@namzu/sdk 62.8.0 → 62.10.0

package/src/manager/session/turn-recorder.ts

@@ -1,3 +1,4 @@
+import { isDeepStrictEqual } from 'node:util'
 import {
 	AUTO_CONTINUATION_USER_MESSAGE,
 	REASONING_CUT_USER_MESSAGE,
@@ -94,6 +95,16 @@ function stampMessageId(message: Message, id: MessageId | undefined): void {
 	else (message as { id?: MessageId }).id = id
 }
 
+/** Two messages that differ only in their id and time are the same text. */
+function sameStoredContent(a: Message, b: Message): boolean {
+	const { id: _a, timestamp: _ta, ...restA } = a
+	const { id: _b, timestamp: _tb, ...restB } = b
+	return isDeepStrictEqual(
+		JSON.parse(JSON.stringify(restA)) as unknown,
+		JSON.parse(JSON.stringify(restB)) as unknown,
+	)
+}
+
 /** How {@link TurnRecorder.open} takes the session's writer lease and starts an empty log. */
 export interface TurnRecorderOpenOptions {
 	/** A lease the caller already holds. Absent: the recorder claims one and releases it at the end. */
@@ -255,6 +266,8 @@ export class TurnRecorder {
 	 * these needs no re-basing, so no `compaction` record is written for it.
 	 */
 	#foldIdsAtResume: readonly MessageId[] | undefined
+	/** What the log folds to for a message a replacement or an edit changed, as of the resume. */
+	#foldEditedAtResume = new Map<MessageId, Message>()
 	/** When a resumed turn began: its `turn_started` record, not this process's start. */
 	#resumedTurnStartedAt: number | undefined
 
@@ -868,21 +881,38 @@ export class TurnRecorder {
 	async #readResumedLog(): Promise<readonly MessageId[] | undefined> {
 		await this.flush()
 		const fold = new SessionMessageFold()
+		// Whether the latest change to a message was a compaction edit: only
+		// that one is the recorder's to put back (a guardrail's replacement is
+		// the settled answer and the restored context is not allowed to undo it).
+		const latestChange = new Map<MessageId, 'edited' | 'replaced'>()
 		for await (const entry of this.log.read()) {
 			const record = entry.record as SessionRecord
 			if (record.type === 'turn_started' && record.turnId === this.turnId) {
 				const at = Date.parse(record.ts)
 				if (Number.isFinite(at)) this.#resumedTurnStartedAt = at
 			}
+			if (record.type === 'message_edited') latestChange.set(record.targetMessageId, 'edited')
+			else if (record.type === 'message_replaced')
+				latestChange.set(record.targetMessageId, 'replaced')
 			fold.apply(record)
 		}
-		if (fold.spilledSummary) return undefined
 		const ids: MessageId[] = []
+		let allRecorded = !fold.spilledSummary
+		this.#foldEditedAtResume.clear()
+		// Filled for every fold entry with an id, whether or not the fold also
+		// holds id-less entries (a summary): a restored context older than an edit
+		// is put right either way. An entry whose text is spilled is not
+		// compared, so a message edited to a spilled text is not put back.
 		for (const entry of fold.entries()) {
-			if (!entry.messageId) return undefined
+			if (!entry.messageId) {
+				allRecorded = false
+				continue
+			}
 			ids.push(entry.messageId)
+			if (latestChange.get(entry.messageId) === 'edited' && entry.spill === undefined)
+				this.#foldEditedAtResume.set(entry.messageId, entry.message)
 		}
-		return ids
+		return allRecorded ? ids : undefined
 	}
 
 	/** The recorded context is exactly what the log folds to: a resume changed nothing. */
@@ -1093,6 +1123,13 @@ export class TurnRecorder {
 		options: {
 			readonly messageId?: MessageId
 			readonly transient?: boolean
+			/**
+			 * The message is part of the history a resume restores, not a new
+			 * one. While the resume's re-base is pending, a restored message with no
+			 * id is held and nothing is reconciled; the first message that is not
+			 * restored (or any other reconcile) re-bases once on the whole context.
+			 */
+			readonly restored?: boolean
 		} = {},
 	): void {
 		if (options.messageId) {
@@ -1110,6 +1147,16 @@ export class TurnRecorder {
 			})
 			return
 		}
+		if (options.restored && this.#rebasePending && this.#phase === 'active') {
+			// A restored message with no id (a compaction summary, the working-memory
+			// slot, a message the host added) can arrive before the recorded ones.
+			// Reconciling now would re-base the fold on a context holding only it and
+			// drop the recorded messages that follow; hold it as an id-less view entry
+			// and let the first reconciliation after the whole context is in place
+			// write one `compaction` that keeps the recorded ids after it.
+			this.#view.push({ message })
+			return
+		}
 		this.#syncMessages()
 	}
 
@@ -1152,6 +1199,100 @@ export class TurnRecorder {
 		return id
 	}
 
+	/**
+	 * A compaction pass edits one message by replacing its object with a copy
+	 * that has other content (`{ ...message, content }`). The copy still carries
+	 * the id the original was stamped with, but the recorder's own indexes are
+	 * keyed by object identity, so without this it would see an unknown message
+	 * and record every message after it again. A live object that is not in the
+	 * view, whose `id` is that of a recorded view entry whose own object has left
+	 * the context, is that same message edited: one `message_edited` record
+	 * carries its new content and the view entry follows the new object.
+	 *
+	 * Only an id claimed by exactly one live object is taken, so two copies of
+	 * one message are never both treated as its edit. Anything else is left to
+	 * the callers, which record it as a new message.
+	 */
+	#absorbEdits(): void {
+		if (this.#phase !== 'active') return
+		const live = this.#turn.messages
+		const inContext = new Set<Message>(live)
+		let orphans: Map<MessageId, ViewEntry> | undefined
+		for (const entry of this.#view) {
+			if (entry.id === undefined || entry.transient || inContext.has(entry.message)) continue
+			orphans ??= new Map()
+			orphans.set(entry.id, entry)
+		}
+		if (orphans === undefined) return
+		const known = new Set<Message>(this.#view.map((entry) => entry.message))
+		const claimed = new Map<MessageId, Message[]>()
+		for (const message of live) {
+			if (known.has(message) || this.#transient.has(message)) continue
+			const id = message.id
+			if (id === undefined || !orphans.has(id)) continue
+			const list = claimed.get(id)
+			if (list) list.push(message)
+			else claimed.set(id, [message])
+		}
+		const turnId = this.turnId
+		for (const [id, messages] of claimed) {
+			const message = messages[0] as Message
+			const entry = orphans.get(id) as ViewEntry
+			if (messages.length !== 1 || message.role !== entry.message.role) continue
+			// `previous` is the live object the view holds: a message mutated in place
+			// and then replaced by a copy of itself is adopted without a record, and
+			// the fold keeps the text it recorded.
+			const previous = entry.message
+			entry.message = message
+			this.#ids.set(message, id)
+			this.#recorded.set(message, id)
+			// A copy with the same text (a structured clone, a re-parsed message)
+			// is adopted as is: the fold already shows that content.
+			if (sameStoredContent(previous, message)) continue
+			void this.#enqueue(() =>
+				this.#append({
+					type: 'message_edited',
+					turnId,
+					targetMessageId: id,
+					content: message,
+					ignorable: true,
+					reason: 'compaction',
+				}),
+			).catch(() => undefined)
+		}
+	}
+
+	/**
+	 * A resume restores the context a checkpoint holds, which can predate a
+	 * compaction edit written after it. The ids still match, so the log is not
+	 * re-based; but the fold then shows the edited text of a message the context
+	 * holds as it was. One `message_edited` per such message makes the fold show
+	 * the context the resume actually runs with.
+	 */
+	#recordDriftFromFold(): void {
+		const edited = this.#foldEditedAtResume
+		if (edited.size === 0) return
+		const turnId = this.turnId
+		for (const entry of this.#view) {
+			if (entry.id === undefined || entry.transient) continue
+			const folded = edited.get(entry.id)
+			if (folded === undefined || sameStoredContent(folded, entry.message)) continue
+			const message = entry.message
+			const id = entry.id
+			void this.#enqueue(() =>
+				this.#append({
+					type: 'message_edited',
+					turnId,
+					targetMessageId: id,
+					content: message,
+					ignorable: true,
+					reason: 'resume',
+				}),
+			).catch(() => undefined)
+		}
+		edited.clear()
+	}
+
 	/**
 	 * Reconcile the context with the log. Nothing is written before the turn
 	 * begins or after it pauses or settles.
@@ -1164,9 +1305,15 @@ export class TurnRecorder {
 			this.#foldIdsAtResume = undefined
 			if (!unchanged) {
 				this.#recordCompaction()
+				// Kept ids whose restored text differs from the edited text the fold
+				// holds get their record; entries re-recorded under fresh ids are not
+				// in the map and are skipped.
+				this.#recordDriftFromFold()
 				return
 			}
+			this.#recordDriftFromFold()
 		}
+		this.#absorbEdits()
 		const live = this.#turn.messages
 		const view = this.#view
 		let prefix = 0
@@ -1205,6 +1352,7 @@ export class TurnRecorder {
 	 * log order, the whole context becomes the summary.
 	 */
 	#recordCompaction(): void {
+		this.#absorbEdits()
 		const live = this.#turn.messages
 		const byMessage = new Map(this.#view.map((entry) => [entry.message, entry]))
 		const next: ViewEntry[] = live.map((message) => {
@@ -1493,6 +1641,34 @@ async function recordedMessages(
 	return out
 }
 
+type RecordedContent = { readonly content: Message; readonly spill?: SpillRef }
+
+function recordedContent(record: {
+	readonly content: Message
+	readonly spill?: SpillRef | undefined
+}): RecordedContent {
+	return { content: record.content, ...(record.spill ? { spill: record.spill } : {}) }
+}
+
+/** Every message ever recorded, and the texts an edited one held before each edit. */
+export interface EverRecordedMessages {
+	/** The latest text of each message, by its durable id. */
+	readonly latest: ReadonlyMap<MessageId, Message>
+	/**
+	 * Whether `id` held `message`'s text before a compaction edit. A
+	 * `message_replaced` for the id forgets the texts before it: a guardrail's
+	 * replacement is the settled answer. A spilled earlier text is read only
+	 * when a comparison needs it.
+	 */
+	heldBeforeAnEdit(id: MessageId, message: Message): Promise<boolean>
+}
+
+interface EverRecordedState {
+	readonly latest: Map<MessageId, RecordedContent>
+	/** Only ids that have an edit appear here. */
+	readonly earlier: Map<MessageId, RecordedContent[]>
+}
+
 /**
  * Every message this session's log has ever recorded, keyed by the durable
  * id its `message` record gave it — including one a compaction has since
@@ -1507,25 +1683,37 @@ async function recordedMessages(
 export async function readEverRecordedMessages(
 	log: SessionLog,
 ): Promise<ReadonlyMap<MessageId, Message>> {
+	return (await readEverRecordedMessageIndex(log)).latest
+}
+
+/**
+ * {@link readEverRecordedMessages} plus what a host that cached the history
+ * before a compaction edit still holds, answered from the same reduction with
+ * no read of the log of its own.
+ */
+export async function readEverRecordedMessageIndex(log: SessionLog): Promise<EverRecordedMessages> {
 	return foldSessionLog(log, {
 		name: 'ever-recorded-messages',
 		mode: 'strict',
-		create: () => new Map<MessageId, { readonly content: Message; readonly spill?: SpillRef }>(),
-		apply: (latest, entry) => {
+		create: (): EverRecordedState => ({ latest: new Map(), earlier: new Map() }),
+		apply: ({ latest, earlier }, entry) => {
 			const record = entry.record as SessionRecord
 			if (record.type === 'message') {
-				latest.set(record.messageId, {
-					content: record.content,
-					...(record.spill ? { spill: record.spill } : {}),
-				})
+				latest.set(record.messageId, recordedContent(record))
 			} else if (record.type === 'message_replaced') {
-				latest.set(record.targetMessageId, {
-					content: record.content,
-					...(record.spill ? { spill: record.spill } : {}),
-				})
+				earlier.delete(record.targetMessageId)
+				latest.set(record.targetMessageId, recordedContent(record))
+			} else if (record.type === 'message_edited') {
+				const before = latest.get(record.targetMessageId)
+				if (before !== undefined) {
+					const held = earlier.get(record.targetMessageId)
+					if (held) held.push(before)
+					else earlier.set(record.targetMessageId, [before])
+				}
+				latest.set(record.targetMessageId, recordedContent(record))
 			}
 		},
-		result: async (latest) => {
+		result: async ({ latest, earlier }) => {
 			const resolved = new Map<MessageId, Message>()
 			for (const [id, entry] of latest) {
 				// Copied: the map this is read from is shared with the next call.
@@ -1534,7 +1722,22 @@ export async function readEverRecordedMessages(
 					: structuredClone(entry.content)
 				resolved.set(id, withMessageId(content, id))
 			}
-			return resolved
+			// A snapshot: the arrays are advanced in place by the next call. The
+			// entries in them are never changed once made.
+			const held = new Map<MessageId, readonly RecordedContent[]>()
+			for (const [id, list] of earlier) held.set(id, [...list])
+			return {
+				latest: resolved,
+				async heldBeforeAnEdit(id, message) {
+					for (const entry of held.get(id) ?? []) {
+						const content = entry.spill
+							? (JSON.parse(await log.readSpill(entry.spill)) as Message)
+							: entry.content
+						if (sameStoredContent(content, message)) return true
+					}
+					return false
+				},
+			}
 		},
 	})
 }

package/src/public-runtime.ts

@@ -1775,6 +1775,7 @@ export {
 	ExternalRefSchema,
 	IgnorableRecordSchema,
 	MessageRecordSchema,
+	MessageEditedRecordSchema,
 	MessageReplacedRecordSchema,
 	OriginSchema,
 	OutcomeProgressWrittenRecordSchema,

package/src/runtime/query/cancelled-before-start.ts

@@ -86,7 +86,7 @@ export async function* settlePreStartCancellation(
 
 	const push = (message: Message, ids: ReadonlyMap<Message, MessageId>): void => {
 		const messageId = ids.get(message)
-		ctx.recorder.pushMessage(message, messageId ? { messageId } : {})
+		ctx.recorder.pushMessage(message, { ...(messageId ? { messageId } : {}), restored: true })
 	}
 	try {
 		if (selectedResumeState) {

package/src/runtime/query/checkpoint.ts

@@ -822,7 +822,8 @@ async function readRecordedMessage(
 		}
 		if (
 			(entry.type === 'message' && entry.messageId === messageId) ||
-			(entry.type === 'message_replaced' && entry.targetMessageId === messageId)
+			((entry.type === 'message_replaced' || entry.type === 'message_edited') &&
+				entry.targetMessageId === messageId)
 		) {
 			found = { content: entry.content, ...(entry.spill ? { spill: entry.spill } : {}) }
 		}

package/src/runtime/query/index.ts

@@ -2248,7 +2248,10 @@ export async function* query(params: QueryParams): AsyncGenerator<SessionEvent,
 				}
 				const pushRestored = (message: Message, ids: ReadonlyMap<Message, MessageId>): void => {
 					const messageId = ids.get(message)
-					ctx.recorder.pushMessage(message, messageId ? { messageId } : {})
+					ctx.recorder.pushMessage(message, {
+						...(messageId ? { messageId } : {}),
+						restored: true,
+					})
 				}
 
 				if (params.resumeFromCheckpoint) {

package/src/runtime/query/iteration/phases/compaction.ts

@@ -7,6 +7,7 @@ import { replaceableSummaries, summarizeWithModel } from '../../../../compaction
 import {
 	type CompactionPlan,
 	DEFAULT_SOFT_TARGET,
+	canShedSalienceWorkingSet,
 	planCompaction,
 	planSalienceWorkingSet,
 } from '../../../../compaction/plan.js'
@@ -787,6 +788,23 @@ async function runCompactionCheckInner(
 	const startAt = salience ? Math.min(config.softTarget ?? DEFAULT_SOFT_TARGET, trigger) : trigger
 	if (!options?.force && usage < startAt) return
 
+	// A pass that can shed nothing and has not reached the summary trigger
+	// does nothing but announce itself: two hooks, a started event and a log
+	// line around a plan with no action. From the soft target until the
+	// trigger it ran on every iteration of every turn once every narration
+	// was cut and every large result cleared. Not asked of a forced pass, of
+	// a turn with a reducer (it owns the reduction), or at the trigger, where
+	// the summary path is what the pass is for.
+	if (
+		salience &&
+		!options?.force &&
+		!ctx.contextReducer &&
+		usage < trigger &&
+		!canShedSalienceWorkingSet(ctx.recorder.messages, config)
+	) {
+		return
+	}
+
 	// Three failed passes in a row: stop proactive compaction for the rest of
 	// the turn. A pass the provider forced is never gated.
 	const breaker = compactionBreaker(ctx)

package/src/runtime/query/prepare-turn.ts

@@ -8,7 +8,7 @@ import {
 import { assertSessionLogAttribution } from '../../manager/session/attribution.js'
 import {
 	type RecordedMessage,
-	readEverRecordedMessages,
+	readEverRecordedMessageIndex,
 	readFoldedHistory,
 } from '../../manager/session/turn-recorder.js'
 import { resolveModelPricing } from '../../pricing/index.js'
@@ -1164,7 +1164,8 @@ async function reconcileCallerMessages(
 	continuationMode: boolean,
 ): Promise<Message[]> {
 	const hasId = messages.some((message) => message.id !== undefined)
-	const recordedById = hasId ? await readEverRecordedMessages(log) : undefined
+	const everRecorded = hasId ? await readEverRecordedMessageIndex(log) : undefined
+	const recordedById = everRecorded?.latest
 	// Ids a caller message already claimed by direct lookup above: a fold
 	// entry that gave one of THESE out must not also be offered to the no-id
 	// alignment below, or a message that already reconciled by id could be
@@ -1182,7 +1183,13 @@ async function reconcileCallerMessages(
 		if (id !== undefined) {
 			const recorded = recordedById?.get(id)
 			if (recorded === undefined) throw staleCachedHistoryError('foreign', message)
-			if (!sameMessageContent(recorded, message)) throw staleCachedHistoryError('edited', message)
+			if (!sameMessageContent(recorded, message)) {
+				// A compaction pass edits a message under its own id; a host that
+				// cached the history before the pass still holds the first text.
+				// Answered from the reduction already read: no read of the log.
+				if (!(await everRecorded?.heldBeforeAnEdit(id, message)))
+					throw staleCachedHistoryError('edited', message)
+			}
 			claimedIds.add(id)
 			continue // already durable: the fold supplies it
 		}

package/src/store/session-log/core.ts

@@ -52,6 +52,12 @@ import {
 } from './lease.js'
 import type { SpillReadOptions, SpillRef, SpillStore } from './spill.js'
 import { TOOL_INPUT_RECORD_TYPES, spilledInput, toolInputSlots } from './spilled-input.js'
+import {
+	type VerifiedPrefix,
+	rehashPrefix,
+	startVerifiedPrefix,
+	verifiedPrefixOf,
+} from './verified-prefix.js'
 
 // ─── public types ─────────────────────────────────────────────────────────
 
@@ -91,6 +97,17 @@ export interface ReadSessionLogOptions {
 	readonly mode?: 'strict' | 'tolerant'
 	/** Resume after this record: its bytes are checked, then the walk continues from it. */
 	readonly after?: RecordPointer
+	/**
+	 * With `after`, and in `strict` mode only: also confirm that every byte
+	 * before the cursor is what this process verified. The prefix is read and
+	 * hashed line by line against what was remembered (no parsing, nothing
+	 * kept); when this process remembers nothing of the log, or any byte
+	 * differs, it is verified in full from byte 0, which refuses a broken chain
+	 * as a read from byte 0 does. Without it a resumed read trusts the records
+	 * before the cursor, as a reduction that is advanced rather than recomputed
+	 * does. Ignored when the medium has no `identity`.
+	 */
+	readonly reverify?: boolean
 	/**
 	 * The record the log must hold at `expectHead.seq`, byte for byte. Anchors
 	 * the tail, which no later record vouches for.
@@ -288,6 +305,25 @@ export interface LogMedium extends LogBytes {
 	truncate(size: number, expectedSize: number): Promise<void>
 	/** The bytes from `offset` to the end, in chunks. */
 	stream(offset: number): AsyncIterable<Uint8Array>
+	/**
+	 * A string that names this log's bytes for as long as the same file stands
+	 * (the disk medium: device, inode and path), or `undefined` when the log
+	 * has none yet or the medium cannot say. A log that has one lets a later
+	 * claim in the same process re-check the bytes it already verified without
+	 * parsing them again; the content is still compared, so a wrong or reused
+	 * identity can only cost a full verification, never skip one.
+	 */
+	identity?(): Promise<string | undefined>
+	/**
+	 * Hand the bytes from `offset` to `visit`, chunk by chunk, until `visit`
+	 * answers `true` or the log ends. The chunk is only valid for the call: the
+	 * medium may fill the same buffer again for the next one, so a visitor keeps
+	 * no slice of it. It lets a re-check of a long log read through one buffer
+	 * instead of allocating a fresh native buffer for every megabyte, which
+	 * otherwise makes the collector run on every few walks. Optional; `stream`
+	 * is used when a medium has no `scan`.
+	 */
+	scan?(offset: number, visit: (chunk: Uint8Array) => boolean): Promise<void>
 }
 
 export interface SessionLogCoreOptions {
@@ -397,6 +433,8 @@ export class SessionLogCore implements SessionLog {
 	readonly #holding: HeldSessionLease = { release: () => this.#releaseHeld() }
 	/** Bytes of the log this instance has verified and applied. */
 	#synced = 0
+	/** What this process remembers of the log's verified prefix (see `verified-prefix.ts`). */
+	#ledgerKey: string | undefined
 	#torn = 0
 	readonly #degradedBufferBytes: number
 	/** Records accepted into the chain that the medium has not taken yet, oldest first. */
@@ -462,13 +500,48 @@ export class SessionLogCore implements SessionLog {
 
 	// ── state ──
 
-	/** Catch up with the medium: verify and apply whatever was appended since the last sync. */
+	/**
+	 * Catch up with the medium: verify and apply whatever was appended since the last sync.
+	 *
+	 * An instance that has nothing yet (a fresh one) first asks whether this
+	 * process already verified a prefix of this very log: it then re-reads and
+	 * hashes every byte of that prefix, and takes it as verified only when
+	 * every line's length and SHA-256 equal what was verified (no parsing, no
+	 * schema check). The bytes after it, and every byte when nothing matches,
+	 * are verified in full.
+	 */
 	async #catchUp(): Promise<void> {
 		// Records waiting for the disk are ahead of it; the lease keeps others out.
 		if (this.#pending.length > 0) return
 		const size = await this.#medium.size()
 		if (size === this.#synced + this.#torn && size >= this.#synced) return
 		if (size < this.#synced) this.#reset()
+		let ledger: VerifiedPrefix | undefined
+		const key = await this.#medium.identity?.()
+		this.#ledgerKey = key
+		if (key !== undefined) {
+			ledger = verifiedPrefixOf(key)
+			if (this.#synced === 0 && this.#chain.head === null) {
+				const remembered = ledger
+				if (
+					remembered !== undefined &&
+					remembered.count > 0 &&
+					remembered.sessionId === this.sessionId &&
+					remembered.end <= size &&
+					(await rehashPrefix(this.#medium, remembered, remembered.count))
+				) {
+					this.#chain = new SessionLogChain({
+						head: remembered.head,
+						sessionId: remembered.sessionId,
+						gen: remembered.gen,
+					})
+					this.#turns = remembered.turns()
+					this.#synced = remembered.end
+				} else {
+					ledger = startVerifiedPrefix(key)
+				}
+			}
+		}
 		const splitter = new LineSplitter(this.#synced)
 		for await (const chunk of this.#medium.stream(this.#synced)) {
 			for (const { line, offset } of splitter.push(chunk)) {
@@ -483,6 +556,7 @@ export class SessionLogCore implements SessionLog {
 				}
 				this.#turns.apply(entry.record)
 				this.#synced = offset + line.byteLength
+				ledger?.append(entry)
 			}
 		}
 		this.#torn = splitter.pendingBytes
@@ -761,9 +835,21 @@ export class SessionLogCore implements SessionLog {
 		const entry = this.#chain.accept(bytes, this.#synced)
 		this.#turns.apply(entry.record)
 		this.#synced += bytes.byteLength
+		// On the disk and fully verified: a later claim need not parse it again.
+		if (this.#pending.length === 0) await this.#rememberWritten(entry)
 		return entry
 	}
 
+	/** Let this process remember a record this instance just wrote and verified. */
+	async #rememberWritten(entry: SessionLogEntry): Promise<void> {
+		if (this.#ledgerKey === undefined) this.#ledgerKey = await this.#medium.identity?.()
+		if (this.#ledgerKey === undefined) return
+		const ledger =
+			verifiedPrefixOf(this.#ledgerKey) ??
+			(entry.pointer.seq === 1 ? startVerifiedPrefix(this.#ledgerKey) : undefined)
+		ledger?.append(entry)
+	}
+
 	/**
 	 * Hand a record's bytes to the medium. A volume that refuses writes (full,
 	 * over quota, read-only) does not fail the record: it waits in a bounded
@@ -888,6 +974,7 @@ export class SessionLogCore implements SessionLog {
 		if (
 			type !== 'message' &&
 			type !== 'message_replaced' &&
+			type !== 'message_edited' &&
 			type !== 'compaction' &&
 			type !== 'turn_completed'
 		)
@@ -926,7 +1013,7 @@ export class SessionLogCore implements SessionLog {
 		const key =
 			content.role === 'tool' && typeof content.toolCallId === 'string'
 				? content.toolCallId
-				: type === 'message_replaced'
+				: type === 'message_replaced' || type === 'message_edited'
 					? `record:${String(candidate.id)}`
 					: `message:${String(candidate.messageId)}`
 		const ref = await this.#spillOrLose(key, 'message', JSON.stringify(content))
@@ -1093,7 +1180,7 @@ export async function collect(
  * both backends and by `readSessionLog`.
  */
 export async function* walkSessionLog(
-	medium: Pick<LogMedium, 'size' | 'read' | 'stream'>,
+	medium: Pick<LogMedium, 'size' | 'read' | 'stream' | 'identity' | 'scan'>,
 	options: ReadSessionLogOptions & { readonly sessionId?: SessionId },
 ): AsyncGenerator<SessionLogEntry, SessionLogReadSummary> {
 	const strict = (options.mode ?? 'strict') === 'strict'
@@ -1105,6 +1192,9 @@ export async function* walkSessionLog(
 		brokeAt = error
 	}
 
+	// A resumed read that must also vouch for the bytes before its cursor.
+	let covered = 0
+	let ledger: VerifiedPrefix | undefined
 	if (options.after !== undefined) {
 		const after = options.after
 		if (!(await verifyPointer(medium, after))) {
@@ -1117,15 +1207,42 @@ export async function* walkSessionLog(
 			fail(error)
 			return { intact: false, throughSeq: 0, head: null, tornBytes: 0, break: error }
 		}
-		const parsed = parseSessionLogLine(await medium.read(after.offset, after.length))
-		chain = new SessionLogChain({
-			head: after,
-			sessionId: options.sessionId ?? parsed.record.sessionId,
-			gen: parsed.record.gen,
-		})
-		start = after.offset + after.length
+		const key = options.reverify && strict ? await medium.identity?.() : undefined
+		if (key !== undefined) {
+			const remembered = verifiedPrefixOf(key)
+			if (
+				remembered !== undefined &&
+				remembered.sessionId === options.sessionId &&
+				remembered.holds(after) &&
+				(await rehashPrefix(medium, remembered, after.seq))
+			) {
+				ledger = remembered
+			} else {
+				// Nothing remembered, or it no longer matches: verify from byte 0 and
+				// remember it, handing the caller only what follows the cursor.
+				ledger = startVerifiedPrefix(key)
+				covered = after.seq
+			}
+		}
+		if (covered > 0) {
+			chain = new SessionLogChain({ head: null, sessionId: options.sessionId })
+		} else {
+			const parsed = parseSessionLogLine(await medium.read(after.offset, after.length))
+			chain = new SessionLogChain({
+				head: after,
+				sessionId: options.sessionId ?? parsed.record.sessionId,
+				gen: parsed.record.gen,
+			})
+			start = after.offset + after.length
+		}
 	} else {
 		chain = new SessionLogChain({ head: null, sessionId: options.sessionId })
+		// A whole read that asked to reverify is the first of its kind: what it verifies in
+		// full is remembered, so the resumed reads after it can re-check by hash.
+		if (options.reverify && strict) {
+			const key = await medium.identity?.()
+			if (key !== undefined) ledger = verifiedPrefixOf(key) ?? startVerifiedPrefix(key)
+		}
 	}
 
 	const splitter = new LineSplitter(start)
@@ -1165,6 +1282,8 @@ export async function* walkSessionLog(
 						break outer
 					}
 				}
+				ledger?.append(entry)
+				if (entry.pointer.seq <= covered) continue
 				yield entry
 				if (options.throughSeq !== undefined && entry.pointer.seq >= options.throughSeq) {
 					stopped = true