@remnic/core 10.0.83 → 10.0.85

package/dist/chunk-IGLJNHOX.js

@@ -0,0 +1,62 @@
+// src/access-mcp-frames.ts
+var MCP_STDIO_MAX_FRAME_BYTES = 131072;
+var TOO_LARGE = { kind: "too-large" };
+var McpFrameReader = class {
+  buffer = Buffer.alloc(0);
+  /** Body bytes of a refused oversized frame that have not arrived yet. */
+  skipBytes = 0;
+  /** Buffer length when `next` last stopped on an incomplete frame. */
+  waitingBytes = 0;
+  push(chunk) {
+    const dropped = Math.min(this.skipBytes, chunk.length);
+    this.skipBytes -= dropped;
+    const kept = chunk.subarray(dropped);
+    if (kept.length > 0) this.buffer = Buffer.concat([this.buffer, kept]);
+  }
+  /** True when bytes arrived after `next` last examined the buffer. */
+  hasUnread() {
+    return this.buffer.length > this.waitingBytes;
+  }
+  next() {
+    this.waitingBytes = 0;
+    const headerEnd = this.buffer.indexOf("\r\n\r\n");
+    if (headerEnd < 0) {
+      if (this.buffer.length <= MCP_STDIO_MAX_FRAME_BYTES) return this.wait();
+      return this.discardBuffer();
+    }
+    if (headerEnd > MCP_STDIO_MAX_FRAME_BYTES) return this.discardBuffer();
+    const headers = this.buffer.subarray(0, headerEnd).toString("utf-8").split("\r\n");
+    const lengthHeader = headers.find((line) => line.toLowerCase().startsWith("content-length:"));
+    const contentLength = lengthHeader ? Number.parseInt(lengthHeader.split(":")[1]?.trim() ?? "0", 10) : NaN;
+    if (!Number.isFinite(contentLength) || contentLength < 0) {
+      this.buffer = Buffer.alloc(0);
+      return null;
+    }
+    const bodyStart = headerEnd + 4;
+    if (contentLength > MCP_STDIO_MAX_FRAME_BYTES) {
+      const rest = this.buffer.subarray(bodyStart);
+      this.skipBytes = Math.max(0, contentLength - rest.length);
+      this.buffer = rest.subarray(Math.min(contentLength, rest.length));
+      return TOO_LARGE;
+    }
+    const bodyEnd = bodyStart + contentLength;
+    if (this.buffer.length < bodyEnd) return this.wait();
+    const text = this.buffer.subarray(bodyStart, bodyEnd).toString("utf-8");
+    this.buffer = this.buffer.subarray(bodyEnd);
+    return { kind: "body", text };
+  }
+  wait() {
+    this.waitingBytes = this.buffer.length;
+    return null;
+  }
+  discardBuffer() {
+    this.buffer = Buffer.alloc(0);
+    return TOO_LARGE;
+  }
+};
+
+export {
+  MCP_STDIO_MAX_FRAME_BYTES,
+  McpFrameReader
+};
+//# sourceMappingURL=chunk-IGLJNHOX.js.map

package/dist/chunk-IGLJNHOX.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/access-mcp-frames.ts"],"sourcesContent":["/**\n * Content-Length framing for the MCP stdio transport.\n *\n * `push` appends raw bytes. `next` returns one frame at a time and `null` when\n * the buffered bytes hold no complete frame yet. The header and the body are\n * each bounded to MCP_STDIO_MAX_FRAME_BYTES, which matches the HTTP access\n * default `maxBodyBytes`, so a peer cannot grow the buffer without limit.\n */\nexport const MCP_STDIO_MAX_FRAME_BYTES = 131072;\n\nexport type McpFrame = { kind: \"body\"; text: string } | { kind: \"too-large\" };\n\nconst TOO_LARGE: McpFrame = { kind: \"too-large\" };\n\nexport class McpFrameReader {\n  private buffer = Buffer.alloc(0);\n  /** Body bytes of a refused oversized frame that have not arrived yet. */\n  private skipBytes = 0;\n  /** Buffer length when `next` last stopped on an incomplete frame. */\n  private waitingBytes = 0;\n\n  push(chunk: Buffer): void {\n    const dropped = Math.min(this.skipBytes, chunk.length);\n    this.skipBytes -= dropped;\n    const kept = chunk.subarray(dropped);\n    if (kept.length > 0) this.buffer = Buffer.concat([this.buffer, kept]);\n  }\n\n  /** True when bytes arrived after `next` last examined the buffer. */\n  hasUnread(): boolean {\n    return this.buffer.length > this.waitingBytes;\n  }\n\n  next(): McpFrame | null {\n    this.waitingBytes = 0;\n    const headerEnd = this.buffer.indexOf(\"\\r\\n\\r\\n\");\n    if (headerEnd < 0) {\n      if (this.buffer.length <= MCP_STDIO_MAX_FRAME_BYTES) return this.wait();\n      return this.discardBuffer();\n    }\n    if (headerEnd > MCP_STDIO_MAX_FRAME_BYTES) return this.discardBuffer();\n\n    const headers = this.buffer.subarray(0, headerEnd).toString(\"utf-8\").split(\"\\r\\n\");\n    const lengthHeader = headers.find((line) => line.toLowerCase().startsWith(\"content-length:\"));\n    const contentLength = lengthHeader ? Number.parseInt(lengthHeader.split(\":\")[1]?.trim() ?? \"0\", 10) : NaN;\n    if (!Number.isFinite(contentLength) || contentLength < 0) {\n      this.buffer = Buffer.alloc(0);\n      return null;\n    }\n\n    const bodyStart = headerEnd + 4;\n    if (contentLength > MCP_STDIO_MAX_FRAME_BYTES) {\n      const rest = this.buffer.subarray(bodyStart);\n      this.skipBytes = Math.max(0, contentLength - rest.length);\n      this.buffer = rest.subarray(Math.min(contentLength, rest.length));\n      return TOO_LARGE;\n    }\n    const bodyEnd = bodyStart + contentLength;\n    if (this.buffer.length < bodyEnd) return this.wait();\n    const text = this.buffer.subarray(bodyStart, bodyEnd).toString(\"utf-8\");\n    this.buffer = this.buffer.subarray(bodyEnd);\n    return { kind: \"body\", text };\n  }\n\n  private wait(): null {\n    this.waitingBytes = this.buffer.length;\n    return null;\n  }\n\n  private discardBuffer(): McpFrame {\n    this.buffer = Buffer.alloc(0);\n    return TOO_LARGE;\n  }\n}\n"],"mappings":";AAQO,IAAM,4BAA4B;AAIzC,IAAM,YAAsB,EAAE,MAAM,YAAY;AAEzC,IAAM,iBAAN,MAAqB;AAAA,EAClB,SAAS,OAAO,MAAM,CAAC;AAAA;AAAA,EAEvB,YAAY;AAAA;AAAA,EAEZ,eAAe;AAAA,EAEvB,KAAK,OAAqB;AACxB,UAAM,UAAU,KAAK,IAAI,KAAK,WAAW,MAAM,MAAM;AACrD,SAAK,aAAa;AAClB,UAAM,OAAO,MAAM,SAAS,OAAO;AACnC,QAAI,KAAK,SAAS,EAAG,MAAK,SAAS,OAAO,OAAO,CAAC,KAAK,QAAQ,IAAI,CAAC;AAAA,EACtE;AAAA;AAAA,EAGA,YAAqB;AACnB,WAAO,KAAK,OAAO,SAAS,KAAK;AAAA,EACnC;AAAA,EAEA,OAAwB;AACtB,SAAK,eAAe;AACpB,UAAM,YAAY,KAAK,OAAO,QAAQ,UAAU;AAChD,QAAI,YAAY,GAAG;AACjB,UAAI,KAAK,OAAO,UAAU,0BAA2B,QAAO,KAAK,KAAK;AACtE,aAAO,KAAK,cAAc;AAAA,IAC5B;AACA,QAAI,YAAY,0BAA2B,QAAO,KAAK,cAAc;AAErE,UAAM,UAAU,KAAK,OAAO,SAAS,GAAG,SAAS,EAAE,SAAS,OAAO,EAAE,MAAM,MAAM;AACjF,UAAM,eAAe,QAAQ,KAAK,CAAC,SAAS,KAAK,YAAY,EAAE,WAAW,iBAAiB,CAAC;AAC5F,UAAM,gBAAgB,eAAe,OAAO,SAAS,aAAa,MAAM,GAAG,EAAE,CAAC,GAAG,KAAK,KAAK,KAAK,EAAE,IAAI;AACtG,QAAI,CAAC,OAAO,SAAS,aAAa,KAAK,gBAAgB,GAAG;AACxD,WAAK,SAAS,OAAO,MAAM,CAAC;AAC5B,aAAO;AAAA,IACT;AAEA,UAAM,YAAY,YAAY;AAC9B,QAAI,gBAAgB,2BAA2B;AAC7C,YAAM,OAAO,KAAK,OAAO,SAAS,SAAS;AAC3C,WAAK,YAAY,KAAK,IAAI,GAAG,gBAAgB,KAAK,MAAM;AACxD,WAAK,SAAS,KAAK,SAAS,KAAK,IAAI,eAAe,KAAK,MAAM,CAAC;AAChE,aAAO;AAAA,IACT;AACA,UAAM,UAAU,YAAY;AAC5B,QAAI,KAAK,OAAO,SAAS,QAAS,QAAO,KAAK,KAAK;AACnD,UAAM,OAAO,KAAK,OAAO,SAAS,WAAW,OAAO,EAAE,SAAS,OAAO;AACtE,SAAK,SAAS,KAAK,OAAO,SAAS,OAAO;AAC1C,WAAO,EAAE,MAAM,QAAQ,KAAK;AAAA,EAC9B;AAAA,EAEQ,OAAa;AACnB,SAAK,eAAe,KAAK,OAAO;AAChC,WAAO;AAAA,EACT;AAAA,EAEQ,gBAA0B;AAChC,SAAK,SAAS,OAAO,MAAM,CAAC;AAC5B,WAAO;AAAA,EACT;AACF;","names":[]}

package/dist/{chunk-KFLD7ZZG.js → chunk-IUKYFTGW.js}

@@ -37,10 +37,10 @@ import {
 } from "./chunk-YCVB7X56.js";
 import {
   fillWearableConversationLocations
-} from "./chunk-2D7BTSDW.js";
+} from "./chunk-ANZZLRUX.js";
 import {
   composeMemoryEnvelope
-} from "./chunk-JRVMCZE3.js";
+} from "./chunk-QEYTRFR3.js";
 import {
   log
 } from "./chunk-3WCASNQZ.js";
@@ -1329,4 +1329,4 @@ export {
   syncWearableSource,
   defaultTimezone
 };
-//# sourceMappingURL=chunk-KFLD7ZZG.js.map
+//# sourceMappingURL=chunk-IUKYFTGW.js.map

package/dist/{chunk-YK7GOPIE.js → chunk-JFH6JAGY.js}

@@ -1,3 +1,6 @@
+import {
+  gunzipCapsuleArchive
+} from "./chunk-QV2VZKD5.js";
 import {
   createVersion
 } from "./chunk-ER7XANP3.js";
@@ -19,7 +22,7 @@ import {
 import {
   decryptCapsuleFileInMemory,
   isEncryptedCapsuleFile
-} from "./chunk-DQEMWVMT.js";
+} from "./chunk-UVYI6VIX.js";
 import {
   assertIsDirectoryNotSymlink,
   assertRealpathInsideRoot,
@@ -32,7 +35,6 @@ import {
 import { lstat, mkdir, readFile, realpath, stat, unlink, writeFile } from "fs/promises";
 import path from "path";
 import { createHash, randomUUID } from "crypto";
-import { gunzipSync } from "zlib";
 async function importCapsule(opts) {
   const archiveAbs = path.resolve(opts.archivePath);
   const rootAbs = path.resolve(opts.root);
@@ -57,7 +59,7 @@ async function importCapsule(opts) {
   } else {
     raw = await readFile(archiveAbs);
   }
-  const json = gunzipSync(raw).toString("utf-8");
+  const json = gunzipCapsuleArchive(raw, "importCapsule", archiveAbs);
   let parsedJson;
   try {
     parsedJson = JSON.parse(json);
@@ -294,4 +296,4 @@ function mintForkId(capsuleId, originalId, now) {
 export {
   importCapsule
 };
-//# sourceMappingURL=chunk-YK7GOPIE.js.map
+//# sourceMappingURL=chunk-JFH6JAGY.js.map

package/dist/chunk-JFH6JAGY.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/transfer/capsule-import.ts"],"sourcesContent":["import { lstat, mkdir, readFile, realpath, stat, unlink, writeFile } from \"node:fs/promises\";\nimport path from \"node:path\";\nimport { createHash, randomUUID } from \"node:crypto\";\nimport { bumpMemoryCorpusVersionForDir } from \"../memory-corpus-version.js\";\nimport {\n  HistoricalEntityCanonicalIdCache,\n  readEntityRefFromFrontmatter,\n  canonicalizeEntityRefFrontmatter,\n  classifyEntityRefWritePath,\n  repairContentAfterJournalMove,\n  requestEntityCanonicalIdReconcile,\n} from \"../storage/entity-canonical-id-references.js\";\nimport { withRawEntityPageMutation } from \"../storage/entity-canonical-id-lock.js\";\nimport {\n  createVersion,\n  type VersioningConfig,\n  type VersioningLogger,\n} from \"../page-versioning.js\";\nimport {\n  assertIsDirectoryNotSymlink,\n  assertRealpathInsideRoot,\n  fromPosixRelPath,\n  isPathInsideRoot,\n  sha256String,\n} from \"./fs-utils.js\";\nimport {\n  parseExportBundle,\n  type CapsuleBlock,\n  type ExportManifestV2,\n  type ExportMemoryRecordV1,\n} from \"./types.js\";\nimport { isEncryptedCapsuleFile, decryptCapsuleFileInMemory } from \"./capsule-crypto.js\";\nimport { gunzipCapsuleArchive } from \"./capsule-gunzip.js\";\n\n/**\n * Conflict-resolution mode for {@link importCapsule}. Inverse of the\n * `mode` selector in PR 4/6's CLI surface.\n *\n *  - `\"skip\"` (default) — when a target file already exists at the same\n *    relative path, leave it untouched. The corresponding record is reported\n *    via {@link ImportCapsuleResult.skipped}.\n *  - `\"overwrite\"` — when a target file exists, snapshot the prior content\n *    via {@link createVersion} (gotcha #54: write-before-delete; gotcha #25:\n *    don't destroy old state until new state is confirmed), then write the\n *    incoming content. The snapshot's `note` includes the source capsule id.\n *  - `\"fork\"` — never overwrite. Every record is rebased under\n *    `forks/<capsule-id>/<original-path>` and any YAML-frontmatter `id:`\n *    field is rewritten to a new fork-scoped value. The original tree is\n *    not touched.\n *\n * The mode is selected once per call and applied uniformly to every record\n * in the bundle. Mixed-mode imports are not supported by design — that\n * would let a single corrupted manifest silently land partial state.\n */\nexport type ImportCapsuleMode = \"skip\" | \"overwrite\" | \"fork\";\n\n/**\n * Options accepted by {@link importCapsule}.\n *\n * `archivePath` — absolute or cwd-relative path to a `.capsule.json.gz`\n * archive produced by `exportCapsule`. The archive must contain a V2\n * bundle (`schemaVersion: 2`); V1 archives are rejected.\n *\n * `root` — absolute or cwd-relative path to the memory directory that\n * will receive the records. Must be an existing directory.\n *\n * `mode` — see {@link ImportCapsuleMode}. Defaults to `\"skip\"`.\n *\n * `versioning` — optional page-versioning config used by `mode: \"overwrite\"`\n * to snapshot prior content before replacing it. Snapshots are skipped when\n * not provided or when `enabled === false`. Tests pass an enabled config\n * to assert snapshot creation; production callers thread the\n * orchestrator's resolved versioning config.\n *\n * `log` — optional logger forwarded to {@link createVersion}.\n *\n * `now` — optional clock override (ms epoch) used to derive deterministic\n * fork ids in tests. Production callers omit this.\n */\nexport interface ImportCapsuleOptions {\n  archivePath: string;\n  root: string;\n  mode?: ImportCapsuleMode;\n  versioning?: VersioningConfig;\n  log?: VersioningLogger;\n  now?: number;\n  /**\n   * Memory directory whose secure-store keyring is used when the archive is\n   * encrypted. Required when `archivePath` ends with `.enc` or when the file\n   * starts with the REMNIC-ENC magic header. If `memoryDir` is omitted and the\n   * archive turns out to be encrypted, `importCapsule` throws a clear error\n   * rather than silently failing.\n   *\n   * When provided and the archive is NOT encrypted, the value is ignored.\n   */\n  memoryDir?: string;\n  /**\n   * Original secure-store passphrase for encrypted format-v2 archives. When\n   * supplied, the importer derives the archive key from the embedded KDF\n   * header, enabling restore without the source machine's unlocked keyring.\n   */\n  passphrase?: string;\n}\n\nexport interface ImportCapsuleSkippedRecord {\n  /** Original record path (capsule-relative, posix). */\n  path: string;\n  /**\n   * Why this record was not written.\n   *\n   * `\"exists\"` — the target path already existed and the mode was `\"skip\"`,\n   * OR the computed fork path already existed in fork mode.\n   *\n   * `\"checksum_mismatch\"` is intentionally absent: a checksum failure aborts\n   * the import entirely (fail-closed) rather than skipping the offending\n   * record, so no `ImportCapsuleSkippedRecord` is ever produced for it.\n   */\n  reason: \"exists\";\n}\n\nexport interface ImportCapsuleImportedRecord {\n  /** Capsule-relative posix path the record carried. */\n  sourcePath: string;\n  /** Memory-dir-relative posix path the file was written to. */\n  targetPath: string;\n  /** Whether a prior version snapshot was taken (overwrite-mode only). */\n  snapshotted: boolean;\n  /** Whether the frontmatter `id:` field was rewritten (fork-mode only). */\n  rewroteId: boolean;\n}\n\nexport interface ImportCapsuleResult {\n  /** Records that landed on disk. */\n  imported: ImportCapsuleImportedRecord[];\n  /** Records that were not written. */\n  skipped: ImportCapsuleSkippedRecord[];\n  /** The manifest decoded from the archive. */\n  manifest: ExportManifestV2;\n}\n\n/**\n * Pure async function that imports a capsule archive into a memory\n * directory. Inverse of {@link import(\"./capsule-export.js\").exportCapsule}.\n *\n * Sequence:\n *   1. Read + gunzip + JSON.parse the archive.\n *   2. Validate the bundle through `parseExportBundle` (V1 rejected).\n *   3. Verify each record's content sha256 against the manifest entry.\n *      Any mismatch aborts the import BEFORE any file is written —\n *      partial-write recovery would require a full rollback we cannot\n *      offer cheaply, so we fail closed (gotcha #25).\n *   4. Apply the selected {@link ImportCapsuleMode} to every record.\n *\n * Determinism guarantees:\n *  - Imported records are returned sorted by `sourcePath`.\n *  - Skipped records are returned sorted by `path`.\n *  - Fork-mode rebases under a stable `forks/<capsule-id>/` prefix so\n *    repeated fork imports of the same capsule shape land in predictable\n *    locations (subsequent fork imports still skip-on-exist because the\n *    target tree is computed from the source path).\n */\nexport async function importCapsule(\n  opts: ImportCapsuleOptions,\n): Promise<ImportCapsuleResult> {\n  const archiveAbs = path.resolve(opts.archivePath);\n  const rootAbs = path.resolve(opts.root);\n  await assertIsDirectoryNotSymlink(rootAbs, \"importCapsule\", \"root\");\n\n  const mode: ImportCapsuleMode = opts.mode ?? \"skip\";\n  // Reject unknown mode values up-front (rule 51). TypeScript callers get a\n  // compile-time check via the union type; JS/CLI callers get a runtime error\n  // here before any write begins — not a silent destructive fallback.\n  if (mode !== \"skip\" && mode !== \"overwrite\" && mode !== \"fork\") {\n    throw new Error(\n      `importCapsule: unknown mode ${JSON.stringify(mode)}; expected \"skip\", \"overwrite\", or \"fork\"`,\n    );\n  }\n\n  // Auto-detect encrypted archives. If the file ends with `.enc` or starts\n  // with the REMNIC-ENC magic header, decrypt it first before gunzip+parse.\n  // Rule 48: default is \"not encrypted\"; we only attempt decryption when the\n  // header is definitively present, never on ambiguous content.\n  const encrypted = await isEncryptedCapsuleFile(archiveAbs);\n  let raw: Buffer;\n  if (encrypted) {\n    if (!opts.memoryDir && !opts.passphrase) {\n      throw new Error(\n        `importCapsule: archive is encrypted but 'memoryDir' was not provided. ` +\n          `Pass the memory directory so the secure-store key can be retrieved, ` +\n          `provide the original passphrase for a format-v2 archive restore, ` +\n          `or run \\`remnic secure-store unlock\\` before importing.`,\n      );\n    }\n    raw = await decryptCapsuleFileInMemory(archiveAbs, opts.memoryDir, {\n      passphrase: opts.passphrase,\n    });\n  } else {\n    raw = await readFile(archiveAbs);\n  }\n  const json = gunzipCapsuleArchive(raw, \"importCapsule\", archiveAbs);\n  let parsedJson: unknown;\n  try {\n    parsedJson = JSON.parse(json);\n  } catch (cause) {\n    throw new Error(\n      `importCapsule: archive is not valid JSON after gunzip: ${archiveAbs}`,\n      { cause: cause as Error },\n    );\n  }\n\n  const parsed = parseExportBundle(parsedJson);\n  if (parsed.capsuleVersion !== 2) {\n    // PR 1/6 ships a V1 reader; capsule import is V2-only by design. A V1\n    // bundle does not carry a capsule block, so fork-mode (which depends on\n    // `capsule.id` for the rebase prefix) cannot work. Reject up-front per\n    // gotcha #51 instead of silently routing to a different code path.\n    throw new Error(\n      \"importCapsule: archive is V1; only V2 capsule archives are supported\",\n    );\n  }\n  const bundle = parsed.bundle as { manifest: ExportManifestV2; records: ExportMemoryRecordV1[] };\n  const manifest = bundle.manifest;\n  const capsule = manifest.capsule;\n\n  // Build a path → manifest-entry index for O(1) checksum lookup. The\n  // manifest is the source of truth; records-without-manifest-entries and\n  // manifest-entries-without-records are both treated as corruption.\n  const manifestIndex = new Map<string, ExportManifestV2[\"files\"][number]>();\n  for (const f of manifest.files) {\n    manifestIndex.set(f.path, f);\n  }\n  if (manifestIndex.size !== manifest.files.length) {\n    throw new Error(\n      \"importCapsule: manifest contains duplicate file paths\",\n    );\n  }\n  const recordPaths = new Set<string>();\n  for (const rec of bundle.records) {\n    if (recordPaths.has(rec.path)) {\n      throw new Error(\n        `importCapsule: bundle contains duplicate record path: ${rec.path}`,\n      );\n    }\n    recordPaths.add(rec.path);\n  }\n\n  // Phase 1: verify every record matches its manifest entry AND validate all\n  // target paths before any filesystem mutation.  We do both in a single pass\n  // so a corrupted or malicious archive cannot leave the memory dir partially\n  // written (fail-closed per gotcha #25).\n  //\n  // The real root is resolved once via realpath so the subsequent per-record\n  // inside-root checks are symlink-aware: a record path like `facts/a.md`\n  // cannot write outside the intended sandbox via a symlinked subdirectory\n  // (Codex P1 feedback).  If realpath fails (root does not exist) the earlier\n  // assertIsDirectoryNotSymlink call already threw, so this should always succeed.\n  const rootReal = await realpath(rootAbs).catch(() => rootAbs);\n\n  // Tracks normalized, case-folded target paths seen so far in phase 1.  Maps\n  // targetAbs.toLowerCase() → first source path so the collision error can name\n  // both offending entries.  Two manifest entries whose computed target paths\n  // normalize to the same absolute path (e.g. `subdir/file.md` and\n  // `subdir/./file.md`, or differing case on case-insensitive filesystems such\n  // as macOS and Windows) would both try to write the same inode — the second\n  // would silently overwrite the first.  We reject the import up-front before\n  // any write (Codex P2 thread on PR #741, line 283).\n  const seenTargetPaths = new Map<string, string>();\n\n  for (const rec of bundle.records) {\n    // Checksum validation.\n    const entry = manifestIndex.get(rec.path);\n    if (!entry) {\n      throw new Error(\n        `importCapsule: archive checksum mismatch (record without manifest entry: ${rec.path})`,\n      );\n    }\n    const { sha256, bytes } = sha256String(rec.content);\n    if (sha256 !== entry.sha256 || bytes !== entry.bytes) {\n      throw new Error(\n        `importCapsule: archive checksum mismatch for ${rec.path}: ` +\n          `expected sha256=${entry.sha256} bytes=${entry.bytes}, ` +\n          `got sha256=${sha256} bytes=${bytes}`,\n      );\n    }\n\n    // Source path validation: reject any record whose posix source path\n    // contains a `..` segment, an absolute prefix, or any component that would\n    // let fork-mode bypass its isolation invariant.  This check runs before\n    // `computeTargetPath` so that fork mode's `forks/<id>/` rebase cannot be\n    // bypassed by a path like `../../profile.md` (which `path.join` would\n    // silently collapse, landing the file inside root but outside the fork\n    // prefix — Cursor medium thread #741).  Rejecting `..` up-front is simpler\n    // and more robust than normalising after the fact.\n    //\n    // Extended guard (Codex P1 #741 round 5): also reject paths containing\n    // backslash separators (`\\`), which are Windows path separators. On Windows\n    // a path like `..\\\\escape.md` or `subdir\\\\..\\\\..\\\\escape.md` would resolve\n    // to a parent traversal but would bypass a purely posix-split check.\n    // Additionally, after posix-normalizing the path we re-check for a leading\n    // `..` or `/` — this catches edge-cases such as `subdir/../..` where the\n    // individual split segments are not `..` but the normalized result is.\n    if (rec.path.includes(\"\\\\\")) {\n      throw new Error(\n        `importCapsule: record path contains backslash separators (Windows-style paths are not allowed): ${rec.path}`,\n      );\n    }\n    const posixNormalized = path.posix.normalize(rec.path);\n    if (\n      rec.path.startsWith(\"/\") ||\n      rec.path.split(\"/\").some((seg) => seg === \"..\") ||\n      posixNormalized.startsWith(\"..\") ||\n      posixNormalized.startsWith(\"/\")\n    ) {\n      throw new Error(\n        `importCapsule: record path escapes target root: ${rec.path}`,\n      );\n    }\n\n    // Path-traversal validation (moved here from phase 2 per Cursor feedback:\n    // the traversal check must run before ANY write so a malicious archive\n    // with an escaping path that sorts last cannot land partial writes).\n    //\n    // We build targetAbs relative to the real-resolved root (rootReal) so\n    // that the inside-root check is symlink-aware: if `rootReal !== rootAbs`\n    // (the import root is itself behind a symlink), we still compare against\n    // the canonical path (Codex P1).\n    const targetRel = computeTargetPath(rec.path, mode, capsule.id);\n    const targetAbs = path.join(rootReal, fromPosixRelPath(targetRel));\n    if (!isPathInsideRoot(rootReal, targetAbs)) {\n      throw new Error(\n        `importCapsule: record path escapes target root: ${rec.path}`,\n      );\n    }\n\n    // Symlink-aware containment check (Cursor thread #741 line 247/264).\n    // The lexical check above handles `..`-traversal but cannot detect\n    // symlinked subdirectories that point outside the root. We resolve the\n    // nearest existing ancestor of the target via realpath to catch symlinks\n    // anywhere in the path components. If any resolved prefix escapes rootReal,\n    // the import is rejected before any write. This applies to ALL modes,\n    // including fork mode whose rebase prefix may itself traverse a symlink.\n    await assertRealpathInsideRoot(rootReal, targetAbs, rec.path, \"importCapsule\");\n\n    // Target-file symlink check (Codex P1 #741 round 4, line 260).\n    // `assertRealpathInsideRoot` resolves the nearest existing *ancestor* to\n    // catch symlinked parent directories, but if the TARGET FILE itself already\n    // exists and is a symlink, that check passes (the parent is real) while the\n    // write would silently follow the symlink to a path outside root.  We\n    // therefore lstat the target directly: if it exists and is a symlink we\n    // reject the record up-front.  For new files the parent-canonicalization\n    // performed above is sufficient; no realpath of a non-existent file is\n    // needed.\n    const targetLstat = await lstat(targetAbs).catch(() => null);\n    if (targetLstat !== null && targetLstat.isSymbolicLink()) {\n      throw new Error(\n        `importCapsule: record target is a symlink and cannot be written to safely: ${rec.path}`,\n      );\n    }\n\n    // Duplicate normalized target path detection (Codex P2 #741, line 283).\n    // `path.join` already normalises `.` segments (e.g. `subdir/./file.md` →\n    // `subdir/file.md`).  On case-insensitive filesystems (macOS default,\n    // Windows), two paths that differ only in case would resolve to the same\n    // inode.  We fold the dedup key to lowercase so that `subdir/File.md` and\n    // `subdir/file.md` are detected as duplicates before any write occurs.\n    // This is intentionally unconditional: the cost of an extra `.toLowerCase()`\n    // on case-sensitive filesystems is negligible, and a defensive lowercase\n    // is far simpler than probing filesystem case-sensitivity at runtime.\n    const dedupKey = targetAbs.toLowerCase();\n    const firstSourcePath = seenTargetPaths.get(dedupKey);\n    if (firstSourcePath !== undefined) {\n      throw new Error(\n        `importCapsule: manifest contains two entries that resolve to the same target path: ` +\n          `\"${firstSourcePath}\" and \"${rec.path}\" both map to \"${targetRel}\"`,\n      );\n    }\n    seenTargetPaths.set(dedupKey, rec.path);\n  }\n  // Detect manifest-only entries (missing record). Treat as corruption.\n  for (const f of manifest.files) {\n    if (!recordPaths.has(f.path)) {\n      throw new Error(\n        `importCapsule: archive checksum mismatch (manifest entry without record: ${f.path})`,\n      );\n    }\n  }\n\n  // Phase 2: apply the mode. All records were validated in phase 1; we now\n  // write to disk. Per-record errors propagate; each individual write is\n  // atomic (mkdir + writeFile pair).\n  const imported: ImportCapsuleImportedRecord[] = [];\n  const skipped: ImportCapsuleSkippedRecord[] = [];\n  // The target's completed migration journal is a write boundary here too\n  // (issue #2213): a capsule can carry pre-migration memories whose entityRef\n  // the target already renamed, and no recurring reconciliation pass exists\n  // to absorb a stale ref after the fact. Read through the identity-keyed\n  // cache PER RECORD so a peer migration completing mid-import is picked up\n  // for every record written after it (one lstat per record).\n  const journalStateDir = path.join(rootReal, \"state\");\n  const historicalIdCache = new HistoricalEntityCanonicalIdCache();\n  // Entity pages in THIS capsule can re-establish collisions the target's\n  // journal already resolved (Codex P1): once the next migration parks the\n  // mapping, a memory canonicalized onto the canonical claimant is\n  // permanently misattributed. Memories whose ref targets a capsule-supplied\n  // entity id import byte-faithful behind the reconcile marker instead; the\n  // migration settles the collision and rewrites references per its verdict.\n  const capsuleEntityIds = new Set(\n    bundle.records\n      .map((record) => computeTargetPath(record.path, mode, capsule.id))\n      .filter((rel) => classifyEntityRefWritePath(rootReal, path.join(rootReal, fromPosixRelPath(rel))) === \"entity\")\n      .map((rel) => path.basename(rel, \".md\")),\n  );\n\n  // Sort by source path so the imported/skipped lists are deterministic\n  // regardless of bundle order. (`exportCapsule` already sorts; we re-sort\n  // defensively in case a hand-edited archive ships records in another order.)\n  const sortedRecords = [...bundle.records].sort((a, b) =>\n    a.path.localeCompare(b.path),\n  );\n\n  // The reconcile marker is published ONCE, after every record landed\n  // (Codex P1, round 21): a per-record marker could be consumed by a peer\n  // between a legacy-preserving memory write and its colliding entity page,\n  // canonicalizing the memory onto the wrong claimant irreversibly.\n  let reconcileNeeded = false;\n  const applyRecords = async (): Promise<void> => {\n  for (const rec of sortedRecords) {\n    const targetRel = computeTargetPath(rec.path, mode, capsule.id);\n    // Use rootReal (realpath-resolved) to stay consistent with phase 1's\n    // traversal validation and avoid writing through stale symlinks.\n    const targetAbs = path.join(rootReal, fromPosixRelPath(targetRel));\n\n    const exists = await fileExistsAt(targetAbs);\n\n    // Skip logic applies to both `skip` mode (explicit) and `fork` mode\n    // (Cursor medium: fork mode must also be skip-on-exist for the computed\n    // fork path, because production imports generate non-deterministic IDs —\n    // so re-importing the same capsule should not overwrite user edits in the\n    // fork tree or silently change file identities by generating new IDs).\n    if ((mode === \"skip\" || mode === \"fork\") && exists) {\n      skipped.push({ path: rec.path, reason: \"exists\" });\n      continue;\n    }\n\n    let snapshotted = false;\n    if (mode === \"overwrite\" && exists) {\n      // Gotcha #54: snapshot BEFORE overwriting. If snapshot creation fails\n      // we abort this record's import rather than silently destroying\n      // history. The page-versioning module is responsible for atomic\n      // sidecar writes; we just call it.\n      if (opts.versioning && opts.versioning.enabled) {\n        const prior = await readFile(targetAbs, \"utf-8\").catch(() => \"\");\n        await createVersion(\n          targetAbs,\n          prior,\n          \"manual\",\n          opts.versioning,\n          opts.log,\n          `capsule-import: ${capsule.id}`,\n          rootReal,\n        );\n        snapshotted = true;\n      }\n    }\n\n    let contentToWrite = rec.content;\n    let rewroteId = false;\n    if (mode === \"fork\") {\n      const forked = rewriteFrontmatterIdForFork(contentToWrite, capsule.id, opts.now);\n      contentToWrite = forked.content;\n      rewroteId = forked.rewrote;\n    }\n\n    await mkdir(path.dirname(targetAbs), { recursive: true });\n    // Resolve at the write itself (mirrors capsule-merge): a peer migration\n    // can complete during the snapshot/mkdir awaits, and capsule writes bump\n    // only the corpus version, which the migration fingerprint ignores. The\n    // post-write REPAIR re-canonicalizes and rewrites when the journal moved\n    // across the write itself (a parked mapping cannot be fixed after the\n    // fact by the reconcile pass). Only memory-tier records canonicalize;\n    // entities/ pages carry relationship TARGETS only\n    // rewriteRelationshipTargets understands, so they import byte-faithful\n    // with a reconcile marker; everything else imports losslessly.\n    const targetKind = classifyEntityRefWritePath(rootReal, targetAbs);\n    const rawRef = targetKind === \"memory\" ? readEntityRefFromFrontmatter(contentToWrite) : null;\n    if (targetKind === \"memory\" && rawRef !== null && capsuleEntityIds.has(rawRef)) {\n      // Ref targets a capsule-supplied entity page (potential collision\n      // claimant): keep the legacy bytes; the DEFERRED marker below lets the\n      // migration settle the collision and rewrite per its verdict (Codex P1).\n      await writeFile(targetAbs, contentToWrite, \"utf-8\");\n      reconcileNeeded = true;\n    } else if (targetKind === \"memory\") {\n      const idsAtWrite = historicalIdCache.get(journalStateDir);\n      const rawRecord = contentToWrite;\n      contentToWrite = canonicalizeEntityRefFrontmatter(rawRecord, idsAtWrite);\n      // Snapshot the pre-write bytes: a repair failure after the write must\n      // restore them (or remove a newly created target), or the import\n      // reports failure while an overwrite already destroyed the prior state\n      // and the skipped corpus bump leaves warm caches stale (AGENTS.md §14).\n      const originalBytes = await readFile(targetAbs, \"utf-8\").catch(() => null);\n      await writeFile(targetAbs, contentToWrite, \"utf-8\");\n      try {\n        await repairContentAfterJournalMove({\n          stateDir: journalStateDir,\n          cache: historicalIdCache,\n          idsAtWrite,\n          rawContent: rawRecord,\n          lastWritten: contentToWrite,\n          rewrite: (content) => writeFile(targetAbs, content, \"utf-8\"),\n        });\n      } catch (err) {\n        if (originalBytes === null) {\n          await unlink(targetAbs).catch(() => undefined);\n        } else {\n          await writeFile(targetAbs, originalBytes, \"utf-8\").catch(() => undefined);\n        }\n        throw err;\n      }\n    } else {\n      await writeFile(targetAbs, contentToWrite, \"utf-8\");\n      if (targetKind === \"entity\") {\n        reconcileNeeded = true;\n      }\n    }\n    // Bump the corpus sentinel per write (Cursor Medium, #1902): a concurrent\n    // readAllMemories during the import must rescan and see records already on\n    // disk, never the pre-import corpus, mid-batch.\n    bumpMemoryCorpusVersionForDir(rootReal);\n    imported.push({\n      sourcePath: rec.path,\n      targetPath: targetRel,\n      snapshotted,\n      rewroteId,\n    });\n  }\n\n  // Every record — including every collision claimant entity page — is on\n  // disk; NOW the reconcile pass can settle collisions safely.\n  if (reconcileNeeded) {\n    await requestEntityCanonicalIdReconcile(journalStateDir);\n  }\n  };\n  const firstEntityId = capsuleEntityIds.values().next().value;\n  if (firstEntityId === undefined) {\n    await applyRecords();\n  } else {\n    await withRawEntityPageMutation(\n      rootReal,\n      path.join(rootReal, \"entities\", `${firstEntityId}.md`),\n      applyRecords,\n    );\n  }\n\n  // Sort skipped for stable output (see comment above).\n  skipped.sort((a, b) => a.path.localeCompare(b.path));\n\n  // Per-record corpus bumps happen inside the loop above (Cursor Medium,\n  // #1902); no after-batch bump needed here.\n\n  return { imported, skipped, manifest };\n}\n\n// ---------------------------------------------------------------------------\n// Path helpers\n// ---------------------------------------------------------------------------\n\n/**\n * Compute the destination relative path for a record under the chosen\n * mode.\n *\n *  - `skip` / `overwrite` — identity: the record's posix path is used as-is.\n *  - `fork` — rebased under `forks/<capsule-id>/<original-path>` so the\n *    original tree is never modified.\n */\nfunction computeTargetPath(\n  sourcePosix: string,\n  mode: ImportCapsuleMode,\n  capsuleId: string,\n): string {\n  if (mode === \"fork\") return `forks/${capsuleId}/${sourcePosix}`;\n  return sourcePosix;\n}\n\nasync function fileExistsAt(absPath: string): Promise<boolean> {\n  const st = await stat(absPath).catch(() => null);\n  return st !== null && st.isFile();\n}\n\n// ---------------------------------------------------------------------------\n// Fork-mode id rewriting\n// ---------------------------------------------------------------------------\n\n/**\n * Rewrite a YAML-frontmatter `id:` field to a fork-scoped value.\n *\n * Strategy: we deliberately do NOT parse the entire YAML — memory files\n * use a deterministic top-of-file frontmatter delimited by `---` lines,\n * and the orchestrator's `parseFrontmatter` reads `id` as a top-level\n * key with a single-line scalar value. We mirror that contract:\n *\n *   - Detect a leading `---\\n` … `\\n---` block at the top of the file.\n *   - Within that block, locate the first `id:` line that is not nested\n *     under another key (cheap heuristic: line starts at column 0).\n *   - Replace its value with a new fork-id derived from `capsuleId` and\n *     a short random suffix (or {@link opts.now} when provided for tests).\n *\n * Files without a frontmatter block, or without an `id:` key inside one,\n * are returned unchanged with `rewrote: false`. This keeps non-memory\n * artifacts (READMEs, transcripts) byte-identical to the source.\n */\nfunction rewriteFrontmatterIdForFork(\n  content: string,\n  capsuleId: string,\n  now: number | undefined,\n): { content: string; rewrote: boolean } {\n  // Detect the dominant line ending in the file so we can preserve it when\n  // rebuilding the frontmatter delimiters. Splitting/joining on `\\n` silently\n  // drops `\\r` from CRLF files, changing the byte content (Cursor thread #741\n  // line 467). We detect the ending of the very first line (the opening `---`)\n  // and use that as the canonical separator for the reconstructed delimiters.\n  // All three cases are covered: CRLF (\\r\\n), LF (\\n), and bare CR (\\r).\n  const crlfMatch = /^---(\\r\\n|\\r|\\n)/.exec(content);\n  // Fall back to LF if the file starts with `---` but has no newline (EOF).\n  const eol = crlfMatch ? crlfMatch[1] : \"\\n\";\n\n  // Frontmatter block detection: `---` on its own line at the very start,\n  // followed by content, followed by `---` on its own line. The closing\n  // delimiter must be at column 0. We capture the trailing terminator\n  // (`\\r?\\n` or end-of-string) as a separate group so we can re-emit it\n  // verbatim, preserving CRLF/LF/EOF shape from the original file.\n  const fmMatch = /^---\\r?\\n([\\s\\S]*?)\\r?\\n---(\\r?\\n|$)/.exec(content);\n  if (!fmMatch) return { content, rewrote: false };\n  const fmBody = fmMatch[1];\n  const fmTrailer = fmMatch[2];\n  const fmStart = fmMatch.index;\n  const fmEnd = fmStart + fmMatch[0].length;\n\n  // Find a top-level `id:` line. Top-level means the line begins at\n  // column 0 inside the frontmatter body (no leading whitespace) and the\n  // key is exactly `id`. We deliberately accept `id:` and `id : ` shapes\n  // but reject `nested_id:` to avoid touching unrelated keys.\n  const idLineRe = /^id:[ \\t]*([^\\r\\n]*)$/m;\n  const idMatch = idLineRe.exec(fmBody);\n  if (!idMatch) return { content, rewrote: false };\n\n  const newId = mintForkId(capsuleId, idMatch[1]?.trim() ?? \"\", now);\n  const replacedBody = fmBody.replace(idLineRe, `id: ${newId}`);\n  // Reconstruct the file: original prefix (always empty here, fmStart === 0\n  // by the `^` anchor) + frontmatter delimiters around the rewritten body.\n  // Use the detected `eol` for the opening/closing `---` lines so that CRLF\n  // files remain CRLF and LF files remain LF, preserving byte-content fidelity\n  // (Cursor thread #741 line 467).  The captured `fmTrailer` (the newline\n  // immediately after the closing `---`, or end-of-string) is re-emitted\n  // verbatim so the byte immediately after the closing fence is unchanged.\n  const prefix = content.slice(0, fmStart);\n  const tail = content.slice(fmEnd);\n  const rebuilt = `${prefix}---${eol}${replacedBody}${eol}---${fmTrailer}${tail}`;\n  return { content: rebuilt, rewrote: true };\n}\n\n/**\n * Derive a deterministic-when-`now`-is-set fork id from the capsule id and\n * the original record id. Production callers omit `now` and get a UUID\n * suffix; tests pass `now` for byte-stable assertions.\n */\nfunction mintForkId(capsuleId: string, originalId: string, now: number | undefined): string {\n  const base = originalId.length > 0 ? originalId : \"fork\";\n  if (now === undefined) {\n    const suffix = randomUUID().slice(0, 8);\n    return `${base}-fork-${capsuleId}-${suffix}`;\n  }\n  // Deterministic suffix: short hash of (capsuleId, originalId, now). Using\n  // sha256 over a sorted-key serialization (gotcha #38) so the suffix does\n  // not depend on Object.entries order.\n  const payload = JSON.stringify({ c: capsuleId, i: originalId, n: now });\n  const suffix = createHash(\"sha256\").update(payload, \"utf-8\").digest(\"hex\").slice(0, 8);\n  return `${base}-fork-${capsuleId}-${suffix}`;\n}\n\n// Note: `CapsuleBlock` is re-exported here purely so callers that want to\n// inspect the manifest block don't have to deep-import from `./types.js`.\nexport type { CapsuleBlock };\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAAA,SAAS,OAAO,OAAO,UAAU,UAAU,MAAM,QAAQ,iBAAiB;AAC1E,OAAO,UAAU;AACjB,SAAS,YAAY,kBAAkB;AA+JvC,eAAsB,cACpB,MAC8B;AAC9B,QAAM,aAAa,KAAK,QAAQ,KAAK,WAAW;AAChD,QAAM,UAAU,KAAK,QAAQ,KAAK,IAAI;AACtC,QAAM,4BAA4B,SAAS,iBAAiB,MAAM;AAElE,QAAM,OAA0B,KAAK,QAAQ;AAI7C,MAAI,SAAS,UAAU,SAAS,eAAe,SAAS,QAAQ;AAC9D,UAAM,IAAI;AAAA,MACR,+BAA+B,KAAK,UAAU,IAAI,CAAC;AAAA,IACrD;AAAA,EACF;AAMA,QAAM,YAAY,MAAM,uBAAuB,UAAU;AACzD,MAAI;AACJ,MAAI,WAAW;AACb,QAAI,CAAC,KAAK,aAAa,CAAC,KAAK,YAAY;AACvC,YAAM,IAAI;AAAA,QACR;AAAA,MAIF;AAAA,IACF;AACA,UAAM,MAAM,2BAA2B,YAAY,KAAK,WAAW;AAAA,MACjE,YAAY,KAAK;AAAA,IACnB,CAAC;AAAA,EACH,OAAO;AACL,UAAM,MAAM,SAAS,UAAU;AAAA,EACjC;AACA,QAAM,OAAO,qBAAqB,KAAK,iBAAiB,UAAU;AAClE,MAAI;AACJ,MAAI;AACF,iBAAa,KAAK,MAAM,IAAI;AAAA,EAC9B,SAAS,OAAO;AACd,UAAM,IAAI;AAAA,MACR,0DAA0D,UAAU;AAAA,MACpE,EAAE,MAAsB;AAAA,IAC1B;AAAA,EACF;AAEA,QAAM,SAAS,kBAAkB,UAAU;AAC3C,MAAI,OAAO,mBAAmB,GAAG;AAK/B,UAAM,IAAI;AAAA,MACR;AAAA,IACF;AAAA,EACF;AACA,QAAM,SAAS,OAAO;AACtB,QAAM,WAAW,OAAO;AACxB,QAAM,UAAU,SAAS;AAKzB,QAAM,gBAAgB,oBAAI,IAA+C;AACzE,aAAW,KAAK,SAAS,OAAO;AAC9B,kBAAc,IAAI,EAAE,MAAM,CAAC;AAAA,EAC7B;AACA,MAAI,cAAc,SAAS,SAAS,MAAM,QAAQ;AAChD,UAAM,IAAI;AAAA,MACR;AAAA,IACF;AAAA,EACF;AACA,QAAM,cAAc,oBAAI,IAAY;AACpC,aAAW,OAAO,OAAO,SAAS;AAChC,QAAI,YAAY,IAAI,IAAI,IAAI,GAAG;AAC7B,YAAM,IAAI;AAAA,QACR,yDAAyD,IAAI,IAAI;AAAA,MACnE;AAAA,IACF;AACA,gBAAY,IAAI,IAAI,IAAI;AAAA,EAC1B;AAYA,QAAM,WAAW,MAAM,SAAS,OAAO,EAAE,MAAM,MAAM,OAAO;AAU5D,QAAM,kBAAkB,oBAAI,IAAoB;AAEhD,aAAW,OAAO,OAAO,SAAS;AAEhC,UAAM,QAAQ,cAAc,IAAI,IAAI,IAAI;AACxC,QAAI,CAAC,OAAO;AACV,YAAM,IAAI;AAAA,QACR,4EAA4E,IAAI,IAAI;AAAA,MACtF;AAAA,IACF;AACA,UAAM,EAAE,QAAQ,MAAM,IAAI,aAAa,IAAI,OAAO;AAClD,QAAI,WAAW,MAAM,UAAU,UAAU,MAAM,OAAO;AACpD,YAAM,IAAI;AAAA,QACR,gDAAgD,IAAI,IAAI,qBACnC,MAAM,MAAM,UAAU,MAAM,KAAK,gBACtC,MAAM,UAAU,KAAK;AAAA,MACvC;AAAA,IACF;AAkBA,QAAI,IAAI,KAAK,SAAS,IAAI,GAAG;AAC3B,YAAM,IAAI;AAAA,QACR,mGAAmG,IAAI,IAAI;AAAA,MAC7G;AAAA,IACF;AACA,UAAM,kBAAkB,KAAK,MAAM,UAAU,IAAI,IAAI;AACrD,QACE,IAAI,KAAK,WAAW,GAAG,KACvB,IAAI,KAAK,MAAM,GAAG,EAAE,KAAK,CAAC,QAAQ,QAAQ,IAAI,KAC9C,gBAAgB,WAAW,IAAI,KAC/B,gBAAgB,WAAW,GAAG,GAC9B;AACA,YAAM,IAAI;AAAA,QACR,mDAAmD,IAAI,IAAI;AAAA,MAC7D;AAAA,IACF;AAUA,UAAM,YAAY,kBAAkB,IAAI,MAAM,MAAM,QAAQ,EAAE;AAC9D,UAAM,YAAY,KAAK,KAAK,UAAU,iBAAiB,SAAS,CAAC;AACjE,QAAI,CAAC,iBAAiB,UAAU,SAAS,GAAG;AAC1C,YAAM,IAAI;AAAA,QACR,mDAAmD,IAAI,IAAI;AAAA,MAC7D;AAAA,IACF;AASA,UAAM,yBAAyB,UAAU,WAAW,IAAI,MAAM,eAAe;AAW7E,UAAM,cAAc,MAAM,MAAM,SAAS,EAAE,MAAM,MAAM,IAAI;AAC3D,QAAI,gBAAgB,QAAQ,YAAY,eAAe,GAAG;AACxD,YAAM,IAAI;AAAA,QACR,8EAA8E,IAAI,IAAI;AAAA,MACxF;AAAA,IACF;AAWA,UAAM,WAAW,UAAU,YAAY;AACvC,UAAM,kBAAkB,gBAAgB,IAAI,QAAQ;AACpD,QAAI,oBAAoB,QAAW;AACjC,YAAM,IAAI;AAAA,QACR,uFACM,eAAe,UAAU,IAAI,IAAI,kBAAkB,SAAS;AAAA,MACpE;AAAA,IACF;AACA,oBAAgB,IAAI,UAAU,IAAI,IAAI;AAAA,EACxC;AAEA,aAAW,KAAK,SAAS,OAAO;AAC9B,QAAI,CAAC,YAAY,IAAI,EAAE,IAAI,GAAG;AAC5B,YAAM,IAAI;AAAA,QACR,4EAA4E,EAAE,IAAI;AAAA,MACpF;AAAA,IACF;AAAA,EACF;AAKA,QAAM,WAA0C,CAAC;AACjD,QAAM,UAAwC,CAAC;AAO/C,QAAM,kBAAkB,KAAK,KAAK,UAAU,OAAO;AACnD,QAAM,oBAAoB,IAAI,iCAAiC;AAO/D,QAAM,mBAAmB,IAAI;AAAA,IAC3B,OAAO,QACJ,IAAI,CAAC,WAAW,kBAAkB,OAAO,MAAM,MAAM,QAAQ,EAAE,CAAC,EAChE,OAAO,CAAC,QAAQ,2BAA2B,UAAU,KAAK,KAAK,UAAU,iBAAiB,GAAG,CAAC,CAAC,MAAM,QAAQ,EAC7G,IAAI,CAAC,QAAQ,KAAK,SAAS,KAAK,KAAK,CAAC;AAAA,EAC3C;AAKA,QAAM,gBAAgB,CAAC,GAAG,OAAO,OAAO,EAAE;AAAA,IAAK,CAAC,GAAG,MACjD,EAAE,KAAK,cAAc,EAAE,IAAI;AAAA,EAC7B;AAMA,MAAI,kBAAkB;AACtB,QAAM,eAAe,YAA2B;AAChD,eAAW,OAAO,eAAe;AAC/B,YAAM,YAAY,kBAAkB,IAAI,MAAM,MAAM,QAAQ,EAAE;AAG9D,YAAM,YAAY,KAAK,KAAK,UAAU,iBAAiB,SAAS,CAAC;AAEjE,YAAM,SAAS,MAAM,aAAa,SAAS;AAO3C,WAAK,SAAS,UAAU,SAAS,WAAW,QAAQ;AAClD,gBAAQ,KAAK,EAAE,MAAM,IAAI,MAAM,QAAQ,SAAS,CAAC;AACjD;AAAA,MACF;AAEA,UAAI,cAAc;AAClB,UAAI,SAAS,eAAe,QAAQ;AAKlC,YAAI,KAAK,cAAc,KAAK,WAAW,SAAS;AAC9C,gBAAM,QAAQ,MAAM,SAAS,WAAW,OAAO,EAAE,MAAM,MAAM,EAAE;AAC/D,gBAAM;AAAA,YACJ;AAAA,YACA;AAAA,YACA;AAAA,YACA,KAAK;AAAA,YACL,KAAK;AAAA,YACL,mBAAmB,QAAQ,EAAE;AAAA,YAC7B;AAAA,UACF;AACA,wBAAc;AAAA,QAChB;AAAA,MACF;AAEA,UAAI,iBAAiB,IAAI;AACzB,UAAI,YAAY;AAChB,UAAI,SAAS,QAAQ;AACnB,cAAM,SAAS,4BAA4B,gBAAgB,QAAQ,IAAI,KAAK,GAAG;AAC/E,yBAAiB,OAAO;AACxB,oBAAY,OAAO;AAAA,MACrB;AAEA,YAAM,MAAM,KAAK,QAAQ,SAAS,GAAG,EAAE,WAAW,KAAK,CAAC;AAUxD,YAAM,aAAa,2BAA2B,UAAU,SAAS;AACjE,YAAM,SAAS,eAAe,WAAW,6BAA6B,cAAc,IAAI;AACxF,UAAI,eAAe,YAAY,WAAW,QAAQ,iBAAiB,IAAI,MAAM,GAAG;AAI9E,cAAM,UAAU,WAAW,gBAAgB,OAAO;AAClD,0BAAkB;AAAA,MACpB,WAAW,eAAe,UAAU;AAClC,cAAM,aAAa,kBAAkB,IAAI,eAAe;AACxD,cAAM,YAAY;AAClB,yBAAiB,iCAAiC,WAAW,UAAU;AAKvE,cAAM,gBAAgB,MAAM,SAAS,WAAW,OAAO,EAAE,MAAM,MAAM,IAAI;AACzE,cAAM,UAAU,WAAW,gBAAgB,OAAO;AAClD,YAAI;AACF,gBAAM,8BAA8B;AAAA,YAClC,UAAU;AAAA,YACV,OAAO;AAAA,YACP;AAAA,YACA,YAAY;AAAA,YACZ,aAAa;AAAA,YACb,SAAS,CAAC,YAAY,UAAU,WAAW,SAAS,OAAO;AAAA,UAC7D,CAAC;AAAA,QACH,SAAS,KAAK;AACZ,cAAI,kBAAkB,MAAM;AAC1B,kBAAM,OAAO,SAAS,EAAE,MAAM,MAAM,MAAS;AAAA,UAC/C,OAAO;AACL,kBAAM,UAAU,WAAW,eAAe,OAAO,EAAE,MAAM,MAAM,MAAS;AAAA,UAC1E;AACA,gBAAM;AAAA,QACR;AAAA,MACF,OAAO;AACL,cAAM,UAAU,WAAW,gBAAgB,OAAO;AAClD,YAAI,eAAe,UAAU;AAC3B,4BAAkB;AAAA,QACpB;AAAA,MACF;AAIA,oCAA8B,QAAQ;AACtC,eAAS,KAAK;AAAA,QACZ,YAAY,IAAI;AAAA,QAChB,YAAY;AAAA,QACZ;AAAA,QACA;AAAA,MACF,CAAC;AAAA,IACH;AAIA,QAAI,iBAAiB;AACnB,YAAM,kCAAkC,eAAe;AAAA,IACzD;AAAA,EACA;AACA,QAAM,gBAAgB,iBAAiB,OAAO,EAAE,KAAK,EAAE;AACvD,MAAI,kBAAkB,QAAW;AAC/B,UAAM,aAAa;AAAA,EACrB,OAAO;AACL,UAAM;AAAA,MACJ;AAAA,MACA,KAAK,KAAK,UAAU,YAAY,GAAG,aAAa,KAAK;AAAA,MACrD;AAAA,IACF;AAAA,EACF;AAGA,UAAQ,KAAK,CAAC,GAAG,MAAM,EAAE,KAAK,cAAc,EAAE,IAAI,CAAC;AAKnD,SAAO,EAAE,UAAU,SAAS,SAAS;AACvC;AAcA,SAAS,kBACP,aACA,MACA,WACQ;AACR,MAAI,SAAS,OAAQ,QAAO,SAAS,SAAS,IAAI,WAAW;AAC7D,SAAO;AACT;AAEA,eAAe,aAAa,SAAmC;AAC7D,QAAM,KAAK,MAAM,KAAK,OAAO,EAAE,MAAM,MAAM,IAAI;AAC/C,SAAO,OAAO,QAAQ,GAAG,OAAO;AAClC;AAwBA,SAAS,4BACP,SACA,WACA,KACuC;AAOvC,QAAM,YAAY,mBAAmB,KAAK,OAAO;AAEjD,QAAM,MAAM,YAAY,UAAU,CAAC,IAAI;AAOvC,QAAM,UAAU,uCAAuC,KAAK,OAAO;AACnE,MAAI,CAAC,QAAS,QAAO,EAAE,SAAS,SAAS,MAAM;AAC/C,QAAM,SAAS,QAAQ,CAAC;AACxB,QAAM,YAAY,QAAQ,CAAC;AAC3B,QAAM,UAAU,QAAQ;AACxB,QAAM,QAAQ,UAAU,QAAQ,CAAC,EAAE;AAMnC,QAAM,WAAW;AACjB,QAAM,UAAU,SAAS,KAAK,MAAM;AACpC,MAAI,CAAC,QAAS,QAAO,EAAE,SAAS,SAAS,MAAM;AAE/C,QAAM,QAAQ,WAAW,WAAW,QAAQ,CAAC,GAAG,KAAK,KAAK,IAAI,GAAG;AACjE,QAAM,eAAe,OAAO,QAAQ,UAAU,OAAO,KAAK,EAAE;AAQ5D,QAAM,SAAS,QAAQ,MAAM,GAAG,OAAO;AACvC,QAAM,OAAO,QAAQ,MAAM,KAAK;AAChC,QAAM,UAAU,GAAG,MAAM,MAAM,GAAG,GAAG,YAAY,GAAG,GAAG,MAAM,SAAS,GAAG,IAAI;AAC7E,SAAO,EAAE,SAAS,SAAS,SAAS,KAAK;AAC3C;AAOA,SAAS,WAAW,WAAmB,YAAoB,KAAiC;AAC1F,QAAM,OAAO,WAAW,SAAS,IAAI,aAAa;AAClD,MAAI,QAAQ,QAAW;AACrB,UAAMA,UAAS,WAAW,EAAE,MAAM,GAAG,CAAC;AACtC,WAAO,GAAG,IAAI,SAAS,SAAS,IAAIA,OAAM;AAAA,EAC5C;AAIA,QAAM,UAAU,KAAK,UAAU,EAAE,GAAG,WAAW,GAAG,YAAY,GAAG,IAAI,CAAC;AACtE,QAAM,SAAS,WAAW,QAAQ,EAAE,OAAO,SAAS,OAAO,EAAE,OAAO,KAAK,EAAE,MAAM,GAAG,CAAC;AACrF,SAAO,GAAG,IAAI,SAAS,SAAS,IAAI,MAAM;AAC5C;","names":["suffix"]}

package/dist/{chunk-BNQJKWWZ.js → chunk-K3FH3LAQ.js}

@@ -1,3 +1,6 @@
+import {
+  LcmWorkQueue
+} from "./chunk-QNN4FYBD.js";
 import {
   assembleCompressedHistoryWithTrace
 } from "./chunk-UXPUUL3G.js";
@@ -14,9 +17,6 @@ import {
 import {
   LcmDag
 } from "./chunk-7N4KAIGN.js";
-import {
-  LcmWorkQueue
-} from "./chunk-QNN4FYBD.js";
 import {
   nativeBindingRecoveryHint
 } from "./chunk-LD72P4YS.js";
@@ -768,4 +768,4 @@ export {
   extractLcmConfig,
   LcmEngine
 };
-//# sourceMappingURL=chunk-BNQJKWWZ.js.map
+//# sourceMappingURL=chunk-K3FH3LAQ.js.map

package/dist/{chunk-FJ2VJTGA.js → chunk-KHZVAISH.js}

@@ -5,7 +5,7 @@ import {
   citationTemplateFingerprint,
   isCachedIdentityReusable,
   isReconcileMemoryIdentity
-} from "./chunk-A7BM2JTH.js";
+} from "./chunk-AJHNXIQU.js";
 import {
   offlineSyncStorageForSnapshot
 } from "./chunk-TIGYOZBU.js";
@@ -250,4 +250,4 @@ export {
   retainExcludedClassifications,
   createOfflineSyncManifestStream
 };
-//# sourceMappingURL=chunk-FJ2VJTGA.js.map
+//# sourceMappingURL=chunk-KHZVAISH.js.map

package/dist/{chunk-WHQXWFH7.js → chunk-LT3CMO65.js}

@@ -3,7 +3,7 @@ import {
 } from "./chunk-KJTKLXTH.js";
 import {
   StorageManager
-} from "./chunk-WAD32CZG.js";
+} from "./chunk-ELWI2R6H.js";
 import {
   assertInjectedStorageRooted
 } from "./chunk-BNZAR6PO.js";
@@ -260,4 +260,4 @@ export {
   backupExistingLedger,
   rebuildMemoryLifecycleLedger
 };
-//# sourceMappingURL=chunk-WHQXWFH7.js.map
+//# sourceMappingURL=chunk-LT3CMO65.js.map

package/dist/{chunk-NUSAAN75.js → chunk-MHSBOEH7.js}

@@ -13,7 +13,7 @@ import {
 } from "./chunk-ZCUTSMR2.js";
 import {
   StorageManager
-} from "./chunk-WAD32CZG.js";
+} from "./chunk-ELWI2R6H.js";
 import {
   excludeSupportPassportPrivateMemories
 } from "./chunk-PWPIERBM.js";
@@ -134,4 +134,4 @@ export {
   runCodexMaterialize,
   runPostConsolidationMaterialize
 };
-//# sourceMappingURL=chunk-NUSAAN75.js.map
+//# sourceMappingURL=chunk-MHSBOEH7.js.map

package/dist/{chunk-KJCL2FZO.js → chunk-MNYQVYJ4.js}

@@ -2,7 +2,7 @@ import {
   WHO_KNOWS_DEFAULT_LIMIT,
   WHO_KNOWS_MAX_LIMIT,
   validateWhoKnowsInput
-} from "./chunk-FUOAIJKQ.js";
+} from "./chunk-Y43X3E24.js";
 
 // src/who-knows-cli.ts
 function extractWhoKnowsRawArgs(rest) {
@@ -74,4 +74,4 @@ export {
   renderWhoKnowsText,
   renderWhoKnows
 };
-//# sourceMappingURL=chunk-KJCL2FZO.js.map
+//# sourceMappingURL=chunk-MNYQVYJ4.js.map

package/dist/{chunk-RZH5RVJC.js → chunk-MTTYIXSU.js}

@@ -5,7 +5,7 @@ import {
 import {
   TAG_LIMITS,
   composeMemoryEnvelope
-} from "./chunk-JRVMCZE3.js";
+} from "./chunk-QEYTRFR3.js";
 import {
   isTombstoneBlockedCaptureWriteLockBusy
 } from "./chunk-YET735EZ.js";
@@ -789,4 +789,4 @@ export {
   shouldProcessInlineExplicitCapture,
   InlineExplicitCaptureProcessor
 };
-//# sourceMappingURL=chunk-RZH5RVJC.js.map
+//# sourceMappingURL=chunk-MTTYIXSU.js.map

package/dist/{chunk-FVRTCYZ3.js → chunk-MVOJDLXS.js}

@@ -1,6 +1,6 @@
 import {
   StorageManager
-} from "./chunk-WAD32CZG.js";
+} from "./chunk-ELWI2R6H.js";
 import {
   getCachedRuleMemories,
   setCachedRuleMemories
@@ -119,4 +119,4 @@ export {
   compareVerifiedSemanticRuleResults,
   searchVerifiedSemanticRules
 };
-//# sourceMappingURL=chunk-FVRTCYZ3.js.map
+//# sourceMappingURL=chunk-MVOJDLXS.js.map

package/dist/{chunk-KESJ5XX3.js → chunk-MYCCO6AA.js}

@@ -1,6 +1,6 @@
 import {
   StorageManager
-} from "./chunk-WAD32CZG.js";
+} from "./chunk-ELWI2R6H.js";
 import {
   keyring_exports,
   secureStoreDir
@@ -416,4 +416,4 @@ export {
   resolveNamespaceStorageRoot,
   NamespaceStorageRouter
 };
-//# sourceMappingURL=chunk-KESJ5XX3.js.map
+//# sourceMappingURL=chunk-MYCCO6AA.js.map

package/dist/{chunk-66JOLMWS.js → chunk-MZCGHPIJ.js}

@@ -3,7 +3,7 @@ import {
 } from "./chunk-B7RWBZXW.js";
 import {
   resolveCausalTrajectoryStoreDir
-} from "./chunk-6L63IN3M.js";
+} from "./chunk-VEFGHRKV.js";
 import {
   normalizeRecallTokens
 } from "./chunk-YCVB7X56.js";
@@ -339,4 +339,4 @@ export {
   scoreStitchCandidate,
   stitchCausalChain
 };
-//# sourceMappingURL=chunk-66JOLMWS.js.map
+//# sourceMappingURL=chunk-MZCGHPIJ.js.map

package/dist/{chunk-B4ZU34JQ.js → chunk-N6II66E5.js}

@@ -7,10 +7,10 @@ import {
 import {
   listMemoryGovernanceRuns,
   readMemoryGovernanceRunArtifact
-} from "./chunk-GCAQ3VUJ.js";
+} from "./chunk-VCVEMQJK.js";
 import {
   StorageManager
-} from "./chunk-WAD32CZG.js";
+} from "./chunk-ELWI2R6H.js";
 import {
   normalizeProjectionPreview,
   normalizeProjectionTags
@@ -1156,4 +1156,4 @@ export {
   verifyMemoryProjection,
   repairMemoryProjection
 };
-//# sourceMappingURL=chunk-B4ZU34JQ.js.map
+//# sourceMappingURL=chunk-N6II66E5.js.map

package/dist/{chunk-BK7AJUWB.js → chunk-NIV7RPWQ.js}

@@ -1,7 +1,7 @@
 import {
   buildStandup,
   parseStandupDate
-} from "./chunk-HQGATKG2.js";
+} from "./chunk-3KGCHTTK.js";
 import {
   backfillMemoryStorage,
   runLocationBackfill,
@@ -9,23 +9,23 @@ import {
   runLocationDay,
   runLocationStatus,
   runLocationSync
-} from "./chunk-XHGYZRVW.js";
+} from "./chunk-OSTFDWZJ.js";
 import {
   externalWikiSearchOperation
-} from "./chunk-K6RTQZA4.js";
+} from "./chunk-6DANGCMO.js";
 import {
   DECISION_SUBCOMMANDS,
   DELTA_SUBCOMMANDS,
   defineOperation,
   isCodegraphToolName
-} from "./chunk-6LCWKS62.js";
+} from "./chunk-HVFX2N2G.js";
 import {
   CorrectionContractError
 } from "./chunk-ETSJD5IV.js";
 import {
   memoryStoreRequestSchema,
   retainedCategoryAlias
-} from "./chunk-HWHNQVRV.js";
+} from "./chunk-GYNRNKMW.js";
 import {
   serializeMutations,
   withHeldFileLock
@@ -1916,4 +1916,4 @@ export {
   codegraphIngestTracesOperation,
   REGISTERED_OPERATIONS
 };
-//# sourceMappingURL=chunk-BK7AJUWB.js.map
+//# sourceMappingURL=chunk-NIV7RPWQ.js.map

package/dist/{chunk-TLHF75OR.js → chunk-O55AGDTI.js}

@@ -3,7 +3,7 @@ import {
   readNamespaceMaintenanceLastRanStatuses,
   readNamespaceMaintenanceStatuses,
   runNamespaceMaintenancePlan
-} from "./chunk-6QYPL6NI.js";
+} from "./chunk-V45TEVDA.js";
 import {
   analyzeSessionIntegrity,
   applySessionRepair,
@@ -14,7 +14,7 @@ import {
 } from "./chunk-CMTINOFS.js";
 import {
   summarizeCorpusAndReplica
-} from "./chunk-4EACCIPO.js";
+} from "./chunk-UHPHH74F.js";
 import {
   readJudgeVerdictStats
 } from "./chunk-OZKOPQCM.js";
@@ -38,26 +38,26 @@ import {
 } from "./chunk-YBPYIAA5.js";
 import {
   parseConfig
-} from "./chunk-T6T2RMWW.js";
+} from "./chunk-23B4HLWG.js";
 import {
   readAggregateExtractionWatermark
-} from "./chunk-EBOHFZI4.js";
+} from "./chunk-E5QEF3JO.js";
 import {
   listMemoryGovernanceRuns,
   readMemoryGovernanceRunArtifact
-} from "./chunk-GCAQ3VUJ.js";
+} from "./chunk-VCVEMQJK.js";
 import {
   listNamespaces
-} from "./chunk-HPFVZPRH.js";
+} from "./chunk-FK4WC6VK.js";
 import {
   analyzeGraphHealth
-} from "./chunk-BFBS7OFQ.js";
+} from "./chunk-DC55RIEZ.js";
 import {
   summarizeExtractionLiveness
 } from "./chunk-AWD36R4D.js";
 import {
   StorageManager
-} from "./chunk-WAD32CZG.js";
+} from "./chunk-ELWI2R6H.js";
 import {
   lintWorkspaceFiles
 } from "./chunk-DM2T26WE.js";
@@ -1069,7 +1069,7 @@ async function summarizeBufferSurpriseDistribution(storage, config) {
   }
 }
 async function summarizeGraphEdgeDecayStatus(config) {
-  const { readGraphEdgeDecayStatus } = await import("./graph-edge-decay-CXTNJ7IQ.js");
+  const { readGraphEdgeDecayStatus } = await import("./graph-edge-decay-EKWXRBWF.js");
   const { graphEdgeDecayEnabled } = config;
   const enabled = graphEdgeDecayEnabled === true;
   if (!enabled) {
@@ -1683,4 +1683,4 @@ export {
   runBenchmarkRecall,
   runOperatorRepair
 };
-//# sourceMappingURL=chunk-TLHF75OR.js.map
+//# sourceMappingURL=chunk-O55AGDTI.js.map

package/dist/{chunk-GGJFRVRD.js → chunk-OMYRPMQC.js}

@@ -2,7 +2,7 @@ import {
   SupportPassportError,
   SupportPassportOwnerCreateGrantRequestSchema,
   getOperation
-} from "./chunk-6LCWKS62.js";
+} from "./chunk-HVFX2N2G.js";
 
 // src/support-passport/access-http.ts
 var OWNER_ROOT = "/engram/v1/support-passport";
@@ -137,4 +137,4 @@ export {
   SUPPORT_PASSPORT_OWNER_HTTP_ROUTES,
   handleSupportPassportOwnerHttp
 };
-//# sourceMappingURL=chunk-GGJFRVRD.js.map
+//# sourceMappingURL=chunk-OMYRPMQC.js.map

package/dist/{chunk-SVCHO337.js → chunk-ONN2E5QD.js}

@@ -1,25 +1,25 @@
 import {
   ExtractionDrain,
   TurnIngestionCoordinator
-} from "./chunk-AYTDCMEL.js";
+} from "./chunk-H4D5YURJ.js";
 import {
   headerConnector,
   renderExtractionConversation,
   resolveSourceConnector
-} from "./chunk-QZBTIYKD.js";
+} from "./chunk-DM4RRTN7.js";
 import {
   SmartBuffer
-} from "./chunk-XYP5WBDO.js";
+} from "./chunk-SGHV6LZ7.js";
 import {
   shouldSkipImplicitExtraction
-} from "./chunk-RZH5RVJC.js";
+} from "./chunk-MTTYIXSU.js";
 import {
   selfDeps
-} from "./chunk-WAD32CZG.js";
+} from "./chunk-ELWI2R6H.js";
 import {
   describeError,
   groupTurnsByExtractionScope
-} from "./chunk-4KLQI3L2.js";
+} from "./chunk-WLNWFHX3.js";
 import {
   resolveMemoryLifecycleCapabilities
 } from "./chunk-C5LWPYS3.js";
@@ -46,38 +46,41 @@ var ClaimBufferStorage = class {
     this.claims = claims;
     this.key = key;
     this.ownerId = ownerId;
-    this.entry = entry;
+    this.seen = entry;
   }
   claims;
   key;
   ownerId;
-  entry;
+  seen;
   async loadBuffer() {
     const entries = /* @__PURE__ */ Object.create(null);
     entries[this.key] = {
-      turns: this.entry.turns,
-      retainedTurns: this.entry.retainedTurns,
-      lastExtractionAt: this.entry.lastExtractionAt,
-      extractionCount: this.entry.extractionCount
+      turns: this.seen.turns,
+      retainedTurns: this.seen.retainedTurns,
+      lastExtractionAt: this.seen.lastExtractionAt,
+      extractionCount: this.seen.extractionCount
     };
     return {
-      turns: this.entry.turns,
-      lastExtractionAt: this.entry.lastExtractionAt,
-      extractionCount: this.entry.extractionCount,
+      turns: this.seen.turns,
+      lastExtractionAt: this.seen.lastExtractionAt,
+      extractionCount: this.seen.extractionCount,
       entries
     };
   }
   async saveBuffer(state) {
     const entry = state.entries?.[this.key];
-    await this.claims.writeEntry(
-      this.key,
-      this.ownerId,
-      entry ?? { turns: [], lastExtractionAt: null, extractionCount: 0 },
-      this.entry
-    );
+    await this.writeProgress(entry ?? { turns: [], lastExtractionAt: null, extractionCount: 0 });
   }
   async saveBufferSession(key, entry) {
-    await this.claims.writeEntry(key, this.ownerId, entry, key === this.key ? this.entry : void 0);
+    if (key !== this.key) {
+      await this.claims.writeEntry(key, this.ownerId, entry, void 0);
+      return;
+    }
+    await this.writeProgress(entry);
+  }
+  async writeProgress(entry) {
+    await this.claims.writeEntry(this.key, this.ownerId, entry, this.seen);
+    this.seen = { ...entry, turns: [...entry.turns], retainedTurns: entry.retainedTurns ? [...entry.retainedTurns] : void 0 };
   }
   async deleteBufferSession() {
   }
@@ -330,12 +333,18 @@ function drainAbortSignal(callerSignal, abort) {
   return callerSignal ? AbortSignal.any([callerSignal, abort.signal]) : abort.signal;
 }
 async function runClaimDrain(ctx, options, heartbeat) {
+  const reconcileDrainedTurns = async () => {
+    const drained = await ctx.claims.drainedTurnsForOwner(ctx.key, ctx.ownerId);
+    if (drained !== null) await ctx.orchestrator.buffer.save({ key: ctx.key, drained });
+  };
   if (ctx.turns.length === 0) {
+    await reconcileDrainedTurns();
     const outcome2 = await ackEmptyClaim(ctx.claims, ctx.key, ctx.ownerId, ctx.turnsAtStart);
     options.onEvent?.({ type: "session_finished", key: ctx.key, outcome: outcome2 });
     return outcome2;
   }
   const { groupOutcomes, groupError } = await drainScopeGroups(ctx);
+  await reconcileDrainedTurns();
   const remaining = await ctx.claims.load(ctx.key);
   const { status, reason, turnsRemaining } = await settleDrainVerdict(
     ctx.claims,
@@ -440,4 +449,4 @@ export {
   ClaimBufferStorage,
   BufferDrainRunner
 };
-//# sourceMappingURL=chunk-SVCHO337.js.map
+//# sourceMappingURL=chunk-ONN2E5QD.js.map