@murphai/murph 1.3.1 → 1.3.2

package/node_modules/@murphai/core/dist/mutations.js

@@ -1,6 +1,8 @@
 import { createHash } from "node:crypto";
 import { createReadStream } from "node:fs";
-import { auditRecordSchema, assertContractId, collectEventRawReferencePaths, compareIsoTimestampsAscending, deviceDataOriginSchema, experimentFrontmatterSchema, externalRefSchema, journalDayFrontmatterSchema, eventRecordSchema, eventImportDecisionSchema, isWritableIsoDateTime, safeParseContract, sampleRecordSchema, } from "@murphai/contracts";
+import { stat } from "node:fs/promises";
+import { performance } from "node:perf_hooks";
+import { auditRecordSchema, assertContractId, collectEventRawReferencePaths, compareIsoTimestampsAscending, deviceDataOriginSchema, experimentFrontmatterSchema, externalRefSchema, journalDayFrontmatterSchema, eventRecordSchema, eventImportDecisionSchema, isWritableIsoDateTime, resolveFloatingIsoTimestampInTimeZone, safeParseContract, sampleRecordSchema, } from "@murphai/contracts";
 import { BASELINE_EVENT_KINDS, BASELINE_SAMPLE_STREAMS, EVENT_SCHEMA_VERSION, EVENT_SOURCES, FRONTMATTER_SCHEMA_VERSIONS, ID_PREFIXES, SAMPLE_QUALITIES, SAMPLE_SCHEMA_VERSION, SAMPLE_SOURCES, VAULT_LAYOUT, } from "./constants.js";
 import { emitAuditRecord } from "./audit.js";
 import { prepareEventAttachments, stagePreparedEventAttachmentsInBatch, } from "./event-attachments.js";
@@ -26,6 +28,7 @@ import { loadVault } from "./vault.js";
 import { statAndHashVaultFile } from "./raw-artifact-integrity.js";
 const DENSE_DEVICE_TELEMETRY_NOT_ALLOWED_CODE = "VAULT_DENSE_DEVICE_TELEMETRY_NOT_ALLOWED";
 const DENSE_DEVICE_SAMPLES_NOT_ALLOWED_LEGACY_CODE = "VAULT_DENSE_DEVICE_SAMPLES_NOT_ALLOWED";
+const MAX_JUNCTION_DAILY_ALIAS_REPAIR_REVISIONS = 64;
 const RESERVED_DEVICE_EVENT_FIELD_NAMES = new Set([
     "schemaVersion",
     "id",
@@ -49,6 +52,9 @@ const RESERVED_DEVICE_EVENT_FIELD_NAMES = new Set([
     "visibility",
 ]);
 const MAX_DEVICE_PROVIDER_SAMPLE_ROWS_DEFAULT = 1_000;
+// Junction menstrual resources admit 512 dated non-BBT facts plus the
+// period-length and cycle-length scalar facets for the same resource version.
+const MAX_DEVICE_AUTHORITATIVE_CURRENT_FACETS = 514;
 const EVENT_KIND_SET = new Set(BASELINE_EVENT_KINDS);
 const EVENT_SOURCE_SET = new Set(EVENT_SOURCES);
 const SAMPLE_STREAM_SET = new Set(BASELINE_SAMPLE_STREAMS);
@@ -543,7 +549,8 @@ function normalizeDeviceEventInputs(eventInputs, context) {
         const inputTimeZone = typeof eventInput.timeZone === "string" ? eventInput.timeZone : undefined;
         const preservesProviderDayWithoutTimeZone = Boolean(inputDayKey &&
             !inputTimeZone &&
-            (isJunctionSleepStageExternalRefInput(eventInput.externalRef)
+            (context.provider === "junction"
+                || isJunctionSleepStageExternalRefInput(eventInput.externalRef)
                 || isDateOnlyFloatingProviderDayInput(inputDayKey, eventInput.dataOrigin)));
         const seed = buildNormalizedEventSeed({
             kind,
@@ -658,7 +665,65 @@ function normalizeDeviceBatchObjectArray(input) {
     }
     return input.value.map((entry, index) => assertPlainObject(entry, input.itemCode, `${input.itemLabel} ${index + 1} must be a plain object.`));
 }
-function normalizeDeviceBatchInputs({ provider, accountId, importedAt = new Date(), defaultTimeZone: fallbackTimeZone, source = "device", events = [], samples = [], evidenceParts = [], ingestReceipt, provenance, }) {
+function normalizeDeviceAuthoritativeEventSets(inputs, events) {
+    if (inputs.length > 128) {
+        throw new VaultError("VAULT_INVALID_DEVICE_AUTHORITATIVE_EVENT_SETS", "Device batch authoritativeEventSets exceeds 128 resources.");
+    }
+    const sets = inputs.map((input, index) => {
+        const parsedRef = safeParseContract(externalRefSchema, {
+            system: input.system,
+            resourceType: input.resourceType,
+            resourceId: input.resourceId,
+            version: input.version,
+        });
+        if (!parsedRef.success || !parsedRef.data.version || !isWritableIsoDateTime(parsedRef.data.version)) {
+            throw new VaultError("VAULT_INVALID_DEVICE_AUTHORITATIVE_EVENT_SET", `Device authoritative event set ${index + 1} requires a valid versioned externalRef identity.`);
+        }
+        const facetPrefixes = normalizeUniqueTextList(input.facetPrefixes, `authoritativeEventSets[${index}].facetPrefixes`, 32, 200);
+        const currentFacets = normalizeUniqueTextList(input.currentFacets, `authoritativeEventSets[${index}].currentFacets`, MAX_DEVICE_AUTHORITATIVE_CURRENT_FACETS, 200) ?? [];
+        if (!facetPrefixes || facetPrefixes.length === 0) {
+            throw new VaultError("VAULT_INVALID_DEVICE_AUTHORITATIVE_EVENT_SET", `Device authoritative event set ${index + 1} requires at least one facet prefix.`);
+        }
+        const ownsFacet = (facet) => facetPrefixes.some((prefix) => facet === prefix || facet.startsWith(`${prefix}-`));
+        if (currentFacets.some((facet) => !ownsFacet(facet))) {
+            throw new VaultError("VAULT_INVALID_DEVICE_AUTHORITATIVE_EVENT_SET", `Device authoritative event set ${index + 1} contains a current facet outside its owned prefixes.`);
+        }
+        return {
+            system: parsedRef.data.system,
+            resourceType: parsedRef.data.resourceType,
+            resourceId: parsedRef.data.resourceId,
+            version: parsedRef.data.version,
+            facetPrefixes: [...facetPrefixes].sort(),
+            currentFacets: new Set(currentFacets),
+        };
+    });
+    const identityKeys = sets.map((set) => stableStringify({
+        system: set.system,
+        resourceType: set.resourceType,
+        resourceId: set.resourceId,
+    }));
+    if (new Set(identityKeys).size !== identityKeys.length) {
+        throw new VaultError("VAULT_INVALID_DEVICE_AUTHORITATIVE_EVENT_SETS", "Device batch authoritativeEventSets contains duplicate resource identities.");
+    }
+    for (const set of sets) {
+        for (const facet of set.currentFacets) {
+            // Unversioned members follow complete-set reconciliation: the set's
+            // version orders only retraction tombstones, while member events collapse
+            // by semantic content and reassert through the serialized set seam.
+            const hasCurrentEvent = events.some(({ seed }) => seed.externalRef?.system === set.system
+                && seed.externalRef.resourceType === set.resourceType
+                && seed.externalRef.resourceId === set.resourceId
+                && (seed.externalRef.version === set.version
+                    || seed.externalRef.version === undefined)
+                && seed.externalRef.facet === facet);
+            if (!hasCurrentEvent) {
+                throw new VaultError("VAULT_INVALID_DEVICE_AUTHORITATIVE_EVENT_SET", `Device authoritative event set current facet "${facet}" has no matching current event.`);
+            }
+        }
+    }
+    return sets;
+}
+function normalizeDeviceBatchInputs({ provider, accountId, importedAt = new Date(), defaultTimeZone: fallbackTimeZone, source = "device", events = [], samples = [], evidenceParts = [], authoritativeEventSets = [], ingestReceipt, provenance, }) {
     const normalizedProvider = sanitizePathSegment(provider, "provider");
     const normalizedAccountId = typeof accountId === "string" && accountId.trim() ? accountId.trim() : undefined;
     const normalizedImportedAt = toIsoTimestamp(importedAt, "importedAt");
@@ -688,12 +753,26 @@ function normalizeDeviceBatchInputs({ provider, accountId, importedAt = new Date
         itemCode: "VAULT_INVALID_RAW_ARTIFACT",
         itemLabel: "Device raw artifact",
     });
+    const authoritativeEventSetInputs = normalizeDeviceBatchObjectArray({
+        value: authoritativeEventSets,
+        code: "VAULT_INVALID_DEVICE_AUTHORITATIVE_EVENT_SETS",
+        message: "Device batch authoritativeEventSets must be an array when provided.",
+        itemCode: "VAULT_INVALID_DEVICE_AUTHORITATIVE_EVENT_SET",
+        itemLabel: "Device authoritative event set",
+    });
     if (eventInputs.length === 0
         && sampleInputs.length === 0
         && evidencePartInputs.length === 0
         && !normalizedIngestReceipt) {
         throw new VaultError("VAULT_INVALID_DEVICE_BATCH", "importDeviceBatch requires at least one event, sample, evidence part, or ingest receipt.");
     }
+    const normalizedEvents = normalizeDeviceEventInputs(eventInputs, {
+        provider: normalizedProvider,
+        accountId: normalizedAccountId,
+        importedAt: normalizedImportedAt,
+        source: normalizedSource,
+        defaultTimeZone,
+    });
     return {
         provider: normalizedProvider,
         accountId: normalizedAccountId,
@@ -703,13 +782,7 @@ function normalizeDeviceBatchInputs({ provider, accountId, importedAt = new Date
         provenance: normalizedProvenance,
         ingestReceipt: normalizedIngestReceipt,
         legacyIngestReceipt,
-        events: normalizeDeviceEventInputs(eventInputs, {
-            provider: normalizedProvider,
-            accountId: normalizedAccountId,
-            importedAt: normalizedImportedAt,
-            source: normalizedSource,
-            defaultTimeZone,
-        }),
+        events: normalizedEvents,
         samples: normalizeDeviceSampleInputs(sampleInputs, {
             provider: normalizedProvider,
             accountId: normalizedAccountId,
@@ -717,6 +790,7 @@ function normalizeDeviceBatchInputs({ provider, accountId, importedAt = new Date
             defaultTimeZone,
         }),
         evidenceParts: normalizeDeviceEvidencePartInputs(evidencePartInputs, normalizedProvider),
+        authoritativeEventSets: normalizeDeviceAuthoritativeEventSets(authoritativeEventSetInputs, normalizedEvents),
     };
 }
 function prepareDeviceEvidenceParts(evidenceParts) {
@@ -863,10 +937,43 @@ function junctionSparseAffectedDayKeys(targets) {
 }
 // Device-sync content equality ignores per-import identity (id, lifecycle,
 // recordedAt) AND rawRefs, because device imports mint fresh raw-artifact
-// paths on every sync run.
-function deviceEventContentKey(record) {
+// paths on every sync run. Member-edit comparison additionally excludes the
+// immutable provider attribution fields while retaining every public edit.
+function eventContentKey(record, options) {
     const { id: _id, rawRefs: _rawRefs, lifecycle: _lifecycle, recordedAt: _recordedAt, ...content } = record;
-    return stableStringify(content);
+    if (options.includeProviderAttribution) {
+        return stableStringify(content);
+    }
+    const { dataOrigin: _dataOrigin, externalRef: _externalRef, ...memberMutableContent } = content;
+    return stableStringify(memberMutableContent);
+}
+function deviceEventContentKey(record) {
+    const { id: _id, rawRefs: _rawRefs, lifecycle: _lifecycle, recordedAt: _recordedAt, externalRef, dataOrigin, ...semanticContent } = record;
+    return stableStringify({
+        ...semanticContent,
+        // Identity and source ordering are enforced independently. Keeping them
+        // out of semantic equality prevents a newer provider capture/version from
+        // masquerading as a health-data change over a member-authored revision.
+        externalRef: externalRef
+            ? {
+                system: externalRef.system,
+                resourceType: externalRef.resourceType,
+                resourceId: externalRef.resourceId,
+                facet: externalRef.facet ?? null,
+            }
+            : null,
+        dataOrigin: dataOrigin
+            ? {
+                // This is the fixed data-origin schema discriminator, not the
+                // provider resource version used for ordering.
+                version: dataOrigin.version,
+                aggregatorProvider: dataOrigin.aggregatorProvider ?? null,
+                sourceProviderSlug: dataOrigin.sourceProviderSlug ?? null,
+                sourceType: dataOrigin.sourceType ?? null,
+                sourceInstanceId: dataOrigin.sourceInstanceId ?? null,
+            }
+            : null,
+    });
 }
 function deviceEventContentFingerprint(record) {
     return createHash("sha256").update(deviceEventContentKey(record)).digest("hex");
@@ -948,8 +1055,11 @@ function orderEventImportDecisionsBySourceVersion(decisions) {
     return ordered;
 }
 async function indexLatestEventsByExternalRef(vaultRoot, relativePaths, signal) {
+    const aliasRepairContaminatedEventIds = new Set();
+    const aliasRepairContaminatedRefKeys = new Set();
     const deviceOwnerRevisionsByRefKeyAndFingerprint = new Map();
     const junctionSparseDayHistoryById = new Map();
+    const liveOwnerIdsByRefKey = new Map();
     const latestByRefKey = new Map();
     const latestById = new Map();
     const maxRevisionById = new Map();
@@ -969,6 +1079,15 @@ async function indexLatestEventsByExternalRef(vaultRoot, relativePaths, signal)
                 signal?.throwIfAborted();
                 const parsed = safeParseContract(eventRecordSchema, raw);
                 if (!parsed.success) {
+                    if (isLooseRecordValue(raw)) {
+                        if (typeof raw.id === "string" && raw.id.length > 0) {
+                            aliasRepairContaminatedEventIds.add(raw.id);
+                        }
+                        const rejectedRefKey = readRejectedEventExternalRefKey(raw.externalRef);
+                        if (rejectedRefKey) {
+                            aliasRepairContaminatedRefKeys.add(rejectedRefKey);
+                        }
+                    }
                     return;
                 }
                 const entry = { relativePath, record: parsed.data };
@@ -1045,13 +1164,19 @@ async function indexLatestEventsByExternalRef(vaultRoot, relativePaths, signal)
         const refKey = eventExternalRefKey(externalRefEntry.record.externalRef);
         const indexedExternalRefEntry = state.latestDeviceExternalRefEntryByRefKey.get(refKey) ?? externalRefEntry;
         const refGroup = groupedByRefKey.get(refKey) ?? [];
-        refGroup.push({
+        const indexedMatch = {
             indexedExternalRef: indexedExternalRefEntry.record.externalRef ?? externalRefEntry.record.externalRef,
             indexedRecord: indexedExternalRefEntry.record,
             relativePath: latestForId.relativePath,
             record: latestForId.record,
-        });
+        };
+        refGroup.push(indexedMatch);
         groupedByRefKey.set(refKey, refGroup);
+        if (!isDeletedEventSpineRecord(latestForId.record)) {
+            const liveOwnerIds = liveOwnerIdsByRefKey.get(refKey) ?? new Set();
+            liveOwnerIds.add(latestForId.record.id);
+            liveOwnerIdsByRefKey.set(refKey, liveOwnerIds);
+        }
     }
     for (const [refKey, group] of groupedByRefKey) {
         signal?.throwIfAborted();
@@ -1062,15 +1187,45 @@ async function indexLatestEventsByExternalRef(vaultRoot, relativePaths, signal)
             latestByRefKey.set(refKey, latest);
         }
     }
+    const junctionNoIdProfilePredecessorsByScope = indexJunctionNoIdProfilePredecessors(latestByRefKey.values());
     return {
+        aliasRepairContaminatedEventIds,
+        aliasRepairContaminatedRefKeys,
+        aliasRepairHistoryById: new Map(),
         deviceOwnerRevisionsByRefKeyAndFingerprint,
+        junctionNoIdProfilePredecessorsByScope,
         junctionSparseDayHistoryById,
         latestByRefKey,
         latestById,
+        liveOwnerIdsByRefKey,
         maxRevisionById,
         revisionsById,
     };
 }
+async function loadBoundedAliasRepairHistories(vaultRoot, relativePaths, eventIds) {
+    const histories = new Map();
+    for (const relativePath of relativePaths) {
+        await visitJsonlRecordsInterruptible({
+            vaultRoot,
+            relativePath,
+            visit(raw) {
+                const parsed = safeParseContract(eventRecordSchema, raw);
+                if (!parsed.success || !eventIds.has(parsed.data.id)) {
+                    return;
+                }
+                const history = histories.get(parsed.data.id) ?? [];
+                if (history.length <= MAX_JUNCTION_DAILY_ALIAS_REPAIR_REVISIONS) {
+                    history.push({ relativePath, record: parsed.data });
+                    histories.set(parsed.data.id, history);
+                }
+            },
+        });
+    }
+    for (const history of histories.values()) {
+        history.sort((left, right) => eventSpineRevision(left.record) - eventSpineRevision(right.record));
+    }
+    return histories;
+}
 function isSameObservationFacet(existing, incoming) {
     return existing.kind === "observation" &&
         incoming.kind === "observation" &&
@@ -1092,6 +1247,8 @@ const JUNCTION_SLEEP_STAGE_METRIC_FACETS = new Set([
 ]);
 const JUNCTION_SLEEP_STAGE_SUMMARY_NORMALIZER_VERSION = "junction-sleep-stage-summary.v1";
 const JUNCTION_SLEEP_STAGE_CYCLE_FALLBACK_NORMALIZER_VERSION = "junction-sleep-stage-cycle-fallback.v1";
+const JUNCTION_NO_ID_PROFILE_NORMALIZER_VERSION = "junction-no-id-profile.v1";
+const JUNCTION_STABLE_PROFILE_CREATED_AT_NORMALIZER_VERSION = "junction-stable-profile-created-at.v1";
 function deviceDataOriginSourceMatches(existing, incoming) {
     if (!existing || !incoming) {
         return false;
@@ -1110,6 +1267,193 @@ function deviceDataOriginSourceMatches(existing, incoming) {
     }
     return compared;
 }
+function junctionNoIdProfileScopeKey(externalRef, origin) {
+    if (externalRef?.system !== "junction"
+        || !externalRef.resourceType.endsWith("-profile")
+        || typeof externalRef.facet !== "string"
+        || !/^profile-[a-f0-9]{16}$/u.test(externalRef.resourceId)
+        || origin?.sourceProviderSlug === undefined) {
+        return null;
+    }
+    return stableStringify({
+        resourceType: externalRef.resourceType,
+        facet: externalRef.facet,
+        aggregatorProvider: origin.aggregatorProvider,
+        sourceProviderSlug: origin.sourceProviderSlug,
+        sourceType: origin.sourceType,
+        sourceInstanceId: origin.sourceInstanceId,
+    });
+}
+function junctionNoIdProfileResourceId(origin, occurredAt) {
+    return `profile-${createHash("sha256")
+        .update(JSON.stringify([
+        "profile",
+        origin.sourceProviderSlug,
+        origin.sourceType,
+        origin.sourceInstanceId,
+        occurredAt,
+    ]))
+        .digest("hex")
+        .slice(0, 16)}`;
+}
+function junctionNoIdProfileProviderBaselineRevision(match) {
+    const externalRef = match.indexedExternalRef;
+    const providerRecord = match.indexedRecord;
+    const origin = providerRecord.dataOrigin;
+    const isCurrentNoIdProfile = origin?.normalizerVersion
+        === JUNCTION_NO_ID_PROFILE_NORMALIZER_VERSION;
+    const isLegacyNoIdProfile = origin?.normalizerVersion === "junction-normalizer.v1";
+    const persistedRevision = isCurrentNoIdProfile
+        ? externalRef.version
+        : externalRef.version ?? providerRecord.occurredAt;
+    if ((!isCurrentNoIdProfile && !isLegacyNoIdProfile)
+        || !junctionNoIdProfileScopeKey(externalRef, origin)
+        || persistedRevision === undefined
+        || !isWritableIsoDateTime(persistedRevision)
+        || !isWritableIsoDateTime(providerRecord.occurredAt)
+        || origin?.observedAtRaw !== providerRecord.occurredAt
+        || (isLegacyNoIdProfile && providerRecord.occurredAt !== persistedRevision)) {
+        return null;
+    }
+    const expectedResourceId = junctionNoIdProfileResourceId(origin, providerRecord.occurredAt);
+    return externalRef.resourceId === expectedResourceId ? persistedRevision : null;
+}
+function junctionNoIdProfilePredecessorRevision(match) {
+    return isDeletedEventSpineRecord(match.record)
+        ? null
+        : junctionNoIdProfileProviderBaselineRevision(match);
+}
+function isJunctionNoIdProfilePredecessor(match) {
+    return junctionNoIdProfileProviderBaselineRevision(match) !== null;
+}
+function indexJunctionNoIdProfilePredecessors(matches) {
+    const byScope = new Map();
+    for (const match of matches) {
+        if (!isJunctionNoIdProfilePredecessor(match)) {
+            continue;
+        }
+        const scopeKey = junctionNoIdProfileScopeKey(match.indexedExternalRef, match.indexedRecord.dataOrigin);
+        if (!scopeKey) {
+            continue;
+        }
+        const scopedMatches = byScope.get(scopeKey) ?? [];
+        scopedMatches.push(match);
+        byScope.set(scopeKey, scopedMatches);
+    }
+    return byScope;
+}
+function isIncomingJunctionNoIdProfile(record) {
+    return record.dataOrigin?.normalizerVersion === JUNCTION_NO_ID_PROFILE_NORMALIZER_VERSION
+        && junctionNoIdProfileScopeKey(record.externalRef, record.dataOrigin) !== null;
+}
+function isIncomingJunctionStableProfileCreatedAt(record) {
+    return record.dataOrigin?.normalizerVersion === JUNCTION_STABLE_PROFILE_CREATED_AT_NORMALIZER_VERSION
+        && junctionNoIdProfileScopeKey(record.externalRef, record.dataOrigin) !== null;
+}
+function isExactJunctionProfileCreatedAtTimestampReplay(existing, incoming) {
+    const existingRef = existing.externalRef;
+    const incomingRef = incoming.externalRef;
+    const existingOrigin = existing.dataOrigin;
+    const incomingOrigin = incoming.dataOrigin;
+    const existingRevision = existingRef?.version ?? existing.occurredAt;
+    const existingScopeKey = junctionNoIdProfileScopeKey(existingRef, existingOrigin);
+    const incomingScopeKey = junctionNoIdProfileScopeKey(incomingRef, incomingOrigin);
+    if (!existingOrigin
+        || !incomingOrigin
+        || existingScopeKey === null
+        || existingScopeKey !== incomingScopeKey
+        || !existingRef
+        || !incomingRef?.version
+        || !isWritableIsoDateTime(existingRevision)
+        || !isWritableIsoDateTime(incomingRef.version)
+        || !isWritableIsoDateTime(existing.occurredAt)
+        || !isWritableIsoDateTime(existing.recordedAt)
+        || !isWritableIsoDateTime(incoming.occurredAt)
+        || !isWritableIsoDateTime(incoming.recordedAt)
+        || compareIsoTimestampsAscending(incomingRef.version, existingRevision) !== 0
+        || (!isDeletedEventSpineRecord(existing)
+            && compareIsoTimestampsAscending(existing.recordedAt, existing.occurredAt) !== 0)
+        || (isDeletedEventSpineRecord(existing)
+            && compareIsoTimestampsAscending(existing.recordedAt, existing.occurredAt) < 0)
+        || existing.dayKey !== toIsoTimestamp(existing.occurredAt, "existing.occurredAt").slice(0, 10)
+        || compareIsoTimestampsAscending(incoming.occurredAt, existing.occurredAt) >= 0
+        || compareIsoTimestampsAscending(incoming.recordedAt, incoming.occurredAt) !== 0
+        || incoming.dayKey !== toIsoTimestamp(incoming.occurredAt, "incoming.occurredAt").slice(0, 10)
+        || existingOrigin.observedAtRaw !== existing.occurredAt
+        || incomingOrigin.observedAtRaw !== incoming.occurredAt
+        || !deviceDataOriginSourceMatches(existingOrigin, incomingOrigin)
+        || existingOrigin.timeZoneOffsetMinutes !== incomingOrigin.timeZoneOffsetMinutes
+        || existingOrigin.timestampSemantics !== incomingOrigin.timestampSemantics
+        || existingOrigin.originConfidence !== incomingOrigin.originConfidence) {
+        return false;
+    }
+    return deviceEventContentKey({
+        ...existing,
+        occurredAt: incoming.occurredAt,
+        recordedAt: incoming.recordedAt,
+        dayKey: incoming.dayKey,
+        externalRef: incomingRef,
+        dataOrigin: incomingOrigin,
+    }) === deviceEventContentKey(incoming);
+}
+// One released Junction normalizer pinned stable-profile occurrence to the
+// mutable updated-at revision. The successor pins occurrence to created-at but
+// deliberately keeps updated-at as source ordering. Admit only that exact,
+// one-way timestamp-only replay so the generic equal-revision guard remains
+// fail-closed for health-data changes.
+function isJunctionStableProfileCreatedAtTimestampMigration(existing, incoming) {
+    const existingRef = existing.externalRef;
+    const incomingRef = incoming.externalRef;
+    return isIncomingJunctionStableProfileCreatedAt(incoming)
+        && existing.dataOrigin?.normalizerVersion === "junction-normalizer.v1"
+        && existingRef?.version !== undefined
+        && incomingRef !== undefined
+        && eventExternalRefKey(existingRef) === eventExternalRefKey(incomingRef)
+        && isExactJunctionProfileCreatedAtTimestampReplay(existing, incoming);
+}
+// Revision-2 admission is account-wide, so a released no-ID profile can be
+// replayed after created_at becomes available while updated_at (the provider
+// revision) is unchanged. Its timestamp-derived resource identity changes,
+// but the replay must not split a member edit or bypass a deletion. Retain the
+// old identity only for this exact timestamp-only transition; changed health
+// data at the same source revision remains a conflict.
+function isJunctionNoIdProfileEqualRevisionTimestampReplay(existing, incoming) {
+    const existingRef = existing.externalRef;
+    const incomingRef = incoming.externalRef;
+    const existingOrigin = existing.dataOrigin;
+    const incomingOrigin = incoming.dataOrigin;
+    if (!isIncomingJunctionNoIdProfile(incoming)
+        || !existingRef
+        || !incomingRef
+        || !existingOrigin
+        || !incomingOrigin
+        || eventExternalRefKey(existingRef) === eventExternalRefKey(incomingRef)
+        || junctionNoIdProfileResourceId(existingOrigin, existing.occurredAt)
+            !== existingRef.resourceId
+        || junctionNoIdProfileResourceId(incomingOrigin, incoming.occurredAt)
+            !== incomingRef.resourceId
+        || !(existingOrigin.normalizerVersion === "junction-normalizer.v1"
+            || existingOrigin.normalizerVersion === JUNCTION_NO_ID_PROFILE_NORMALIZER_VERSION)) {
+        return false;
+    }
+    return isExactJunctionProfileCreatedAtTimestampReplay(existing, incoming);
+}
+function isMemberDeletedJunctionStableProfile(existing, incoming) {
+    const existingRef = existing.externalRef;
+    const incomingRef = incoming.externalRef;
+    if (!existingRef || !incomingRef) {
+        return false;
+    }
+    return isDeletedEventSpineRecord(existing)
+        && isIncomingJunctionStableProfileCreatedAt(incoming)
+        && junctionNoIdProfileScopeKey(existingRef, existing.dataOrigin) !== null
+        && eventExternalRefKey(existingRef) === eventExternalRefKey(incomingRef)
+        && deviceDataOriginSourceMatches(existing.dataOrigin, incoming.dataOrigin)
+        && existingRef?.version !== undefined
+        && isWritableIsoDateTime(existingRef.version)
+        && isWritableIsoDateTime(existing.recordedAt)
+        && compareIsoTimestampsAscending(existing.recordedAt, existingRef.version) > 0;
+}
 function isDateLikeWhoopBodyMeasurementResourceId(resourceId) {
     return /^\d{4}-\d{2}-\d{2}$/u.test(resourceId) ||
         /^date:\d{4}-\d{2}-\d{2}$/u.test(resourceId);
@@ -1174,6 +1518,95 @@ function shouldKeepExistingJunctionSleepStageSummaryObservation(existing, incomi
         isJunctionSleepStageCycleFallbackObservation(incoming);
 }
 const JUNCTION_COMPANION_HEALTH_METADATA_SOURCE_TYPE = "companion-whoop-metadata-unverified";
+const JUNCTION_SPARSE_FLOATING_FALLBACK_NORMALIZER_VERSION = "junction-sparse-timeseries.floating-fallback.v2";
+function resolveJunctionFloatingFallbackTime(existing, incoming) {
+    if (incoming.externalRef?.system !== "junction"
+        || incoming.dataOrigin?.normalizerVersion
+            !== JUNCTION_SPARSE_FLOATING_FALLBACK_NORMALIZER_VERSION
+        || incoming.dataOrigin.timestampSemantics !== "floating") {
+        return incoming;
+    }
+    if (!incoming.timeZone) {
+        return incoming;
+    }
+    // Junction documents Libre's +00:00 values as wall clocks, not instants.
+    // The importer carries those raw wall values through a schema-valid transient
+    // event. Resolve them only after stable external identity lookup, so a matched
+    // row uses its event spine's accepted zone while a new row uses the incoming
+    // fallback zone. Each endpoint resolves independently across DST transitions.
+    const acceptedExisting = existing?.externalRef?.system === "junction"
+        && existing.dataOrigin?.timestampSemantics === "floating"
+        && deviceDataOriginSourceMatches(existing.dataOrigin, incoming.dataOrigin)
+        ? existing
+        : undefined;
+    const targetTimeZone = acceptedExisting?.timeZone ?? incoming.timeZone;
+    const startRaw = incoming.dataOrigin.observedAtRaw;
+    if (typeof startRaw !== "string") {
+        return incoming;
+    }
+    const resolvedOccurrence = resolveFloatingIsoTimestampInTimeZone(startRaw, targetTimeZone);
+    const resolvedStart = incoming.kind === "intervention_session"
+        && typeof incoming.fields?.["start-at"] === "string"
+        ? resolveFloatingIsoTimestampInTimeZone(incoming.fields["start-at"], targetTimeZone)
+        : undefined;
+    const resolvedStartAt = resolvedStart?.timestamp;
+    const resolvedEndAt = incoming.kind === "intervention_session"
+        && typeof incoming.fields?.["end-at"] === "string"
+        ? resolveFloatingIsoTimestampInTimeZone(incoming.fields["end-at"], targetTimeZone)?.timestamp
+        : undefined;
+    if (!resolvedOccurrence
+        || (incoming.kind === "intervention_session"
+            && (!resolvedStartAt
+                || !resolvedEndAt
+                || Date.parse(resolvedEndAt) < Date.parse(resolvedStartAt)))) {
+        return null;
+    }
+    const resolvedInterventionFields = incoming.kind === "intervention_session"
+        && incoming.fields
+        ? {
+            ...incoming.fields,
+            ...(resolvedStartAt ? { "start-at": resolvedStartAt } : {}),
+            ...(resolvedEndAt ? { "end-at": resolvedEndAt } : {}),
+        }
+        : undefined;
+    const canonicalOccurrence = incoming.kind === "intervention_session"
+        && resolvedStartAt
+        ? resolvedStartAt
+        : resolvedOccurrence.timestamp;
+    const canonicalDayKey = incoming.kind === "intervention_session"
+        && resolvedStart
+        ? resolvedStart.dayKey
+        : resolvedOccurrence.dayKey;
+    return {
+        ...incoming,
+        occurredAt: canonicalOccurrence,
+        recordedAt: acceptedExisting?.recordedAt ?? incoming.recordedAt,
+        dayKey: canonicalDayKey,
+        timeZone: targetTimeZone,
+        ...(incoming.kind === "intervention_session" && resolvedInterventionFields
+            ? { fields: resolvedInterventionFields }
+            : {}),
+    };
+}
+function resolveJunctionFloatingFallbackEntries(entries, context) {
+    return entries.flatMap((entry) => {
+        if (entry.record.externalRef?.system !== "junction"
+            || entry.record.dataOrigin?.normalizerVersion
+                !== JUNCTION_SPARSE_FLOATING_FALLBACK_NORMALIZER_VERSION) {
+            return [entry];
+        }
+        const resolved = resolveDeviceEventIdentity(entry, context, { strict: true });
+        const indexedProviderMatch = resolved?.matchedEntries.find((match) => match.indexedMatch.record.id === resolved.latest?.id)?.indexedMatch ?? resolved?.matchedEntries[0]?.indexedMatch;
+        const canonicalRecord = resolveJunctionFloatingFallbackTime(indexedProviderMatch?.indexedRecord, entry.record);
+        return canonicalRecord
+            ? [{
+                    ...entry,
+                    relativePath: toEventLedgerFile(canonicalRecord.occurredAt),
+                    record: canonicalRecord,
+                }]
+            : [];
+    });
+}
 function parseJunctionCompanionSyncVersion(version) {
     if (!version || !/^(?:0|[1-9]\d*)$/u.test(version)) {
         return undefined;
@@ -1275,12 +1708,126 @@ function toIndexedExternalRefMatch(record, externalRef, relativePath = "") {
         record,
     };
 }
-function userAuthoredEventStateKey(record) {
-    return stableStringify({
-        links: record.links ?? [],
-        note: record.note ?? null,
-        tags: record.tags ?? [],
+const deviceBatchImportSessionState = new WeakMap();
+export function createDeviceBatchImportSession() {
+    const session = Object.freeze({
+        kind: "device_batch_import_session",
+    });
+    deviceBatchImportSessionState.set(session, new Map());
+    return session;
+}
+function buildDeviceEventIdentityDependency(plan, additionalEventIds = []) {
+    const externalRefs = plan.preparedEvents.flatMap((entry) => [
+        ...(entry.record.externalRef ? [entry.record.externalRef] : []),
+        ...entry.legacyExternalRefs,
+    ]);
+    return {
+        authoritativeEventSets: plan.authoritativeEventSets,
+        eventIds: new Set([
+            ...plan.preparedEvents.map((entry) => entry.record.id),
+            ...additionalEventIds,
+        ]),
+        externalRefs,
+        junctionNoIdProfileScopes: new Set(plan.preparedEvents.flatMap((entry) => {
+            const externalRef = entry.record.externalRef;
+            const scope = externalRef
+                ? junctionNoIdProfileScopeKey(externalRef, entry.record.dataOrigin)
+                : null;
+            return scope ? [scope] : [];
+        })),
+    };
+}
+function eventRefBelongsToAuthoritativeSet(externalRef, set) {
+    if (externalRef.system !== set.system
+        || externalRef.resourceType !== set.resourceType
+        || externalRef.resourceId !== set.resourceId
+        || externalRef.facet === undefined) {
+        return false;
+    }
+    return set.facetPrefixes.some((prefix) => externalRef.facet === prefix || externalRef.facet?.startsWith(`${prefix}-`));
+}
+function authoritativeEventSetsOverlap(left, right) {
+    if (left.system !== right.system
+        || left.resourceType !== right.resourceType
+        || left.resourceId !== right.resourceId) {
+        return false;
+    }
+    return left.facetPrefixes.some((leftPrefix) => right.facetPrefixes.some((rightPrefix) => leftPrefix === rightPrefix
+        || leftPrefix.startsWith(`${rightPrefix}-`)
+        || rightPrefix.startsWith(`${leftPrefix}-`)));
+}
+function deviceEventIdentityDependenciesOverlap(left, right) {
+    if ([...left.eventIds].some((eventId) => right.eventIds.has(eventId))) {
+        return true;
+    }
+    const rightRefKeys = new Set(right.externalRefs.map(eventExternalRefKey));
+    if (left.externalRefs.some((externalRef) => rightRefKeys.has(eventExternalRefKey(externalRef)))) {
+        return true;
+    }
+    if ([...left.junctionNoIdProfileScopes].some((scope) => right.junctionNoIdProfileScopes.has(scope))) {
+        return true;
+    }
+    if (left.externalRefs.some((externalRef) => right.authoritativeEventSets.some((set) => eventRefBelongsToAuthoritativeSet(externalRef, set)))) {
+        return true;
+    }
+    if (right.externalRefs.some((externalRef) => left.authoritativeEventSets.some((set) => eventRefBelongsToAuthoritativeSet(externalRef, set)))) {
+        return true;
+    }
+    return left.authoritativeEventSets.some((leftSet) => right.authoritativeEventSets.some((rightSet) => authoritativeEventSetsOverlap(leftSet, rightSet)));
+}
+function readDeviceBatchImportSessionVaultState(session, vaultRoot) {
+    return session ? deviceBatchImportSessionState.get(session)?.get(vaultRoot) : undefined;
+}
+function replaceDeviceBatchImportSessionVaultState(session, vaultRoot, state) {
+    if (!session) {
+        return;
+    }
+    deviceBatchImportSessionState.get(session)?.set(vaultRoot, state);
+}
+function clearDeviceBatchImportSessionVaultState(session, vaultRoot) {
+    if (!session) {
+        return;
+    }
+    deviceBatchImportSessionState.get(session)?.delete(vaultRoot);
+}
+function emitDeviceBatchImportTiming(observer, timing) {
+    try {
+        observer?.({ ...timing });
+    }
+    catch {
+        // Diagnostics must not turn an already-committed canonical write into an
+        // apparent import failure.
+    }
+}
+async function buildDeviceEventLedgerFingerprint(vaultRoot) {
+    const shardPaths = await walkVaultFiles(vaultRoot, VAULT_LAYOUT.eventLedgerDirectory, {
+        extension: ".jsonl",
     });
+    const metadata = await Promise.all(shardPaths.map(async (relativePath) => {
+        const shard = await stat(resolveVaultPath(vaultRoot, relativePath).absolutePath);
+        return [
+            relativePath,
+            shard.dev,
+            shard.ino,
+            shard.size,
+            shard.mtimeMs,
+            shard.ctimeMs,
+        ].join("\0");
+    }));
+    return createHash("sha256").update(metadata.join("\n")).digest("hex");
+}
+async function tryBuildDeviceEventLedgerFingerprint(vaultRoot) {
+    try {
+        return await buildDeviceEventLedgerFingerprint(vaultRoot);
+    }
+    catch {
+        // A failed cache fence disables reuse. The canonical import path remains
+        // authoritative and will surface any real ledger read failure itself.
+        return undefined;
+    }
+}
+function userAuthoredEventStateKey(record) {
+    return eventContentKey(record, { includeProviderAttribution: false });
 }
 function hasHistoricalExternalRefUserAuthoredChanges(match) {
     return eventSpineRevision(match.record) > eventSpineRevision(match.indexedRecord) &&
@@ -1288,40 +1835,99 @@ function hasHistoricalExternalRefUserAuthoredChanges(match) {
 }
 function buildLegacyExternalRefReservations(entries, index) {
     const reservations = new Map();
+    const reserve = (entry, refKey, indexedMatch) => {
+        const existing = reservations.get(refKey);
+        if (existing && existing.entry !== entry) {
+            const externalRef = indexedMatch.indexedExternalRef;
+            throw new VaultError("EVENT_EXTERNAL_REF_ALIAS_CONFLICT", `Event legacy externalRef "${externalRef.system}/${externalRef.resourceType}/` +
+                `${externalRef.resourceId}${externalRef.facet ? `#${externalRef.facet}` : ""}" ` +
+                "matched multiple incoming device events; ambiguous legacy cleanup must be repaired explicitly.");
+        }
+        reservations.set(refKey, { entry, indexedMatch });
+    };
     for (const entry of entries) {
         const externalRef = entry.record.externalRef;
         if (!externalRef) {
             continue;
         }
         const primaryRefKey = eventExternalRefKey(externalRef);
+        const dailyAliasOwnerSplit = resolveJunctionDailyAggregateAliasOwnerSplit(entry, index);
         for (const legacyExternalRef of entry.legacyExternalRefs) {
             const legacyRefKey = eventExternalRefKey(legacyExternalRef);
             if (legacyRefKey === primaryRefKey) {
                 continue;
             }
-            const indexedMatch = index.latestByRefKey.get(legacyRefKey);
-            if (!indexedMatch || !isCompatibleLegacyExternalRefMatch(indexedMatch, entry.record, legacyExternalRef)) {
+            const persistedAliasMatch = dailyAliasOwnerSplit?.legacyRefKey === legacyRefKey
+                ? dailyAliasOwnerSplit.legacyOwner
+                : undefined;
+            const indexedMatch = persistedAliasMatch ?? index.latestByRefKey.get(legacyRefKey);
+            if (!indexedMatch
+                || (!persistedAliasMatch
+                    && !isCompatibleLegacyExternalRefMatch(indexedMatch, entry.record, legacyExternalRef))) {
                 continue;
             }
-            const existing = reservations.get(legacyRefKey);
-            if (existing && existing.entry !== entry) {
-                throw new VaultError("EVENT_EXTERNAL_REF_ALIAS_CONFLICT", `Event legacy externalRef "${legacyExternalRef.system}/${legacyExternalRef.resourceType}/` +
-                    `${legacyExternalRef.resourceId}${legacyExternalRef.facet ? `#${legacyExternalRef.facet}` : ""}" ` +
-                    "matched multiple incoming device events; ambiguous legacy cleanup must be repaired explicitly.");
+            reserve(entry, legacyRefKey, indexedMatch);
+        }
+        if (!isIncomingJunctionNoIdProfile(entry.record)) {
+            continue;
+        }
+        const scopeKey = junctionNoIdProfileScopeKey(externalRef, entry.record.dataOrigin);
+        const incomingRevision = externalRef.version;
+        if (!scopeKey || !incomingRevision || !isWritableIsoDateTime(incomingRevision)) {
+            continue;
+        }
+        const scopedMatches = (index.junctionNoIdProfilePredecessorsByScope.get(scopeKey) ?? [])
+            .filter((match) => eventExternalRefKey(match.indexedExternalRef) !== primaryRefKey);
+        const equalRevisionMatches = scopedMatches.filter((match) => {
+            const predecessorRevision = junctionNoIdProfileProviderBaselineRevision(match);
+            return predecessorRevision !== null
+                && compareIsoTimestampsAscending(incomingRevision, predecessorRevision) === 0;
+        });
+        if (equalRevisionMatches.length > 1) {
+            throw new VaultError("EVENT_EXTERNAL_REF_ALIAS_CONFLICT", `Junction profile externalRef "${externalRef.system}/${externalRef.resourceType}/` +
+                `${externalRef.resourceId}${externalRef.facet ? `#${externalRef.facet}` : ""}" ` +
+                "matched multiple persisted identities at the same provider revision; nothing was imported.");
+        }
+        const equalRevisionMatch = equalRevisionMatches[0];
+        if (equalRevisionMatch) {
+            if (!isJunctionNoIdProfileEqualRevisionTimestampReplay(equalRevisionMatch.indexedRecord, entry.record)) {
+                throw new VaultError("EVENT_SOURCE_REVISION_CONFLICT", `Junction profile externalRef "${externalRef.system}/${externalRef.resourceType}/` +
+                    `${externalRef.resourceId}${externalRef.facet ? `#${externalRef.facet}` : ""}" ` +
+                    `has conflicting content for source revision "${incomingRevision}"; nothing was imported.`);
             }
-            reservations.set(legacyRefKey, { entry, indexedMatch });
+            reserve(entry, eventExternalRefKey(equalRevisionMatch.indexedExternalRef), equalRevisionMatch);
+            continue;
+        }
+        const predecessorMatches = scopedMatches.filter((match) => {
+            const predecessorRevision = junctionNoIdProfilePredecessorRevision(match);
+            return predecessorRevision !== null
+                && compareIsoTimestampsAscending(incomingRevision, predecessorRevision) > 0;
+        });
+        if (predecessorMatches.length > 1) {
+            throw new VaultError("EVENT_EXTERNAL_REF_ALIAS_CONFLICT", `Junction profile externalRef "${externalRef.system}/${externalRef.resourceType}/` +
+                `${externalRef.resourceId}${externalRef.facet ? `#${externalRef.facet}` : ""}" ` +
+                "matched multiple persisted predecessor identities; nothing was imported.");
+        }
+        const predecessor = predecessorMatches[0];
+        if (predecessor) {
+            reserve(entry, eventExternalRefKey(predecessor.indexedExternalRef), predecessor);
         }
     }
     return reservations;
 }
-async function buildDeviceEventIdentityContext(vaultRoot, entries) {
-    if (entries.length === 0) {
+async function buildDeviceEventIdentityContext(vaultRoot, entries, authoritativeEventSets = []) {
+    if (entries.length === 0 && authoritativeEventSets.length === 0) {
         return {
             index: {
+                aliasRepairContaminatedEventIds: new Set(),
+                aliasRepairContaminatedRefKeys: new Set(),
+                aliasRepairHistoryById: new Map(),
                 deviceOwnerRevisionsByRefKeyAndFingerprint: new Map(),
+                junctionNoIdProfilePredecessorsByScope: new Map(),
                 junctionSparseDayHistoryById: new Map(),
                 latestByRefKey: new Map(),
                 latestById: new Map(),
+                liveOwnerIdsByRefKey: new Map(),
                 maxRevisionById: new Map(),
                 revisionsById: new Map(),
             },
@@ -1332,30 +1938,55 @@ async function buildDeviceEventIdentityContext(vaultRoot, entries) {
         extension: ".jsonl",
     });
     const index = await indexLatestEventsByExternalRef(vaultRoot, shardPaths);
-    return {
-        index,
-        legacyReservations: buildLegacyExternalRefReservations(entries, index),
-    };
+    const context = { index, legacyReservations: new Map() };
+    // A legitimate primary spine may advance before the duplicate is repaired.
+    // Load only structural candidates first so reservations can use the bounded
+    // common-initial-history proof instead of latest-record equality.
+    const aliasRepairOwnerIds = new Set();
+    for (const entry of entries) {
+        const ownerSplit = resolveStructuralJunctionDailyAggregateAliasOwnerSplit(entry, index);
+        if (!ownerSplit) {
+            continue;
+        }
+        assertJunctionDailyAggregateAliasHistoryIsUncontaminated(entry, context);
+        aliasRepairOwnerIds.add(ownerSplit.primaryOwner.record.id);
+        aliasRepairOwnerIds.add(ownerSplit.legacyOwner.record.id);
+    }
+    if (aliasRepairOwnerIds.size > 0) {
+        index.aliasRepairHistoryById = await loadBoundedAliasRepairHistories(vaultRoot, shardPaths, aliasRepairOwnerIds);
+    }
+    context.legacyReservations = buildLegacyExternalRefReservations(entries, index);
+    return context;
 }
 function cloneDeviceEventIdentityContext(context) {
     return {
         index: {
+            aliasRepairContaminatedEventIds: new Set(context.index.aliasRepairContaminatedEventIds),
+            aliasRepairContaminatedRefKeys: new Set(context.index.aliasRepairContaminatedRefKeys),
+            aliasRepairHistoryById: new Map([...context.index.aliasRepairHistoryById].map(([id, history]) => [id, [...history]])),
             deviceOwnerRevisionsByRefKeyAndFingerprint: context.index.deviceOwnerRevisionsByRefKeyAndFingerprint,
+            junctionNoIdProfilePredecessorsByScope: context.index.junctionNoIdProfilePredecessorsByScope,
             junctionSparseDayHistoryById: context.index.junctionSparseDayHistoryById,
             latestByRefKey: new Map(context.index.latestByRefKey),
             latestById: new Map(context.index.latestById),
+            liveOwnerIdsByRefKey: new Map([...context.index.liveOwnerIdsByRefKey].map(([key, ids]) => [key, new Set(ids)])),
             maxRevisionById: new Map(context.index.maxRevisionById),
-            revisionsById: new Map(context.index.revisionsById),
+            revisionsById: new Map([...context.index.revisionsById].map(([id, revisions]) => [id, new Set(revisions)])),
         },
         legacyReservations: new Map(context.legacyReservations),
     };
 }
 function buildEmptyDeviceEventIdentityContext(entries) {
     const index = {
+        aliasRepairContaminatedEventIds: new Set(),
+        aliasRepairContaminatedRefKeys: new Set(),
+        aliasRepairHistoryById: new Map(),
         deviceOwnerRevisionsByRefKeyAndFingerprint: new Map(),
+        junctionNoIdProfilePredecessorsByScope: new Map(),
         junctionSparseDayHistoryById: new Map(),
         latestByRefKey: new Map(),
         latestById: new Map(),
+        liveOwnerIdsByRefKey: new Map(),
         maxRevisionById: new Map(),
         revisionsById: new Map(),
     };
@@ -1372,6 +2003,470 @@ function eventSpineRevisionsAreComplete(index, eventId) {
         && revisions !== undefined
         && revisions.size === maxRevision;
 }
+function buildDeviceEventAliasRepairContext(plan) {
+    return {
+        evidenceByRole: new Map(plan.preparedEvidenceParts.map((part) => [part.role, part])),
+        evidenceRolesByPreparedRecordId: plan.evidenceRolesByPreparedRecordId,
+    };
+}
+function isLooseRecordValue(value) {
+    return value !== null && typeof value === "object" && !Array.isArray(value);
+}
+function readRejectedEventExternalRefKey(value) {
+    if (!isLooseRecordValue(value)) {
+        return undefined;
+    }
+    const parsed = safeParseContract(externalRefSchema, {
+        system: value.system,
+        resourceType: value.resourceType,
+        resourceId: value.resourceId,
+        ...(value.facet === undefined ? {} : { facet: value.facet }),
+        ...(value.version === undefined ? {} : { version: value.version }),
+    });
+    return parsed.success ? eventExternalRefKey(parsed.data) : undefined;
+}
+function junctionDailyAggregateAliasRefShape(externalRef) {
+    return stableStringify({
+        facet: externalRef.facet ?? null,
+        resourceType: externalRef.resourceType,
+        system: externalRef.system,
+        version: externalRef.version ?? null,
+    });
+}
+function junctionDailyAggregateAliasOriginKey(origin) {
+    if (!origin) {
+        return null;
+    }
+    const { observedAtRaw: _observedAtRaw, ...stableOrigin } = origin;
+    return stableStringify(stableOrigin);
+}
+function junctionDailyAggregateAliasHistoricalOriginMatches(historical, current) {
+    if (!historical) {
+        return false;
+    }
+    if (junctionDailyAggregateAliasOriginKey(historical)
+        === junctionDailyAggregateAliasOriginKey(current)) {
+        return true;
+    }
+    if (historical.timeZoneOffsetMinutes !== undefined) {
+        return false;
+    }
+    const { observedAtRaw: _historicalObservedAtRaw, timeZoneOffsetMinutes: _historicalOffset, ...stableHistorical } = historical;
+    const { observedAtRaw: _currentObservedAtRaw, timeZoneOffsetMinutes: _currentOffset, ...stableCurrent } = current;
+    return stableStringify(stableHistorical) === stableStringify(stableCurrent);
+}
+function junctionDailyAggregateProviderStateKey(record) {
+    const { dataOrigin: _dataOrigin, dayKey: _dayKey, externalRef: _externalRef, id: _id, lifecycle: _lifecycle, links: _links, note: _note, recordedAt: _recordedAt, source: _source, tags: _tags, ...providerState } = record;
+    return stableStringify(providerState);
+}
+function isJunctionDailyAggregateAliasCandidate(entry) {
+    const externalRef = entry.record.externalRef;
+    const legacyExternalRef = entry.legacyExternalRefs[0];
+    return externalRef !== undefined
+        && legacyExternalRef !== undefined
+        && entry.legacyExternalRefs.length === 1
+        && entry.record.kind === "observation"
+        && entry.record.source === "device"
+        && entry.record.dataOrigin?.aggregatorProvider === "junction"
+        && entry.record.dataOrigin.normalizerVersion === "junction-normalizer.v1"
+        && externalRef.system === "junction"
+        && externalRef.version === undefined
+        && legacyExternalRef.version === undefined
+        && eventExternalRefKey(externalRef) !== eventExternalRefKey(legacyExternalRef)
+        && junctionDailyAggregateAliasRefShape(externalRef)
+            === junctionDailyAggregateAliasRefShape(legacyExternalRef)
+        && entry.record.note === undefined
+        && entry.record.tags === undefined
+        && entry.record.links === undefined
+        && entry.record.rawRefs === undefined
+        && entry.record.evidence === undefined
+        && entry.record.attachments === undefined;
+}
+function resolveStructuralJunctionDailyAggregateAliasOwnerSplit(entry, index) {
+    const externalRef = entry.record.externalRef;
+    const legacyExternalRef = entry.legacyExternalRefs[0];
+    if (!externalRef
+        || !legacyExternalRef
+        || !isJunctionDailyAggregateAliasCandidate(entry)) {
+        return null;
+    }
+    const primaryRefKey = eventExternalRefKey(externalRef);
+    const legacyRefKey = eventExternalRefKey(legacyExternalRef);
+    const primaryOwnerIds = index.liveOwnerIdsByRefKey.get(primaryRefKey)
+        ?? new Set();
+    const legacyOwnerIds = index.liveOwnerIdsByRefKey.get(legacyRefKey)
+        ?? new Set();
+    if (primaryOwnerIds.size === 0 || legacyOwnerIds.size === 0) {
+        return null;
+    }
+    const primaryOwner = index.latestByRefKey.get(primaryRefKey);
+    const legacyOwner = index.latestByRefKey.get(legacyRefKey);
+    if (!primaryOwner || !legacyOwner) {
+        return null;
+    }
+    const primaryProviderRecord = primaryOwner.indexedRecord;
+    const legacyProviderRecord = legacyOwner.indexedRecord;
+    const primaryOrigin = primaryProviderRecord.dataOrigin;
+    const legacyOrigin = legacyProviderRecord.dataOrigin;
+    const incomingOrigin = entry.record.dataOrigin;
+    const observedAtRaw = incomingOrigin?.observedAtRaw;
+    const observedAtRawPrefix = `${entry.record.dayKey}:`;
+    const resource = observedAtRaw?.startsWith(observedAtRawPrefix)
+        && observedAtRaw.endsWith(":daily")
+        ? observedAtRaw.slice(observedAtRawPrefix.length, -":daily".length)
+        : "";
+    if (primaryProviderRecord.dayKey !== entry.record.dayKey
+        || !isSameObservationFacet(primaryProviderRecord, entry.record)
+        || !isSameObservationFacet(primaryProviderRecord, legacyProviderRecord)
+        || junctionDailyAggregateAliasRefShape(primaryOwner.indexedExternalRef)
+            !== junctionDailyAggregateAliasRefShape(externalRef)
+        || junctionDailyAggregateAliasRefShape(legacyOwner.indexedExternalRef)
+            !== junctionDailyAggregateAliasRefShape(legacyExternalRef)
+        || !primaryOrigin
+        || !legacyOrigin
+        || !incomingOrigin
+        || resource.length === 0
+        || !deviceDataOriginSourceMatches(primaryOrigin, incomingOrigin)
+        || !deviceDataOriginSourceMatches(legacyOrigin, incomingOrigin)) {
+        return null;
+    }
+    const distinctOwnerIds = new Set([...primaryOwnerIds, ...legacyOwnerIds]);
+    if (distinctOwnerIds.size < 2) {
+        return null;
+    }
+    if (primaryOwnerIds.size !== 1
+        || legacyOwnerIds.size !== 1
+        || distinctOwnerIds.size !== 2) {
+        throw new VaultError("EVENT_ALIAS_REPAIR_OWNER_REFUSED", "Junction daily aggregate alias repair requires exactly one live owner per claimed reference.");
+    }
+    if (!primaryOwnerIds.has(primaryOwner.record.id)
+        || !legacyOwnerIds.has(legacyOwner.record.id)
+        || primaryOwner.record.id === legacyOwner.record.id) {
+        throw new VaultError("EVENT_ALIAS_REPAIR_OWNER_REFUSED", "Junction daily aggregate alias repair could not prove the two live reference owners.");
+    }
+    return { legacyOwner, legacyRefKey, primaryOwner, primaryRefKey, resource };
+}
+function assertJunctionDailyAggregateAliasHistoryIsUncontaminated(entry, context) {
+    const externalRef = entry.record.externalRef;
+    const legacyExternalRef = entry.legacyExternalRefs[0];
+    if (!externalRef || !legacyExternalRef) {
+        return;
+    }
+    const primaryRefKey = eventExternalRefKey(externalRef);
+    const legacyRefKey = eventExternalRefKey(legacyExternalRef);
+    const ownerIds = new Set([
+        ...(context.index.liveOwnerIdsByRefKey.get(primaryRefKey) ?? []),
+        ...(context.index.liveOwnerIdsByRefKey.get(legacyRefKey) ?? []),
+    ]);
+    if ([...ownerIds].some((id) => context.index.aliasRepairContaminatedEventIds.has(id))
+        || context.index.aliasRepairContaminatedRefKeys.has(primaryRefKey)
+        || context.index.aliasRepairContaminatedRefKeys.has(legacyRefKey)) {
+        throw new VaultError("EVENT_ALIAS_REPAIR_HISTORY_REFUSED", "Junction daily aggregate alias repair found a schema-rejected candidate revision.");
+    }
+}
+function parseJunctionDailyAggregateAliasEvidence(entry, context) {
+    const roles = context.evidenceRolesByPreparedRecordId.get(entry.record.id) ?? [];
+    const part = roles.length === 1 ? context.evidenceByRole.get(roles[0]) : undefined;
+    const metadata = part?.metadata;
+    if (!part
+        || !isLooseRecordValue(metadata)
+        || metadata.artifactClass !== "compact_provider_timeseries_aggregate"
+        || metadata.provider !== "junction"
+        || metadata.resourceCategory !== "timeseries_daily_aggregate"
+        || metadata.retentionClass !== "provider_evidence") {
+        throw new VaultError("EVENT_ALIAS_REPAIR_EVIDENCE_REFUSED", "Junction daily aggregate alias repair requires one exact compact provider evidence role.");
+    }
+    let parsed;
+    try {
+        parsed = JSON.parse(part.content);
+    }
+    catch {
+        throw new VaultError("EVENT_ALIAS_REPAIR_EVIDENCE_REFUSED", "Junction daily aggregate alias repair evidence was not valid JSON.");
+    }
+    if (!isLooseRecordValue(parsed)) {
+        throw new VaultError("EVENT_ALIAS_REPAIR_EVIDENCE_REFUSED", "Junction daily aggregate alias repair evidence did not contain an object.");
+    }
+    const legacyDayKeys = parsed.legacyDayKeys;
+    const origin = entry.record.dataOrigin;
+    if (parsed.schema !== "junction.timeseries_daily_aggregate.v1"
+        || parsed.provider !== "junction"
+        || typeof parsed.resource !== "string"
+        || parsed.resource.length === 0
+        || metadata.resource !== parsed.resource
+        || typeof parsed.dayKey !== "string"
+        || !/^\d{4}-\d{2}-\d{2}$/u.test(parsed.dayKey)
+        || parsed.dayKey !== entry.record.dayKey
+        || typeof parsed.sourceProviderSlug !== "string"
+        || parsed.sourceProviderSlug.length === 0
+        || typeof parsed.sampleCount !== "number"
+        || !Number.isSafeInteger(parsed.sampleCount)
+        || parsed.sampleCount <= 0
+        || !Array.isArray(legacyDayKeys)
+        || legacyDayKeys.length !== 1
+        || typeof legacyDayKeys[0] !== "string"
+        || !/^\d{4}-\d{2}-\d{2}$/u.test(legacyDayKeys[0])
+        || legacyDayKeys[0] === parsed.dayKey
+        || (parsed.sourceType !== undefined && typeof parsed.sourceType !== "string")
+        || (parsed.sourceInstanceId !== undefined
+            && parsed.sourceInstanceId !== null
+            && typeof parsed.sourceInstanceId !== "string")
+        || origin?.sourceProviderSlug !== parsed.sourceProviderSlug
+        || (origin.sourceType ?? null) !== (parsed.sourceType ?? null)
+        || (origin.sourceInstanceId ?? null) !== (parsed.sourceInstanceId ?? null)
+        || origin.observedAtRaw !== `${parsed.dayKey}:${parsed.resource}:daily`) {
+        throw new VaultError("EVENT_ALIAS_REPAIR_EVIDENCE_REFUSED", "Junction daily aggregate alias repair evidence did not prove one normalized primary and legacy day split.");
+    }
+    return {
+        dayKey: parsed.dayKey,
+        legacyDayKey: legacyDayKeys[0],
+        resource: parsed.resource,
+    };
+}
+function readCompleteJunctionDailyAggregateAliasHistory(index, eventId) {
+    const history = index.aliasRepairHistoryById.get(eventId) ?? [];
+    const maxRevision = index.maxRevisionById.get(eventId) ?? 0;
+    const revisions = index.revisionsById.get(eventId);
+    if (maxRevision < 1
+        || maxRevision > MAX_JUNCTION_DAILY_ALIAS_REPAIR_REVISIONS
+        || !revisions
+        || revisions.size !== maxRevision
+        || history.length !== maxRevision
+        || history.some((entry, historyIndex) => eventSpineRevision(entry.record) !== historyIndex + 1)) {
+        throw new VaultError("EVENT_ALIAS_REPAIR_HISTORY_REFUSED", "Junction daily aggregate alias repair requires a complete bounded event history.");
+    }
+    return history;
+}
+function junctionDailyAggregateAliasPersistedOriginsMatch(left, right) {
+    if (!left || !right) {
+        return false;
+    }
+    return junctionDailyAggregateAliasHistoricalOriginMatches(left, right)
+        || junctionDailyAggregateAliasHistoricalOriginMatches(right, left);
+}
+function junctionDailyAggregateAliasInitialRecordMatches(record, input) {
+    return record !== undefined
+        && record.source === "device"
+        && !isDeletedEventSpineRecord(record)
+        && record.dayKey === input.expectedDayKey
+        && record.dataOrigin?.observedAtRaw === input.expectedObservedAtRaw
+        && record.externalRef !== undefined
+        && eventExternalRefKey(record.externalRef)
+            === eventExternalRefKey(input.expectedExternalRef)
+        && junctionDailyAggregateAliasRefShape(record.externalRef)
+            === junctionDailyAggregateAliasRefShape(input.expectedExternalRef);
+}
+function analyzeJunctionDailyAggregateAliasHistoryEvolution(input) {
+    const expectedRefKey = eventExternalRefKey(input.expectedExternalRef);
+    let providerStateKey = input.initialProviderStateKey;
+    let memberCarrierStateKey;
+    for (const { record } of input.history) {
+        const recordProviderStateKey = junctionDailyAggregateProviderStateKey(record);
+        const providerRecord = record.source === "device";
+        const manualMatchesProvider = recordProviderStateKey === providerStateKey;
+        const manualMatchesCarrier = memberCarrierStateKey !== undefined
+            && recordProviderStateKey === memberCarrierStateKey;
+        if (isDeletedEventSpineRecord(record)
+            || (record.source !== "device" && record.source !== "manual")
+            || record.dayKey !== input.expectedDayKey
+            || !isSameObservationFacet(input.initialRecord, record)
+            || (providerRecord
+                && (!record.externalRef
+                    || !record.dataOrigin))
+            || (record.externalRef !== undefined
+                && (eventExternalRefKey(record.externalRef) !== expectedRefKey
+                    || junctionDailyAggregateAliasRefShape(record.externalRef)
+                        !== junctionDailyAggregateAliasRefShape(input.expectedExternalRef)))
+            || (record.dataOrigin !== undefined
+                && (record.dataOrigin.observedAtRaw !== input.expectedObservedAtRaw
+                    || !junctionDailyAggregateAliasHistoricalOriginMatches(record.dataOrigin, input.expectedOrigin)))
+            || (providerRecord
+                ? !input.allowProviderEvolution
+                    && recordProviderStateKey !== input.initialProviderStateKey
+                : !manualMatchesProvider && !manualMatchesCarrier)) {
+            throw new VaultError("EVENT_ALIAS_REPAIR_HISTORY_REFUSED", "Junction daily aggregate alias repair found unsupported or divergent historical state.");
+        }
+        if (providerRecord) {
+            providerStateKey = recordProviderStateKey;
+        }
+        else if (manualMatchesProvider) {
+            memberCarrierStateKey = recordProviderStateKey;
+        }
+    }
+    const latest = input.history.at(-1)?.record;
+    if (!latest) {
+        throw new VaultError("EVENT_ALIAS_REPAIR_HISTORY_REFUSED", "Junction daily aggregate alias repair requires a complete bounded event history.");
+    }
+    const links = [...(latest.links ?? [])];
+    const tags = [...(latest.tags ?? [])];
+    return {
+        links,
+        memberAuthored: latest.source === "manual"
+            || latest.note !== undefined
+            || tags.length > 0
+            || links.length > 0,
+        ...(latest.note ? { note: latest.note } : {}),
+        tags,
+    };
+}
+function resolveJunctionDailyAggregateAliasOwnerSplit(entry, index) {
+    const ownerSplit = resolveStructuralJunctionDailyAggregateAliasOwnerSplit(entry, index);
+    const externalRef = entry.record.externalRef;
+    const legacyExternalRef = entry.legacyExternalRefs[0];
+    if (!ownerSplit || !externalRef || !legacyExternalRef || !entry.record.dataOrigin) {
+        return null;
+    }
+    const primaryInitial = index.aliasRepairHistoryById.get(ownerSplit.primaryOwner.record.id)?.[0]?.record;
+    const legacyInitial = index.aliasRepairHistoryById.get(ownerSplit.legacyOwner.record.id)?.[0]?.record;
+    const legacyDayKey = ownerSplit.legacyOwner.indexedRecord.dayKey;
+    // Divergent initial baselines are ordinary adjacent-day owners. Once the
+    // baselines match, every later revision must satisfy the bounded evolution
+    // rules before this pair can reserve or mutate either identity.
+    if (!junctionDailyAggregateAliasInitialRecordMatches(primaryInitial, {
+        expectedDayKey: entry.record.dayKey,
+        expectedExternalRef: externalRef,
+        expectedObservedAtRaw: `${entry.record.dayKey}:${ownerSplit.resource}:daily`,
+    })
+        || !junctionDailyAggregateAliasInitialRecordMatches(legacyInitial, {
+            expectedDayKey: legacyDayKey,
+            expectedExternalRef: legacyExternalRef,
+            expectedObservedAtRaw: `${legacyDayKey}:${ownerSplit.resource}:daily`,
+        })
+        || !isSameObservationFacet(primaryInitial, legacyInitial)
+        || junctionDailyAggregateProviderStateKey(primaryInitial)
+            !== junctionDailyAggregateProviderStateKey(legacyInitial)
+        || !junctionDailyAggregateAliasPersistedOriginsMatch(primaryInitial.dataOrigin, legacyInitial.dataOrigin)) {
+        return null;
+    }
+    const primaryHistory = readCompleteJunctionDailyAggregateAliasHistory(index, ownerSplit.primaryOwner.record.id);
+    const legacyHistory = readCompleteJunctionDailyAggregateAliasHistory(index, ownerSplit.legacyOwner.record.id);
+    const primaryOverlay = analyzeJunctionDailyAggregateAliasHistoryEvolution({
+        allowProviderEvolution: true,
+        expectedDayKey: entry.record.dayKey,
+        expectedExternalRef: externalRef,
+        expectedOrigin: entry.record.dataOrigin,
+        expectedObservedAtRaw: `${entry.record.dayKey}:${ownerSplit.resource}:daily`,
+        history: primaryHistory,
+        initialProviderStateKey: junctionDailyAggregateProviderStateKey(primaryInitial),
+        initialRecord: primaryInitial,
+    });
+    const legacyOverlay = analyzeJunctionDailyAggregateAliasHistoryEvolution({
+        allowProviderEvolution: false,
+        expectedDayKey: legacyDayKey,
+        expectedExternalRef: legacyExternalRef,
+        expectedOrigin: entry.record.dataOrigin,
+        expectedObservedAtRaw: `${legacyDayKey}:${ownerSplit.resource}:daily`,
+        history: legacyHistory,
+        initialProviderStateKey: junctionDailyAggregateProviderStateKey(legacyInitial),
+        initialRecord: legacyInitial,
+    });
+    return { ...ownerSplit, legacyOverlay, primaryOverlay };
+}
+function hasJunctionDailyAggregateAliasSplit(entry, context) {
+    return resolveJunctionDailyAggregateAliasOwnerSplit(entry, context.index) !== null;
+}
+function mergeJunctionDailyAggregateAliasOverlays(primary, legacy) {
+    if (primary.note && legacy.note && primary.note !== legacy.note) {
+        throw new VaultError("EVENT_ALIAS_REPAIR_OVERLAY_REFUSED", "Junction daily aggregate alias repair found conflicting member notes.");
+    }
+    const linksByKey = new Map();
+    for (const link of [...primary.links, ...legacy.links]) {
+        linksByKey.set(stableStringify(link), link);
+    }
+    return {
+        links: [...linksByKey.entries()]
+            .sort(([left], [right]) => left.localeCompare(right))
+            .map(([, link]) => link),
+        memberAuthored: primary.memberAuthored || legacy.memberAuthored,
+        ...(primary.note || legacy.note ? { note: primary.note ?? legacy.note } : {}),
+        tags: [...new Set([...primary.tags, ...legacy.tags])].sort(),
+    };
+}
+function buildJunctionDailyAggregateAliasRepairPlan(input) {
+    const { aliasRepairContext, context, entry } = input;
+    const externalRef = entry.record.externalRef;
+    const legacyExternalRef = entry.legacyExternalRefs[0];
+    const ownerSplit = resolveJunctionDailyAggregateAliasOwnerSplit(entry, context.index);
+    if (!aliasRepairContext
+        || !externalRef
+        || !legacyExternalRef
+        || !ownerSplit) {
+        return null;
+    }
+    assertJunctionDailyAggregateAliasHistoryIsUncontaminated(entry, context);
+    const { legacyOverlay, legacyOwner, legacyRefKey, primaryOverlay, primaryOwner, primaryRefKey, } = ownerSplit;
+    const evidence = parseJunctionDailyAggregateAliasEvidence(entry, aliasRepairContext);
+    if (primaryOwner.record.dayKey !== evidence.dayKey
+        || legacyOwner.record.dayKey !== evidence.legacyDayKey
+        || ownerSplit.resource !== evidence.resource) {
+        throw new VaultError("EVENT_ALIAS_REPAIR_HISTORY_REFUSED", "Junction daily aggregate alias repair owner days did not match the normalized evidence.");
+    }
+    const overlay = mergeJunctionDailyAggregateAliasOverlays(primaryOverlay, legacyOverlay);
+    const primaryRevision = (context.index.maxRevisionById.get(primaryOwner.record.id) ?? 0) + 1;
+    const legacyRevision = (context.index.maxRevisionById.get(legacyOwner.record.id) ?? 0) + 1;
+    const providerSurvivor = {
+        ...entry.record,
+        id: primaryOwner.record.id,
+        lifecycle: buildEventSpineLifecycle(primaryRevision),
+    };
+    const loserTombstone = {
+        ...entry.record,
+        id: legacyOwner.record.id,
+        lifecycle: buildEventSpineLifecycle(legacyRevision, "deleted"),
+    };
+    const overlaySurvivor = overlay.memberAuthored
+        ? {
+            ...providerSurvivor,
+            source: "manual",
+            ...(overlay.note ? { note: overlay.note } : {}),
+            ...(overlay.tags.length > 0 ? { tags: overlay.tags } : {}),
+            ...(overlay.links.length > 0 ? { links: overlay.links } : {}),
+            lifecycle: buildEventSpineLifecycle(primaryRevision + 1),
+        }
+        : undefined;
+    return {
+        legacyRefKey,
+        loserPath: legacyOwner.relativePath || toEventLedgerFile(legacyOwner.record.occurredAt),
+        loserTombstone,
+        ...(overlaySurvivor ? { overlaySurvivor } : {}),
+        primaryExternalRef: externalRef,
+        primaryRefKey,
+        providerSurvivor,
+        survivorPath: entry.relativePath,
+    };
+}
+function applyJunctionDailyAggregateAliasRepairToIndex(plan, index) {
+    const survivor = plan.overlaySurvivor ?? plan.providerSurvivor;
+    index.latestByRefKey.set(plan.primaryRefKey, {
+        indexedExternalRef: plan.primaryExternalRef,
+        indexedRecord: plan.providerSurvivor,
+        relativePath: plan.survivorPath,
+        record: survivor,
+    });
+    index.latestByRefKey.delete(plan.legacyRefKey);
+    index.latestById.set(survivor.id, survivor);
+    index.latestById.set(plan.loserTombstone.id, plan.loserTombstone);
+    index.liveOwnerIdsByRefKey.set(plan.primaryRefKey, new Set([survivor.id]));
+    index.liveOwnerIdsByRefKey.delete(plan.legacyRefKey);
+    for (const record of [
+        plan.providerSurvivor,
+        ...(plan.overlaySurvivor ? [plan.overlaySurvivor] : []),
+        plan.loserTombstone,
+    ]) {
+        const revision = eventSpineRevision(record);
+        index.maxRevisionById.set(record.id, revision);
+        const revisions = index.revisionsById.get(record.id) ?? new Set();
+        revisions.add(revision);
+        index.revisionsById.set(record.id, revisions);
+        const history = index.aliasRepairHistoryById.get(record.id) ?? [];
+        history.push({
+            relativePath: record.id === plan.loserTombstone.id
+                ? plan.loserPath
+                : plan.survivorPath,
+            record,
+        });
+        index.aliasRepairHistoryById.set(record.id, history);
+    }
+}
 function whoopSleepTypeProviderBaselineRevision(index, refKey, eventId, incoming) {
     if (incoming.kind !== "sleep_session"
         || incoming.externalRef?.system !== "whoop"
@@ -1414,6 +2509,7 @@ function resolveDeviceEventIdentity(entry, context, options = {}) {
     const primaryMatch = reservedForLegacyClaim && reservedForLegacyClaim.entry !== entry
         ? undefined
         : index.latestByRefKey.get(refKey);
+    const explicitLegacyRefKeys = new Set(entry.legacyExternalRefs.map((legacyExternalRef) => eventExternalRefKey(legacyExternalRef)));
     const legacyMatchedEntries = entry.legacyExternalRefs
         .map((legacyExternalRef) => ({
         legacyExternalRef,
@@ -1438,9 +2534,18 @@ function resolveDeviceEventIdentity(entry, context, options = {}) {
         return (!reservation || reservation.entry === entry)
             && isCompatibleLegacyExternalRefMatch(match.indexedMatch, entry.record, match.legacyExternalRef);
     });
+    const implicitReservedEntries = [...legacyReservations.entries()]
+        .filter(([reservedRefKey, reservation]) => reservation.entry === entry
+        && reservedRefKey !== refKey
+        && !explicitLegacyRefKeys.has(reservedRefKey))
+        .map(([reservedRefKey, reservation]) => ({
+        refKey: reservedRefKey,
+        indexedMatch: reservation.indexedMatch,
+    }));
     const matchedEntries = [
         ...(primaryMatch ? [{ refKey, indexedMatch: primaryMatch }] : []),
         ...legacyMatchedEntries,
+        ...implicitReservedEntries,
     ];
     const selectedPrimaryMatch = matchedEntries.find((match) => match.refKey === refKey);
     const latest = selectedPrimaryMatch?.indexedMatch.record ?? matchedEntries[0]?.indexedMatch.record;
@@ -1547,6 +2652,8 @@ function mapCurrentDeviceEventOwners(entries, context) {
             ? []
             : resolved.matchedEntries.map(({ indexedMatch }) => compareIncomingExternalRefVersion(indexedMatch.indexedExternalRef, incomingExternalRef)).filter((comparison) => comparison !== null);
         const incomingHasEqualOrNewerComparableVersion = sourceVersionComparisons.some((comparison) => comparison >= 0);
+        const incomingHasOnlyOlderComparableVersions = sourceVersionComparisons.length > 0
+            && !incomingHasEqualOrNewerComparableVersion;
         if (sourceVersionComparisons.some((comparison) => comparison > 0)) {
             incomingNewerPreparedIds.add(entry.record.id);
         }
@@ -1556,6 +2663,7 @@ function mapCurrentDeviceEventOwners(entries, context) {
             historicallyDeliveredPreparedIds.add(entry.record.id);
         }
         if (resolved.associationSafe
+            && !incomingHasOnlyOlderComparableVersions
             && !isDeletedEventSpineRecord(current)
             && deviceEventContentKey(current) === deviceEventContentKey(entry.record)) {
             associationSafePreparedIds.add(entry.record.id);
@@ -1579,18 +2687,63 @@ function mapCurrentDeviceEventOwners(entries, context) {
 // skipped; changed content normally appends an event-spine revision onto the
 // existing event id instead of a new event. Callers may mark a capture's
 // externalRef immutable when changed content must be rejected instead.
-async function reconcileDeviceEventEntriesByExternalRef(vaultRoot, entries, existingContext, preferredCanonicalIdByPreparedId = new Map()) {
+async function reconcileDeviceEventEntriesByExternalRef(vaultRoot, entries, existingContext, preferredCanonicalIdByPreparedId = new Map(), authoritativeEventSets = [], aliasRepairContext) {
     assertCanonicalWriteLockScope(vaultRoot);
     const context = existingContext ?? await buildDeviceEventIdentityContext(vaultRoot, entries);
     const { index } = context;
     const appendEntries = [];
     const appendRecordIdByPreparedRecordId = new Map();
-    const records = [];
+    const recordsByEntryIndex = new Map();
     const forceAppendIds = new Set();
     const retainedPreparedIds = new Set();
     let skippedDuplicateCount = 0;
     let supersededCount = 0;
-    for (const entry of entries) {
+    let retractedCount = 0;
+    const aliasRepairByEntryIndex = new Map();
+    for (const [entryIndex, entry] of entries.entries()) {
+        const aliasRepair = buildJunctionDailyAggregateAliasRepairPlan({
+            aliasRepairContext,
+            context,
+            entry,
+        });
+        if (aliasRepair) {
+            aliasRepairByEntryIndex.set(entryIndex, aliasRepair);
+        }
+    }
+    const aliasRepairOwnerIds = new Set();
+    for (const aliasRepair of aliasRepairByEntryIndex.values()) {
+        for (const ownerId of [
+            aliasRepair.providerSurvivor.id,
+            aliasRepair.loserTombstone.id,
+        ]) {
+            if (aliasRepairOwnerIds.has(ownerId)) {
+                throw new VaultError("EVENT_ALIAS_REPAIR_OWNER_REFUSED", "Junction daily aggregate alias repair operations cannot share persisted owners.");
+            }
+            aliasRepairOwnerIds.add(ownerId);
+        }
+    }
+    for (const [entryIndex, aliasRepair] of aliasRepairByEntryIndex) {
+        const entry = entries[entryIndex];
+        appendEntries.push({ relativePath: aliasRepair.survivorPath, record: aliasRepair.providerSurvivor }, { relativePath: aliasRepair.loserPath, record: aliasRepair.loserTombstone });
+        if (aliasRepair.overlaySurvivor) {
+            appendEntries.push({
+                relativePath: aliasRepair.survivorPath,
+                record: aliasRepair.overlaySurvivor,
+            });
+        }
+        appendRecordIdByPreparedRecordId.set(entry.record.id, aliasRepair.providerSurvivor.id);
+        forceAppendIds.add(aliasRepair.providerSurvivor.id);
+        forceAppendIds.add(aliasRepair.loserTombstone.id);
+        recordsByEntryIndex.set(entryIndex, aliasRepair.overlaySurvivor ?? aliasRepair.providerSurvivor);
+        applyJunctionDailyAggregateAliasRepairToIndex(aliasRepair, index);
+        supersededCount += 1;
+        retractedCount += 1;
+    }
+    for (const [entryIndex, originalEntry] of entries.entries()) {
+        if (aliasRepairByEntryIndex.has(entryIndex)) {
+            continue;
+        }
+        let entry = originalEntry;
         const externalRef = entry.record.externalRef;
         if (!externalRef) {
             const current = index.latestById.get(entry.record.id);
@@ -1599,20 +2752,25 @@ async function reconcileDeviceEventEntriesByExternalRef(vaultRoot, entries, exis
                 && deviceEventContentKey(current) === deviceEventContentKey(entry.record)) {
                 skippedDuplicateCount += 1;
                 retainedPreparedIds.add(entry.record.id);
-                records.push(current);
+                recordsByEntryIndex.set(entryIndex, current);
                 continue;
             }
             appendEntries.push(entry);
             appendRecordIdByPreparedRecordId.set(entry.record.id, entry.record.id);
-            records.push(entry.record);
+            recordsByEntryIndex.set(entryIndex, entry.record);
             continue;
         }
         const resolved = resolveDeviceEventIdentity(entry, context, { strict: true });
         if (!resolved) {
             throw new VaultError("EVENT_EXTERNAL_REF_ALIAS_CONFLICT", "Device event identity unexpectedly lost its externalRef during reconciliation.");
         }
+        if (resolved.latest && aliasRepairOwnerIds.has(resolved.latest.id)) {
+            throw new VaultError("EVENT_ALIAS_REPAIR_OWNER_REFUSED", "Junction daily aggregate alias repair operations cannot share persisted owners.");
+        }
         const { matchedEntries, refKey } = resolved;
         let latest = resolved.latest;
+        const migratesJunctionNoIdProfileIdentity = isIncomingJunctionNoIdProfile(entry.record)
+            && matchedEntries.some((match) => match.refKey !== refKey);
         if (!latest) {
             const canonicalRecordId = preferredCanonicalIdByPreparedId.get(entry.record.id)
                 ?? entry.record.id;
@@ -1622,9 +2780,59 @@ async function reconcileDeviceEventEntriesByExternalRef(vaultRoot, entries, exis
             index.latestByRefKey.set(refKey, toIndexedExternalRefMatch(canonicalRecord, externalRef));
             appendEntries.push({ relativePath: entry.relativePath, record: canonicalRecord });
             appendRecordIdByPreparedRecordId.set(entry.record.id, canonicalRecord.id);
-            records.push(canonicalRecord);
+            recordsByEntryIndex.set(entryIndex, canonicalRecord);
+            continue;
+        }
+        const indexedProviderMatch = matchedEntries.find((match) => match.indexedMatch.record.id === latest.id)?.indexedMatch ?? matchedEntries[0]?.indexedMatch;
+        const replaysJunctionNoIdProfileTimestamp = indexedProviderMatch !== undefined
+            && isJunctionNoIdProfileEqualRevisionTimestampReplay(indexedProviderMatch.indexedRecord, entry.record);
+        if (replaysJunctionNoIdProfileTimestamp) {
+            skippedDuplicateCount += 1;
+            retainedPreparedIds.add(entry.record.id);
+            recordsByEntryIndex.set(entryIndex, latest);
             continue;
         }
+        const matchesIndexedProviderContent = indexedProviderMatch !== undefined
+            && deviceEventContentKey(indexedProviderMatch.indexedRecord)
+                === deviceEventContentKey(entry.record);
+        const indexedSourceVersionComparison = indexedProviderMatch
+            ? compareIncomingExternalRefVersion(indexedProviderMatch.indexedExternalRef, externalRef)
+            : null;
+        const migratesJunctionStableProfileTimestamp = indexedProviderMatch !== undefined
+            && isJunctionStableProfileCreatedAtTimestampMigration(indexedProviderMatch.indexedRecord, entry.record);
+        const retainsDeletedJunctionStableProfile = isMemberDeletedJunctionStableProfile(latest, entry.record);
+        if (isDeletedEventSpineRecord(latest)
+            && (migratesJunctionStableProfileTimestamp || retainsDeletedJunctionStableProfile)) {
+            skippedDuplicateCount += 1;
+            retainedPreparedIds.add(entry.record.id);
+            recordsByEntryIndex.set(entryIndex, latest);
+            continue;
+        }
+        const authoritativeSet = authoritativeEventSets.find((set) => externalRef.system === set.system
+            && externalRef.resourceType === set.resourceType
+            && externalRef.resourceId === set.resourceId
+            && externalRef.facet !== undefined
+            && set.currentFacets.has(externalRef.facet));
+        if (authoritativeSet) {
+            const sourceVersionComparison = compareIncomingExternalRefVersion(matchedEntries.find((match) => match.refKey === refKey)?.indexedMatch.indexedExternalRef
+                ?? matchedEntries[0]?.indexedMatch.indexedExternalRef
+                ?? latest.externalRef
+                ?? externalRef, externalRef);
+            if (sourceVersionComparison !== null && sourceVersionComparison < 0) {
+                skippedDuplicateCount += 1;
+                recordsByEntryIndex.set(entryIndex, latest);
+                continue;
+            }
+            if (sourceVersionComparison === 0
+                && (isDeletedEventSpineRecord(latest)
+                    || deviceEventContentKey(latest) !== deviceEventContentKey(entry.record))
+                && !matchesIndexedProviderContent
+                && !migratesJunctionStableProfileTimestamp) {
+                throw new VaultError("EVENT_SOURCE_REVISION_CONFLICT", `Authoritative device event externalRef "${externalRef.system}/${externalRef.resourceType}/` +
+                    `${externalRef.resourceId}#${externalRef.facet}" has conflicting content for source revision ` +
+                    `"${authoritativeSet.version}"; nothing was imported.`);
+            }
+        }
         // externalRef identity does not include kind. Event spines are kind-stable,
         // so device reconciliation must reject under-faceted provider refs instead
         // of rewriting an existing event id as a different event kind.
@@ -1633,20 +2841,79 @@ async function reconcileDeviceEventEntriesByExternalRef(vaultRoot, entries, exis
                 `${externalRef.facet ? `#${externalRef.facet}` : ""}" already belongs to kind ` +
                 `"${latest.kind}" and cannot be rewritten as "${entry.record.kind}"; nothing was imported.`);
         }
-        if (deviceEventContentKey(latest) === deviceEventContentKey(entry.record)) {
+        // An unversioned member declared current by this batch's authoritative set
+        // reasserts a retracted facet in serialized arrival order rather than
+        // treating the tombstone's identical content as an exact replay. Ordinary
+        // versionless deliveries without complete-set authority never resurrect.
+        // Only provider-owned authoritative-set retractions may be reasserted.
+        // Their tombstones carry the set's explicit version marker on the external
+        // reference, while a member deletion preserves the member's unversioned
+        // reference and must stay deleted under authoritative replay.
+        const reassertsUnversionedSetMember = Boolean(authoritativeSet
+            && indexedSourceVersionComparison === null
+            && isDeletedEventSpineRecord(latest)
+            && latest.source === "device"
+            && latest.externalRef?.version !== undefined);
+        if (deviceEventContentKey(latest) === deviceEventContentKey(entry.record)
+            && (indexedSourceVersionComparison === null || indexedSourceVersionComparison === 0)
+            && !reassertsUnversionedSetMember) {
             skippedDuplicateCount += 1;
             retainedPreparedIds.add(entry.record.id);
-            records.push(latest);
+            recordsByEntryIndex.set(entryIndex, latest);
             continue;
         }
-        const indexedProviderMatch = matchedEntries.find((match) => match.indexedMatch.record.id === latest.id)?.indexedMatch ?? matchedEntries[0]?.indexedMatch;
-        if (indexedProviderMatch
-            && deviceEventContentKey(indexedProviderMatch.indexedRecord)
-                === deviceEventContentKey(entry.record)) {
-            skippedDuplicateCount += 1;
-            retainedPreparedIds.add(entry.record.id);
-            records.push(latest);
-            continue;
+        if (matchesIndexedProviderContent && !reassertsUnversionedSetMember) {
+            const historicalUserEditMatch = matchedEntries.find((match) => hasHistoricalExternalRefUserAuthoredChanges(match.indexedMatch));
+            if (historicalUserEditMatch
+                && indexedSourceVersionComparison !== null
+                && indexedSourceVersionComparison > 0) {
+                const providerRevision = Math.max(eventSpineRevision(latest), index.maxRevisionById.get(latest.id) ?? 0) + 1;
+                const providerBaseline = {
+                    ...entry.record,
+                    id: latest.id,
+                    lifecycle: buildEventSpineLifecycle(providerRevision),
+                };
+                const retainedMemberRevision = {
+                    ...latest,
+                    ...(migratesJunctionNoIdProfileIdentity
+                        ? { externalRef, dataOrigin: entry.record.dataOrigin }
+                        : {}),
+                    lifecycle: buildEventSpineLifecycle(providerRevision + 1),
+                };
+                const retainedMemberPath = historicalUserEditMatch.indexedMatch.relativePath
+                    || toEventLedgerFile(latest.occurredAt);
+                forceAppendIds.add(latest.id);
+                index.latestByRefKey.set(refKey, {
+                    indexedExternalRef: externalRef,
+                    indexedRecord: providerBaseline,
+                    relativePath: retainedMemberPath,
+                    record: retainedMemberRevision,
+                });
+                for (const { refKey: matchedRefKey, indexedMatch } of matchedEntries) {
+                    const currentMatch = index.latestByRefKey.get(matchedRefKey);
+                    if (matchedRefKey !== refKey
+                        && indexedMatch.record.id === latest.id
+                        && currentMatch?.record.id === latest.id) {
+                        index.latestByRefKey.delete(matchedRefKey);
+                    }
+                }
+                index.maxRevisionById.set(latest.id, providerRevision + 1);
+                appendEntries.push({ relativePath: entry.relativePath, record: providerBaseline });
+                appendEntries.push({
+                    relativePath: retainedMemberPath,
+                    record: retainedMemberRevision,
+                });
+                appendRecordIdByPreparedRecordId.set(entry.record.id, providerBaseline.id);
+                recordsByEntryIndex.set(entryIndex, retainedMemberRevision);
+                supersededCount += 1;
+                continue;
+            }
+            if (indexedSourceVersionComparison === null || indexedSourceVersionComparison === 0) {
+                skippedDuplicateCount += 1;
+                retainedPreparedIds.add(entry.record.id);
+                recordsByEntryIndex.set(entryIndex, latest);
+                continue;
+            }
         }
         if (entry.externalRefUpdatePolicy === "immutable") {
             throw new VaultError("EVENT_IMMUTABLE_EXTERNAL_REF_CONFLICT", "Immutable device event externalRef already exists with different content; nothing was imported.");
@@ -1672,7 +2939,7 @@ async function reconcileDeviceEventEntriesByExternalRef(vaultRoot, entries, exis
                 if (eventSpineRevisionsAreComplete(index, latest.id)) {
                     retainedPreparedIds.add(entry.record.id);
                 }
-                records.push(latest);
+                recordsByEntryIndex.set(entryIndex, latest);
                 continue;
             }
             if (sourceVersionComparison === 0) {
@@ -1688,7 +2955,7 @@ async function reconcileDeviceEventEntriesByExternalRef(vaultRoot, entries, exis
                 if (eventSpineRevisionsAreComplete(index, latest.id)) {
                     retainedPreparedIds.add(entry.record.id);
                 }
-                records.push(latest);
+                recordsByEntryIndex.set(entryIndex, latest);
                 continue;
             }
             const sleepTypeBaselineRevision = sourceVersionComparison === 0
@@ -1714,7 +2981,7 @@ async function reconcileDeviceEventEntriesByExternalRef(vaultRoot, entries, exis
                 if (eventSpineRevisionsAreComplete(index, latest.id)) {
                     retainedPreparedIds.add(entry.record.id);
                 }
-                records.push(latest);
+                recordsByEntryIndex.set(entryIndex, latest);
                 continue;
             }
         }
@@ -1725,37 +2992,87 @@ async function reconcileDeviceEventEntriesByExternalRef(vaultRoot, entries, exis
             if (eventSpineRevisionsAreComplete(index, latest.id)) {
                 retainedPreparedIds.add(entry.record.id);
             }
-            records.push(latest);
+            recordsByEntryIndex.set(entryIndex, latest);
             continue;
         }
-        if (isDeletedEventSpineRecord(latest)) {
+        const replaysProviderOwnedRetractionWithoutSetAuthority = Boolean(isDeletedEventSpineRecord(latest)
+            && latest.source === "device"
+            && latest.externalRef?.version !== undefined
+            && externalRef.version === undefined
+            && !authoritativeSet);
+        if (replaysProviderOwnedRetractionWithoutSetAuthority) {
+            skippedDuplicateCount += 1;
+            retainedPreparedIds.add(entry.record.id);
+            recordsByEntryIndex.set(entryIndex, latest);
+            continue;
+        }
+        if (isDeletedEventSpineRecord(latest) && !reassertsUnversionedSetMember) {
+            // A member-authored deletion tombstone (unversioned reference) stays
+            // dead under authoritative replay: no append, no index change, so a
+            // later empty-then-populated cadence cannot launder the deletion away.
+            if (authoritativeSet && indexedSourceVersionComparison === null) {
+                skippedDuplicateCount += 1;
+                retainedPreparedIds.add(entry.record.id);
+                recordsByEntryIndex.set(entryIndex, latest);
+                continue;
+            }
             index.latestByRefKey.set(refKey, toIndexedExternalRefMatch(entry.record, externalRef));
             appendEntries.push(entry);
             appendRecordIdByPreparedRecordId.set(entry.record.id, entry.record.id);
-            records.push(entry.record);
+            recordsByEntryIndex.set(entryIndex, entry.record);
             continue;
         }
+        // A member declared current by this batch's authoritative set falls
+        // through to the superseding append below, so the reassertion lands as
+        // the next serialized event-spine revision over the retraction tombstone.
         if (shouldKeepExistingJunctionSleepStageSummaryObservation(latest, entry.record)) {
             if (eventSpineRevisionsAreComplete(index, latest.id)) {
                 retainedPreparedIds.add(entry.record.id);
             }
-            records.push(latest);
+            recordsByEntryIndex.set(entryIndex, latest);
             continue;
         }
         const historicalUserEditMatch = matchedEntries.find((match) => hasHistoricalExternalRefUserAuthoredChanges(match.indexedMatch));
-        if (historicalUserEditMatch) {
-            throw new VaultError("EVENT_EXTERNAL_REF_ALIAS_CONFLICT", `Event externalRef "${externalRef.system}/${externalRef.resourceType}/${externalRef.resourceId}` +
-                `${externalRef.facet ? `#${externalRef.facet}` : ""}" matched a historical provider identity ` +
-                "whose latest event revision contains user-authored changes; merge must be repaired explicitly.");
-        }
         const revision = Math.max(eventSpineRevision(latest), index.maxRevisionById.get(latest.id) ?? 0) + 1;
         const superseding = {
             ...entry.record,
             id: latest.id,
             lifecycle: buildEventSpineLifecycle(revision),
         };
+        const migratesRetainedMemberOccurrence = migratesJunctionStableProfileTimestamp
+            && indexedProviderMatch !== undefined
+            && latest.occurredAt === indexedProviderMatch.indexedRecord.occurredAt
+            && latest.dayKey === indexedProviderMatch.indexedRecord.dayKey;
+        const retainedMemberRevision = historicalUserEditMatch
+            ? {
+                ...latest,
+                ...(migratesJunctionStableProfileTimestamp
+                    ? {
+                        ...(migratesRetainedMemberOccurrence
+                            ? { occurredAt: entry.record.occurredAt, dayKey: entry.record.dayKey }
+                            : {}),
+                        externalRef,
+                        dataOrigin: entry.record.dataOrigin,
+                    }
+                    : migratesJunctionNoIdProfileIdentity
+                        ? { externalRef, dataOrigin: entry.record.dataOrigin }
+                        : {}),
+                lifecycle: buildEventSpineLifecycle(revision + 1),
+            }
+            : null;
+        const retainedMemberPath = migratesRetainedMemberOccurrence
+            ? entry.relativePath
+            : historicalUserEditMatch?.indexedMatch.relativePath
+                || toEventLedgerFile(latest.occurredAt);
         forceAppendIds.add(latest.id);
-        index.latestByRefKey.set(refKey, toIndexedExternalRefMatch(superseding, externalRef));
+        index.latestByRefKey.set(refKey, retainedMemberRevision
+            ? {
+                indexedExternalRef: externalRef,
+                indexedRecord: superseding,
+                relativePath: retainedMemberPath,
+                record: retainedMemberRevision,
+            }
+            : toIndexedExternalRefMatch(superseding, externalRef));
         for (const { refKey: matchedRefKey, indexedMatch } of matchedEntries) {
             const currentMatch = index.latestByRefKey.get(matchedRefKey);
             if (matchedRefKey !== refKey &&
@@ -1764,12 +3081,87 @@ async function reconcileDeviceEventEntriesByExternalRef(vaultRoot, entries, exis
                 index.latestByRefKey.delete(matchedRefKey);
             }
         }
-        index.maxRevisionById.set(latest.id, revision);
+        index.maxRevisionById.set(latest.id, retainedMemberRevision ? revision + 1 : revision);
         appendEntries.push({ relativePath: entry.relativePath, record: superseding });
+        if (retainedMemberRevision) {
+            appendEntries.push({ relativePath: retainedMemberPath, record: retainedMemberRevision });
+        }
         appendRecordIdByPreparedRecordId.set(entry.record.id, superseding.id);
-        records.push(superseding);
+        recordsByEntryIndex.set(entryIndex, retainedMemberRevision ?? superseding);
         supersededCount += 1;
     }
+    for (const set of authoritativeEventSets) {
+        const ownsFacet = (facet) => set.facetPrefixes.some((prefix) => facet === prefix || facet.startsWith(`${prefix}-`));
+        const candidates = [...index.latestByRefKey.entries()].filter(([, match]) => {
+            const externalRef = match.record.externalRef;
+            return externalRef?.system === set.system
+                && externalRef.resourceType === set.resourceType
+                && externalRef.resourceId === set.resourceId
+                && typeof externalRef.facet === "string"
+                && ownsFacet(externalRef.facet)
+                && !set.currentFacets.has(externalRef.facet)
+                && !isDeletedEventSpineRecord(match.record);
+        });
+        for (const [refKey, latestMatch] of candidates) {
+            const latest = latestMatch.record;
+            const latestRef = latest.externalRef;
+            if (!latestRef?.facet) {
+                continue;
+            }
+            const incomingRef = { ...latestRef, version: set.version };
+            const sourceVersionComparison = compareIncomingExternalRefVersion(latestMatch.indexedExternalRef, incomingRef);
+            if (sourceVersionComparison !== null && sourceVersionComparison < 0) {
+                continue;
+            }
+            if (sourceVersionComparison === 0
+                && isDeletedEventSpineRecord(latestMatch.indexedRecord)) {
+                continue;
+            }
+            if (sourceVersionComparison === 0) {
+                throw new VaultError("EVENT_SOURCE_REVISION_CONFLICT", `Authoritative device event externalRef "${set.system}/${set.resourceType}/` +
+                    `${set.resourceId}#${latestRef.facet}" has conflicting membership for source revision ` +
+                    `"${set.version}"; nothing was imported.`);
+            }
+            const hasMemberEdit = hasHistoricalExternalRefUserAuthoredChanges(latestMatch);
+            const revision = Math.max(eventSpineRevision(latest), index.maxRevisionById.get(latest.id) ?? 0) + 1;
+            const tombstone = {
+                ...latestMatch.indexedRecord,
+                source: "device",
+                recordedAt: set.version,
+                externalRef: incomingRef,
+                lifecycle: buildEventSpineLifecycle(revision, "deleted"),
+            };
+            const retainedMemberRevision = hasMemberEdit
+                ? {
+                    ...latest,
+                    lifecycle: buildEventSpineLifecycle(revision + 1),
+                }
+                : null;
+            const latestPath = latestMatch.relativePath || toEventLedgerFile(latest.occurredAt);
+            forceAppendIds.add(latest.id);
+            index.latestByRefKey.set(refKey, retainedMemberRevision
+                ? {
+                    indexedExternalRef: incomingRef,
+                    indexedRecord: tombstone,
+                    relativePath: latestPath,
+                    record: retainedMemberRevision,
+                }
+                : toIndexedExternalRefMatch(tombstone, incomingRef, latestPath));
+            index.maxRevisionById.set(latest.id, retainedMemberRevision ? revision + 1 : revision);
+            appendEntries.push({ relativePath: latestPath, record: tombstone });
+            if (retainedMemberRevision) {
+                appendEntries.push({ relativePath: latestPath, record: retainedMemberRevision });
+            }
+            retractedCount += 1;
+        }
+    }
+    const records = entries.map((entry, entryIndex) => {
+        const record = recordsByEntryIndex.get(entryIndex);
+        if (!record) {
+            throw new VaultError("EVENT_EXTERNAL_REF_ALIAS_CONFLICT", `Device event reconciliation did not produce a result for "${entry.record.id}".`);
+        }
+        return record;
+    });
     return {
         appendEntries,
         appendRecordIdByPreparedRecordId,
@@ -1778,6 +3170,7 @@ async function reconcileDeviceEventEntriesByExternalRef(vaultRoot, entries, exis
         retainedPreparedIds,
         skippedDuplicateCount,
         supersededCount,
+        retractedCount,
     };
 }
 // Public bulk import reconciles externalRef identity vault-wide, not per
@@ -2147,6 +3540,9 @@ function buildDeviceBatchAuditSummary(input) {
     if (input.supersededCount > 0) {
         dedupeNotes.push(`${input.supersededCount} event(s) updated in place by externalRef`);
     }
+    if (input.retractedCount > 0) {
+        dedupeNotes.push(`${input.retractedCount} omitted authoritative event(s) retracted`);
+    }
     const dedupeSuffix = dedupeNotes.length > 0 ? ` (${dedupeNotes.join(", ")})` : "";
     return `Imported ${input.provider} device batch with ${input.eventCount} event(s) and ${input.sampleCount} sample(s)${dedupeSuffix}.`;
 }
@@ -2178,7 +3574,7 @@ function buildLegacyReceiptFingerprint(receipt, provider) {
             sha256: createHash("sha256").update(content).digest("hex"),
         }];
 }
-function prepareDeviceBatchPlan({ provider, accountId, importedAt = new Date(), defaultTimeZone: fallbackTimeZone, source = "device", events = [], samples = [], evidenceParts = [], ingestReceipt, provenance, }) {
+function prepareDeviceBatchPlan({ provider, accountId, importedAt = new Date(), defaultTimeZone: fallbackTimeZone, source = "device", events = [], samples = [], evidenceParts = [], authoritativeEventSets = [], ingestReceipt, provenance, }) {
     const normalizedInputs = normalizeDeviceBatchInputs({
         provider,
         accountId,
@@ -2188,6 +3584,7 @@ function prepareDeviceBatchPlan({ provider, accountId, importedAt = new Date(),
         events,
         samples,
         evidenceParts,
+        authoritativeEventSets,
         ingestReceipt,
         provenance,
     });
@@ -2224,6 +3621,18 @@ function prepareDeviceBatchPlan({ provider, accountId, importedAt = new Date(),
         receipt: compactedIngestReceipt ?? null,
         eventIds: normalizedInputs.events.map(({ recordId }) => recordId),
         sampleIds: normalizedInputs.samples.map(({ recordId }) => recordId),
+        ...(normalizedInputs.authoritativeEventSets.length === 0
+            ? {}
+            : {
+                authoritativeEventSets: normalizedInputs.authoritativeEventSets.map((set) => ({
+                    system: set.system,
+                    resourceType: set.resourceType,
+                    resourceId: set.resourceId,
+                    version: set.version,
+                    facetPrefixes: set.facetPrefixes,
+                    currentFacets: [...set.currentFacets].sort(),
+                })),
+            }),
         evidenceParts: fingerprint,
     }));
     const importId = buildImportId(rawArtifactFingerprint);
@@ -2245,6 +3654,7 @@ function prepareDeviceBatchPlan({ provider, accountId, importedAt = new Date(),
         evidenceRolesByPreparedRecordId: eventPlan.evidenceRolesByPreparedRecordId,
         preparedSamples,
         preparedEvidenceParts,
+        authoritativeEventSets: normalizedInputs.authoritativeEventSets,
     };
 }
 async function hashSourceFile(sourcePath) {
@@ -3212,7 +4622,8 @@ function preparedDeviceEventRetainsCurrentOutput(input) {
     }
     const current = input.currentEventOwners.currentRecordByPreparedId.get(preparedId);
     return current !== undefined && (isDeletedEventSpineRecord(current)
-        || (eventSpineRevision(current) > eventSpineRevision(input.entry.record)
+        || (current.source !== "device"
+            && eventSpineRevision(current) > eventSpineRevision(input.entry.record)
             && userAuthoredEventStateKey(current) !== userAuthoredEventStateKey(input.entry.record)));
 }
 function storedIntegrationIngestRetainsCurrentOutputLocators(input) {
@@ -3339,7 +4750,28 @@ function buildStoredDeviceDeliveryNoopResult(input) {
         auditPath: null,
     };
 }
-export async function importDeviceBatch({ vaultRoot, provider, accountId, importedAt = new Date(), source = "device", events = [], samples = [], evidenceParts = [], ingestReceipt, provenance, }) {
+export async function importDeviceBatch(input, options = {}) {
+    assertCanonicalWriteLockScope(input.vaultRoot);
+    const startedAt = performance.now();
+    const timing = {
+        canonicalWriteElapsedMs: 0,
+        eventIdentityIndexCacheHit: false,
+        eventIdentityIndexElapsedMs: 0,
+        totalElapsedMs: 0,
+    };
+    try {
+        return await importDeviceBatchWithExecutionOptions(input, options, timing);
+    }
+    catch (error) {
+        clearDeviceBatchImportSessionVaultState(options.session, input.vaultRoot);
+        throw error;
+    }
+    finally {
+        timing.totalElapsedMs = Math.max(0, performance.now() - startedAt);
+        emitDeviceBatchImportTiming(options.onTiming, timing);
+    }
+}
+async function importDeviceBatchWithExecutionOptions({ vaultRoot, provider, accountId, importedAt = new Date(), source = "device", events = [], samples = [], evidenceParts = [], authoritativeEventSets = [], ingestReceipt, provenance, }, options, timing) {
     assertDeviceSampleRowLimit(Array.isArray(samples) ? samples.length : 0);
     const vault = await loadVault({ vaultRoot });
     const deviceBatchPlan = prepareDeviceBatchPlan({
@@ -3351,17 +4783,66 @@ export async function importDeviceBatch({ vaultRoot, provider, accountId, import
         events,
         samples,
         evidenceParts,
+        authoritativeEventSets,
         ingestReceipt,
         provenance,
     });
-    const eventTargetShardPaths = [
-        ...new Set(deviceBatchPlan.preparedEvents.map((entry) => entry.relativePath)),
-    ].sort();
     const sampleRecords = deviceBatchPlan.preparedSamples.map((entry) => entry.record);
     const sampleAppendPlan = await buildJsonlAppendPlan(vaultRoot, deviceBatchPlan.preparedSamples, {
         dedupeWithinPlan: true,
     });
-    const eventIdentityContext = await buildDeviceEventIdentityContext(vaultRoot, deviceBatchPlan.preparedEvents);
+    const requiresEventIdentityContext = deviceBatchPlan.preparedEvents.length > 0
+        || deviceBatchPlan.authoritativeEventSets.length > 0;
+    const eventIdentityDependency = buildDeviceEventIdentityDependency(deviceBatchPlan);
+    const indexStartedAt = performance.now();
+    const sessionVaultState = requiresEventIdentityContext
+        ? readDeviceBatchImportSessionVaultState(options.session, vaultRoot)
+        : undefined;
+    const currentEventLedgerFingerprint = sessionVaultState
+        ? await tryBuildDeviceEventLedgerFingerprint(vaultRoot)
+        : undefined;
+    const sessionFingerprintMatches = sessionVaultState
+        && currentEventLedgerFingerprint !== undefined
+        ? sessionVaultState.eventLedgerFingerprint
+            === currentEventLedgerFingerprint
+        : false;
+    const cachedEventIdentityContext = sessionVaultState
+        && sessionFingerprintMatches
+        && sessionVaultState.dependencyChanges.every((dependencyChange) => !deviceEventIdentityDependenciesOverlap(eventIdentityDependency, dependencyChange))
+        ? cloneDeviceEventIdentityContext(sessionVaultState.eventIdentityContext)
+        : undefined;
+    let initialEventIdentityContext = cachedEventIdentityContext
+        ?? await buildDeviceEventIdentityContext(vaultRoot, deviceBatchPlan.preparedEvents, deviceBatchPlan.authoritativeEventSets);
+    if (cachedEventIdentityContext
+        && deviceBatchPlan.preparedEvents.some((entry) => resolveStructuralJunctionDailyAggregateAliasOwnerSplit(entry, cachedEventIdentityContext.index) !== null)) {
+        initialEventIdentityContext = await buildDeviceEventIdentityContext(vaultRoot, deviceBatchPlan.preparedEvents, deviceBatchPlan.authoritativeEventSets);
+    }
+    else if (cachedEventIdentityContext) {
+        timing.eventIdentityIndexCacheHit = true;
+    }
+    timing.eventIdentityIndexElapsedMs = Math.max(0, performance.now() - indexStartedAt);
+    if (requiresEventIdentityContext && !timing.eventIdentityIndexCacheHit) {
+        const eventLedgerFingerprint = await tryBuildDeviceEventLedgerFingerprint(vaultRoot);
+        if (eventLedgerFingerprint) {
+            replaceDeviceBatchImportSessionVaultState(options.session, vaultRoot, {
+                dependencyChanges: [],
+                eventIdentityContext: cloneDeviceEventIdentityContext(initialEventIdentityContext),
+                eventLedgerFingerprint,
+            });
+        }
+        else {
+            clearDeviceBatchImportSessionVaultState(options.session, vaultRoot);
+        }
+    }
+    deviceBatchPlan.preparedEvents = resolveJunctionFloatingFallbackEntries(deviceBatchPlan.preparedEvents, initialEventIdentityContext);
+    const eventIdentityContext = {
+        index: initialEventIdentityContext.index,
+        legacyReservations: buildLegacyExternalRefReservations(deviceBatchPlan.preparedEvents, initialEventIdentityContext.index),
+    };
+    const aliasRepairContext = buildDeviceEventAliasRepairContext(deviceBatchPlan);
+    const eventTargetShardPaths = [
+        ...new Set(deviceBatchPlan.preparedEvents.map((entry) => entry.relativePath)),
+    ].sort();
     const currentEventOwners = mapCurrentDeviceEventOwners(deviceBatchPlan.preparedEvents, eventIdentityContext);
     const baselineEventReconciliation = await reconcileDeviceEventEntriesByExternalRef(vaultRoot, deviceBatchPlan.preparedEvents, buildEmptyDeviceEventIdentityContext(deviceBatchPlan.preparedEvents));
     const baselineRetainedPreparedIds = new Set(baselineEventReconciliation.appendRecordIdByPreparedRecordId.keys());
@@ -3376,6 +4857,7 @@ export async function importDeviceBatch({ vaultRoot, provider, accountId, import
     });
     const protectedPreparedEventIds = new Set(deviceBatchPlan.preparedEvents
         .filter((entry) => baselineRetainedPreparedIds.has(entry.record.id)
+        && !hasJunctionDailyAggregateAliasSplit(entry, eventIdentityContext)
         && (currentEventOwners.historicallyDeliveredPreparedIds.has(entry.record.id)
             || (entry.record.externalRef === undefined
                 && currentEventOwners.currentRecordByPreparedId.has(entry.record.id)
@@ -3384,7 +4866,7 @@ export async function importDeviceBatch({ vaultRoot, provider, accountId, import
         .map((entry) => entry.record.id));
     const ordinaryReconciliationEntries = deviceBatchPlan.preparedEvents.filter((entry) => baselineRetainedPreparedIds.has(entry.record.id)
         && !protectedPreparedEventIds.has(entry.record.id));
-    const currentEventReconciliation = await reconcileDeviceEventEntriesByExternalRef(vaultRoot, ordinaryReconciliationEntries, cloneDeviceEventIdentityContext(eventIdentityContext));
+    const currentEventReconciliation = await reconcileDeviceEventEntriesByExternalRef(vaultRoot, ordinaryReconciliationEntries, cloneDeviceEventIdentityContext(eventIdentityContext), new Map(), deviceBatchPlan.authoritativeEventSets, aliasRepairContext);
     const replayRetainedPreparedIds = new Set([
         ...protectedPreparedEventIds,
         ...currentEventReconciliation.retainedPreparedIds,
@@ -3693,7 +5175,7 @@ export async function importDeviceBatch({ vaultRoot, provider, accountId, import
         const persistenceReconciliationEntries = reconciliationEntries.filter((entry) => !storedEventRepairIds.has(entry.record.id));
         const repairedProtectedPreparedEventCount = [...historicalRepairEntryByPreparedId.keys()].filter((preparedId) => persistenceProtectedPreparedEventIds.has(preparedId)).length;
         const reconciled = evidenceRepairRequired
-            ? await reconcileDeviceEventEntriesByExternalRef(vaultRoot, persistenceReconciliationEntries, cloneDeviceEventIdentityContext(eventIdentityContext))
+            ? await reconcileDeviceEventEntriesByExternalRef(vaultRoot, persistenceReconciliationEntries, cloneDeviceEventIdentityContext(eventIdentityContext), new Map(), deviceBatchPlan.authoritativeEventSets, aliasRepairContext)
             : currentEventReconciliation;
         const reconciledRecordByPreparedId = new Map(persistenceReconciliationEntries.map((entry, index) => [
             entry.record.id,
@@ -3767,7 +5249,7 @@ export async function importDeviceBatch({ vaultRoot, provider, accountId, import
         ]));
         const persistencePreparedEvents = deviceBatchPlan.preparedEvents.filter((entry) => associablePreparedEventIds.has(entry.record.id)
             && persistenceEvidenceRolesByPreparedRecordId.has(entry.record.id));
-        const hasAppendedOutputs = appendedPreparedEventIds.size > 0
+        const hasAppendedOutputs = eventAppendPlan.appendedRecordIds.length > 0
             || sampleAppendPlan.appendedRecordIds.length > 0;
         const eventIdsByEvidenceRole = new Map();
         for (const entry of deviceBatchPlan.preparedEvents) {
@@ -3936,7 +5418,8 @@ export async function importDeviceBatch({ vaultRoot, provider, accountId, import
         assertInspectionCanAuthorizeNoop();
         return buildNoopResult();
     }
-    return runCanonicalWrite({
+    const canonicalWriteStartedAt = performance.now();
+    const result = await runCanonicalWrite({
         vaultRoot,
         operationType: "device_batch_import",
         summary: `Import ${deviceBatchPlan.provider} device batch ${persistedImportId}`,
@@ -3961,6 +5444,7 @@ export async function importDeviceBatch({ vaultRoot, provider, accountId, import
                     sampleCount: sampleRecords.length,
                     skippedDuplicateCount: eventReconciliation.skippedDuplicateCount,
                     supersededCount: eventReconciliation.supersededCount,
+                    retractedCount: eventReconciliation.retractedCount,
                 }),
                 occurredAt: deviceBatchPlan.importedAt,
                 files: touchedPaths,
@@ -3978,7 +5462,12 @@ export async function importDeviceBatch({ vaultRoot, provider, accountId, import
                 importedAt: deviceBatchPlan.importedAt,
                 events: canonicalEventRecords,
                 samples: sampleRecords,
-                eventShardPaths: eventTargetShardPaths,
+                eventShardPaths: [
+                    ...new Set([
+                        ...eventTargetShardPaths,
+                        ...eventAppendPlan.targetShardPaths,
+                    ]),
+                ].sort(),
                 sampleShardPaths: sampleAppendPlan.targetShardPaths,
                 evidencePartCount: deviceBatchPlan.preparedEvidenceParts.length,
                 persistedEvidencePartCount: retainedEvidenceParts.length,
@@ -3986,6 +5475,27 @@ export async function importDeviceBatch({ vaultRoot, provider, accountId, import
             };
         },
     });
+    timing.canonicalWriteElapsedMs = Math.max(0, performance.now() - canonicalWriteStartedAt);
+    if (eventAppendPlan.appendedRecordIds.length > 0) {
+        const currentSessionState = readDeviceBatchImportSessionVaultState(options.session, vaultRoot);
+        if (currentSessionState) {
+            const eventLedgerFingerprint = await tryBuildDeviceEventLedgerFingerprint(vaultRoot);
+            if (eventLedgerFingerprint) {
+                replaceDeviceBatchImportSessionVaultState(options.session, vaultRoot, {
+                    ...currentSessionState,
+                    dependencyChanges: [
+                        ...currentSessionState.dependencyChanges,
+                        buildDeviceEventIdentityDependency(deviceBatchPlan, eventReconciliation.records.map((record) => record.id)),
+                    ],
+                    eventLedgerFingerprint,
+                });
+            }
+            else {
+                clearDeviceBatchImportSessionVaultState(options.session, vaultRoot);
+            }
+        }
+    }
+    return result;
 }
 const EVENT_BATCH_FAILURE_REPORT_LIMIT = 20;
 // importEventBatch is public API surface, so the batch-shape invariants live