@ouro.bot/cli 0.1.0-alpha.812 → 0.1.0-alpha.814

package/changelog.json

@@ -1,6 +1,19 @@
 {
   "_note": "This changelog is maintained as part of the PR/version-bump workflow. Agent-curated, not auto-generated. Agents read this file directly via read_file to understand what changed between versions.",
   "versions": [
+    {
+      "version": "0.1.0-alpha.814",
+      "changes": [
+        "Preserve native session history and delivery references while keeping model context and active outputs bounded.",
+        "Keep precommitted ingress validation strict when loading effective projections."
+      ]
+    },
+    {
+      "version": "0.1.0-alpha.813",
+      "changes": [
+        "Unrelated logs no longer block Sanctuary containment checks; identity and authenticated audit safeguards remain intact."
+      ]
+    },
     {
       "version": "0.1.0-alpha.812",
       "changes": [

package/deploy/unraid/sanctuary.ouro/bundle-meta.json

@@ -1,5 +1,5 @@
 {
-  "runtimeVersion": "0.1.0-alpha.812",
+  "runtimeVersion": "0.1.0-alpha.814",
   "bundleSchemaVersion": 3,
   "lastUpdated": "2026-09-03T00:00:00.000Z"
 }

package/deploy/unraid/sanctuary.xml

@@ -1,7 +1,7 @@
 <?xml version="1.0"?>
 <Container version="2">
   <Name>ouro-butler</Name>
-  <Repository>ghcr.io/ourostack/ouroboros-butler:0.1.0-alpha.812</Repository>
+  <Repository>ghcr.io/ourostack/ouroboros-butler:0.1.0-alpha.814</Repository>
   <Registry>https://github.com/ourostack/ouroboros/pkgs/container/ouroboros-butler</Registry>
   <Network>host</Network>
   <Shell>sh</Shell>

package/dist/heart/core.js

@@ -1336,14 +1336,16 @@ async function runAgent(messages, callbacks, channel, signal, options) {
                     contextWindowTokens: (0, config_1.getContextConfig)().maxTokens,
                 };
                 const canonicalBudget = (0, prompt_budget_1.applyPromptBudget)({ ...budgetOptions, messages });
-                if (canonicalBudget.status !== "within_budget") {
-                    messages.splice(0, messages.length, ...canonicalBudget.messages);
-                }
-                // Preserve canonical evidence object identity while freezing the array
-                // and the one attempt's private control/scratch across operational retries.
-                const attemptMessages = rejectedAttempt.length > 0
-                    ? [...(0, prompt_budget_1.applyPromptBudget)({ ...budgetOptions, messages: [...messages, ...rejectedAttempt, ...nextAttemptControls] }).messages]
-                    : [...messages];
+                const currentUserMessage = budgetOptions.requiredPromptEvidence?.currentUserMessage
+                    ?? canonicalBudget.messages.findLast((message) => message.role === "user");
+                // Keep retry controls attached to the genuine request, not to canonical history.
+                let attemptMessages = rejectedAttempt.length > 0
+                    ? [...(0, prompt_budget_1.applyPromptBudget)({
+                            ...budgetOptions,
+                            requiredPromptEvidence: budgetOptions.requiredPromptEvidence ?? (currentUserMessage ? { currentUserMessage } : undefined),
+                            messages: [...canonicalBudget.messages, ...rejectedAttempt, ...nextAttemptControls],
+                        }).messages]
+                    : [...canonicalBudget.messages];
                 if (rejectedAttempt.length > 0 || canonicalBudget.status !== "within_budget")
                     providerRuntime.resetTurnState(attemptMessages);
                 const turnCallbackBufferRef = { current: null };
@@ -1384,20 +1386,22 @@ async function runAgent(messages, callbacks, channel, signal, options) {
                             throw error;
                         if (isContextOverflow(error) && !overflowRetried) {
                             overflowRetried = true;
-                            const overflowMessages = messages.map((message) => message.role === "assistant" ? { ...message } : message);
+                            const protectedStart = currentUserMessage ? Math.max(0, attemptMessages.indexOf(currentUserMessage)) : 0;
+                            const currentAttempt = attemptMessages.slice(protectedStart);
+                            const overflowMessages = attemptMessages.slice(0, protectedStart).map((message) => message.role === "assistant" ? { ...message } : message);
                             stripLastToolCalls(overflowMessages);
+                            overflowMessages.push(...currentAttempt);
                             const { maxTokens, contextMargin } = (0, config_1.getContextConfig)();
                             const trimmed = (0, context_1.trimMessages)(overflowMessages, maxTokens, contextMargin, maxTokens * 2);
                             const requiredEvidence = options?.requiredPromptEvidence;
                             const requiredMessages = new Set([
                                 ...(requiredEvidence?.verifiedPredecessorMessage ? [requiredEvidence.verifiedPredecessorMessage] : []),
-                                ...(requiredEvidence?.currentUserMessage ? [requiredEvidence.currentUserMessage] : []),
+                                ...currentAttempt,
                             ]);
                             const trimmedMessages = new Set(trimmed);
-                            const overflowRetryMessages = requiredMessages.size === 0
+                            attemptMessages = requiredMessages.size === 0
                                 ? trimmed
                                 : overflowMessages.filter((message) => trimmedMessages.has(message) || requiredMessages.has(message));
-                            messages.splice(0, messages.length, ...overflowRetryMessages);
                             providerRuntime.resetTurnState(attemptMessages);
                             callbacks.onError(new Error("context trimmed, retrying..."), "transient");
                             return callProviderTurn();

package/dist/heart/daemon/sanctuary-acceptance-adapter.js

@@ -1372,59 +1372,62 @@ async function readDefaultSanctuaryScenarioFacts(label, scenarioHandleDigest, de
                 throw new Error("Telegram approval evidence MAC is invalid");
             }
         }
-        const expectedSubject = (0, telegram_1.opaqueTelegramSubject)(identityKey, credentials.botToken, credentials.authorizedUserId, credentials.authorizedChatId);
-        const observedSubjects = auditEntries.flatMap((entry) => typeof entry.meta.subject === "string" ? [entry.meta.subject] : []);
-        const approvalSubjects = approvalRecords.map((projection) => projection.approval).filter((record) => record.transport === "telegram").map((record) => record.requesterId);
-        const rawValues = [...new Set([credentials.botToken, credentials.authorizedUserId, credentials.authorizedChatId])];
-        const persistedIdentitySurfaces = readBoundedIdentitySurfaces(agentRoot);
-        const surfacePairs = Array.from({ length: Math.floor(persistedIdentitySurfaces.length / 2) }, (_, index) => ({
-            relativePath: persistedIdentitySurfaces[index * 2],
-            raw: persistedIdentitySurfaces[index * 2 + 1],
-        }));
-        const canonicalSessionPath = path.join("state", "sessions", `telegram-user:${expectedSubject}`, "telegram", `telegram_${expectedSubject}.json`);
-        const canonicalSessionCount = surfacePairs.filter(({ relativePath, raw }) => {
-            if (relativePath !== canonicalSessionPath)
-                return false;
-            object(JSON.parse(raw), "canonical Telegram session");
-            return true;
-        }).length;
-        const sessionSurfaceDigest = (0, node_crypto_1.createHash)("sha256").update(JSON.stringify(surfacePairs.filter(({ relativePath }) => relativePath === path.join("state", "senses", "telegram", "identity-subjects.json")
-            || relativePath.startsWith(`state${path.sep}sessions${path.sep}`)
-            || relativePath.startsWith(`state${path.sep}pending${path.sep}`)
-            || relativePath.startsWith(`state${path.sep}pending-returns${path.sep}`)))).digest("hex");
-        const friendSurfaceDigest = (0, node_crypto_1.createHash)("sha256").update(JSON.stringify(surfacePairs.filter(({ relativePath }) => relativePath.startsWith(`friends${path.sep}`)))).digest("hex");
-        const canonicalFriendCount = surfacePairs.reduce((count, { relativePath, raw }) => {
-            if (!relativePath.startsWith(`friends${path.sep}`) || !relativePath.endsWith(".json"))
-                return count;
-            const record = object(JSON.parse(raw), "Telegram Friend identity");
-            if (!Array.isArray(record.externalIds))
-                return count;
-            return count + record.externalIds.filter((value) => {
-                const identity = object(value, "Telegram Friend external identity");
-                return identity.provider === "telegram-user" && identity.externalId === expectedSubject;
+        // Unknown admission needs the same surfaces for its zero-work digest.
+        if (sanctuary_acceptance_harness_1.SANCTUARY_SCENARIO_SOURCES[label].includes("identity-surface-audit") || label === "unit-16d-2-unknown-admission") {
+            const expectedSubject = (0, telegram_1.opaqueTelegramSubject)(identityKey, credentials.botToken, credentials.authorizedUserId, credentials.authorizedChatId);
+            const observedSubjects = auditEntries.flatMap((entry) => typeof entry.meta.subject === "string" ? [entry.meta.subject] : []);
+            const approvalSubjects = approvalRecords.map((projection) => projection.approval).filter((record) => record.transport === "telegram").map((record) => record.requesterId);
+            const rawValues = [...new Set([credentials.botToken, credentials.authorizedUserId, credentials.authorizedChatId])];
+            const persistedIdentitySurfaces = readBoundedIdentitySurfaces(agentRoot);
+            const surfacePairs = Array.from({ length: Math.floor(persistedIdentitySurfaces.length / 2) }, (_, index) => ({
+                relativePath: persistedIdentitySurfaces[index * 2],
+                raw: persistedIdentitySurfaces[index * 2 + 1],
+            }));
+            const canonicalSessionPath = path.join("state", "sessions", `telegram-user:${expectedSubject}`, "telegram", `telegram_${expectedSubject}.json`);
+            const canonicalSessionCount = surfacePairs.filter(({ relativePath, raw }) => {
+                if (relativePath !== canonicalSessionPath)
+                    return false;
+                object(JSON.parse(raw), "canonical Telegram session");
+                return true;
             }).length;
-        }, 0);
-        const surfaceRecords = [...persistedIdentitySurfaces, auditRaw ?? "", auditHeadRaw ?? "", JSON.stringify(approvalRecords)];
-        const surfaceSubjects = surfaceRecords.flatMap((raw) => raw.match(/tg_[A-Za-z0-9_-]{43}/gu) ?? []);
-        const structuredRawId = /"(?:authorizedUserId|authorizedChatId|transportUserId|transportChatId|userId|chatId|updateId|messageId)"\s*:\s*"?\d{1,20}"?/gu;
-        const rawLeakCount = surfaceRecords.reduce((count, raw) => count + rawValues.filter((value) => raw.includes(value)).length + (raw.match(structuredRawId)?.length ?? 0), 0);
-        const mismatchCount = [...surfaceSubjects, ...observedSubjects, ...approvalSubjects].filter((subject) => subject !== expectedSubject).length;
-        identity = {
-            keyPresent: true,
-            subjectOpaque: /^tg_[A-Za-z0-9_-]{43}$/u.test(expectedSubject)
-                && mismatchCount === 0,
-            rawIdentityAbsent: rawLeakCount === 0,
-            liveSubjectObserved: observedSubjects.includes(expectedSubject) && telegramTurns.some((turn) => turn.status === "success"),
-            inspectedRecordCount: surfaceRecords.length,
-            opaqueSubjectCount: [...surfaceSubjects, ...observedSubjects, ...approvalSubjects].filter((subject) => subject === expectedSubject).length,
-            mismatchCount,
-            rawLeakCount,
-            canonicalSessionCount,
-            canonicalFriendCount,
-            sessionSurfaceDigest,
-            friendSurfaceDigest,
-            surfaceDigest: (0, node_crypto_1.createHash)("sha256").update(JSON.stringify(surfaceRecords)).digest("hex"),
-        };
+            const sessionSurfaceDigest = (0, node_crypto_1.createHash)("sha256").update(JSON.stringify(surfacePairs.filter(({ relativePath }) => relativePath === path.join("state", "senses", "telegram", "identity-subjects.json")
+                || relativePath.startsWith(`state${path.sep}sessions${path.sep}`)
+                || relativePath.startsWith(`state${path.sep}pending${path.sep}`)
+                || relativePath.startsWith(`state${path.sep}pending-returns${path.sep}`)))).digest("hex");
+            const friendSurfaceDigest = (0, node_crypto_1.createHash)("sha256").update(JSON.stringify(surfacePairs.filter(({ relativePath }) => relativePath.startsWith(`friends${path.sep}`)))).digest("hex");
+            const canonicalFriendCount = surfacePairs.reduce((count, { relativePath, raw }) => {
+                if (!relativePath.startsWith(`friends${path.sep}`) || !relativePath.endsWith(".json"))
+                    return count;
+                const record = object(JSON.parse(raw), "Telegram Friend identity");
+                if (!Array.isArray(record.externalIds))
+                    return count;
+                return count + record.externalIds.filter((value) => {
+                    const identity = object(value, "Telegram Friend external identity");
+                    return identity.provider === "telegram-user" && identity.externalId === expectedSubject;
+                }).length;
+            }, 0);
+            const surfaceRecords = [...persistedIdentitySurfaces, auditRaw ?? "", auditHeadRaw ?? "", JSON.stringify(approvalRecords)];
+            const surfaceSubjects = surfaceRecords.flatMap((raw) => raw.match(/tg_[A-Za-z0-9_-]{43}/gu) ?? []);
+            const structuredRawId = /"(?:authorizedUserId|authorizedChatId|transportUserId|transportChatId|userId|chatId|updateId|messageId)"\s*:\s*"?\d{1,20}"?/gu;
+            const rawLeakCount = surfaceRecords.reduce((count, raw) => count + rawValues.filter((value) => raw.includes(value)).length + (raw.match(structuredRawId)?.length ?? 0), 0);
+            const mismatchCount = [...surfaceSubjects, ...observedSubjects, ...approvalSubjects].filter((subject) => subject !== expectedSubject).length;
+            identity = {
+                keyPresent: true,
+                subjectOpaque: /^tg_[A-Za-z0-9_-]{43}$/u.test(expectedSubject)
+                    && mismatchCount === 0,
+                rawIdentityAbsent: rawLeakCount === 0,
+                liveSubjectObserved: observedSubjects.includes(expectedSubject) && telegramTurns.some((turn) => turn.status === "success"),
+                inspectedRecordCount: surfaceRecords.length,
+                opaqueSubjectCount: [...surfaceSubjects, ...observedSubjects, ...approvalSubjects].filter((subject) => subject === expectedSubject).length,
+                mismatchCount,
+                rawLeakCount,
+                canonicalSessionCount,
+                canonicalFriendCount,
+                sessionSurfaceDigest,
+                friendSurfaceDigest,
+                surfaceDigest: (0, node_crypto_1.createHash)("sha256").update(JSON.stringify(surfaceRecords)).digest("hex"),
+            };
+        }
     }
     const container = options.skipContainerSnapshot === true
         ? null

package/dist/heart/session-events.js

@@ -239,6 +239,13 @@ function removeApprovalSuspensionCheckpoint(envelope, approvalId) {
     });
     return { ...envelope, approvalSuspensions };
 }
+// Native origins survive replay normalization, but never enter serialized provider or session data.
+const messageSourceEventIds = Symbol("messageSourceEventIds");
+function withMessageSourceEventIds(message, eventIds) {
+    if (eventIds)
+        Object.defineProperty(message, messageSourceEventIds, { value: eventIds });
+    return message;
+}
 exports.EVENT_CONTENT_MAX_CHARS = 256 * 1024;
 function truncateLargeEventContent(content, maxChars) {
     if (typeof content !== "string") {
@@ -383,6 +390,7 @@ function normalizeMessage(message) {
     const record = message;
     const role = normalizeRole(record.role);
     const normalizedContent = sanitizeConversationContent(role, normalizeContent(record.content));
+    const sourceEventIds = message[messageSourceEventIds];
     if (role === "assistant") {
         return {
             role,
@@ -391,6 +399,7 @@ function normalizeMessage(message) {
             toolCallId: null,
             toolCalls: normalizeToolCalls(record.tool_calls),
             hadToolCallsField: Array.isArray(record.tool_calls),
+            sourceEventIds,
         };
     }
     if (role === "tool") {
@@ -401,6 +410,7 @@ function normalizeMessage(message) {
             toolCallId: typeof record.tool_call_id === "string" ? record.tool_call_id : null,
             toolCalls: [],
             hadToolCallsField: false,
+            sourceEventIds,
         };
     }
     return {
@@ -410,6 +420,7 @@ function normalizeMessage(message) {
         toolCallId: null,
         toolCalls: [],
         hadToolCallsField: false,
+        sourceEventIds,
     };
 }
 function contentText(content) {
@@ -442,33 +453,38 @@ function toProviderMessage(message) {
                 },
             }));
         }
-        return assistant;
+        return withMessageSourceEventIds(assistant, message.sourceEventIds);
     }
     if (message.role === "tool") {
-        return {
+        return withMessageSourceEventIds({
             role: "tool",
             content: typeof message.content === "string" ? message.content : contentText(message.content),
             tool_call_id: message.toolCallId ?? "",
-        };
+        }, message.sourceEventIds);
     }
     if (message.role === "system") {
-        return {
+        return withMessageSourceEventIds({
             role: "system",
             content: typeof message.content === "string" ? message.content : contentText(message.content),
             ...(message.name ? { name: message.name } : {}),
-        };
+        }, message.sourceEventIds);
     }
-    return {
+    return withMessageSourceEventIds({
         role: "user",
         content: (typeof message.content === "string" || Array.isArray(message.content) ? message.content : ""),
         ...(message.name ? { name: message.name } : {}),
-    };
+    }, message.sourceEventIds);
+}
+function messageSourcesAgree(left, right) {
+    const leftIds = left[messageSourceEventIds];
+    const rightIds = right[messageSourceEventIds];
+    return !leftIds || !rightIds || leftIds.length === rightIds.length && leftIds.every((id, index) => id === rightIds[index]);
 }
-function messageFingerprint(message) {
+function messageFingerprint(message, captureContent = false) {
     const normalized = normalizeMessage(message);
     return JSON.stringify({
         role: normalized.role,
-        content: normalized.content,
+        content: captureContent ? truncateLargeEventContent(normalized.content, exports.EVENT_CONTENT_MAX_CHARS).content : normalized.content,
         name: normalized.name,
         tool_call_id: normalized.toolCallId,
         tool_calls: normalized.toolCalls,
@@ -582,6 +598,8 @@ function repairSessionMessages(messages) {
         if (msg.role === "assistant" && result.length > 0) {
             const prev = result[result.length - 1];
             if (prev.role === "assistant" && prev.toolCalls.length === 0) {
+                if (prev.sourceEventIds)
+                    prev.sourceEventIds = [...new Set([...prev.sourceEventIds, ...(msg.sourceEventIds ?? [])])];
                 const prevContent = contentText(prev.content);
                 const curContent = contentText(msg.content);
                 // Drop the second of two consecutive assistants when the content is
@@ -805,7 +823,7 @@ function repairInlineReasoningOnReplay(messages, inlineReasoningStrippedCallIds)
         repaired++;
         for (const tc of a.tool_calls)
             inlineReasoningStrippedCallIds.add(tc.id);
-        return { ...a, content: stripped.length > 0 ? stripped : null };
+        return withMessageSourceEventIds({ ...a, content: stripped.length > 0 ? stripped : null }, msg[messageSourceEventIds]);
     });
     if (repaired > 0) {
         (0, runtime_1.emitNervesEvent)({
@@ -949,27 +967,30 @@ function buildEventFromMessage(message, sequence, recordedAt, captureKind, sourc
     };
 }
 function projectedSessionEventIds(envelope) {
-    return envelope.projection.eventIds.length > 0
-        ? envelope.projection.eventIds
-        : envelope.events.map((event) => event.id);
+    return providerProjectionEvents(envelope).map((event) => event.id);
 }
 function providerProjectionEvents(envelope) {
-    const eventIds = projectedSessionEventIds(envelope);
-    const byId = new Map(selectEffectiveSessionEvents(envelope.events).map((event) => [event.id, event]));
-    return eventIds
+    const events = selectEffectiveSessionEvents(envelope.events);
+    if (envelope.projection.eventIds.length === 0)
+        return envelope.projection.trimmed ? [] : events;
+    const byId = new Map(events.map((event) => [event.id, event]));
+    return envelope.projection.eventIds
         .map((id) => byId.get(id))
         .filter((event) => Boolean(event));
 }
-function projectProviderMessages(envelope) {
-    return providerProjectionEvents(envelope)
-        .map((event) => toProviderMessage({
+function providerMessageFromEvent(event) {
+    return toProviderMessage({
         role: event.role,
         content: event.content,
         name: event.name,
         toolCallId: event.toolCallId,
         toolCalls: event.toolCalls,
         hadToolCallsField: event.toolCalls.length > 0,
-    }));
+        sourceEventIds: [event.id],
+    });
+}
+function projectProviderMessages(envelope) {
+    return providerProjectionEvents(envelope).map(providerMessageFromEvent);
 }
 /**
  * Annotate user and assistant messages with a relative time offset tag.
@@ -1262,7 +1283,7 @@ function parseSessionEnvelope(raw, options = {}) {
     // still resolves predictably.
     const events = dedupeEventsByIdLastWins(rawEvents);
     const projection = record.projection;
-    return {
+    const envelope = {
         version: 2,
         events,
         projection: {
@@ -1273,11 +1294,12 @@ function parseSessionEnvelope(raw, options = {}) {
             inputTokens: typeof projection.inputTokens === "number" ? projection.inputTokens : null,
             projectedAt: typeof projection.projectedAt === "string" ? projection.projectedAt : null,
         },
-        structuredOutputs: (0, structured_output_1.extractStructuredOutputsFromEvents)(selectEffectiveSessionEvents(events), { emitTelemetry: false }),
         lastUsage: normalizeUsage(record.lastUsage),
         state: normalizeContinuityState(record.state),
         approvalSuspensions: normalizeApprovalSuspensions(record.approvalSuspensions),
     };
+    envelope.structuredOutputs = (0, structured_output_1.extractStructuredOutputsFromEvents)(providerProjectionEvents(envelope), { emitTelemetry: false });
+    return envelope;
 }
 function loadSessionEnvelopeFile(filePath) {
     try {
@@ -1310,12 +1332,14 @@ function filterNonSystem(messages) {
  * System messages (whose content changes every turn due to live world-state)
  * are excluded so that prefix matching is not defeated by system prompt updates.
  */
-function findCommonPrefixLength(a, b) {
+function findCommonPrefixLength(a, b, captureContent = false) {
     const aNonSys = filterNonSystem(a);
     const bNonSys = filterNonSystem(b);
     const max = Math.min(aNonSys.length, bNonSys.length);
     for (let i = 0; i < max; i++) {
-        if (messageFingerprint(aNonSys[i]) !== messageFingerprint(bNonSys[i]))
+        if (!messageSourcesAgree(aNonSys[i], bNonSys[i]))
+            return i;
+        if (messageFingerprint(aNonSys[i], captureContent) !== messageFingerprint(bNonSys[i], captureContent))
             return i;
     }
     return max;
@@ -1324,101 +1348,139 @@ function selectProjectedEventIds(currentMessages, currentEventIds, trimmedMessag
     if (trimmedMessages.length === 0)
         return [];
     const result = [];
+    const currentIdentities = new Set(currentMessages);
     let needle = 0;
     let trimmedFingerprint = null;
     for (let i = 0; i < currentMessages.length && needle < trimmedMessages.length; i++) {
         const currentMessage = currentMessages[i];
         const trimmedMessage = trimmedMessages[needle];
         if (currentMessage !== trimmedMessage) {
+            if (currentIdentities.has(trimmedMessage))
+                continue;
+            if (!messageSourcesAgree(currentMessage, trimmedMessage))
+                continue;
             trimmedFingerprint ??= messageFingerprint(trimmedMessage);
             if (messageFingerprint(currentMessage) !== trimmedFingerprint)
                 continue;
         }
-        result.push(currentEventIds[i]);
+        result.push(...currentEventIds[i]);
         needle++;
         trimmedFingerprint = null;
     }
     return result;
 }
+function retainedSourceEventIds(message, existing, used) {
+    const ids = message[messageSourceEventIds];
+    if (!ids?.length || ids.some((id) => !existing.has(id) || used.has(id)))
+        return null;
+    const originals = ids.map((id) => providerMessageFromEvent(existing.get(id)));
+    const fingerprint = messageFingerprint(message, true);
+    const matches = (candidate) => (candidate[messageSourceEventIds] !== undefined
+        && messageSourcesAgree(candidate, message)
+        && messageFingerprint(candidate, true) === fingerprint);
+    return originals.some(matches) || sanitizeProviderMessages(originals).some(matches) ? ids : null;
+}
 function buildCanonicalSessionEnvelope(options) {
     const existing = options.existing;
     // Callers pass pre-sanitized messages + pre-captured ingress times.
     const currentIngressTimes = options.currentIngressTimes ?? options.currentMessages.map(getIngressTime);
     const currentIngressRelations = options.currentIngressRelations ?? options.currentMessages.map(getIngressRelations);
-    const previousMessages = options.previousMessages;
+    let previousMessages = options.previousMessages;
     const currentMessages = options.currentMessages;
     const trimmedMessages = options.trimmedMessages;
-    const previousProjectionIds = existing ? providerProjectionEvents(existing).map((event) => event.id) : [];
+    let previousProjectionGroups = existing ? providerProjectionEvents(existing).map((event) => [event.id]) : [];
     // Compare only non-system messages to find the common prefix.
     // System messages change every turn (live world-state in system prompt)
     // and must not defeat prefix matching of the actual conversation.
-    const nonSystemPrefix = findCommonPrefixLength(previousMessages, currentMessages);
+    let nonSystemPrefix = findCommonPrefixLength(previousMessages, currentMessages, true);
+    // A repaired provider message can represent several original native records.
+    const repairedPrevious = sanitizeProviderMessages(previousMessages.map((message, index) => withMessageSourceEventIds({ ...message }, previousProjectionGroups[index])));
+    const repairedPrefix = findCommonPrefixLength(repairedPrevious, currentMessages);
+    if (repairedPrefix > nonSystemPrefix) {
+        previousMessages = repairedPrevious;
+        previousProjectionGroups = repairedPrevious.map((message) => message[messageSourceEventIds] ?? []);
+        nonSystemPrefix = repairedPrefix;
+    }
     // Build a lookup of non-system previous projection IDs.
     const prevNonSystemIds = [];
     for (let i = 0; i < previousMessages.length; i++) {
         if (messageRole(previousMessages[i]) !== "system") {
-            prevNonSystemIds.push(previousProjectionIds[i]);
+            prevNonSystemIds.push(previousProjectionGroups[i]);
         }
     }
     // Walk currentMessages and build currentEventIds + new events.
     // Non-system messages within the prefix reuse old event IDs.
-    // System messages and post-prefix messages get new events.
+    // Other messages reuse a matching native origin or create a new event.
     const events = [...(existing?.events ?? [])];
+    const sourceEvents = new Map(selectEffectiveSessionEvents(events).map((event) => [event.id, event]));
+    const excludedSourceIds = new Set(events.filter((event) => !sourceEvents.has(event.id)).map((event) => event.id));
+    const usedEventIds = new Set();
     const currentEventIds = [];
     let nonSystemSeen = 0;
     for (let i = 0; i < currentMessages.length; i++) {
+        const sourceIds = currentMessages[i][messageSourceEventIds];
+        if (sourceIds?.some((id) => excludedSourceIds.has(id))) {
+            throw new Error("cannot persist messages derived from redacted session events");
+        }
         const role = messageRole(currentMessages[i]);
         const isSystem = role === "system";
         const inPrefix = !isSystem && nonSystemSeen < nonSystemPrefix;
-        if (inPrefix) {
+        if (inPrefix && prevNonSystemIds[nonSystemSeen].every((id) => !usedEventIds.has(id))) {
             // Reuse existing event ID for this matched non-system message
             currentEventIds.push(prevNonSystemIds[nonSystemSeen]);
             nonSystemSeen++;
         }
         else if (isSystem && i < previousMessages.length
             && messageRole(previousMessages[i]) === "system"
-            && messageFingerprint(currentMessages[i]) === messageFingerprint(previousMessages[i])) {
+            && messageSourcesAgree(currentMessages[i], previousMessages[i])
+            && previousProjectionGroups[i].every((id) => !usedEventIds.has(id))
+            && messageFingerprint(currentMessages[i], true) === messageFingerprint(previousMessages[i], true)) {
             // System message at same position with identical content -- reuse event ID
-            currentEventIds.push(previousProjectionIds[i]);
+            currentEventIds.push(previousProjectionGroups[i]);
         }
         else {
             if (!isSystem)
                 nonSystemSeen++;
+            const retainedIds = retainedSourceEventIds(currentMessages[i], sourceEvents, usedEventIds);
+            if (retainedIds) {
+                currentEventIds.push(retainedIds);
+                for (const id of retainedIds)
+                    usedEventIds.add(id);
+                continue;
+            }
             // Create a new event. Use nextEventSequence(events) instead of
             // `events.length + 1` so that any gap (from pruning, archive replay,
             // or self-heal dedup) cannot collide with an existing id.
             const event = buildEventFromMessage(currentMessages[i], nextEventSequence(events), options.recordedAt, "live", null, null, currentIngressTimes[i], currentIngressRelations[i]);
             events.push(event);
-            currentEventIds.push(event.id);
+            currentEventIds.push([event.id]);
         }
+        for (const id of currentEventIds.at(-1))
+            usedEventIds.add(id);
     }
     const projectionEventIds = selectProjectedEventIds(currentMessages, currentEventIds, trimmedMessages);
-    // Prune events: only keep events whose IDs are in the projection.
-    // Events not in projection are returned as evicted for archiving.
+    // Projection omissions are not authority to delete native history.
     const projectionIdSet = new Set(projectionEventIds);
-    const effectiveIds = new Set(selectEffectiveSessionEvents(events).map((event) => event.id));
-    const keep = (event) => projectionIdSet.has(event.id) || !effectiveIds.has(event.id);
-    const prunedEvents = events.filter(keep);
-    const evictedEvents = events.filter((event) => !keep(event));
-    return {
-        envelope: {
-            version: 2,
-            events: prunedEvents,
-            projection: {
-                eventIds: projectionEventIds.filter((id) => effectiveIds.has(id)),
-                trimmed: projectionEventIds.length < currentEventIds.length,
-                maxTokens: options.projectionBasis.maxTokens,
-                contextMargin: options.projectionBasis.contextMargin,
-                inputTokens: options.projectionBasis.inputTokens,
-                projectedAt: options.recordedAt,
-            },
-            structuredOutputs: (0, structured_output_1.extractStructuredOutputsFromEvents)(selectEffectiveSessionEvents(prunedEvents)),
-            lastUsage: normalizeUsage(options.lastUsage),
-            state: normalizeContinuityState(options.state),
-            approvalSuspensions: structuredClone(options.existing?.approvalSuspensions ?? []),
+    const effectiveEvents = selectEffectiveSessionEvents(events);
+    const effectiveIds = new Set(effectiveEvents.map((event) => event.id));
+    const evictedEvents = effectiveEvents.filter((event) => !projectionIdSet.has(event.id));
+    const envelope = {
+        version: 2,
+        events,
+        projection: {
+            eventIds: projectionEventIds.filter((id) => effectiveIds.has(id)),
+            trimmed: evictedEvents.length > 0,
+            maxTokens: options.projectionBasis.maxTokens,
+            contextMargin: options.projectionBasis.contextMargin,
+            inputTokens: options.projectionBasis.inputTokens,
+            projectedAt: options.recordedAt,
         },
-        evictedEvents,
+        lastUsage: normalizeUsage(options.lastUsage),
+        state: normalizeContinuityState(options.state),
+        approvalSuspensions: structuredClone(options.existing?.approvalSuspensions ?? []),
     };
+    envelope.structuredOutputs = (0, structured_output_1.extractStructuredOutputsFromEvents)(providerProjectionEvents(envelope));
+    return { envelope, evictedEvents };
 }
 function appendSyntheticAssistantEvent(envelope, content, recordedAt) {
     // Use nextEventSequence(events) instead of `events.length + 1` so any gap
@@ -1426,15 +1488,17 @@ function appendSyntheticAssistantEvent(envelope, content, recordedAt) {
     // an existing event id. Same fix pattern as line 1046.
     const sequence = nextEventSequence(envelope.events);
     const event = buildEventFromMessage({ role: "assistant", content }, sequence, recordedAt, "synthetic", null, null);
-    return {
+    const priorIds = projectedSessionEventIds(envelope);
+    const updated = {
         ...envelope,
         events: [...envelope.events, event],
-        structuredOutputs: (0, structured_output_1.extractStructuredOutputsFromEvents)(selectEffectiveSessionEvents([...envelope.events, event])),
         projection: {
             ...envelope.projection,
-            eventIds: [...envelope.projection.eventIds, event.id],
+            eventIds: [...priorIds, event.id],
             projectedAt: recordedAt,
-            trimmed: false,
+            trimmed: new Set(priorIds).size < selectEffectiveSessionEvents(envelope.events).length,
         },
     };
+    updated.structuredOutputs = (0, structured_output_1.extractStructuredOutputsFromEvents)(providerProjectionEvents(updated));
+    return updated;
 }