSeeded) throw new SessionFormatError("format v2 unseeded Session contains an inherited end-seed marker");
+			this.sourceCut = event.seq;
+			this.targetCut = this.targetSeq;
+		}
+		if (event.type === "session-log-deepseek/delivery-accepted") {
+			if (data["sessionFormatVersion"] === 3) throw new SessionFormatError("format v2 delivery marker claims target format v3");
+			if (data["sessionFormatVersion"] === 2 && data["sessionId"] !== this.input.sourceHeader.id) this.lastForeignDeliverySeq = event.seq;
+		}
+		const target = remapEvent(source, this.targetSeq, this.mapping);
+		this.mapping.push(this.targetSeq++);
+		context.emitEvent(canonicalizeTransformedEvent(renamePtcEvent(target)));
+		if (event.type === "step/start") {
+			this.step = {
+				turn: data["turn"],
+				step: data["step"]
+			};
+			if (this.head === void 0) this.emitSystem("", event, context);
+		} else if (event.type === "step/end" || event.type === "turn/end") this.step = void 0;
+	}
+	transformRun(run, context) {
+		for (const event of run.expand()) this.transformEvent(event, context);
+	}
+	finish(_context) {
+		const cut = sessionFormatCount(this.sourceCut, "format v2 inherited end-seed marker");
+		if (this.input.sourceInheritedEventCount !== void 0 && this.input.sourceInheritedEventCount !== cut) throw new SessionFormatError("format v2 inherited end-seed marker disagrees with its source cut");
+		if (this.lastForeignDeliverySeq !== void 0 && (this.input.sourceHeader.parentSession === void 0 || this.lastForeignDeliverySeq >= cut)) throw new SessionFormatError("current-generation delivery marker names the wrong Session");
+		return sessionFormatCount(this.targetCut, "format v3 inherited event count");
+	}
+	observeMessageIds(event) {
+		const data = record(event.data, event.type);
+		const messages = event.type === "user/message" ? [data] : event.type === "assistant/message" || event.type === "tool/result" ? [record(data["message"], "message")] : event.type === "agent/inbox/spliced" ? data["inserted"] : event.type === "session/title-llm-request" ? data["messages"] : [];
+		for (const message of messages) {
+			const id = message["id"];
+			if (this.generatedIds.has(id)) throw new SessionFormatUnsupportedMigrationError("source message id collides with a generated system message id");
+			this.originalIds.add(id);
+		}
+	}
+	emitSystem(prompt, anchor, context) {
+		if (this.step === void 0) throw new SessionFormatUnsupportedMigrationError("format v2 changed request prompt outside an open step cannot retain source chronology");
+		const identity = JSON.stringify([
+			"session-format-v2-to-v3",
+			this.input.sourceHeader.id,
+			anchor.seq,
+			anchor.type
+		]);
+		const id = "v2-to-v3-system-" + createHash("sha256").update(identity).digest("hex");
+		if (this.originalIds.has(id) || this.generatedIds.has(id)) throw new SessionFormatUnsupportedMigrationError("generated system message id collides with an existing message id");
+		this.generatedIds.add(id);
+		const seq = this.targetSeq++;
+		context.emitEvent(canonicalizeTransformedEvent({
+			type: "system/message",
+			seq,
+			time: anchor.time,
+			data: {
+				...this.step,
+				message: {
+					id,
+					role: "system",
+					source: {
+						kind: "plugin",
+						plugin: "@deepseek-ai/dsh-system-prompt"
+					},
+					content: prompt === "" ? [] : [{
+						type: "text",
+						text: prompt
+					}]
+				}
+			},
+			...this.head === void 0 ? { surfaceOp: "append" } : {
+				surfaceOp: {
+					op: "replace",
+					start: this.head,
+					end: this.head
+				},
+				sourceEventSeqs: [this.head]
+			}
+		}));
+		this.head = seq;
+		this.prompt = prompt;
+	}
+};
+/** Source admission precedes renaming, so these payloads have exact audited fields. */
+function renamePtcEvent(event) {
+	switch (event.type) {
+		case "agent-preset/selected": return event.data["agentPreset"] === "code" ? {
+			...event,
+			data: {
+				...event.data,
+				agentPreset: "ptc"
+			}
+		} : event;
+		case "tool/code-dispatch-start": return {
+			...event,
+			type: "tool/ptc-dispatch-start"
+		};
+		case "tool/code-dispatch": return {
+			...event,
+			type: "tool/ptc-dispatch"
+		};
+		case "user/message": {
+			const data = renameMessageSource(event.data);
+			return data === event.data ? event : {
+				...event,
+				data
+			};
+		}
+		case "agent/inbox/spliced":
+		case "session/title-llm-request": {
+			const data = event.data;
+			const key = event.type === "agent/inbox/spliced" ? "inserted" : "messages";
+			const messages = data[key];
+			const renamed = messages.map(renameMessageSource);
+			return renamed.every((message, index) => message === messages[index]) ? event : {
+				...event,
+				data: {
+					...data,
+					[key]: renamed
+				}
+			};
+		}
+		default: return event;
+	}
+}
+function renameMessageSource(message) {
+	const source = message["source"];
+	if (source["kind"] !== "plugin" || source["plugin"] !== "tools-code-mode") return message;
+	return {
+		...message,
+		source: {
+			...source,
+			plugin: "tools-ptc"
+		}
+	};
+}
+//#endregion
 //#region ../../vendor/deepseek-harness/packages/session/session-format-catalog/lib/index.js
 /** Current installed Session validation used after vocabulary-aware format restoration. */
 /**
@@ -17763,30 +18649,56 @@ function validateInstalledCurrentSessionArtifact(artifact) {
 */
 /** Physical codec dispatch and complete adjacent chain, independent of mounted plugins. */
 const sessionFormatCatalog = createSessionFormatCatalog({
-	currentVersion: 2,
+	currentVersion: 3,
 	codecs: [
 		releasedV0SessionFormatCodec,
 		releasedV1SessionFormatCodec,
-		releasedV2SessionFormatCodec
+		releasedV2SessionFormatCodec,
+		releasedV3SessionFormatCodec
+	],
+	currentEncoder: releasedV3SessionFormatCodec,
+	migrations: [
+		sessionFormatV0ToV1,
+		sessionFormatV1ToV2,
+		sessionFormatV2ToV3
 	],
-	currentEncoder: releasedV2SessionFormatCodec,
-	migrations: [sessionFormatV0ToV1, sessionFormatV1ToV2],
 	restoreCurrent(artifact) {
-		const restored = restoreReleasedV2Artifact(artifact, KNOWN_SESSION_EVENT_TYPES);
+		const restored = restoreReleasedV3Artifact(artifact, KNOWN_SESSION_EVENT_TYPES);
 		validateInstalledCurrentSessionArtifact(restored);
 		return restored;
 	},
 	restoreTransformedCurrent(artifact) {
-		return restoreReleasedV2Artifact(artifact, KNOWN_SESSION_EVENT_TYPES);
+		return restoreReleasedV3Artifact(artifact, KNOWN_SESSION_EVENT_TYPES);
 	},
 	restoreCurrentHeader(header) {
-		assertReleasedV2Header(header);
+		assertReleasedV3Header(header);
 		validateInstalledCurrentSessionHeader(header);
 		return header;
 	}
 });
 //#endregion
 //#region ../session-rdb/src/log.ts
+/**
+* 把桥接行列里的 replace surfaceOp 归一到当前字段名。
+*
+* v2 时代落库的 JSON 用 `start`/`end`，当前格式用 `startSeq`/`endSeq`；
+* 混合世代回退路径直接采用存储行，必须在此归一，否则上游 v3 surface 校验
+* 以「invalid replace surfaceOp」拒绝整个会话。非 replace 形状原样返回，
+* 由读取视图修复决定降级。
+*/
+function normalizeSurfaceOp(value) {
+	if (typeof value !== "object" || value === null || Array.isArray(value)) return value;
+	const record = value;
+	if (record["op"] !== "replace") return value;
+	const startSeq = record["startSeq"] ?? record["start"];
+	const endSeq = record["endSeq"] ?? record["end"];
+	if (typeof startSeq !== "number" || typeof endSeq !== "number") return value;
+	return {
+		op: "replace",
+		startSeq: SessionSeq$1(startSeq),
+		endSeq: SessionSeq$1(endSeq)
+	};
+}
 function rowToMeta(row) {
 	if (!Number.isSafeInteger(row.fCreatedAt) || row.fCreatedAt < 0) throw new Error("stored session createdAt must be a non-negative safe integer");
 	return {
@@ -17830,7 +18742,7 @@ function sessionConflictRow(storage) {
 	};
 }
 function rowToEvent(row) {
-	const surfaceOp = row.fSurfaceOp !== null ? JSON.parse(row.fSurfaceOp) : void 0;
+	const surfaceOp = row.fSurfaceOp !== null ? normalizeSurfaceOp(JSON.parse(row.fSurfaceOp)) : void 0;
 	const record = JSON.parse(row.fData);
 	if (typeof record === "object" && record !== null && !Array.isArray(record) && typeof record["type"] === "string" && typeof record["seq"] === "number" && typeof record["time"] === "number" && "data" in record) return {
 		...record,
@@ -17847,6 +18759,7 @@ function rowToEvent(row) {
 	};
 }
 const SURFACE_EVENT_TYPES = /* @__PURE__ */ new Set([
+	"system/message",
 	"user/message",
 	"assistant/message",
 	"tool/result"
@@ -17869,7 +18782,7 @@ function recomputeReplaceProvenance(events) {
 		const raw = events[i];
 		const op = raw.surfaceOp;
 		if (typeof op !== "object" || op === null || op.op !== "replace") continue;
-		const { start, end } = op;
+		const { startSeq, endSeq } = op;
 		const metering = i > 0 ? events[i - 1] : void 0;
 		const meteringData = metering !== void 0 && METERING_EVENT_TYPES.has(metering.type) ? metering.data : void 0;
 		if (meteringData?.shadowedSeqs !== void 0) {
@@ -17877,7 +18790,7 @@ function recomputeReplaceProvenance(events) {
 			continue;
 		}
 		const refs = [];
-		for (const candidate of events) if (candidate.seq >= start && candidate.seq <= end && SURFACE_EVENT_TYPES.has(candidate.type)) refs.push(candidate.seq);
+		for (const candidate of events) if (candidate.seq >= startSeq && candidate.seq <= endSeq && SURFACE_EVENT_TYPES.has(candidate.type)) refs.push(candidate.seq);
 		raw.sourceEventSeqs = refs;
 	}
 }
@@ -17929,7 +18842,9 @@ function findSurfaceRepairs(events) {
 	const degradeToAppend = /* @__PURE__ */ new Set();
 	const addAppendMarker = /* @__PURE__ */ new Set();
 	const clearSurfaceOp = /* @__PURE__ */ new Set();
-	for (const event of events) {
+	const clampEnd = /* @__PURE__ */ new Map();
+	for (let index = 0; index < events.length; index++) {
+		const event = events[index];
 		const op = event.surfaceOp;
 		if (op === void 0) {
 			if (SURFACE_EVENT_TYPES.has(event.type)) {
@@ -17948,12 +18863,18 @@ function findSurfaceRepairs(events) {
 			continue;
 		}
 		const replace = typeof op === "object" && op !== null && !Array.isArray(op) ? op : void 0;
-		const start = replace?.["start"];
-		const end = replace?.["end"];
+		const start = replace?.["startSeq"];
+		const end = replace?.["endSeq"];
 		const shapeOk = replace !== void 0 && replace["op"] === "replace" && isEventSeqLike(start) && isEventSeqLike(end);
 		const startIdx = shapeOk ? nodes.indexOf(start) : -1;
-		const endIdx = shapeOk ? nodes.indexOf(end) : -1;
+		let endIdx = shapeOk ? nodes.indexOf(end) : -1;
+		let clamped;
+		if (shapeOk && startIdx !== -1 && endIdx === -1) {
+			clamped = clampReplaceEnd(events, index, nodes, startIdx);
+			if (clamped !== void 0) endIdx = nodes.indexOf(clamped);
+		}
 		const rangeOk = shapeOk && startIdx !== -1 && endIdx !== -1 && startIdx <= endIdx;
+		const provenanceOk = event.type !== "assistant/message";
 		let rewriteOk = true;
 		if (rangeOk && event.type === "tool/result") {
 			const shadowed = nodes.slice(startIdx, endIdx + 1);
@@ -17963,30 +18884,202 @@ function findSurfaceRepairs(events) {
 				rewriteOk = original?.type === "tool/result" && toolResultRewriteContentOnly(original, event);
 			}
 		}
-		if (!rangeOk || !rewriteOk) {
+		if (!rangeOk || !rewriteOk || !provenanceOk) {
 			degradeToAppend.add(event.seq);
 			nodes.push(event.seq);
 			continue;
 		}
+		if (clamped !== void 0) clampEnd.set(event.seq, clamped);
 		nodes.splice(startIdx, endIdx - startIdx + 1, event.seq);
 	}
 	return {
 		degradeToAppend,
 		addAppendMarker,
-		clearSurfaceOp
+		clearSurfaceOp,
+		clampEnd
 	};
 }
+/**
+* 夹取一个 end 落在旧坐标空间的 replace 的结尾。
+*
+* 仅当 replace 紧邻一个 metering 事件且其 `shadowedSeqs` 是权威数量时成立；
+* 夹取点是从 `start` 起的第 `shadowedSeqs.length` 个当前 surface 节点（不足
+* 则取当前 surface 末尾）。无法夹取（start 也不在当前 surface）时返回
+* `undefined`，由调用方降级为 append。
+*/
+function clampReplaceEnd(events, index, nodes, startIdx) {
+	const metering = index > 0 ? events[index - 1] : void 0;
+	if (metering === void 0 || !METERING_EVENT_TYPES.has(metering.type)) return void 0;
+	const shadowedSeqs = metering.data.shadowedSeqs;
+	if (!Array.isArray(shadowedSeqs) || shadowedSeqs.length === 0) return void 0;
+	return nodes[Math.min(startIdx + shadowedSeqs.length - 1, nodes.length - 1)];
+}
 function repairSurfaceOps(events) {
 	const repairs = findSurfaceRepairs(events);
-	if (repairs.degradeToAppend.size === 0 && repairs.addAppendMarker.size === 0 && repairs.clearSurfaceOp.size === 0) return;
+	if (repairs.degradeToAppend.size === 0 && repairs.addAppendMarker.size === 0 && repairs.clearSurfaceOp.size === 0 && repairs.clampEnd.size === 0) return;
 	for (const event of events) {
 		const raw = event;
+		const clamped = repairs.clampEnd.get(event.seq);
 		if (repairs.degradeToAppend.has(event.seq)) raw.surfaceOp = "append";
-		else if (repairs.addAppendMarker.has(event.seq)) raw.surfaceOp = "append";
+		else if (clamped !== void 0) {
+			const op = raw.surfaceOp;
+			raw.surfaceOp = {
+				op: "replace",
+				startSeq: SessionSeq$1(op.startSeq),
+				endSeq: SessionSeq$1(clamped)
+			};
+		} else if (repairs.addAppendMarker.has(event.seq)) raw.surfaceOp = "append";
 		else if (repairs.clearSurfaceOp.has(event.seq)) delete raw.surfaceOp;
 	}
 }
 /**
+* 读取时补全 assistant 结算字段：旧写入器不落库 `stream`（v2 才把流式记录
+* 嵌入消息），读回时缺失即补空数组——上游 seed 校验要求 turn/step/stream
+* 三者齐备，缺失会让整个会话加载失败。
+*/
+function repairAssistantSettlement(events) {
+	for (const event of events) {
+		if (event.type !== "assistant/message" && event.type !== "assistant/attempt") continue;
+		const data = event.data;
+		if (!Array.isArray(data["stream"])) data["stream"] = [];
+	}
+}
+/**
+* 读取时把旧格式 `request/header` 归一为当前格式：v3 起 system prompt 由
+* surface 上的 `system/message` 承载，header 必须省略 `system`，空 `tools` /
+* `adapterDefaults` 也必须省略（上游 v3 事件校验 fail loud）。混合世代回退
+* 视图直接采用存储行，不归一会让整个会话加载失败。system prompt 因此不再
+* 进入模型请求；会话下次运行由 v3 的 system/message 机制重建。
+*/
+function repairRequestHeaders(events) {
+	for (const event of events) {
+		if (event.type !== "request/header") continue;
+		const header = event.data["header"];
+		if (typeof header !== "object" || header === null || Array.isArray(header)) continue;
+		const record = header;
+		delete record["system"];
+		if (Array.isArray(record["tools"]) && record["tools"].length === 0) delete record["tools"];
+		const defaults = record["adapterDefaults"];
+		if (typeof defaults === "object" && defaults !== null && !Array.isArray(defaults) && Object.keys(defaults).length === 0) delete record["adapterDefaults"];
+	}
+}
+/**
+* 把紧邻 replace 的 metering 事件的 `shadowedRange` / `shadowedSeqs` 对齐到
+* replace 最终的稠密 range。
+*
+* 旧写入器重编号事件后，metering 与 replace 一起落在旧坐标空间：二者数值
+* 相等但与当前 surface 无关。夹取（或 range 本身已落在稠密空间而 metering
+* 仍是旧值）后二者不再相等，而上游 token-meter 契约要求紧邻的 metering
+* range 与 replace range 完全一致（否则报 no adjacent shadow price）。range
+* 已一致时不改写——当前写入器保证一致，shadowedSeqs 的额外并发节点因此
+* 原样保留。
+*/
+function syncMeteringRanges(events) {
+	for (let i = 1; i < events.length; i++) {
+		const metering = events[i - 1];
+		if (!METERING_EVENT_TYPES.has(metering.type)) continue;
+		const op = events[i].surfaceOp;
+		if (typeof op !== "object" || op === null || op.op !== "replace") continue;
+		const { startSeq, endSeq } = op;
+		const data = metering.data;
+		if (data.shadowedRange?.start === startSeq && data.shadowedRange.end === endSeq) continue;
+		data.shadowedRange = {
+			start: startSeq,
+			end: endSeq
+		};
+		data.shadowedSeqs = events.filter((candidate) => candidate.seq >= startSeq && candidate.seq <= endSeq && SURFACE_EVENT_TYPES.has(candidate.type)).map((candidate) => candidate.seq);
+	}
+}
+const PTC_EVENT_RENAMES = {
+	"tool/code-dispatch-start": "tool/ptc-dispatch-start",
+	"tool/code-dispatch": "tool/ptc-dispatch"
+};
+/** 把消息的 `tools-code-mode` 插件来源改写为 `tools-ptc`（非该来源原样返回）。 */
+function renamePtcMessageSource(message) {
+	if (typeof message !== "object" || message === null || Array.isArray(message)) return message;
+	const record = message;
+	const source = record["source"];
+	if (typeof source !== "object" || source === null || Array.isArray(source)) return message;
+	const sourceRecord = source;
+	if (sourceRecord["kind"] !== "plugin" || sourceRecord["plugin"] !== "tools-code-mode") return message;
+	return {
+		...record,
+		source: {
+			...sourceRecord,
+			plugin: "tools-ptc"
+		}
+	};
+}
+/**
+* 读取时把 v2 时代的 PTC 词汇归一为当前词汇。
+*
+* 上游 v2→v3 迁移把 `tool/code-dispatch(-start)` 改名为
+* `tool/ptc-dispatch(-start)`、把 `tools-code-mode` 插件来源改名为 `tools-ptc`、
+* 把 agent preset 值 `code` 改名为 `ptc`。混合世代回退视图直接采用存储行，
+* 不重命名会被上游 v3 校验以「unknown event type」拒绝整个会话。词汇改写
+* 与上游迁移链的 renamePtcEvent 对齐。
+*/
+function renameLegacyPtcEvents(events) {
+	for (let index = 0; index < events.length; index++) {
+		const event = events[index];
+		const renamedType = PTC_EVENT_RENAMES[event.type];
+		if (renamedType !== void 0) {
+			events[index] = {
+				...event,
+				type: renamedType
+			};
+			continue;
+		}
+		if (event.type === "agent-preset/selected") {
+			const data = event.data;
+			if (data["agentPreset"] === "code") events[index] = {
+				...event,
+				data: {
+					...data,
+					agentPreset: "ptc"
+				}
+			};
+			continue;
+		}
+		if (event.type === "user/message") {
+			const renamed = renamePtcMessageSource(event.data);
+			if (renamed !== event.data) events[index] = {
+				...event,
+				data: renamed
+			};
+			continue;
+		}
+		if (event.type === "agent/inbox/spliced" || event.type === "session/title-llm-request") {
+			const data = event.data;
+			const key = event.type === "agent/inbox/spliced" ? "inserted" : "messages";
+			const list = data[key];
+			if (!Array.isArray(list)) continue;
+			const renamed = list.map(renamePtcMessageSource);
+			if (renamed.some((message, position) => message !== list[position])) events[index] = {
+				...event,
+				data: {
+					...data,
+					[key]: renamed
+				}
+			};
+		}
+	}
+}
+/**
+* 读取视图修复总入口：形状补全（结算字段 / request header）→ PTC 词汇归一
+* → surface 语义修复 → metering 对齐 → provenance 重算 → 孤儿 inbox splice
+* 改写。全部只作用于内存视图，不落库。
+*/
+function repairReadView(events) {
+	repairAssistantSettlement(events);
+	repairRequestHeaders(events);
+	renameLegacyPtcEvents(events);
+	repairSurfaceOps(events);
+	syncMeteringRanges(events);
+	recomputeReplaceProvenance(events);
+	repairOrphanInboxSplices(events);
+}
+/**
 * 定位无法从空状态增量重放的 agent/inbox/spliced 事件（孤儿操作）。
 *
 * 上游 Inbox 每次构造都从会话起点重放全部 inbox splice，失败即拒绝整个
@@ -23424,35 +24517,43 @@ function registerSessionImport(ctx, persistence) {
 }
 //#endregion
 //#region ../session-rdb/src/legacy.ts
-/** 重建 v0/v1 物理 header 记录（RDB 行 → 物理 JSON 对象）。 */
+/** 重建 v0/v1/v2 物理 header 记录（RDB 行 → 物理 JSON 对象）。 */
 function physicalHeader(row) {
-	return {
+	const common = {
 		type: "session",
 		version: row.fVersion,
 		id: row.fSessionId,
 		createdAt: row.fCreatedAt,
 		...row.fCwd !== null ? { cwd: row.fCwd } : {},
 		...row.fParentSession !== null ? { parentSession: row.fParentSession } : {},
-		...row.fSeedLength !== null ? { seedLength: row.fSeedLength } : {},
 		...row.fOrigin !== null ? { origin: row.fOrigin } : {},
 		delegationDepth: row.fDelegationDepth ?? 0
 	};
+	return row.fVersion < 2 ? {
+		...common,
+		...row.fSeedLength !== null ? { seedLength: row.fSeedLength } : {}
+	} : {
+		...common,
+		isSeeded: row.fSeedLength !== null
+	};
 }
-/** 重建一条 v0/v1 物理事件记录（桥接行 + 事件行 → 物理 JSON 对象）。 */
+/** 重建一条 v0/v1/v2 物理事件记录（桥接行 + 事件行 → 物理 JSON 对象）。 */
 function physicalEvent(row) {
+	const stored = JSON.parse(row.fData);
+	const full = typeof stored === "object" && stored !== null && !Array.isArray(stored) && typeof stored["type"] === "string" && "data" in stored;
 	return {
 		type: row.fType,
 		seq: row.fSequence,
 		time: row.fCreatedAt,
-		data: JSON.parse(row.fData),
+		data: full ? stored["data"] : stored,
 		...row.fSurfaceOp !== null ? { surfaceOp: JSON.parse(row.fSurfaceOp) } : {}
 	};
 }
 /**
-* 把旧格式（v0/v1）行转换为 v2 逻辑事件与 header。
-* @param row - 会话行（f_version < 2）。
+* 把非当前格式（v0/v1/v2）行转换为当前逻辑事件与 header。
+* @param row - 会话行（f_version < SESSION_FORMAT_VERSION）。
 * @param eventRows - 已扫描保留的桥接行（稠密 seq，torn tail 已剔除）。
-* @returns v2 逻辑 header、继承前缀长度与事件。
+* @returns 当前逻辑 header、继承前缀长度与事件。
 * @throws 迁移链拒绝（格式损坏 / 无法迁移）时原样抛出。
 */
 function convertLegacyRows(row, eventRows) {
@@ -23468,9 +24569,40 @@ function convertLegacyRows(row, eventRows) {
 		events: artifact.events
 	};
 }
-/** 会话行是否携带旧格式（v0/v1）数据。 */
+/** 会话行是否携带非当前格式（f_version < SESSION_FORMAT_VERSION）数据。 */
 function isLegacyVersion(version) {
-	return version < 2;
+	return version < SESSION_FORMAT_VERSION;
+}
+/**
+* 迁移链拒绝后，把旧格式行直接当**当前格式**事件视图采用。
+*
+* 旧写入器只在建会话时落一次 header version，之后跟随上游演进继续追加
+* 事件——同一个 log 因此可能是混合世代（v0 时代的行 + 新版本字段），不是
+* 任何单一已发布格式，严格迁移链必然拒绝。这些行的数据形状（消息包装、
+* 类型名）已经是当前格式，只需 header 版本归一到当前、按稠密 seq 读取；
+* 事件数据的补全与 surface 修复由读取视图修复（repairReadView）负责。
+*
+* 调用方须在此之后执行 `validateStoredEvents`：真正属于旧格式的类型
+* （`assistant/chunk` / `compact/*` 等）仍会被 fail-loud 拒绝。
+*
+* @param row - 会话行（f_version < SESSION_FORMAT_VERSION）。
+* @param eventRows - 该会话全部桥接行（按 f_sequence 升序）。
+* @returns 当前格式 header（version 归一到 SESSION_FORMAT_VERSION）、收缩后的
+*   继承前缀长度、稠密事件与可选 torn tail 起点。
+* @throws scanRows 的已提交区损坏错误（seq gap / 不可解析行）。
+*/
+function adoptLegacyRows(row, eventRows) {
+	const { preserved, tornFrom } = scanRows(eventRows, 0);
+	repairRequestHeaders(preserved);
+	return {
+		meta: {
+			...rowToMeta(row),
+			version: SESSION_FORMAT_VERSION
+		},
+		inheritedEventCount: Math.min(row.fSeedLength ?? 0, preserved.length),
+		events: preserved,
+		...tornFrom !== void 0 ? { tornFrom } : {}
+	};
 }
 //#endregion
 //#region ../session-rdb/src/index.ts
@@ -23615,9 +24747,7 @@ var RdbSessionHandle = class RdbSessionHandle {
 			};
 			throw new SessionPersistenceNotFoundError(this.id);
 		}
-		repairSurfaceOps(log.events);
-		recomputeReplaceProvenance(log.events);
-		repairOrphanInboxSplices(log.events);
+		repairReadView(log.events);
 		return {
 			eventState: "detached",
 			events: log.events.slice(offset, offset + length)
@@ -23813,6 +24943,7 @@ var SessionPersistenceRdb = class SessionPersistenceRdb extends SessionPersisten
 			}));
 			const log = await this.readLog(id, {}, options?.signal);
 			if (log === void 0) throw new SessionPersistenceNotFoundError(id);
+			repairReadView(log.events);
 			validateStoredEvents(log.meta, log.events);
 			return this.tracker.adopt(new RdbSessionHandle(this, id, log.meta, "read", {
 				cursor: log.events.length,
@@ -23829,7 +24960,9 @@ var SessionPersistenceRdb = class SessionPersistenceRdb extends SessionPersisten
 			}));
 			const log = await this.readLog(id, {}, options?.signal);
 			if (log === void 0) throw new SessionPersistenceNotFoundError(id);
+			repairReadView(log.events);
 			validateStoredEvents(log.meta, log.events);
+			if (log.migrated && log.events.length !== log.storedCount) await this.rewriteMigratedLog(id, log);
 			this.writeGuard.confirmHead(id, log.events.at(-1)?.seq ?? -1);
 			return this.tracker.adopt(new RdbSessionHandle(this, id, log.meta, "write", {
 				cursor: log.events.length,
@@ -23893,8 +25026,7 @@ var SessionPersistenceRdb = class SessionPersistenceRdb extends SessionPersisten
 		signal?.throwIfAborted();
 		const log = await this.readLog(id, {}, signal);
 		if (log === void 0) return void 0;
-		repairSurfaceOps(log.events);
-		recomputeReplaceProvenance(log.events);
+		repairReadView(log.events);
 		const inheritedEventCount = Math.min(log.inheritedEventCount, log.events.length);
 		return {
 			meta: log.meta,
@@ -23917,9 +25049,9 @@ var SessionPersistenceRdb = class SessionPersistenceRdb extends SessionPersisten
 		this.writeGuard.confirmHead(meta.id, -1);
 	}
 	/** 原样 append 落库（handle 已校验 contiguity；torn tail 先截断）。
-	*  与上游 JSONL 一致：ignorable 事件原样存储，不做过滤。写路径校验 v2
-	*  形状（fail-closed）：未知类型（非 ignorable）与非法消息形状拒绝入库；
-	*  旧格式（v0/v1）数据只在读取时经 legacy 转换链动态转换，不落新库。 */
+	*  与上游 JSONL 一致：ignorable 事件原样存储，不做过滤。写路径校验当前
+	*  格式形状（fail-closed）：未知类型（非 ignorable）与非法消息形状拒绝入库；
+	*  非当前格式（v0/v1/v2）数据只在读取时经 legacy 转换链动态转换，不落新库。 */
 	async appendBatch(meta, inheritedEventCount, events, tornTruncateTo) {
 		await this.ready;
 		if (events.length === 0) return false;
@@ -23962,14 +25094,29 @@ var SessionPersistenceRdb = class SessionPersistenceRdb extends SessionPersisten
 		const meta = rowToMeta(row);
 		const eventRows = options.fromSeq === void 0 ? await this.backend.getEventRows(id) : await this.backend.getEventRows(id, options.fromSeq);
 		signal?.throwIfAborted();
-		if (isLegacyVersion(row.fVersion)) {
+		if (isLegacyVersion(row.fVersion)) try {
 			const converted = convertLegacyRows(row, eventRows);
 			return {
 				meta: converted.meta,
 				inheritedEventCount: converted.inheritedEventCount,
 				events: converted.events,
 				incarnation: row.fIncarnation,
-				revision: row.fRevision
+				revision: row.fRevision,
+				storedCount: eventRows.length,
+				migrated: true
+			};
+		} catch (error) {
+			this.ctx.logger.warn(`session-rdb: session "${id}" is not a single released format; adopting its stored rows as current-format data (${error instanceof Error ? error.message : String(error)})`);
+			const adopted = adoptLegacyRows(row, eventRows);
+			return {
+				meta: adopted.meta,
+				inheritedEventCount: adopted.inheritedEventCount,
+				events: adopted.events,
+				incarnation: row.fIncarnation,
+				revision: row.fRevision,
+				storedCount: eventRows.length,
+				migrated: false,
+				...adopted.tornFrom !== void 0 ? { tornFrom: adopted.tornFrom } : {}
 			};
 		}
 		const { preserved, tornFrom } = scanRows(eventRows, options.fromSeq ?? 0);
@@ -23979,9 +25126,35 @@ var SessionPersistenceRdb = class SessionPersistenceRdb extends SessionPersisten
 			events: preserved,
 			incarnation: row.fIncarnation,
 			revision: row.fRevision,
+			storedCount: eventRows.length,
+			migrated: false,
 			...tornFrom !== void 0 ? { tornFrom } : {}
 		};
 	}
+	/**
+	* 把迁移链读出的当前格式视图整体落库（非当前格式会话写打开时的一次性迁移）。
+	*
+	* 迁移链会生成/合并事件（end-seed / attempt / chunk 合并），事件 seq 空间
+	* 与存储桥接行数不再相等；写路径以存储 head 为锚点重编号，二者不一致会让
+	* append 撞上已有行。这里在同一事务内删光本会话桥接行、按迁移视图重建
+	* （新事件行，完整信封），并更新 head 与 revision；旧事件行保留（可能被
+	* fork 子会话引用，孤儿由惰性 GC 处理）。
+	*/
+	async rewriteMigratedLog(id, log) {
+		await this.backend.transaction(async (tx) => {
+			await tx.deleteBridgeTail(id, 0);
+			await tx.upsertSession({
+				meta: log.meta,
+				inheritedEventCount: SessionLogOffset(log.inheritedEventCount)
+			}, randomUUID());
+			const { headEventId, headSequence } = await appendEventTail(tx, log.meta, log.events, {
+				parentId: "",
+				nextSeq: 0
+			});
+			await tx.updateHead(id, headEventId, headSequence);
+			await tx.bumpRevision(id);
+		});
+	}
 	async listSnapshots(signal) {
 		signal?.throwIfAborted();
 		await this.ready;
@@ -24167,6 +25340,7 @@ var SessionPersistenceRdb = class SessionPersistenceRdb extends SessionPersisten
 			if (stored.meta.cwd !== session.header.cwd) throw new Error(`session "${id}" is already persisted at a different cwd (persisted: ${String(stored.meta.cwd)}, live: ${String(session.header.cwd)}) (id collision)`);
 			if (stored.inheritedEventCount !== session.inheritedEventCount) throw new Error(`session "${id}" is already persisted with a different inherited event count (id collision)`);
 			assertVersion(stored.meta);
+			repairReadView(stored.events);
 			const seed = session.snapshotEvents();
 			if (!seedCoversPrefix(seed, stored.events)) throw new Error(`session "${id}" already has a persisted log on disk that does not match this live session (id collision)`);
 			handle = await this.open(id, "write");