@remnic/core 9.3.649 → 9.3.651

package/src/coding/coding-namespace.test.ts

@@ -365,3 +365,47 @@ test("resolveCodingNamespaceOverlay: read path and write path see identical name
   const writeOverlay = resolveCodingNamespaceOverlay(input[0], input[1]);
   assert.deepEqual(readOverlay, writeOverlay);
 });
+
+test("#1505 codex P2: lcmReadSessionIdsForNamespaces preserves UNDEFINED for a sessionless read (never the literal 'default' session id)", async () => {
+  const { lcmReadSessionIdsForNamespaces } = await import("./coding-namespace.js");
+  // Sessionless ⇒ a single archive-wide read (`undefined`), so the LCM builders
+  // run with no exact session_id filter — NOT filtered to a session literally
+  // named "default" (which would silently drop explicit-cue/targeted/focused/
+  // response/event LCM sections for every recall that omits a session key).
+  assert.deepEqual(
+    lcmReadSessionIdsForNamespaces(["default"], undefined, "default"),
+    [undefined],
+    "sessionless ⇒ [undefined], never ['default']",
+  );
+  assert.deepEqual(
+    lcmReadSessionIdsForNamespaces(["acme", "default"], "", "default"),
+    [undefined],
+    "empty-string sessionKey is treated as sessionless ⇒ [undefined]",
+  );
+});
+
+test("#1505 codex P2: lcmReadSessionIdsForNamespaces keeps the raw sessionKey + overlay keys when a session IS present", async () => {
+  const { lcmReadSessionIdsForNamespaces, lcmSessionKeyForNamespace } = await import(
+    "./coding-namespace.js"
+  );
+  // Shape-agnostic expectation: derive each expected key through the SAME shared
+  // encoder production uses (#1495 P1 made the namespaced encoding sentinel-framed
+  // and unforgeable; rule 22: never re-hardcode the join).
+  const enc = (ns: string, sk: string) =>
+    lcmSessionKeyForNamespace(ns, sk, "default") ?? sk;
+  // Single-store / default namespace ⇒ raw sessionKey (byte-for-byte prior).
+  assert.deepEqual(
+    lcmReadSessionIdsForNamespaces(["default"], "sk", "default"),
+    ["sk"],
+  );
+  // Non-default namespaces ⇒ sentinel-framed keys, deduped, ordered. The default
+  // key collapses to the raw `sk`, and the namespaced key is disjoint from it.
+  assert.deepEqual(
+    lcmReadSessionIdsForNamespaces(["acme", "default", "acme"], "sk", "default"),
+    [enc("acme", "sk"), "sk"],
+  );
+  // Security invariant: the namespaced key cannot equal a raw default key, so a
+  // forged default read can never collide with the overlay key.
+  assert.notEqual(enc("acme", "sk"), "acme:sk");
+  assert.notEqual(enc("acme", "sk"), "sk");
+});

package/src/coding/coding-namespace.ts

@@ -418,3 +418,166 @@ export function describeCodingScope(
     disabledReason: null,
   };
 }
+
+// ──────────────────────────────────────────────────────────────────────────
+// LCM session-key namespacing (#1495)
+// ──────────────────────────────────────────────────────────────────────────
+
+/**
+ * Reserved structural sentinel for the namespaced LCM `session_id` encoding
+ * (#1495 P1). U+001F (UNIT SEPARATOR) is a C0 control character that CANNOT
+ * occur in a route namespace (`isSafeRouteNamespace` ⇒ `[A-Za-z0-9._-]{1,64}`,
+ * see routing/engine.ts) and does not occur in any legitimate session key, so
+ * it is an unforgeable structural marker for the namespace boundary.
+ *
+ * SECURITY — why this is unforgeable (the #1495 P1 fix):
+ * The LCM archive is keyed by the `session_id` STRING (exact `session_id = ?`
+ * and prefix `session_id LIKE '<prefix>%'`), NOT physically partitioned by
+ * namespace. The previous encoding `${namespace}:${sessionKey}` shared the SAME
+ * string space as a raw default-store key, so a caller authorized for the
+ * `default` store could pass a raw `sessionKey` equal to another namespace's
+ * encoded key (`"<overlay-ns>:<victim-session>"`) and exact-match the victim's
+ * rows — a cross-tenant read leak.
+ *
+ * The new encoding makes the namespaced and default key-spaces PROVABLY
+ * DISJOINT:
+ *   - Overlay key  = `\x1f<namespace>\x1f<sessionKey>` — always begins with
+ *     `\x1f` followed by a NON-`\x1f` character (the namespace is non-empty and
+ *     `\x1f`-free). The leading `\x1f<namespace>\x1f` is an unambiguous,
+ *     injective frame: the namespace cannot contain `\x1f`, so the second `\x1f`
+ *     terminates it without any escaping of the (raw) session key.
+ *   - Default key  = the raw `sessionKey`, UNLESS it already begins with the
+ *     sentinel, in which case it is escaped to begin with `\x1f\x1f` (see
+ *     `escapeDefaultLcmKey`). A default key therefore NEVER matches the overlay
+ *     frame `\x1f<non-\x1f>…`.
+ * Hence no caller-controlled raw `sessionKey` (default path) can reproduce an
+ * overlay key, closing the forgery for BOTH the exact-`session_id` match and the
+ * `sessionPrefix` LIKE match (an overlay prefix `\x1f<ns>\x1f<rawPrefix>` stays a
+ * valid LIKE-prefix of the overlay full keys, and a default prefix can only
+ * LIKE-match default keys).
+ *
+ * Existing default-store rows need NO migration: legitimate session keys never
+ * contain `\x1f`, so `escapeDefaultLcmKey` is a no-op for them and they remain
+ * byte-for-byte their raw form. The namespaced encoding is NEW in this
+ * unreleased PR, so changing its shape costs nothing.
+ */
+const LCM_NS_SENTINEL = "\u001f";
+
+/**
+ * Make a default-store (raw) LCM key disjoint from the namespaced key-space.
+ *
+ * Namespaced overlay keys always begin with `\x1f` followed by a non-`\x1f`
+ * namespace character. A raw default key collides with that frame ONLY if it
+ * begins with `\x1f`. Legitimate session keys never contain `\x1f`, so this is a
+ * pure no-op for them; a forged key that begins with `\x1f` is escaped to begin
+ * with `\x1f\x1f`, which can never equal an overlay key (whose second character
+ * is a `[A-Za-z0-9._-]` namespace char, never `\x1f`).
+ */
+function escapeDefaultLcmKey(sessionKey: string): string {
+  return sessionKey.startsWith(LCM_NS_SENTINEL)
+    ? `${LCM_NS_SENTINEL}${sessionKey}`
+    : sessionKey;
+}
+
+/**
+ * Build the LCM/structured-history `session_id` that a write-producing surface
+ * archives under, and that a same-session reader must search under, so reads
+ * and writes never drift (#1495, CLAUDE.md rule 42).
+ *
+ * The LCM archive filters strictly by the `session_id` string, so the writer's
+ * archival key and the reader's lookup key MUST agree byte-for-byte. The
+ * encoding frames the namespace with the reserved {@link LCM_NS_SENTINEL}
+ * (`\x1f<namespace>\x1f<sessionKey>`) whenever that namespace diverges from the
+ * single-store default; otherwise it passes the (escaped) raw `sessionKey` so
+ * single-user / no-overlay deployments keep pre-#1495 behavior exactly. The two
+ * key-spaces are provably disjoint, so a caller-controlled raw `sessionKey`
+ * cannot forge another namespace's encoded id (see the {@link LCM_NS_SENTINEL}
+ * doc comment for the full security rationale).
+ *
+ * `observe`, compaction flush/record, and the orchestrator recall readers all
+ * route through this one helper so a project-scoped (cwd/projectTag) or
+ * explicit-namespace session reads its own compressed-history / structured /
+ * targeted-fact evidence instead of missing it.
+ */
+export function lcmSessionKeyForNamespace(
+  namespace: string | undefined,
+  sessionKey: string | undefined,
+  defaultNamespace: string,
+): string | undefined {
+  if (typeof sessionKey !== "string" || sessionKey.length === 0) return sessionKey;
+  if (
+    typeof namespace === "string" &&
+    namespace.length > 0 &&
+    namespace !== defaultNamespace
+  ) {
+    // Namespaced (overlay / explicit) key: frame the namespace with the reserved
+    // sentinel so the boundary is unambiguous AND unforgeable from the default
+    // key-space. The namespace is guaranteed `\x1f`-free by `isSafeRouteNamespace`.
+    return `${LCM_NS_SENTINEL}${namespace}${LCM_NS_SENTINEL}${sessionKey}`;
+  }
+  // Default store: raw sessionKey, escaped only if it would otherwise intrude on
+  // the namespaced key-space (no-op for every legitimate key).
+  return escapeDefaultLcmKey(sessionKey);
+}
+
+/**
+ * Map an ORDERED, read-authorized namespace set (the SAME set normal QMD/file
+ * recall searches) to the ordered set of LCM `session_id`s a same-session reader
+ * must query (#1505 thread "Include coding fallback namespaces in LCM reads").
+ *
+ * The LCM archive filters strictly by `session_id`, and `observe` archives each
+ * turn under `${effectiveNamespace}:${sessionKey}` for the namespace that was
+ * effective when it was written. A branch-scoped session that overlays
+ * `${base-project-*-branch-*}` only sees rows written under THAT namespace if it
+ * reads a single overlay key — but normal recall ALSO searches the
+ * `codingOverlay.readFallbacks` (project / root) namespaces, so rows archived at
+ * project/root scope are surfaced by QMD/file recall yet MISSED by a single-key
+ * LCM read. Deriving the LCM read keys from the SAME `recallNamespaces` set keeps
+ * the LCM read path from diverging: every namespace recall is authorized to read
+ * (read-auth gate already applied upstream in `recallNamespaces`) contributes one
+ * LCM key, ordered primary-overlay-first then fallbacks. Unreadable namespaces
+ * are never in `recallNamespaces`, so they are never searched here either (no
+ * cross-tenant read leak).
+ *
+ * Single-user / no-overlay recall passes a single-namespace set that collapses to
+ * the raw `sessionKey`, so the result is `[sessionKey]` — byte-for-byte the
+ * pre-#1505 single-key behavior.
+ *
+ * SESSIONLESS recall (`sessionKey === undefined`): returns `[undefined]` so the
+ * caller issues ONE archive-wide LCM read with no exact `session_id` filter —
+ * byte-for-byte the pre-#1505 sessionless behavior. It must NOT substitute the
+ * literal `"default"` session id (codex P2 "Preserve unscoped LCM searches
+ * without a session key"): that would filter to a session literally named
+ * `default`, silently dropping the explicit-cue / targeted / focused / response /
+ * event LCM sections for every recall that omits a session key.
+ *
+ * The result is deduped while preserving first-seen order so the caller can query
+ * keys in priority order and short-circuit on the first hit without re-querying an
+ * identical key (e.g. when two namespaces both collapse to the default store).
+ */
+export function lcmReadSessionIdsForNamespaces(
+  namespaces: readonly string[],
+  sessionKey: string | undefined,
+  defaultNamespace: string,
+): Array<string | undefined> {
+  // Sessionless ⇒ a single archive-wide read (no `session_id` filter). NEVER the
+  // literal "default" session id (codex P2).
+  if (typeof sessionKey !== "string" || sessionKey.length === 0) {
+    return [undefined];
+  }
+  const out: string[] = [];
+  const seen = new Set<string>();
+  for (const namespace of namespaces) {
+    const key =
+      lcmSessionKeyForNamespace(namespace, sessionKey, defaultNamespace) ??
+      sessionKey;
+    if (!seen.has(key)) {
+      seen.add(key);
+      out.push(key);
+    }
+  }
+  if (out.length === 0) {
+    out.push(sessionKey);
+  }
+  return out;
+}

package/src/event-order-recall.ts

@@ -3,6 +3,11 @@ import type { ExplicitCueRecallEngine } from "./explicit-cue-recall.js";
 
 export interface EventOrderRecallOptions {
   engine: ExplicitCueRecallEngine | null | undefined;
+  // event-order reads a SINGLE LCM session key. Unlike the relevance-ranked
+  // sections, its evidence must not be merged across the #1505 fallback key set:
+  // `turn_index` is local to each LCM `session_id`, so interleaving keys would
+  // misstate chronology. The orchestrator reads the ordered key set via
+  // first-non-empty instead (see the event-order call site).
   sessionId?: string;
   query: string;
   maxChars: number;
@@ -42,6 +47,9 @@ export async function buildEventOrderRecallSection(
 ): Promise<string> {
   const budget = normalizePositiveInteger(options.maxChars);
   const maxItems = normalizePositiveInteger(options.maxItems ?? DEFAULT_MAX_ITEMS);
+  // event-order reads a SINGLE session key (`turn_index` is local to each LCM
+  // `session_id`, so chronology can't be merged across the #1505 fallback set —
+  // the orchestrator drives the ordered key set via first-non-empty instead).
   if (!options.engine || !options.sessionId || budget <= 0) {
     return "";
   }

package/src/explicit-cue-recall.ts

@@ -1,4 +1,8 @@
 import { buildEvidencePack } from "./evidence-pack.js";
+import {
+  gatherAcrossReadSessions,
+  resolveLcmReadSessionIds,
+} from "./lcm-fallback-read.js";
 
 export interface ExplicitCueRecallEngine {
   expandContext(
@@ -29,6 +33,13 @@ export interface ExplicitCueRecallEngine {
 export interface ExplicitCueRecallOptions {
   engine: ExplicitCueRecallEngine | null | undefined;
   sessionId?: string;
+  /**
+   * Ordered, read-authorized LCM read key set (primary overlay → project/root
+   * fallbacks). When present, cue evidence is gathered across EVERY key into one
+   * shared accumulator and merged under this section's budget (#1505 codex P2).
+   * Falls back to `sessionId`.
+   */
+  sessionIds?: readonly (string | undefined)[];
   query: string;
   maxChars: number;
   maxItemChars?: number;
@@ -324,45 +335,75 @@ export async function buildExplicitCueRecallSection(
   }> = [];
   const seenTurns = new Set<string>();
 
-  await collectTurnReferenceEvidence({
-    engine,
-    sessionId: options.sessionId,
-    query,
-    maxReferences,
-    evidenceItems,
-    seenTurns,
-  });
-
-  if (options.includeContentLexicalCues) {
-    await collectNamedMeetingFactEvidence({
+  // #1505 codex P2: gather cue evidence across the ordered LCM read key set
+  // (primary overlay → project/root fallbacks) into ONE shared accumulator
+  // (`evidenceItems` / `seenTurns`), so a branch-scoped session's project/root
+  // fallback cues are RECOVERED instead of being skipped by the old
+  // first-non-empty short-circuit. `seenTurns` dedupes across keys by
+  // `session_id`+`turn_index`; the budget is applied exactly once in the
+  // `buildEvidencePack` call below. `gatherAcrossReadSessions` isolates a
+  // per-key read failure (a corrupt/locked fallback index must not discard the
+  // other keys' cues); single-key recall runs each collector directly, so a
+  // failure propagates exactly as before.
+  //
+  // Ordering: gather by evidence TYPE first (turn references → content cues →
+  // lexical cues), then by read-key priority within each type. This is the
+  // section's deliberate value order, and it carries across keys — so a fallback
+  // key's high-value turn references precede the primary key's lower-value
+  // lexical cues under a tight budget, while a single key is byte-for-byte the
+  // pre-#1505 insertion order. We intentionally do NOT score-sort the merged set:
+  // explicit-cue's highest-value cues (turn references / content cues) are
+  // deliberately UNSCORED while lexical search hits carry numeric scores, so a
+  // score-DESC sort would invert the priority and demote turn references below
+  // weak lexical hits (cursor[bot] / codex P2 on this PR).
+  const readSessionIds = resolveLcmReadSessionIds(options);
+  await gatherAcrossReadSessions(readSessionIds, (sessionId) =>
+    collectTurnReferenceEvidence({
       engine,
-      sessionId: options.sessionId,
+      sessionId,
       query,
       maxReferences,
       evidenceItems,
       seenTurns,
-    });
+    }),
+  );
 
-    await collectFocusedTranscriptCueEvidence({
+  if (options.includeContentLexicalCues) {
+    await gatherAcrossReadSessions(readSessionIds, (sessionId) =>
+      collectNamedMeetingFactEvidence({
+        engine,
+        sessionId,
+        query,
+        maxReferences,
+        evidenceItems,
+        seenTurns,
+      }),
+    );
+
+    await gatherAcrossReadSessions(readSessionIds, (sessionId) =>
+      collectFocusedTranscriptCueEvidence({
+        engine,
+        sessionId,
+        query,
+        evidenceItems,
+        seenTurns,
+      }),
+    );
+  }
+
+  await gatherAcrossReadSessions(readSessionIds, (sessionId) =>
+    collectLexicalCueEvidence({
       engine,
-      sessionId: options.sessionId,
+      sessionId,
       query,
+      maxReferences,
+      includeBenchmarkAnchorCues: options.includeBenchmarkAnchorCues,
+      includeContentLexicalCues: options.includeContentLexicalCues,
+      includeStructuredPlanCues: options.includeStructuredPlanCues,
       evidenceItems,
       seenTurns,
-    });
-  }
-
-  await collectLexicalCueEvidence({
-    engine,
-    sessionId: options.sessionId,
-    query,
-    maxReferences,
-    includeBenchmarkAnchorCues: options.includeBenchmarkAnchorCues,
-    includeContentLexicalCues: options.includeContentLexicalCues,
-    includeStructuredPlanCues: options.includeStructuredPlanCues,
-    evidenceItems,
-    seenTurns,
-  });
+    }),
+  );
 
   const evidenceFocusQuery = buildEvidenceFocusQuery(query, {
     includeBenchmarkAnchorCues: options.includeBenchmarkAnchorCues,

package/src/focused-list-recall.ts

@@ -4,10 +4,20 @@ import {
   type EvidencePackItem,
 } from "./evidence-pack.js";
 import type { ExplicitCueRecallEngine } from "./explicit-cue-recall.js";
+import {
+  gatherAcrossReadSessions,
+  resolveLcmReadSessionIds,
+} from "./lcm-fallback-read.js";
 
 export interface FocusedListRecallOptions {
   engine: ExplicitCueRecallEngine | null | undefined;
   sessionId?: string;
+  /**
+   * Ordered, read-authorized LCM read key set (primary overlay → project/root
+   * fallbacks). When present, evidence is gathered across EVERY key and merged
+   * under this section's budget (#1505 codex P2). Falls back to `sessionId`.
+   */
+  sessionIds?: readonly (string | undefined)[];
   query: string;
   maxChars: number;
   maxItemChars?: number;
@@ -52,7 +62,19 @@ export async function buildFocusedListRecallSection(
     return "";
   }
 
-  const items = await collectFocusedListItems(options, intent);
+  // #1505 codex P2: gather candidates across the ordered LCM read key set
+  // (primary overlay → project/root fallbacks) and UNION them into the existing
+  // rank/dedupe/budget pass, so a stronger project-fallback candidate is not
+  // masked by a weak primary-key hit. `rankAndDedupeFocusedListItems` applies
+  // the section-appropriate dedupe and relevance rank; the budget is applied
+  // exactly once below. `gatherAcrossReadSessions` isolates a per-key read
+  // failure so a corrupt/locked fallback index can't discard the primary key's
+  // candidates; the single-key path runs exactly one collect and propagates a
+  // failure as before — byte-for-byte the pre-#1505 behavior.
+  const items: EvidencePackItem[] = [];
+  await gatherAcrossReadSessions(resolveLcmReadSessionIds(options), async (sessionId) => {
+    items.push(...(await collectFocusedListItems({ ...options, sessionId }, intent)));
+  });
   const ranked = rankAndDedupeFocusedListItems(items, options.query, intent)
     .slice(0, maxResults);
   if (ranked.length === 0) {

package/src/lcm-fallback-read.ts

@@ -0,0 +1,113 @@
+/**
+ * Shared helper for reading LCM-backed recall sections across the ordered,
+ * read-authorized fallback key set (#1505 codex P2 "Merge LCM fallback reads
+ * instead of short-circuiting").
+ *
+ * Background: a branch-scoped session archives its LCM rows under whichever
+ * coding-overlay namespace was effective at write time, so its evidence can be
+ * split across the primary overlay key AND the project / root fallback keys.
+ * Normal QMD/file recall already searches the primary namespace PLUS
+ * `codingOverlay.readFallbacks` and MERGES the rows. The LCM read path must do
+ * the same: query EVERY authorized read key and merge the candidate evidence
+ * into each section's existing dedupe + rank + budget pass, instead of stopping
+ * at the first key that happens to yield a (possibly weak) hit.
+ *
+ * Each section already owns a section-appropriate dedupe (a `seen` set or a
+ * `rankAndDedupe…` step), so the fan-out only needs to resolve the ordered,
+ * deduped read-key set and UNION the per-key candidates into that existing
+ * pipeline — the budget is then applied exactly once to the union. Centralizing
+ * the key-set resolution here (rather than re-implementing per builder) follows
+ * CLAUDE.md rule 22 (scope resolution must be deduplicated).
+ */
+
+/** A recall section's LCM read target: either a single key or an ordered set. */
+export interface LcmReadSessionTarget {
+  /**
+   * The single LCM read `session_id` (pre-#1505 behavior). `undefined` means a
+   * sessionless, archive-wide read with no `session_id` filter.
+   */
+  sessionId?: string;
+  /**
+   * The ordered, read-authorized LCM read key set (primary overlay key first,
+   * then project / root fallbacks) the orchestrator derived from the same
+   * readable namespace set normal recall searches. When present and non-empty,
+   * it supersedes `sessionId`.
+   */
+  sessionIds?: readonly (string | undefined)[];
+}
+
+// `undefined` (a sessionless, archive-wide read) is a distinct, legitimate read
+// target, so it needs a non-string sentinel in the dedupe set. A leading space
+// keeps it disjoint from every real session key / namespaced LCM key (which are
+// `[A-Za-z0-9._-]` plus the U+001F namespace sentinel, never leading-space).
+const UNDEFINED_SESSION_SENTINEL = " <lcm-sessionless>";
+
+/**
+ * Resolve the ordered, deduped set of LCM read `session_id`s a recall section
+ * must query.
+ *
+ * When `sessionIds` is provided (the #1505 fallback unification), it is used
+ * verbatim, deduped while preserving first-seen order so the caller queries
+ * keys in priority order (primary overlay → fallbacks) without re-querying an
+ * identical key (e.g. when two namespaces both collapse to the default store).
+ * Otherwise the section reads under the single `sessionId`, so the result is
+ * `[sessionId]` — byte-for-byte the pre-#1505 single-key behavior, including a
+ * single `undefined` for a sessionless archive-wide read.
+ */
+export function resolveLcmReadSessionIds(
+  target: LcmReadSessionTarget,
+): Array<string | undefined> {
+  const source =
+    target.sessionIds && target.sessionIds.length > 0
+      ? target.sessionIds
+      : [target.sessionId];
+  const seen = new Set<string>();
+  const out: Array<string | undefined> = [];
+  for (const sessionId of source) {
+    const key = sessionId === undefined ? UNDEFINED_SESSION_SENTINEL : sessionId;
+    if (seen.has(key)) continue;
+    seen.add(key);
+    out.push(sessionId);
+  }
+  // Defensive: an all-empty `sessionIds` still collapses to the single-key path.
+  return out.length > 0 ? out : [target.sessionId];
+}
+
+/**
+ * Run a per-key LCM `gather` across the resolved read-key set with FAULT
+ * ISOLATION across keys (#1505 codex P2 review follow-up).
+ *
+ * A recall section that reads every key in a bare `for…await` loop loses the
+ * WHOLE section if any one key throws (e.g. a `SqliteError` from a corrupt or
+ * locked fallback index) — even when the primary overlay key already gathered
+ * evidence. The pre-#1505 first-non-empty read never had this problem: it
+ * returned the primary key's non-empty result without ever touching a failing
+ * fallback. This helper restores that resilience for the merged path: when more
+ * than one key is read, a per-key failure is contained so the other keys'
+ * evidence survives (best-effort recall — a total failure degrades to an empty
+ * section, which the orchestrator already treats as "no evidence").
+ *
+ * SINGLE-KEY is byte-for-byte the pre-#1505 behavior: the gather runs directly,
+ * so a failure PROPAGATES exactly as before (the caller / orchestrator catch
+ * still logs it). Fault isolation only engages once there is a fallback key that
+ * could fail independently of the primary.
+ */
+export async function gatherAcrossReadSessions(
+  sessionIds: ReadonlyArray<string | undefined>,
+  gather: (sessionId: string | undefined) => Promise<void>,
+): Promise<void> {
+  if (sessionIds.length <= 1) {
+    for (const sessionId of sessionIds) {
+      await gather(sessionId);
+    }
+    return;
+  }
+  for (const sessionId of sessionIds) {
+    try {
+      await gather(sessionId);
+    } catch {
+      // One read key failed; keep the evidence already gathered from the other
+      // keys instead of discarding the whole section.
+    }
+  }
+}