@try-works/dsh-memory 0.1.19 → 0.1.21

package/cordis.patch.yml

@@ -1,69 +1,69 @@
-# dsh-memory bundle patch — the patch layer this package exports.
-#
-# Declared by `dsh.bundle.patch` in package.json. When the package is added to a profile, dsh
-# reconciles it into `dsh.profile.bundles` and composes this layer over the profile, so the
-# plugin mounts from the installed package rather than by absolute path.
-#
-# This layer does two things: it mounts dsh-memory, and it switches on the session history
-# search that a memory plugin is useless without. Both are described where they appear.
-#
-# Patch semantics, which the rest of this file depends on: a patch REPLACES the targeted row's
-# whole `config`, it does not merge into it. Every override below therefore restates EVERY key
-# it owns, or the omitted ones silently become undefined.
-- insert:
-    # dsh-memory itself.
-    #
-    # A single row naming the published package mounts the plugin on the profile root. The row id
-# stays dsh-memory, which is what the PROFILE patch addresses for config. It publishes the `memory`
-    # service, registers the memory_* tools into the host-owned tools registry, and keeps its
-    # browser half module-scoped — so, like the other memory-like plugins, it needs no `isolate`
-    # realm.
-    #
-    # The row carries NO config: the store root, the memory model and the git origin are set on
-    # Settings -> Memory, which writes a top-level `config:` row for this id into the PROFILE
-    # patch. That is why the mounted row must be addressable by id — the config editor finds a
-    # row by id at the top level, so a profile that configures memory ends up with both this
-    # insert and a sibling `- id: dsh-memory` config row after it.
-    - id: dsh-memory
-      # A scoped name MUST be quoted: YAML treats a leading @ as a reserved indicator.
-      name: '@try-works/dsh-memory'
-
-    # NOTE: the model-facing session history TOOLS are deliberately NOT mounted here.
-    #
-    # Not because they are unwanted, but because this is the wrong plane. A Web profile
-    # disables every base tool row and hands the tool plane to PRESETS, and its gate reads
-    # declared row ids WITHOUT regard to `disabled` — the web-app bundle keeps `tool-ralph`
-    # declared-but-disabled purely to hold it off the host plane and out of collision with
-    # every preset's rows. Inserting a live tool row here would put it on the host plane and
-    # in collision with that arrangement, which is a large side effect for a memory plugin to
-    # have on somebody else's tool surface. Enabling the index below is a config override, the
-    # kind the web-app bundle explicitly invites; owning a tool row is not.
-
-# ---------------------------------------------------------------------------------------------
-# Session search: switched on by installing this plugin.
-# ---------------------------------------------------------------------------------------------
-#
-# The base bundle mounts `session-query-sqlite` with `openAt: never`, and the web-app bundle
-# restates that. It is deliberate: ctx.sessionQuery stays available for exact reads and lineage
-# while SEARCH calls fail with SESSION_QUERY_SEARCH_DISABLED, so no deployment indexes gigabytes
-# of session logs without asking. The cost of that default is a system that cannot look back at
-# what happened — and memory that cannot be searched is half a memory. Installing a memory plugin
-# is the request that flag was waiting for, so this layer asks. The web-app bundle says so in as
-# many words: 'a deployment enabling content search overrides openAt to first-search in a later
-# patch layer'. This is that layer.
-#
-# `first-search` rather than `startup`: nothing is indexed until a search is actually made, so
-# the capability is present from install while the work still happens lazily, on a query.
-#
-# `path` is restated even though both bundles already set one, because a patch replaces the
-# whole config rather than merging: omitting it would drop the index to undefined and rebuild
-# it in memory on every process. A durable file under storages/ is what makes a several-gigabyte
-# corpus worth indexing once.
-#
-# Precedence is why this is safe to set here. Bundle layers compose FIRST and the profile's own
-# cordis.patch.yml applies AFTER, so a profile wanting `startup`, a different path, or `never`
-# simply says so there and wins. This layer supplies a default, not a mandate.
-- id: session-query-sqlite
-  config:
-    path: !!js dshHomePath('storages', 'session-search.sqlite')
-    openAt: first-search
+# dsh-memory bundle patch — the patch layer this package exports.
+#
+# Declared by `dsh.bundle.patch` in package.json. When the package is added to a profile, dsh
+# reconciles it into `dsh.profile.bundles` and composes this layer over the profile, so the
+# plugin mounts from the installed package rather than by absolute path.
+#
+# This layer does two things: it mounts dsh-memory, and it switches on the session history
+# search that a memory plugin is useless without. Both are described where they appear.
+#
+# Patch semantics, which the rest of this file depends on: a patch REPLACES the targeted row's
+# whole `config`, it does not merge into it. Every override below therefore restates EVERY key
+# it owns, or the omitted ones silently become undefined.
+- insert:
+    # dsh-memory itself.
+    #
+    # A single row naming the published package mounts the plugin on the profile root. The row id
+# stays dsh-memory, which is what the PROFILE patch addresses for config. It publishes the `memory`
+    # service, registers the memory_* tools into the host-owned tools registry, and keeps its
+    # browser half module-scoped — so, like the other memory-like plugins, it needs no `isolate`
+    # realm.
+    #
+    # The row carries NO config: the store root, the memory model and the git origin are set on
+    # Settings -> Memory, which writes a top-level `config:` row for this id into the PROFILE
+    # patch. That is why the mounted row must be addressable by id — the config editor finds a
+    # row by id at the top level, so a profile that configures memory ends up with both this
+    # insert and a sibling `- id: dsh-memory` config row after it.
+    - id: dsh-memory
+      # A scoped name MUST be quoted: YAML treats a leading @ as a reserved indicator.
+      name: '@try-works/dsh-memory'
+
+    # NOTE: the model-facing session history TOOLS are deliberately NOT mounted here.
+    #
+    # Not because they are unwanted, but because this is the wrong plane. A Web profile
+    # disables every base tool row and hands the tool plane to PRESETS, and its gate reads
+    # declared row ids WITHOUT regard to `disabled` — the web-app bundle keeps `tool-ralph`
+    # declared-but-disabled purely to hold it off the host plane and out of collision with
+    # every preset's rows. Inserting a live tool row here would put it on the host plane and
+    # in collision with that arrangement, which is a large side effect for a memory plugin to
+    # have on somebody else's tool surface. Enabling the index below is a config override, the
+    # kind the web-app bundle explicitly invites; owning a tool row is not.
+
+# ---------------------------------------------------------------------------------------------
+# Session search: switched on by installing this plugin.
+# ---------------------------------------------------------------------------------------------
+#
+# The base bundle mounts `session-query-sqlite` with `openAt: never`, and the web-app bundle
+# restates that. It is deliberate: ctx.sessionQuery stays available for exact reads and lineage
+# while SEARCH calls fail with SESSION_QUERY_SEARCH_DISABLED, so no deployment indexes gigabytes
+# of session logs without asking. The cost of that default is a system that cannot look back at
+# what happened — and memory that cannot be searched is half a memory. Installing a memory plugin
+# is the request that flag was waiting for, so this layer asks. The web-app bundle says so in as
+# many words: 'a deployment enabling content search overrides openAt to first-search in a later
+# patch layer'. This is that layer.
+#
+# `first-search` rather than `startup`: nothing is indexed until a search is actually made, so
+# the capability is present from install while the work still happens lazily, on a query.
+#
+# `path` is restated even though both bundles already set one, because a patch replaces the
+# whole config rather than merging: omitting it would drop the index to undefined and rebuild
+# it in memory on every process. A durable file under storages/ is what makes a several-gigabyte
+# corpus worth indexing once.
+#
+# Precedence is why this is safe to set here. Bundle layers compose FIRST and the profile's own
+# cordis.patch.yml applies AFTER, so a profile wanting `startup`, a different path, or `never`
+# simply says so there and wins. This layer supplies a default, not a mandate.
+- id: session-query-sqlite
+  config:
+    path: !!js dshHomePath('storages', 'session-search.sqlite')
+    openAt: first-search

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@try-works/dsh-memory",
-  "version": "0.1.19",
+  "version": "0.1.21",
   "description": "Git-backed, workspace-scoped memory for the DeepSeek Harness (global layer + per-workspace layers)",
   "type": "module",
   "main": "src/index.js",

package/scripts/check-package.mjs

@@ -1,76 +1,76 @@
-// Package invariants for dsh-memory. Run with: node scripts/check-package.mjs
-//
-// A plugin that is installed by name must declare everything the loader needs; when one of these
-// drifts the failure appears at MOUNT time in someone else's profile, which is the worst place to
-// discover it. This is a fast pre-flight, and test/package.test.js asserts the same invariants.
-import { readFileSync, existsSync } from 'node:fs'
-import { dirname, join } from 'node:path'
-import { fileURLToPath } from 'node:url'
-
-const root = join(dirname(fileURLToPath(import.meta.url)), '..')
-const problems = []
-const note = (ok, message) => { if (!ok) problems.push(message) }
-
-const manifest = JSON.parse(readFileSync(join(root, 'package.json'), 'utf8'))
-
-note(manifest.name === '@try-works/dsh-memory', 'package name must be "@try-works/dsh-memory", found ' + manifest.name)
-note(manifest.type === 'module', 'package must be ESM ("type": "module")')
-note(typeof manifest.main === 'string', 'package must declare "main"')
-note(existsSync(join(root, manifest.main)), 'main does not exist: ' + manifest.main)
-
-// The loader must be able to import the entry.
-const entry = await import(new URL('../' + manifest.main, import.meta.url))
-note(typeof entry.name === 'string' && entry.name === 'dsh-memory', 'entry must export name = "dsh-memory"')
-note(Array.isArray(entry.inject), 'entry must export inject')
-note(typeof entry.apply === 'function', 'entry must export apply')
-note(entry.Config !== undefined, 'entry must export Config')
-note(entry.default === undefined, 'entry must NOT export default (the loader does exports.default ?? exports, which would discard name/inject/Config)')
-
-// Bundle patch: what makes an install-by-name mount the plugin.
-const patchPath = manifest.dsh?.bundle?.patch
-note(typeof patchPath === 'string', 'dsh.bundle.patch must be declared for install-by-name')
-if (typeof patchPath === 'string') {
-  const full = join(root, patchPath.replace(/^\.\//, ''))
-  note(existsSync(full), 'bundle patch does not exist: ' + patchPath)
-  if (existsSync(full)) {
-    const text = readFileSync(full, 'utf8')
-    note(text.includes('id: dsh-memory'), 'bundle patch must insert an entry with id: dsh-memory')
-    note(text.includes("name: '@try-works/dsh-memory'"), 'bundle patch must mount the package by its published name')
-  }
-  note((manifest.files ?? []).some((f) => f.includes('cordis.patch.yml')), 'files[] must ship the bundle patch')
-}
-
-// Client half.
-const client = manifest.dsh?.client
-note(client !== undefined, 'dsh.client must be declared for the Settings page')
-if (client) {
-  note(client.platform === 'web', 'dsh.client.platform must be "web"')
-  const clientExport = manifest.exports?.['./client']
-  const target = typeof clientExport === 'string' ? clientExport : clientExport?.default
-  note(typeof target === 'string', 'exports["./client"] must resolve to a file')
-  if (typeof target === 'string') note(existsSync(join(root, target)), 'client half missing: ' + target)
-}
-
-// Everything the entry imports at load time must ship.
-note((manifest.files ?? []).includes('src'), 'files[] must ship src/')
-// The system document template is read at runtime from beside its module.
-note(existsSync(join(root, 'src', 'SYSTEM.template.md')), 'src/SYSTEM.template.md must exist (rendered into every store)')
-
-// Peers: a missing declaration means an unresolvable import in a clean profile.
-for (const peer of ['@deepseek-ai/cordis', '@deepseek-ai/dsh-tools', '@deepseek-ai/dsh-llm']) {
-  note(Object.hasOwn(manifest.peerDependencies ?? {}, peer), 'peerDependencies must declare ' + peer)
-}
-// schemastery is the exception, and it is deliberate: .volatile() exists only from 3.18.4, and a
-// PEER lets the profile supply 3.18.1, which throws at module load. As a dependency the version
-// is ours to pin. Declaring it as a peer is what broke the first registry install.
-note(!Object.hasOwn(manifest.peerDependencies ?? {}, '@deepseek-ai/schemastery'), 'schemastery must NOT be a peer dependency')
-note(/^\^3\.18\.[4-9]/.test((manifest.dependencies ?? {})['@deepseek-ai/schemastery'] ?? ''), 'schemastery must be a dependency pinned at 3.18.4 or newer, for .volatile()')
-{
-}
-
-if (problems.length > 0) {
-  console.error('dsh-memory package check FAILED:')
-  for (const problem of problems) console.error('  - ' + problem)
-  process.exit(1)
-}
-console.log('dsh-memory package check OK (' + manifest.name + '@' + manifest.version + ')')
+// Package invariants for dsh-memory. Run with: node scripts/check-package.mjs
+//
+// A plugin that is installed by name must declare everything the loader needs; when one of these
+// drifts the failure appears at MOUNT time in someone else's profile, which is the worst place to
+// discover it. This is a fast pre-flight, and test/package.test.js asserts the same invariants.
+import { readFileSync, existsSync } from 'node:fs'
+import { dirname, join } from 'node:path'
+import { fileURLToPath } from 'node:url'
+
+const root = join(dirname(fileURLToPath(import.meta.url)), '..')
+const problems = []
+const note = (ok, message) => { if (!ok) problems.push(message) }
+
+const manifest = JSON.parse(readFileSync(join(root, 'package.json'), 'utf8'))
+
+note(manifest.name === '@try-works/dsh-memory', 'package name must be "@try-works/dsh-memory", found ' + manifest.name)
+note(manifest.type === 'module', 'package must be ESM ("type": "module")')
+note(typeof manifest.main === 'string', 'package must declare "main"')
+note(existsSync(join(root, manifest.main)), 'main does not exist: ' + manifest.main)
+
+// The loader must be able to import the entry.
+const entry = await import(new URL('../' + manifest.main, import.meta.url))
+note(typeof entry.name === 'string' && entry.name === 'dsh-memory', 'entry must export name = "dsh-memory"')
+note(Array.isArray(entry.inject), 'entry must export inject')
+note(typeof entry.apply === 'function', 'entry must export apply')
+note(entry.Config !== undefined, 'entry must export Config')
+note(entry.default === undefined, 'entry must NOT export default (the loader does exports.default ?? exports, which would discard name/inject/Config)')
+
+// Bundle patch: what makes an install-by-name mount the plugin.
+const patchPath = manifest.dsh?.bundle?.patch
+note(typeof patchPath === 'string', 'dsh.bundle.patch must be declared for install-by-name')
+if (typeof patchPath === 'string') {
+  const full = join(root, patchPath.replace(/^\.\//, ''))
+  note(existsSync(full), 'bundle patch does not exist: ' + patchPath)
+  if (existsSync(full)) {
+    const text = readFileSync(full, 'utf8')
+    note(text.includes('id: dsh-memory'), 'bundle patch must insert an entry with id: dsh-memory')
+    note(text.includes("name: '@try-works/dsh-memory'"), 'bundle patch must mount the package by its published name')
+  }
+  note((manifest.files ?? []).some((f) => f.includes('cordis.patch.yml')), 'files[] must ship the bundle patch')
+}
+
+// Client half.
+const client = manifest.dsh?.client
+note(client !== undefined, 'dsh.client must be declared for the Settings page')
+if (client) {
+  note(client.platform === 'web', 'dsh.client.platform must be "web"')
+  const clientExport = manifest.exports?.['./client']
+  const target = typeof clientExport === 'string' ? clientExport : clientExport?.default
+  note(typeof target === 'string', 'exports["./client"] must resolve to a file')
+  if (typeof target === 'string') note(existsSync(join(root, target)), 'client half missing: ' + target)
+}
+
+// Everything the entry imports at load time must ship.
+note((manifest.files ?? []).includes('src'), 'files[] must ship src/')
+// The system document template is read at runtime from beside its module.
+note(existsSync(join(root, 'src', 'SYSTEM.template.md')), 'src/SYSTEM.template.md must exist (rendered into every store)')
+
+// Peers: a missing declaration means an unresolvable import in a clean profile.
+for (const peer of ['@deepseek-ai/cordis', '@deepseek-ai/dsh-tools', '@deepseek-ai/dsh-llm']) {
+  note(Object.hasOwn(manifest.peerDependencies ?? {}, peer), 'peerDependencies must declare ' + peer)
+}
+// schemastery is the exception, and it is deliberate: .volatile() exists only from 3.18.4, and a
+// PEER lets the profile supply 3.18.1, which throws at module load. As a dependency the version
+// is ours to pin. Declaring it as a peer is what broke the first registry install.
+note(!Object.hasOwn(manifest.peerDependencies ?? {}, '@deepseek-ai/schemastery'), 'schemastery must NOT be a peer dependency')
+note(/^\^3\.18\.[4-9]/.test((manifest.dependencies ?? {})['@deepseek-ai/schemastery'] ?? ''), 'schemastery must be a dependency pinned at 3.18.4 or newer, for .volatile()')
+{
+}
+
+if (problems.length > 0) {
+  console.error('dsh-memory package check FAILED:')
+  for (const problem of problems) console.error('  - ' + problem)
+  process.exit(1)
+}
+console.log('dsh-memory package check OK (' + manifest.name + '@' + manifest.version + ')')

package/scripts/inspect-log.ts

@@ -0,0 +1,40 @@
+/* eslint-disable no-console */
+// One-shot diagnostic: decompress a session.v4.jsonl.zstd artifact with the
+// harness's own frame primitives and report memory/map rows and their envelope.
+import { readFileSync } from 'node:fs'
+import { scanZstdFrames, decompressZstdFrame } from 'file:///D:/deepseek-harness/packages/session/session-persistence-jsonl/src/zstd.ts'
+
+const file = process.argv[2]
+if (!file) throw new Error('usage: inspect-log.ts <session.v4.jsonl.zstd>')
+
+const buf = readFileSync(file)
+const scan = scanZstdFrames(buf)
+const lines: string[] = []
+for (const frame of scan.frames) {
+  const plain = await decompressZstdFrame(buf.subarray(frame.start, frame.end))
+  lines.push(...plain.toString('utf8').split('\n').filter((l) => l.trim() !== ''))
+}
+console.log(`frames=${scan.frames.length} torn=${scan.tornStart ?? '-'} rows=${lines.length}`)
+if (scan.tornStart !== undefined) console.log(`tornStart=${scan.tornStart}`)
+
+const header = lines[0]
+console.log(`header: ${header?.slice(0, 300) ?? '(none)'}`)
+
+const hits = lines.filter((l) => l.startsWith('{"type":"memory/map"'))
+console.log(`\nmemory/map EVENT rows: ${hits.length}`)
+for (const h of hits) {
+  let env: { seq?: number; time?: number; ignorable?: unknown } = {}
+  try { env = JSON.parse(h) } catch { /* not json */ }
+  console.log(`seq=${env.seq} time=${env.time} ignorable=${JSON.stringify(env.ignorable)} keys=${Object.keys(env).join(',')}`)
+}
+
+const unmarked = hits.filter((l) => !l.includes('"ignorable":true'))
+console.log(`\nUNMARKED memory/map events: ${unmarked.length}`)
+for (const h of unmarked.slice(0, 10)) console.log(h.slice(0, 300))
+
+console.log('\nlast 4 rows:')
+for (const l of lines.slice(-4)) {
+  let env: { type?: string; seq?: number; time?: number } = {}
+  try { env = JSON.parse(l) } catch { /* not json */ }
+  console.log(`type=${env.type} seq=${env.seq} time=${env.time}`)
+}

package/scripts/repair-ignorable.ts

@@ -0,0 +1,130 @@
+/* eslint-disable no-console */
+// One-shot repair for the dsh-memory "unknown event type" incident.
+//
+// Plugin <=0.1.19 appended `{"type":"memory/map",...}` events WITHOUT the
+// `ignorable: true` envelope marker. The harness's fail-closed storage contract
+// (session-persistence/src/storage-contract.ts) refuses such logs on every
+// load: "unknown to this harness and not marked ignorable". This rewrites each
+// poisoned log with the marker inserted into the memory/map rows, preserving
+// every other byte, the header-only first frame, frame checksums and seq
+// contiguity, then verifies the result through the harness's own validator.
+//
+// Idempotent: files with zero unmarked memory/map events are left untouched.
+// Usage: node --import tsx/esm scripts/repair-ignorable.ts [session-dir ...]
+//        (no args = scan the default sessions root and repair every broken log)
+import { copyFileSync, existsSync, readdirSync, readFileSync, renameSync, statSync, writeFileSync } from 'node:fs'
+import { join, basename } from 'node:path'
+import { scanZstdFrames, decompressZstdFrame, decompressZstdPrefix, compressZstdFrame } from 'file:///D:/deepseek-harness/packages/session/session-persistence-jsonl/src/zstd.ts'
+import { validateStoredEvents } from 'file:///D:/deepseek-harness/packages/session/session-persistence/src/storage-contract.ts'
+
+const ROOT = 'C:/Users/erikb/.dsh/sessions'
+const CUT_MS = Date.parse('2026-10-09T20:53:00Z')
+
+/** Insert the marker into one memory/map row, preserving every other byte of the line. */
+function markLine(line) {
+  if (!line.startsWith('{"type":"memory/map"') || line.includes('"ignorable":true')) return { line, marked: false }
+  const edited = line.replace(/^(\{"type":"memory\/map","seq":\d+,"time":\d+,)/, '$1"ignorable":true,')
+  if (edited === line) throw new Error(`memory/map row did not match the envelope pattern: ${line.slice(0, 80)}`)
+  return { line: edited, marked: true }
+}
+
+function markText(text) {
+  let marked = 0
+  const out = text.split('\n').map((line) => {
+    const r = markLine(line)
+    if (r.marked) marked += 1
+    return r.line
+  }).join('\n')
+  return { text: out, marked }
+}
+
+/** Repair one file in place; returns a report or throws. */
+async function repairFile(file) {
+  const buf = readFileSync(file)
+  const scan = scanZstdFrames(buf)
+  const frames = []
+  for (const frame of scan.frames) {
+    const plain = await decompressZstdFrame(buf.subarray(frame.start, frame.end))
+    frames.push(plain.toString('utf8'))
+  }
+  if (scan.tornStart !== undefined) {
+    const prefix = await decompressZstdPrefix(buf.subarray(scan.tornStart))
+    frames.push(prefix.toString('utf8'))
+  }
+  let marked = 0
+  const edited = []
+  for (const text of frames) {
+    const r = markText(text)
+    marked += r.marked
+    edited.push(r.text)
+  }
+  if (marked === 0) return { file, repaired: false, reason: 'no unmarked memory/map events' }
+
+  // Compress each frame back as its own checksummed frame: frame 1 stays the
+  // header-only frame, batch boundaries are preserved, and a recovered torn
+  // prefix becomes a complete final frame.
+  const parts = []
+  for (const text of edited) parts.push(await compressZstdFrame(Buffer.from(text, 'utf8')))
+  const out = Buffer.concat(parts)
+
+  const backup = `${file}.bak-pre-ignorable`
+  if (!existsSync(backup)) copyFileSync(file, backup)
+  const tmp = `${file}.repair.tmp`
+  writeFileSync(tmp, out)
+  renameSync(tmp, file)
+  return { file, repaired: true, marked }
+}
+
+/** Verify a file the way the gateway will read it: frames decode, frame 1 is
+ *  header-only, every row parses, seq is contiguous, and the storage contract
+ *  (the exact validator that refused these logs) accepts every event. */
+async function verifyFile(file) {
+  const buf = readFileSync(file)
+  const scan = scanZstdFrames(buf)
+  if (scan.frames.length === 0) throw new Error('no frames')
+  const header = (await decompressZstdFrame(buf.subarray(scan.frames[0].start, scan.frames[0].end))).toString('utf8')
+  if (header.indexOf('\n') !== header.length - 1) throw new Error('first frame is not exactly one header line')
+  const lines = [header.trimEnd()]
+  for (const frame of scan.frames.slice(1)) {
+    lines.push(...(await decompressZstdFrame(buf.subarray(frame.start, frame.end))).toString('utf8').split('\n').filter((l) => l.trim() !== ''))
+  }
+  if (scan.tornStart !== undefined) {
+    lines.push(...(await decompressZstdPrefix(buf.subarray(scan.tornStart))).toString('utf8').split('\n').filter((l) => l.trim() !== ''))
+  }
+  const rows = lines.map((l) => JSON.parse(l))
+  const meta = rows[0]
+  const events = rows.slice(1)
+  // Relative contiguity: a fork inherits a prefix, so the log may start at a nonzero seq.
+  for (let i = 1; i < events.length; i += 1) {
+    if (events[i].seq !== events[0].seq + i) throw new Error(`seq gap at index ${i}: ${events[i].seq}`)
+  }
+  const unmarked = events.filter((e) => e.type === 'memory/map' && e.ignorable !== true)
+  if (unmarked.length > 0) throw new Error(`${unmarked.length} memory/map events still unmarked`)
+  validateStoredEvents(meta, events, { kind: 'jsonl', path: file })
+  return { rows: rows.length, events: events.length, memoryMaps: events.filter((e) => e.type === 'memory/map').length }
+}
+
+function collectFiles() {
+  const dirs = process.argv.slice(2).filter((a) => !a.startsWith('-'))
+  if (dirs.length > 0) return dirs.map((d) => join(d, 'session.v4.jsonl.zstd'))
+  const out = []
+  const walk = (dir) => {
+    for (const e of readdirSync(dir, { withFileTypes: true })) {
+      const p = join(dir, e.name)
+      if (e.isDirectory()) walk(p)
+      else if (e.name.endsWith('.zstd') && !e.name.includes('.bak') && statSync(p).mtimeMs >= CUT_MS) out.push(p)
+    }
+  }
+  walk(ROOT)
+  return out
+}
+
+let repaired = 0
+for (const file of collectFiles()) {
+  const r = await repairFile(file)
+  if (!r.repaired) continue
+  repaired += 1
+  const v = await verifyFile(file)
+  console.log(`repaired ${basename(file)}: marked ${r.marked} events; verified ${v.events} events, ${v.memoryMaps} memory/map rows, storage contract OK`)
+}
+console.log(`\nrepaired ${repaired} file(s); backups kept as <file>.bak-pre-ignorable`)

package/scripts/scan-sessions.ts

@@ -0,0 +1,43 @@
+/* eslint-disable no-console */
+// One-shot diagnostic: scan every session log modified since the first
+// memory/map publish and report unmarked memory/map events per file.
+import { readdirSync, readFileSync, statSync } from 'node:fs'
+import { join, basename } from 'node:path'
+import { scanZstdFrames, decompressZstdFrame, decompressZstdPrefix } from 'file:///D:/deepseek-harness/packages/session/session-persistence-jsonl/src/zstd.ts'
+
+const root = process.argv[2] ?? 'C:/Users/erikb/.dsh/sessions'
+const cut = Date.parse(process.argv[3] ?? '2026-10-09T20:53:00Z')
+
+function walk(dir: string): string[] {
+  const out: string[] = []
+  for (const e of readdirSync(dir, { withFileTypes: true })) {
+    const p = join(dir, e.name)
+    if (e.isDirectory()) out.push(...walk(p))
+    else if (e.name.endsWith('.zstd') && !e.name.includes('.bak') && statSync(p).mtimeMs >= cut) out.push(p)
+  }
+  return out
+}
+
+let scanned = 0
+for (const file of walk(root)) {
+  scanned += 1
+  let text = ''
+  try {
+    const buf = readFileSync(file)
+    const scan = scanZstdFrames(buf)
+    for (const f of scan.frames) text += (await decompressZstdFrame(buf.subarray(f.start, f.end))).toString('utf8')
+    if (scan.tornStart !== undefined) text += (await decompressZstdPrefix(buf.subarray(scan.tornStart))).toString('utf8')
+  } catch (err) {
+    console.log(`${basename(file)}: DECOMPRESS ERROR ${String(err).slice(0, 120)}`)
+    continue
+  }
+  let events = 0
+  let unmarked = 0
+  for (const line of text.split('\n')) {
+    if (!line.startsWith('{"type":"memory/map"')) continue
+    events += 1
+    if (!line.includes('"ignorable":true')) unmarked += 1
+  }
+  if (events > 0) console.log(`${unmarked > 0 ? 'BROKEN ' : 'ok     '} events=${events} unmarked=${unmarked} ${file}`)
+}
+console.log(`scanned ${scanned} files`)

package/scripts/verify-log.ts

@@ -0,0 +1,26 @@
+/* eslint-disable no-console */
+// Read-only: run the harness's own storage-contract validator over a live log.
+import { readFileSync } from 'node:fs'
+import { scanZstdFrames, decompressZstdFrame, decompressZstdPrefix } from 'file:///D:/deepseek-harness/packages/session/session-persistence-jsonl/src/zstd.ts'
+import { validateStoredEvents } from 'file:///D:/deepseek-harness/packages/session/session-persistence/src/storage-contract.ts'
+
+for (const file of process.argv.slice(2)) {
+  try {
+    const buf = readFileSync(file)
+    const scan = scanZstdFrames(buf)
+    const header = (await decompressZstdFrame(buf.subarray(scan.frames[0].start, scan.frames[0].end))).toString('utf8')
+    if (header.indexOf('\n') !== header.length - 1) throw new Error('first frame is not exactly one header line')
+    const lines = [header.trimEnd()]
+    for (const frame of scan.frames.slice(1)) {
+      lines.push(...(await decompressZstdFrame(buf.subarray(frame.start, frame.end))).toString('utf8').split('\n').filter((l) => l.trim() !== ''))
+    }
+    if (scan.tornStart !== undefined) {
+      lines.push(...(await decompressZstdPrefix(buf.subarray(scan.tornStart))).toString('utf8').split('\n').filter((l) => l.trim() !== ''))
+    }
+    const rows = lines.map((l) => JSON.parse(l))
+    validateStoredEvents(rows[0], rows.slice(1), { kind: 'jsonl', path: file })
+    console.log(`OK ${rows.length} rows, ${rows.slice(1).filter((e) => e.type === 'memory/map').length} memory/map: ${file}`)
+  } catch (err) {
+    console.log(`FAIL ${file}: ${String(err).slice(0, 300)}`)
+  }
+}