@takboo/dsh-session-bin 0.2.0 → 0.2.1

package/dist/index.js

@@ -1799,22 +1799,90 @@ import { readFile } from "node:fs/promises";
 import { dirname, join as join2 } from "node:path";
 import { createHash as createHash3 } from "node:crypto";
 var nativeRetirementSdkSources = {
-  cordis: { version: "4.0.4", files: { "lib/index.js": "6a9394c0877ff45218818c6e815edd038f8057e1a1deb390a8d43ec81c57691e" } },
-  "dsh-session": { version: "0.2.0-rc.2", files: { "lib/index.js": "87ea85e2fb5318bf1f826db9a1c88c1b26d3ea328027a7f32b211880c4d62b9d", "lib/types/index.js": "71b3a3578b85704f026b590462e7d5e8bceb6dededd4e8782a83696138ec7da7" } },
-  "dsh-session-persistence": { version: "0.2.0-rc.2", files: { "lib/index.js": "cc0b6d3a224133af611b428d5a49020e300f86c3b4ba28037aeb219029bde3eb" } },
-  "dsh-session-persistence-jsonl": { version: "0.2.0-rc.2", files: { "lib/index.js": "0845707017acc2b4a8a75eab2244fa3fd88587b8094ab32014321dce7ca1e31b" } },
-  "dsh-session-format-catalog": { version: "0.2.0-rc.2", files: { "lib/index.js": "836bbb772ab505c299f1a4a246164c50c7c08b67ab0d17f1251d7ea2cd8c1818", "lib/types/index.js": "c7d797760bf2b9bc654751f2f8cb0b8a6b98998c8d9c1e41323c71a4d5f316f2" } },
-  "dsh-storage-domain": { version: "0.2.0-rc.2", files: { "lib/index.js": "e536ba09b7ccc0f10bb54818dfe44454374e5cbf7aeba140b216ba1ca2e87517" } },
-  "dsh-storage-json": { version: "0.2.0-rc.2", files: { "lib/index.js": "0a6b75d5569db3379edd93e863570170e1f4121b6c9fabd856f5b476cffe8df4" } },
-  "dsh-workspace": { version: "0.2.0-rc.2", files: { "lib/index.js": "a33af459cfc7af29dd17412443a63655fd5037dd348b0dec20a413ce60c6c8bc", "lib/types/index.js": "dbc8cc80e2b33c6bce07c73bd4e43be08af02051077ea9e032c2db2b9a154104" } },
-  "dsh-session-query": { version: "0.2.0-rc.2", files: { "lib/index.js": "dd8056fad008063c7e85169d4306720abe8efa6b32eac98f1b3053c6f89894aa" } },
-  "dsh-session-query-sqlite": { version: "0.2.0-rc.2", files: { "lib/index.js": "dbecf83320e10d93d735b3d01384ab817a0b90102ccecb0a22c013c71dfe70a0" } },
-  "dsh-session-projection-cache": { version: "0.2.0-rc.2", files: { "lib/index.js": "797282e86a23ece3a6a6246765277ec00360813bc0bac0450caff8c56278db0b" } },
-  "dsh-api-session-controller": { version: "0.2.0-rc.2", files: { "lib/index.js": "fb0f7b96130f595db20809eeb77a195b05f4a039f931d1e67692f1f74a4dd269", "lib/types/index.js": "764de9dca8a029a3c874f8fe15b864de59b222666853319f0e5f16fe29909e9f" } }
+  "cordis": {
+    "version": "4.0.5",
+    "files": {
+      "lib/index.js": "6a9394c0877ff45218818c6e815edd038f8057e1a1deb390a8d43ec81c57691e"
+    }
+  },
+  "dsh-session": {
+    "version": "0.2.1-rc.1",
+    "files": {
+      "lib/index.js": "2f5dd07cb5c744a29abbb8003a8a4cefd9e582c6e2538074ca299a0ddd02a3bf",
+      "lib/types/index.js": "59cced30c7ee65813c62f4858c2fc15c8c636df96507b60c15543468178b72f2"
+    }
+  },
+  "dsh-session-persistence": {
+    "version": "0.2.1-rc.1",
+    "files": {
+      "lib/index.js": "cc0b6d3a224133af611b428d5a49020e300f86c3b4ba28037aeb219029bde3eb"
+    }
+  },
+  "dsh-session-persistence-jsonl": {
+    "version": "0.2.1-rc.1",
+    "files": {
+      "lib/index.js": "973dd78679b2661d6f492343bc22b124ae958aa597d3b36c698a2c650f909984"
+    }
+  },
+  "dsh-session-format-catalog": {
+    "version": "0.2.1-rc.1",
+    "files": {
+      "lib/index.js": "836bbb772ab505c299f1a4a246164c50c7c08b67ab0d17f1251d7ea2cd8c1818",
+      "lib/types/index.js": "c7d797760bf2b9bc654751f2f8cb0b8a6b98998c8d9c1e41323c71a4d5f316f2"
+    }
+  },
+  "dsh-storage-domain": {
+    "version": "0.2.1-rc.1",
+    "files": {
+      "lib/index.js": "a54f7664d2f64fe04a08c7058ca5bff4fc69ed6a0d30c2bc11561b620698ef16"
+    }
+  },
+  "dsh-storage-json": {
+    "version": "0.2.1-rc.1",
+    "files": {
+      "lib/index.js": "0a6b75d5569db3379edd93e863570170e1f4121b6c9fabd856f5b476cffe8df4"
+    }
+  },
+  "dsh-workspace": {
+    "version": "0.2.1-rc.1",
+    "files": {
+      "lib/index.js": "931ca0cb10c5102066c7723690a887f0e6e8e7ab0ffdee1a782686745b0b934f",
+      "lib/types/index.js": "ed69989d8286598fddb3a40030723810a1238968e91ccfec05fc84657bb5ec74"
+    }
+  },
+  "dsh-session-query": {
+    "version": "0.2.1-rc.1",
+    "files": {
+      "lib/index.js": "76ce2944e561c12f48b5e240d68cafe54ce6d667b1d20722e6939ed834489939"
+    }
+  },
+  "dsh-session-query-sqlite": {
+    "version": "0.2.1-rc.1",
+    "files": {
+      "lib/index.js": "dbecf83320e10d93d735b3d01384ab817a0b90102ccecb0a22c013c71dfe70a0"
+    }
+  },
+  "dsh-session-projection-cache": {
+    "version": "0.2.1-rc.1",
+    "files": {
+      "lib/index.js": "faf307dce5db2fb7ff58b4c7d9e544fc7cad5de2f270a89326a8d7bb2bda9c80"
+    }
+  },
+  "dsh-api-session-controller": {
+    "version": "0.2.1-rc.1",
+    "files": {
+      "lib/index.js": "a9801acb577b03053c5d5a3191ff555c5f1d791d0acddec113bea4511e33b386",
+      "lib/types/index.js": "616ced16623b7448afa908ff65093eb6ef2a478d32e5ef9bc22634bfa9f80472"
+    }
+  }
 };
+var legacyDurableHostContract = "0.2.0-rc.2";
+var legacyDurableContractFingerprint = "2618a33decce99fe8ae893245236273d10ac5536bb9dd582dddd115ef27069f3";
 async function nativeRetirementSdkFingerprint() {
   const root = createRequire(import.meta.url);
-  const base = createRequire(root.resolve("@deepseek-ai/dsh/package.json"));
+  const hostPath = root.resolve("@deepseek-ai/dsh/package.json");
+  if (JSON.parse(await readFile(hostPath, "utf8")).version !== "0.2.1-rc.1") return null;
+  const base = createRequire(hostPath);
   for (const [name2, expected] of Object.entries(nativeRetirementSdkSources)) {
     let path;
     try {
@@ -1836,8 +1904,8 @@ async function nativeRetirementSdkFingerprint() {
   }
   const runtime = createRequire(base.resolve("@deepseek-ai/dsh-base/package.json"));
   for (const [name2, expected] of Object.entries({
-    "dsh-agent": "7b9aa39474de83115cf890dd7f8904cf0d59df0811cb335ab85565a04f1aac93",
-    "dsh-agent-loop": "00c4814d63f3d1e2754eb09144832d19b30499d6ea444730473f740b587948c2"
+    "dsh-agent": "7b59cf82c2784c25bdce4e3e24e5e5303b02b9f1003efacf50255492d17baf8b",
+    "dsh-agent-loop": "cf57e3ecd487ac5c2553455aaa5cef2c6fb41e6bd61be5aa455675d1d7193033"
   })) {
     let path;
     try {
@@ -1846,9 +1914,9 @@ async function nativeRetirementSdkFingerprint() {
       if (error.code === "MODULE_NOT_FOUND") return null;
       throw error;
     }
-    if (JSON.parse(await readFile(path, "utf8")).version !== "0.2.0-rc.2" || createHash3("sha256").update(await readFile(join2(dirname(path), "lib/index.js"))).digest("hex") !== expected) return null;
+    if (JSON.parse(await readFile(path, "utf8")).version !== "0.2.1-rc.1" || createHash3("sha256").update(await readFile(join2(dirname(path), "lib/index.js"))).digest("hex") !== expected) return null;
   }
-  return createHash3("sha256").update(JSON.stringify(nativeRetirementSdkSources)).digest("hex");
+  return legacyDurableContractFingerprint;
 }
 
 // src/host/native-jsonl-files.ts
@@ -1857,1511 +1925,1518 @@ import { isAbsolute as isAbsolute2, join as join3, relative, resolve as resolve2
 import { createHash as createHash4 } from "node:crypto";
 import { createRequire as createRequire2 } from "node:module";
 import { zstdDecompressSync } from "node:zlib";
-import Jsonl from "@deepseek-ai/dsh-session-persistence-jsonl";
+import { SessionPersistence } from "@deepseek-ai/dsh-session-persistence";
 import { SESSION_FORMAT_VERSION } from "@deepseek-ai/dsh-session";
 import { sessionFormatCatalog } from "@deepseek-ai/dsh-session-format-catalog";
 import { tryLockExclusive as tryLockExclusive2 } from "@deepseek-ai/node-addon-system/flock";
 import { z as z4 } from "zod";
-var integer = z4.string().regex(/^\d+$/);
-var hash = z4.string().regex(/^[a-f0-9]{64}$/);
-var positiveInteger = z4.string().regex(/^[1-9]\d*$/);
-var nodeIdentitySchema = z4.object({ dev: integer, ino: positiveInteger, birthtimeNs: positiveInteger }).strict();
-var fileIdentitySchema = nodeIdentitySchema.extend({ size: integer, mtimeNs: integer, ctimeNs: integer, nlink: z4.literal("1") }).strict();
-var lockIdentitySchema = nodeIdentitySchema.extend({ size: z4.literal("0"), nlink: z4.literal("1") }).strict();
-var windowsLockSchema = z4.object({ kind: z4.literal("win32-semaphore"), name: z4.string().min(1) }).strict();
-var nativeLockSchema = z4.union([lockIdentitySchema, windowsLockSchema]);
-var headerIdentitySchema = z4.object({
-  id: z4.string().min(1),
-  createdAt: z4.number().int().nonnegative(),
-  cwd: z4.string().nullable(),
-  parentSession: z4.string().nullable(),
-  origin: z4.literal("subagent").nullable(),
-  isSeeded: z4.boolean(),
-  delegationDepth: z4.number().int().nonnegative(),
-  agentPreset: z4.string().nullable()
-}).strict();
-var fileRowSchema = z4.object({
-  resourceId: z4.string().min(1),
-  kind: z4.enum(["generation", "staging"]),
-  formatVersion: z4.number().int().min(0).max(4),
-  compression: z4.enum(["none", "zstd"]),
-  identity: fileIdentitySchema,
-  digest: hash,
-  header: headerIdentitySchema,
-  revision: hash
-}).strict().superRefine((value, ctx) => {
-  try {
-    const kind = classify(value.resourceId);
-    if (kind.kind !== value.kind || kind.version !== value.formatVersion || kind.compression !== value.compression || value.revision !== sha(JSON.stringify({ identity: value.identity, digest: value.digest, header: value.header }))) {
-      ctx.addIssue({ code: "custom", message: "Resource classification and identity digest must agree." });
-    }
-  } catch {
-    ctx.addIssue({ code: "custom", message: "Unknown physical resource name." });
+
+// src/host/native-retirement-persistence.ts
+import { SessionId as SessionId2 } from "@deepseek-ai/dsh-session";
+
+// src/host/native-retirement-admission.ts
+import { AsyncLocalStorage } from "node:async_hooks";
+var NativeAdmissionError = class extends Error {
+  code = "native/session-busy";
+};
+var NativeAdmission = class {
+  maintenance = new AsyncLocalStorage();
+  acceptedFrames = new AsyncLocalStorage();
+  activeAcceptedFrames = /* @__PURE__ */ new Set();
+  held = /* @__PURE__ */ new Set();
+  released = /* @__PURE__ */ new Map();
+  pending = /* @__PURE__ */ new Map();
+  globalReads = /* @__PURE__ */ new Set();
+  retired = /* @__PURE__ */ new Set();
+  candidates = /* @__PURE__ */ new Set();
+  closing = false;
+  failed = false;
+  ready = false;
+  requiresRecovery() {
+    return this.failed;
   }
-});
-var nativeJsonlFileSchema = fileRowSchema;
-var nativeJsonlInventorySchema = z4.object({
-  schemaVersion: z4.literal(1),
-  root: z4.string(),
-  rootIdentity: nodeIdentitySchema,
-  directory: z4.string(),
-  directoryIdentity: nodeIdentitySchema,
-  sessionId: z4.string().min(1),
-  compression: z4.enum(["none", "zstd"]),
-  header: headerIdentitySchema,
-  anchor: z4.object({ resourceId: z4.string(), identity: nodeIdentitySchema, header: headerIdentitySchema }).strict(),
-  lock: nativeLockSchema,
-  files: z4.array(fileRowSchema).max(4096),
-  revision: hash
-}).strict().superRefine((value, ctx) => {
-  try {
-    const anchor = generation(value.anchor.resourceId);
-    if (!isAbsolute2(value.root) || value.directory !== join3(project(value.header.cwd), segment(value.sessionId)) || value.header.id !== value.sessionId || !same(value.anchor.header, value.header) || !anchor || anchor.compression !== value.compression || new Set(value.files.map((row) => row.resourceId)).size !== value.files.length || value.files.some((row) => row.compression !== value.compression || !same(row.header, value.header)) || value.revision !== sha(JSON.stringify(value.files))) {
-      ctx.addIssue({ code: "custom", message: "Frozen directory, header identities, file scope and digest must agree." });
-    }
-  } catch {
-    ctx.addIssue({ code: "custom", message: "Invalid frozen directory or anchor." });
+  activate() {
+    this.ready = true;
   }
-});
-var NativeJsonlRefusal = class extends Error {
-  constructor(code, message) {
-    super(message);
-    this.code = code;
-    this.name = "NativeJsonlRefusal";
+  suspend() {
+    this.failed = true;
   }
-};
-function refuse(code, message) {
-  throw new NativeJsonlRefusal(code, message);
-}
-function sha(value) {
-  return createHash4("sha256").update(value).digest("hex");
-}
-function same(a, b) {
-  return JSON.stringify(a) === JSON.stringify(b);
-}
-function nodeIdentity(stat) {
-  if (stat.ino <= 0n || stat.birthtimeNs <= 0n) refuse("jsonl/identity-unavailable", "The filesystem does not provide a stable inode and creation identity.");
-  return { dev: String(stat.dev), ino: String(stat.ino), birthtimeNs: String(stat.birthtimeNs) };
-}
-function nodeIdentityFromRow(row) {
-  return { dev: row.identity.dev, ino: row.identity.ino, birthtimeNs: row.identity.birthtimeNs };
-}
-function fileIdentity(stat) {
-  if (!stat.isFile() || stat.nlink !== 1n) refuse("jsonl/unsafe-file", "Resources must be exclusive regular files without additional hard links.");
-  return fileIdentitySchema.parse({ ...nodeIdentity(stat), size: String(stat.size), mtimeNs: String(stat.mtimeNs), ctimeNs: String(stat.ctimeNs), nlink: "1" });
-}
-function lockIdentity(stat) {
-  const identity3 = fileIdentity(stat);
-  if (identity3.size !== "0") refuse("jsonl/lock-invalid", "The existing stable lock must contain no session content.");
-  return lockIdentitySchema.parse({ ...nodeIdentity(stat), size: "0", nlink: "1" });
-}
-function headerIdentity(header) {
-  return headerIdentitySchema.parse({
-    id: header.id,
-    createdAt: header.createdAt,
-    cwd: header.cwd ?? null,
-    parentSession: header.parentSession ?? null,
-    origin: header.origin ?? null,
-    isSeeded: header.isSeeded,
-    delegationDepth: header.delegationDepth ?? 0,
-    agentPreset: header.agentPreset ?? null
-  });
-}
-function segment(value) {
-  if (!value) refuse("jsonl/identity-invalid", "A path identity cannot be empty.");
-  if (value === "." || value === "..") return value.replace(/\./g, "~002E");
-  return value.replace(/[^A-Za-z0-9._-]/g, (unit) => `~${unit.charCodeAt(0).toString(16).toUpperCase().padStart(4, "0")}`);
-}
-function project(cwd) {
-  if (cwd === null) return "_no-cwd";
-  if (!isAbsolute2(cwd)) refuse("jsonl/identity-invalid", "The stored cwd must be absolute.");
-  const readable = segment(cwd.replace(/[/\\:]+/g, "-")).replace(/^-+/, "") || "root";
-  return `--${readable.slice(0, 251)}--`;
-}
-function generation(name2) {
-  const match = /^session(?:\.v([1-9]\d*))?\.jsonl(\.zstd)?$/.exec(name2);
-  if (!match) return;
-  const version = match[1] === void 0 ? 0 : Number(match[1]);
-  if (!Number.isSafeInteger(version) || version > SESSION_FORMAT_VERSION) refuse("jsonl/unsupported-generation", "Unknown future physical generations cannot be retired.");
-  return { version, compression: match[2] ? "zstd" : "none" };
-}
-function classify(name2) {
-  const committed = generation(name2);
-  if (committed) return { ...committed, kind: "generation" };
-  const materializing = /^(session(?:\.v[1-9]\d*)?\.jsonl(?:\.zstd)?)\.[a-f0-9]{12}\.tmp$/.exec(name2);
-  if (materializing) return { ...generation(materializing[1]), kind: "staging" };
-  const migrating = /^session\.migration\.[a-f0-9]{16}\.jsonl(\.zstd)?\.tmp$/.exec(name2);
-  if (migrating) return { version: SESSION_FORMAT_VERSION, compression: migrating[1] ? "zstd" : "none", kind: "staging" };
-  refuse("jsonl/unknown-resource", `Unclassified session resource: ${name2}`);
-}
-var HEADER_LIMIT = 1024 * 1024;
-function firstFrameEnd(bytes) {
-  if (bytes.length < 5) return;
-  if (bytes.readUInt32LE(0) !== 4247762216) refuse("jsonl/header-invalid", "The first Zstandard frame is not a standard frame.");
-  const descriptor2 = bytes[4];
-  if (descriptor2 & 24) refuse("jsonl/header-invalid", "Reserved Zstandard frame flags are unsupported.");
-  const single = Boolean(descriptor2 & 32);
-  const sizeFlag = descriptor2 >>> 6;
-  const dictionaryBytes = [0, 1, 2, 4][descriptor2 & 3];
-  const sizeBytes = sizeFlag === 0 ? single ? 1 : 0 : [0, 2, 4, 8][sizeFlag];
-  let cursor = 5 + (single ? 0 : 1) + dictionaryBytes + sizeBytes;
-  if (cursor > bytes.length) return;
-  for (; ; ) {
-    if (cursor + 3 > bytes.length) return;
-    const block = bytes.readUIntLE(cursor, 3);
-    const type = block >>> 1 & 3;
-    if (type === 3) refuse("jsonl/header-invalid", "Reserved Zstandard block type.");
-    cursor += 3 + (type === 1 ? 1 : block >>> 3);
-    if (cursor > bytes.length) return;
-    if (block & 1) {
-      cursor += descriptor2 & 4 ? 4 : 0;
-      return cursor <= bytes.length ? cursor : void 0;
+  beginClose() {
+    this.closing = true;
+  }
+  isRetired(id) {
+    return this.retired.has(id) || this.failed && this.candidates.has(id);
+  }
+  hasTombstones() {
+    return this.retired.size > 0 || this.failed && this.candidates.size > 0;
+  }
+  markRetired(id) {
+    this.retired.add(id);
+  }
+  isAcceptedFrame() {
+    const frame = this.acceptedFrames.getStore();
+    return frame !== void 0 && this.activeAcceptedFrames.has(frame);
+  }
+  assertAllowed(id) {
+    const maintenance = this.maintenance.getStore();
+    if (maintenance?.active && maintenance.id === id && !(this.failed && this.candidates.has(id))) return;
+    if (!this.ready || this.closing && !this.isAcceptedFrame() || this.failed && this.candidates.has(id) || this.retired.has(id) || this.held.has(id) && !this.isAcceptedFrame()) {
+      throw new NativeAdmissionError("The session is reserved for retirement or awaiting recovery.");
     }
   }
-}
-function decodeHeader(bytes, compression, version) {
-  let line;
-  if (compression === "none") {
-    const newline = bytes.indexOf(10);
-    if (newline < 0) refuse("jsonl/header-invalid", "A complete physical header is required, including for staging.");
-    line = bytes.subarray(0, newline);
-  } else {
-    const end = firstFrameEnd(bytes);
-    if (end === void 0) refuse("jsonl/header-invalid", "A complete Zstandard header frame is required.");
-    let decoded;
+  bypass(id, work) {
+    const token = { id, active: true };
     try {
-      decoded = zstdDecompressSync(bytes.subarray(0, end), { maxOutputLength: HEADER_LIMIT });
-    } catch {
-      refuse("jsonl/header-invalid", "The bounded first Zstandard frame cannot be decoded.");
+      const value = this.maintenance.run(token, work);
+      if (value && typeof value.then === "function") {
+        return Promise.resolve(value).finally(() => {
+          token.active = false;
+        });
+      }
+      token.active = false;
+      return value;
+    } catch (error) {
+      token.active = false;
+      throw error;
     }
-    if (!decoded.length || decoded.indexOf(10) !== decoded.length - 1) refuse("jsonl/header-invalid", "The header frame must contain exactly one newline-terminated record.");
-    line = decoded.subarray(0, -1);
   }
-  try {
-    const raw = JSON.parse(new TextDecoder("utf-8", { fatal: true }).decode(line));
-    const result = sessionFormatCatalog.readHeader(raw);
-    if (result.status !== "current" && result.status !== "migration-required") refuse("jsonl/header-invalid", "Malformed or unsupported physical Session header.");
-    if (result.storedVersion !== version) refuse("jsonl/header-invalid", "Physical filename and header versions differ.");
-    return headerIdentity(result.header);
-  } catch (error) {
-    if (error instanceof NativeJsonlRefusal) throw error;
-    refuse("jsonl/header-invalid", "The physical Session header cannot be decoded and identified.");
+  withoutBypass(work) {
+    return this.maintenance.run(void 0, work);
   }
-}
-function missing(error) {
-  return error?.code === "ENOENT";
-}
-function leaseStamp(inventory) {
-  return JSON.stringify({
-    root: inventory.root,
-    rootIdentity: inventory.rootIdentity,
-    directory: inventory.directory,
-    directoryIdentity: inventory.directoryIdentity,
-    sessionId: inventory.sessionId,
-    compression: inventory.compression,
-    header: inventory.header,
-    anchor: inventory.anchor,
-    lock: inventory.lock
-  });
-}
-var NativeJsonlFiles = class _NativeJsonlFiles {
-  constructor(provider, root, compression, rootIdentity) {
-    this.provider = provider;
-    this.root = root;
-    this.compression = compression;
-    this.rootIdentity = rootIdentity;
+  track(id, work) {
+    this.assertAllowed(id);
+    const tasks = this.pending.get(id) ?? /* @__PURE__ */ new Set();
+    this.pending.set(id, tasks);
+    const frame = Symbol("native-accepted-operation");
+    this.activeAcceptedFrames.add(frame);
+    const task = this.acceptedFrames.run(frame, () => Promise.resolve().then(work));
+    tasks.add(task);
+    void task.finally(() => {
+      this.activeAcceptedFrames.delete(frame);
+      tasks.delete(task);
+      if (!tasks.size) this.pending.delete(id);
+    }).catch(() => {
+    });
+    return task;
   }
-  leases = /* @__PURE__ */ new Map();
-  static async open(provider) {
-    if (!nativePlatformCandidate()) return;
-    if (!(provider instanceof Jsonl) || provider.name !== "session-persistence-jsonl" || SESSION_FORMAT_VERSION !== 4) return;
-    const internals = provider;
-    if (typeof internals.root !== "string" || !isAbsolute2(internals.root) || internals.compression !== "none" && internals.compression !== "zstd" || typeof provider.config.root !== "string" || resolve2(provider.config.root) !== internals.root || (provider.config.compression ?? "zstd") !== internals.compression) return;
-    const require2 = createRequire2(import.meta.url);
-    const metadata = require2("@deepseek-ai/dsh-session-persistence-jsonl/package.json");
-    if (metadata.version !== "0.2.0-rc.2") return;
-    let root;
-    try {
-      root = await realpath2(internals.root);
-    } catch (error) {
-      if (missing(error)) return;
-      throw error;
+  async trackGlobal(work) {
+    if (this.closing && !this.isAcceptedFrame() && !this.maintenance.getStore()?.active) {
+      throw new NativeAdmissionError("Native admission is closing.");
     }
-    if (process.platform === "win32" && resolve2(internals.root).toLowerCase() !== root.toLowerCase()) return;
-    const identity3 = await lstat3(root, { bigint: true });
-    if (!identity3.isDirectory()) refuse("jsonl/root-invalid", "The configured root must be an existing directory.");
-    if (identity3.ino <= 0n || identity3.birthtimeNs <= 0n) return;
-    return new _NativeJsonlFiles(provider, root, internals.compression, nodeIdentity(identity3));
-  }
-  async inspect(sessionId, header) {
-    if (header.version !== SESSION_FORMAT_VERSION) refuse("jsonl/identity-invalid", "Inspection requires the current logical Session header.");
-    const identity3 = headerIdentity(header);
-    if (sessionId !== identity3.id) refuse("jsonl/identity-invalid", "Requested session and header identities differ.");
-    const directory = join3(project(identity3.cwd), segment(sessionId));
-    const base = await this.directory(directory, sessionId, identity3);
-    const files = await this.rows(base.path, identity3);
-    const canonical3 = files.filter((row) => row.kind === "generation").sort((a, b) => a.formatVersion - b.formatVersion)[0];
-    if (!canonical3) refuse("jsonl/session-not-found", "No identified committed generation exists.");
-    const inventory = {
-      schemaVersion: 1,
-      root: this.root,
-      rootIdentity: this.rootIdentity,
-      directory,
-      directoryIdentity: base.identity,
-      sessionId,
-      compression: this.compression,
-      header: identity3,
-      anchor: {
-        resourceId: canonical3.resourceId,
-        identity: { dev: canonical3.identity.dev, ino: canonical3.identity.ino, birthtimeNs: canonical3.identity.birthtimeNs },
-        header: identity3
-      },
-      lock: await this.lockIdentity(base.path),
-      files,
-      revision: sha(JSON.stringify(files))
-    };
-    await this.directory(directory, sessionId, identity3);
-    return nativeJsonlInventorySchema.parse(inventory);
-  }
-  /** Re-enumerate the entire scope without changing its original durable anchor. */
-  async current(input) {
-    const inventory = this.validate(input);
-    const base = await this.assertDirectory(inventory);
-    const files = await this.rows(base.path, inventory.header, inventory);
-    const lock = await this.lockIdentity(base.path);
-    if (!same(lock, inventory.lock)) refuse("jsonl/lock-changed", "The stable coordination file changed.");
-    return nativeJsonlInventorySchema.parse({ ...inventory, files, revision: sha(JSON.stringify(files)) });
-  }
-  async acquire(input, options = {}) {
-    const inventory = this.validate(input);
-    const base = await this.assertDirectory(inventory);
-    let fd;
-    let unlock;
-    const record = {
-      stamp: leaseStamp(inventory),
-      closing: false,
-      tail: Promise.resolve(),
-      pending: /* @__PURE__ */ new Set(),
-      recovering: options.recovering === true
-    };
-    let held = false;
+    while (this.held.size && !this.maintenance.getStore()?.active && !this.isAcceptedFrame()) {
+      await Promise.all([...this.released.values()].map((signal) => signal.promise));
+    }
+    if (!this.ready || this.closing && !this.isAcceptedFrame() && !this.maintenance.getStore()?.active) {
+      throw new NativeAdmissionError("Native admission is not accepting another request.");
+    }
+    const frame = Symbol("native-header-read");
+    this.activeAcceptedFrames.add(frame);
+    const task = this.acceptedFrames.run(frame, () => Promise.resolve().then(work));
+    this.globalReads.add(task);
     try {
-      if (process.platform === "win32") {
-        try {
-          unlock = await acquireWindowsSemaphore(join3(base.path, "session.lock"), "session");
-        } catch (error) {
-          if (error.code === "EBUSY") refuse("jsonl/writer-active", "Another writer holds the session kernel lease.");
-          throw error;
-        }
-      } else {
-        fd = await this.openFile(join3(base.path, "session.lock"), "write");
-        if (!same(lockIdentity(await fd.stat({ bigint: true })), inventory.lock)) refuse("jsonl/lock-changed", "The frozen stable lock changed.");
-        try {
-          await tryLockExclusive2(fd.fd);
-        } catch (error) {
-          if (["EAGAIN", "EWOULDBLOCK"].includes(error.code ?? "")) refuse("jsonl/writer-active", "Another writer holds the session lock.");
-          throw error;
-        }
-      }
-      await this.assertDirectory(inventory);
-      if (!same(await this.lockIdentity(base.path), inventory.lock)) refuse("jsonl/lock-changed", "The held lock no longer has its frozen namespace identity.");
-      this.leases.set(inventory.directory, record);
-      held = true;
+      return await task;
     } finally {
-      if (!held) {
-        try {
-          await unlock?.();
-        } finally {
-          await fd?.close();
-        }
-      }
+      this.activeAcceptedFrames.delete(frame);
+      this.globalReads.delete(task);
     }
-    let releasing;
-    return { release: () => releasing ??= (async () => {
-      record.closing = true;
-      await Promise.allSettled([...record.pending]);
-      try {
-        try {
-          await unlock?.();
-        } finally {
-          await fd?.close();
-        }
-      } finally {
-        if (this.leases.get(inventory.directory) === record) this.leases.delete(inventory.directory);
-      }
-    })() };
   }
-  /** Caller must have persisted the exact retirement intent before this method. */
-  async erase(input, inputRow) {
-    const inventory = this.validate(input);
-    const row = fileRowSchema.parse(inputRow);
-    const lease = this.leases.get(inventory.directory);
-    if (!lease || lease.closing || lease.stamp !== leaseStamp(inventory)) refuse("jsonl/lease-required", "Erasure requires the same stable namespace kernel lease.");
-    if (!inventory.files.some((saved) => same(saved, row))) refuse("jsonl/scope-changed", "The resource is outside the frozen inventory.");
-    const operation = lease.tail.then(() => this.eraseInner(inventory, row));
-    lease.tail = operation.then(() => void 0, () => void 0);
-    lease.pending.add(operation);
-    try {
-      await operation;
-    } finally {
-      lease.pending.delete(operation);
+  async drain(id) {
+    for (; ; ) {
+      const tasks = id === void 0 ? [...this.pending.values()].flatMap((set) => [...set]) : [...this.pending.get(id) ?? []];
+      tasks.push(...this.globalReads);
+      if (!tasks.length) return;
+      await Promise.allSettled(tasks);
     }
   }
-  async eraseInner(inventory, row) {
-    const base = await this.assertDirectory(inventory);
-    const names = await readdir(base.path);
-    if (names.some((name2) => name2 !== "session.lock" && !inventory.files.some((saved) => saved.resourceId === name2))) refuse("jsonl/scope-changed", "A new or unknown file entered the frozen scope.");
-    if (!same(await this.lockIdentity(base.path), inventory.lock)) refuse("jsonl/lock-changed", "The held lock changed.");
-    const absolute = join3(base.path, row.resourceId);
-    const target = resolve2(absolute);
-    if (target !== absolute || relative(base.path, target) !== row.resourceId) refuse("jsonl/path-invalid", "The exact resource must be a direct child of its bound directory.");
-    const remainder = await this.isWindowsErasureRemainder(inventory, row);
+  async acquire(id, recovery = false) {
+    while (this.held.has(id)) await this.released.get(id).promise;
+    if (this.failed || this.closing || !this.ready || !recovery && this.retired.has(id)) {
+      throw new NativeAdmissionError("The session cannot enter another retirement scope.");
+    }
+    let resolve4;
+    const signal = { promise: new Promise((done2) => {
+      resolve4 = done2;
+    }), resolve: () => resolve4() };
+    this.held.add(id);
+    this.released.set(id, signal);
+    this.candidates.add(id);
+    const release = () => {
+      this.held.delete(id);
+      this.released.delete(id);
+      signal.resolve();
+    };
     try {
-      if (!remainder) {
-        const observed = await this.readRow(base.path, row.resourceId, inventory.header);
-        if (!same(row, observed)) refuse("jsonl/resource-changed", "The physical resource identity or bytes changed after confirmation.");
-      }
+      await this.drain(id);
     } catch (error) {
-      if (missing(error)) {
-        await this.syncDirectory(base.path);
-        return;
-      }
+      release();
       throw error;
     }
-    await this.assertDirectory(inventory);
-    const latest = fileIdentity(await lstat3(absolute, { bigint: true }));
-    if (remainder ? latest.size !== "0" || !same(nodeIdentity(await lstat3(absolute, { bigint: true })), nodeIdentityFromRow(row)) : !same(latest, row.identity)) refuse("jsonl/resource-changed", "The exact resource changed before erasure.");
-    if (process.platform === "win32") {
-      const handle = await this.openFile(absolute, "write");
-      try {
-        const opened = fileIdentity(await handle.stat({ bigint: true }));
-        if (remainder ? opened.size !== "0" || !same(nodeIdentity(await handle.stat({ bigint: true })), nodeIdentityFromRow(row)) : !same(opened, row.identity)) refuse("jsonl/resource-changed", "The opened erasure object differs from the frozen file.");
-        await handle.truncate(0);
-        await handle.sync();
-      } finally {
-        await handle.close();
+    let done = false;
+    return () => {
+      if (!done) {
+        done = true;
+        release();
       }
-      const cleared = await lstat3(absolute, { bigint: true });
-      if (!cleared.isFile() || cleared.nlink !== 1n || cleared.size !== 0n || !same(nodeIdentity(cleared), nodeIdentityFromRow(row))) refuse("jsonl/resource-changed", "The cleared erasure object changed before unlink.");
-    }
-    await unlink(absolute);
-    await this.syncDirectory(base.path);
+    };
   }
-  validate(input) {
-    const value = nativeJsonlInventorySchema.parse(input);
-    if (value.root !== this.root || value.compression !== this.compression || !same(value.rootIdentity, this.rootIdentity) || value.sessionId !== value.header.id || value.directory !== join3(project(value.header.cwd), segment(value.sessionId)) || value.files.some((row) => row.resourceId.includes(sep) || row.resourceId.includes("/") || row.resourceId.includes("\\") || row.resourceId === "session.lock" || !same(row.header, value.header))) refuse("jsonl/binding-invalid", "The inventory is not bound to this adapter and exact directory.");
-    const windowsLock = "kind" in value.lock;
-    if (process.platform === "win32" !== windowsLock || "kind" in value.lock && value.lock.name !== windowsSemaphoreName(join3(this.root, value.directory, "session.lock"), "session")) {
-      refuse("jsonl/binding-invalid", "The inventory kernel lease belongs to another platform or namespace.");
-    }
-    if (new Set(value.files.map((row) => row.resourceId)).size !== value.files.length || value.revision !== sha(JSON.stringify(value.files))) refuse("jsonl/binding-invalid", "The frozen resource inventory digest is invalid.");
-    for (const row of value.files) {
-      const classified = classify(row.resourceId);
-      if (classified.kind !== row.kind || classified.version !== row.formatVersion || classified.compression !== row.compression || row.revision !== sha(JSON.stringify({ identity: row.identity, digest: row.digest, header: row.header }))) refuse("jsonl/binding-invalid", "Frozen resource classification or digest changed.");
-    }
-    return value;
-  }
-  async directory(directory, sessionId, header) {
-    const internals = this.provider;
-    if (await realpath2(internals.root) !== this.root || internals.compression !== this.compression || process.platform === "win32" && resolve2(internals.root).toLowerCase() !== this.root.toLowerCase() || resolve2(this.provider.config.root) !== internals.root || (this.provider.config.compression ?? "zstd") !== this.compression) refuse("jsonl/provider-changed", "The provider root or encoding changed.");
-    const root = await lstat3(this.root, { bigint: true });
-    if (!root.isDirectory() || !same(nodeIdentity(root), this.rootIdentity)) refuse("jsonl/root-changed", "The configured root identity changed.");
-    if (directory !== join3(project(header.cwd), segment(sessionId))) refuse("jsonl/path-invalid", "Directory does not match the stored identity.");
-    const matches = [];
-    for (const entry of await readdir(this.root, { withFileTypes: true })) {
-      const projectPath = join3(this.root, entry.name);
-      if ([`${segment(sessionId)}.jsonl`, `${segment(sessionId)}.jsonl.zstd`].includes(entry.name)) refuse("jsonl/legacy-layout", "Root-level flat session artifacts are not admitted.");
-      if (entry.isSymbolicLink()) refuse("jsonl/unsafe-directory", "Symlink project directories cannot certify a unique target.");
-      if (!entry.isDirectory()) continue;
-      for (const suffix of [".jsonl", ".jsonl.zstd"]) {
-        try {
-          await lstat3(join3(projectPath, segment(sessionId) + suffix));
-          refuse("jsonl/legacy-layout", "Flat session artifacts are not admitted.");
-        } catch (error) {
-          if (!missing(error)) throw error;
-        }
-      }
-      const candidate = join3(projectPath, segment(sessionId));
-      try {
-        const stat = await lstat3(candidate, { bigint: true });
-        if (!stat.isDirectory()) refuse("jsonl/unsafe-directory", "Session directories must be direct regular directories.");
-        matches.push(candidate);
-      } catch (error) {
-        if (!missing(error)) throw error;
-      }
-    }
-    const path = join3(this.root, directory);
-    if (matches.length !== 1 || matches[0] !== path) refuse("jsonl/identity-ambiguous", "The session directory is missing, misplaced, or duplicated across projects.");
-    const actual = await realpath2(path);
-    const rel = relative(this.root, actual);
-    if (actual !== path || rel !== directory || rel.startsWith(`..${sep}`) || isAbsolute2(rel)) refuse("jsonl/unsafe-directory", "The session directory leaves the configured root.");
-    return { path, identity: nodeIdentity(await lstat3(path, { bigint: true })) };
+};
+
+// src/host/native-retirement-persistence.ts
+function nativeServiceInstance(value) {
+  return Reflect.get(value, Symbol.for("cordis.original")) ?? value;
+}
+var NativePersistenceAdapter = class {
+  constructor(provider, admission) {
+    this.provider = provider;
+    this.admission = admission;
+    const raw = nativeServiceInstance(provider);
+    if (!(raw.tracker?.openHandles instanceof Set) || !(raw.tracker.writers instanceof Map) || !(raw.tracker.pending instanceof Map) || !(raw.migrationPreparations instanceof Map) || !(raw.coldLogMemo instanceof Map)) throw new Error("JSONL retirement runtime shape does not match the pinned provider.");
+    this.raw = raw;
+    this.originalStat = provider.stat.bind(provider);
+    this.originalList = provider.list.bind(provider);
   }
-  async assertDirectory(inventory) {
-    const base = await this.directory(inventory.directory, inventory.sessionId, inventory.header);
-    if (!same(base.identity, inventory.directoryIdentity)) refuse("jsonl/directory-changed", "The bound directory incarnation changed.");
-    return base;
+  raw;
+  originalStat;
+  originalList;
+  restore = [];
+  detached = false;
+  active = true;
+  managedHandles = /* @__PURE__ */ new WeakSet();
+  stat(id) {
+    return this.originalStat(SessionId2(id));
   }
-  async lockIdentity(directory) {
-    if (process.platform === "win32") return { kind: "win32-semaphore", name: windowsSemaphoreName(join3(directory, "session.lock"), "session") };
-    return lockIdentity(await lstat3(join3(directory, "session.lock"), { bigint: true }));
+  list() {
+    return this.originalList();
   }
-  async isWindowsErasureRemainder(inventory, row) {
-    const lease = this.leases.get(inventory.directory);
-    if (process.platform !== "win32" || !lease?.recovering || lease.stamp !== leaseStamp(inventory)) return false;
-    try {
-      const handle = await this.openFile(join3(this.root, inventory.directory, row.resourceId), "read");
-      try {
-        const stat = await handle.stat({ bigint: true });
-        return stat.size === 0n && same(nodeIdentity(stat), nodeIdentityFromRow(row));
-      } finally {
-        await handle.close();
-      }
-    } catch (error) {
-      if (missing(error)) return false;
-      throw error;
-    }
+  busy(id) {
+    return this.raw.tracker.pending.has(id) || this.raw.tracker.writers.has(id) || [...this.raw.tracker.openHandles].some((handle) => handle.id === id) || this.raw.migrationPreparations.size !== 0;
   }
-  async rows(directory, header, frozen) {
-    const names = (await readdir(directory)).sort();
-    if (names.length > 4097) refuse("jsonl/scope-too-large", "Session scope exceeds the bounded inventory.");
-    const posix = process.platform !== "win32";
-    if (posix && !names.includes("session.lock")) refuse("jsonl/lock-missing", "The existing stable writer lock is required.");
-    const rows = [];
-    for (const name2 of names) {
-      if (posix && name2 === "session.lock") continue;
-      const original = frozen?.files.find((row) => row.resourceId === name2);
-      if (frozen && original && await this.isWindowsErasureRemainder(frozen, original)) rows.push(original);
-      else rows.push(await this.readRow(directory, name2, header));
-    }
-    if (!same(names, (await readdir(directory)).sort())) refuse("jsonl/scope-changed", "The directory changed while enumerating resources.");
-    return rows;
+  forget(id) {
+    if (this.busy(id)) throw new NativeAdmissionError("A persistence reference still owns this session.");
+    this.raw.coldLogMemo.delete(id);
   }
-  async readRow(directory, name2, expected) {
-    const classified = classify(name2);
-    if (classified.compression !== this.compression) refuse("jsonl/encoding-mismatch", "Mixed raw and Zstandard session generations are not admitted.");
-    const path = join3(directory, name2);
-    const before = fileIdentity(await lstat3(path, { bigint: true }));
-    const fd = await this.openFile(path, "read");
-    try {
-      if (!same(before, fileIdentity(await fd.stat({ bigint: true })))) refuse("jsonl/resource-changed", "Resource was replaced before reading.");
-      const digest2 = createHash4("sha256");
-      const chunks = [];
-      let headerBytes = 0;
-      const buffer = Buffer.alloc(64 * 1024);
-      let total = 0n;
-      for (; ; ) {
-        const { bytesRead } = await fd.read(buffer, 0, buffer.length, null);
-        if (!bytesRead) break;
-        total += BigInt(bytesRead);
-        digest2.update(buffer.subarray(0, bytesRead));
-        if (headerBytes < HEADER_LIMIT) {
-          const chunk = Buffer.from(buffer.subarray(0, Math.min(bytesRead, HEADER_LIMIT - headerBytes)));
-          chunks.push(chunk);
-          headerBytes += chunk.length;
+  install() {
+    this.originalStat = this.provider.stat.bind(this.provider);
+    this.originalList = this.provider.list.bind(this.provider);
+    const route = (target, name2, idFor, transform, globalRead = false) => {
+      target = nativeServiceInstance(target);
+      const record = target;
+      const original = record[name2];
+      if (typeof original !== "function") throw new Error(`Missing pinned JSONL route ${name2}.`);
+      const own = Object.getOwnPropertyDescriptor(target, name2);
+      const adapter2 = this;
+      const wrapper = function(...args) {
+        const receiver = this;
+        if (adapter2.detached) return Promise.reject(new NativeAdmissionError("This native guard belongs to a replaced retirement owner."));
+        const id = idFor(args);
+        if (!adapter2.active) {
+          if (adapter2.admission.isRetired(id)) return Promise.reject(new NativeAdmissionError("This session has a retirement tombstone."));
+          return Reflect.apply(original, receiver, args);
         }
-      }
-      if (String(total) !== before.size || !same(before, fileIdentity(await fd.stat({ bigint: true }))) || !same(before, fileIdentity(await lstat3(path, { bigint: true })))) refuse("jsonl/resource-changed", "The resource changed while hashing its exact bytes.");
-      const header = decodeHeader(Buffer.concat(chunks), classified.compression, classified.version);
-      if (!same(header, expected)) refuse("jsonl/identity-changed", "A physical generation or staging header belongs to another lifecycle.");
-      const value = {
-        resourceId: name2,
-        kind: classified.kind,
-        formatVersion: classified.version,
-        compression: classified.compression,
-        identity: before,
-        digest: digest2.digest("hex"),
-        header
+        const run = () => adapter2.admission.track(id, async () => {
+          const value = await Reflect.apply(original, receiver, args);
+          return transform ? transform(value) : value;
+        });
+        return globalRead ? adapter2.admission.trackGlobal(run) : run();
       };
-      return fileRowSchema.parse({ ...value, revision: sha(JSON.stringify({ identity: value.identity, digest: value.digest, header })) });
-    } finally {
-      await fd.close();
+      Object.defineProperty(target, name2, { configurable: true, writable: true, value: wrapper });
+      this.restore.push(() => {
+        if (record[name2] !== wrapper) throw new Error(`JSONL route ${name2} changed while retirement was installed.`);
+        if (own) Object.defineProperty(target, name2, own);
+        else delete record[name2];
+      });
+    };
+    const headerId = (args) => String(args[0].id);
+    route(this.provider, "create", headerId, (value) => this.manage(value));
+    route(this.provider, "open", (args) => String(args[0]), (value) => this.manage(value), true);
+    for (const method of ["persistBatch", "persistHeader", "truncateTornTail", "acquireWriteLease"]) {
+      route(this.provider, method, headerId);
     }
+    route(this.provider, "readStoredLog", (args) => String(args[1]), void 0, true);
+    route(this.provider, "resolveCurrentLog", (args) => String(args[0]));
+    const instance = nativeServiceInstance(this.provider);
+    const rawStat = instance.stat;
+    const rawList = instance.list;
+    const adapter = this;
+    instance.stat = async function(id, options) {
+      if (adapter.detached) throw new NativeAdmissionError("This native observer belongs to a replaced retirement owner.");
+      if (adapter.admission.isRetired(id)) return void 0;
+      const value = await adapter.admission.trackGlobal(() => adapter.admission.track(id, () => rawStat.call(this, id, options)));
+      return adapter.admission.isRetired(id) ? void 0 : value;
+    };
+    instance.list = async function(options) {
+      if (adapter.detached) throw new NativeAdmissionError("This native observer belongs to a replaced retirement owner.");
+      return (await adapter.admission.trackGlobal(() => rawList.call(this, options))).filter((item) => !adapter.admission.isRetired(item.header.id));
+    };
+    this.restore.push(() => {
+      instance.stat = rawStat;
+      instance.list = rawList;
+    });
+    return async () => {
+      await this.admission.drain();
+      this.active = false;
+      if (this.originalRetired()) return;
+      for (const undo of [...this.restore].reverse()) undo();
+      this.restore.length = 0;
+    };
   }
-  async openFile(path, access) {
-    try {
-      return await openRegularFile(path, access);
-    } catch (error) {
-      if (error instanceof RegularFileRefusal) refuse(error.code === "platform/unsafe-file" ? "jsonl/unsafe-file" : error.code === "platform/identity-unavailable" ? "jsonl/identity-unavailable" : "jsonl/resource-changed", error.message);
-      throw error;
-    }
+  forceRestore() {
+    this.detached = true;
+    this.active = false;
+    for (const undo of [...this.restore].reverse()) undo();
+    this.restore.length = 0;
   }
-  async syncDirectory(directory) {
-    await syncDirectory(directory);
+  originalRetired() {
+    return this.admission.hasTombstones();
   }
-};
-
-// src/host/native-retirement-metadata.ts
-import { AsyncLocalStorage } from "node:async_hooks";
-import { createHash as createHash5 } from "node:crypto";
-import { readdir as readdir2, realpath as realpath3, lstat as lstat4, unlink as unlink2 } from "node:fs/promises";
-import { dirname as dirname2, join as join4, resolve as resolve3 } from "node:path";
-import { workspaceDomainState as workspaceDomainState2, workspaceRecord } from "@deepseek-ai/dsh-workspace";
-import { z as z5 } from "zod";
-var NativeMetadataRefusal = class extends Error {
-  constructor(code, message) {
-    super(message);
-    this.code = code;
-    this.name = "NativeMetadataRefusal";
+  manage(handle) {
+    if (this.managedHandles.has(handle)) return handle;
+    this.managedHandles.add(handle);
+    const methods2 = ["read", "append", "flush"];
+    for (const name2 of methods2) {
+      const original = handle[name2];
+      Object.defineProperty(handle, name2, {
+        configurable: true,
+        writable: true,
+        value: (...args) => !this.active && !this.admission.isRetired(handle.id) ? Reflect.apply(original, handle, args) : this.admission.track(handle.id, async () => Reflect.apply(original, handle, args))
+      });
+    }
+    return handle;
   }
 };
-var cachePhysicalIdentitySchema = z5.object({
-  dev: z5.string().regex(/^\d+$/),
-  ino: z5.string().regex(/^[1-9]\d*$/),
-  birthtimeNs: z5.string().regex(/^[1-9]\d*$/)
-}).strict();
-var nativeMetadataSnapshotSchema = z5.object({
-  schemaVersion: z5.literal(1),
-  sessionId: z5.string().min(1),
-  global: z5.object({ archived: z5.boolean(), pinned: z5.boolean() }).strict(),
-  workspaces: z5.array(z5.object({ workspaceId: z5.string(), record: workspaceRecord }).strict()),
-  cache: z5.object({
-    present: z5.boolean(),
-    digest: z5.string().nullable(),
-    location: z5.string().nullable(),
-    documentDigest: z5.string().nullable(),
-    memoryDigest: z5.string().nullable(),
-    physicalIdentity: cachePhysicalIdentitySchema.optional()
-  }).strict(),
-  queryProvider: z5.enum(["none", "sqlite-0.2.0-rc.2", "sqlite-memory-disabled-0.2.0-rc.2"]),
-  queryPath: z5.string().nullable()
+
+// src/host/native-jsonl-files.ts
+var integer = z4.string().regex(/^\d+$/);
+var hash = z4.string().regex(/^[a-f0-9]{64}$/);
+var positiveInteger = z4.string().regex(/^[1-9]\d*$/);
+var nodeIdentitySchema = z4.object({ dev: integer, ino: positiveInteger, birthtimeNs: positiveInteger }).strict();
+var fileIdentitySchema = nodeIdentitySchema.extend({ size: integer, mtimeNs: integer, ctimeNs: integer, nlink: z4.literal("1") }).strict();
+var lockIdentitySchema = nodeIdentitySchema.extend({ size: z4.literal("0"), nlink: z4.literal("1") }).strict();
+var windowsLockSchema = z4.object({ kind: z4.literal("win32-semaphore"), name: z4.string().min(1) }).strict();
+var nativeLockSchema = z4.union([lockIdentitySchema, windowsLockSchema]);
+var headerIdentitySchema = z4.object({
+  id: z4.string().min(1),
+  createdAt: z4.number().int().nonnegative(),
+  cwd: z4.string().nullable(),
+  parentSession: z4.string().nullable(),
+  origin: z4.literal("subagent").nullable(),
+  isSeeded: z4.boolean(),
+  delegationDepth: z4.number().int().nonnegative(),
+  agentPreset: z4.string().nullable()
 }).strict();
-function object(value) {
-  return value !== null && typeof value === "object" ? value : void 0;
+var fileRowSchema = z4.object({
+  resourceId: z4.string().min(1),
+  kind: z4.enum(["generation", "staging"]),
+  formatVersion: z4.number().int().min(0).max(4),
+  compression: z4.enum(["none", "zstd"]),
+  identity: fileIdentitySchema,
+  digest: hash,
+  header: headerIdentitySchema,
+  revision: hash
+}).strict().superRefine((value, ctx) => {
+  try {
+    const kind = classify(value.resourceId);
+    if (kind.kind !== value.kind || kind.version !== value.formatVersion || kind.compression !== value.compression || value.revision !== sha(JSON.stringify({ identity: value.identity, digest: value.digest, header: value.header }))) {
+      ctx.addIssue({ code: "custom", message: "Resource classification and identity digest must agree." });
+    }
+  } catch {
+    ctx.addIssue({ code: "custom", message: "Unknown physical resource name." });
+  }
+});
+var nativeJsonlFileSchema = fileRowSchema;
+var nativeJsonlInventorySchema = z4.object({
+  schemaVersion: z4.literal(1),
+  root: z4.string(),
+  rootIdentity: nodeIdentitySchema,
+  directory: z4.string(),
+  directoryIdentity: nodeIdentitySchema,
+  sessionId: z4.string().min(1),
+  compression: z4.enum(["none", "zstd"]),
+  header: headerIdentitySchema,
+  anchor: z4.object({ resourceId: z4.string(), identity: nodeIdentitySchema, header: headerIdentitySchema }).strict(),
+  lock: nativeLockSchema,
+  files: z4.array(fileRowSchema).max(4096),
+  revision: hash
+}).strict().superRefine((value, ctx) => {
+  try {
+    const anchor = generation(value.anchor.resourceId);
+    if (!isAbsolute2(value.root) || value.directory !== join3(project(value.header.cwd), segment(value.sessionId)) || value.header.id !== value.sessionId || !same(value.anchor.header, value.header) || !anchor || anchor.compression !== value.compression || new Set(value.files.map((row) => row.resourceId)).size !== value.files.length || value.files.some((row) => row.compression !== value.compression || !same(row.header, value.header)) || value.revision !== sha(JSON.stringify(value.files))) {
+      ctx.addIssue({ code: "custom", message: "Frozen directory, header identities, file scope and digest must agree." });
+    }
+  } catch {
+    ctx.addIssue({ code: "custom", message: "Invalid frozen directory or anchor." });
+  }
+});
+var NativeJsonlRefusal = class extends Error {
+  constructor(code, message) {
+    super(message);
+    this.code = code;
+    this.name = "NativeJsonlRefusal";
+  }
+};
+function refuse(code, message) {
+  throw new NativeJsonlRefusal(code, message);
 }
-function canonical2(value) {
-  if (Array.isArray(value)) return `[${value.map(canonical2).join(",")}]`;
-  if (value !== null && typeof value === "object") return `{${Object.keys(value).sort().map((key2) => `${JSON.stringify(key2)}:${canonical2(value[key2])}`).join(",")}}`;
-  return JSON.stringify(value);
+function sha(value) {
+  return createHash4("sha256").update(value).digest("hex");
 }
-function digest(value) {
-  return createHash5("sha256").update(canonical2(value)).digest("hex");
+function same(a, b) {
+  return JSON.stringify(a) === JSON.stringify(b);
 }
-var methods = (port, names) => names.every((name2) => typeof port[name2] === "function");
-var windowsCacheStagePrefix = ".dsh-session-bin-cache-";
-function physicalIdentity(stat) {
+function nodeIdentity(stat) {
+  if (stat.ino <= 0n || stat.birthtimeNs <= 0n) refuse("jsonl/identity-unavailable", "The filesystem does not provide a stable inode and creation identity.");
   return { dev: String(stat.dev), ino: String(stat.ino), birthtimeNs: String(stat.birthtimeNs) };
 }
-function samePhysicalIdentity(left, right) {
-  return left !== void 0 && right !== void 0 && left.dev === right.dev && left.ino === right.ino && left.birthtimeNs === right.birthtimeNs;
+function nodeIdentityFromRow(row) {
+  return { dev: row.identity.dev, ino: row.identity.ino, birthtimeNs: row.identity.birthtimeNs };
 }
-function cacheStageBasename(snapshot, expected, request) {
-  const value = digest({ schemaVersion: 1, expected, request, cache: snapshot });
-  return `${windowsCacheStagePrefix}${value}.stage`;
+function fileIdentity(stat) {
+  if (!stat.isFile() || stat.nlink !== 1n) refuse("jsonl/unsafe-file", "Resources must be exclusive regular files without additional hard links.");
+  return fileIdentitySchema.parse({ ...nodeIdentity(stat), size: String(stat.size), mtimeNs: String(stat.mtimeNs), ctimeNs: String(stat.ctimeNs), nlink: "1" });
 }
-var NativeMetadataAdapter = class _NativeMetadataAdapter {
-  constructor(ctx, admission, workspace, sessions, cache, query, controller) {
-    this.ctx = ctx;
-    this.admission = admission;
-    this.workspace = workspace;
-    this.sessions = sessions;
-    this.cache = cache;
-    this.query = query;
-    this.controller = controller;
-    this.queryConfiguration = query ? { path: query.config.path, openAt: query.config.openAt } : void 0;
-    this.queryProvider = !query ? "none" : query.config.openAt === "never" ? "sqlite-memory-disabled-0.2.0-rc.2" : "sqlite-0.2.0-rc.2";
-    this.cacheTable = cache?.requireTable();
-    this.cacheDirectory = this.cacheTable?.host.unit.dir;
-    this.agents = controller ? _NativeMetadataAdapter.get(ctx, "agents") : void 0;
-  }
-  targets = /* @__PURE__ */ new Set();
-  retained = /* @__PURE__ */ new Map();
-  followers = /* @__PURE__ */ new Map();
-  followerStops = /* @__PURE__ */ new Map();
-  activationTarget = new AsyncLocalStorage();
-  apiHandles = /* @__PURE__ */ new Map();
-  operations = /* @__PURE__ */ new Map();
-  queueTarget = new AsyncLocalStorage();
-  receivers = new AsyncLocalStorage();
-  restores = [];
-  guardedMethods = [];
-  guardedEntities = /* @__PURE__ */ new WeakSet();
-  installed = false;
-  disposed = false;
-  detached = false;
-  fallbackRetired = /* @__PURE__ */ new Set();
-  queryConfiguration;
-  queryProvider;
-  cacheTable;
-  cacheDirectory;
-  agents;
-  moveCacheDocument = renameWindowsWriteThrough;
-  clearCacheStage = async (handle) => {
-    await handle.truncate(0);
-    await handle.sync();
-  };
-  removeCacheStage = unlink2;
-  static get(ctx, name2) {
-    const value = object(ctx.get(name2));
-    return object(value?.[Symbol.for("cordis.original")] ?? value);
-  }
-  static async open(ctx, admission) {
-    const workspace = this.get(ctx, "workspaceRegistry");
-    const sessions = this.get(ctx, "sessions");
-    const cache = this.get(ctx, "sessionProjectionCache");
-    const query = this.get(ctx, "sessionQuery");
-    const controller = this.get(ctx, "sessionController");
-    if (!workspace || !sessions || workspace.constructor.name !== "WorkspaceRegistry" || sessions.constructor.name !== "SessionStore" || !methods(workspace, ["list", "requireTable", "requireState", "setState", "enqueueOperation", "indexHeader", "readSessionHeader"]) || ![workspace.headers, workspace.sessionPaths, workspace.invalidSessionPaths].every((map) => map instanceof Map) || !methods(sessions, ["get", "prepare", "enter", "announce"])) return void 0;
-    if (cache && (cache.constructor.name !== "SessionProjectionCache" || !(cache.dirty instanceof Map) || !methods(cache, ["put", "requireTable", "write", "coldSnapshot", "hydratePrepared", "cachedSnapshot", "cachedPredecessorTitle"]))) return void 0;
-    if (cache) {
-      const table = cache.requireTable();
-      const domain = ctx.storageDomain.get("session_projcache");
-      if (table?.constructor.name !== "KvTableImpl" || table.tableName !== "sessions" || !(table.records instanceof Map) || table.host?.domainName !== "session_projcache" || table.host.unit?.constructor.name !== "PerRecordJsonUnit" || table.host.unit.descriptor?.name !== "session_projcache" || table.host.unit.descriptor.version !== 7 || table.host.unit.descriptor.layout !== "per-record" || typeof table.host.unit.dir !== "string" || !methods(table.host, ["enqueue", "emitChanged", "assertReadable"]) || !methods(table.host.unit, ["loadAll", "deleteRecord", "tableDir"]) || domain?.unit !== table.host.unit) return void 0;
-    }
-    if (query) {
-      const enabled = ["startup", "first-search"].includes(query.config?.openAt);
-      const disabledMemory = query.config?.openAt === "never" && query.config.path === ":memory:" && query._db === void 0 && query._ready === void 0;
-      if (query.constructor.name !== "SqliteSessionQueryEngine" || !enabled && !disabledMemory || typeof query.config?.path !== "string" || !methods(query, ["searchSessions", "listSessions", "observeSession", "_serialized"]) || !(query._observations?.cache instanceof Map) || !methods(query._observations, ["read", "store"])) return void 0;
-    }
-    if (controller && (controller.constructor.name !== "SessionController" || !(controller.history?.closeFollowers instanceof Set) || !methods(controller.history, ["page", "follow", "sourceFor"]) || controller.agents?.constructor.name !== "ApiSessionAgentController" || !methods(controller.agents, ["resumeObserved", "createOrAdopt"]) || !methods(controller.listState ?? {}, ["summarizeCold"]) || !methods(this.get(ctx, "agents") ?? {}, ["create", "resume", "get"]))) return void 0;
-    return new _NativeMetadataAdapter(ctx, admission, workspace, sessions, cache, query, controller);
-  }
-  assert(id) {
-    this.targets.add(id);
-    if (this.disposed) {
-      if (this.fallbackRetired.has(id)) throw new NativeMetadataRefusal("native/retired", "This retired session remains fenced after adapter withdrawal.");
-      return;
+function lockIdentity(stat) {
+  const identity3 = fileIdentity(stat);
+  if (identity3.size !== "0") refuse("jsonl/lock-invalid", "The existing stable lock must contain no session content.");
+  return lockIdentitySchema.parse({ ...nodeIdentity(stat), size: "0", nlink: "1" });
+}
+function headerIdentity(header) {
+  return headerIdentitySchema.parse({
+    id: header.id,
+    createdAt: header.createdAt,
+    cwd: header.cwd ?? null,
+    parentSession: header.parentSession ?? null,
+    origin: header.origin ?? null,
+    isSeeded: header.isSeeded,
+    delegationDepth: header.delegationDepth ?? 0,
+    agentPreset: header.agentPreset ?? null
+  });
+}
+function segment(value) {
+  if (!value) refuse("jsonl/identity-invalid", "A path identity cannot be empty.");
+  if (value === "." || value === "..") return value.replace(/\./g, "~002E");
+  return value.replace(/[^A-Za-z0-9._-]/g, (unit) => `~${unit.charCodeAt(0).toString(16).toUpperCase().padStart(4, "0")}`);
+}
+function project(cwd) {
+  if (cwd === null) return "_no-cwd";
+  if (!isAbsolute2(cwd)) refuse("jsonl/identity-invalid", "The stored cwd must be absolute.");
+  const readable = segment(cwd.replace(/[/\\:]+/g, "-")).replace(/^-+/, "") || "root";
+  return `--${readable.slice(0, 251)}--`;
+}
+function generation(name2) {
+  const match = /^session(?:\.v([1-9]\d*))?\.jsonl(\.zstd)?$/.exec(name2);
+  if (!match) return;
+  const version = match[1] === void 0 ? 0 : Number(match[1]);
+  if (!Number.isSafeInteger(version) || version > SESSION_FORMAT_VERSION) refuse("jsonl/unsupported-generation", "Unknown future physical generations cannot be retired.");
+  return { version, compression: match[2] ? "zstd" : "none" };
+}
+function classify(name2) {
+  const committed = generation(name2);
+  if (committed) return { ...committed, kind: "generation" };
+  const materializing = /^(session(?:\.v[1-9]\d*)?\.jsonl(?:\.zstd)?)\.[a-f0-9]{12}\.tmp$/.exec(name2);
+  if (materializing) return { ...generation(materializing[1]), kind: "staging" };
+  const migrating = /^session\.migration\.[a-f0-9]{16}\.jsonl(\.zstd)?\.tmp$/.exec(name2);
+  if (migrating) return { version: SESSION_FORMAT_VERSION, compression: migrating[1] ? "zstd" : "none", kind: "staging" };
+  refuse("jsonl/unknown-resource", `Unclassified session resource: ${name2}`);
+}
+var HEADER_LIMIT = 1024 * 1024;
+function firstFrameEnd(bytes) {
+  if (bytes.length < 5) return;
+  if (bytes.readUInt32LE(0) !== 4247762216) refuse("jsonl/header-invalid", "The first Zstandard frame is not a standard frame.");
+  const descriptor2 = bytes[4];
+  if (descriptor2 & 24) refuse("jsonl/header-invalid", "Reserved Zstandard frame flags are unsupported.");
+  const single = Boolean(descriptor2 & 32);
+  const sizeFlag = descriptor2 >>> 6;
+  const dictionaryBytes = [0, 1, 2, 4][descriptor2 & 3];
+  const sizeBytes = sizeFlag === 0 ? single ? 1 : 0 : [0, 2, 4, 8][sizeFlag];
+  let cursor = 5 + (single ? 0 : 1) + dictionaryBytes + sizeBytes;
+  if (cursor > bytes.length) return;
+  for (; ; ) {
+    if (cursor + 3 > bytes.length) return;
+    const block = bytes.readUIntLE(cursor, 3);
+    const type = block >>> 1 & 3;
+    if (type === 3) refuse("jsonl/header-invalid", "Reserved Zstandard block type.");
+    cursor += 3 + (type === 1 ? 1 : block >>> 3);
+    if (cursor > bytes.length) return;
+    if (block & 1) {
+      cursor += descriptor2 & 4 ? 4 : 0;
+      return cursor <= bytes.length ? cursor : void 0;
     }
-    this.admission.assertAllowed(id);
   }
-  tracked(id, work) {
-    this.targets.add(id);
-    if (this.disposed) {
-      this.assert(id);
-      return work();
-    }
-    return this.admission.trackGlobal(() => this.admission.track(id, async () => {
-      this.assert(id);
-      this.increment(this.operations, id, 1);
-      try {
-        return await work();
-      } finally {
-        this.increment(this.operations, id, -1);
-      }
-    }));
-  }
-  increment(map, id, delta) {
-    const next = (map.get(id) ?? 0) + delta;
-    if (next === 0) map.delete(id);
-    else map.set(id, next);
-  }
-  refuse(code, message) {
-    throw new NativeMetadataRefusal(code, message);
-  }
-  assertInstances() {
-    if (this.guardedMethods.some(({ port, name: name2, replacement }) => port[name2] !== replacement)) {
-      this.refuse("native/guard-replaced", "A native metadata admission guard was replaced.");
-    }
-    if (_NativeMetadataAdapter.get(this.ctx, "workspaceRegistry") !== this.workspace || _NativeMetadataAdapter.get(this.ctx, "sessions") !== this.sessions || _NativeMetadataAdapter.get(this.ctx, "sessionProjectionCache") !== this.cache || _NativeMetadataAdapter.get(this.ctx, "sessionQuery") !== this.query || _NativeMetadataAdapter.get(this.ctx, "sessionController") !== this.controller || this.controller && _NativeMetadataAdapter.get(this.ctx, "agents") !== this.agents || this.cache && (this.cache.requireTable() !== this.cacheTable || this.cacheTable.host.unit.dir !== this.cacheDirectory) || this.query && (this.query.config.path !== this.queryConfiguration.path || this.query.config.openAt !== this.queryConfiguration.openAt) || this.queryProvider === "sqlite-memory-disabled-0.2.0-rc.2" && (this.query._db !== void 0 || this.query._ready !== void 0)) {
-      this.refuse("native/composition-changed", "Native metadata service composition changed.");
+}
+function decodeHeader(bytes, compression, version) {
+  let line;
+  if (compression === "none") {
+    const newline = bytes.indexOf(10);
+    if (newline < 0) refuse("jsonl/header-invalid", "A complete physical header is required, including for staging.");
+    line = bytes.subarray(0, newline);
+  } else {
+    const end = firstFrameEnd(bytes);
+    if (end === void 0) refuse("jsonl/header-invalid", "A complete Zstandard header frame is required.");
+    let decoded;
+    try {
+      decoded = zstdDecompressSync(bytes.subarray(0, end), { maxOutputLength: HEADER_LIMIT });
+    } catch {
+      refuse("jsonl/header-invalid", "The bounded first Zstandard frame cannot be decoded.");
     }
+    if (!decoded.length || decoded.indexOf(10) !== decoded.length - 1) refuse("jsonl/header-invalid", "The header frame must contain exactly one newline-terminated record.");
+    line = decoded.subarray(0, -1);
   }
-  assertCold(id) {
-    if (this.sessions.get(id) !== void 0 || _NativeMetadataAdapter.get(this.ctx, "agents")?.get(id) !== void 0) {
-      this.refuse("native/session-live", "Native deletion currently accepts only cold sessions.");
-    }
-    const cached = this.query?._observations.cache.get(id);
-    if (cached?.refs > 0 || (this.retained.get(id) ?? 0) > 0) this.refuse("native/query-retained", "A retained query observation still owns this session.");
-    if ((this.followers.get(id) ?? 0) > 0) this.refuse("native/follow-retained", "A history follower still owns this session.");
-    const knownFollowers = [...this.followers.values()].reduce((sum, count) => sum + count, 0);
-    if ((this.controller?.history.closeFollowers.size ?? 0) > knownFollowers) this.refuse("native/unknown-follow", "A history follower predates native admission tracking.");
-    if (this.cache && [...this.cache.dirty.keys()].some((session) => session.id === id)) this.refuse("native/cache-dirty", "Target cache write-behind is not quiescent.");
+  try {
+    const raw = JSON.parse(new TextDecoder("utf-8", { fatal: true }).decode(line));
+    const result = sessionFormatCatalog.readHeader(raw);
+    if (result.status !== "current" && result.status !== "migration-required") refuse("jsonl/header-invalid", "Malformed or unsupported physical Session header.");
+    if (result.storedVersion !== version) refuse("jsonl/header-invalid", "Physical filename and header versions differ.");
+    return headerIdentity(result.header);
+  } catch (error) {
+    if (error instanceof NativeJsonlRefusal) throw error;
+    refuse("jsonl/header-invalid", "The physical Session header cannot be decoded and identified.");
   }
-  /** Explicit deletion preparation may unload an idle API-owned lifecycle.
-   * No bare registry Agent, foreign handle, or unknown reader is disposed. */
-  async releaseIdle(id) {
-    this.assertInstances();
-    const handle = this.apiHandles.get(id);
-    if (!handle) return;
-    const agent = handle.agent;
-    const registry = this.agents;
-    if (registry.get(id) !== agent || this.sessions.get(id) !== agent.session) return;
-    const activity = await this.admission.withoutBypass(() => this.ctx.waterfall(
-      "workspace/session-activity",
-      { sessionId: id },
-      async () => []
-    ));
-    if (activity.length || agent.constructor.name !== "ReactLoopAgent" || agent.phase?.kind !== "idle" || agent.status !== "idle" || !Array.isArray(agent.inbox?.nextTurn) || !Array.isArray(agent.inbox?.nextStep) || agent.inbox.nextTurn.length || agent.inbox.nextStep.length) {
-      this.refuse("native/session-active", "Native deletion refuses active or queued work.");
-    }
-    if (!this.workspace.archivedSessionIds.includes(id)) this.refuse("native/not-archived", "Only an archived target may be unloaded.");
-    if (registry.get(id) !== agent || this.sessions.get(id) !== agent.session) this.refuse("native/session-live", "The API lifecycle changed.");
-    await this.admission.bypass(id, async () => {
-      await handle.dispose();
-      for (const stop of [...this.followerStops.get(id) ?? []]) await stop();
-      if (this.cache) await this.cache.requireTable().host.enqueue(async () => void 0);
-      const summary = this.controller.listState.summarizeCold(agent.session.header);
-      this.admission.withoutBypass(() => this.ctx.emit("api-session/added", summary));
-    });
-    this.apiHandles.delete(id);
+}
+function missing(error) {
+  return error?.code === "ENOENT";
+}
+function leaseStamp(inventory) {
+  return JSON.stringify({
+    root: inventory.root,
+    rootIdentity: inventory.rootIdentity,
+    directory: inventory.directory,
+    directoryIdentity: inventory.directoryIdentity,
+    sessionId: inventory.sessionId,
+    compression: inventory.compression,
+    header: inventory.header,
+    anchor: inventory.anchor,
+    lock: inventory.lock
+  });
+}
+var NativeJsonlFiles = class _NativeJsonlFiles {
+  constructor(provider, root, compression, rootIdentity) {
+    this.provider = provider;
+    this.root = root;
+    this.compression = compression;
+    this.rootIdentity = rootIdentity;
   }
-  async cacheView(table, id, acceptedStage) {
-    table.host.assertReadable();
-    if (!/^[a-zA-Z0-9_-]+$/.test(id)) this.refuse("native/cache-key-unsupported", "The pinned cache backend cannot own this record key.");
-    const directory = resolve3(table.host.unit.dir);
-    const legacyPath = join4(dirname2(directory), `${table.host.unit.descriptor.name}.json`);
-    try {
-      await lstat4(legacyPath);
-      this.refuse("native/cache-unclassified-resource", "A legacy whole-unit cache could republish the retired target document.");
-    } catch (error) {
-      if (error.code !== "ENOENT") throw error;
-    }
-    let location;
-    try {
-      location = await realpath3(directory);
-    } catch (error) {
-      if (error.code !== "ENOENT") throw error;
-      location = join4(await realpath3(dirname2(directory)), "session_projcache");
-    }
-    const tableDirectory = table.host.unit.tableDir("sessions");
-    let names;
+  leases = /* @__PURE__ */ new Map();
+  static async open(provider) {
+    if (!nativePlatformCandidate()) return;
+    if (!(provider instanceof SessionPersistence) || provider.constructor.name !== "JsonlSessionPersistence" || provider.name !== "session-persistence-jsonl" || SESSION_FORMAT_VERSION !== 4) return;
+    if (createHash4("sha256").update(Function.prototype.toString.call(nativeServiceInstance(provider).constructor)).digest("hex") !== "bb0e12b14bd21adec58c51934f00014e482380102f09aa5e935536c57c0d6e1e") return;
+    const internals = provider;
+    const config = internals.config;
+    if (typeof internals.root !== "string" || !isAbsolute2(internals.root) || internals.compression !== "none" && internals.compression !== "zstd" || typeof config?.root !== "string" || resolve2(config.root) !== internals.root || (config.compression ?? "zstd") !== internals.compression) return;
+    const require2 = createRequire2(import.meta.url);
+    const metadata = require2("@deepseek-ai/dsh-session-persistence-jsonl/package.json");
+    if (metadata.version !== "0.2.1-rc.1") return;
+    let root;
     try {
-      names = await readdir2(tableDirectory);
+      root = await realpath2(internals.root);
     } catch (error) {
-      if (error.code !== "ENOENT") throw error;
-      names = [];
-    }
-    if (names.some((name2) => name2.startsWith(`${id}.json.bak.`) || /^\.[a-f0-9-]+\.tmp$/.test(name2) || name2.startsWith(windowsCacheStagePrefix) && name2 !== acceptedStage)) {
-      this.refuse("native/cache-unclassified-resource", "A cache backup or unclassified staging document prevents complete target erasure.");
+      if (missing(error)) return;
+      throw error;
     }
-    let documentDigest = null;
-    let documentIdentity;
-    const path = join4(tableDirectory, `${id}.json`);
+    if (process.platform === "win32" && resolve2(internals.root).toLowerCase() !== root.toLowerCase()) return;
+    const identity3 = await lstat3(root, { bigint: true });
+    if (!identity3.isDirectory()) refuse("jsonl/root-invalid", "The configured root must be an existing directory.");
+    if (identity3.ino <= 0n || identity3.birthtimeNs <= 0n) return;
+    return new _NativeJsonlFiles(provider, root, internals.compression, nodeIdentity(identity3));
+  }
+  async inspect(sessionId, header) {
+    if (header.version !== SESSION_FORMAT_VERSION) refuse("jsonl/identity-invalid", "Inspection requires the current logical Session header.");
+    const identity3 = headerIdentity(header);
+    if (sessionId !== identity3.id) refuse("jsonl/identity-invalid", "Requested session and header identities differ.");
+    const directory = join3(project(identity3.cwd), segment(sessionId));
+    const base = await this.directory(directory, sessionId, identity3);
+    const files = await this.rows(base.path, identity3);
+    const canonical3 = files.filter((row) => row.kind === "generation").sort((a, b) => a.formatVersion - b.formatVersion)[0];
+    if (!canonical3) refuse("jsonl/session-not-found", "No identified committed generation exists.");
+    const inventory = {
+      schemaVersion: 1,
+      root: this.root,
+      rootIdentity: this.rootIdentity,
+      directory,
+      directoryIdentity: base.identity,
+      sessionId,
+      compression: this.compression,
+      header: identity3,
+      anchor: {
+        resourceId: canonical3.resourceId,
+        identity: { dev: canonical3.identity.dev, ino: canonical3.identity.ino, birthtimeNs: canonical3.identity.birthtimeNs },
+        header: identity3
+      },
+      lock: await this.lockIdentity(base.path),
+      files,
+      revision: sha(JSON.stringify(files))
+    };
+    await this.directory(directory, sessionId, identity3);
+    return nativeJsonlInventorySchema.parse(inventory);
+  }
+  /** Re-enumerate the entire scope without changing its original durable anchor. */
+  async current(input) {
+    const inventory = this.validate(input);
+    const base = await this.assertDirectory(inventory);
+    const files = await this.rows(base.path, inventory.header, inventory);
+    const lock = await this.lockIdentity(base.path);
+    if (!same(lock, inventory.lock)) refuse("jsonl/lock-changed", "The stable coordination file changed.");
+    return nativeJsonlInventorySchema.parse({ ...inventory, files, revision: sha(JSON.stringify(files)) });
+  }
+  async acquire(input, options = {}) {
+    const inventory = this.validate(input);
+    const base = await this.assertDirectory(inventory);
+    let fd;
+    let unlock;
+    const record = {
+      stamp: leaseStamp(inventory),
+      closing: false,
+      tail: Promise.resolve(),
+      pending: /* @__PURE__ */ new Set(),
+      recovering: options.recovering === true
+    };
+    let held = false;
     try {
-      let handle;
-      try {
-        handle = await openRegularFile(path, "read");
-      } catch (error) {
-        if (error instanceof RegularFileRefusal) this.refuse(error.code === "platform/unsafe-file" ? "native/cache-unsafe-document" : "native/cache-document-changed", error.message);
-        throw error;
+      if (process.platform === "win32") {
+        try {
+          unlock = await acquireWindowsSemaphore(join3(base.path, "session.lock"), "session");
+        } catch (error) {
+          if (error.code === "EBUSY") refuse("jsonl/writer-active", "Another writer holds the session kernel lease.");
+          throw error;
+        }
+      } else {
+        fd = await this.openFile(join3(base.path, "session.lock"), "write");
+        if (!same(lockIdentity(await fd.stat({ bigint: true })), inventory.lock)) refuse("jsonl/lock-changed", "The frozen stable lock changed.");
+        try {
+          await tryLockExclusive2(fd.fd);
+        } catch (error) {
+          if (["EAGAIN", "EWOULDBLOCK"].includes(error.code ?? "")) refuse("jsonl/writer-active", "Another writer holds the session lock.");
+          throw error;
+        }
       }
-      try {
-        const before = await handle.stat({ bigint: true });
-        const bytes = await handle.readFile();
-        const after = await handle.stat({ bigint: true });
-        const current = await lstat4(path, { bigint: true });
-        if (!current.isFile() || before.dev !== after.dev || before.ino !== after.ino || before.size !== after.size || before.birthtimeNs !== after.birthtimeNs || before.mtimeNs !== after.mtimeNs || before.ctimeNs !== after.ctimeNs || after.nlink !== 1n || after.dev !== current.dev || after.ino !== current.ino || after.birthtimeNs !== current.birthtimeNs || after.size !== current.size || after.mtimeNs !== current.mtimeNs || after.ctimeNs !== current.ctimeNs) {
-          this.refuse("native/cache-document-changed", "The physical cache document changed while observing its bytes.");
+      await this.assertDirectory(inventory);
+      if (!same(await this.lockIdentity(base.path), inventory.lock)) refuse("jsonl/lock-changed", "The held lock no longer has its frozen namespace identity.");
+      this.leases.set(inventory.directory, record);
+      held = true;
+    } finally {
+      if (!held) {
+        try {
+          await unlock?.();
+        } finally {
+          await fd?.close();
         }
-        documentDigest = createHash5("sha256").update(bytes).digest("hex");
-        if (process.platform === "win32") documentIdentity = physicalIdentity(after);
-      } finally {
-        await handle.close();
       }
-    } catch (error) {
-      if (error.code !== "ENOENT") throw error;
     }
-    const memory = table.records.get(id);
-    const memoryDigest = memory === void 0 ? null : digest(memory);
-    const present = documentDigest !== null || memoryDigest !== null;
-    return {
-      present,
-      digest: present ? digest({ documentDigest, memoryDigest }) : null,
-      location,
-      documentDigest,
-      memoryDigest,
-      ...documentIdentity ? { physicalIdentity: documentIdentity } : {}
-    };
+    let releasing;
+    return { release: () => releasing ??= (async () => {
+      record.closing = true;
+      await Promise.allSettled([...record.pending]);
+      try {
+        try {
+          await unlock?.();
+        } finally {
+          await fd?.close();
+        }
+      } finally {
+        if (this.leases.get(inventory.directory) === record) this.leases.delete(inventory.directory);
+      }
+    })() };
   }
-  async openCacheDocument(path, access) {
+  /** Caller must have persisted the exact retirement intent before this method. */
+  async erase(input, inputRow) {
+    const inventory = this.validate(input);
+    const row = fileRowSchema.parse(inputRow);
+    const lease = this.leases.get(inventory.directory);
+    if (!lease || lease.closing || lease.stamp !== leaseStamp(inventory)) refuse("jsonl/lease-required", "Erasure requires the same stable namespace kernel lease.");
+    if (!inventory.files.some((saved) => same(saved, row))) refuse("jsonl/scope-changed", "The resource is outside the frozen inventory.");
+    const operation = lease.tail.then(() => this.eraseInner(inventory, row));
+    lease.tail = operation.then(() => void 0, () => void 0);
+    lease.pending.add(operation);
     try {
-      return await openRegularFile(path, access);
-    } catch (error) {
-      if (error instanceof RegularFileRefusal) this.refuse(error.code === "platform/unsafe-file" ? "native/cache-unsafe-document" : "native/cache-document-changed", error.message);
-      throw error;
+      await operation;
+    } finally {
+      lease.pending.delete(operation);
     }
   }
-  async pathAbsent(path) {
+  async eraseInner(inventory, row) {
+    const base = await this.assertDirectory(inventory);
+    const names = await readdir(base.path);
+    if (names.some((name2) => name2 !== "session.lock" && !inventory.files.some((saved) => saved.resourceId === name2))) refuse("jsonl/scope-changed", "A new or unknown file entered the frozen scope.");
+    if (!same(await this.lockIdentity(base.path), inventory.lock)) refuse("jsonl/lock-changed", "The held lock changed.");
+    const absolute = join3(base.path, row.resourceId);
+    const target = resolve2(absolute);
+    if (target !== absolute || relative(base.path, target) !== row.resourceId) refuse("jsonl/path-invalid", "The exact resource must be a direct child of its bound directory.");
+    const remainder = await this.isWindowsErasureRemainder(inventory, row);
     try {
-      await lstat4(path);
-      return false;
+      if (!remainder) {
+        const observed = await this.readRow(base.path, row.resourceId, inventory.header);
+        if (!same(row, observed)) refuse("jsonl/resource-changed", "The physical resource identity or bytes changed after confirmation.");
+      }
     } catch (error) {
-      if (error.code === "ENOENT") return true;
+      if (missing(error)) {
+        await this.syncDirectory(base.path);
+        return;
+      }
       throw error;
     }
-  }
-  async frozenCacheBytes(handle, snapshot, allowCleared) {
-    const before = await handle.stat({ bigint: true });
-    if (!before.isFile() || before.nlink !== 1n || !samePhysicalIdentity(physicalIdentity(before), snapshot.physicalIdentity)) return false;
-    const bytes = await handle.readFile();
-    const after = await handle.stat({ bigint: true });
-    if (before.dev !== after.dev || before.ino !== after.ino || before.birthtimeNs !== after.birthtimeNs || before.size !== after.size || before.mtimeNs !== after.mtimeNs || before.ctimeNs !== after.ctimeNs || after.nlink !== 1n) return false;
-    return allowCleared && bytes.length === 0 || snapshot.documentDigest !== null && createHash5("sha256").update(bytes).digest("hex") === snapshot.documentDigest;
-  }
-  async eraseWindowsCache(snapshot, id, expected, request, table) {
-    if (snapshot.documentDigest !== null && snapshot.physicalIdentity === void 0) return false;
-    if (snapshot.documentDigest === null && snapshot.physicalIdentity !== void 0) return false;
-    const tableDirectory = table.host.unit.tableDir("sessions");
-    const originalPath = join4(tableDirectory, `${id}.json`);
-    const stageName = cacheStageBasename(snapshot, expected, request);
-    const stagePath = join4(tableDirectory, stageName);
-    const current = await this.cacheView(table, id, stageName);
-    if (current.location !== snapshot.location || current.documentDigest !== null && current.documentDigest !== snapshot.documentDigest || current.memoryDigest !== null && current.memoryDigest !== snapshot.memoryDigest || !snapshot.present && current.present) return false;
-    let originalAbsent = await this.pathAbsent(originalPath);
-    let stageAbsent = await this.pathAbsent(stagePath);
-    if (!originalAbsent && !stageAbsent) return false;
-    if (!originalAbsent) {
-      if (snapshot.physicalIdentity === void 0 || current.documentDigest !== snapshot.documentDigest || !samePhysicalIdentity(current.physicalIdentity, snapshot.physicalIdentity)) return false;
-      let handle;
+    await this.assertDirectory(inventory);
+    const latest = fileIdentity(await lstat3(absolute, { bigint: true }));
+    if (remainder ? latest.size !== "0" || !same(nodeIdentity(await lstat3(absolute, { bigint: true })), nodeIdentityFromRow(row)) : !same(latest, row.identity)) refuse("jsonl/resource-changed", "The exact resource changed before erasure.");
+    if (process.platform === "win32") {
+      const handle = await this.openFile(absolute, "write");
       try {
-        handle = await this.openCacheDocument(originalPath, "write");
-      } catch (error) {
-        if (error.code === "ENOENT") return false;
-        throw error;
+        const opened = fileIdentity(await handle.stat({ bigint: true }));
+        if (remainder ? opened.size !== "0" || !same(nodeIdentity(await handle.stat({ bigint: true })), nodeIdentityFromRow(row)) : !same(opened, row.identity)) refuse("jsonl/resource-changed", "The opened erasure object differs from the frozen file.");
+        await handle.truncate(0);
+        await handle.sync();
+      } finally {
+        await handle.close();
       }
-      try {
-        if (!await this.frozenCacheBytes(handle, snapshot, false)) return false;
+      const cleared = await lstat3(absolute, { bigint: true });
+      if (!cleared.isFile() || cleared.nlink !== 1n || cleared.size !== 0n || !same(nodeIdentity(cleared), nodeIdentityFromRow(row))) refuse("jsonl/resource-changed", "The cleared erasure object changed before unlink.");
+    }
+    await unlink(absolute);
+    await this.syncDirectory(base.path);
+  }
+  validate(input) {
+    const value = nativeJsonlInventorySchema.parse(input);
+    if (value.root !== this.root || value.compression !== this.compression || !same(value.rootIdentity, this.rootIdentity) || value.sessionId !== value.header.id || value.directory !== join3(project(value.header.cwd), segment(value.sessionId)) || value.files.some((row) => row.resourceId.includes(sep) || row.resourceId.includes("/") || row.resourceId.includes("\\") || row.resourceId === "session.lock" || !same(row.header, value.header))) refuse("jsonl/binding-invalid", "The inventory is not bound to this adapter and exact directory.");
+    const windowsLock = "kind" in value.lock;
+    if (process.platform === "win32" !== windowsLock || "kind" in value.lock && value.lock.name !== windowsSemaphoreName(join3(this.root, value.directory, "session.lock"), "session")) {
+      refuse("jsonl/binding-invalid", "The inventory kernel lease belongs to another platform or namespace.");
+    }
+    if (new Set(value.files.map((row) => row.resourceId)).size !== value.files.length || value.revision !== sha(JSON.stringify(value.files))) refuse("jsonl/binding-invalid", "The frozen resource inventory digest is invalid.");
+    for (const row of value.files) {
+      const classified = classify(row.resourceId);
+      if (classified.kind !== row.kind || classified.version !== row.formatVersion || classified.compression !== row.compression || row.revision !== sha(JSON.stringify({ identity: row.identity, digest: row.digest, header: row.header }))) refuse("jsonl/binding-invalid", "Frozen resource classification or digest changed.");
+    }
+    return value;
+  }
+  async directory(directory, sessionId, header) {
+    const internals = this.provider;
+    if (await realpath2(internals.root) !== this.root || internals.compression !== this.compression || process.platform === "win32" && resolve2(internals.root).toLowerCase() !== this.root.toLowerCase() || resolve2(this.provider.config.root) !== internals.root || (this.provider.config.compression ?? "zstd") !== this.compression) refuse("jsonl/provider-changed", "The provider root or encoding changed.");
+    const root = await lstat3(this.root, { bigint: true });
+    if (!root.isDirectory() || !same(nodeIdentity(root), this.rootIdentity)) refuse("jsonl/root-changed", "The configured root identity changed.");
+    if (directory !== join3(project(header.cwd), segment(sessionId))) refuse("jsonl/path-invalid", "Directory does not match the stored identity.");
+    const matches = [];
+    for (const entry of await readdir(this.root, { withFileTypes: true })) {
+      const projectPath = join3(this.root, entry.name);
+      if ([`${segment(sessionId)}.jsonl`, `${segment(sessionId)}.jsonl.zstd`].includes(entry.name)) refuse("jsonl/legacy-layout", "Root-level flat session artifacts are not admitted.");
+      if (entry.isSymbolicLink()) refuse("jsonl/unsafe-directory", "Symlink project directories cannot certify a unique target.");
+      if (!entry.isDirectory()) continue;
+      for (const suffix of [".jsonl", ".jsonl.zstd"]) {
         try {
-          await this.moveCacheDocument(originalPath, stagePath);
+          await lstat3(join3(projectPath, segment(sessionId) + suffix));
+          refuse("jsonl/legacy-layout", "Flat session artifacts are not admitted.");
         } catch (error) {
-          if (["EEXIST", "EXDEV", "ENOENT"].includes(error.code ?? "")) return false;
-          throw error;
+          if (!missing(error)) throw error;
         }
-      } finally {
-        await handle.close();
       }
-      originalAbsent = await this.pathAbsent(originalPath);
-      stageAbsent = await this.pathAbsent(stagePath);
-      if (!originalAbsent || stageAbsent) return false;
-    }
-    if (!stageAbsent) {
-      let handle;
+      const candidate = join3(projectPath, segment(sessionId));
       try {
-        handle = await this.openCacheDocument(stagePath, "write");
+        const stat = await lstat3(candidate, { bigint: true });
+        if (!stat.isDirectory()) refuse("jsonl/unsafe-directory", "Session directories must be direct regular directories.");
+        matches.push(candidate);
       } catch (error) {
-        if (error.code === "ENOENT") return false;
-        throw error;
-      }
-      try {
-        if (!await this.frozenCacheBytes(handle, snapshot, true)) return false;
-        await this.clearCacheStage(handle);
-      } finally {
-        await handle.close();
+        if (!missing(error)) throw error;
       }
-      await this.removeCacheStage(stagePath);
-      if (!await this.pathAbsent(stagePath)) return false;
     }
-    if (!await this.pathAbsent(originalPath) || !await this.pathAbsent(stagePath)) return false;
-    table.records.delete(id);
-    this.admission.withoutBypass(() => table.host.emitChanged({ domain: table.host.domainName, table: "sessions", key: id, operation: "deleted" }));
-    const final = await this.cacheView(table, id, stageName);
-    return final.location === snapshot.location && !final.present && await this.pathAbsent(stagePath);
+    const path = join3(this.root, directory);
+    if (matches.length !== 1 || matches[0] !== path) refuse("jsonl/identity-ambiguous", "The session directory is missing, misplaced, or duplicated across projects.");
+    const actual = await realpath2(path);
+    const rel = relative(this.root, actual);
+    if (actual !== path || rel !== directory || rel.startsWith(`..${sep}`) || isAbsolute2(rel)) refuse("jsonl/unsafe-directory", "The session directory leaves the configured root.");
+    return { path, identity: nodeIdentity(await lstat3(path, { bigint: true })) };
   }
-  async eraseCache(snapshot, id, expected, request) {
-    const table = this.cacheTable;
-    if (!table) return !snapshot.present && snapshot.location === null;
-    return table.host.enqueue(async () => {
-      if (process.platform === "win32") return this.eraseWindowsCache(snapshot, id, expected, request, table);
-      const current = await this.cacheView(table, id);
-      if (current.location !== snapshot.location || current.documentDigest !== null && current.documentDigest !== snapshot.documentDigest || current.memoryDigest !== null && current.memoryDigest !== snapshot.memoryDigest || !snapshot.present && current.present) return false;
-      await table.host.unit.deleteRecord("sessions", id);
-      const tableDirectory = table.host.unit.tableDir("sessions");
-      try {
-        await syncDirectory(tableDirectory);
-      } catch (error) {
-        if (error.code !== "ENOENT") throw error;
-      }
-      table.records.delete(id);
-      this.admission.withoutBypass(() => table.host.emitChanged({ domain: table.host.domainName, table: "sessions", key: id, operation: "deleted" }));
-      const final = await this.cacheView(table, id);
-      return final.location === snapshot.location && !final.present;
-    });
+  async assertDirectory(inventory) {
+    const base = await this.directory(inventory.directory, inventory.sessionId, inventory.header);
+    if (!same(base.identity, inventory.directoryIdentity)) refuse("jsonl/directory-changed", "The bound directory incarnation changed.");
+    return base;
   }
-  async capture(sessionId) {
-    return this.admission.bypass(sessionId, () => this.captureInner(sessionId));
+  async lockIdentity(directory) {
+    if (process.platform === "win32") return { kind: "win32-semaphore", name: windowsSemaphoreName(join3(directory, "session.lock"), "session") };
+    return lockIdentity(await lstat3(join3(directory, "session.lock"), { bigint: true }));
   }
-  async captureInner(sessionId) {
-    this.targets.add(sessionId);
-    this.assertInstances();
-    this.assertCold(sessionId);
-    const activity = await this.admission.withoutBypass(() => this.ctx.waterfall(
-      "workspace/session-activity",
-      { sessionId },
-      async () => []
-    ));
-    if (activity.length !== 0) this.refuse("native/session-active", "Native deletion refuses active work.");
-    this.assertCold(sessionId);
-    const domain = this.ctx.storageDomain.get("workspace");
-    if (!domain) throw new Error("Native workspace domain is unavailable.");
-    const global = workspaceDomainState2.parse(domain.global.get());
-    if (!global.archivedSessionIds.some((id) => id === sessionId)) this.refuse("native/not-archived", "Native metadata preparation requires an archived session.");
-    const workspaces = [];
-    for (const [workspaceId, raw] of this.workspace.requireTable().entries()) {
-      const record = workspaceRecord.parse(raw);
-      if (!record.sessionIds.some((id) => id === sessionId)) continue;
-      if (record.sessionIds.some((id) => id !== sessionId && this.workspace.sessionPaths.get(id) !== record.path)) {
-        this.refuse("native/workspace-pruning-required", "Target removal would prune an unrelated Workspace candidate.");
+  async isWindowsErasureRemainder(inventory, row) {
+    const lease = this.leases.get(inventory.directory);
+    if (process.platform !== "win32" || !lease?.recovering || lease.stamp !== leaseStamp(inventory)) return false;
+    try {
+      const handle = await this.openFile(join3(this.root, inventory.directory, row.resourceId), "read");
+      try {
+        const stat = await handle.stat({ bigint: true });
+        return stat.size === 0n && same(nodeIdentity(stat), nodeIdentityFromRow(row));
+      } finally {
+        await handle.close();
       }
-      workspaces.push({ workspaceId, record });
+    } catch (error) {
+      if (missing(error)) return false;
+      throw error;
     }
-    const cache = this.cacheTable ? await this.cacheTable.host.enqueue(() => this.cacheView(this.cacheTable, sessionId)) : { present: false, digest: null, location: null, documentDigest: null, memoryDigest: null };
-    return nativeMetadataSnapshotSchema.parse({
-      schemaVersion: 1,
-      sessionId,
-      global: { archived: global.archivedSessionIds.includes(sessionId), pinned: global.pinnedSessionIds.includes(sessionId) },
-      workspaces,
-      cache,
-      queryProvider: this.queryProvider,
-      queryPath: this.queryConfiguration?.path ?? null
-    });
   }
-  wrap(port, name2, replace) {
-    const descriptor2 = Object.getOwnPropertyDescriptor(port, name2);
-    const original = port[name2];
-    const adapter = this;
-    const guarded = replace((...args) => Reflect.apply(original, adapter.receivers.getStore() ?? port, args));
-    const replacement = function(...args) {
-      if (adapter.detached) throw new NativeMetadataRefusal("native/stale-reference", "Reacquire native methods after retirement adapter takeover.");
-      return adapter.receivers.run(this, () => guarded(...args));
-    };
-    Object.defineProperty(port, name2, { configurable: true, writable: true, value: replacement });
-    this.guardedMethods.push({ port, name: name2, replacement });
-    this.restores.push(() => {
-      if (port[name2] !== replacement) throw new Error(`Native metadata guard ${name2} was replaced before withdrawal.`);
-      if (descriptor2) Object.defineProperty(port, name2, descriptor2);
-      else delete port[name2];
-    });
+  async rows(directory, header, frozen) {
+    const names = (await readdir(directory)).sort();
+    if (names.length > 4097) refuse("jsonl/scope-too-large", "Session scope exceeds the bounded inventory.");
+    const posix = process.platform !== "win32";
+    if (posix && !names.includes("session.lock")) refuse("jsonl/lock-missing", "The existing stable writer lock is required.");
+    const rows = [];
+    for (const name2 of names) {
+      if (posix && name2 === "session.lock") continue;
+      const original = frozen?.files.find((row) => row.resourceId === name2);
+      if (frozen && original && await this.isWindowsErasureRemainder(frozen, original)) rows.push(original);
+      else rows.push(await this.readRow(directory, name2, header));
+    }
+    if (!same(names, (await readdir(directory)).sort())) refuse("jsonl/scope-changed", "The directory changed while enumerating resources.");
+    return rows;
   }
-  guardEntity(entity) {
-    if (this.guardedEntities.has(entity)) return;
-    this.guardedEntities.add(entity);
-    this.wrap(entity, "attachSession", (original) => (id) => this.tracked(id, async () => {
-      const result = await original(id);
+  async readRow(directory, name2, expected) {
+    const classified = classify(name2);
+    if (classified.compression !== this.compression) refuse("jsonl/encoding-mismatch", "Mixed raw and Zstandard session generations are not admitted.");
+    const path = join3(directory, name2);
+    const before = fileIdentity(await lstat3(path, { bigint: true }));
+    const fd = await this.openFile(path, "read");
+    try {
+      if (!same(before, fileIdentity(await fd.stat({ bigint: true })))) refuse("jsonl/resource-changed", "Resource was replaced before reading.");
+      const digest2 = createHash4("sha256");
+      const chunks = [];
+      let headerBytes = 0;
+      const buffer = Buffer.alloc(64 * 1024);
+      let total = 0n;
+      for (; ; ) {
+        const { bytesRead } = await fd.read(buffer, 0, buffer.length, null);
+        if (!bytesRead) break;
+        total += BigInt(bytesRead);
+        digest2.update(buffer.subarray(0, bytesRead));
+        if (headerBytes < HEADER_LIMIT) {
+          const chunk = Buffer.from(buffer.subarray(0, Math.min(bytesRead, HEADER_LIMIT - headerBytes)));
+          chunks.push(chunk);
+          headerBytes += chunk.length;
+        }
+      }
+      if (String(total) !== before.size || !same(before, fileIdentity(await fd.stat({ bigint: true }))) || !same(before, fileIdentity(await lstat3(path, { bigint: true })))) refuse("jsonl/resource-changed", "The resource changed while hashing its exact bytes.");
+      const header = decodeHeader(Buffer.concat(chunks), classified.compression, classified.version);
+      if (!same(header, expected)) refuse("jsonl/identity-changed", "A physical generation or staging header belongs to another lifecycle.");
+      const value = {
+        resourceId: name2,
+        kind: classified.kind,
+        formatVersion: classified.version,
+        compression: classified.compression,
+        identity: before,
+        digest: digest2.digest("hex"),
+        header
+      };
+      return fileRowSchema.parse({ ...value, revision: sha(JSON.stringify({ identity: value.identity, digest: value.digest, header })) });
+    } finally {
+      await fd.close();
+    }
+  }
+  async openFile(path, access) {
+    try {
+      return await openRegularFile(path, access);
+    } catch (error) {
+      if (error instanceof RegularFileRefusal) refuse(error.code === "platform/unsafe-file" ? "jsonl/unsafe-file" : error.code === "platform/identity-unavailable" ? "jsonl/identity-unavailable" : "jsonl/resource-changed", error.message);
+      throw error;
+    }
+  }
+  async syncDirectory(directory) {
+    await syncDirectory(directory);
+  }
+};
+
+// src/host/native-retirement-metadata.ts
+import { AsyncLocalStorage as AsyncLocalStorage2 } from "node:async_hooks";
+import { createHash as createHash5 } from "node:crypto";
+import { readdir as readdir2, realpath as realpath3, lstat as lstat4, unlink as unlink2 } from "node:fs/promises";
+import { dirname as dirname2, join as join4, resolve as resolve3 } from "node:path";
+import { workspaceDomainState as workspaceDomainState2, workspaceRecord } from "@deepseek-ai/dsh-workspace";
+import { z as z5 } from "zod";
+var NativeMetadataRefusal = class extends Error {
+  constructor(code, message) {
+    super(message);
+    this.code = code;
+    this.name = "NativeMetadataRefusal";
+  }
+};
+var cachePhysicalIdentitySchema = z5.object({
+  dev: z5.string().regex(/^\d+$/),
+  ino: z5.string().regex(/^[1-9]\d*$/),
+  birthtimeNs: z5.string().regex(/^[1-9]\d*$/)
+}).strict();
+var nativeMetadataSnapshotSchema = z5.object({
+  schemaVersion: z5.literal(1),
+  sessionId: z5.string().min(1),
+  global: z5.object({ archived: z5.boolean(), pinned: z5.boolean() }).strict(),
+  workspaces: z5.array(z5.object({ workspaceId: z5.string(), record: workspaceRecord }).strict()),
+  cache: z5.object({
+    present: z5.boolean(),
+    digest: z5.string().nullable(),
+    location: z5.string().nullable(),
+    documentDigest: z5.string().nullable(),
+    memoryDigest: z5.string().nullable(),
+    physicalIdentity: cachePhysicalIdentitySchema.optional()
+  }).strict(),
+  queryProvider: z5.enum(["none", "sqlite-0.2.0-rc.2", "sqlite-memory-disabled-0.2.0-rc.2"]),
+  queryPath: z5.string().nullable()
+}).strict();
+function object(value) {
+  return value !== null && typeof value === "object" ? value : void 0;
+}
+function canonical2(value) {
+  if (Array.isArray(value)) return `[${value.map(canonical2).join(",")}]`;
+  if (value !== null && typeof value === "object") return `{${Object.keys(value).sort().map((key2) => `${JSON.stringify(key2)}:${canonical2(value[key2])}`).join(",")}}`;
+  return JSON.stringify(value);
+}
+function digest(value) {
+  return createHash5("sha256").update(canonical2(value)).digest("hex");
+}
+var methods = (port, names) => names.every((name2) => typeof port[name2] === "function");
+var windowsCacheStagePrefix = ".dsh-session-bin-cache-";
+function physicalIdentity(stat) {
+  return { dev: String(stat.dev), ino: String(stat.ino), birthtimeNs: String(stat.birthtimeNs) };
+}
+function samePhysicalIdentity(left, right) {
+  return left !== void 0 && right !== void 0 && left.dev === right.dev && left.ino === right.ino && left.birthtimeNs === right.birthtimeNs;
+}
+function cacheStageBasename(snapshot, expected, request) {
+  const value = digest({ schemaVersion: 1, expected, request, cache: snapshot });
+  return `${windowsCacheStagePrefix}${value}.stage`;
+}
+var NativeMetadataAdapter = class _NativeMetadataAdapter {
+  constructor(ctx, admission, workspace, sessions, cache, query, controller) {
+    this.ctx = ctx;
+    this.admission = admission;
+    this.workspace = workspace;
+    this.sessions = sessions;
+    this.cache = cache;
+    this.query = query;
+    this.controller = controller;
+    this.queryConfiguration = query ? { path: query.config.path, openAt: query.config.openAt } : void 0;
+    this.queryProvider = !query ? "none" : query.config.openAt === "never" ? "sqlite-memory-disabled-0.2.0-rc.2" : "sqlite-0.2.0-rc.2";
+    this.cacheTable = cache?.requireTable();
+    this.cacheDirectory = this.cacheTable?.host.unit.dir;
+    this.agents = controller ? _NativeMetadataAdapter.get(ctx, "agents") : void 0;
+  }
+  targets = /* @__PURE__ */ new Set();
+  retained = /* @__PURE__ */ new Map();
+  followers = /* @__PURE__ */ new Map();
+  followerStops = /* @__PURE__ */ new Map();
+  activationTarget = new AsyncLocalStorage2();
+  apiHandles = /* @__PURE__ */ new Map();
+  operations = /* @__PURE__ */ new Map();
+  queueTarget = new AsyncLocalStorage2();
+  receivers = new AsyncLocalStorage2();
+  restores = [];
+  guardedMethods = [];
+  guardedEntities = /* @__PURE__ */ new WeakSet();
+  installed = false;
+  disposed = false;
+  detached = false;
+  fallbackRetired = /* @__PURE__ */ new Set();
+  queryConfiguration;
+  queryProvider;
+  cacheTable;
+  cacheDirectory;
+  agents;
+  moveCacheDocument = renameWindowsWriteThrough;
+  clearCacheStage = async (handle) => {
+    await handle.truncate(0);
+    await handle.sync();
+  };
+  removeCacheStage = unlink2;
+  static get(ctx, name2) {
+    const value = object(ctx.get(name2));
+    return object(value?.[Symbol.for("cordis.original")] ?? value);
+  }
+  static async open(ctx, admission) {
+    const workspace = this.get(ctx, "workspaceRegistry");
+    const sessions = this.get(ctx, "sessions");
+    const cache = this.get(ctx, "sessionProjectionCache");
+    const query = this.get(ctx, "sessionQuery");
+    const controller = this.get(ctx, "sessionController");
+    if (!workspace || !sessions || workspace.constructor.name !== "WorkspaceRegistry" || sessions.constructor.name !== "SessionStore" || !methods(workspace, ["list", "requireTable", "requireState", "setState", "enqueueOperation", "indexHeader", "readSessionHeader"]) || ![workspace.headers, workspace.sessionPaths, workspace.invalidSessionPaths].every((map) => map instanceof Map) || !(workspace.missingSessionPaths instanceof Set) || !methods(sessions, ["get", "prepare", "enter", "announce"])) return void 0;
+    if (cache && (cache.constructor.name !== "SessionProjectionCache" || !(cache.dirty instanceof Map) || !methods(cache, ["put", "requireTable", "write", "coldSnapshot", "hydratePrepared", "cachedSnapshot", "cachedPredecessorTitle"]))) return void 0;
+    if (cache) {
+      const table = cache.requireTable();
+      const domain = ctx.storageDomain.get("session_projcache");
+      if (table?.constructor.name !== "KvTableImpl" || table.tableName !== "sessions" || !(table.records instanceof Map) || table.host?.domainName !== "session_projcache" || table.host.unit?.constructor.name !== "PerRecordJsonUnit" || table.host.unit.descriptor?.name !== "session_projcache" || table.host.unit.descriptor.version !== 7 || table.host.unit.descriptor.layout !== "per-record" || typeof table.host.unit.dir !== "string" || !methods(table.host, ["enqueue", "emitChanged", "assertReadable"]) || !methods(table.host.unit, ["loadAll", "deleteRecord", "tableDir"]) || domain?.unit !== table.host.unit) return void 0;
+    }
+    if (query) {
+      const enabled = ["startup", "first-search"].includes(query.config?.openAt);
+      const disabledMemory = query.config?.openAt === "never" && query.config.path === ":memory:" && query._db === void 0 && query._ready === void 0;
+      if (query.constructor.name !== "SqliteSessionQueryEngine" || !enabled && !disabledMemory || typeof query.config?.path !== "string" || !methods(query, ["searchSessions", "listSessions", "observeSession", "_serialized"]) || !(query._observations?.cache instanceof Map) || !methods(query._observations, ["read", "store"])) return void 0;
+    }
+    if (controller && (controller.constructor.name !== "SessionController" || !(controller.history?.closeFollowers instanceof Set) || !methods(controller.history, ["page", "follow", "sourceFor"]) || controller.agents?.constructor.name !== "ApiSessionAgentController" || !methods(controller.agents, ["resumeObserved", "claim", "createAgent"]) || !methods(controller.listState ?? {}, ["summarizeCold"]) || !methods(this.get(ctx, "agents") ?? {}, ["create", "resume", "get"]))) return void 0;
+    return new _NativeMetadataAdapter(ctx, admission, workspace, sessions, cache, query, controller);
+  }
+  assert(id) {
+    this.targets.add(id);
+    if (this.disposed) {
+      if (this.fallbackRetired.has(id)) throw new NativeMetadataRefusal("native/retired", "This retired session remains fenced after adapter withdrawal.");
+      return;
+    }
+    this.admission.assertAllowed(id);
+  }
+  tracked(id, work) {
+    this.targets.add(id);
+    if (this.disposed) {
       this.assert(id);
-      return result;
+      return work();
+    }
+    return this.admission.trackGlobal(() => this.admission.track(id, async () => {
+      this.assert(id);
+      this.increment(this.operations, id, 1);
+      try {
+        return await work();
+      } finally {
+        this.increment(this.operations, id, -1);
+      }
     }));
   }
-  guardedObservation(id, observation) {
-    this.increment(this.retained, id, 1);
-    let disposed = false;
-    return new Proxy(observation, { get: (target, property) => {
-      if (property === Symbol.dispose) return () => {
-        if (disposed) return;
-        disposed = true;
-        try {
-          target[Symbol.dispose]();
-        } finally {
-          this.increment(this.retained, id, -1);
-        }
-      };
-      if (property === "retain") return () => {
-        this.assert(id);
-        return this.guardedObservation(id, target.retain());
-      };
-      if (property === "events" || property === "projections") this.assert(id);
-      return Reflect.get(target, property, target);
-    } });
+  increment(map, id, delta) {
+    const next = (map.get(id) ?? 0) + delta;
+    if (next === 0) map.delete(id);
+    else map.set(id, next);
   }
-  async install() {
-    if (this.installed) throw new Error("Native metadata adapter is already installed.");
+  refuse(code, message) {
+    throw new NativeMetadataRefusal(code, message);
+  }
+  assertInstances() {
+    if (this.guardedMethods.some(({ port, name: name2, replacement }) => port[name2] !== replacement)) {
+      this.refuse("native/guard-replaced", "A native metadata admission guard was replaced.");
+    }
+    if (_NativeMetadataAdapter.get(this.ctx, "workspaceRegistry") !== this.workspace || _NativeMetadataAdapter.get(this.ctx, "sessions") !== this.sessions || _NativeMetadataAdapter.get(this.ctx, "sessionProjectionCache") !== this.cache || _NativeMetadataAdapter.get(this.ctx, "sessionQuery") !== this.query || _NativeMetadataAdapter.get(this.ctx, "sessionController") !== this.controller || this.controller && _NativeMetadataAdapter.get(this.ctx, "agents") !== this.agents || this.cache && (this.cache.requireTable() !== this.cacheTable || this.cacheTable.host.unit.dir !== this.cacheDirectory) || this.query && (this.query.config.path !== this.queryConfiguration.path || this.query.config.openAt !== this.queryConfiguration.openAt) || this.queryProvider === "sqlite-memory-disabled-0.2.0-rc.2" && (this.query._db !== void 0 || this.query._ready !== void 0)) {
+      this.refuse("native/composition-changed", "Native metadata service composition changed.");
+    }
+  }
+  assertCold(id) {
+    if (this.sessions.get(id) !== void 0 || _NativeMetadataAdapter.get(this.ctx, "agents")?.get(id) !== void 0) {
+      this.refuse("native/session-live", "Native deletion currently accepts only cold sessions.");
+    }
+    const cached = this.query?._observations.cache.get(id);
+    if (cached?.refs > 0 || (this.retained.get(id) ?? 0) > 0) this.refuse("native/query-retained", "A retained query observation still owns this session.");
+    if ((this.followers.get(id) ?? 0) > 0) this.refuse("native/follow-retained", "A history follower still owns this session.");
+    const knownFollowers = [...this.followers.values()].reduce((sum, count) => sum + count, 0);
+    if ((this.controller?.history.closeFollowers.size ?? 0) > knownFollowers) this.refuse("native/unknown-follow", "A history follower predates native admission tracking.");
+    if (this.cache && [...this.cache.dirty.keys()].some((session) => session.id === id)) this.refuse("native/cache-dirty", "Target cache write-behind is not quiescent.");
+  }
+  /** Explicit deletion preparation may unload an idle API-owned lifecycle.
+   * No bare registry Agent, foreign handle, or unknown reader is disposed. */
+  async releaseIdle(id) {
     this.assertInstances();
-    this.installed = true;
+    const handle = this.apiHandles.get(id);
+    if (!handle) return;
+    const agent = handle.agent;
+    const registry = this.agents;
+    if (registry.get(id) !== agent || this.sessions.get(id) !== agent.session) return;
+    const activity = await this.admission.withoutBypass(() => this.ctx.waterfall(
+      "workspace/session-activity",
+      { sessionId: id },
+      async () => []
+    ));
+    if (activity.length || agent.constructor.name !== "ReactLoopAgent" || agent.phase?.kind !== "idle" || agent.status !== "idle" || !Array.isArray(agent.inbox?.nextTurn) || !Array.isArray(agent.inbox?.nextStep) || agent.inbox.nextTurn.length || agent.inbox.nextStep.length) {
+      this.refuse("native/session-active", "Native deletion refuses active or queued work.");
+    }
+    if (!this.workspace.archivedSessionIds.includes(id)) this.refuse("native/not-archived", "Only an archived target may be unloaded.");
+    if (registry.get(id) !== agent || this.sessions.get(id) !== agent.session) this.refuse("native/session-live", "The API lifecycle changed.");
+    await this.admission.bypass(id, async () => {
+      await handle.dispose();
+      for (const stop of [...this.followerStops.get(id) ?? []]) await stop();
+      if (this.cache) await this.cache.requireTable().host.enqueue(async () => void 0);
+      const summary = this.controller.listState.summarizeCold({ header: agent.session.header });
+      this.admission.withoutBypass(() => this.ctx.emit("api-session/added", summary));
+    });
+    this.apiHandles.delete(id);
+  }
+  async cacheView(table, id, acceptedStage) {
+    table.host.assertReadable();
+    if (!/^[a-zA-Z0-9_-]+$/.test(id)) this.refuse("native/cache-key-unsupported", "The pinned cache backend cannot own this record key.");
+    const directory = resolve3(table.host.unit.dir);
+    const legacyPath = join4(dirname2(directory), `${table.host.unit.descriptor.name}.json`);
     try {
-      for (const name2 of ["workspace", ...this.cache ? ["session_projcache"] : []]) {
-        const domain = this.ctx.storageDomain.get(name2);
-        if (!domain || domain.constructor.name !== "DomainImpl" || !methods(domain, ["emitChanged"])) {
-          throw new Error("Native metadata domain publication shape changed.");
-        }
-        this.wrap(domain, "emitChanged", (original) => (change) => this.admission.withoutBypass(() => original(change)));
-      }
-      for (const name2 of ["archiveSession", "unarchiveSession", "pinSession", "unpinSession"]) {
-        this.wrap(this.workspace, name2, (original) => (id, ...args) => this.tracked(
-          id,
-          () => this.queueTarget.run(id, async () => original(id, ...args))
-        ));
-      }
-      this.wrap(this.workspace, "enqueueOperation", (original) => (operation) => {
-        const id = this.queueTarget.getStore();
-        return original(async () => {
-          if (id !== void 0) this.assert(id);
-          return operation();
-        });
-      });
-      this.wrap(this.workspace, "setState", (original) => async (next) => {
-        const id = this.queueTarget.getStore();
-        if (id !== void 0) this.assert(id);
-        return original(next);
-      });
-      this.wrap(this.workspace, "indexHeader", (original) => (header) => this.tracked(header.id, async () => {
-        const result = await original(header);
-        this.assert(header.id);
-        return result;
-      }));
-      this.wrap(this.workspace, "readSessionHeader", (original) => (id) => this.tracked(id, async () => {
-        const result = await original(id);
-        this.assert(id);
-        return result;
-      }));
-      for (const entity of this.workspace.list()) this.guardEntity(entity);
-      for (const name2 of ["create", "initializeDefault"]) this.wrap(this.workspace, name2, (original) => async (...args) => {
-        const entity = await original(...args);
-        if (entity) this.guardEntity(entity);
-        return entity;
-      });
-      this.wrap(this.sessions, "prepare", (original) => (id, ...args) => {
-        if (id !== void 0) this.assert(id);
-        const session = original(id, ...args);
-        this.assert(session.id);
-        return session;
-      });
-      for (const name2 of ["enter", "announce"]) this.wrap(this.sessions, name2, (original) => (session) => {
-        this.assert(session.id);
-        return original(session);
-      });
-      if (this.cache) {
-        this.wrap(this.cache, "put", (original) => (id, ...args) => this.tracked(id, async () => original(id, ...args)));
-        for (const name2 of ["cachedSnapshot", "cachedPredecessorTitle", "coldSnapshot"]) this.wrap(
-          this.cache,
-          name2,
-          (original) => (header, ...args) => {
-            this.assert(header.id);
-            return original(header, ...args);
-          }
-        );
-        this.wrap(this.cache, "hydratePrepared", (original) => (session, ...args) => {
-          this.assert(session.id);
-          return original(session, ...args);
-        });
-      }
-      if (this.query) {
-        this.wrap(this.query, "_serialized", (original) => (signal, operation) => this.admission.trackGlobal(async () => original(signal, operation)));
-        this.wrap(this.query._observations, "read", (original) => (id, ...args) => this.tracked(id, async () => {
-          const observation = await original(id, ...args);
-          try {
-            this.assert(id);
-            return this.guardedObservation(id, observation);
-          } catch (error) {
-            observation[Symbol.dispose]();
-            throw error;
-          }
-        }));
-        this.wrap(this.query._observations, "store", (original) => (id, ...args) => {
-          this.assert(id);
-          return original(id, ...args);
-        });
-        for (const name2 of ["readSession", "readTitle", "readTitleSnapshot", "listEvents", "filterEvents", "readSurface", "traceSession"]) {
-          if (typeof this.query[name2] === "function") this.wrap(this.query, name2, (original) => (id, ...args) => this.tracked(id, async () => {
-            const result = await original(id, ...args);
-            this.assert(id);
-            return result;
-          }));
-        }
-        for (const name2 of ["searchEvents", "readEvent", "traceEvent"]) if (typeof this.query[name2] === "function") {
-          this.wrap(this.query, name2, (original) => (request, ...args) => this.tracked(
-            request.sessionId,
-            async () => {
-              const result = await original(request, ...args);
-              this.assert(request.sessionId);
-              return result;
-            }
-          ));
-        }
-      }
-      if (this.controller) {
-        const adapter = this;
-        for (const name2 of ["resumeObserved", "createOrAdopt"]) {
-          this.wrap(this.controller.agents, name2, (original) => (id, ...args) => this.tracked(id, () => this.activationTarget.run(id, async () => original(id, ...args))));
-        }
-        const agents = this.agents;
-        for (const name2 of ["create", "resume"]) {
-          this.wrap(agents, name2, (original) => (options, ...args) => {
-            const id = String(name2 === "create" ? options.sessionId : options.resumeSessionId);
-            return this.tracked(id, async () => {
-              const handle = await original(options, ...args);
-              if (this.activationTarget.getStore() === id && options.parentAgent === void 0 && handle.agent.id === id && handle.agent.session.header.origin !== "subagent" && typeof handle.dispose === "function") this.apiHandles.set(id, handle);
-              return handle;
-            });
-          });
-        }
-        this.restores.push(this.ctx.on("agent/disposed", ({ agent }) => {
-          if (this.apiHandles.get(agent.id)?.agent === agent) this.apiHandles.delete(agent.id);
-        }, { global: true }));
-        this.wrap(this.controller.history, "follow", (original) => function(request, signal) {
-          const id = String(request.address.sessionId);
-          adapter.assert(id);
-          return (async function* () {
-            adapter.assert(id);
-            adapter.increment(adapter.followers, id, 1);
-            const cancellation = new AbortController();
-            const iterator = original(request, AbortSignal.any([signal, cancellation.signal]));
-            const stops = adapter.followerStops.get(id) ?? /* @__PURE__ */ new Set();
-            adapter.followerStops.set(id, stops);
-            let finished = false;
-            const finish = () => {
-              if (finished) return;
-              finished = true;
-              adapter.increment(adapter.followers, id, -1);
-              stops.delete(stop);
-              if (!stops.size) adapter.followerStops.delete(id);
-            };
-            const stop = async () => {
-              cancellation.abort();
-              await iterator.return();
-              finish();
-            };
-            stops.add(stop);
-            try {
-              for await (const frame of iterator) {
-                adapter.assert(id);
-                yield frame;
-              }
-            } finally {
-              finish();
-            }
-          })();
-        });
-      }
+      await lstat4(legacyPath);
+      this.refuse("native/cache-unclassified-resource", "A legacy whole-unit cache could republish the retired target document.");
+    } catch (error) {
+      if (error.code !== "ENOENT") throw error;
+    }
+    let location;
+    try {
+      location = await realpath3(directory);
     } catch (error) {
-      for (const restore of [...this.restores].reverse()) restore();
-      this.restores.length = 0;
-      this.installed = false;
-      throw error;
+      if (error.code !== "ENOENT") throw error;
+      location = join4(await realpath3(dirname2(directory)), "session_projcache");
     }
-    let closing;
-    return () => closing ??= (async () => {
-      this.fallbackRetired = new Set([...this.targets].filter((id) => this.admission.isRetired(id)));
-      this.disposed = true;
-      this.apiHandles.clear();
-      if (this.fallbackRetired.size === 0) {
-        for (const restore of [...this.restores].reverse()) restore();
-        this.restores.length = 0;
-      }
-    })();
-  }
-  /** The verified owner completes all asynchronous takeover work before this
-   * synchronous restoration and installs its successor guards without yielding. */
-  forceRestore() {
-    if (this.restores.length && this.guardedMethods.some(({ port, name: name2, replacement }) => port[name2] !== replacement)) {
-      throw new Error("Native metadata guards changed before trusted takeover.");
+    const tableDirectory = table.host.unit.tableDir("sessions");
+    let names;
+    try {
+      names = await readdir2(tableDirectory);
+    } catch (error) {
+      if (error.code !== "ENOENT") throw error;
+      names = [];
     }
-    this.detached = true;
-    this.disposed = true;
-    for (const restore of [...this.restores].reverse()) restore();
-    this.restores.length = 0;
-    this.guardedMethods.length = 0;
-    this.fallbackRetired.clear();
-    this.apiHandles.clear();
-  }
-  async converge(input, expected, request) {
-    const snapshot = nativeMetadataSnapshotSchema.parse(input);
-    const id = snapshot.sessionId;
-    this.targets.add(id);
-    this.assertInstances();
-    if (snapshot.queryProvider !== this.queryProvider || snapshot.queryPath !== (this.queryConfiguration?.path ?? null)) return false;
-    if (id !== expected.sessionId || id !== request.expected.sessionId || expected.storeId !== request.expected.storeId || expected.lifecycleId !== request.expected.lifecycleId || !this.admission.isRetired(id)) {
-      this.refuse("native/maintenance-binding-changed", "Native convergence requires the exact durable retirement binding.");
+    if (names.some((name2) => name2.startsWith(`${id}.json.bak.`) || /^\.[a-f0-9-]+\.tmp$/.test(name2) || name2.startsWith(windowsCacheStagePrefix) && name2 !== acceptedStage)) {
+      this.refuse("native/cache-unclassified-resource", "A cache backup or unclassified staging document prevents complete target erasure.");
     }
-    if ((this.operations.get(id) ?? 0) > 0 || (this.retained.get(id) ?? 0) > 0 || (this.followers.get(id) ?? 0) > 0) return false;
-    this.assertCold(id);
-    return this.admission.bypass(id, async () => {
-      if (!await this.eraseCache(snapshot.cache, id, expected, request)) return false;
-      this.query?._observations.cache.delete(id);
-      const frozenIds = new Set(snapshot.workspaces.map((item) => item.workspaceId));
-      const convergeWorkspace = async () => {
-        for (const [workspaceId, raw] of this.workspace.requireTable().entries()) {
-          const record = workspaceRecord.parse(raw);
-          if (!record.sessionIds.some((sessionId) => sessionId === id)) continue;
-          if (!frozenIds.has(workspaceId) || record.sessionIds.some((other) => other !== id && this.workspace.sessionPaths.get(other) !== record.path)) return false;
-          const entity = this.workspace.get(workspaceId);
-          if (!entity) throw new Error("Native Workspace account lost its runtime entity.");
-          await entity.detachSession(id);
-        }
-        const state = workspaceDomainState2.parse(this.workspace.requireState());
-        if (state.archivedSessionIds.includes(id) || state.pinnedSessionIds.includes(id)) {
-          await this.workspace.setState({
-            ...state,
-            archivedSessionIds: state.archivedSessionIds.filter((other) => other !== id),
-            pinnedSessionIds: state.pinnedSessionIds.filter((other) => other !== id)
-          });
-        }
-        this.workspace.headers.delete(id);
-        this.workspace.sessionPaths.delete(id);
-        this.workspace.invalidSessionPaths.delete(id);
-        return true;
-      };
-      if (!await this.workspace.enqueueOperation(convergeWorkspace)) return false;
-      if (this.query) {
-        if (this.queryProvider === "sqlite-0.2.0-rc.2") {
-          await this.query.searchSessions({ query: "native-retirement-reconciliation", limit: 1 });
+    let documentDigest = null;
+    let documentIdentity;
+    const path = join4(tableDirectory, `${id}.json`);
+    try {
+      let handle;
+      try {
+        handle = await openRegularFile(path, "read");
+      } catch (error) {
+        if (error instanceof RegularFileRefusal) this.refuse(error.code === "platform/unsafe-file" ? "native/cache-unsafe-document" : "native/cache-document-changed", error.message);
+        throw error;
+      }
+      try {
+        const before = await handle.stat({ bigint: true });
+        const bytes = await handle.readFile();
+        const after = await handle.stat({ bigint: true });
+        const current = await lstat4(path, { bigint: true });
+        if (!current.isFile() || before.dev !== after.dev || before.ino !== after.ino || before.size !== after.size || before.birthtimeNs !== after.birthtimeNs || before.mtimeNs !== after.mtimeNs || before.ctimeNs !== after.ctimeNs || after.nlink !== 1n || after.dev !== current.dev || after.ino !== current.ino || after.birthtimeNs !== current.birthtimeNs || after.size !== current.size || after.mtimeNs !== current.mtimeNs || after.ctimeNs !== current.ctimeNs) {
+          this.refuse("native/cache-document-changed", "The physical cache document changed while observing its bytes.");
         }
-        if ((await this.query.listSessions()).some((record) => record.header.id === id)) return false;
-        this.assertInstances();
+        documentDigest = createHash5("sha256").update(bytes).digest("hex");
+        if (process.platform === "win32") documentIdentity = physicalIdentity(after);
+      } finally {
+        await handle.close();
       }
-      this.admission.withoutBypass(() => this.ctx.emit("api-session/removed", id));
-      return true;
-    });
-  }
-};
-
-// src/host/native-retirement-admission.ts
-import { AsyncLocalStorage as AsyncLocalStorage2 } from "node:async_hooks";
-var NativeAdmissionError = class extends Error {
-  code = "native/session-busy";
-};
-var NativeAdmission = class {
-  maintenance = new AsyncLocalStorage2();
-  acceptedFrames = new AsyncLocalStorage2();
-  activeAcceptedFrames = /* @__PURE__ */ new Set();
-  held = /* @__PURE__ */ new Set();
-  released = /* @__PURE__ */ new Map();
-  pending = /* @__PURE__ */ new Map();
-  globalReads = /* @__PURE__ */ new Set();
-  retired = /* @__PURE__ */ new Set();
-  candidates = /* @__PURE__ */ new Set();
-  closing = false;
-  failed = false;
-  ready = false;
-  requiresRecovery() {
-    return this.failed;
-  }
-  activate() {
-    this.ready = true;
-  }
-  suspend() {
-    this.failed = true;
+    } catch (error) {
+      if (error.code !== "ENOENT") throw error;
+    }
+    const memory = table.records.get(id);
+    const memoryDigest = memory === void 0 ? null : digest(memory);
+    const present = documentDigest !== null || memoryDigest !== null;
+    return {
+      present,
+      digest: present ? digest({ documentDigest, memoryDigest }) : null,
+      location,
+      documentDigest,
+      memoryDigest,
+      ...documentIdentity ? { physicalIdentity: documentIdentity } : {}
+    };
   }
-  beginClose() {
-    this.closing = true;
+  async openCacheDocument(path, access) {
+    try {
+      return await openRegularFile(path, access);
+    } catch (error) {
+      if (error instanceof RegularFileRefusal) this.refuse(error.code === "platform/unsafe-file" ? "native/cache-unsafe-document" : "native/cache-document-changed", error.message);
+      throw error;
+    }
   }
-  isRetired(id) {
-    return this.retired.has(id) || this.failed && this.candidates.has(id);
+  async pathAbsent(path) {
+    try {
+      await lstat4(path);
+      return false;
+    } catch (error) {
+      if (error.code === "ENOENT") return true;
+      throw error;
+    }
   }
-  hasTombstones() {
-    return this.retired.size > 0 || this.failed && this.candidates.size > 0;
+  async frozenCacheBytes(handle, snapshot, allowCleared) {
+    const before = await handle.stat({ bigint: true });
+    if (!before.isFile() || before.nlink !== 1n || !samePhysicalIdentity(physicalIdentity(before), snapshot.physicalIdentity)) return false;
+    const bytes = await handle.readFile();
+    const after = await handle.stat({ bigint: true });
+    if (before.dev !== after.dev || before.ino !== after.ino || before.birthtimeNs !== after.birthtimeNs || before.size !== after.size || before.mtimeNs !== after.mtimeNs || before.ctimeNs !== after.ctimeNs || after.nlink !== 1n) return false;
+    return allowCleared && bytes.length === 0 || snapshot.documentDigest !== null && createHash5("sha256").update(bytes).digest("hex") === snapshot.documentDigest;
   }
-  markRetired(id) {
-    this.retired.add(id);
+  async eraseWindowsCache(snapshot, id, expected, request, table) {
+    if (snapshot.documentDigest !== null && snapshot.physicalIdentity === void 0) return false;
+    if (snapshot.documentDigest === null && snapshot.physicalIdentity !== void 0) return false;
+    const tableDirectory = table.host.unit.tableDir("sessions");
+    const originalPath = join4(tableDirectory, `${id}.json`);
+    const stageName = cacheStageBasename(snapshot, expected, request);
+    const stagePath = join4(tableDirectory, stageName);
+    const current = await this.cacheView(table, id, stageName);
+    if (current.location !== snapshot.location || current.documentDigest !== null && current.documentDigest !== snapshot.documentDigest || current.memoryDigest !== null && current.memoryDigest !== snapshot.memoryDigest || !snapshot.present && current.present) return false;
+    let originalAbsent = await this.pathAbsent(originalPath);
+    let stageAbsent = await this.pathAbsent(stagePath);
+    if (!originalAbsent && !stageAbsent) return false;
+    if (!originalAbsent) {
+      if (snapshot.physicalIdentity === void 0 || current.documentDigest !== snapshot.documentDigest || !samePhysicalIdentity(current.physicalIdentity, snapshot.physicalIdentity)) return false;
+      let handle;
+      try {
+        handle = await this.openCacheDocument(originalPath, "write");
+      } catch (error) {
+        if (error.code === "ENOENT") return false;
+        throw error;
+      }
+      try {
+        if (!await this.frozenCacheBytes(handle, snapshot, false)) return false;
+        try {
+          await this.moveCacheDocument(originalPath, stagePath);
+        } catch (error) {
+          if (["EEXIST", "EXDEV", "ENOENT"].includes(error.code ?? "")) return false;
+          throw error;
+        }
+      } finally {
+        await handle.close();
+      }
+      originalAbsent = await this.pathAbsent(originalPath);
+      stageAbsent = await this.pathAbsent(stagePath);
+      if (!originalAbsent || stageAbsent) return false;
+    }
+    if (!stageAbsent) {
+      let handle;
+      try {
+        handle = await this.openCacheDocument(stagePath, "write");
+      } catch (error) {
+        if (error.code === "ENOENT") return false;
+        throw error;
+      }
+      try {
+        if (!await this.frozenCacheBytes(handle, snapshot, true)) return false;
+        await this.clearCacheStage(handle);
+      } finally {
+        await handle.close();
+      }
+      await this.removeCacheStage(stagePath);
+      if (!await this.pathAbsent(stagePath)) return false;
+    }
+    if (!await this.pathAbsent(originalPath) || !await this.pathAbsent(stagePath)) return false;
+    table.records.delete(id);
+    this.admission.withoutBypass(() => table.host.emitChanged({ domain: table.host.domainName, table: "sessions", key: id, operation: "deleted" }));
+    const final = await this.cacheView(table, id, stageName);
+    return final.location === snapshot.location && !final.present && await this.pathAbsent(stagePath);
   }
-  isAcceptedFrame() {
-    const frame = this.acceptedFrames.getStore();
-    return frame !== void 0 && this.activeAcceptedFrames.has(frame);
+  async eraseCache(snapshot, id, expected, request) {
+    const table = this.cacheTable;
+    if (!table) return !snapshot.present && snapshot.location === null;
+    return table.host.enqueue(async () => {
+      if (process.platform === "win32") return this.eraseWindowsCache(snapshot, id, expected, request, table);
+      const current = await this.cacheView(table, id);
+      if (current.location !== snapshot.location || current.documentDigest !== null && current.documentDigest !== snapshot.documentDigest || current.memoryDigest !== null && current.memoryDigest !== snapshot.memoryDigest || !snapshot.present && current.present) return false;
+      await table.host.unit.deleteRecord("sessions", id);
+      const tableDirectory = table.host.unit.tableDir("sessions");
+      try {
+        await syncDirectory(tableDirectory);
+      } catch (error) {
+        if (error.code !== "ENOENT") throw error;
+      }
+      table.records.delete(id);
+      this.admission.withoutBypass(() => table.host.emitChanged({ domain: table.host.domainName, table: "sessions", key: id, operation: "deleted" }));
+      const final = await this.cacheView(table, id);
+      return final.location === snapshot.location && !final.present;
+    });
   }
-  assertAllowed(id) {
-    const maintenance = this.maintenance.getStore();
-    if (maintenance?.active && maintenance.id === id && !(this.failed && this.candidates.has(id))) return;
-    if (!this.ready || this.closing && !this.isAcceptedFrame() || this.failed && this.candidates.has(id) || this.retired.has(id) || this.held.has(id) && !this.isAcceptedFrame()) {
-      throw new NativeAdmissionError("The session is reserved for retirement or awaiting recovery.");
-    }
+  async capture(sessionId) {
+    return this.admission.bypass(sessionId, () => this.captureInner(sessionId));
   }
-  bypass(id, work) {
-    const token = { id, active: true };
-    try {
-      const value = this.maintenance.run(token, work);
-      if (value && typeof value.then === "function") {
-        return Promise.resolve(value).finally(() => {
-          token.active = false;
-        });
+  async captureInner(sessionId) {
+    this.targets.add(sessionId);
+    this.assertInstances();
+    this.assertCold(sessionId);
+    const activity = await this.admission.withoutBypass(() => this.ctx.waterfall(
+      "workspace/session-activity",
+      { sessionId },
+      async () => []
+    ));
+    if (activity.length !== 0) this.refuse("native/session-active", "Native deletion refuses active work.");
+    this.assertCold(sessionId);
+    const domain = this.ctx.storageDomain.get("workspace");
+    if (!domain) throw new Error("Native workspace domain is unavailable.");
+    const global = workspaceDomainState2.parse(domain.global.get());
+    if (!global.archivedSessionIds.some((id) => id === sessionId)) this.refuse("native/not-archived", "Native metadata preparation requires an archived session.");
+    const workspaces = [];
+    for (const [workspaceId, raw] of this.workspace.requireTable().entries()) {
+      const record = workspaceRecord.parse(raw);
+      if (!record.sessionIds.some((id) => id === sessionId)) continue;
+      if (record.sessionIds.some((id) => id !== sessionId && this.workspace.sessionPaths.get(id) !== record.path && !this.workspace.missingSessionPaths.has(id))) {
+        this.refuse("native/workspace-pruning-required", "Target removal would prune an unrelated Workspace candidate.");
       }
-      token.active = false;
-      return value;
-    } catch (error) {
-      token.active = false;
-      throw error;
+      workspaces.push({ workspaceId, record });
     }
+    const cache = this.cacheTable ? await this.cacheTable.host.enqueue(() => this.cacheView(this.cacheTable, sessionId)) : { present: false, digest: null, location: null, documentDigest: null, memoryDigest: null };
+    return nativeMetadataSnapshotSchema.parse({
+      schemaVersion: 1,
+      sessionId,
+      global: { archived: global.archivedSessionIds.includes(sessionId), pinned: global.pinnedSessionIds.includes(sessionId) },
+      workspaces,
+      cache,
+      queryProvider: this.queryProvider,
+      queryPath: this.queryConfiguration?.path ?? null
+    });
   }
-  withoutBypass(work) {
-    return this.maintenance.run(void 0, work);
-  }
-  track(id, work) {
-    this.assertAllowed(id);
-    const tasks = this.pending.get(id) ?? /* @__PURE__ */ new Set();
-    this.pending.set(id, tasks);
-    const frame = Symbol("native-accepted-operation");
-    this.activeAcceptedFrames.add(frame);
-    const task = this.acceptedFrames.run(frame, () => Promise.resolve().then(work));
-    tasks.add(task);
-    void task.finally(() => {
-      this.activeAcceptedFrames.delete(frame);
-      tasks.delete(task);
-      if (!tasks.size) this.pending.delete(id);
-    }).catch(() => {
+  wrap(port, name2, replace) {
+    const descriptor2 = Object.getOwnPropertyDescriptor(port, name2);
+    const original = port[name2];
+    const adapter = this;
+    const guarded = replace((...args) => Reflect.apply(original, adapter.receivers.getStore() ?? port, args));
+    const replacement = function(...args) {
+      if (adapter.detached) throw new NativeMetadataRefusal("native/stale-reference", "Reacquire native methods after retirement adapter takeover.");
+      return adapter.receivers.run(this, () => guarded(...args));
+    };
+    Object.defineProperty(port, name2, { configurable: true, writable: true, value: replacement });
+    this.guardedMethods.push({ port, name: name2, replacement });
+    this.restores.push(() => {
+      if (port[name2] !== replacement) throw new Error(`Native metadata guard ${name2} was replaced before withdrawal.`);
+      if (descriptor2) Object.defineProperty(port, name2, descriptor2);
+      else delete port[name2];
     });
-    return task;
   }
-  async trackGlobal(work) {
-    if (this.closing && !this.isAcceptedFrame() && !this.maintenance.getStore()?.active) {
-      throw new NativeAdmissionError("Native admission is closing.");
-    }
-    while (this.held.size && !this.maintenance.getStore()?.active && !this.isAcceptedFrame()) {
-      await Promise.all([...this.released.values()].map((signal) => signal.promise));
-    }
-    if (!this.ready || this.closing && !this.isAcceptedFrame() && !this.maintenance.getStore()?.active) {
-      throw new NativeAdmissionError("Native admission is not accepting another request.");
-    }
-    const frame = Symbol("native-header-read");
-    this.activeAcceptedFrames.add(frame);
-    const task = this.acceptedFrames.run(frame, () => Promise.resolve().then(work));
-    this.globalReads.add(task);
-    try {
-      return await task;
-    } finally {
-      this.activeAcceptedFrames.delete(frame);
-      this.globalReads.delete(task);
-    }
+  guardEntity(entity) {
+    if (this.guardedEntities.has(entity)) return;
+    this.guardedEntities.add(entity);
+    this.wrap(entity, "attachSession", (original) => (id) => this.tracked(id, async () => {
+      const result = await original(id);
+      this.assert(id);
+      return result;
+    }));
   }
-  async drain(id) {
-    for (; ; ) {
-      const tasks = id === void 0 ? [...this.pending.values()].flatMap((set) => [...set]) : [...this.pending.get(id) ?? []];
-      tasks.push(...this.globalReads);
-      if (!tasks.length) return;
-      await Promise.allSettled(tasks);
-    }
+  guardedObservation(id, observation) {
+    this.increment(this.retained, id, 1);
+    let disposed = false;
+    return new Proxy(observation, { get: (target, property) => {
+      if (property === Symbol.dispose) return () => {
+        if (disposed) return;
+        disposed = true;
+        try {
+          target[Symbol.dispose]();
+        } finally {
+          this.increment(this.retained, id, -1);
+        }
+      };
+      if (property === "retain") return () => {
+        this.assert(id);
+        return this.guardedObservation(id, target.retain());
+      };
+      if (property === "events" || property === "projections") this.assert(id);
+      return Reflect.get(target, property, target);
+    } });
   }
-  async acquire(id, recovery = false) {
-    while (this.held.has(id)) await this.released.get(id).promise;
-    if (this.failed || this.closing || !this.ready || !recovery && this.retired.has(id)) {
-      throw new NativeAdmissionError("The session cannot enter another retirement scope.");
-    }
-    let resolve4;
-    const signal = { promise: new Promise((done2) => {
-      resolve4 = done2;
-    }), resolve: () => resolve4() };
-    this.held.add(id);
-    this.released.set(id, signal);
-    this.candidates.add(id);
-    const release = () => {
-      this.held.delete(id);
-      this.released.delete(id);
-      signal.resolve();
-    };
+  async install() {
+    if (this.installed) throw new Error("Native metadata adapter is already installed.");
+    this.assertInstances();
+    this.installed = true;
     try {
-      await this.drain(id);
-    } catch (error) {
-      release();
-      throw error;
-    }
-    let done = false;
-    return () => {
-      if (!done) {
-        done = true;
-        release();
+      for (const name2 of ["workspace", ...this.cache ? ["session_projcache"] : []]) {
+        const domain = this.ctx.storageDomain.get(name2);
+        if (!domain || domain.constructor.name !== "DomainImpl" || !methods(domain, ["emitChanged"])) {
+          throw new Error("Native metadata domain publication shape changed.");
+        }
+        this.wrap(domain, "emitChanged", (original) => (change) => this.admission.withoutBypass(() => original(change)));
+      }
+      for (const name2 of ["archiveSession", "unarchiveSession", "pinSession", "unpinSession"]) {
+        this.wrap(this.workspace, name2, (original) => (id, ...args) => this.tracked(
+          id,
+          () => this.queueTarget.run(id, async () => original(id, ...args))
+        ));
+      }
+      this.wrap(this.workspace, "enqueueOperation", (original) => (operation) => {
+        const id = this.queueTarget.getStore();
+        return original(async () => {
+          if (id !== void 0) this.assert(id);
+          return operation();
+        });
+      });
+      this.wrap(this.workspace, "setState", (original) => async (next) => {
+        const id = this.queueTarget.getStore();
+        if (id !== void 0) this.assert(id);
+        return original(next);
+      });
+      this.wrap(this.workspace, "indexHeader", (original) => (header) => this.tracked(header.id, async () => {
+        const result = await original(header);
+        this.assert(header.id);
+        return result;
+      }));
+      this.wrap(this.workspace, "readSessionHeader", (original) => (id) => this.tracked(id, async () => {
+        const result = await original(id);
+        this.assert(id);
+        return result;
+      }));
+      for (const entity of this.workspace.list()) this.guardEntity(entity);
+      for (const name2 of ["create", "initializeDefault"]) this.wrap(this.workspace, name2, (original) => async (...args) => {
+        const entity = await original(...args);
+        if (entity) this.guardEntity(entity);
+        return entity;
+      });
+      this.wrap(this.sessions, "prepare", (original) => (id, ...args) => {
+        if (id !== void 0) this.assert(id);
+        const session = original(id, ...args);
+        this.assert(session.id);
+        return session;
+      });
+      for (const name2 of ["enter", "announce"]) this.wrap(this.sessions, name2, (original) => (session) => {
+        this.assert(session.id);
+        return original(session);
+      });
+      if (this.cache) {
+        this.wrap(this.cache, "put", (original) => (id, ...args) => this.tracked(id, async () => original(id, ...args)));
+        for (const name2 of ["cachedSnapshot", "cachedPredecessorTitle", "coldSnapshot"]) this.wrap(
+          this.cache,
+          name2,
+          (original) => (header, ...args) => {
+            this.assert(header.id);
+            return original(header, ...args);
+          }
+        );
+        this.wrap(this.cache, "hydratePrepared", (original) => (session, ...args) => {
+          this.assert(session.id);
+          return original(session, ...args);
+        });
+      }
+      if (this.query) {
+        this.wrap(this.query, "_serialized", (original) => (signal, operation) => this.admission.trackGlobal(async () => original(signal, operation)));
+        this.wrap(this.query._observations, "read", (original) => (id, ...args) => this.tracked(id, async () => {
+          const observation = await original(id, ...args);
+          try {
+            this.assert(id);
+            return this.guardedObservation(id, observation);
+          } catch (error) {
+            observation[Symbol.dispose]();
+            throw error;
+          }
+        }));
+        this.wrap(this.query._observations, "store", (original) => (id, ...args) => {
+          this.assert(id);
+          return original(id, ...args);
+        });
+        for (const name2 of ["readSession", "readTitle", "readTitleSnapshot", "listEvents", "filterEvents", "readSurface", "traceSession"]) {
+          if (typeof this.query[name2] === "function") this.wrap(this.query, name2, (original) => (id, ...args) => this.tracked(id, async () => {
+            const result = await original(id, ...args);
+            this.assert(id);
+            return result;
+          }));
+        }
+        for (const name2 of ["searchEvents", "readEvent", "traceEvent"]) if (typeof this.query[name2] === "function") {
+          this.wrap(this.query, name2, (original) => (request, ...args) => this.tracked(
+            request.sessionId,
+            async () => {
+              const result = await original(request, ...args);
+              this.assert(request.sessionId);
+              return result;
+            }
+          ));
+        }
       }
-    };
-  }
-};
-
-// src/host/native-retirement-persistence.ts
-import { SessionId as SessionId2 } from "@deepseek-ai/dsh-session";
-function nativeServiceInstance(value) {
-  return Reflect.get(value, Symbol.for("cordis.original")) ?? value;
-}
-var NativePersistenceAdapter = class {
-  constructor(provider, admission) {
-    this.provider = provider;
-    this.admission = admission;
-    const raw = nativeServiceInstance(provider);
-    if (!(raw.tracker?.openHandles instanceof Set) || !(raw.tracker.writers instanceof Map) || !(raw.tracker.pending instanceof Map) || !(raw.migrationPreparations instanceof Map) || !(raw.coldLogMemo instanceof Map)) throw new Error("JSONL retirement runtime shape does not match the pinned provider.");
-    this.raw = raw;
-    this.originalStat = provider.stat.bind(provider);
-    this.originalList = provider.list.bind(provider);
-  }
-  raw;
-  originalStat;
-  originalList;
-  restore = [];
-  detached = false;
-  active = true;
-  managedHandles = /* @__PURE__ */ new WeakSet();
-  stat(id) {
-    return this.originalStat(SessionId2(id));
-  }
-  list() {
-    return this.originalList();
-  }
-  busy(id) {
-    return this.raw.tracker.pending.has(id) || this.raw.tracker.writers.has(id) || [...this.raw.tracker.openHandles].some((handle) => handle.id === id) || this.raw.migrationPreparations.size !== 0;
-  }
-  forget(id) {
-    if (this.busy(id)) throw new NativeAdmissionError("A persistence reference still owns this session.");
-    this.raw.coldLogMemo.delete(id);
-  }
-  install() {
-    this.originalStat = this.provider.stat.bind(this.provider);
-    this.originalList = this.provider.list.bind(this.provider);
-    const route = (target, name2, idFor, transform, globalRead = false) => {
-      target = nativeServiceInstance(target);
-      const record = target;
-      const original = record[name2];
-      if (typeof original !== "function") throw new Error(`Missing pinned JSONL route ${name2}.`);
-      const own = Object.getOwnPropertyDescriptor(target, name2);
-      const adapter2 = this;
-      const wrapper = function(...args) {
-        const receiver = this;
-        if (adapter2.detached) return Promise.reject(new NativeAdmissionError("This native guard belongs to a replaced retirement owner."));
-        const id = idFor(args);
-        if (!adapter2.active) {
-          if (adapter2.admission.isRetired(id)) return Promise.reject(new NativeAdmissionError("This session has a retirement tombstone."));
-          return Reflect.apply(original, receiver, args);
+      if (this.controller) {
+        const adapter = this;
+        for (const name2 of ["resumeObserved", "claim", "createAgent"]) {
+          this.wrap(this.controller.agents, name2, (original) => (id, ...args) => this.tracked(id, () => this.activationTarget.run(id, async () => original(id, ...args))));
         }
-        const run = () => adapter2.admission.track(id, async () => {
-          const value = await Reflect.apply(original, receiver, args);
-          return transform ? transform(value) : value;
+        const agents = this.agents;
+        for (const name2 of ["create", "resume"]) {
+          this.wrap(agents, name2, (original) => (options, ...args) => {
+            const id = String(name2 === "create" ? options.sessionId : options.resumeSessionId);
+            return this.tracked(id, async () => {
+              const handle = await original(options, ...args);
+              if (this.activationTarget.getStore() === id && options.parentAgent === void 0 && handle.agent.id === id && handle.agent.session.header.origin !== "subagent" && typeof handle.dispose === "function") this.apiHandles.set(id, handle);
+              return handle;
+            });
+          });
+        }
+        this.restores.push(this.ctx.on("agent/disposed", ({ agent }) => {
+          if (this.apiHandles.get(agent.id)?.agent === agent) this.apiHandles.delete(agent.id);
+        }, { global: true }));
+        this.wrap(this.controller.history, "follow", (original) => function(request, signal) {
+          const id = String(request.address.sessionId);
+          adapter.assert(id);
+          return (async function* () {
+            adapter.assert(id);
+            adapter.increment(adapter.followers, id, 1);
+            const cancellation = new AbortController();
+            const iterator = original(request, AbortSignal.any([signal, cancellation.signal]));
+            const stops = adapter.followerStops.get(id) ?? /* @__PURE__ */ new Set();
+            adapter.followerStops.set(id, stops);
+            let finished = false;
+            const finish = () => {
+              if (finished) return;
+              finished = true;
+              adapter.increment(adapter.followers, id, -1);
+              stops.delete(stop);
+              if (!stops.size) adapter.followerStops.delete(id);
+            };
+            const stop = async () => {
+              cancellation.abort();
+              await iterator.return();
+              finish();
+            };
+            stops.add(stop);
+            try {
+              for await (const frame of iterator) {
+                adapter.assert(id);
+                yield frame;
+              }
+            } finally {
+              finish();
+            }
+          })();
         });
-        return globalRead ? adapter2.admission.trackGlobal(run) : run();
-      };
-      Object.defineProperty(target, name2, { configurable: true, writable: true, value: wrapper });
-      this.restore.push(() => {
-        if (record[name2] !== wrapper) throw new Error(`JSONL route ${name2} changed while retirement was installed.`);
-        if (own) Object.defineProperty(target, name2, own);
-        else delete record[name2];
-      });
-    };
-    const headerId = (args) => String(args[0].id);
-    route(this.provider, "create", headerId, (value) => this.manage(value));
-    route(this.provider, "open", (args) => String(args[0]), (value) => this.manage(value), true);
-    for (const method of ["persistBatch", "persistHeader", "truncateTornTail", "acquireWriteLease"]) {
-      route(this.provider, method, headerId);
+      }
+    } catch (error) {
+      for (const restore of [...this.restores].reverse()) restore();
+      this.restores.length = 0;
+      this.installed = false;
+      throw error;
     }
-    route(this.provider, "readStoredLog", (args) => String(args[1]), void 0, true);
-    route(this.provider, "resolveCurrentLog", (args) => String(args[0]));
-    const instance = nativeServiceInstance(this.provider);
-    const rawStat = instance.stat;
-    const rawList = instance.list;
-    const adapter = this;
-    instance.stat = async function(id, options) {
-      if (adapter.detached) throw new NativeAdmissionError("This native observer belongs to a replaced retirement owner.");
-      if (adapter.admission.isRetired(id)) return void 0;
-      const value = await adapter.admission.trackGlobal(() => adapter.admission.track(id, () => rawStat.call(this, id, options)));
-      return adapter.admission.isRetired(id) ? void 0 : value;
-    };
-    instance.list = async function(options) {
-      if (adapter.detached) throw new NativeAdmissionError("This native observer belongs to a replaced retirement owner.");
-      return (await adapter.admission.trackGlobal(() => rawList.call(this, options))).filter((item) => !adapter.admission.isRetired(item.header.id));
-    };
-    this.restore.push(() => {
-      instance.stat = rawStat;
-      instance.list = rawList;
-    });
-    return async () => {
-      await this.admission.drain();
-      this.active = false;
-      if (this.originalRetired()) return;
-      for (const undo of [...this.restore].reverse()) undo();
-      this.restore.length = 0;
-    };
+    let closing;
+    return () => closing ??= (async () => {
+      this.fallbackRetired = new Set([...this.targets].filter((id) => this.admission.isRetired(id)));
+      this.disposed = true;
+      this.apiHandles.clear();
+      if (this.fallbackRetired.size === 0) {
+        for (const restore of [...this.restores].reverse()) restore();
+        this.restores.length = 0;
+      }
+    })();
   }
+  /** The verified owner completes all asynchronous takeover work before this
+   * synchronous restoration and installs its successor guards without yielding. */
   forceRestore() {
+    if (this.restores.length && this.guardedMethods.some(({ port, name: name2, replacement }) => port[name2] !== replacement)) {
+      throw new Error("Native metadata guards changed before trusted takeover.");
+    }
     this.detached = true;
-    this.active = false;
-    for (const undo of [...this.restore].reverse()) undo();
-    this.restore.length = 0;
-  }
-  originalRetired() {
-    return this.admission.hasTombstones();
+    this.disposed = true;
+    for (const restore of [...this.restores].reverse()) restore();
+    this.restores.length = 0;
+    this.guardedMethods.length = 0;
+    this.fallbackRetired.clear();
+    this.apiHandles.clear();
   }
-  manage(handle) {
-    if (this.managedHandles.has(handle)) return handle;
-    this.managedHandles.add(handle);
-    const methods2 = ["read", "append", "flush"];
-    for (const name2 of methods2) {
-      const original = handle[name2];
-      Object.defineProperty(handle, name2, {
-        configurable: true,
-        writable: true,
-        value: (...args) => !this.active && !this.admission.isRetired(handle.id) ? Reflect.apply(original, handle, args) : this.admission.track(handle.id, async () => Reflect.apply(original, handle, args))
-      });
+  async converge(input, expected, request) {
+    const snapshot = nativeMetadataSnapshotSchema.parse(input);
+    const id = snapshot.sessionId;
+    this.targets.add(id);
+    this.assertInstances();
+    if (snapshot.queryProvider !== this.queryProvider || snapshot.queryPath !== (this.queryConfiguration?.path ?? null)) return false;
+    if (id !== expected.sessionId || id !== request.expected.sessionId || expected.storeId !== request.expected.storeId || expected.lifecycleId !== request.expected.lifecycleId || !this.admission.isRetired(id)) {
+      this.refuse("native/maintenance-binding-changed", "Native convergence requires the exact durable retirement binding.");
     }
-    return handle;
+    if ((this.operations.get(id) ?? 0) > 0 || (this.retained.get(id) ?? 0) > 0 || (this.followers.get(id) ?? 0) > 0) return false;
+    this.assertCold(id);
+    return this.admission.bypass(id, async () => {
+      if (!await this.eraseCache(snapshot.cache, id, expected, request)) return false;
+      this.query?._observations.cache.delete(id);
+      const frozenIds = new Set(snapshot.workspaces.map((item) => item.workspaceId));
+      const convergeWorkspace = async () => {
+        for (const [workspaceId, raw] of this.workspace.requireTable().entries()) {
+          const record = workspaceRecord.parse(raw);
+          if (!record.sessionIds.some((sessionId) => sessionId === id)) continue;
+          if (!frozenIds.has(workspaceId) || record.sessionIds.some((other) => other !== id && this.workspace.sessionPaths.get(other) !== record.path && !this.workspace.missingSessionPaths.has(other))) return false;
+          const entity = this.workspace.get(workspaceId);
+          if (!entity) throw new Error("Native Workspace account lost its runtime entity.");
+          await entity.detachSession(id);
+        }
+        const state = workspaceDomainState2.parse(this.workspace.requireState());
+        if (state.archivedSessionIds.includes(id) || state.pinnedSessionIds.includes(id)) {
+          await this.workspace.setState({
+            ...state,
+            archivedSessionIds: state.archivedSessionIds.filter((other) => other !== id),
+            pinnedSessionIds: state.pinnedSessionIds.filter((other) => other !== id)
+          });
+        }
+        this.workspace.headers.delete(id);
+        this.workspace.sessionPaths.delete(id);
+        this.workspace.invalidSessionPaths.delete(id);
+        this.workspace.missingSessionPaths.delete(id);
+        return true;
+      };
+      if (!await this.workspace.enqueueOperation(convergeWorkspace)) return false;
+      if (this.query) {
+        if (this.queryProvider === "sqlite-0.2.0-rc.2") {
+          await this.query.searchSessions({ query: "native-retirement-reconciliation", limit: 1 });
+        }
+        if ((await this.query.listSessions()).some((record) => record.header.id === id)) return false;
+        this.assertInstances();
+      }
+      this.admission.withoutBypass(() => this.ctx.emit("api-session/removed", id));
+      return true;
+    });
   }
 };
 
@@ -4059,7 +4134,7 @@ var NativeRetirementOwner = class _NativeRetirementOwner {
     this.descriptor = retirementCapabilitiesSchema.parse({
       protocolVersion: 1,
       ownerId: "session-bin-native-jsonl-owner",
-      hostVersion: "0.2.0-rc.2",
+      hostVersion: legacyDurableHostContract,
       providerId: "jsonl-session-records-v1",
       storeId: domain.global.get().storeId,
       participants: [{ id: "native-jsonl-files", version: fingerprint }, { id: "native-metadata", version: fingerprint }]