@opendatalabs/personal-server-ts-core 1.34.2 → 1.35.1

package/dist/storage/legacy-scope-view.js

@@ -1,6 +1,7 @@
 import { compareLegacyCoverage, } from "./legacy-scope-coverage.js";
 import { LEGACY_SCOPE_ENTITY_KEYS } from "./legacy-scope-entity-keys.js";
-import { GITHUB_BROWSER_BINDINGS, LEGACY_SCOPE_BINDINGS, legacyBindingsForProfile, META_040_BINDINGS, OURA_BROWSER_BINDINGS, } from "../legacy-projection/index.js";
+import { OURA_BROWSER_HISTORY_POLICY } from "../oura/history-policy.js";
+import { ANTHROPIC_LIVE_BINDINGS, GITHUB_BROWSER_BINDINGS, LEGACY_SCOPE_BINDINGS, legacyBindingsForProfile, META_040_BINDINGS, OURA_BROWSER_BINDINGS, STRAVA_BROWSER_BINDINGS, } from "../legacy-projection/index.js";
 import { legacyConnectorKey, readCanonicalLegacyScope, CANONICAL_LEGACY_VIEW_CONTRACT, } from "./canonical-legacy-projection.js";
 /**
  * Decides, per legacy scope, whether the latest body comes from the
@@ -28,11 +29,60 @@ import { legacyConnectorKey, readCanonicalLegacyScope, CANONICAL_LEGACY_VIEW_CON
 /** Every declaration profile the pure module serves a scope from. */
 const BINDING_PROFILES = [
     LEGACY_SCOPE_BINDINGS,
+    ANTHROPIC_LIVE_BINDINGS,
     GITHUB_BROWSER_BINDINGS,
     META_040_BINDINGS,
     OURA_BROWSER_BINDINGS,
+    STRAVA_BROWSER_BINDINGS,
 ];
-const COVERAGE_RULE_VERSION = 5;
+// Invalidate persisted witnesses created before completion-horizon fencing.
+const COVERAGE_RULE_VERSION = 11;
+const OURA_RUN_STREAMS = ["sleep", "readiness", "activity"];
+/** Live Claude omits some account metadata. Preserve known fields from the
+ * same organization's saved head; never borrow entities or another identity. */
+async function retainClaudeProfile(read, legacy) {
+    const current = read.envelope.data;
+    const previous = legacy.data;
+    if (current.source !== "live-session" ||
+        typeof current.organizationId !== "string" ||
+        current.organizationId !== previous.organizationId)
+        return;
+    const isObject = (value) => value !== null && typeof value === "object" && !Array.isArray(value);
+    if (!isObject(current.profile) || !isObject(previous.profile))
+        return;
+    const profile = { ...current.profile };
+    let retained = false;
+    for (const field of ["name", "plan"]) {
+        if (profile[field] === null &&
+            typeof previous.profile[field] === "string") {
+            profile[field] = previous.profile[field];
+            retained = true;
+        }
+    }
+    if (retained) {
+        read.envelope = { ...read.envelope, data: { ...current, profile } };
+        // The stored metadata contributes to the response even when live rows do not change.
+        const digest = await crypto.subtle.digest("SHA-256", new TextEncoder().encode(`${read.revision}:profile:${JSON.stringify(profile)}`));
+        read.revision = Array.from(new Uint8Array(digest), (byte) => byte.toString(16).padStart(2, "0")).join("");
+    }
+}
+/** An export-to-live transition never treats missing old entities as deletions. */
+export async function coversClaudeTransition(current, previous) {
+    if (current.envelope.scope !== "claude.conversations" ||
+        previous.scope !== "claude.conversations" ||
+        typeof previous.data.organizationId !== "string" ||
+        !previous.data.organizationId ||
+        previous.data.organizationId !== current.envelope.data.organizationId)
+        return false;
+    await retainClaudeProfile(current, previous);
+    return compareLegacyCoverage(previous.data, current.envelope.data, {
+        scope: "claude.conversations",
+        entityKeys: LEGACY_SCOPE_ENTITY_KEYS["claude.conversations"],
+        canonicalNewer: Date.parse(current.envelope.collectedAt) >
+            Date.parse(previous.collectedAt),
+        allowProvenDeletion: false,
+    }).covered;
+}
 function scopeDeclarationCursor(scope) {
     return JSON.stringify(BINDING_PROFILES.flatMap((profile) => [...profile.values()])
         .filter((binding) => binding.scope === scope)
@@ -44,11 +94,100 @@ function scopeDeclarationCursor(scope) {
         provenance: binding.provenance,
     })));
 }
+/**
+ * The deletion history of a body, decided with the body. Callers never
+ * recompute it from later ownership state.
+ */
+export function deletionHistoryOf(body) {
+    return body.kind === "file" ? body.deletion : "canonical";
+}
 export function createLegacyScopeView(input) {
     const { authority, records } = input;
     const coveredProjection = new Map();
-    function decide(scope) {
-        const streamsByMethod = scopeMethods(scope);
+    /**
+     * The scope's methods, minus each opt-in method (`input.optInMethods`)
+     * while the legacy file is still the owner's latest body: an eligible
+     * legacy head and no takeover recorded for that method. Such a method never
+     * served this scope, so its deleted, reset or replaced connections are not
+     * ownership evidence: the file was the served body all along. A takeover
+     * another method earned (the PAT `oura` connection, say), or one that does
+     * not name its method, leaves it excluded. Once it has earned one, it
+     * serves, and deletion refuses, as for any other method.
+     */
+    function withoutOptedOutMethods(scope) {
+        const methods = scopeMethods(scope);
+        const head = authority.eligibleLegacyHead(scope);
+        if (head === null)
+            return methods;
+        const gated = new Set([...optedOutMethods(scope)].filter((method) => !earnedTakeover(scope, method)));
+        if (gated.size === 0)
+            return methods;
+        reportKeptLegacyFile(scope, head, gated);
+        return new Map([...methods].filter(([method]) => !gated.has(method)));
+    }
+    function optedOutMethods(scope) {
+        const optIn = input.optInMethods;
+        if (!optIn || optIn.size === 0)
+            return [];
+        return [...scopeMethods(scope).keys()].filter((method) => optIn.has(method));
+    }
+    function earnedTakeover(scope, method) {
+        return authority.hasMethodTakeover(scope, method);
+    }
+    /**
+     * Deletion safety asks the ungated question: do connection rows exist that
+     * a legacy-only deletion would let appear? Where the gate keeps the file
+     * over an opted-out method, only live rows of that method count: a deleted,
+     * reset or replaced connection erased its rows, and a connection that never
+     * held data has none.
+     */
+    function ownsScope(scope) {
+        if (decide(scope, false).kind === "file")
+            return false;
+        if (decide(scope).kind !== "file")
+            return true;
+        return authority
+            .listMethodConnections([...optedOutMethods(scope)])
+            .some((connection) => connection.deletedAt === null &&
+            authority.hasHeldData(connection.instance, null));
+    }
+    /** Decided with the body: connection rows serve the scope, or they do not. */
+    function deletionFor(decision) {
+        return decision.kind === "file" ? "file" : "canonical";
+    }
+    /**
+     * One line per (scope, legacy head, number of connections holding rows), so
+     * an operator can see a stalled collector keeping a fresh projection gated.
+     */
+    const reportedKept = new Set();
+    function reportKeptLegacyFile(scope, head, optedOut) {
+        if (!input.logger)
+            return;
+        const held = authority
+            .listMethodConnections([...optedOut])
+            .filter((connection) => connection.deletedAt === null &&
+            authority.hasHeldData(connection.instance, null)).length;
+        if (held === 0)
+            return;
+        const key = `${scope}:${head.id}:${held}`;
+        if (reportedKept.has(key))
+            return;
+        reportedKept.add(key);
+        input.logger.info({
+            scope,
+            legacyHeadCollectedAt: head.collectedAt,
+            heldConnections: held,
+        }, "Legacy file kept as the latest body; a method that opts out of takeover holds synced rows");
+    }
+    /**
+     * `legacyFirst` (the default) lets the legacy file stay authoritative over
+     * methods whose binding opts out of takeover. Deletion safety asks the
+     * ungated question: do any connection rows exist for this scope?
+     */
+    function decide(scope, legacyFirst = true) {
+        const streamsByMethod = legacyFirst
+            ? withoutOptedOutMethods(scope)
+            : scopeMethods(scope);
         if (streamsByMethod.size === 0) {
             return authority.hasTakeover(scope)
                 ? refused({
@@ -124,149 +263,292 @@ export function createLegacyScopeView(input) {
     }
     function listingFor(scope) {
         return authority.readSnapshot(() => {
-            if (authority.isReset(scope))
-                return { kind: "file" };
             const decision = decide(scope);
-            const legacyHead = authority.eligibleLegacyHead(scope);
-            const hasTakeover = authority.hasTakeover(scope, decision.kind === "canonical" ? decision.selection.instance : undefined, decision.kind === "canonical" ? decision.generation : undefined);
-            if (decision.kind === "refused" &&
-                decision.refusal.status === "unavailable" &&
-                decision.refusal.reason === "no_connection" &&
-                canServeLegacyBeforeTakeover(scope)) {
-                return { kind: "file" };
-            }
-            if (decision.kind !== "canonical")
-                return { kind: decision.kind };
-            const hasLegacyHead = legacyHead !== null;
-            if (hasLegacyHead && input.readLegacyHead) {
-                const verdict = authority
-                    .verdictFor(scope)
-                    .find((row) => row.instance === decision.selection.instance &&
-                    row.generation === decision.generation &&
-                    row.legacyVersionId === legacyHead.id);
-                const coveredHead = authority.hasCoveredHead(scope, legacyHead);
-                if (verdict?.verdict !== "covered") {
-                    return { kind: coveredHead ? "refused" : "file" };
-                }
-                if (!verdict.canonicalCursor.startsWith(`${authority.writeClock()}:${authority.arrivalRevision()}:${receiptCursor(decision, input.declarations)}:`)) {
-                    return { kind: "refused" };
-                }
+            const listed = chooseListing(scope, decision);
+            return listed.kind === "file"
+                ? { kind: "file", deletion: deletionFor(decision) }
+                : listed;
+        });
+    }
+    function chooseListing(scope, decision) {
+        if (authority.isReset(scope))
+            return { kind: "file" };
+        const legacyHead = authority.eligibleLegacyHead(scope);
+        const hasTakeover = authority.hasTakeover(scope, decision.kind === "canonical" ? decision.selection.instance : undefined, decision.kind === "canonical" ? decision.generation : undefined);
+        if (decision.kind === "refused" &&
+            decision.refusal.status === "unavailable" &&
+            decision.refusal.reason === "no_connection" &&
+            canServeLegacyBeforeTakeover(scope)) {
+            return { kind: "file" };
+        }
+        if (decision.kind !== "canonical")
+            return { kind: decision.kind };
+        if (ouraHasRetainedEntityLoss(decision) &&
+            !ouraCompletedReplacement(decision))
+            return { kind: hasTakeover || legacyHead === null ? "refused" : "file" };
+        const hasLegacyHead = legacyHead !== null;
+        if (hasLegacyHead && !hasTakeover && !initialOuraRunComplete(decision)) {
+            return { kind: "file" };
+        }
+        const completedReplacement = legacyHead !== null &&
+            authority.hasCompletedReplacement?.(scope, legacyHead, decision.selection.instance, decision.generation, decision.selection.method, coverageCursor(scope, decision, authority.writeClock(), authority.arrivalRevision(), receiptCursor(decision, input.declarations))) === true;
+        if (hasLegacyHead && input.readLegacyHead && !completedReplacement) {
+            const verdict = authority
+                .verdictFor(scope)
+                .find((row) => row.instance === decision.selection.instance &&
+                row.generation === decision.generation &&
+                row.legacyVersionId === legacyHead.id);
+            const coveredHead = authority.hasCoveredHead(scope, legacyHead);
+            if (verdict?.verdict !== "covered") {
+                return { kind: coveredHead ? "refused" : "file" };
             }
-            else if (hasLegacyHead && !hasTakeover)
-                return { kind: "file" };
-            if (!input.readLegacyHead &&
-                hasLegacyHead &&
-                hasTakeover &&
-                missingCompletionReceipts(decision).length > 0) {
+            if (verdict.canonicalCursor !==
+                coverageCursor(scope, decision, authority.writeClock(), authority.arrivalRevision(), receiptCursor(decision, input.declarations))) {
                 return { kind: "refused" };
             }
-            const collectedAt = listedCollectedAt(decision.records, decision.selection.instance, decision.streams);
-            return collectedAt === null
-                ? { kind: "refused" }
-                : { kind: "canonical", collectedAt };
+        }
+        else if (hasLegacyHead && !hasTakeover)
+            return { kind: "file" };
+        if (!input.readLegacyHead &&
+            hasLegacyHead &&
+            hasTakeover &&
+            missingCompletionReceipts(decision).length > 0) {
+            return { kind: "refused" };
+        }
+        const collectedAt = listedCollectedAt(decision.records, decision.selection.instance, decision.streams);
+        return collectedAt === null
+            ? { kind: "refused" }
+            : { kind: "canonical", collectedAt };
+    }
+    function ouraHasRetainedEntityLoss(decision) {
+        return (decision.selection.method === "oura-browser" &&
+            OURA_BROWSER_HISTORY_POLICY.preserveRetainedEntities &&
+            authority.hasRetainedTombstones(decision.selection.instance, decision.streams));
+    }
+    // Omitted IDs are intentional only when every Oura stream has current,
+    // coherent completion evidence. A tombstone alone proves no replacement.
+    function ouraCompletedReplacement(decision) {
+        if (!initialOuraRunComplete(decision))
+            return false;
+        const receipts = decision.records.listStreamCompletions(decision.selection.instance);
+        return OURA_RUN_STREAMS.every((stream) => {
+            const head = authority.eligibleLegacyHead(`oura.${stream}`);
+            if (!head)
+                return true;
+            const receipt = receipts.find((entry) => entry.stream === stream);
+            const collected = Date.parse(receipt?.sourceCollectedAt ?? "");
+            const previous = Date.parse(head.collectedAt);
+            return (Number.isFinite(collected) &&
+                Number.isFinite(previous) &&
+                collected > previous);
         });
     }
-    return {
-        async readLatest(scope) {
-            if (authority.isReset(scope))
-                return { kind: "file" };
-            const initial = authority.readSnapshot(() => {
-                const decision = decide(scope);
+    function coverageCursor(scope, decision, writeClock, arrivalRevision, receipts) {
+        return [
+            writeClock,
+            arrivalRevision,
+            receipts,
+            decision.generation,
+            CANONICAL_LEGACY_VIEW_CONTRACT,
+            scopeDeclarationCursor(scope),
+            COVERAGE_RULE_VERSION,
+            input.coverageThresholds?.maxPayloadRatio ?? 1.5,
+            input.coverageThresholds?.maxExtraBytes ?? 256 * 1024,
+        ].join(":");
+    }
+    /** One snapshot: the decision and the evidence the read is judged by. */
+    function readDecision(scope) {
+        return authority.readSnapshot(() => {
+            const decision = decide(scope);
+            return {
+                reset: authority.isReset(scope),
+                decision,
+                retainedEntityLoss: decision.kind === "canonical" && ouraHasRetainedEntityLoss(decision),
+                legacyHead: authority.eligibleLegacyHead(scope),
+                hasTakeover: authority.hasTakeover(scope, decision.kind === "canonical"
+                    ? decision.selection.instance
+                    : undefined, decision.kind === "canonical" ? decision.generation : undefined),
+                canServeLegacy: canServeLegacyBeforeTakeover(scope),
+                hasCompletion: decision.kind === "canonical" &&
+                    missingCompletionReceipts(decision).length === 0,
+                initialOuraRunComplete: decision.kind !== "canonical" || initialOuraRunComplete(decision),
+                writeClock: authority.writeClock(),
+                arrivalRevision: authority.arrivalRevision(),
+                receiptCursor: decision.kind === "canonical"
+                    ? receiptCursor(decision, input.declarations)
+                    : "",
+            };
+        });
+    }
+    /** The body `decision` serves; the caller attaches its deletion history. */
+    async function chooseBody(scope, initial) {
+        if (initial.reset)
+            return { kind: "file" };
+        const { decision, legacyHead, hasTakeover, canServeLegacy } = initial;
+        if (decision.kind === "refused" &&
+            decision.refusal.status === "unavailable" &&
+            decision.refusal.reason === "no_connection" &&
+            canServeLegacy) {
+            return { kind: "file" };
+        }
+        if (decision.kind !== "canonical")
+            return decision;
+        if (initial.retainedEntityLoss && !ouraCompletedReplacement(decision)) {
+            return hasTakeover || legacyHead === null
+                ? {
+                    kind: "refused",
+                    refusal: {
+                        status: "incomplete",
+                        reason: "canonical_view_incomplete",
+                        diagnostics: [],
+                    },
+                }
+                : { kind: "file" };
+        }
+        if (legacyHead !== null &&
+            !hasTakeover &&
+            !initial.initialOuraRunComplete) {
+            return { kind: "file" };
+        }
+        const replacementEligible = initial.hasCompletion &&
+            typeof authority.hasCompletedReplacement === "function";
+        const canonicalCursor = legacyHead
+            ? coverageCursor(scope, decision, initial.writeClock, initial.arrivalRevision, initial.receiptCursor)
+            : "";
+        const projectionKey = legacyHead
+            ? JSON.stringify([
+                decision.selection.instance,
+                decision.generation,
+                legacyHead.id,
+                canonicalCursor,
+            ])
+            : "";
+        const projectionOwner = scope;
+        const cachedCoverage = legacyHead !== null && input.readLegacyHead
+            ? authority.cachedVerdict(scope, decision.selection.instance, decision.generation, legacyHead.id, canonicalCursor)
+            : null;
+        const cachedProjection = coveredProjection.get(projectionOwner);
+        if (cachedCoverage?.covered && cachedProjection?.key === projectionKey) {
+            const confirmed = authority.confirmRead(scope, legacyHead, () => sameSelection(decide(scope), decision) &&
+                receiptCursor(decision, input.declarations) === initial.receiptCursor, decision.selection.method, {
+                instance: decision.selection.instance,
+                generation: decision.generation,
+                writeClock: initial.writeClock,
+                arrivalRevision: initial.arrivalRevision,
+                canonicalCursor,
+                coverage: cachedCoverage,
+                cached: true,
+            });
+            if (!confirmed) {
+                if (authority.isReset(scope))
+                    return { kind: "file" };
                 return {
-                    decision,
-                    legacyHead: authority.eligibleLegacyHead(scope),
-                    hasTakeover: authority.hasTakeover(scope, decision.kind === "canonical"
-                        ? decision.selection.instance
-                        : undefined, decision.kind === "canonical" ? decision.generation : undefined),
-                    canServeLegacy: canServeLegacyBeforeTakeover(scope),
-                    writeClock: authority.writeClock(),
-                    arrivalRevision: authority.arrivalRevision(),
-                    receiptCursor: decision.kind === "canonical"
-                        ? receiptCursor(decision, input.declarations)
-                        : "",
+                    kind: "refused",
+                    refusal: {
+                        status: "unavailable",
+                        reason: "store_inconsistent_read",
+                        detail: "legacy head or canonical cursor changed during parity evaluation",
+                    },
                 };
-            });
-            const { decision, legacyHead, hasTakeover, canServeLegacy } = initial;
-            if (decision.kind === "refused" &&
-                decision.refusal.status === "unavailable" &&
-                decision.refusal.reason === "no_connection" &&
-                canServeLegacy) {
-                return { kind: "file" };
             }
-            if (decision.kind !== "canonical")
-                return decision;
-            const canonicalCursor = legacyHead
-                ? [
-                    initial.writeClock,
-                    initial.arrivalRevision,
-                    initial.receiptCursor,
-                    decision.generation,
-                    CANONICAL_LEGACY_VIEW_CONTRACT,
-                    scopeDeclarationCursor(scope),
-                    COVERAGE_RULE_VERSION,
-                    input.coverageThresholds?.maxPayloadRatio ?? 1.5,
-                    input.coverageThresholds?.maxExtraBytes ?? 256 * 1024,
-                ].join(":")
-                : "";
-            const projectionKey = legacyHead
-                ? JSON.stringify([
-                    decision.selection.instance,
-                    decision.generation,
-                    legacyHead.id,
-                    canonicalCursor,
-                ])
-                : "";
-            const projectionOwner = scope;
-            const cachedCoverage = legacyHead !== null && input.readLegacyHead
-                ? authority.cachedVerdict(scope, decision.selection.instance, decision.generation, legacyHead.id, canonicalCursor)
-                : null;
-            const cachedProjection = coveredProjection.get(projectionOwner);
-            if (cachedCoverage?.covered && cachedProjection?.key === projectionKey) {
-                const confirmed = authority.confirmRead(scope, legacyHead, () => sameSelection(decide(scope), decision) &&
-                    receiptCursor(decision, input.declarations) ===
-                        initial.receiptCursor, {
-                    instance: decision.selection.instance,
-                    generation: decision.generation,
-                    writeClock: initial.writeClock,
-                    arrivalRevision: initial.arrivalRevision,
-                    canonicalCursor,
-                    coverage: cachedCoverage,
-                    cached: true,
-                });
-                if (!confirmed) {
-                    if (authority.isReset(scope))
-                        return { kind: "file" };
-                    return {
+            return {
+                kind: "canonical",
+                envelope: cachedProjection.envelope,
+                revision: cachedProjection.revision,
+            };
+        }
+        if (cachedCoverage && !cachedCoverage.covered && legacyHead) {
+            let legacy;
+            try {
+                legacy = await input.readLegacyHead(legacyHead);
+            }
+            catch {
+                return hasTakeover
+                    ? {
                         kind: "refused",
                         refusal: {
                             status: "unavailable",
                             reason: "store_inconsistent_read",
-                            detail: "legacy head or canonical cursor changed during parity evaluation",
+                            detail: "indexed legacy head could not be read",
                         },
-                    };
-                }
+                    }
+                    : { kind: "file" };
+            }
+            if (legacy.scope !== scope) {
+                return {
+                    kind: "refused",
+                    refusal: {
+                        status: "unavailable",
+                        reason: "store_inconsistent_read",
+                        detail: "indexed legacy head has another scope",
+                    },
+                };
+            }
+            const alreadyCovered = authority.hasCoveredHead(scope, legacyHead);
+            const confirmed = authority.confirmRead(scope, legacyHead, () => sameSelection(decide(scope), decision) &&
+                receiptCursor(decision, input.declarations) === initial.receiptCursor, decision.selection.method, {
+                instance: decision.selection.instance,
+                generation: decision.generation,
+                writeClock: initial.writeClock,
+                arrivalRevision: initial.arrivalRevision,
+                canonicalCursor,
+                coverage: cachedCoverage,
+                cached: true,
+            });
+            if (!confirmed) {
+                if (authority.isReset(scope))
+                    return { kind: "file" };
                 return {
-                    kind: "canonical",
-                    envelope: cachedProjection.envelope,
-                    revision: cachedProjection.revision,
+                    kind: "refused",
+                    refusal: {
+                        status: "unavailable",
+                        reason: "store_inconsistent_read",
+                        detail: "legacy head or canonical cursor changed during parity evaluation",
+                    },
                 };
             }
-            if (cachedCoverage && !cachedCoverage.covered && legacyHead) {
+            return alreadyCovered
+                ? {
+                    kind: "refused",
+                    refusal: {
+                        status: "incomplete",
+                        reason: "canonical_view_incomplete",
+                        diagnostics: [],
+                    },
+                }
+                : { kind: "file" };
+        }
+        const read = await readCanonicalLegacyScope({
+            store: decision.records,
+            declarations: input.declarations,
+            scope,
+            selection: decision.selection,
+            profileBy: "method",
+            // Completion proves initial Oura admission. Once a takeover is earned,
+            // partial refreshes still face coverage checks without requiring receipts.
+            requireCompletionReceipts: legacyHead !== null &&
+                (replacementEligible ||
+                    !input.readLegacyHead ||
+                    (decision.selection.method === "oura-browser" && !hasTakeover)),
+            allowUnprovenEmptyStreams: legacyHead !== null && !!input.readLegacyHead,
+            includeStreamTimes: legacyHead !== null,
+            requireClaudeRawBlobs: legacyHead !== null && !!input.readLegacyHead,
+            // The rows must come from a state in which this is still the one
+            // connection: a second account appearing between the decision and
+            // the rows refuses instead of serving a body chosen while ambiguous.
+            confirmSelection: () => sameSelection(decide(scope), decision),
+        });
+        if (!read.ok) {
+            if (legacyHead !== null &&
+                input.readLegacyHead &&
+                isProjectionDataFailure(read.reason)) {
                 let legacy;
                 try {
                     legacy = await input.readLegacyHead(legacyHead);
                 }
                 catch {
-                    return hasTakeover
-                        ? {
-                            kind: "refused",
-                            refusal: {
-                                status: "unavailable",
-                                reason: "store_inconsistent_read",
-                                detail: "indexed legacy head could not be read",
-                            },
-                        }
-                        : { kind: "file" };
+                    const { ok: _ok, ...refusal } = read;
+                    return { kind: "refused", refusal };
                 }
                 if (legacy.scope !== scope) {
                     return {
@@ -278,17 +560,18 @@ export function createLegacyScopeView(input) {
                         },
                     };
                 }
-                const alreadyCovered = authority.hasCoveredHead(scope, legacyHead);
+                const coveredHead = authority.hasCoveredHead(scope, legacyHead);
+                const coverage = projectionUnavailableCoverage(legacy.data, read.reason === "missing_raw_blob" ? read.recordCount : 0);
                 const confirmed = authority.confirmRead(scope, legacyHead, () => sameSelection(decide(scope), decision) &&
                     receiptCursor(decision, input.declarations) ===
-                        initial.receiptCursor, {
+                        initial.receiptCursor, decision.selection.method, {
                     instance: decision.selection.instance,
                     generation: decision.generation,
                     writeClock: initial.writeClock,
                     arrivalRevision: initial.arrivalRevision,
-                    canonicalCursor,
-                    coverage: cachedCoverage,
-                    cached: true,
+                    canonicalCursor: `${initial.writeClock}:${initial.arrivalRevision}:${initial.receiptCursor}:unavailable:${read.reason}:${COVERAGE_RULE_VERSION}`,
+                    coverage,
+                    cached: false,
                 });
                 if (!confirmed) {
                     if (authority.isReset(scope))
@@ -302,228 +585,248 @@ export function createLegacyScopeView(input) {
                         },
                     };
                 }
-                return alreadyCovered
-                    ? {
-                        kind: "refused",
-                        refusal: {
-                            status: "incomplete",
-                            reason: "canonical_view_incomplete",
-                            diagnostics: [],
-                        },
-                    }
-                    : { kind: "file" };
+                if (coveredHead) {
+                    const { ok: _ok, ...refusal } = read;
+                    return { kind: "refused", refusal };
+                }
+                return { kind: "file" };
+            }
+            if (legacyHead !== null &&
+                !hasTakeover &&
+                (read.reason === "projection_rejected" ||
+                    read.reason === "all_rows_rejected" ||
+                    read.reason === "no_synced_data" ||
+                    read.reason === "stream_completion_unknown" ||
+                    read.reason === "blob_read_budget_exceeded" ||
+                    read.reason === "blob_backed_record_invalid" ||
+                    read.reason === "missing_raw_blob" ||
+                    read.reason === "blob_backed_records_unsupported")) {
+                const stillLegacyOwned = authority.readSnapshot(() => canServeLegacyBeforeTakeover(scope));
+                if (stillLegacyOwned)
+                    return { kind: "file" };
             }
-            const read = await readCanonicalLegacyScope({
-                store: decision.records,
-                declarations: input.declarations,
-                scope,
-                selection: decision.selection,
-                profileBy: "method",
-                requireCompletionReceipts: legacyHead !== null && !input.readLegacyHead,
-                allowUnprovenEmptyStreams: legacyHead !== null && !!input.readLegacyHead,
-                includeStreamTimes: legacyHead !== null && !!input.readLegacyHead,
-                requireClaudeRawBlobs: legacyHead !== null && !!input.readLegacyHead,
-                // The rows must come from a state in which this is still the one
-                // connection: a second account appearing between the decision and
-                // the rows refuses instead of serving a body chosen while ambiguous.
-                confirmSelection: () => sameSelection(decide(scope), decision),
+            const { ok: _ok, ...refusal } = read;
+            return { kind: "refused", refusal };
+        }
+        // Receipt presence cannot make a lossy/partial projection complete.
+        if (initial.retainedEntityLoss && !read.complete) {
+            if (legacyHead !== null && !hasTakeover) {
+                const stillLegacyOwned = authority.readSnapshot(() => canServeLegacyBeforeTakeover(scope));
+                if (stillLegacyOwned)
+                    return { kind: "file" };
+            }
+            return {
+                kind: "refused",
+                refusal: {
+                    status: "incomplete",
+                    reason: "canonical_view_incomplete",
+                    diagnostics: incompleteness(read),
+                },
+            };
+        }
+        // Whole-dataset replacement needs a fresh completion for every input.
+        // Equal/older horizons retain the existing parity path, not deletion authority.
+        if (legacyHead !== null &&
+            replacementEligible &&
+            read.complete &&
+            allStreamsProvenAfter(read, decision.streams, legacyHead.collectedAt)) {
+            const confirmed = authority.confirmRead(scope, legacyHead, () => sameSelection(decide(scope), decision) &&
+                receiptCursor(decision, input.declarations) === initial.receiptCursor, decision.selection.method, {
+                instance: decision.selection.instance,
+                generation: decision.generation,
+                writeClock: initial.writeClock,
+                arrivalRevision: initial.arrivalRevision,
+                canonicalCursor,
+                completion: true,
             });
-            if (!read.ok) {
-                if (legacyHead !== null &&
-                    input.readLegacyHead &&
-                    isProjectionDataFailure(read.reason)) {
-                    let legacy;
-                    try {
-                        legacy = await input.readLegacyHead(legacyHead);
-                    }
-                    catch {
-                        const { ok: _ok, ...refusal } = read;
-                        return { kind: "refused", refusal };
-                    }
-                    if (legacy.scope !== scope) {
-                        return {
-                            kind: "refused",
-                            refusal: {
-                                status: "unavailable",
-                                reason: "store_inconsistent_read",
-                                detail: "indexed legacy head has another scope",
-                            },
-                        };
-                    }
-                    const coveredHead = authority.hasCoveredHead(scope, legacyHead);
-                    const coverage = projectionUnavailableCoverage(legacy.data, read.reason === "missing_raw_blob" ? read.recordCount : 0);
-                    const confirmed = authority.confirmRead(scope, legacyHead, () => sameSelection(decide(scope), decision) &&
-                        receiptCursor(decision, input.declarations) ===
-                            initial.receiptCursor, {
-                        instance: decision.selection.instance,
-                        generation: decision.generation,
-                        writeClock: initial.writeClock,
-                        arrivalRevision: initial.arrivalRevision,
-                        canonicalCursor: `${initial.writeClock}:${initial.arrivalRevision}:${initial.receiptCursor}:unavailable:${read.reason}:${COVERAGE_RULE_VERSION}`,
-                        coverage,
-                        cached: false,
-                    });
-                    if (!confirmed) {
-                        if (authority.isReset(scope))
-                            return { kind: "file" };
-                        return {
-                            kind: "refused",
-                            refusal: {
-                                status: "unavailable",
-                                reason: "store_inconsistent_read",
-                                detail: "legacy head or canonical cursor changed during parity evaluation",
-                            },
-                        };
-                    }
-                    if (coveredHead) {
-                        const { ok: _ok, ...refusal } = read;
-                        return { kind: "refused", refusal };
-                    }
+            if (!confirmed) {
+                if (authority.isReset(scope))
                     return { kind: "file" };
-                }
-                if (legacyHead !== null &&
-                    !hasTakeover &&
-                    (read.reason === "projection_rejected" ||
-                        read.reason === "all_rows_rejected" ||
-                        read.reason === "no_synced_data" ||
-                        read.reason === "stream_completion_unknown" ||
-                        read.reason === "blob_read_budget_exceeded" ||
-                        read.reason === "blob_backed_record_invalid" ||
-                        read.reason === "missing_raw_blob" ||
-                        read.reason === "blob_backed_records_unsupported")) {
-                    const stillLegacyOwned = authority.readSnapshot(() => canServeLegacyBeforeTakeover(scope));
-                    if (stillLegacyOwned)
-                        return { kind: "file" };
-                }
-                const { ok: _ok, ...refusal } = read;
-                return { kind: "refused", refusal };
+                const canKeepFile = authority.readSnapshot(() => canServeLegacyBeforeTakeover(scope) &&
+                    !authority.hasTakeover(scope, decision.selection.instance, decision.generation));
+                if (canKeepFile)
+                    return { kind: "file" };
+                return {
+                    kind: "refused",
+                    refusal: {
+                        status: "unavailable",
+                        reason: "store_inconsistent_read",
+                        detail: "legacy head or canonical snapshot changed during replacement",
+                    },
+                };
             }
-            if (legacyHead !== null && input.readLegacyHead) {
-                let coverage = cachedCoverage;
-                const cached = coverage !== null;
-                if (!coverage) {
-                    let legacy;
-                    try {
-                        legacy = await input.readLegacyHead(legacyHead);
-                    }
-                    catch {
-                        return hasTakeover
-                            ? {
-                                kind: "refused",
-                                refusal: {
-                                    status: "unavailable",
-                                    reason: "store_inconsistent_read",
-                                    detail: "indexed legacy head could not be read",
-                                },
-                            }
-                            : { kind: "file" };
-                    }
-                    if (legacy.scope !== scope) {
-                        return {
+            return {
+                kind: "canonical",
+                envelope: read.envelope,
+                revision: read.revision,
+            };
+        }
+        // Without the old body, only a newer complete import can prove replacement.
+        // Do not fall through to confirmation that records an unscoped takeover.
+        if (legacyHead !== null && !input.readLegacyHead) {
+            const stillLegacyOwned = authority.readSnapshot(() => canServeLegacyBeforeTakeover(scope));
+            if (stillLegacyOwned)
+                return { kind: "file" };
+            return {
+                kind: "refused",
+                refusal: {
+                    status: "incomplete",
+                    reason: "canonical_view_incomplete",
+                    diagnostics: incompleteness(read),
+                },
+            };
+        }
+        if (legacyHead !== null && input.readLegacyHead) {
+            // Coverage compares against the old file, so it cannot see rows the
+            // source reports short of detail. Such a history cannot take over; once
+            // this file is covered, it keeps serving (no hard break).
+            if (read.diagnostics.partialRows.length > 0 &&
+                !authority.hasCoveredHead(scope, legacyHead)) {
+                return { kind: "file" };
+            }
+            let coverage = cachedCoverage;
+            const cached = coverage !== null;
+            if (!coverage || decision.selection.method === "anthropic-live") {
+                let legacy;
+                try {
+                    legacy = await input.readLegacyHead(legacyHead);
+                }
+                catch {
+                    return hasTakeover
+                        ? {
                             kind: "refused",
                             refusal: {
                                 status: "unavailable",
                                 reason: "store_inconsistent_read",
-                                detail: "indexed legacy head has another scope",
+                                detail: "indexed legacy head could not be read",
                             },
-                        };
-                    }
-                    coverage = compareLegacyCoverage(legacy.data, read.envelope.data, {
-                        scope,
-                        entityKeys: LEGACY_SCOPE_ENTITY_KEYS[scope],
-                        projectionOmissions: read.projectionOmissions,
-                        canonicalNewer: allStreamsNewerThan(read, decision.streams, legacyHead.collectedAt),
-                        allowProvenDeletion: read.complete &&
-                            allStreamsProvenAfter(read, decision.streams, legacyHead.collectedAt),
-                        ...input.coverageThresholds,
-                    });
+                        }
+                        : { kind: "file" };
                 }
-                const alreadyCovered = authority.hasCoveredHead(scope, legacyHead);
-                const confirmed = authority.confirmRead(scope, legacyHead, () => sameSelection(decide(scope), decision) &&
-                    receiptCursor(decision, input.declarations) ===
-                        initial.receiptCursor, {
-                    instance: decision.selection.instance,
-                    generation: decision.generation,
-                    writeClock: initial.writeClock,
-                    arrivalRevision: initial.arrivalRevision,
-                    canonicalCursor,
-                    coverage,
-                    cached,
-                });
-                if (!confirmed) {
-                    if (authority.isReset(scope))
-                        return { kind: "file" };
+                if (legacy.scope !== scope) {
                     return {
                         kind: "refused",
                         refusal: {
                             status: "unavailable",
                             reason: "store_inconsistent_read",
-                            detail: "legacy head or canonical cursor changed during parity evaluation",
+                            detail: "indexed legacy head has another scope",
                         },
                     };
                 }
-                if (!coverage.covered) {
-                    // A newer file is an explicit, recorded rollback. A canonical
-                    // regression against the same file must still refuse after takeover.
-                    return alreadyCovered
-                        ? {
-                            kind: "refused",
-                            refusal: {
-                                status: "incomplete",
-                                reason: "canonical_view_incomplete",
-                                diagnostics: [],
-                            },
-                        }
-                        : { kind: "file" };
+                if (scope === "claude.conversations" &&
+                    decision.selection.method === "anthropic-live") {
+                    await retainClaudeProfile(read, legacy);
                 }
-                coveredProjection.set(projectionOwner, {
-                    key: projectionKey,
-                    envelope: read.envelope,
-                    revision: read.revision,
+                coverage = compareLegacyCoverage(legacy.data, read.envelope.data, {
+                    scope,
+                    entityKeys: LEGACY_SCOPE_ENTITY_KEYS[scope],
+                    projectionOmissions: read.projectionOmissions,
+                    canonicalNewer: allStreamsNewerThan(read, decision.streams, legacyHead.collectedAt),
+                    // A partial row is present, only short of detail, so it does not
+                    // weaken the receipts' proof that a missing entity was deleted. A
+                    // dropped row would look deleted, so omissions still block it.
+                    allowProvenDeletion: (decision.selection.method === "oura-browser"
+                        ? OURA_BROWSER_HISTORY_POLICY.allowProvenDeletion
+                        : true) &&
+                        read.diagnostics.omissions.length === 0 &&
+                        (read.diagnostics.unproven?.length ?? 0) === 0 &&
+                        allStreamsProvenAfter(read, decision.streams, legacyHead.collectedAt),
+                    ...input.coverageThresholds,
                 });
-                return {
-                    kind: "canonical",
-                    envelope: read.envelope,
-                    revision: read.revision,
-                };
             }
-            if (!read.complete) {
-                if (legacyHead !== null && !hasTakeover) {
-                    const stillLegacyOwned = authority.readSnapshot(() => canServeLegacyBeforeTakeover(scope));
-                    if (stillLegacyOwned)
-                        return { kind: "file" };
-                }
-                return {
-                    kind: "refused",
-                    refusal: {
-                        status: "incomplete",
-                        reason: "canonical_view_incomplete",
-                        diagnostics: incompleteness(read),
-                    },
-                };
-            }
-            const confirmed = authority.confirmRead(scope, legacyHead, () => sameSelection(decide(scope), decision));
+            const alreadyCovered = authority.hasCoveredHead(scope, legacyHead);
+            const confirmed = authority.confirmRead(scope, legacyHead, () => sameSelection(decide(scope), decision) &&
+                receiptCursor(decision, input.declarations) === initial.receiptCursor, decision.selection.method, {
+                instance: decision.selection.instance,
+                generation: decision.generation,
+                writeClock: initial.writeClock,
+                arrivalRevision: initial.arrivalRevision,
+                canonicalCursor,
+                coverage,
+                cached,
+            });
             if (!confirmed) {
-                const current = authority.readSnapshot(() => ({
-                    canServeLegacy: canServeLegacyBeforeTakeover(scope),
-                    hasTakeover: authority.hasTakeover(scope, decision.selection.instance, decision.generation),
-                }));
-                if (current.canServeLegacy && !current.hasTakeover)
+                if (authority.isReset(scope))
                     return { kind: "file" };
                 return {
                     kind: "refused",
                     refusal: {
                         status: "unavailable",
                         reason: "store_inconsistent_read",
-                        detail: "legacy head or connection selection changed during canonical projection",
+                        detail: "legacy head or canonical cursor changed during parity evaluation",
                     },
                 };
             }
+            if (!coverage.covered) {
+                // A newer file is an explicit, recorded rollback. A canonical
+                // regression against the same file must still refuse after takeover.
+                return alreadyCovered
+                    ? {
+                        kind: "refused",
+                        refusal: {
+                            status: "incomplete",
+                            reason: "canonical_view_incomplete",
+                            diagnostics: [],
+                        },
+                    }
+                    : { kind: "file" };
+            }
+            coveredProjection.set(projectionOwner, {
+                key: projectionKey,
+                envelope: read.envelope,
+                revision: read.revision,
+            });
             return {
                 kind: "canonical",
                 envelope: read.envelope,
                 revision: read.revision,
             };
+        }
+        if (!read.complete) {
+            if (legacyHead !== null && !hasTakeover) {
+                const stillLegacyOwned = authority.readSnapshot(() => canServeLegacyBeforeTakeover(scope));
+                if (stillLegacyOwned)
+                    return { kind: "file" };
+            }
+            return {
+                kind: "refused",
+                refusal: {
+                    status: "incomplete",
+                    reason: "canonical_view_incomplete",
+                    diagnostics: incompleteness(read),
+                },
+            };
+        }
+        const confirmed = authority.confirmRead(scope, legacyHead, () => sameSelection(decide(scope), decision), decision.selection.method);
+        if (!confirmed) {
+            const current = authority.readSnapshot(() => ({
+                canServeLegacy: canServeLegacyBeforeTakeover(scope),
+                hasTakeover: authority.hasTakeover(scope, decision.selection.instance, decision.generation),
+            }));
+            if (current.canServeLegacy && !current.hasTakeover)
+                return { kind: "file" };
+            return {
+                kind: "refused",
+                refusal: {
+                    status: "unavailable",
+                    reason: "store_inconsistent_read",
+                    detail: "legacy head or connection selection changed during canonical projection",
+                },
+            };
+        }
+        return {
+            kind: "canonical",
+            envelope: read.envelope,
+            revision: read.revision,
+        };
+    }
+    return {
+        async readLatest(scope) {
+            const initial = readDecision(scope);
+            const body = await chooseBody(scope, initial);
+            return body.kind === "file"
+                ? { kind: "file", deletion: deletionFor(initial.decision) }
+                : body;
         },
         listingFor,
         listCanonicalScopes(scopePrefix) {
@@ -540,13 +843,34 @@ export function createLegacyScopeView(input) {
             return listed;
         },
         ownsScope(scope) {
-            return authority.readSnapshot(() => decide(scope)).kind !== "file";
+            return authority.readSnapshot(() => ownsScope(scope));
         },
         verdictFor: (scope) => authority.verdictFor(scope),
         resetTakeover: (scope) => authority.resetTakeover(scope),
         isReset: (scope) => authority.isReset(scope),
     };
 }
+/** Initial Oura admission is one completed three-stream run, never a mix of windows. */
+function initialOuraRunComplete(decision) {
+    if (decision.selection.method !== "oura-browser")
+        return true;
+    const binding = decision.records.getInstanceBinding(decision.selection.instance);
+    const listings = decision.records.listStreams([decision.selection.instance]);
+    const receipts = decision.records.listStreamCompletions(decision.selection.instance);
+    let horizon;
+    return OURA_RUN_STREAMS.every((stream) => {
+        const count = listings.find((entry) => entry.stream === stream)?.recordCount ?? 0;
+        const receipt = receipts.find((entry) => entry.stream === stream &&
+            entry.method === binding.method &&
+            entry.generation === binding.generation &&
+            entry.liveCount === count);
+        const time = Date.parse(receipt?.sourceCollectedAt ?? "");
+        if (!Number.isFinite(time))
+            return false;
+        horizon ??= time;
+        return time === horizon;
+    });
+}
 function missingCompletionReceipts(decision) {
     const binding = decision.records.getInstanceBinding(decision.selection.instance);
     const listings = decision.records.listStreams([decision.selection.instance]);
@@ -575,7 +899,9 @@ function isProjectionDataFailure(reason) {
 function receiptCursor(decision, declarations) {
     const receipts = decision.records
         .listStreamCompletions(decision.selection.instance)
-        .filter((receipt) => decision.streams.includes(receipt.stream))
+        .filter((receipt) => (decision.selection.method === "oura-browser"
+        ? OURA_RUN_STREAMS
+        : decision.streams).includes(receipt.stream))
         .map((receipt) => [
         receipt.stream,
         receipt.method,