@remnic/core 9.15.3 → 9.16.1

package/dist/write-envelope.d.ts

@@ -1,4 +1,4 @@
-import { w as MemoryCategory } from './types-2q_MRFcM.js';
+import { w as MemoryCategory } from './types-OUCJALBK.js';
 import './message-parts/index.js';
 import './bounded-jsonl-state.js';
 import './types-continuity.js';

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@remnic/core",
-  "version": "9.15.3",
+  "version": "9.16.1",
   "description": "Framework-agnostic Remnic memory engine — orchestrator, storage, extraction, search, trust zones",
   "type": "module",
   "main": "dist/index.js",
@@ -3045,7 +3045,7 @@
     "core"
   ],
   "peerDependencies": {
-    "@remnic/coding-graph": "^9.15.3"
+    "@remnic/coding-graph": "^9.16.1"
   },
   "peerDependenciesMeta": {
     "@remnic/coding-graph": {

package/src/activity/config.test.ts

@@ -0,0 +1,113 @@
+import assert from "node:assert/strict";
+import test from "node:test";
+
+import { parseActivityConfig } from "./config.js";
+
+test("parseActivityConfig defaults to an inert configuration", () => {
+  assert.deepEqual(parseActivityConfig(undefined), {
+    enabled: false,
+    timezone: "UTC",
+    syncDays: 1,
+    autoSyncIntervalMinutes: 15,
+    sources: [],
+  });
+});
+
+test("parseActivityConfig treats a string false gate as disabled", () => {
+  assert.equal(parseActivityConfig({ enabled: "false" }).enabled, false);
+});
+
+test("parseActivityConfig preserves explicit source settings", () => {
+  assert.deepEqual(
+    parseActivityConfig({
+      enabled: true,
+      timezone: "America/Chicago",
+      syncDays: 3,
+      sources: [{ machineLabel: "fixture-machine", baseUrl: "http://127.0.0.1:4319", token: "fixture-token" }],
+    }),
+    {
+      enabled: true,
+      timezone: "America/Chicago",
+      syncDays: 3,
+      autoSyncIntervalMinutes: 15,
+      sources: [{ machineLabel: "fixture-machine", baseUrl: "http://127.0.0.1:4319", token: "fixture-token" }],
+    },
+  );
+});
+
+test("parseActivityConfig rejects enabled configurations without valid source definitions", () => {
+  assert.throws(() => parseActivityConfig({ enabled: true, sources: [] }), /at least one source/);
+  assert.throws(
+    () => parseActivityConfig({ enabled: true, sources: [{ machineLabel: "fixture", baseUrl: "ftp://example.test" }] }),
+    /HTTP or HTTPS/,
+  );
+  assert.throws(() => parseActivityConfig({ syncDays: 0 }), /syncDays/);
+});
+
+test("parseActivityConfig enforces both ends of the syncDays range", () => {
+  assert.equal(parseActivityConfig({ syncDays: 90 }).syncDays, 90);
+  assert.equal(parseActivityConfig({ syncDays: 1 }).syncDays, 1);
+  assert.throws(() => parseActivityConfig({ syncDays: 91 }), /syncDays must be an integer from 1 to 90/);
+  assert.throws(() => parseActivityConfig({ syncDays: 0 }), /syncDays must be an integer from 1 to 90/);
+});
+
+test("parseActivityConfig rejects an invalid IANA timezone at parse time", () => {
+  assert.throws(() => parseActivityConfig({ timezone: "Not/AZone" }), /Invalid IANA timezone/);
+});
+
+test("parseActivityConfig rejects a whitespace-only machineLabel before any sync", () => {
+  assert.throws(
+    () => parseActivityConfig({ enabled: true, sources: [{ machineLabel: "   ", baseUrl: "http://127.0.0.1:4319" }] }),
+    /machineLabel must not be blank/,
+  );
+});
+
+test("parseActivityConfig rejects duplicate machine labels that would share a cursor", () => {
+  assert.throws(
+    () =>
+      parseActivityConfig({
+        enabled: true,
+        sources: [
+          { machineLabel: "dup", baseUrl: "http://127.0.0.1:4319" },
+          { machineLabel: "dup", baseUrl: "http://127.0.0.1:4320" },
+        ],
+      }),
+    /machineLabel must be unique/,
+  );
+});
+
+test("parseActivityConfig reports a malformed baseUrl with a prefixed validation error", () => {
+  assert.throws(
+    () => parseActivityConfig({ enabled: true, sources: [{ machineLabel: "fixture", baseUrl: "not a url" }] }),
+    /activity source baseUrl must be a valid URL/,
+  );
+});
+
+test("parseActivityConfig rejects a non-loopback baseUrl that could exfiltrate the token", () => {
+  assert.throws(
+    () => parseActivityConfig({ enabled: true, sources: [{ machineLabel: "fixture", baseUrl: "https://example.test" }] }),
+    /must target a loopback host/,
+  );
+});
+
+test("parseActivityConfig accepts localhost and 127.x loopback hosts", () => {
+  assert.equal(
+    parseActivityConfig({ enabled: true, sources: [{ machineLabel: "a", baseUrl: "http://localhost:4319" }] }).sources
+      .length,
+    1,
+  );
+  assert.equal(
+    parseActivityConfig({ enabled: true, sources: [{ machineLabel: "b", baseUrl: "http://127.0.0.5:4319" }] }).sources
+      .length,
+    1,
+  );
+});
+
+test("parseActivityConfig parses and bounds autoSyncIntervalMinutes", () => {
+  assert.equal(parseActivityConfig(undefined).autoSyncIntervalMinutes, 15);
+  assert.equal(parseActivityConfig({ autoSyncIntervalMinutes: "30" }).autoSyncIntervalMinutes, 30);
+  assert.equal(parseActivityConfig({ autoSyncIntervalMinutes: 1 }).autoSyncIntervalMinutes, 1);
+  assert.equal(parseActivityConfig({ autoSyncIntervalMinutes: 1440 }).autoSyncIntervalMinutes, 1440);
+  assert.throws(() => parseActivityConfig({ autoSyncIntervalMinutes: 0 }), /autoSyncIntervalMinutes must be an integer from 1 to 1440/);
+  assert.throws(() => parseActivityConfig({ autoSyncIntervalMinutes: 1441 }), /autoSyncIntervalMinutes must be an integer from 1 to 1440/);
+});

package/src/activity/config.ts

@@ -0,0 +1,111 @@
+import { coerceBooleanLike, coerceNumber } from "../connectors/coerce.js";
+import { assertValidTimezone } from "./digest.js";
+import type { ActivityConfig, ActivitySourceConfig } from "./types.js";
+
+function asRecord(value: unknown, name: string): Record<string, unknown> {
+  if (typeof value !== "object" || value === null || Array.isArray(value)) {
+    throw new TypeError(`${name} must be an object`);
+  }
+  return value as Record<string, unknown>;
+}
+
+function optionalString(value: unknown, name: string): string | undefined {
+  if (value === undefined) return undefined;
+  if (typeof value !== "string" || value.length === 0) throw new TypeError(`${name} must be a non-empty string`);
+  return value;
+}
+
+const LOOPBACK_HOSTS: Record<string, true> = { localhost: true, "127.0.0.1": true, "::1": true };
+
+/**
+ * Parse, protocol-check, and confine an activity source base URL to a local
+ * loopback host. Shared with ActivityHttpSourceClient so config-load and client
+ * construction reject the exact same shapes with the same prefixed message (a
+ * bare `new URL()` throws an opaque TypeError on malformed input). The bearer
+ * token travels in an Authorization header, so a non-loopback baseUrl would
+ * exfiltrate it; the subsystem contract is local capture daemons only.
+ */
+export function validateActivityBaseUrl(baseUrl: string): URL {
+  let parsed: URL;
+  try {
+    parsed = new URL(baseUrl);
+  } catch {
+    throw new RangeError(`activity source baseUrl must be a valid URL: ${baseUrl}`);
+  }
+  if (parsed.protocol !== "http:" && parsed.protocol !== "https:") {
+    throw new RangeError("activity source baseUrl must use HTTP or HTTPS");
+  }
+  // URL keeps IPv6 hosts bracketed (e.g. "[::1]"); normalize before the lookup.
+  const host = parsed.hostname.replace(/^\[|\]$/g, "");
+  if (LOOPBACK_HOSTS[host] !== true && !/^127\.\d{1,3}\.\d{1,3}\.\d{1,3}$/.test(host)) {
+    throw new RangeError(`activity source baseUrl must target a loopback host (got ${parsed.hostname})`);
+  }
+  return parsed;
+}
+
+function parseSource(value: unknown): ActivitySourceConfig {
+  const raw = asRecord(value, "activity source");
+  const machineLabel = optionalString(raw.machineLabel, "activity source machineLabel");
+  const baseUrl = optionalString(raw.baseUrl, "activity source baseUrl");
+  if (machineLabel === undefined || baseUrl === undefined) {
+    throw new TypeError("activity source requires machineLabel and baseUrl");
+  }
+  // Reject whitespace-only labels here so config-load fails loudly rather than
+  // parsing clean and then failing on the first sync (the client and pipeline
+  // both reject a blank label via trim()).
+  if (machineLabel.trim().length === 0) {
+    throw new RangeError("activity source machineLabel must not be blank");
+  }
+  validateActivityBaseUrl(baseUrl);
+  const token = optionalString(raw.token, "activity source token");
+  return { machineLabel, baseUrl, ...(token === undefined ? {} : { token }) };
+}
+
+export function parseActivityConfig(raw: unknown): ActivityConfig {
+  if (raw === undefined || raw === null) {
+    return { enabled: false, timezone: "UTC", syncDays: 1, autoSyncIntervalMinutes: 15, sources: [] };
+  }
+  const config = asRecord(raw, "activity");
+  const enabledValue = coerceBooleanLike(config.enabled, "activity.enabled");
+  if (config.enabled !== undefined && enabledValue === undefined) {
+    throw new TypeError("activity.enabled must be a boolean");
+  }
+  const timezone = optionalString(config.timezone, "activity.timezone") ?? "UTC";
+  // Validate the IANA zone at parse so a typo fails before any daemon is
+  // contacted; otherwise activityDayWindow() throws mid-sync after snapshot
+  // pages may already be persisted, and every retry replays the same window.
+  assertValidTimezone(timezone);
+  const syncDaysValue = coerceNumber(config.syncDays, "activity.syncDays");
+  if (config.syncDays !== undefined && syncDaysValue === undefined) {
+    throw new TypeError("activity.syncDays must be a finite number");
+  }
+  const syncDays = syncDaysValue ?? 1;
+  if (!Number.isInteger(syncDays) || syncDays < 1 || syncDays > 90) {
+    throw new RangeError("activity.syncDays must be an integer from 1 to 90");
+  }
+  const intervalValue = coerceNumber(config.autoSyncIntervalMinutes, "activity.autoSyncIntervalMinutes");
+  if (config.autoSyncIntervalMinutes !== undefined && intervalValue === undefined) {
+    throw new TypeError("activity.autoSyncIntervalMinutes must be a finite number");
+  }
+  const autoSyncIntervalMinutes = intervalValue ?? 15;
+  if (!Number.isInteger(autoSyncIntervalMinutes) || autoSyncIntervalMinutes < 1 || autoSyncIntervalMinutes > 1440) {
+    throw new RangeError("activity.autoSyncIntervalMinutes must be an integer from 1 to 1440");
+  }
+  if (config.sources !== undefined && !Array.isArray(config.sources)) {
+    throw new TypeError("activity.sources must be an array");
+  }
+  const sources = (config.sources ?? []).map(parseSource);
+  // Cursors and row dedup are keyed on machineLabel alone; two sources sharing
+  // a label would share a cursor and dedup namespace, silently skipping or
+  // conflating snapshots. Reject the collision at parse.
+  const labels = new Set<string>();
+  for (const source of sources) {
+    if (labels.has(source.machineLabel)) {
+      throw new RangeError(`activity source machineLabel must be unique: ${source.machineLabel}`);
+    }
+    labels.add(source.machineLabel);
+  }
+  const enabled = enabledValue ?? false;
+  if (enabled && sources.length === 0) throw new RangeError("activity.enabled requires at least one source");
+  return { enabled, timezone, syncDays, autoSyncIntervalMinutes, sources };
+}

package/src/activity/digest.ts

@@ -55,11 +55,11 @@ function timezoneOffsetIso(instant: Date, timezone: string): string {
   return match?.[1] ?? "+00:00";
 }
 
-function assertValidTimezone(timezone: string): void {
+export function assertValidTimezone(timezone: string): void {
   try {
     new Intl.DateTimeFormat("en-US", { timeZone: timezone });
   } catch {
-    throw new RangeError(`Invalid IANA timezone "${timezone}" for the activity digest.`);
+    throw new RangeError(`Invalid IANA timezone "${timezone}".`);
   }
 }
 

package/src/activity/index.ts

@@ -7,3 +7,9 @@
 export * from "./types.js";
 export * from "./store.js";
 export * from "./digest.js";
+export * from "./pipeline.js";
+export * from "./source-client.js";
+export * from "./runner.js";
+export * from "./scheduler.js";
+export * from "./config.js";
+export * from "./reindex.js";

package/src/activity/pipeline.test.ts

@@ -0,0 +1,379 @@
+import assert from "node:assert/strict";
+import { access, mkdtemp, readFile, rm } from "node:fs/promises";
+import os from "node:os";
+import path from "node:path";
+import test from "node:test";
+
+import { activityDigestPath } from "./digest.js";
+import { activityCursorKey, syncActivitySource } from "./pipeline.js";
+import { ActivityStore } from "./store.js";
+import type { ActivitySnapshot, ActivitySourceClient } from "./types.js";
+
+function snapshot(overrides: Partial<ActivitySnapshot> = {}): ActivitySnapshot {
+  return {
+    machine: "untrusted-source-value",
+    capturedAtUtc: "2026-07-22T14:00:00.000Z",
+    app: "Browser",
+    windowTitle: "Example",
+    text: "A synthetic activity snapshot",
+    textSource: "ax",
+    contentHash: "hash-1",
+    ...overrides,
+  };
+}
+
+function source(
+  machineLabel: string,
+  pages: Map<string | null, ActivitySnapshot[]>,
+  cursors: Map<string | null, string | null>,
+): ActivitySourceClient {
+  return {
+    machineLabel,
+    async verify() {
+      return { ok: true };
+    },
+    async fetchSnapshots({ cursor }) {
+      return { snapshots: pages.get(cursor ?? null) ?? [], nextCursor: cursors.get(cursor ?? null) ?? null };
+    },
+  };
+}
+
+test("syncActivitySource persists every page, renders the digest, then advances the cursor", async () => {
+  const memoryDir = await mkdtemp(path.join(os.tmpdir(), "remnic-activity-pipeline-"));
+  const store = ActivityStore.open(memoryDir);
+  try {
+    const client = source(
+      "workstation-a",
+      new Map([
+        [null, [snapshot()]],
+        ["cursor-1", [snapshot({ capturedAtUtc: "2026-07-22T14:01:00.000Z", contentHash: "hash-2" })]],
+      ]),
+      new Map([
+        [null, "cursor-1"],
+        ["cursor-1", "cursor-2"],
+      ]),
+    );
+
+    const result = await syncActivitySource(client, { date: "2026-07-22", timezone: "UTC", memoryDir, store });
+
+    assert.deepEqual(result, {
+      machine: "workstation-a",
+      fetched: 2,
+      inserted: 2,
+      duplicates: 0,
+      cursor: "cursor-2",
+      digestWritten: true,
+    });
+    assert.equal(store.getCursor(activityCursorKey("workstation-a", "2026-07-22")), "cursor-2");
+    assert.deepEqual(
+      store.listSnapshotsForDay(null, "2026-07-22T00:00:00.000Z", "2026-07-23T00:00:00.000Z").map((item) => item.machine),
+      ["workstation-a", "workstation-a"],
+      "the source identity, not a remote payload label, owns the persisted machine field",
+    );
+    assert.match(await readFile(activityDigestPath(memoryDir, "2026-07-22"), "utf8"), /snapshotCount: 2/);
+  } finally {
+    store.close();
+    await rm(memoryDir, { recursive: true, force: true });
+  }
+});
+
+test("syncActivitySource leaves the cursor unchanged when a later page cannot persist", async () => {
+  const memoryDir = await mkdtemp(path.join(os.tmpdir(), "remnic-activity-pipeline-"));
+  const store = ActivityStore.open(memoryDir);
+  try {
+    const client = source(
+      "workstation-a",
+      new Map([
+        [null, [snapshot()]],
+        ["cursor-1", [snapshot({ capturedAtUtc: "not-a-timestamp", contentHash: "bad-hash" })]],
+      ]),
+      new Map([
+        [null, "cursor-1"],
+        ["cursor-1", "cursor-2"],
+      ]),
+    );
+
+    await assert.rejects(
+      syncActivitySource(client, { date: "2026-07-22", timezone: "UTC", memoryDir, store }),
+      /capture timestamp/,
+    );
+
+    assert.equal(store.getCursor(activityCursorKey("workstation-a", "2026-07-22")), null);
+    assert.equal(store.listSnapshotsForDay(null, "2026-07-22T00:00:00.000Z", "2026-07-23T00:00:00.000Z").length, 1);
+  } finally {
+    store.close();
+    await rm(memoryDir, { recursive: true, force: true });
+  }
+});
+
+test("syncActivitySource completes normally when the final page lands on the page cap", async () => {
+  const memoryDir = await mkdtemp(path.join(os.tmpdir(), "remnic-activity-pipeline-"));
+  const store = ActivityStore.open(memoryDir);
+  try {
+    const client = source(
+      "workstation-a",
+      new Map([
+        [null, [snapshot()]],
+        ["cursor-1", [snapshot({ capturedAtUtc: "2026-07-22T14:01:00.000Z", contentHash: "hash-2" })]],
+      ]),
+      new Map([
+        [null, "cursor-1"],
+        ["cursor-1", null],
+      ]),
+    );
+
+    // Two pages with a page budget of exactly two: the terminal null cursor
+    // arrives on the last allowed page, which must not be treated as a runaway.
+    const result = await syncActivitySource(client, { date: "2026-07-22", timezone: "UTC", memoryDir, store, maxPages: 2 });
+    assert.equal(result.inserted, 2);
+    assert.equal(result.cursor, "cursor-1");
+    assert.equal(store.getCursor(activityCursorKey("workstation-a", "2026-07-22")), "cursor-1");
+  } finally {
+    store.close();
+    await rm(memoryDir, { recursive: true, force: true });
+  }
+});
+
+test("syncActivitySource rejects runaway pagination and leaves the cursor unadvanced", async () => {
+  const memoryDir = await mkdtemp(path.join(os.tmpdir(), "remnic-activity-pipeline-"));
+  const store = ActivityStore.open(memoryDir);
+  try {
+    let issued = 0;
+    const runaway: ActivitySourceClient = {
+      machineLabel: "workstation-a",
+      async verify() {
+        return { ok: true };
+      },
+      async fetchSnapshots() {
+        issued += 1;
+        return { snapshots: [], nextCursor: `cursor-${issued}` };
+      },
+    };
+
+    await assert.rejects(
+      syncActivitySource(runaway, { date: "2026-07-22", timezone: "UTC", memoryDir, store, maxPages: 3 }),
+      /exceeded 3 pages/,
+    );
+    assert.equal(store.getCursor(activityCursorKey("workstation-a", "2026-07-22")), null);
+  } finally {
+    store.close();
+    await rm(memoryDir, { recursive: true, force: true });
+  }
+});
+
+test("concurrent same-day syncs from two sources persist without corrupting the digest", async () => {
+  const memoryDir = await mkdtemp(path.join(os.tmpdir(), "remnic-activity-pipeline-"));
+  const store = ActivityStore.open(memoryDir);
+  try {
+    const clientA = source("workstation-a", new Map([[null, [snapshot({ contentHash: "a-1" })]]]), new Map([[null, null]]));
+    const clientB = source("workstation-b", new Map([[null, [snapshot({ contentHash: "b-1" })]]]), new Map([[null, null]]));
+
+    await Promise.all([
+      syncActivitySource(clientA, { date: "2026-07-22", timezone: "UTC", memoryDir, store }),
+      syncActivitySource(clientB, { date: "2026-07-22", timezone: "UTC", memoryDir, store }),
+    ]);
+
+    const digest = await readFile(activityDigestPath(memoryDir, "2026-07-22"), "utf8");
+    assert.match(digest, /kind: activity-digest/);
+    assert.match(digest, /snapshotCount: 2/);
+    assert.equal(store.getCursor(activityCursorKey("workstation-a", "2026-07-22")), null);
+    assert.equal(store.getCursor(activityCursorKey("workstation-b", "2026-07-22")), null);
+  } finally {
+    store.close();
+    await rm(memoryDir, { recursive: true, force: true });
+  }
+});
+
+test("syncActivitySource reindexes after a digest write, with the digest already durable", async () => {
+  const memoryDir = await mkdtemp(path.join(os.tmpdir(), "remnic-activity-pipeline-"));
+  const store = ActivityStore.open(memoryDir);
+  try {
+    const client = source("workstation-a", new Map([[null, [snapshot()]]]), new Map([[null, null]]));
+    let reindexed = 0;
+    let digestAtReindex = "";
+    const result = await syncActivitySource(client, {
+      date: "2026-07-22",
+      timezone: "UTC",
+      memoryDir,
+      store,
+      afterWrites: async () => {
+        reindexed += 1;
+        // The reindex must see the durable digest already on disk — that is
+        // what makes the new day discoverable (rule 31).
+        digestAtReindex = await readFile(activityDigestPath(memoryDir, "2026-07-22"), "utf8");
+      },
+    });
+
+    assert.equal(result.digestWritten, true);
+    assert.equal(reindexed, 1, "reindex fires exactly once after the digest write");
+    assert.match(digestAtReindex, /snapshotCount: 1/, "the written digest is visible to the reindex");
+    assert.equal(result.reindexError, undefined);
+  } finally {
+    store.close();
+    await rm(memoryDir, { recursive: true, force: true });
+  }
+});
+
+test("syncActivitySource skips the reindex when the digest is unchanged", async () => {
+  const memoryDir = await mkdtemp(path.join(os.tmpdir(), "remnic-activity-pipeline-"));
+  const store = ActivityStore.open(memoryDir);
+  try {
+    let reindexed = 0;
+    const opts = {
+      date: "2026-07-22",
+      timezone: "UTC",
+      memoryDir,
+      store,
+      afterWrites: async () => {
+        reindexed += 1;
+      },
+    };
+    const first = source("workstation-a", new Map([[null, [snapshot()]]]), new Map([[null, null]]));
+    await syncActivitySource(first, opts);
+    const second = source("workstation-a", new Map([[null, [snapshot()]]]), new Map([[null, null]]));
+    const result = await syncActivitySource(second, opts);
+
+    assert.equal(result.digestWritten, false, "an unchanged day rewrites nothing");
+    assert.equal(reindexed, 1, "no reindex when the digest did not change");
+  } finally {
+    store.close();
+    await rm(memoryDir, { recursive: true, force: true });
+  }
+});
+
+test("syncActivitySource isolates a reindex failure: rows, digest, and cursor still commit", async () => {
+  const memoryDir = await mkdtemp(path.join(os.tmpdir(), "remnic-activity-pipeline-"));
+  const store = ActivityStore.open(memoryDir);
+  try {
+    const client = source("workstation-a", new Map([[null, [snapshot()]]]), new Map([[null, null]]));
+    const result = await syncActivitySource(client, {
+      date: "2026-07-22",
+      timezone: "UTC",
+      memoryDir,
+      store,
+      afterWrites: async () => {
+        // A backend error whose message embeds an absolute path must be
+        // sanitized to a name+code in the exported reindexError, not echoed.
+        throw Object.assign(new Error("ENOENT: /abs/qmd/index.sqlite missing"), { code: "ENOENT" });
+      },
+    });
+
+    assert.equal(result.digestWritten, true, "the digest is durable despite the reindex failure");
+    assert.match(result.reindexError ?? "", /ENOENT/);
+    assert.ok(!result.reindexError?.includes("/abs/qmd"), "reindexError does not leak the absolute path");
+    assert.equal(result.inserted, 1);
+    await access(activityDigestPath(memoryDir, "2026-07-22"));
+    assert.equal(
+      store.getCursor(activityCursorKey("workstation-a", "2026-07-22")),
+      null,
+      "cursor still advanced; reindex is best-effort",
+    );
+  } finally {
+    store.close();
+    await rm(memoryDir, { recursive: true, force: true });
+  }
+});
+
+test("syncActivitySource honors an abort before committing the digest and cursor", async () => {
+  const memoryDir = await mkdtemp(path.join(os.tmpdir(), "remnic-activity-pipeline-"));
+  const store = ActivityStore.open(memoryDir);
+  try {
+    const controller = new AbortController();
+    const client: ActivitySourceClient = {
+      machineLabel: "workstation-a",
+      async verify() {
+        return { ok: true };
+      },
+      async fetchSnapshots() {
+        // Abort fires after the last page returns but before the digest write.
+        controller.abort();
+        return { snapshots: [snapshot()], nextCursor: null };
+      },
+    };
+
+    await assert.rejects(
+      syncActivitySource(client, {
+        date: "2026-07-22",
+        timezone: "UTC",
+        memoryDir,
+        store,
+        signal: controller.signal,
+      }),
+    );
+
+    assert.equal(
+      store.getCursor(activityCursorKey("workstation-a", "2026-07-22")),
+      null,
+      "an aborted tick never advances the cursor",
+    );
+    await assert.rejects(
+      readFile(activityDigestPath(memoryDir, "2026-07-22"), "utf8"),
+      "an aborted tick never writes the digest",
+    );
+  } finally {
+    store.close();
+    await rm(memoryDir, { recursive: true, force: true });
+  }
+});
+
+test("syncActivitySource persists out-of-window snapshots under their own day, never the requested day's digest", async () => {
+  const memoryDir = await mkdtemp(path.join(os.tmpdir(), "remnic-activity-pipeline-"));
+  const store = ActivityStore.open(memoryDir);
+  try {
+    const client = source(
+      "workstation-a",
+      new Map([
+        [
+          null,
+          [
+            snapshot({ capturedAtUtc: "2026-07-22T14:00:00.000Z", contentHash: "in-window" }),
+            // A snapshot the daemon misplaced onto a different day (replay /
+            // timezone bug). It must be retained under its own day, not lost.
+            snapshot({ capturedAtUtc: "2026-07-20T10:00:00.000Z", contentHash: "out-of-window" }),
+          ],
+        ],
+      ]),
+      new Map([[null, null]]),
+    );
+
+    const result = await syncActivitySource(client, { date: "2026-07-22", timezone: "UTC", memoryDir, store });
+
+    assert.equal(result.fetched, 2, "both snapshots were fetched");
+    assert.equal(result.inserted, 2, "both snapshots are durably persisted (no data loss)");
+    // The requested day's digest is a window query: only its in-window row.
+    const day = store.listSnapshotsForDay(null, "2026-07-22T00:00:00.000Z", "2026-07-23T00:00:00.000Z");
+    assert.deepEqual(day.map((s) => s.contentHash), ["in-window"], "the requested day contains only its in-window row");
+    assert.match(await readFile(activityDigestPath(memoryDir, "2026-07-22"), "utf8"), /snapshotCount: 1/);
+    // The misplaced row is durable under ITS OWN day, surfacing when that day syncs.
+    const ownDay = store.listSnapshotsForDay(null, "2026-07-20T00:00:00.000Z", "2026-07-21T00:00:00.000Z");
+    assert.deepEqual(ownDay.map((s) => s.contentHash), ["out-of-window"], "the misplaced row is retained under its own day, not dropped");
+    // Nothing was skipped, so the cursor advancing past the page is correct.
+    assert.equal(store.getCursor(activityCursorKey("workstation-a", "2026-07-22")), null, "cursor advances after a fully-persisted page");
+  } finally {
+    store.close();
+    await rm(memoryDir, { recursive: true, force: true });
+  }
+});
+
+test("syncActivitySource rejects a calendar-overflow timestamp instead of skipping it", async () => {
+  const memoryDir = await mkdtemp(path.join(os.tmpdir(), "remnic-activity-pipeline-"));
+  const store = ActivityStore.open(memoryDir);
+  try {
+    const client = source(
+      "workstation-a",
+      // 2026-02-30 is impossible; Date.parse rolls it to Mar 2, which would fall
+      // outside a Feb 28 sync window. It must fail loudly, not be silently skipped.
+      new Map([[null, [snapshot({ capturedAtUtc: "2026-02-30T12:00:00.000Z", contentHash: "overflow" })]]]),
+      new Map([[null, null]]),
+    );
+
+    await assert.rejects(
+      syncActivitySource(client, { date: "2026-02-28", timezone: "UTC", memoryDir, store }),
+      /capture timestamp/,
+    );
+    assert.equal(store.getCursor(activityCursorKey("workstation-a", "2026-02-28")), null, "cursor never advances on a rejected page");
+  } finally {
+    store.close();
+    await rm(memoryDir, { recursive: true, force: true });
+  }
+});