@sporhq/spor 0.29.0 → 0.29.1

package/.claude-plugin/plugin.json

@@ -2,7 +2,7 @@
   "name": "spor",
   "displayName": "Spor Context Compiler",
   "description": "Maintains a typed, versioned knowledge graph and compiles compact briefings from it: session-start injection, per-prompt relevance digests, capture at discovery, end-of-session distillation, decision queue.",
-  "version": "0.29.0",
+  "version": "0.29.1",
   "author": {
     "name": "losthammer"
   }

package/.codex-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "spor",
-  "version": "0.29.0",
+  "version": "0.29.1",
   "description": "Maintains a typed, versioned knowledge graph and compiles compact briefings from it: session-start injection, per-prompt relevance digests, capture at discovery, end-of-session distillation, decision queue.",
   "author": {
     "name": "Spor",

package/API.md

@@ -601,7 +601,7 @@ agent subject sees no graph content; a coarse read-only/CI flag is not a bypass.
 | `DELETE /v1/me/tokens/{hash-prefix}` | `spor token revoke` | revoke one of the caller's OWN PATs by hash prefix → `{revoked, hash_prefix, oauth_grants_revoked}`; a prefix that isn't one of the caller's is `404` (never another person's token). `403` if unbound. Shares the admin revoke's OAuth-grant cascade-completeness invariant (issue-cc-pat-revoke-cascades-all-oauth-grants) |
 | `GET /v1/briefing/{project}` | session-start | read the `brief-<project>` node → `{found, version, body, project_brief?, graph_status}`. The slug resolves through project-node aliases (GRAPH.md "Project identity nodes") before lookup. A BARE repo slug also rides up to its home-project grouping: the grouping's `brief-<grouping>` node returns alongside as `project_brief` (the product context spanning sibling repos), matching the shared up-resolution (dec-spor-queue-slug-resolves-to-grouping); passing the repo NODE id (`repo-<slug>`) is the escape hatch that returns only the repo brief, no `project_brief`. Optional `?fp=root:<sha>,remote:<host/path>,...` carries the repo's fingerprints: the server learns them onto the owning project node, and an unknown slug with a known fingerprint files an alias proposal in the queue |
 | `POST /v1/digest` `{query, root?, project?, min_sim?}` | prompt-context, /spor:brief | digest-mode compile → `{found, text}`; `found: false` is a successful empty result. `root` is the structural-walk twin of `query` (the two are mutually exclusive; `root` wins, an unknown id is `422`). Optional `project` is the session slug: the server scopes the compile to it — the same-project relevance boost, the grouping union, and the `always_on` norm `applies_to_*` ride-along — resolving the slug through project-node aliases/groupings inside compile (dec-spor-queue-slug-resolves-to-grouping), exactly as `/v1/queue` does. A bad slug is `422`; **omitting `project` runs the digest project-blind (byte-identical to before)**, so older clients that send only `{query}` are unaffected. **Digest rerank (task-spor-compile-jev-rerank-stage, per-org opt-in, default OFF, server half task-split-spor-server-eb6de3fca31e):** when the org has opted in, the server scores the candidate pool (cosine top-30 ∪ top structural) with `jev.rerank` and hands the verdicts to `compile()` as `opts.rerankScores` — a `{ [id]: { score, noul } }` map, `score` an ordinal 0-3 (irrelevant / background / directly relevant / required) and `noul` a 0-1 probability that that candidate answers or resolves the query. `compile()` stays pure — it never calls Jev itself, it only reorders the section it already builds under `DIGEST_CAP`: pinned → scored candidates (`noul` desc, `score` secondary, cosine-sim tiebreak) → remaining structural (unscored, original score-desc order) → remaining content (unscored, original sim-desc order) — and reports it back as `meta.rerank: {applied: true, candidates: <n>}` (absent when rerank did not run) for the response's own additive `rerank` summary field to echo. Fail-open: an org that hasn't opted in, local mode (no server to call Jev with), or a call that omits/empties `opts.rerankScores` all render byte-identical to before (norm-cc-byte-identical-refactor). **Optional `intent`** (task-spor-digest-intent-jev-gate / task-split-spor-server-bca885114354): when the org has Jev enabled and the request carries a `query`, the server also returns `intent: {warranted: bool, needs_history: 0–1, digest_helps: 0–1, source: "jev"}` — the digest-intent verdict computed server-side (`warranted` = the deterministic prompt heuristics, then max(noul) ≥ 0.5). It is **absent** whenever it was not computed (Jev disabled/shed/timed out/failed, a `root` walk, an older server): fail-open, never `warranted: false` by default. The prompt-context hook suppresses THIS prompt's digest only on an explicit boolean `warranted: false`, and only when its digest intent gate is on (`digest.async`, a tri-state: explicit `true`/`false`, unset = the client default); an absent or non-boolean field is ignored, and so is one on a `found: false` response (its `digest_helps` judged an empty team digest, not the client's personal-graph merge) |
-| `GET /v1/nodes/{id}` | /spor:brief | `get_node` semantics; hidden and absent ids both return `404 not_found`. The node's active schema may attach read-time enrichment via a `get(node, ctx)` hook (GRAPH.md) — the seed `question`/`issue`/`task`/`incident` schemas attach `resolution`: a live **visible** inbound resolves/answers edge carrying the resolver's `summary`/`title` and a `lagging` flag (set when it contradicts a still-open status, clear when the node is already terminal, e.g. an answered question pointing at its answer). Open visible gardener findings about the node ride along as `open_findings` (`bin/spor.js`'s `dispatchDeclineFindingCheck` reads it to refuse re-dispatching a node a prior run DECLINED — task-spor-decline-finding-gates-redispatch — filtering for a live `find-declined-*` entry), and a node marked stale by a visible inbound supersedes edge as `superseded_by`. Returned `raw`/`frontmatter.edges` redact invisible edge targets. All enrichment is additive top-level keys; ignore unknown ones. Reserved: a top-level `inert` boolean — this node's status evaluated against the FULL type-aware queue-liveness-dead partition, including graph-resident schema overrides a graph-less client can't see (issue-spor-type-blind-terminal-status-fallbacks). The graph-less client callers that need it (`bin/spor.js` `dispatchResolutionReason`, `distill.js` `sessionEndLease`) already read it opportunistically when present and fall back to an offline seed-registry check otherwise, but no server response emits the key yet — implementing it server-side is separate, tracked work |
+| `GET /v1/nodes/{id}` | /spor:brief | `get_node` semantics; hidden and absent ids both return `404 not_found`. The node's active schema may attach read-time enrichment via a `get(node, ctx)` hook (GRAPH.md) — the seed `question`/`issue`/`task`/`incident` schemas attach `resolution`: a live **visible** inbound resolves/answers edge carrying the resolver's `summary`/`title` and a `lagging` flag (set when it contradicts a still-open status, clear when the node is already terminal, e.g. an answered question pointing at its answer). Open visible gardener findings about the node ride along as `open_findings` (`bin/spor.js`'s `dispatchDeclineFindingCheck` reads it to refuse re-dispatching a node a prior run DECLINED — task-spor-decline-finding-gates-redispatch — filtering for a live `find-declined-*` entry), and a node marked stale by a visible inbound supersedes edge as `superseded_by`. Returned `raw`/`frontmatter.edges` redact invisible edge targets. `?inbound=1` adds `inbound_edges`: every inbound edge as `{from, type}` in the order a `GET /v1/export` sweep yields (sources sorted by id, each source's edges in file order) — what `spor get --json` uses instead of downloading the export per read (issue-spor-remote-get-json-full-export-per-call); omitted by default. All enrichment is additive top-level keys; ignore unknown ones. Reserved: a top-level `inert` boolean — this node's status evaluated against the FULL type-aware queue-liveness-dead partition, including graph-resident schema overrides a graph-less client can't see (issue-spor-type-blind-terminal-status-fallbacks). The graph-less client callers that need it (`bin/spor.js` `dispatchResolutionReason`, `distill.js` `sessionEndLease`) already read it opportunistically when present and fall back to an offline seed-registry check otherwise, but no server response emits the key yet — implementing it server-side is separate, tracked work |
 | `POST /v1/nodes/batch` `{ids?\|cursor?}` | `get_nodes` | bounded plural `get_node`: start with 1–100 ids, deduplicated by first occurrence; hidden/absent ids appear only in `missing_ids`. Returns `{nodes, returned_ids, missing_ids, truncated, next_cursor}` with the same per-node read enrichment as the single route, capped at 48 KiB without splitting entries. Resume a truncated logical request by sending only its opaque `cursor`; the final page carries `next_cursor: null` |
 | `GET /v1/nodes/{id}/history?limit=N` | `spor history <id>`, the `node_history` MCP tool | per-node commit lineage — a `git log` projection over `nodes/{id}.md` → `{id, head, count, history: [{sha, short, actor, actor_name, actor_email, date, message, internal, person}]}`, newest first. Each revision is labeled `internal:true` for a server-internal write (boot reconcile / migration, `server@spor.invalid`) vs. a real actor, and mapped to its `person` node by author email. Deliberately NOT `git log --follow` (node files share heavy frontmatter boilerplate, so similarity-based rename detection crosses node boundaries — dec-spor-node-history-git-log-projection). `limit` defaults to 50, max 200. The frontmatter `author` re-stamps to the LAST editor on every write, so this is the only durable record of the full chain of editors. A node with no commit history (unknown id) is `404`; a bad id is `422`. The `spor history <id>` CLI verb is the shell front-door (remote reads this; local mode runs the same projection over the graph home) |
 | `GET /v1/nodes/{id}/history/{sha}` | `spor history <id> <sha>`, `node_history` (sha mode) | one revision's detail, the expensive half gated behind an explicit per-sha fetch → the history record for that commit plus `{change, patch, content}`: the change type (`A`/`M`/`D`/`R`), the patch this commit introduced to the node file, and the full node content at that revision (`null` when the commit deleted it). The `sha` must be one from the node's own history — a sha that didn't touch the node, or an unresolvable sha, is `404`; a malformed sha is `422` |
@@ -888,9 +888,12 @@ rather than re-POSTed forever; `429` and `5xx` stay transient and are
 retried with backoff.
 
 `GET /v1/export` response headers: `x-substrate-head` carries the graph
-commit, `x-substrate-node-count` the entry count (plus
-`x-substrate-skipped` when any entry was omitted, and `x-substrate-auth-files`
-on an `?auth=1` export — the count of `auth/*.json` files bundled). A
+commit, `x-substrate-node-count` the entry count (plus `x-substrate-auth-files`
+on an `?auth=1` export — the count of `auth/*.json` files bundled). A path too
+long for any ustar name/prefix split (a node id near the 200-byte limit) is
+written under a POSIX pax extended header carrying its full `path`, so no entry
+is omitted; the legacy `x-substrate-skipped` header is no longer emitted and a
+client should treat its absence as zero. A
 `?history=1` bundle carries only `x-substrate-head` (a git bundle has no node
 count). These header names are a wire contract and were deliberately **not**
 renamed in the Spor rename — clients should keep reading the `x-substrate-*`

package/bin/spor.js

@@ -1103,7 +1103,11 @@ async function cmdGet(cfg, { positionals, values }) {
     return 1;
   }
   if (cfg.mode() === "remote") {
-    const r = await remote.get(cfg, `/v1/nodes/${encodeURIComponent(id)}`, { timeoutMs: 6000 });
+    // --json asks the server for the node's inbound edges in the same read
+    // (?inbound=1, issue-spor-remote-get-json-full-export-per-call); an older
+    // server ignores the param and the export sweep below fills them instead.
+    const q = values.json ? "?inbound=1" : "";
+    const r = await remote.get(cfg, `/v1/nodes/${encodeURIComponent(id)}${q}`, { timeoutMs: 6000 });
     if (r.transport) {
       err(`offline — could not reach server (${r.error})`);
       return 1;
@@ -1122,9 +1126,10 @@ async function cmdGet(cfg, { positionals, values }) {
       return 0;
     }
     // --json: parse the raw with the SAME lib parser as local (parity), take the
-    // server's git-blob-sha revision, and gather inbound edges from the team graph
-    // (the documented graph-wide sweep via GET /v1/export — there is no inbound
-    // endpoint, the same path `spor query --to` walks).
+    // server's git-blob-sha revision, and take inbound edges from the server's
+    // inbound_edges when it sent them. Only an older server without ?inbound=1
+    // falls back to the graph-wide sweep via GET /v1/export (the path `spor
+    // query --to` walks) — a full download per read, so never the first choice.
     const graphLib = require(path.join(ROOT, "lib", "graph.js"));
     const raw = r.json && r.json.raw;
     if (typeof raw !== "string") {
@@ -1132,13 +1137,17 @@ async function cmdGet(cfg, { positionals, values }) {
       return 1;
     }
     const node = graphLib.parseFrontmatter(raw, `${id}.md`);
-    const fetched = await fetchRemoteExportNodes(cfg, "get");
-    if (fetched.error) return 1; // already reported
-    let inbound;
-    try {
-      inbound = inboundEdges(graphLib.loadGraph(fetched.nodesDir), node.id);
-    } finally {
-      fetched.cleanup();
+    let inbound = Array.isArray(r.json.inbound_edges)
+      ? r.json.inbound_edges.map((e) => ({ from: e.from, type: e.type }))
+      : null;
+    if (!inbound) {
+      const fetched = await fetchRemoteExportNodes(cfg, "get");
+      if (fetched.error) return 1; // already reported
+      try {
+        inbound = inboundEdges(graphLib.loadGraph(fetched.nodesDir), node.id);
+      } finally {
+        fetched.cleanup();
+      }
     }
     out(JSON.stringify(getNodeJson(node, inbound, r.json.revision), null, 2));
     return 0;

package/lib/kernel/graph.js

@@ -1010,6 +1010,18 @@ function compile(graph, opts = {}) {
   // along is a schema flag now (always_on: true; the seed sets it on norm).
   const reg = graph.registry ?? seedRegistry(opts.seedSchemas ?? []);
 
+  // Supersession by STATUS as well as by edge (issue-spor-superseded-context-
+  // injected-as-live): a node whose own status reads `superseded` but whose
+  // replacement never earned a `supersedes` edge used to render with only a
+  // `, superseded` parenthetical — which the prompt hook's compaction dropped —
+  // so it reached ambient context reading as live guidance. Both forms now get
+  // the same treatment: ⚠ block + summary-only in briefings, dropped from the
+  // digest (unless a correction pinned it), never riding along as a norm.
+  const isSuperseded = (n) => !!supersededBy[n.id] || String(n.status ?? "").toLowerCase() === "superseded";
+  const supersededLabel = (n) => supersededBy[n.id]
+    ? `SUPERSEDED by ${supersededBy[n.id]}`
+    : "SUPERSEDED (status: superseded; no superseding node linked)";
+
   // Project scoping (issue-cc-digest-unscoped-cross-project-ranking): under a
   // single-org-graph topology tf-idf ranks every prompt against ALL teams'
   // nodes equally, so shared vocabulary ("auth", "deploy", "migration")
@@ -1256,6 +1268,11 @@ function compile(graph, opts = {}) {
   };
   const normCandidates = Object.values(nodes).filter((n) =>
     reg.isAlwaysOn(n.type) && normRidesAlong(n) &&
+    // A superseded or retired norm is no longer team policy; the ride-along
+    // injects unasked into every session, so it must never carry one
+    // (issue-spor-superseded-context-injected-as-live). It can still surface
+    // through the relevance arms, where render() flags it.
+    !isSuperseded(n) && !resolution.isTerminalStatus(n.status, n.type, graph) &&
     !structuralSet.has(n.id) && !contentSet.has(n.id) && !pinned.has(n.id) && !excluded.has(n.id));
   // When the candidate set exceeds the cap, KEEP the most topically relevant
   // (then by id, deterministic) but RENDER them in the original insertion
@@ -1292,13 +1309,13 @@ function compile(graph, opts = {}) {
   // whatever its status says, so a terminal status there is reported as HELD
   // rather than as done — the read-time twin of the queue's rule.
   function statusTag(n) {
-    if (supersededBy[n.id] || !resolution.isTerminalStatus(n.status, n.type, graph)) return "";
+    if (isSuperseded(n) || !resolution.isTerminalStatus(n.status, n.type, graph)) return "";
     return resolution.executionHeld(n) ? `, ${n.status.toLowerCase()} — HELD by execution ${n.execution}, not retired` : `, ${n.status.toLowerCase()}`;
   }
   // Inline ⚠ for an edge-retired node whose status still reads live, mirroring
   // the get_node lead line. Superseded nodes are handled separately.
   function resolutionWarn(n) {
-    if (supersededBy[n.id] || resolution.isTerminalStatus(n.status, n.type, graph)) return "";
+    if (isSuperseded(n) || resolution.isTerminalStatus(n.status, n.type, graph)) return "";
     const r = resMap[n.id];
     if (!r) return "";
     const when = r.date ? ` (${r.date})` : "";
@@ -1317,10 +1334,10 @@ function compile(graph, opts = {}) {
   // ---------- rendering ----------
   function render(n, full, provenance) {
     const head = `### ${n.id} — ${n.title} (${n.type}, ${n.date}${statusTag(n)}${crossTag(n)}${machineAuthorshipTag(n)})\n*selected via: ${provenance}*\n`;
-    const stale = supersededBy[n.id]
-      ? `\n> ⚠ SUPERSEDED by ${supersededBy[n.id]}. Do not follow; included only so you recognize stale references.\n`
+    const stale = isSuperseded(n)
+      ? `\n> ⚠ ${supersededLabel(n)}. Do not follow; included only so you recognize stale references.\n`
       : resolutionWarn(n) ? `\n>${resolutionWarn(n)}.\n` : "";
-    return (full && !supersededBy[n.id]) ? `${head}${stale}\n${n.body}\n` : `${head}${stale}\n${n.summary}\n`;
+    return (full && !isSuperseded(n)) ? `${head}${stale}\n${n.body}\n` : `${head}${stale}\n${n.summary}\n`;
   }
 
   // Norm rendering (issue-cc-norm-always-on-injection): an always_on norm rides
@@ -1360,8 +1377,14 @@ function compile(graph, opts = {}) {
     const add = (n, tag) => {
       if (seen.has(n.id)) return;
       seen.add(n.id);
-      const warn = supersededBy[n.id]
-        ? ` ⚠ SUPERSEDED by ${supersededBy[n.id]} — do not follow`
+      // The digest is AMBIENT context (the prompt and session-start hooks inject
+      // it unasked, a handful of slots wide), so a superseded node is dropped
+      // rather than flagged — its replacement is already pulled in by the
+      // supersession fixups above. A correction's explicit pin still renders
+      // it, flagged (issue-spor-superseded-context-injected-as-live).
+      if (isSuperseded(n) && !pinned.has(n.id)) return;
+      const warn = isSuperseded(n)
+        ? ` ⚠ ${supersededLabel(n)} — do not follow`
         : resolutionWarn(n);
       const proj = n.project ? `, ${n.project}` : "";
       lines.push(`- **${n.id} — ${n.title}** (${n.type}${proj}, ${n.date}${statusTag(n)}${crossTag(n)}${machineAuthorshipTag(n)}${tag ? `, ${tag}` : ""}): ${n.summary}${warn}`);
@@ -1846,6 +1869,17 @@ function validateGraphFiles(files, seedSchemas = [], opts = {}) {
     }
   }
 
+  // A `status: superseded` with no inbound `supersedes` edge names no
+  // replacement, so no reader can follow it to what is now in force
+  // (issue-spor-superseded-context-injected-as-live).
+  const supersededTargets = new Set();
+  for (const n of Object.values(nodes)) for (const e of n.edges) if (e.type === "supersedes") supersededTargets.add(e.to);
+  for (const n of Object.values(nodes)) {
+    if (String(n.status ?? "").toLowerCase() === "superseded" && !supersededTargets.has(n.id)) {
+      warnings.push(`${n.file}: status superseded but no node supersedes it — add a supersedes edge from its replacement so readers can find what is in force`);
+    }
+  }
+
   const byType = {};
   for (const n of Object.values(nodes)) byType[n.type] = (byType[n.type] ?? 0) + 1;
 

package/lib/tar.js

@@ -54,24 +54,61 @@ function splitUstarName(name) {
 function tarHeader(name, size, mtime) {
   const split = splitUstarName(name);
   if (!split) throw new Error(`ustar: '${name}' has no /-boundary split that fits prefix(155)+name(100)`);
+  return rawTarHeader(split.name, split.prefix, size, mtime, "0");
+}
+
+// One 512-byte ustar header block with the name/prefix fields already split.
+function rawTarHeader(name, prefix, size, mtime, typeflag) {
   const buf = Buffer.alloc(512);
-  buf.write(split.name, 0, 100, "utf8");
+  buf.write(name, 0, 100, "utf8");
   buf.write("0000644\0", 100); // mode
   buf.write("0000000\0", 108); // uid
   buf.write("0000000\0", 116); // gid
   buf.write(size.toString(8).padStart(11, "0") + "\0", 124);
   buf.write(mtime.toString(8).padStart(11, "0") + "\0", 136);
   buf.write("        ", 148); // chksum: spaces while summing
-  buf.write("0", 156); // typeflag: regular file
+  buf.write(typeflag, 156); // '0' regular file, 'x' pax extended header
   buf.write("ustar\0", 257);
   buf.write("00", 263);
-  if (split.prefix) buf.write(split.prefix, 345, 155, "utf8");
+  if (prefix) buf.write(prefix, 345, 155, "utf8");
   let sum = 0;
   for (const b of buf) sum += b;
   buf.write(sum.toString(8).padStart(6, "0") + "\0 ", 148);
   return buf;
 }
 
+// A pax extended-header record, "<len> <key>=<value>\n", where <len> counts the
+// whole record including its own digits.
+function paxRecord(key, value) {
+  const body = ` ${key}=${value}\n`;
+  const bodyLen = Buffer.byteLength(body, "utf8");
+  let digits = 1;
+  while (String(bodyLen + digits).length !== digits) digits++;
+  return `${bodyLen + digits}${body}`;
+}
+
+// The header bytes for one archive entry — the byte-faithful twin of the
+// server's tarEntryHeader (spor-server server/rest.js). A path the ustar prefix
+// split represents gets the plain ustar header; one it can't (a node id too long
+// for the 100-byte name field) gets a POSIX pax extended header carrying the
+// full `path`, then the regular header under a short deterministic stub name
+// (issue-spor-export-drops-ids-over-ustar-name-limit).
+function tarEntryHeader(name, size, mtime) {
+  const split = splitUstarName(name);
+  if (split) return rawTarHeader(split.name, split.prefix, size, mtime, "0");
+  const dir = name.includes("/") ? name.slice(0, name.lastIndexOf("/")) : "";
+  const hash = require("crypto").createHash("sha1").update(name).digest("hex").slice(0, 16);
+  const stub = `${dir ? `${dir}/` : ""}longname-${hash}`;
+  const pax = Buffer.from(paxRecord("path", name), "utf8");
+  const pad = (512 - (pax.length % 512)) % 512;
+  return Buffer.concat([
+    rawTarHeader(`${dir ? `${dir}/` : ""}PaxHeaders/${hash}`, "", pax.length, mtime, "x"),
+    pax,
+    Buffer.alloc(pad),
+    rawTarHeader(stub, "", size, mtime, "0"),
+  ]);
+}
+
 // Concatenate the descriptors ({name, abs}) into a ustar archive Buffer: a
 // header per file, its bytes, padding up to the next 512 boundary, then two
 // closing zero blocks. mtime mirrors the server (file mtime, second precision).
@@ -80,7 +117,7 @@ function buildTarball(descriptors) {
   for (const d of descriptors) {
     const data = fs.readFileSync(d.abs);
     const mtime = Math.max(0, Math.floor(fs.statSync(d.abs).mtimeMs / 1000));
-    parts.push(tarHeader(d.name, data.length, mtime));
+    parts.push(tarEntryHeader(d.name, data.length, mtime));
     parts.push(data);
     const pad = (512 - (data.length % 512)) % 512;
     if (pad) parts.push(Buffer.alloc(pad));
@@ -90,27 +127,17 @@ function buildTarball(descriptors) {
 }
 
 // The export entry list for a graph home's nodes/ dir, mirroring the server's
-// selection: every *.md file, sorted by name, as a `nodes/<name>` entry. Most
-// long ids are rescued by the prefix split (splitUstarName); an entry with no
-// viable split at all is dropped and counted (a path with no viable split is
-// still unrepresentable in this archive format).
+// selection: every *.md file, sorted by name, as a `nodes/<name>` entry. A long
+// id the prefix split can't represent rides a pax header (tarEntryHeader), so
+// nothing is dropped; `skipped` stays in the return shape (always 0) for callers.
 function collectNodeEntries(nodesDir) {
   const names = fs
     .readdirSync(nodesDir, { withFileTypes: true })
     .filter((d) => d.isFile() && d.name.endsWith(".md"))
     .map((d) => d.name)
     .sort();
-  const descriptors = [];
-  let skipped = 0;
-  for (const name of names) {
-    const entry = `nodes/${name}`;
-    if (!splitUstarName(entry)) {
-      skipped++;
-      continue;
-    }
-    descriptors.push({ name: entry, abs: path.join(nodesDir, name) });
-  }
-  return { descriptors, skipped };
+  const descriptors = names.map((name) => ({ name: `nodes/${name}`, abs: path.join(nodesDir, name) }));
+  return { descriptors, skipped: 0 };
 }
 
 // The whole local export in one call: { buffer, count, skipped } where buffer
@@ -141,24 +168,52 @@ function tarField(header, start, len) {
 // `prefix` field (the tarHeader/splitUstarName rescue for a long path) is
 // rejoined as `prefix + "/" + name`, matching how a real ustar reader
 // reconstructs the full path — same reconstruction rule splitUstarName's
-// comment describes for why the split can only land on an existing "/".
+// comment describes for why the split can only land on an existing "/". A pax
+// extended header (typeflag 'x') is consumed, not returned: its `path` record
+// names the entry that follows (the tarEntryHeader rescue for an id too long
+// for any ustar split, issue-spor-export-drops-ids-over-ustar-name-limit).
 function extract(buf) {
   const entries = [];
   let off = 0;
+  let paxPath = null; // a pending pax `path` record, applied to the NEXT entry only
   while (off + 512 <= buf.length) {
     const header = buf.subarray(off, off + 512);
     if (header.every((b) => b === 0)) break; // end-of-archive zero block
     const prefix = tarField(header, 345, 155);
     const name = prefix ? `${prefix}/${tarField(header, 0, 100)}` : tarField(header, 0, 100);
     const size = parseInt(tarField(header, 124, 12).trim() || "0", 8) || 0;
-    const typeflag = header[156]; // 0x30 '0' or 0x00 → regular file
+    const typeflag = header[156]; // 0x30 '0' or 0x00 → regular file; 0x78 'x' → pax
     off += 512; // advance past the header to the data
-    if (name && (typeflag === 0x30 || typeflag === 0)) {
-      entries.push({ name, data: Buffer.from(buf.subarray(off, off + size)) });
+    if (typeflag === 0x78) {
+      paxPath = parsePaxPath(buf.subarray(off, off + size));
+    } else {
+      if (typeflag === 0x30 || typeflag === 0) {
+        const full = paxPath || name;
+        if (full) entries.push({ name: full, data: Buffer.from(buf.subarray(off, off + size)) });
+      }
+      paxPath = null;
     }
     off += Math.ceil(size / 512) * 512; // skip the data + its padding to the next block
   }
   return entries;
 }
 
-module.exports = { tarHeader, splitUstarName, buildTarball, collectNodeEntries, exportNodesDir, extract };
+// The `path` value from a pax extended-header body ("<len> key=value\n"...), or
+// null when it carries none.
+function parsePaxPath(data) {
+  let pos = 0;
+  let found = null;
+  while (pos < data.length) {
+    const sp = data.indexOf(0x20, pos);
+    if (sp < 0) break;
+    const len = parseInt(data.toString("utf8", pos, sp), 10);
+    if (!(len > 0)) break;
+    const rec = data.toString("utf8", sp + 1, pos + len - 1); // drop the trailing \n
+    const eq = rec.indexOf("=");
+    if (eq > 0 && rec.slice(0, eq) === "path") found = rec.slice(eq + 1);
+    pos += len;
+  }
+  return found;
+}
+
+module.exports = { tarHeader, tarEntryHeader, paxRecord, splitUstarName, buildTarball, collectNodeEntries, exportNodesDir, extract };

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@sporhq/spor",
-  "version": "0.29.0",
+  "version": "0.29.1",
   "description": "Spor — a shared memory substrate for teams and agents. Decisions, their reasons, and the traces they leave. Knowledge-graph context compiler: session-start briefings, per-prompt digests, capture at discovery, end-of-session distillation, decision queue.",
   "license": "Apache-2.0",
   "author": "Anthony Allen",

package/scripts/engines/prompt-context.js

@@ -165,7 +165,7 @@ function compactNodeLine(line) {
   const [, id, title, meta, rest] = m;
   const warning = rest.match(/ ⚠ .+$/);
   const summary = warning ? rest.slice(0, warning.index).trim() : rest.trim();
-  const statusMatch = meta.match(/\b(resolved|done|rejected|abandoned|answered)\b/i);
+  const statusMatch = meta.match(/\b(resolved|done|rejected|abandoned|answered|superseded|settled)\b/i);
   const status = statusMatch ? ` (${statusMatch[1].toLowerCase()})` : "";
   return `- ${id}: ${title}${status} — ${summary}${warning ? warning[0] : ""}`;
 }
@@ -174,7 +174,15 @@ function microDigest(digest, maxNodes = MICRO_MAX_NODES, maxBytes = MICRO_MAX_BY
   const { nodes, corrections } = parseDigest(digest);
   if (!nodes.length) return u.byteHead(digest, maxBytes);
   let out = "Spor context (top matches; run /spor:brief for full):\n";
-  for (const line of nodes.slice(0, maxNodes)) out += `${compactNodeLine(line)}\n`;
+  // Whole node lines only: a line's ⚠ note (superseded / resolved) sits at
+  // its END, so a mid-line byte cut would inject the node minus the warning
+  // that says not to follow it (issue-spor-superseded-context-injected-as-live).
+  // The first line always goes in (byteHead below still bounds it).
+  for (const [i, line] of nodes.slice(0, maxNodes).entries()) {
+    const l = `${compactNodeLine(line)}\n`;
+    if (i > 0 && Buffer.byteLength(out + l, "utf8") > maxBytes) break;
+    out += l;
+  }
   if (corrections.length) {
     out += "\nStanding corrections:\n";
     for (const line of corrections) out += `${line}\n`;