@volter/supercode-teams 0.2.20

package/package.json

@@ -0,0 +1,80 @@
+{
+  "name": "@volter/supercode-teams",
+  "version": "0.2.20",
+  "type": "module",
+  "description": "A machine daemon serving this machine's doors, and a local or remote Teams server for shared session discovery, OpenTelemetry ingestion and access to enrolled machines.",
+  "license": "MIT",
+  "exports": {
+    ".": "./index.mjs",
+    "./client": "./client.mjs",
+    "./machine": "./machine.mjs",
+    "./browser-attach": "./browser-attach.mjs",
+    "./attention": "./attention.mjs",
+    "./bin": "./bin/teams.mjs",
+    "./fleet": "./fleet.mjs",
+    "./bin/fleet": "./bin/fleet.mjs",
+    "./server": {
+      "types": "./server/index.d.ts",
+      "default": "./server/index.mjs"
+    },
+    "./workspace-client": {
+      "types": "./workspace-client.d.ts",
+      "default": "./workspace-client.mjs"
+    },
+    "./connector": {
+      "types": "./connector/index.d.ts",
+      "default": "./connector/index.mjs"
+    },
+    "./contracts": {
+      "types": "./contracts/index.d.ts",
+      "default": "./contracts/index.mjs"
+    },
+    "./connector/native-continuation": {
+      "types": "./connector/native-continuation.d.ts",
+      "default": "./connector/native-continuation.mjs"
+    }
+  },
+  "bin": {
+    "supercode-teams": "./bin/teams.mjs",
+    "supercode-teams-fleet": "./bin/fleet.mjs"
+  },
+  "files": [
+    "*.mjs",
+    "workspace-client.d.ts",
+    "porthole-hook.cjs",
+    "bin",
+    "server",
+    "worker",
+    "connector",
+    "contracts",
+    "remote",
+    "README.md"
+  ],
+  "engines": {
+    "node": ">=20"
+  },
+  "scripts": {
+    "typecheck:teams": "tsc --noEmit -p test/tsconfig.json"
+  },
+  "dependencies": {
+    "@homebridge/node-pty-prebuilt-multiarch": "^0.14.1",
+    "@volter/supercode-frontend": "^0.2.2",
+    "@volter/supercode-harness-sdk": "^0.3.43",
+    "@volter/supercode-terminal": "^0.2.30",
+    "@volter/identity": "^0.4.0",
+    "@volter/teams": "^0.1.6",
+    "protobufjs": "8.8.0",
+    "ws": "^8.21.0"
+  },
+  "peerDependencies": {
+    "@xterm/xterm": "^6.0.0"
+  },
+  "peerDependenciesMeta": {
+    "@xterm/xterm": {
+      "optional": true
+    }
+  },
+  "devDependencies": {
+    "@grpc/grpc-js": "1.14.5"
+  }
+}

package/porthole-hook.cjs

@@ -0,0 +1,137 @@
+"use strict";
+// The porthole hook: the node exports this file into every pane's
+// NODE_OPTIONS (--require), so every node process an agent runs in a launched pane
+// loads it. It patches child_process.spawn; when a Chromium launch goes by it makes
+// sure a TCP DevTools port exists — Playwright's default pipe-only mode uses private
+// fds no CDP client can discover, and Chrome serves pipe AND port simultaneously, so
+// adding --remote-debugging-port=0 lets the kernel pick a free port with no race —
+// then announces {port, pid, pane, label} into SUPERCODE_TEAMS_PORTS_DIR, where the
+// node reads it as the live port table. The announce file is removed when the child
+// exits. This is what makes an agent's plain `chromium.launch()` appear in
+// `ports.list` with the pane that owns it, with zero agent-side setup.
+//
+// Contract, all by env (the node exports these per pane):
+//   SUPERCODE_TEAMS_PORTS_DIR  — where announce files are written (required to act)
+//   SUPERCODE_TEAMS_PANE       — the pane contextKey carried on every announcement
+//   SUPERCODE_TEAMS_NO_PORTHOLE — set to skip every launch (opt-out)
+// Every path fails open: the hook must never break its host process.
+try {
+  var cp = require("child_process");
+  var fs = require("fs");
+  var path = require("path");
+
+  var portsDir = process.env.SUPERCODE_TEAMS_PORTS_DIR;
+  var pane = process.env.SUPERCODE_TEAMS_PANE || null;
+  var disabled = Boolean(process.env.SUPERCODE_TEAMS_NO_PORTHOLE);
+
+  var BROWSER_EXE = /(^|[\/\\])(google chrome( (canary|beta|dev))?|chrome|chrome\.exe|chromium|chromium-browser|headless_shell|msedge|brave browser)$/i;
+  var UDD = "--user-data-dir=";
+  var PORT_FLAG = "--remote-debugging-port";
+  var PIPE_FLAG = "--remote-debugging-pipe";
+  // Chromium prints this once the DevTools HTTP server is listening.
+  var LISTENING = /DevTools listening on ws:\/\/(?:127\.0\.0\.1|\[::1\]|localhost):(\d+)\//;
+
+  var flagValue = function (args, prefix) {
+    for (var i = 0; i < args.length; i += 1) {
+      if (typeof args[i] === "string" && args[i].indexOf(prefix) === 0) return args[i].slice(prefix.length);
+    }
+    return null;
+  };
+
+  var isBrowserLaunch = function (cmd, args) {
+    // argv[0]: "chromium", "headless_shell", ".../Google Chrome.app/Contents/MacOS/Google Chrome".
+    if (typeof cmd === "string" && BROWSER_EXE.test(path.basename(cmd))) return true;
+    for (var i = 0; i < args.length; i += 1) {
+      if (typeof args[i] !== "string") continue;
+      if (args[i] === PIPE_FLAG || args[i].indexOf(PORT_FLAG) === 0) return true;
+    }
+    return false;
+  };
+
+  var origSpawn = cp.spawn;
+  cp.spawn = function (cmd, args, opts) {
+    try {
+      if (portsDir && !disabled && Array.isArray(args) && isBrowserLaunch(cmd, args)) {
+        var hasPipe = args.indexOf(PIPE_FLAG) !== -1;
+        var hasPort = args.some(function (a) { return typeof a === "string" && a.indexOf(PORT_FLAG) === 0; });
+        // Pipe-only: give the launch an ephemeral TCP port beside the pipe it asked for.
+        var launchArgs = hasPipe && !hasPort ? ["--remote-debugging-port=0"].concat(args) : args;
+        var child = origSpawn.call(this, cmd, launchArgs, opts);
+        watch(child, cmd, launchArgs, opts);
+        return child;
+      }
+    } catch (e) { /* fail open */ }
+    return origSpawn.call(this, cmd, args, opts);
+  };
+
+  var watch = function (child, cmd, args, opts) {
+    try {
+      if (!child || !child.pid) return;
+      var announceFile = path.join(portsDir, child.pid + ".json");
+      var cwd = (opts && opts.cwd) ? String(opts.cwd) : process.cwd();
+      var label = path.basename(cwd) || path.basename(String(cmd)) || null;
+      var done = false;
+      var timer = null;
+      var stopPolling = function () { if (timer) { clearInterval(timer); timer = null; } };
+
+      var announce = function (port) {
+        if (done || !port || !Number.isFinite(port) || port <= 0) return;
+        done = true;
+        stopPolling();
+        try {
+          fs.mkdirSync(portsDir, { recursive: true });
+          fs.writeFileSync(announceFile, JSON.stringify({
+            port: port,
+            pid: child.pid,
+            pane: pane,
+            label: label,
+            kind: "browser",
+            at: Date.now(),
+          }));
+        } catch (e) { /* fail open */ }
+      };
+
+      // Primary: Chromium's own "DevTools listening on ws://127.0.0.1:<port>/" line.
+      // Adding a listener puts the stream in flowing mode; a host that reads its child's
+      // stderr (Playwright does, synchronously after spawn) still receives every chunk.
+      if (child.stderr && typeof child.stderr.on === "function") {
+        var seen = "";
+        child.stderr.on("data", function (chunk) {
+          if (done) return;
+          try {
+            seen = (seen + String(chunk)).slice(-8192);
+            var match = LISTENING.exec(seen);
+            if (match) announce(Number(match[1]));
+          } catch (e) { /* fail open */ }
+        });
+        child.stderr.on("error", function () { /* fail open */ });
+      }
+
+      // Fallback for a host that inherits stdio (no readable stderr): Chromium writes the
+      // chosen port into <user-data-dir>/DevToolsActivePort at CDP startup.
+      var udd = flagValue(args, UDD);
+      var started = Date.now();
+      if (udd) {
+        var portFile = path.join(udd, "DevToolsActivePort");
+        timer = setInterval(function () {
+          try {
+            if (fs.existsSync(portFile)) {
+              announce(Number(String(fs.readFileSync(portFile, "utf8")).split("\n")[0].trim()));
+            } else if (Date.now() - started > 20000) {
+              // NEVER raise this timeout: waiting longer cannot repair a broken launch
+              // contract; it only delays discovery of the real problem.
+              stopPolling();
+            }
+          } catch (e) { stopPolling(); }
+        }, 150);
+        if (timer.unref) timer.unref();
+      }
+
+      child.once("exit", function () {
+        done = true;
+        stopPolling();
+        try { fs.unlinkSync(announceFile); } catch (e) { /* already gone */ }
+      });
+    } catch (e) { /* fail open */ }
+  };
+} catch (e) { /* fail open */ }

package/remote/job-exec.py

@@ -0,0 +1,146 @@
+#!/usr/bin/python3
+"""Target endpoint of a machine's `exec` stream: one job with the pilot's descriptor numbers,
+terminal and wait status, leased on the pilot's heartbeat. The daemon runs it in the job's cgroup
+where one is delegated (execution.mjs), which is what contains descendants that call setsid().
+Named Unix sockets, SCM_RIGHTS, mmap/shared memory and general ioctls are unsupported.
+"""
+import base64, fcntl, json, os, pathlib, pty, queue, signal, socket, struct, sys, termios, threading, time
+from wire import Wire
+ident=sys.argv[1]
+assert len(ident)==32 and all(c in '0123456789abcdef' for c in ident)
+wire=Wire(sys.stdin.buffer,sys.stdout.buffer)
+message=wire.recv();assert message['type']=='start'
+request=message['request'];assert request['version']==1
+# The machine daemon that runs this endpoint names its jobs directory and owns the job.
+root=pathlib.Path(sys.argv[2]);root.mkdir(exist_ok=True)
+state=root/(ident+'.state.json')
+def record(**row):
+    temp=state.with_suffix('.next');temp.write_text(json.dumps(row));temp.replace(state)
+def send(row):
+    try: wire.send(row)
+    except (BrokenPipeError,OSError): pass
+inputs={};outputs={};mapping={};owned=[];duplex=set()
+tty_rows=[r for r in request['descriptors'] if r['tty']]
+master=slave=None
+if tty_rows:
+    master,slave=pty.openpty();owned.extend([master,slave])
+    fcntl.ioctl(slave,termios.TIOCSWINSZ,struct.pack('HHHH',*tty_rows[0]['size']))
+for row in request['descriptors']:
+    fd=row['fd']
+    if row['tty']:
+        mapping[fd]=slave
+        if row['read']: inputs[fd]=master
+        if row['write'] and master not in outputs.values(): outputs[fd]=master
+    elif row['read'] and row['write']:
+        a,b=socket.socketpair();parent=a.detach();child=b.detach();owned.extend([parent,child])
+        mapping[fd]=child;inputs[fd]=parent;outputs[fd]=parent;duplex.add(fd)
+    else:
+        r,w=os.pipe();owned.extend([r,w])
+        if row['read']: mapping[fd]=r;inputs[fd]=w
+        else: mapping[fd]=w;outputs[fd]=r
+# Reserve child sources above all destination descriptors before dup2 can clobber them.
+high=max([*mapping,20])+1
+copies={fd:fcntl.fcntl(src,fcntl.F_DUPFD_CLOEXEC,high) for fd,src in mapping.items()}
+pid=os.fork()
+if pid==0:
+    try:
+        os.setsid()
+        if slave is not None: fcntl.ioctl(slave,termios.TIOCSCTTY,0)
+        for fd,source in copies.items(): os.dup2(source,fd,inheritable=True)
+        for name in os.listdir('/proc/self/fd'):
+            fd=int(name)
+            if fd not in mapping:
+                try: os.close(fd)
+                except OSError: pass
+        os.chdir(request['cwd']);os.execve(request['path'],request['argv'],request['env'])
+    except BaseException as error:
+        try: os.write(2,('remote exec failed: '+str(error)+'\n').encode())
+        except OSError: pass
+        os._exit(127)
+keep=set(inputs.values())|set(outputs.values())
+for fd in set(owned+list(copies.values()))-keep: os.close(fd)
+record(pid=pid,status='running',lease_seconds=4)
+stopped=threading.Event();last_seen=time.monotonic();cancelled=None
+def group_alive():
+    # Linux process-group census excludes zombies. Escaped sessions are a named gap.
+    for path in pathlib.Path('/proc').glob('[0-9]*/stat'):
+        try:
+            fields=path.read_text().rsplit(')',1)[1].split()
+            if fields[0]!='Z' and int(fields[2])==pid: return True
+        except (OSError,ValueError,IndexError): pass
+    return False
+def signal_group(sig):
+    try: os.killpg(pid,sig)
+    except ProcessLookupError: pass
+def cancel(reason):
+    global cancelled
+    if cancelled is None:
+        cancelled=reason;signal_group(signal.SIGTERM)
+        def escalate():
+            time.sleep(.5)
+            if not stopped.is_set(): signal_group(signal.SIGKILL)
+        threading.Thread(target=escalate,daemon=True).start()
+def output_pump(fd,source):
+    try:
+        while True:
+            data=os.read(source,16384)
+            if not data: break
+            send({'type':'data','fd':fd,'data':base64.b64encode(data).decode()})
+    except OSError: pass
+readers=[]
+for fd,source in outputs.items():
+    t=threading.Thread(target=output_pump,args=(fd,source),daemon=True);t.start();readers.append(t)
+def waiter():
+    _,status=os.waitpid(pid,0);code=os.waitstatus_to_exitcode(status)
+    # A shell returning does not release its surviving background process group.
+    while group_alive(): time.sleep(.05)
+    for t in readers: t.join()
+    record(pid=pid,status='exited',exit_code=code,cancelled=cancelled)
+    stopped.set();send({'type':'exit','code':code});os._exit(0)
+def lease():
+    while not stopped.wait(.2):
+        if time.monotonic()-last_seen>4: cancel('lease-expired');return
+threading.Thread(target=waiter,daemon=True).start()
+threading.Thread(target=lease,daemon=True).start()
+# Per-descriptor credit keeps blocked application stdin from blocking the
+# control/heartbeat reader. Only one 16 KiB data chunk may be outstanding per FD.
+queues={number:queue.Queue(maxsize=2) for number in inputs}
+def input_worker(number,fd):
+    while True:
+        data=queues[number].get()
+        if data is None:
+            try:
+                if fd==master: os.write(fd,b'\x04')
+                elif number in duplex:
+                    s=socket.socket(fileno=os.dup(fd));s.shutdown(socket.SHUT_WR);s.close()
+                else: os.close(fd)
+            except OSError: pass
+            return
+        try:
+            while data: data=data[os.write(fd,data):]
+            send({'type':'credit','fd':number})
+        except OSError:
+            send({'type':'input-closed','fd':number});return
+for number,fd in inputs.items():
+    threading.Thread(target=input_worker,args=(number,fd),daemon=True).start()
+try:
+    while not stopped.is_set():
+        row=wire.recv();last_seen=time.monotonic();kind=row['type']
+        if kind=='data':
+            queues[row['fd']].put_nowait(base64.b64decode(row['data']))
+        elif kind=='eof':
+            queues[row['fd']].put_nowait(None)
+        elif kind=='signal':
+            if row['signal'] in [signal.SIGINT,signal.SIGTERM,signal.SIGHUP]:
+                signal_group(row['signal'])
+                if row['signal'] in [signal.SIGTERM,signal.SIGHUP]: cancel('client-signal')
+        elif kind=='resize' and master is not None:
+            fcntl.ioctl(master,termios.TIOCSWINSZ,struct.pack('HHHH',*row['size']));signal_group(signal.SIGWINCH)
+        elif kind=='close-output':
+            fd=outputs.pop(row['fd'],None)
+            if fd is not None and fd not in inputs.values():
+                try: os.close(fd)
+                except OSError: pass
+except (EOFError,OSError,ValueError): cancel('transport-lost')
+stopped.wait(8)
+if not stopped.is_set(): signal_group(signal.SIGKILL)

package/remote/wire.py

@@ -0,0 +1,23 @@
+"""Versioned bounded framing for the experimental SSH byte-stream transport."""
+import json, struct, threading
+LIMIT=1024*1024
+class Wire:
+    def __init__(self, reader, writer):
+        self.reader,self.writer=reader,writer
+        self.lock=threading.Lock()
+    def send(self, row):
+        data=json.dumps(row,separators=(',',':')).encode()
+        if len(data)>LIMIT: raise ValueError('frame too large')
+        with self.lock:
+            self.writer.write(struct.pack('!I',len(data))+data);self.writer.flush()
+    def exact(self,n):
+        chunks=[]
+        while n:
+            data=self.reader.read(n)
+            if not data: raise EOFError('transport closed')
+            chunks.append(data);n-=len(data)
+        return b''.join(chunks)
+    def recv(self):
+        n=struct.unpack('!I',self.exact(4))[0]
+        if n>LIMIT: raise ValueError('frame too large')
+        return json.loads(self.exact(n))

package/server/arc2-transactions.mjs

@@ -0,0 +1,125 @@
+function normalizeSearch(value) { return String(value ?? "").normalize("NFC").toLowerCase(); }
+function contentText(content) { return typeof content === "string" ? content : Array.isArray(content) ? content.filter((x) => x?.type === "text").map((x) => x.text).join("\n") : ""; }
+function fail(message, code, status) { throw Object.assign(new Error(message), { code, status }); }
+
+export function correlateSessions(db,args){
+  const {get,all,run}=db,now=args.now;
+  const membership=get('SELECT role,active FROM memberships WHERE team_id=? AND principal_id=?',[args.teamId,args.principalId]);
+  const credential=get('SELECT revoked_at,expires_at FROM credentials WHERE id=? AND principal_id=?',[args.credentialId,args.principalId]);
+  if(!membership?.active||!credential||credential.revoked_at!=null||(credential.expires_at!=null&&credential.expires_at<=now))fail('authorization changed','authentication_required',401);
+  const loadOrigin=(side)=>get(`SELECT s.*,o.source_id,o.native_id,src.custodian_id source_custodian
+    FROM sessions s JOIN origins o ON o.team_id=s.team_id AND o.session_id=s.id JOIN sources src ON src.team_id=o.team_id AND src.id=o.source_id
+    WHERE s.team_id=? AND o.source_id=? AND o.native_id=? AND o.harness=?`,[args.teamId,side.sourceId,side.nativeId,args.harness]);
+  const leftInput=loadOrigin(args.left),rightInput=loadOrigin(args.right);
+  if(!leftInput||!rightInput||leftInput.id===rightInput.id)fail('correlation origins do not identify two sessions','invalid_request',400);
+  if(leftInput.revision!==args.left.revision||rightInput.revision!==args.right.revision)fail('session revision changed','revision_mismatch',409);
+  if(leftInput.harness!==rightInput.harness||leftInput.harness!==args.harness)fail('correlation harness differs','invalid_request',400);
+  if(leftInput.source_custodian!==args.principalId||rightInput.source_custodian!==args.principalId||leftInput.source_custodian!==rightInput.source_custodian)fail('caller must be custodian of both sources','forbidden',403);
+  const sessions=all('SELECT * FROM sessions WHERE team_id=?',[args.teamId]),byId=new Map(sessions.map(row=>[row.id,row]));
+  const rootOf=(row)=>{const seen=new Set();while(row.canonical_id){if(seen.has(row.id))fail('correlation cycle','conflict',409);seen.add(row.id);row=byId.get(row.canonical_id);if(!row)fail('correlation root missing','conflict',409);}return row;};
+  const leftRoot=rootOf(leftInput),rightRoot=rootOf(rightInput);if(leftRoot.id===rightRoot.id)fail('sessions are already correlated','conflict',409);
+  const family=(root)=>sessions.filter(row=>rootOf(row).id===root.id);const members=[...family(leftRoot),...family(rightRoot)];
+  for(const member of members){const custodians=all('SELECT DISTINCT s.custodian_id FROM origins o JOIN sources s ON s.team_id=o.team_id AND s.id=o.source_id WHERE o.team_id=? AND o.session_id=?',[args.teamId,member.id]);if(custodians.some(row=>row.custodian_id!==args.principalId))fail('all constituent sources must share caller custody','forbidden',403);}
+  const manageable=(row)=>membership.role!=='viewer'&&(row.custodian_id===args.principalId||get(`SELECT 1 ok FROM session_grants g WHERE g.team_id=? AND g.session_id=? AND g.role='manager' AND (g.expires_at IS NULL OR g.expires_at>?) AND (g.subject_kind='principal' AND g.subject_id=? OR g.subject_kind='group' AND EXISTS (SELECT 1 FROM group_members gm WHERE gm.team_id=g.team_id AND gm.group_id=g.subject_id AND gm.principal_id=?))`,[args.teamId,row.id,now,args.principalId,args.principalId]));
+  if(members.some(row=>!manageable(row)))fail('caller must manage every constituent','forbidden',403);
+  if(members.some(row=>row.deleted_at!=null)){
+    const deletedAt=members.map(row=>row.deleted_at).filter(value=>value!=null).reduce((a,b)=>Math.min(a,b)),team=get('SELECT journal_revision FROM teams WHERE id=?',[args.teamId]),revision=team.journal_revision+1,canonical=rootOf(members.reduce((best,row)=>row.created_at<best.created_at?row:best,members[0]));
+    for(const member of members){run('UPDATE sessions SET deleted_at=?,revision=? WHERE team_id=? AND id=?',[deletedAt,revision,args.teamId,member.id]);run('UPDATE origins SET deleted_at=? WHERE team_id=? AND session_id=?',[deletedAt,args.teamId,member.id]);}
+    run('UPDATE teams SET journal_revision=?,auth_epoch=auth_epoch+1 WHERE id=?',[revision,args.teamId]);run('INSERT INTO journal(team_id,revision,session_id,kind,created_at) VALUES (?,?,?,?,?)',[args.teamId,revision,canonical.id,'delete',now]);run('INSERT INTO audit(team_id,id,actor_id,operation,target_id,outcome,revision,created_at) VALUES (?,?,?,?,?,?,?,?)',[args.teamId,args.auditId,args.principalId,args.operation,args.correlationId,'denied',revision,now]);return{tombstoned:true,revision,canonicalId:canonical.id};
+  }
+  const viewBySource=new Map();for(const row of members)for(const version of all('SELECT * FROM session_versions WHERE team_id=? AND session_id=? ORDER BY revision',[args.teamId,row.id])){const sourceId=JSON.parse(version.source_projection_json).source_id??'';if(sourceId&&(!viewBySource.has(sourceId)||version.revision>viewBySource.get(sourceId).revision))viewBySource.set(sourceId,{...row,...version,source_id:sourceId});}const views=[...viewBySource.values()];if(!views.length)fail('constituent projection missing','conflict',409);
+  const canonical=members.reduce((best,row)=>row.created_at<best.created_at||row.created_at===best.created_at&&row.id.localeCompare(best.id)<0?row:best,members[0]);
+  const rank=(row)=>{const p=JSON.parse(row.source_projection_json),d=JSON.parse(row.descriptor_json);return p.kind==='telemetry'?0:d.coverage?.completeness==='complete'?2:1;};
+  const primary=views.reduce((best,row)=>rank(row)>rank(best)||rank(row)===rank(best)&&String(row.source_id).localeCompare(String(best.source_id))<0?row:best,views[0]);
+  const team=get('SELECT journal_revision FROM teams WHERE id=?',[args.teamId]),revision=team.journal_revision+1;
+  const originSources=all(`SELECT DISTINCT source_id FROM origins WHERE team_id=? AND session_id IN (${members.map(()=>'?').join(',')})`,[args.teamId,...members.map(row=>row.id)]).map(row=>row.source_id);const descriptor={...JSON.parse(primary.descriptor_json),id:canonical.id,revision,source_ids:[...new Set(originSources)].sort()};
+  const comparable=new Map();let sourceConflict=false;for(const view of views)for(const message of all('SELECT native_key,value_json FROM messages WHERE team_id=? AND session_id=? AND revision=?',[args.teamId,view.id,view.revision])){if(!message.native_key)continue;const value=JSON.parse(message.value_json),semantic=JSON.stringify({role:value.role,content:value.content});const previous=comparable.get(message.native_key);if(previous!==undefined&&previous!==semantic)sourceConflict=true;else comparable.set(message.native_key,semantic);}if(sourceConflict)descriptor.coverage={...descriptor.coverage,reasons:[...new Set([...(descriptor.coverage?.reasons??[]),'source_conflict'])]};
+  for(const member of members)run('UPDATE sessions SET canonical_id=? WHERE team_id=? AND id=?',[member.id===canonical.id?null:canonical.id,args.teamId,member.id]);
+  run('UPDATE sessions SET revision=? WHERE team_id=? AND id=?',[revision,args.teamId,canonical.id]);
+  run('INSERT INTO correlations(team_id,id,left_session_id,right_session_id,canonical_id,policy_json,evidence_json,revision) VALUES (?,?,?,?,?,?,?,?)',[args.teamId,args.correlationId,leftInput.id,rightInput.id,canonical.id,JSON.stringify({reader:'all_constituents'}),JSON.stringify(args.evidence),revision]);
+  run('INSERT INTO session_versions(team_id,session_id,revision,descriptor_json,source_projection_json,search_title,sort_at,created_at) VALUES (?,?,?,?,?,?,?,?)',[args.teamId,canonical.id,revision,JSON.stringify(descriptor),primary.source_projection_json,primary.search_title,primary.sort_at,now]);
+  for(const m of all('SELECT * FROM messages WHERE team_id=? AND session_id=? AND revision=? ORDER BY ordinal',[args.teamId,primary.id,primary.revision]))run('INSERT INTO messages(team_id,session_id,revision,ordinal,id,source_id,native_key,recorded_at,value_json,search_text) VALUES (?,?,?,?,?,?,?,?,?,?)',[args.teamId,canonical.id,revision,m.ordinal,m.id,m.source_id,m.native_key,m.recorded_at,m.value_json,m.search_text]);
+  run('UPDATE teams SET journal_revision=?,auth_epoch=auth_epoch+1 WHERE id=?',[revision,args.teamId]);
+  run('INSERT INTO journal(team_id,revision,session_id,kind,created_at) VALUES (?,?,?,?,?)',[args.teamId,revision,canonical.id,'metadata',now]);
+  const response={version:1,context:args.context,data:descriptor};
+  if(args.idempotency)run('INSERT INTO idempotency(team_id,principal_id,route,key,request_digest,response_status,response_json,expires_at) VALUES (?,?,?,?,?,?,?,?)',[args.teamId,args.principalId,args.idempotency.route,args.idempotency.key,args.idempotency.requestDigest,200,JSON.stringify(response),now+86400000]);
+  run('INSERT INTO audit(team_id,id,actor_id,operation,target_id,outcome,revision,created_at) VALUES (?,?,?,?,?,?,?,?)',[args.teamId,args.auditId,args.principalId,args.operation,args.correlationId,'allowed',revision,now]);
+  return {revision,canonicalId:canonical.id,aliasIds:members.filter(row=>row.id!==canonical.id).map(row=>row.id),response};
+}
+export function ingestOtlpBatch(db, args) {
+  const { get, all, run } = db, now = args.receivedAt,authorizationNow=args.authorizationCheckedAt??now;
+  const authorized = get(`SELECT s.*,c.id credential_id,c.principal_id,m.active FROM credentials c JOIN sources s ON s.team_id=c.team_id AND s.id=c.source_id JOIN memberships m ON m.team_id=s.team_id AND m.principal_id=s.custodian_id WHERE c.id=? AND c.kind='ingest' AND c.team_id=? AND c.source_id=? AND c.revoked_at IS NULL AND (c.expires_at IS NULL OR c.expires_at>?) AND s.state='active' AND m.active=1`, [args.credentialId,args.teamId,args.sourceId,authorizationNow]);
+  if (!authorized) fail("source authorization changed", "authentication_required", 401);
+  const bySession = new Map(); let accepted = 0, duplicates = 0;
+  for (const item of args.items) {
+    const inserted = run('INSERT OR IGNORE INTO evidence(team_id,source_id,id,native_event_key,signal,raw_json,received_at,decode_state) VALUES (?,?,?,?,?,?,?,?)', [args.teamId,args.sourceId,item.evidenceId,item.nativeEventKey,item.signal,JSON.stringify(item.raw),now,item.decoded?.status ?? 'activity']);
+    if (!inserted.changes) { duplicates++; continue; }
+    accepted++;
+    const decoded = item.decoded;
+    if (!decoded?.native_session_id || !decoded.harness) continue;
+    let origin = get('SELECT * FROM origins WHERE team_id=? AND source_id=? AND harness=? AND native_id=?', [args.teamId,args.sourceId,decoded.harness,decoded.native_session_id]);
+    if (origin?.deleted_at != null) continue;
+    if (!origin) {
+      run('INSERT INTO sessions(team_id,id,harness,custodian_id,visibility,created_at) VALUES (?,?,?,?,?,?)', [args.teamId,item.proposedSessionId,decoded.harness,authorized.custodian_id,authorized.visibility,now]);
+      run('INSERT INTO origins(team_id,source_id,harness,native_id,session_id) VALUES (?,?,?,?,?)', [args.teamId,args.sourceId,decoded.harness,decoded.native_session_id,item.proposedSessionId]);
+      origin = { session_id: item.proposedSessionId };
+    }
+    const list = bySession.get(origin.session_id) ?? []; list.push(item); bySession.set(origin.session_id,list);
+  }
+  let journalRevision = get('SELECT journal_revision FROM teams WHERE id=?',[args.teamId]).journal_revision;
+  const changedSessions = [];
+  for (const [sessionId, items] of bySession) {
+    const session = get('SELECT * FROM sessions WHERE team_id=? AND id=?',[args.teamId,sessionId]);
+    if (!session || session.deleted_at != null) continue;
+    const prior = get("SELECT * FROM session_versions WHERE team_id=? AND session_id=? AND json_extract(source_projection_json,'$.source_id')=? ORDER BY revision DESC LIMIT 1",[args.teamId,sessionId,args.sourceId]);
+    const priorDescriptor = prior ? JSON.parse(prior.descriptor_json) : null;
+    const messages = items.filter((item) => item.decoded?.message);
+    journalRevision++;
+    const recordedValues = items.map((item) => item.decoded?.recorded_at).filter(Number.isSafeInteger);
+    const recordedAt = recordedValues.length ? Math.max(...recordedValues, priorDescriptor?.recorded_activity_at ?? 0) : priorDescriptor?.recorded_activity_at ?? null;
+    const reasons = new Set([...(priorDescriptor?.coverage?.reasons ?? []), ...items.flatMap((item) => item.decoded?.coverage_reasons ?? [])]);
+    if (items.some((item) => item.decoded?.status === 'decode_error')) reasons.add('parse_error');
+    const reportedUser=items.map(item=>item.decoded?.reported_user).find(Boolean)??priorDescriptor?.user?.reported_user??null;
+    const descriptor = priorDescriptor ?? { id:sessionId,title:null,harness:session.harness,user:{principal_id:null,reported_user:reportedUser,status:reportedUser?'reported':'unknown',mapping_id:null},repository:null,parent_id:null,continued_from:null,machine_ids:[],bindings:[],actions:{} };
+    descriptor.user={principal_id:null,reported_user:reportedUser,status:reportedUser?'reported':'unknown',mapping_id:null};
+    Object.assign(descriptor,{revision:journalRevision,recorded_activity_at:recordedAt,received_at:now,sort_at:recordedAt??now,activity_basis:recordedAt==null?'received':'recorded',source_ids:[...new Set([...(descriptor.source_ids??[]),args.sourceId])],coverage:{completeness:'partial',reasons:[...reasons],missing:descriptor.coverage?.missing??[]}});
+    run('UPDATE sessions SET revision=? WHERE team_id=? AND id=?',[journalRevision,args.teamId,sessionId]);
+    run('INSERT INTO session_versions(team_id,session_id,revision,descriptor_json,source_projection_json,search_title,sort_at,created_at) VALUES (?,?,?,?,?,?,?,?)',[args.teamId,sessionId,journalRevision,JSON.stringify(descriptor),JSON.stringify({source_id:args.sourceId,kind:'telemetry',native_session_id:items[0].decoded.native_session_id,decoder:items[0].decoded.decoder}),normalizeSearch(descriptor.title),descriptor.sort_at,now]);
+    let ordinal = 0;
+    if (prior) {
+      const priorMessages = all('SELECT * FROM messages WHERE team_id=? AND session_id=? AND revision=? ORDER BY ordinal',[args.teamId,sessionId,session.revision]);
+      for (const message of priorMessages) run('INSERT INTO messages(team_id,session_id,revision,ordinal,id,source_id,native_key,recorded_at,value_json,search_text) VALUES (?,?,?,?,?,?,?,?,?,?)',[args.teamId,sessionId,journalRevision,ordinal++,message.id,message.source_id,message.native_key,message.recorded_at,message.value_json,message.search_text]);
+    }
+    for (const item of messages) {
+      const decoded=item.decoded, nativeKey=decoded.identity?.native_event_id ?? item.evidenceId;
+      let messageId = decoded.identity?.native_event_id ? get('SELECT id FROM message_ids WHERE team_id=? AND source_id=? AND harness=? AND native_id=? AND native_key=?',[args.teamId,args.sourceId,decoded.harness,decoded.native_session_id,nativeKey])?.id : null;
+      if (messageId && get('SELECT 1 ok FROM messages WHERE team_id=? AND session_id=? AND revision=? AND native_key=?',[args.teamId,sessionId,journalRevision,nativeKey])) continue;
+      messageId ??= item.proposedMessageId;
+      if (decoded.identity?.native_event_id) run('INSERT OR IGNORE INTO message_ids(team_id,source_id,harness,native_id,native_key,id) VALUES (?,?,?,?,?,?)',[args.teamId,args.sourceId,decoded.harness,decoded.native_session_id,nativeKey,messageId]);
+      run('INSERT INTO messages(team_id,session_id,revision,ordinal,id,source_id,native_key,recorded_at,value_json,search_text) VALUES (?,?,?,?,?,?,?,?,?,?)',[args.teamId,sessionId,journalRevision,ordinal++,messageId,args.sourceId,nativeKey,decoded.recorded_at,JSON.stringify(decoded.message),normalizeSearch(contentText(decoded.message.content))]);
+    }
+    run('INSERT INTO journal(team_id,revision,session_id,kind,created_at) VALUES (?,?,?,?,?)',[args.teamId,journalRevision,sessionId,'capture',now]); changedSessions.push({sessionId,revision:journalRevision});
+  }
+  const refreshed=new Set();
+  for(const change of [...changedSessions]){
+    const changed=get('SELECT * FROM sessions WHERE team_id=? AND id=?',[args.teamId,change.sessionId]),canonicalId=changed?.canonical_id??changed?.id;if(!canonicalId||refreshed.has(canonicalId))continue;
+    const family=all('SELECT * FROM sessions WHERE team_id=? AND (id=? OR canonical_id=?)',[args.teamId,canonicalId,canonicalId]);if(family.length<2)continue;refreshed.add(canonicalId);
+    const viewBySource=new Map();for(const member of family)for(const version of all('SELECT * FROM session_versions WHERE team_id=? AND session_id=? ORDER BY revision',[args.teamId,member.id])){const sourceId=JSON.parse(version.source_projection_json).source_id??'';if(sourceId&&(!viewBySource.has(sourceId)||version.revision>viewBySource.get(sourceId).revision))viewBySource.set(sourceId,{...member,...version});}const views=[...viewBySource.values()];
+    const rank=row=>{const p=JSON.parse(row.source_projection_json),d=JSON.parse(row.descriptor_json);return p.kind==='telemetry'?0:d.coverage?.completeness==='complete'?2:1;};
+    const source=row=>JSON.parse(row.source_projection_json).source_id??'';
+    const primary=views.reduce((best,row)=>rank(row)>rank(best)||rank(row)===rank(best)&&(source(row).localeCompare(source(best))<0||source(row)===source(best)&&row.revision>best.revision)?row:best,views[0]);
+    const canonical=get('SELECT * FROM sessions WHERE team_id=? AND id=?',[args.teamId,canonicalId]);if(primary.id===canonicalId&&primary.revision===canonical.revision)continue;
+    journalRevision++;const originSources=all(`SELECT DISTINCT source_id FROM origins WHERE team_id=? AND session_id IN (${family.map(()=>'?').join(',')})`,[args.teamId,...family.map(row=>row.id)]).map(row=>row.source_id);const descriptor={...JSON.parse(primary.descriptor_json),id:canonicalId,revision:journalRevision,source_ids:[...new Set(originSources)].sort()};
+    run('UPDATE sessions SET revision=? WHERE team_id=? AND id=?',[journalRevision,args.teamId,canonicalId]);
+    run('INSERT INTO session_versions(team_id,session_id,revision,descriptor_json,source_projection_json,search_title,sort_at,created_at) VALUES (?,?,?,?,?,?,?,?)',[args.teamId,canonicalId,journalRevision,JSON.stringify(descriptor),primary.source_projection_json,primary.search_title,primary.sort_at,now]);
+    for(const m of all('SELECT * FROM messages WHERE team_id=? AND session_id=? AND revision=? ORDER BY ordinal',[args.teamId,primary.id,primary.revision]))run('INSERT INTO messages(team_id,session_id,revision,ordinal,id,source_id,native_key,recorded_at,value_json,search_text) VALUES (?,?,?,?,?,?,?,?,?,?)',[args.teamId,canonicalId,journalRevision,m.ordinal,m.id,m.source_id,m.native_key,m.recorded_at,m.value_json,m.search_text]);
+    run('INSERT INTO journal(team_id,revision,session_id,kind,created_at) VALUES (?,?,?,?,?)',[args.teamId,journalRevision,canonicalId,'capture',now]);changedSessions.push({sessionId:canonicalId,revision:journalRevision});
+  }
+  const currentCounters = JSON.parse(authorized.counters_json ?? '{}');
+  const counters = { ...currentCounters, accepted:(currentCounters.accepted??0)+accepted, rejected:(currentCounters.rejected??0)+(args.rejectedCount??0), duplicates:(currentCounters.duplicates??0)+duplicates };
+  const decoder = args.items.map((item)=>item.decoded?.decoder).find(Boolean) ?? authorized.decoder;
+  const lastError=(args.rejectedCount??0)>0?`${args.rejectedCount} OTLP evidence unit(s) rejected`:null;
+  run('UPDATE sources SET last_received_at=?,decoder=?,counters_json=?,last_error=? WHERE team_id=? AND id=?',[now,decoder,JSON.stringify(counters),lastError,args.teamId,args.sourceId]);
+  if (changedSessions.length) run('UPDATE teams SET journal_revision=? WHERE id=?',[journalRevision,args.teamId]);
+  return { accepted, duplicates, changedSessions, counters };
+}