@volter/supercode-interchange 0.1.22 → 0.1.24

package/LICENSE-diffy-MIT

@@ -0,0 +1,23 @@
+Permission is hereby granted, free of charge, to any
+person obtaining a copy of this software and associated
+documentation files (the "Software"), to deal in the
+Software without restriction, including without
+limitation the rights to use, copy, modify, merge,
+publish, distribute, sublicense, and/or sell copies of
+the Software, and to permit persons to whom the Software
+is furnished to do so, subject to the following
+conditions:
+
+The above copyright notice and this permission notice
+shall be included in all copies or substantial portions
+of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF
+ANY KIND, EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED
+TO THE WARRANTIES OF MERCHANTABILITY, FITNESS FOR A
+PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT
+SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY
+CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION
+OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR
+IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER
+DEALINGS IN THE SOFTWARE.

package/README.md

@@ -1,11 +1,28 @@
 # Supercode interchange
 
+The `./parity-report` subpath owns the frozen capability/orchestration ledger
+report printed by `supercode harness parity`. The native evidence-audit helpers
+retain their configuration/tool/runtime consumers and read the same unchanged
+ledgers. This report does not execute the evidence resolver or verify runtime
+support. [Original records](../../docs/evidence/parity-report-port-2026-10-09.md) and
+[current-main recordings](../../docs/evidence/parity-report-integration-2026-10-15.md)
+retain their distinct source and native/handoff scopes.
+
+The `./ontology-contracts` subpath owns the committed schema and operation
+inventory printed by `supercode ontology schema|operations`. Record-specific
+definition sets and native JSON numeric facts are retained. The orchestrator
+type generator and harness SDK operation generator read these contracts by
+default; an explicit `SUPERCODE_BIN` still selects an external product's output.
+The native schema functions and derives retire. Native serde models and operation
+execution retain their unported runtime/codec owners. [Original records](../../docs/evidence/ontology-contracts-port-2026-10-09.md)
+and [current-main integration](../../docs/evidence/ontology-contracts-integration-2026-10-15.md)
+retain distinct scopes; schema availability is not runtime support.
+
 Read-only metadata and discovery projection for the daemon-owned session index in
 [TypeScript architecture step 4](../../docs/plans/typescript-architecture.md#order).
 The port branch routes discovery and index windows through this library and the Teams owner.
 [Dated private Mac/Windows observations](../../docs/evidence/session-index-owner-2026-10-08.md)
 cover selected small homes; publication, all-format and large-home qualification remain open.
-Full session translation codecs remain at their later boundary.
 
 The `./session-model` subpath supplies the step-5 read service's typed message
 and retained-session representation, native raw-line framing, normalized views,
@@ -67,8 +84,24 @@ the external revert sidecar and verifies both identities; malformed JSON columns
 remain diagnostic. Legacy JSON-tree directories retain their native
 unsupported-source refusal. The small envelope observation does not qualify
 concurrent SQLite/revert changes or all compaction/tool shapes.
+Foreign-store snapshots share a 256 MiB cumulative row charge across scalar,
+iterator and array reads. Accepted native rows remain complete; capacity
+refuses the snapshot with the existing unreadable-session code. Failed close
+keeps the exact owner and refuses successor snapshots. The
+[row-admission source record](../../docs/evidence/session-store-row-admission-2026-10-12.md)
+separates this charge from SQLite's own allocations and runtime qualification.
 The path layer selects formats structurally, pins native store selectors and
-reads compressed transcripts through Node's zstd support. Native sidecars
+reads compressed transcripts through Node's zstd support.
+The read library admits compressed input, decompressed output and an individual
+physical record at the smaller of Node's Buffer capacity and four times its
+single-string UTF-16 capacity. Oversize reads refuse with `SESSION_UNREADABLE`
+at that byte budget; accepted bytes stay complete and this
+reader does not modify the source. This bounds these byte owners, rather than
+the reconstructed graph or total process memory. The
+[admission record](../../docs/evidence/session-read-byte-admission-2026-10-12.md)
+states current qualification limits.
+
+Native sidecars
 validate framing and retain malformed appended turns as raw parse loss.
 Grok summaries and OpenClaw path profiles keep their source meanings. Display
 reads retain the native byte-window, human-anchor and fixed-byte-anchor rules;
@@ -110,6 +143,30 @@ cover recorded posture/policies through npm and operator streams, including
 unknown posture for malformed records. The manifest's other branches,
 corpus/scale, concurrent reads and independent source review remain open.
 
+Plain Claude and Codex recorded-configuration reads retain append-validated
+header and runtime folds. Unchanged reads parse no old records; appended complete
+lines extend the folds, while an unfinished final line belongs only to its current
+answer. Permission mode still requires a valid complete runtime reconstruction.
+A runtime call that retroactively names an earlier result rebuilds the fold;
+replacement, truncation and prefix changes use the existing append-scan validation.
+The configuration cache keeps at most 32 files and charges 400,000 retained
+reference/runtime entries, with the current-scan exception used by Claude scans.
+It retains no ordinary message bodies. Claude option-based message windows now
+share the retained replay scan, including native metadata residue. Requested
+payloads still cost their returned size; no full-session payload cache is added.
+
+Daemon one-shot reads share a retained worker across caller transports. A caller's
+deadline rejects its wait without terminating that worker; duplicate pending
+reads share one parse, and 64 distinct reads bound the pending queue. Followers
+keep their own subscriptions. Closing a caller stream releases its followers,
+while a daemon-owned scan finishes against its bounded file snapshot. One-shot
+mail enrichment retains no resolved history: at most 16 in-flight session reads
+are shared, with a 250 ms optional wait per result. Follower histories are removed
+when their last subscription ends. Parse-fold retention is independent. Actual
+worker failure and daemon shutdown still release its state. These are source
+changes; large-transcript runtime and deadline qualification remain unperformed.
+
+
 `sessions.launch_agent` reads `<harness home>/supercode/launches/<session id>.json`
 in the same caller-owned load lane. Claude `projects` and Codex `sessions`
 ancestors select the transcript's recorded home, independent of current vendor
@@ -186,9 +243,372 @@ read-only and observe DB/WAL changes. OpenCode and Goose compare native row mark
 facts for query-time selection; orchestrator rows keep routing keys and the source change cursor. Codex names
 and history topics, and late Claude rename aliases, have separate append-aware ledgers.
 
+`readSourceJson(path, metrics, previous)` can reuse an earlier result produced by
+this process when the current open file has the same fingerprint. The handle
+and path are still verified, and readability failures remain failures. A copied
+or deserialized result is reread: native integer-versus-float facts belong to the
+original parsed object. The machine owner keeps this raw cache in memory and
+persists only derived registry facts. [Source and package evidence](../../docs/evidence/session-index-invalidations-2026-10-10.md)
+does not establish runtime or scale performance.
+
 Bounded preview readers preserve source roles, provenance, native message cursors and Codex's adjacent
 event/response pairing. Preview search enriches eligible rows before pagination. These readers and discovery
 projection are connected to the owner; their presence is not a runtime or Windows qualification.
 
 This package requires Node 22.15 or newer. It does not start a native harness, change a vendor home or own
 a database. The machine daemon owns index state and subscriptions.
+
+The machine-tree journal fold is exposed at `session-machine-tree`; the Teams
+reader combines it with fresh local process/registry facts. Public
+`sessions.tree` uses the caller-owned load worker and requires its separate
+`tree` capability marker. The CLI and daemon writer share that TypeScript
+reader; lineage records and remembered names grant no caller authority.
+[Private Mac/Windows tree observations](../../docs/evidence/session-machine-tree-2026-10-08.md)
+cover small registry/history inputs, the public SDK/CLI/operator doors, journal
+rollover/heartbeat and an in-progress daemon offer at shutdown. The new Mac
+native CLI handoff is operated; new Windows forwarding, real vendor/runtime
+corpus, automatic scheduling, concurrency, scale and installed sets remain
+unqualified.
+
+The `session-activity` projection keeps presence and turn evidence separate
+from transcript freshness. The Teams `sessions.activity_under` reader joins
+it to the nearest proven Claude/Codex process beneath each requested root;
+its caller-owned load lane advertises `activity_under` separately. It reads
+existing registry, rollout and runtime metadata and adds no caller identity,
+provider launch or receipt retirement. [Private Mac/Windows activity observations](../../docs/evidence/session-pane-activity-2026-10-08.md)
+cover owned descendant/registry selection, runtime precedence, malformed
+requests and older-service refusal through SDK and operator doors. Live
+Codex/vendor ownership, corpus/scale, concurrency, natural shutdown and
+installed sets remain unqualified.
+
+The activity subscription branch also routes subscribe/unsubscribe and the
+activity-event stream to a separate caller-owned worker, admitted by the
+`activity` marker. It retains incremental Codex cursors, runtime precedence,
+Hermes fire links, transition-only notifications and a background pane-prompt
+cache. The Hermes projection reads the complete home's validity dependencies
+without exporting or writing a home. The native activity service/module and
+CLI poll lane are removed; their shared mail/runtime readers remain.
+[Private Mac/Windows subscription records](../../docs/evidence/session-activity-subscriptions-2026-10-09.md)
+cover snapshots, transitions, validation, unsubscribe/EOF and older-service
+refusal through npm/SDK and real loopback operator streams. Owned Node fixtures
+qualify Codex cursor/ownership mechanics; actual vendor sessions, pane/control
+overrides, broader Hermes branches, concurrency/scale and installed sets remain
+unqualified.
+
+The shared method table also admits `sessions.inbox` through a separate
+caller-owned Teams worker with an `inbox` marker. This bridge forwards to the
+daemon's existing mailbox owner: operator reads consume unread messages,
+while explicit session-address reads look only. It is not a pure transcript
+read or a mailbox implementation in interchange. It preserves strict field
+validation, the native positional-array forwarding and independent calls;
+closing the caller aborts its sockets without retrying a consuming request.
+[Private Mac/Windows inbox records](../../docs/evidence/session-inbox-port-2026-10-09.md)
+cover the public SDK and loopback operator doors, admission/refusals and close
+cancellation. Real mail delivery, all claim/channel branches, full timeout,
+scale, remote grants and installed sets remain unqualified.
+
+The shared method table also admits `sessions.message` through an independent
+caller-owned Teams worker and a separate `message` marker. Admission and
+Claude's user-level inbound report live in interchange; the worker forwards
+one request to the existing machine mail owner, retains uncertain submitted
+outcomes and never retries. It reads settings without changing policy.
+[Private Mac/Windows message records](../../docs/evidence/session-message-port-2026-10-09.md)
+qualify small owned operator-mail and settings cases, private operator streams,
+loss/cancellation and the Mac native boundary. Vendor delivery, agent wake,
+full deadlines, broader settings/store/grant branches and installed/published
+sets remain unqualified.
+
+[Current-main integration records](../../docs/evidence/session-message-integration-2026-10-15.md)
+retain the independent message lane beside the explicit pure-read coalescer.
+
+`sessions.import` admits an explicit document and transfer format in the
+caller-owned load worker, using these same strict codecs and normalized model.
+It accepts the native `open-code` alias; `hermes` selects the Codex import
+document. It performs no home discovery, store mutation or vendor invocation.
+The separate `import` capability marker refuses an older service rather than
+routing the call back to a native parser. Export, translate, branch and handoff
+use the separate transfer worker, including explicit continuation materialization.
+
+[Private Windows-first/Mac import records](../../docs/evidence/session-document-import-2026-10-09.md)
+cover small supplied documents, explicit admission, operator streams, retained
+native normalized parity, older refusal and the new Mac native boundary. Broader
+corpus, scale, transport interruptions, installed sets and a new Windows native
+binary remain unqualified.
+
+### Support inventory
+
+`supportRegistryReport` and the public `harness.v1.support.report` reader
+report the declared native-format, runtime and orchestration wiring in stable
+product order. They construct launch specifications, never execute or probe
+a vendor. The descriptor table is canonical in
+`crates/harness/src/support-registry.json`; `scripts/support-registry.mjs`
+maintains the package copy. Codex executable admission and Grok's symlink-home
+hint use the caller's reader environment. An older service lacking the separate
+`support` capability marker is refused. The npm `supercode harness report`
+command serves this same reader. Retained native runtime/probe consumers still
+read the shared typed descriptor data and their existing orchestration table.
+[Private Windows-first/Mac finished-source records](../../docs/evidence/support-report-port-2026-10-09.md)
+cover thirteen SDK reports per OS, selected CLI forms, private operator streams,
+older admission, native descriptor/environment comparisons and the new Mac
+forwarding boundary. Actual vendor/probe behavior, broader path/home branches,
+new Windows forwarding and installed/published sets remain unqualified.
+
+### User-level interoperation settings
+
+`loadHarnessSettings` and public `harness.v1.harnesses.settings` read Claude's
+user-level inbound setting through the same reader used by message admission.
+The report hashes original file bytes, retains configured values and leaves
+process-effective policy explicitly unknown. Other harness strings return
+the native empty report; malformed parameters or invalid Claude settings
+refuse. Separate SDK `settings` admission prevents an older service fallback.
+The npm `supercode harness settings` command serves human or JSON output from
+that reader. Configure and native runtime/mail consumers retain their own
+active boundaries; this read executes no recommendation and writes no policy.
+[Private Windows-first/Mac records](../../docs/evidence/harness-settings-port-2026-10-09.md)
+cover selected SDK, CLI, operator, native report/refusal comparison and new
+Mac forwarding cases. Effective policy, real configure/delivery, broader
+path/concurrency branches, new Windows forwarding, installed sets and actual
+machine upgrades remain unqualified.
+
+### Named profiles
+
+`listProfiles`/`getProfile` from the `session-read` subpath implement public
+`harness.v1.profiles.list`/`get` in the caller-owned load worker. Supercode
+presets, Codex TOML profiles, Hermes profiles, OpenClaw agents and orchestrator
+profiles retain complete native home validity, model/default selection and
+known/unknown counts. SDK admission requires `profiles:true` separately;
+the npm CLI `profiles list`/`show` uses the same reading. Profile mutations
+and native memory-search consumers retain their shared helpers.
+[Private Mac/Windows product records](../../docs/evidence/profiles-read-port-2026-10-09.md)
+qualify the named same-input native/TypeScript cases, CLI/operator readings,
+older-service refusal, Windows routing-scope correction and new Mac native
+forwarding/retirement. Broader corpus, concurrency, uncommon paths, new
+Windows forwarding and published/installed sets remain unqualified.
+
+### Recorded memory documents
+
+`showMemory` from `session-read` implements public `harness.v1.memory.show`
+in the caller-owned load worker, with separate `memory_show:true` SDK
+admission. It selects Claude project/session stores, Hermes user/profile
+stores and OpenClaw agent workspaces; reports ordered prose documents with
+bounded preview or full text, size and recorded timestamp; and keeps native
+empty/refusal meanings. The npm `memory show` CLI uses this reader. It writes
+no memory, starts no provider and changes no caller authority. Native memory
+search and its profile/store helpers remain separate.
+[Private Mac/Windows product records](../../docs/evidence/memory-show-port-2026-10-09.md)
+qualify the named same-input SDK, CLI/operator, older-service and new Mac
+forwarding/retirement cases. Unusual paths, complete corpus/scale,
+concurrent replacement, new Windows forwarding and installed sets remain
+unqualified.
+
+### Recorded job notepads
+
+`readJobNotepad` from `session-read` implements public `harness.v1.jobs.notepad`
+in the caller-owned load worker with separate `job_notepad:true` SDK admission.
+It reads Hermes notepad entries after complete job-file validation and the
+first job/profile selection, preserving SQLite TEXT and UTF-8 refusals.
+The read-only `jobs notepad` CLI uses the same reader; set/delete and verified
+native readback retain their owners. This reader writes no notepad or job.
+[Original Mac/Windows records](../../docs/evidence/job-notepad-read-port-2026-10-09.md)
+retain their exact source scope; current native/installed composition,
+concurrent writers and the wider home/store corpus remain unqualified.
+
+### Recorded run history
+
+`listRuns`/`getRun` from `session-read` implement public `harness.v1.runs.list`
+and `get` in the caller-owned worker, with separate `runs:true` admission.
+They read Hermes, OpenClaw and orchestrator histories after complete home
+validity, retaining source availability, execution/delivery separation,
+ordering, limits and native record projection. The list/ls/get CLI uses the
+same reader. No scheduler, claim, retry, pruning or writer runs here.
+[Original Mac/Windows records](../../docs/evidence/runs-read-port-2026-10-09.md)
+retain their source scope. Broader corpus/concurrency, native controls,
+new Windows forwarding and current installed composition remain unqualified.
+
+### Recorded scheduled jobs
+
+`listJobs`/`getJob` from `session-read` implement public `harness.v1.jobs.list`
+and `get` in the caller-owned load worker, with separate `jobs:true` admission.
+They inspect Claude session cron/wakeup records and Hermes/OpenClaw/orchestrator
+jobs, retaining native source availability, projections and refusal meanings.
+The list/ls/get CLI uses the same reader. Shared native private job readback
+and controls keep their owners; no scheduler, job writer or provider starts.
+[Original Mac/Windows records](../../docs/evidence/jobs-read-port-2026-10-09.md)
+retain their source scope, including exact wakeup delays and the SQLite UTF-8
+pathname correction. Broader corpus/concurrency, native controls, new Windows
+forwarding and current installed composition remain unqualified.
+
+### Installed skill packages
+
+`listInstalledSkills` and public `harness.v1.skills.list` report the skill
+packages selected by harness, scope, working directory and config homes.
+They read managed, user, project, plugin and bundled roots for Claude Code,
+Codex, opencode, pi, Hermes and OpenClaw; frontmatter supplies the recorded
+name, description, version and optional enablement. Codex config supplies a
+sequential enablement overlay after a complete TOML parse. Invalid or unread
+config leaves the recorded frontmatter enablement unchanged. Unknown harnesses
+and malformed request fields refuse explicitly. SDK `listSkills` requires the
+separate `skills:true` marker; an older service is refused while its catalog
+remains available. The npm `supercode skills list`/`ls` command uses the same
+reader. Runtime loading and install/remove retain their own native boundaries.
+This listing writes no package or policy and executes no vendor. Product observations are recorded separately by source.
+
+### Recorded routing inventory
+
+`listRoutes` from the session-read entry projects recorded Hermes, OpenClaw
+and orchestrator routes after complete owning-home validity. Public worker,
+SDK `routes:true` admission and `routes list`/`ls` use the same reader.
+Target filters, native source spelling, precedence and raw-number text retain
+the native meanings. Listing resolves no live traffic and edits no route.
+The complete native reader retires; shared codecs and control consumers stay.
+[Original Mac/Windows records](../../docs/evidence/routes-read-port-2026-10-09.md)
+retain their own source and lifecycle limits.
+
+### Recorded inbound triggers
+
+`listTriggers` uses complete owning-home readers and the caller-owned load
+worker with separate `triggers:true` admission. Hermes root subscriptions and
+static YAML routes, orchestrator profile order and OpenClaw duplicate-name/
+mapping-position behavior retain native meaning. Rows return endpoint metadata
+and secret presence; listing starts no endpoint and changes no store.
+[Original records](../../docs/evidence/triggers-read-port-2026-10-09.md) retain
+their own source, native comparison and lifecycle scopes.
+
+### Recorded channel inventory
+
+`listChannels` and `channelStatus` serve public channel list/status in the
+caller-owned load worker with separate `channels:true` admission. The npm
+list/ls/status CLI shares the reader. Complete owning-home validity precedes
+projection; credentials and caller environment contribute presence only.
+Unfiltered catalog counts preserve native source skips, mirror/child rules
+and transport grouping. Status stays `unknown`; listing opens no gateway.
+[Original records](../../docs/evidence/channels-read-port-2026-10-09.md) retain
+their own source, native comparison and lifecycle scopes.
+
+### Recorded workflow board
+
+`loadWorkflow` serves public workflow load through the caller-owned worker
+with separate `workflow:true` SDK admission and npm `workflow load`. Explicit
+or inferred Hermes/supercode backing retains the complete read-only board,
+task/run/review/comment/dependency and residue projection. The sole native
+reader/codec retires; shared model/schema, mutations, dispatch and authority
+retain their owners. Listing creates no board, index or task.
+[Original records](../../docs/evidence/workflow-read-port-2026-10-09.md) retain
+their own source, corrected metadata ordering and native/operator scopes.
+
+## Corpus audit
+
+`@volter/supercode-interchange/corpus-audit` owns the complete read-only audit
+for Claude Code, Codex, Pi, OpenCode, Grok, Gemini and Goose. `auditCorpus(root,
+{format, limit})` preserves typed envelope refusals, unknown fields,
+per-instance block coverage, tools and notes; `corpusAuditJson` retains exact
+native integer wire counts. `formatCorpusAudit` produces the compact CLI view,
+while `formatCorpusAuditInventory` produces the full library inventory. The
+[native selection contract and usage](../../docs/guides/corpus-audit.md) name
+file/store limits and empty/error boundaries. The public CLI is `supercode
+audit`; its remaining native parser forwards to this release's Node front door.
+The audit-specific native models and classifiers have been removed. Shared
+catalog, codecs, pricing and runtime owners remain separate. [Original records](../../docs/evidence/corpus-audit-port-2026-10-09.md)
+retain their source and native scope. Product observations are recorded
+separately by source; installed composition remains unqualified.
+
+### Session emission and transfer
+
+`@volter/supercode-interchange/session-write` exports the seven format writers,
+same-format prefix splicing and native recovery containers. The `session-read`
+entry exports `transferSession`, which loads the complete source and returns a
+primary artifact, recovery files and an explicit fidelity/residue report.
+A verified content-addressed residue cache can restore prior source records;
+a cache miss, ambiguity or unsound prefix falls back to ordinary rendering.
+
+Public `sessions.export` and `sessions.translate` run in a separate caller-owned
+worker with separate capability markers. They are independent requests rather
+than coalesced reads. Translation to Hermes returns an artifact; export to
+Hermes invokes `hermes sessions import --from codex` through that vendor's CLI.
+No other target is executed or installed. Shared native writer/model/residue
+consumers in reduction, handoff and emulation remain until their owners move.
+The emission version asset follows the interchange crate via the generator and
+commit hook; bypassing generation can leave it stale.
+
+### Complete conversion
+
+The public `./session-convert` entry and `supercode convert` command share
+literal-path and saved-family admission, all seven emitters, verified reduction
+pointers and complete sidecar rehydration. Recorded reductions affect the view
+token diagnostic; output uses the full source. A damaged literal may write
+partial output to a distinct destination and then fail, but cannot overwrite
+its own source. Saved Claude children are validated before primary output and
+written afterward; concurrent failures do not imply transactional rollback.
+Saved-family lookup may create an absent store directory, as the native reader
+did. Literal Hermes conversion invokes its CLI; saved Hermes conversion retains
+Codex emission without invoking a vendor. Shared runtime reduction decisions,
+mutation, provider continuation and native library consumers remain separate.
+
+### Offline inspection
+
+The public `./session-inspect` entry and `supercode inspect` command report
+complete literal sessions or saved working views after validating sidecar
+reduction pointers. A persisted working transcript takes precedence over
+mechanical reapplication. Partial literal reports end with failure.
+`./inspection-schemas` reports fresh committed built-in schema definitions and
+full/medium/minimal costs, after whole typed configuration admission when a
+configured tier is requested. JSON inspection and parse-loss exits skip that
+configuration read. No tool, hook, credential or provider runs. The generator
+and commit hook maintain projections while native config/tool consumers remain.
+Process ancestry keeps its current main owner and is outside this inspection
+slice; no old ancestry operation qualifies current source here.
+
+### Branch artifacts and handoff specifications
+
+`sessions.branch` and `sessions.handoff`, including SDK `branchSession` and
+`handoffSession`, use the caller-owned transfer worker with independent
+`branch:true` and `handoff:true` markers. A cut names exactly one user message
+by its recorded `claude_uuid`; other keys, absent or duplicated user IDs
+refuse. It retains only preceding messages and children linked to their kept
+tool calls. Whole-session raw records and cut-specific source residue are
+dropped; the original source remains unchanged. An omitted branch target
+returns `artifact:null`; a supplied target uses the complete artifact builder.
+
+Handoff rewrites the target identity to a fresh UUID (OpenCode uses `ses_`
+plus its undashed UUID) and returns structured launch/materialization
+instructions for all eight targets. Explicit cwd, including empty, precedes
+recorded cwd and `.`. Neither method invokes a vendor, writes a destination
+session store or executes its instructions. Artifact construction may populate
+the same best-effort source residue cache as translation. The exclusive native
+request/dispatch/artifact/cut/instruction helpers retire together. Native
+reduction, shared writers/residue and terminal-launch consumers remain.
+[Current-main Windows/Mac recordings](../../docs/evidence/session-branch-handoff-integration-2026-10-15.md)
+retain the named SDK/worker/stdio paths. Independent board review, native
+composition and installed/runtime support remain separate.
+
+### Continuation artifact materialization
+
+`sessions.materialize` uses the caller-owned transfer worker and an independent
+`materialize:true` marker. Claude, Codex, Pi and Grok get fresh-ID exclusive
+files; OpenCode owns its import and read-only database confirmation. Source
+recovery cache writes precede validation. Later bundle failure retains earlier
+files and cancellation does not undo an import. No resume command executes.
+Native materialization dispatch and the exclusive native module retire;
+current native composition, used-home and actual vendor qualification remain
+separate from the dated integration recordings.
+
+### Controlled skill packages
+
+`skills.install` and `skills.remove` use a separate caller-owned worker and
+`skills_control:true` admission, independent of listing. Claude, Codex, Pi and
+OpenCode local packages use their loader roots; Hermes/OpenClaw keep their own
+CLI doors and verified inventory readback. Native control/rendering retires;
+shared native runtime loading and frontmatter retain their owner. Explicit null
+mutation structs refuse. The CLI preserves the bare release installer and
+selected listing/mutation cwd. No actual vendor installation or current native
+composition is implied by the dated integration records.
+
+### Controlled profile commands
+
+`profiles.create` and `profiles.delete` use an independent caller-owned worker
+with `profiles_control:true` admission. Hermes/OpenClaw keep their own CLI
+writers; the orchestrator keeps its package's live/cold operator and readback.
+Native control and CLI decisions retire, with static support facts beside the
+shared native profile reader. CLI cwd stays accepted grammar without redefining
+profile homes. Current native/vendor/PTY/installed operation is separate from
+these source ownership facts.

package/channel-records.mjs

@@ -0,0 +1,71 @@
+// Narrow recorded channel facts. Credentials contribute presence only;
+// their values and the rest of the owning configuration stay internal.
+import { hermesYamlKeys } from './hermes-read-yaml.mjs';
+import { stringifyNativeJsonMember } from './native-json.mjs';
+import { nativeTrim } from './text.mjs';
+
+const object = value => value != null && typeof value === 'object' && !Array.isArray(value);
+const compare = (a, b) => Buffer.compare(Buffer.from(a), Buffer.from(b));
+const placeholder = value => typeof value === 'string' && /^\$\{[A-Za-z_][A-Za-z0-9_]*\}(?![\s\S])/u.test(value);
+const accountKeys = ['account', 'account_id', 'app_id', 'bot_id', 'client_id', 'corp_id', 'phone_number_id', 'user_id'];
+const openclawAccountKeys = ['accountId', 'account_id', 'account', 'teamId', 'appId', 'userId'];
+const credential = key => /token|secret|key|password|passwd|api_key|app_secret|signing|webhook_url|private/u.test(key.replace(/[A-Z]/gu, c => c.toLowerCase()));
+const openclawPublicKeys = new Set(['sessionkey', 'session_key', 'storekey', 'store_key', 'metakey', 'meta_key', 'bindingkey', 'binding_key', 'declarationkey', 'declaration_key', 'idempotencykey', 'idempotency_key']);
+const openclawCredential = key => {
+  const lower = key.replace(/[A-Z]/gu, c => c.toLowerCase());
+  return !openclawPublicKeys.has(lower) && /(?:token|key|secret|password|credential)$/u.test(lower);
+};
+const scalar = (parent, key) => typeof parent[key] === 'string' ? parent[key] : typeof parent[key] === 'number' ? stringifyNativeJsonMember(parent, key) : null;
+
+export function folderChannelRecords(config, dotenv) {
+  const channels = new Map();
+  if (object(config.platforms)) for (const name of Object.keys(config.platforms).sort(compare)) {
+    const block = config.platforms[name], extra = new Map(); let configured = false;
+    const walk = (parent, prefix = '') => {
+      for (const key of hermesYamlKeys(parent)) {
+        const value = parent[key], field = `${prefix}${key}`;
+        if (!prefix && key === 'enabled') continue;
+        if (placeholder(value) || typeof value === 'string' && credential(key)) configured = true;
+        else if (!prefix && key === 'extra' && object(value)) walk(value, 'extra.');
+        else extra.set(field, scalar(parent, key));
+      }
+    };
+    walk(block);
+    let account = null;
+    for (const key of accountKeys) {
+      const value = extra.has(key) ? extra.get(key) : extra.get(`extra.${key}`);
+      if (value != null && value !== '') { account = value; break; }
+    }
+    channels.set(name, { name, account, enabled: block.enabled ?? true, configured });
+  }
+  for (const [name, token] of [['discord', 'DISCORD_BOT_TOKEN'], ['telegram', 'TELEGRAM_BOT_TOKEN'], ['slack', 'SLACK_BOT_TOKEN']]) {
+    if (!channels.has(name) && nativeTrim(dotenv.get(token) ?? '') !== '') channels.set(name, { name, account: null, enabled: true, configured: false });
+  }
+  return [...channels.values()].sort((a, b) => compare(a.name, b.name));
+}
+
+export function openclawChannelRecords(config) {
+  const rows = new Map();
+  const credentials = block => object(block) && Object.keys(block).some(key => typeof block[key] === 'string'
+    && (placeholder(block[key]) || openclawCredential(key)));
+  if (!object(config.channels)) return [];
+  for (const kind of Object.keys(config.channels).sort(compare)) {
+    const entry = config.channels[kind]; if (!object(entry)) continue;
+    const sharedEnabled = typeof entry.enabled === 'boolean' ? entry.enabled : null;
+    const accounts = object(entry.accounts) ? Object.keys(entry.accounts).map(id => [id, entry.accounts[id]])
+      : Array.isArray(entry.accounts) ? entry.accounts.flatMap(account => {
+        if (!object(account)) return [];
+        const id = Object.hasOwn(account, 'id') ? account.id : account.accountId;
+        return typeof id === 'string' && id !== '' ? [[id, account]] : [];
+      }) : [];
+    accounts.sort(([a], [b]) => compare(a, b));
+    if (!accounts.length) {
+      const key = openclawAccountKeys.find(key => typeof entry[key] === 'string');
+      rows.set(kind, { name: kind, kind, account: key == null ? null : entry[key], enabled: sharedEnabled, configured: credentials(entry) });
+    } else for (const [id, account] of accounts) {
+      const enabled = typeof account?.enabled === 'boolean' ? account.enabled : sharedEnabled;
+      rows.set(`${kind}/${id}`, { name: `${kind}/${id}`, kind, account: id, enabled, configured: credentials(account) || credentials(entry) });
+    }
+  }
+  return [...rows.keys()].sort(compare).map(name => rows.get(name));
+}

package/channel-session-counts.mjs

@@ -0,0 +1,81 @@
+// The native channels reader used an unfiltered catalog reading, with children
+// hidden. Reuse its source/noun contracts without creating an index or watcher.
+import { readdirSync, readFileSync } from 'node:fs';
+import { join } from 'node:path';
+import { readStore, statement, text, integer, jsonColumn } from './sqlite-reader.mjs';
+import { selectStoreFiles } from './store-registry.mjs';
+import { hermesSessionNouns } from './hermes-store.mjs';
+import { readOrchestratorStore } from './orchestrator-store.mjs';
+import { openclawNouns } from './openclaw.mjs';
+import { parseNativeJson, nativeInteger } from './native-json.mjs';
+import { nativeTrim } from './text.mjs';
+
+const extended = ['session_key', 'chat_id', 'chat_type', 'thread_id', 'user_id', 'profile_name', 'handoff_state', 'handoff_platform', 'handoff_error'];
+const utf8 = new TextDecoder('utf-8', { fatal: true, ignoreBOM: true });
+const add = (counts, platform) => { if (platform != null) counts.set(platform, (counts.get(platform) ?? 0n) + 1n); };
+const entries = path => { try { return readdirSync(path); } catch { return []; } };
+
+async function hermesPlatforms(path) {
+  const snapshot = await readStore(path, db => {
+    if (!['sessions', 'messages', 'schema_version'].every(name => db.prepare("SELECT 1 FROM sqlite_master WHERE type='table' AND name=?").get(name))) return [];
+    const values = statement(db, 'SELECT id, cwd, title, model, message_count, started_at, ended_at, parent_session_id, source, model_config FROM sessions ORDER BY started_at DESC').all();
+    // A bad required/nullable column refuses the entire native store, including
+    // a malformed child that would subsequently be excluded from the count.
+    for (const row of values) {
+      text(row.id);
+      for (const key of ['cwd', 'title', 'model', 'parent_session_id', 'source', 'model_config']) text(row[key], true);
+      const count = integer(row.message_count, true);
+      if (count != null && (count < -(1n << 63n) || count >= (1n << 63n))) throw new Error('native i64 count required');
+      for (const key of ['started_at', 'ended_at']) if (row[key] != null && typeof row[key] !== 'number' && typeof row[key] !== 'bigint') throw new Error('native numeric epoch required');
+    }
+    let extendedRead = null;
+    try { extendedRead = statement(db, `SELECT ${extended.join(',')} FROM sessions WHERE id=?`); } catch { /* optional gateway schema */ }
+    return values.flatMap(row => {
+      const mirror = jsonColumn(row.model_config)?._supercode_mirror;
+      if (mirror != null) {
+        const amount = nativeInteger(mirror, 'messages', { signed: true });
+        const unchanged = amount == null || (row.message_count ?? 0n) <= amount;
+        if (unchanged && (mirror.harness === 'hermes' || Object.hasOwn(mirror, 'continued_as'))) return [];
+      }
+      if (row.parent_session_id != null) return [];
+      let fields;
+      try { fields = extendedRead?.get(row.id); } catch { /* no gateway nouns from a refused optional row */ }
+      const admitted = fields != null && extended.every(key => fields[key] == null || typeof fields[key] === 'string');
+      const nouns = hermesSessionNouns({ ...row, ...(admitted ? fields : {}) }, null, null, admitted);
+      return nouns.surface?.platform == null ? [] : [nouns.surface.platform];
+    });
+  });
+  return snapshot.result;
+}
+
+export async function channelSessionCounts(harness, homes) {
+  const counts = new Map();
+  if (harness === 'openclaw') {
+    for (const agent of entries(join(homes.openclaw, 'agents'))) {
+      const sessions = join(homes.openclaw, 'agents', agent, 'sessions');
+      for (const leaf of entries(sessions)) {
+        if (!leaf.endsWith('.jsonl') || leaf.endsWith('.trajectory.jsonl')) continue;
+        const path = join(sessions, leaf);
+        try {
+          const source = utf8.decode(readFileSync(path));
+          const header = parseNativeJson(source.split('\n').find(line => nativeTrim(line) !== '') ?? '');
+          if (header?.type === 'session') add(counts, openclawNouns(header, path).surface?.platform);
+        } catch { /* native discovery skips an unread/malformed session */ }
+      }
+    }
+  } else {
+    let stores;
+    try { stores = await selectStoreFiles(harness, homes); }
+    catch { stores = [{ path: harness === 'hermes' ? homes.hermes : join(homes.orchestrator, 'state.db'), profile: harness === 'hermes' ? null : 'default' }]; }
+    for (const store of stores) {
+      try {
+        if (harness === 'hermes') for (const platform of await hermesPlatforms(store.path)) add(counts, platform);
+        else {
+          const { result } = await readOrchestratorStore(store.path, store.profile, { surfaceOnly: true });
+          for (const { descriptor } of result.rows) add(counts, descriptor?.surface?.platform);
+        }
+      } catch { /* the native catalog skips the entire refused store */ }
+    }
+  }
+  return counts;
+}