@playola-radio/slipstream 0.1.0

package/dist/questions.js

@@ -0,0 +1,167 @@
+import { constants } from 'node:fs';
+import { open } from 'node:fs/promises';
+import { createHash } from 'node:crypto';
+import { openLogCursor } from "./log-reader.js";
+import { blobPath } from "./store-reader.js";
+import { sourceFor } from "./event.js";
+export const QUESTION_TTL_MS = 1_800_000;
+export const QUESTION_LIMIT = 16;
+export const MAX_SOURCE_BYTES = 1024 * 1024;
+export const MAX_ANSWER_BYTES = 16 * 1024;
+export const UUID = /^[0-9a-f]{8}-[0-9a-f]{4}-[1-8][0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12}$/;
+export class QuestionError extends Error {
+    code;
+    constructor(code, message) {
+        super(message);
+        this.code = code;
+        this.name = 'QuestionError';
+    }
+}
+function invalidContext(message) { throw new QuestionError('INVALID_CONTEXT', message); }
+function record(value) {
+    return typeof value === 'object' && value !== null && !Array.isArray(value) ? value : {};
+}
+function validRange(start, end) {
+    return Number.isSafeInteger(start) && Number.isSafeInteger(end)
+        && start >= 1 && end >= start && end - start < 200;
+}
+/** Copy only contract fields: caller mutation and unknown fields cannot retarget a request. */
+export function normalizeAsk(value) {
+    const req = record(value);
+    if (typeof req.session_id !== 'string' || !UUID.test(req.session_id)
+        || typeof req.request_id !== 'string' || !UUID.test(req.request_id)) {
+        throw new QuestionError('PROTOCOL', 'ask requires canonical lowercase session_id and request_id UUIDs');
+    }
+    if (typeof req.text !== 'string' || /[\uD800-\uDFFF]/u.test(req.text))
+        throw new QuestionError('INVALID_QUESTION', 'question text is required');
+    const text = req.text.trim();
+    if (Buffer.byteLength(text) < 1 || Buffer.byteLength(text) > 8192) {
+        throw new QuestionError('INVALID_QUESTION', 'question must contain 1–8192 UTF-8 bytes after trimming');
+    }
+    const ctx = record(req.context);
+    if (typeof ctx.change_seq !== 'string' || !/^[1-9][0-9]*$/.test(ctx.change_seq))
+        invalidContext('change_seq must be a canonical positive decimal string');
+    if (typeof ctx.path !== 'string' || Buffer.byteLength(ctx.path) < 1 || Buffer.byteLength(ctx.path) > 4096
+        || /[\uD800-\uDFFF]/u.test(ctx.path))
+        invalidContext('context path must be a relative source path of at most 4096 UTF-8 bytes');
+    if (typeof ctx.snapshot_sha256 !== 'string' || !/^[0-9a-f]{64}$/.test(ctx.snapshot_sha256))
+        invalidContext('snapshot_sha256 must be a lowercase SHA-256');
+    if (!validRange(ctx.line_start, ctx.line_end))
+        invalidContext('select 1–200 source lines using inclusive positive integer bounds');
+    const reply = req.reply_to_question_id;
+    if (reply !== undefined && (typeof reply !== 'string' || !UUID.test(reply)))
+        invalidContext('reply_to_question_id must be a canonical lowercase UUID');
+    return { session_id: req.session_id, request_id: req.request_id, text, context: {
+            change_seq: ctx.change_seq, path: ctx.path, snapshot_sha256: ctx.snapshot_sha256,
+            line_start: ctx.line_start, line_end: ctx.line_end,
+        }, ...(reply !== undefined ? { reply_to_question_id: reply } : {}) };
+}
+/** Fixed-order normalized request body; identity excludes derived text and target. */
+export function questionBody(req) {
+    const c = req.context;
+    return JSON.stringify([req.text, c.change_seq, c.path, c.snapshot_sha256, c.line_start, c.line_end, req.reply_to_question_id ?? null]);
+}
+export function selectSource(bytes, range) {
+    if (bytes.includes(0))
+        invalidContext('source contains NUL');
+    let text;
+    try {
+        text = new TextDecoder('utf-8', { fatal: true, ignoreBOM: true }).decode(bytes);
+    }
+    catch {
+        return invalidContext('source is not valid UTF-8');
+    }
+    const lines = text === '' ? [] : text.split('\n');
+    if (text.endsWith('\n'))
+        lines.pop();
+    if (range.line_end > lines.length)
+        invalidContext('line range does not exist in the recorded snapshot');
+    const selected = lines.slice(range.line_start - 1, range.line_end).join('\n');
+    if (Buffer.byteLength(selected) > 16384)
+        invalidContext('selected source exceeds 16384 UTF-8 bytes');
+    return selected;
+}
+/** Finite committed-log lookup and an actually bounded CAS read. Never reads the worktree. */
+export async function readQuestionContext(input) {
+    const { context, sessionId } = input;
+    const seq = BigInt(context.change_seq);
+    if (seq > input.boundary)
+        invalidContext('change is not in the durable prefix');
+    let snapshot;
+    try {
+        const cursor = await openLogCursor(input.logPath, seq - 1n);
+        try {
+            const events = await cursor.readThrough(seq);
+            const event = events[0];
+            if (!event)
+                throw new QuestionError('STORAGE_UNAVAILABLE', 'durable source record is missing');
+            const envelope = JSON.parse(event.raw);
+            if (event.type !== 'slipstream.file.changed.v1' || event.seq !== seq
+                || event.data.session_id !== sessionId || envelope.source !== sourceFor(sessionId)
+                || envelope.id !== context.change_seq || event.data.path !== context.path)
+                invalidContext('context does not identify a change in this capture');
+            snapshot = (event.data.after ?? {});
+            if (snapshot.kind !== 'content' || snapshot.sha256 !== context.snapshot_sha256)
+                invalidContext('context does not identify available after-content');
+            if (typeof snapshot.size !== 'number' || snapshot.size > MAX_SOURCE_BYTES)
+                invalidContext('source snapshot exceeds 1 MiB');
+        }
+        finally {
+            await cursor.close();
+        }
+    }
+    catch (err) {
+        if (err instanceof QuestionError)
+            throw err;
+        throw new QuestionError('STORAGE_UNAVAILABLE', 'cannot read the durable source log');
+    }
+    let bytes;
+    try {
+        const handle = await open(blobPath(input.storeDir, context.snapshot_sha256), constants.O_RDONLY | constants.O_NOFOLLOW | constants.O_NONBLOCK);
+        try {
+            if (!(await handle.stat()).isFile())
+                throw new Error('not a regular blob');
+            const buffer = Buffer.alloc(MAX_SOURCE_BYTES + 1);
+            let total = 0;
+            while (total < buffer.length) {
+                const { bytesRead } = await handle.read(buffer, total, buffer.length - total, total);
+                if (bytesRead === 0)
+                    break;
+                total += bytesRead;
+            }
+            if (total > MAX_SOURCE_BYTES)
+                throw new QuestionError('STORAGE_UNAVAILABLE', 'recorded source blob exceeds its declared size');
+            bytes = buffer.subarray(0, total);
+        }
+        finally {
+            await handle.close();
+        }
+    }
+    catch (err) {
+        if (err instanceof QuestionError)
+            throw err;
+        throw new QuestionError('STORAGE_UNAVAILABLE', 'recorded source blob is unavailable');
+    }
+    if (bytes.length !== snapshot.size || createHash('sha256').update(bytes).digest('hex') !== context.snapshot_sha256) {
+        throw new QuestionError('STORAGE_UNAVAILABLE', 'recorded source blob does not match its content hash');
+    }
+    return selectSource(bytes, context);
+}
+export function questionResult(event) {
+    const d = event.data;
+    return Object.freeze({ session_id: d.session_id, request_id: d.request_id, question_id: d.question_id,
+        seq: event.seq, queued_at_ms: d.queued_at_ms, expires_at_ms: d.expires_at_ms, duplicate: false });
+}
+/** Answer text is stored verbatim, so it is checked but never trimmed. Unpaired
+ * surrogates are refused for the same reason as in question text. */
+export function assertAnswerText(text) {
+    if (typeof text !== 'string' || !/\S/u.test(text) || /[\uD800-\uDFFF]/u.test(text)
+        || Buffer.byteLength(text, 'utf8') > MAX_ANSWER_BYTES) {
+        throw new QuestionError('INVALID_ANSWER', `answer text must contain a non-whitespace character and be at most ${MAX_ANSWER_BYTES} UTF-8 bytes`);
+    }
+}
+export function answerResult(event) {
+    const d = event.data;
+    return Object.freeze({ session_id: d.session_id, question_id: d.question_id, event_id: event.seq, seq: event.seq,
+        answered_at_ms: d.answered_at_ms, duplicate: false });
+}

package/dist/reader-runtime.js

@@ -0,0 +1,38 @@
+export function liveBoundary(health) {
+    const current = () => BigInt(health.snapshot().durable_seq);
+    return {
+        current,
+        waitForAdvance(from, signal) {
+            return new Promise((resolve, reject) => {
+                if (signal.aborted) {
+                    reject(new Error('aborted'));
+                    return;
+                }
+                let off;
+                const onAbort = () => { cleanup(); reject(new Error('aborted')); };
+                const cleanup = () => { off?.(); signal.removeEventListener('abort', onAbort); };
+                const check = () => { if (current() > from) {
+                    cleanup();
+                    resolve();
+                } };
+                signal.addEventListener('abort', onAbort, { once: true });
+                off = health.subscribe(check);
+                check(); // race-free: re-check after subscribing
+            });
+        },
+    };
+}
+export function staticBoundary(seq) {
+    return {
+        current: () => seq,
+        waitForAdvance(_from, signal) {
+            return new Promise((_resolve, reject) => {
+                if (signal.aborted) {
+                    reject(new Error('aborted'));
+                    return;
+                }
+                signal.addEventListener('abort', () => reject(new Error('aborted')), { once: true });
+            });
+        },
+    };
+}

package/dist/reader.js

@@ -0,0 +1,93 @@
+import { constants } from 'node:fs';
+import { lstat, open } from 'node:fs/promises';
+import { join } from 'node:path';
+import { StorageError } from "./storage.js";
+export const DEFAULT_MAX_BYTES = 10 * 1024 * 1024; // 10 MiB
+/**
+ * A read is trustworthy only if the file did not change while we were reading
+ * it. If size, mtime, or ctime moved between the pre-read and post-read stat,
+ * the bytes we hold may be a torn mix of two states — which we must never
+ * record as a real endpoint. ctime is included because it cannot be set
+ * backward via `utimes`, so it still moves when a writer restores the original
+ * mtime to hide a mid-read change. Callers retry, then fall back to
+ * `unavailable/unstable`.
+ */
+export function isStableAcross(before, after) {
+    return before.size === after.size && before.mtimeMs === after.mtimeMs && before.ctimeMs === after.ctimeMs;
+}
+const STABILITY_RETRIES = 3;
+export function createReader(opts) {
+    const maxBytes = opts.maxBytes ?? DEFAULT_MAX_BYTES;
+    const retries = STABILITY_RETRIES;
+    const openFile = opts.openFile ?? open;
+    const read = async (relPath) => {
+        const abs = join(opts.root, relPath);
+        for (let attempt = 0; attempt <= retries; attempt++) {
+            let before;
+            try {
+                const st = await lstat(abs);
+                if (st.isSymbolicLink() || !st.isFile())
+                    return { kind: 'absent' };
+                before = { size: st.size, mtimeMs: st.mtimeMs, ctimeMs: st.ctimeMs };
+            }
+            catch (err) {
+                if (err.code === 'ENOENT')
+                    return { kind: 'absent' };
+                return { kind: 'unavailable', reason: 'io-error' };
+            }
+            if (before.size > maxBytes)
+                return { kind: 'unavailable', reason: 'oversize' };
+            let handle;
+            try {
+                handle = await openFile(abs, constants.O_RDONLY | constants.O_NONBLOCK);
+            }
+            catch (err) {
+                const code = err.code;
+                if (code === 'ENOENT')
+                    return { kind: 'absent' };
+                if (code === 'EACCES' || code === 'EPERM')
+                    return { kind: 'unavailable', reason: 'unreadable' };
+                return { kind: 'unavailable', reason: 'io-error' };
+            }
+            try {
+                const opened = await handle.stat();
+                if (!opened.isFile())
+                    return { kind: 'absent' };
+                if (opened.size > maxBytes)
+                    return { kind: 'unavailable', reason: 'oversize' };
+                const bytes = Buffer.alloc(opened.size);
+                let offset = 0;
+                while (offset < bytes.length) {
+                    const { bytesRead } = await handle.read(bytes, offset, bytes.length - offset, offset);
+                    if (bytesRead === 0)
+                        break;
+                    offset += bytesRead;
+                }
+                const st = await handle.stat();
+                if (st.size > maxBytes)
+                    return { kind: 'unavailable', reason: 'oversize' };
+                if (!isStableAcross(before, { size: st.size, mtimeMs: st.mtimeMs, ctimeMs: st.ctimeMs })) {
+                    continue; // torn read; re-observe from a fresh stat
+                }
+                const ref = await opts.cas.put(bytes.subarray(0, offset));
+                return { kind: 'content', sha256: ref.sha256, size: ref.size };
+            }
+            catch (err) {
+                // A failure to durably publish the blob is a *storage* fault, not an
+                // unreadable source file. Never launder it into an `unavailable`
+                // snapshot — propagate so capture can suspend and disclose a gap.
+                if (err instanceof StorageError)
+                    throw err;
+                const code = err.code;
+                if (code === 'EACCES' || code === 'EPERM')
+                    return { kind: 'unavailable', reason: 'unreadable' };
+                return { kind: 'unavailable', reason: 'io-error' };
+            }
+            finally {
+                await handle.close();
+            }
+        }
+        return { kind: 'unavailable', reason: 'unstable' };
+    };
+    return { read };
+}

package/dist/recovery.js

@@ -0,0 +1,303 @@
+import { open, readFile } from 'node:fs/promises';
+import { createHash } from 'node:crypto';
+import { dirname, isAbsolute } from 'node:path';
+import { fsyncDir } from "./storage.js";
+import { sourceFor } from "./event.js";
+import { PUBLIC_EVENT_TYPES } from "./public-events.js";
+import { loadAllSchemas, validate } from "./schema.js";
+import { snapshotsEqual } from "./snapshot.js";
+/**
+ * A mid-log defect that cannot be honestly repaired. Only bytes after the final
+ * newline are ever removable (an interrupted append); any *terminated* record
+ * that fails to validate means the durable history is untrustworthy, so we stop
+ * hard rather than skip an event and silently lie about what was captured.
+ */
+export class CorruptLogError extends Error {
+    constructor(message) {
+        super(message);
+        this.name = 'CorruptLogError';
+    }
+}
+/** The envelope constraints every record must satisfy, regardless of type — so an
+ * unknown event type cannot smuggle a malformed envelope past validation. */
+const ENVELOPE_SCHEMA = {
+    type: 'object',
+    required: ['specversion', 'id', 'source', 'type', 'datacontenttype', 'seq', 'time'],
+    properties: {
+        specversion: { const: '1.0' },
+        datacontenttype: { const: 'application/json' },
+        id: { type: 'string', pattern: '^[1-9][0-9]*$' },
+        source: { type: 'string', pattern: '^urn:slipstream:session:' },
+        type: { type: 'string' },
+        seq: { type: 'string', pattern: '^[1-9][0-9]*$' },
+        time: { type: 'string', format: 'date-time' },
+    },
+};
+/** A captured path is relative to the worktree root and never escapes it. A log
+ * whose path escapes (absolute, or with a `..` segment) is corrupt — reconciling
+ * it would read outside the watched tree. */
+export function assertSafePath(path, at) {
+    if (path === '' || isAbsolute(path) || /(^|[\\/])\.\.([\\/]|$)/.test(path)) {
+        throw new CorruptLogError(`${at}: unsafe path ${JSON.stringify(path)}`);
+    }
+}
+/** Like {@link assertSafePath} but for a directory scope, where the empty string
+ * legitimately names the worktree root (a failed root enumeration emits a
+ * `baseline-unreadable` gap whose `relative(root, root)` scope path is ""). */
+function assertSafeDir(path, at) {
+    if (isAbsolute(path) || /(^|[\\/])\.\.([\\/]|$)/.test(path)) {
+        throw new CorruptLogError(`${at}: unsafe path ${JSON.stringify(path)}`);
+    }
+}
+/**
+ * Validate and replay an existing session log. Throws CorruptLogError on any
+ * mid-log defect; truncates only an unterminated trailing suffix. Never uses the
+ * lenient test reader — every terminated line must parse and validate here.
+ */
+export async function recoverSession(logPath, expectedSessionId, cas) {
+    const raw = await readFile(logPath).catch((err) => {
+        if (err.code === 'ENOENT')
+            return Buffer.alloc(0);
+        throw err;
+    });
+    const lastLf = raw.lastIndexOf(0x0a);
+    const keptLen = lastLf + 1; // bytes through the final newline (0 if none)
+    const discardedTailBytes = raw.length - keptLen;
+    const terminated = raw.subarray(0, keptLen);
+    let text;
+    try {
+        text = new TextDecoder('utf-8', { fatal: true }).decode(terminated);
+    }
+    catch {
+        throw new CorruptLogError('log contains invalid UTF-8 before its final newline');
+    }
+    const schemas = await loadAllSchemas();
+    const expectedSource = sourceFor(expectedSessionId);
+    const committed = new Map();
+    const baselineUnknownDirs = new Set();
+    const storageGapSeqByEpisode = new Map();
+    const taskDeclarations = new Map();
+    const attributionEvents = [];
+    const questions = [];
+    const questionAttempts = [];
+    const questionAnswers = [];
+    // Keep the ordered event arrays for callers, while replay validation uses
+    // indexes so a long-lived session is replayed in one pass.
+    const queuedSeqsByQuestion = new Map();
+    const attemptSeqByQuestion = new Map();
+    const answeredQuestionIds = new Set();
+    const verifiedBlobs = new Map(); // sha256 -> verified byte length
+    let root;
+    let maxBytes;
+    let baselineCompleted = false;
+    let currentTaskId;
+    let seq = 0n;
+    const verifyBlob = async (snap, where) => {
+        if (snap.kind !== 'content')
+            return;
+        const cached = verifiedBlobs.get(snap.sha256);
+        if (cached !== undefined) {
+            if (cached !== snap.size) {
+                throw new CorruptLogError(`${where}: blob ${snap.sha256} size ${snap.size} != verified ${cached}`);
+            }
+            return; // hash the bytes once, but re-check each reference's declared size
+        }
+        let bytes;
+        try {
+            bytes = await cas.read(snap.sha256);
+        }
+        catch {
+            throw new CorruptLogError(`${where}: referenced blob ${snap.sha256} is missing`);
+        }
+        if (bytes.length !== snap.size) {
+            throw new CorruptLogError(`${where}: blob ${snap.sha256} size ${bytes.length} != ${snap.size}`);
+        }
+        if (createHash('sha256').update(bytes).digest('hex') !== snap.sha256) {
+            throw new CorruptLogError(`${where}: blob content does not hash to ${snap.sha256}`);
+        }
+        await cas.ensureDurable(snap.sha256); // durability barrier before reuse (Q5)
+        verifiedBlobs.set(snap.sha256, bytes.length);
+    };
+    const lines = text.length === 0 ? [] : text.slice(0, -1).split('\n');
+    for (let i = 0; i < lines.length; i++) {
+        const line = lines[i];
+        const at = `record ${i + 1}`;
+        if (line.length === 0)
+            throw new CorruptLogError(`${at}: blank terminated line`);
+        let event;
+        try {
+            event = JSON.parse(line);
+        }
+        catch {
+            throw new CorruptLogError(`${at}: invalid JSON`);
+        }
+        const envelopeErrors = validate(ENVELOPE_SCHEMA, event);
+        if (envelopeErrors.length > 0) {
+            throw new CorruptLogError(`${at}: envelope invalid: ${envelopeErrors[0]}`);
+        }
+        seq += 1n;
+        const expectedSeq = seq.toString();
+        if (event.seq !== expectedSeq) {
+            throw new CorruptLogError(`${at}: seq ${event.seq} != expected ${expectedSeq}`);
+        }
+        if (event.id !== expectedSeq) {
+            throw new CorruptLogError(`${at}: id ${event.id} != seq ${expectedSeq}`);
+        }
+        if (event.source !== expectedSource) {
+            throw new CorruptLogError(`${at}: source ${event.source} != ${expectedSource}`);
+        }
+        if (event.data?.session_id !== expectedSessionId) {
+            throw new CorruptLogError(`${at}: session_id disagrees with session directory`);
+        }
+        // The first record binds identity and worktree; enforce it before any
+        // forward-compat skip so an unknown type cannot stand in for session.started.
+        if (i === 0 && event.type !== 'slipstream.session.started.v1') {
+            throw new CorruptLogError(`${at}: first record must be session.started, got ${event.type}`);
+        }
+        if (!PUBLIC_EVENT_TYPES.includes(event.type)) {
+            continue; // forward-compat: unknown type, seq still advanced
+        }
+        const schema = schemas.get(event.type);
+        const errors = validate(schema, event);
+        if (errors.length > 0) {
+            throw new CorruptLogError(`${at}: ${event.type} fails schema: ${errors[0]}`);
+        }
+        if (event.type === 'slipstream.file.changed.v1' ||
+            event.type === 'slipstream.harness.evidence.v1' ||
+            event.type === 'slipstream.change.attribution.v1' ||
+            event.type === 'slipstream.enrichment.configured.v1') {
+            attributionEvents.push(event);
+        }
+        switch (event.type) {
+            case 'slipstream.session.started.v1': {
+                if (i !== 0)
+                    throw new CorruptLogError(`${at}: duplicate session.started`);
+                root = event.data.root;
+                maxBytes = event.data.max_bytes;
+                break;
+            }
+            case 'slipstream.file.baselined.v1': {
+                assertSafePath(event.data.path, at);
+                await verifyBlob(event.data.snapshot, at);
+                committed.set(event.data.path, event.data.snapshot);
+                break;
+            }
+            case 'slipstream.capture.baseline.completed.v1': {
+                for (const dir of event.data.unknown_scopes) {
+                    assertSafeDir(dir, at);
+                    baselineUnknownDirs.add(dir);
+                }
+                baselineCompleted = true;
+                break;
+            }
+            case 'slipstream.file.changed.v1': {
+                assertSafePath(event.data.path, at);
+                await verifyBlob(event.data.before, `${at} before`);
+                await verifyBlob(event.data.after, `${at} after`);
+                const prior = committed.get(event.data.path);
+                if (prior !== undefined && !snapshotsEqual(prior, event.data.before)) {
+                    throw new CorruptLogError(`${at}: before contradicts replayed state for ${event.data.path}`);
+                }
+                committed.set(event.data.path, event.data.after);
+                break;
+            }
+            case 'slipstream.capture.gap.v1': {
+                if (event.data.reason === 'baseline-unreadable' && 'path' in event.data.scope) {
+                    assertSafeDir(event.data.scope.path, at);
+                    baselineUnknownDirs.add(event.data.scope.path);
+                }
+                if (event.data.reason === 'storage' && event.data.episode_id !== undefined) {
+                    storageGapSeqByEpisode.set(event.data.episode_id, event.seq);
+                }
+                break;
+            }
+            case 'slipstream.question.queued.v1': {
+                if (event.subject !== `question/${event.data.question_id}`)
+                    throw new CorruptLogError(`${at}: question subject disagrees with id`);
+                questions.push(event);
+                let queuedSeqs = queuedSeqsByQuestion.get(event.data.question_id);
+                if (queuedSeqs === undefined) {
+                    queuedSeqs = new Set();
+                    queuedSeqsByQuestion.set(event.data.question_id, queuedSeqs);
+                }
+                queuedSeqs.add(event.seq);
+                break;
+            }
+            case 'slipstream.question.dispatch_attempted.v1': {
+                if (event.subject !== `question/${event.data.question_id}`
+                    || !queuedSeqsByQuestion.get(event.data.question_id)?.has(event.data.queued_seq)
+                    || attemptSeqByQuestion.has(event.data.question_id)) {
+                    throw new CorruptLogError(`${at}: dispatch attempt has no unique queued question`);
+                }
+                questionAttempts.push(event);
+                attemptSeqByQuestion.set(event.data.question_id, event.seq);
+                break;
+            }
+            case 'slipstream.question.answered.v1': {
+                if (event.subject !== `question/${event.data.question_id}`
+                    || attemptSeqByQuestion.get(event.data.question_id) !== event.data.attempt_seq
+                    || answeredQuestionIds.has(event.data.question_id)) {
+                    throw new CorruptLogError(`${at}: answer has no unique attempted question`);
+                }
+                questionAnswers.push(event);
+                answeredQuestionIds.add(event.data.question_id);
+                break;
+            }
+            case 'slipstream.task.started.v1': {
+                // Replayed in order: the last committed declaration is the current task,
+                // and its request_id indexes the committed result so a replayed duplicate
+                // does not re-append or move the current task backward.
+                currentTaskId = event.data.task_id;
+                taskDeclarations.set(event.data.request_id, {
+                    taskId: event.data.task_id,
+                    title: event.data.title,
+                    seq: event.seq,
+                });
+                break;
+            }
+            case 'slipstream.session.resumed.v1':
+                break;
+        }
+    }
+    // A crash before `baseline.completed` means the initial scan never finished:
+    // every path we did not baseline is of genuinely unknown prior state, so the
+    // whole root is baseline-unknown. Without this, restart reconciliation would
+    // fabricate `absent -> content` for pre-existing files it simply never saw.
+    if (root !== undefined && !baselineCompleted) {
+        baselineUnknownDirs.add('');
+    }
+    // A recovered seq must be a durable seq. The writer commits bytes to the page
+    // cache (writeAll) and only then fsyncs, so a crash mid-outage — exactly when
+    // recovery runs — can leave complete, valid, CAS-verified records that never
+    // reached the platter. Before recoveredThroughSeq is published as the durable
+    // high-water, force the retained prefix to disk (and truncate a torn tail in
+    // the same barrier). Without this, a clean recovery would advertise a boundary
+    // storage may not hold, and a later crash could move the sequence backwards.
+    if (keptLen > 0 || discardedTailBytes > 0) {
+        const handle = await open(logPath, 'r+');
+        try {
+            if (discardedTailBytes > 0)
+                await handle.truncate(keptLen);
+            await handle.sync();
+        }
+        finally {
+            await handle.close();
+        }
+        await fsyncDir(dirname(logPath));
+    }
+    return {
+        root,
+        maxBytes,
+        recoveredThroughSeq: seq,
+        discardedTailBytes,
+        committed,
+        baselineUnknownDirs,
+        storageGapSeqByEpisode,
+        currentTaskId,
+        taskDeclarations,
+        attributionEvents,
+        questions,
+        questionAttempts,
+        questionAnswers,
+    };
+}