@volter/supercode-teams 0.2.21 → 0.2.23

package/bin/workspace/roots.mjs

@@ -0,0 +1,48 @@
+import { realpathSync } from 'node:fs';
+import { homedir } from 'node:os';
+import { dirname, isAbsolute, relative, resolve, sep } from 'node:path';
+
+const canonical = path => { try { return realpathSync.native(path); } catch { return resolve(path); } };
+const folded = (path, platform) => platform === 'win32' || platform === 'darwin' ? path.toLowerCase() : path;
+const contains = (outer, inner) => { const name = relative(outer, inner); return name === '' || (!isAbsolute(name) && name !== '..' && !name.startsWith('..' + sep)); };
+
+/**
+ * Why connecting `path` as a Teams sync root would share every session on this machine, or null.
+ * A rule covers its root and every folder under it, so a filesystem or drive root, the user's home, or
+ * a folder holding the home (`/Users`, `C:\Users`) publishes everything the harnesses ever recorded.
+ */
+export function broadRootReason(path, { home = homedir(), platform = process.platform } = {}) {
+  const root = canonical(path);
+  if (dirname(root) === root) return 'a filesystem root';
+  if (!home) return null;
+  const user = canonical(home);
+  if (folded(root, platform) === folded(user, platform)) return 'your home directory';
+  if (contains(folded(root, platform), folded(user, platform))) return 'a folder that holds your home directory';
+  return null;
+}
+
+/**
+ * How `teams connect` registers `path`: the fields its saved root carries.
+ * - An ordinary folder: `{}` (the rule covers the folder and every folder under it).
+ * - A broad root with --force, or one accepted with --force before: `{ broad_accepted: true }`.
+ * - A broad root this enrollment already had before rules covered subfolders (saved without
+ *   `broad_accepted`), rerun without a terminal by the background service: `{ exact_only: true }`. It keeps
+ *   syncing only sessions recorded in that exact folder, as it did, and says so on stderr; refusing it
+ *   would silently stop the machine's sync.
+ * - Otherwise a broad root is refused.
+ */
+export function connectRootScope(path, { force = false, saved = null, interactive = false, warn = message => process.stderr.write(message), ...options } = {}) {
+  const previous = saved?.roots?.find(item => item.path === path) ?? null;
+  const reason = refuseBroadRoot(path, { force, accepted: Boolean(previous?.broad_accepted) || (Boolean(previous) && !interactive), ...options });
+  if (!reason) return {};
+  if (force || previous?.broad_accepted) return { broad_accepted: true };
+  warn(`supercode teams: ${path} is ${reason}. Its sync rules keep sharing only sessions recorded in that exact folder; sessions in its subfolders are not shared. To share every session under it, run \`supercode teams connect --force\` from that folder.\n`);
+  return { exact_only: true };
+}
+
+/** Refuse a broad root unless the caller passed --force (or accepted this same root before). */
+export function refuseBroadRoot(path, { force = false, accepted = false, verb = 'connect', ...options } = {}) {
+  const reason = broadRootReason(path, options);
+  if (!reason || force || accepted) return reason;
+  throw Object.assign(new Error(`refusing to ${verb} ${path}: it is ${reason}, and a Teams sync rule covers every session whose working directory is that folder or any folder under it, so it would share every session on this machine. Choose a project folder, or pass --force to share them all.`), { code: 'invalid_request', exitCode: 2 });
+}

package/bin/workspace/sync-status.mjs

@@ -0,0 +1,20 @@
+// How `supercode teams status` and `supercode auth status` show what this machine's connector could not sync
+// (connector/index.mjs readSyncStatus): the sessions not syncing and why, most recent first, and its last error.
+const SHOWN = 10;
+const when = at => Number.isFinite(at) ? new Date(at).toISOString().replace(/\.\d{3}Z$/, 'Z') : 'unknown time';
+const reason = item => `${item.code ? `${item.code}: ` : ''}${item.message}`;
+
+/** Human lines for a connector's sync status, each without a trailing newline; `indent` prefixes the detail lines. */
+export function syncStatusLines(sync, { indent = '  ' } = {}) {
+  if (!sync) return [];
+  const lines = [];
+  const problems = sync.not_syncing ?? [];
+  if (problems.length) {
+    lines.push(`Not syncing (${problems.length} session${problems.length === 1 ? '' : 's'}, most recent first):`);
+    for (const item of problems.slice(0, SHOWN)) lines.push(`${indent}${item.harness} ${item.session_id}${item.rule_id ? ` · ${item.rule_id}` : ''} · ${when(item.at)} · ${reason(item)}`);
+    if (problems.length > SHOWN) lines.push(`${indent}… and ${problems.length - SHOWN} more (--json lists them all)`);
+  } else lines.push('Not syncing  none');
+  if (sync.queued_captures) lines.push(`Queued   ${sync.queued_captures} capture${sync.queued_captures === 1 ? '' : 's'} waiting for the server`);
+  if (sync.last_error) lines.push(`Last error ${when(sync.last_error.at)} · ${reason(sync.last_error)}`);
+  return lines;
+}

package/bin/workspace.mjs

@@ -9,7 +9,8 @@ import { WorkspaceContexts, fromContext, loginContext } from '../context.mjs';
 import { productionIds } from '@volter/teams/server/core';
 import { makeToken } from '@volter/teams/server/auth';
 import { moveWorkspace } from '../workspace-move.mjs';
-import { TeamsConnector } from '../connector/index.mjs';
+import { TeamsConnector, readSyncStatus } from '../connector/index.mjs';
+import { syncStatusLines } from './workspace/sync-status.mjs';
 import { CONTINUATION_FIDELITY, CONTINUATION_HARNESSES } from '../connector/native-continuation.mjs';
 import { TeamsMachine } from '../machine.mjs';
 import { teamsHome, paths } from '@volter/teams/home';
@@ -21,6 +22,7 @@ import { volterDeviceSignIn } from './workspace/volter-device.mjs';
 import { loginSummary, signInToTeams } from './workspace/volter-login.mjs';
 import { readSharedSignIn, signOut } from '@volter/identity';
 import { createInterface } from 'node:readline/promises';
+import { connectRootScope, refuseBroadRoot } from './workspace/roots.mjs';
 
 const ERROR_EXITS = { invalid_request: 2, ambiguous_reference: 2, authentication_required: 3, not_found: 4, forbidden: 4, unsupported: 5, machine_offline: 5, controller_busy: 6, conflict: 6, resync_required: 6, revision_mismatch: 6, idempotency_conflict: 6, batch_gap: 6, capture_conflict: 6, source_paused: 6 };
 
@@ -204,7 +206,7 @@ async function authCommand({ flags, sub = 'status', rest, home, contexts, output
     if (account.context) {
       const command = authTeamCommand(home, account.context, flags, output, env);
       const enrollment = command.state().read();
-      account.machine = enrollment?.machine ? { id: enrollment.machine.id, name: enrollment.machine.name, folder: enrollment.roots?.[0]?.path ?? null, service: enrollment.service?.kind ?? null, connection: null } : null;
+      account.machine = enrollment?.machine ? { id: enrollment.machine.id, name: enrollment.machine.name, folder: enrollment.roots?.[0]?.path ?? null, service: enrollment.service?.kind ?? null, connection: null, sync: readSyncStatus(command.state().directory) ?? { not_syncing: [], last_error: null, queued_captures: 0 } } : null;
       try { await command.client.me(); account.reachable = true; } catch { account.reachable = false; }
       if (account.machine && account.reachable) account.machine.connection = (await command.team.machines.get(account.machine.id).catch(() => null))?.data?.connection ?? null;
     }
@@ -213,6 +215,9 @@ async function authCommand({ flags, sub = 'status', rest, home, contexts, output
     if (!account.context) return say(account.others.length ? `Team     none current · saved: ${account.others.join(', ')} (supercode auth switch NAME)` : 'Team     none (supercode login)');
     say(`Team     ${account.team} · ${new URL(account.origin).host}${account.reachable ? '' : ' · unreachable'}${account.others.length ? ` · also: ${account.others.join(', ')} (supercode auth switch)` : ''}`);
     say(account.machine ? `Machine  ${account.machine.name} · ${account.machine.connection ?? 'unknown'} · sharing ${account.machine.folder ?? '?'}${account.machine.service ? ` (${account.machine.service})` : ' (runs while `teams connect` does)'}` : 'Machine  not connected (supercode teams connect)');
+    // Only trouble (a session not syncing, an error in the last day) is worth lines here; `teams status` shows the rest.
+    const sync = account.machine?.sync;
+    if (sync?.not_syncing.length || sync?.last_error?.at > Date.now() - 86_400_000) for (const line of syncStatusLines(sync)) say(line);
     return;
   }
   if (sub === 'switch') {
@@ -607,6 +612,7 @@ async function syncCommand(sub, { flags, rest, output, client, context, team, ho
     if (!enrollment?.machine?.id) unsupported('this context has no connector enrollment');
     const path = realpathSync(resolve(flags.repo)), root = enrollment.roots?.find(item => item.path === path);
     if (!root) unsupported('the connector has not registered that repository root; restart connect with --cwd PATH');
+    refuseBroadRoot(path, { force: flags.force, verb: 'sync' });
     if (flags.harness && !root.harnesses.includes(flags.harness)) unsupported(`the native core does not report a ${flags.harness} discovery adapter`);
     return output(await team.syncRules.create({ machine_id: enrollment.machine.id, source_id: enrollment.source.id, selector: { root_id: root.id, harnesses: flags.harness ? [flags.harness] : root.harnesses }, visibility: flags.visibility ?? 'restricted', backfill: backfill(flags.backfill ?? 'none') }));
   }
@@ -623,9 +629,26 @@ async function syncCommand(sub, { flags, rest, output, client, context, team, ho
 
 async function connectorCommand(verb, { flags, rest, output, client, context, team, contextName }, home) {
   requireArgs(rest, 0, 0, `teams ${verb}`); const state = new WorkspaceContexts(home).connector(context.server_id, context.team_id);
-  if (verb === 'status') { let reachable = true; let account = null; try { account = await client.me(); } catch { reachable = false; } const saved = state.read(); const running = saved?.process?.socket ? await activeSocket(saved.process.socket) : false; return output({ version: 1, context: scope(context), data: { reachable, account, connector: saved ? { enrolled: true, running, machine: saved.machine, source: saved.source } : { enrolled: false, running: false }, sources: reachable ? (await team.sources.list()).items : [] } }); }
+  if (verb === 'status') {
+    let reachable = true; let account = null; try { account = await client.me(); } catch { reachable = false; }
+    const saved = state.read(); const running = saved?.process?.socket ? await activeSocket(saved.process.socket) : false;
+    // What the connector could not sync, as it last wrote it to its state (it is written while it runs).
+    const sync = saved ? readSyncStatus(state.directory) ?? { not_syncing: [], last_error: null, queued_captures: 0 } : null;
+    const value = { version: 1, context: scope(context), data: { reachable, account, connector: saved ? { enrolled: true, running, machine: saved.machine, source: saved.source, sync } : { enrolled: false, running: false }, sources: reachable ? (await team.sources.list()).items : [] } };
+    if (flags.json) return output(value);
+    const lines = [`Team       ${context.team_name ?? context.team_id} · ${new URL(context.origin).host}${reachable ? '' : ' · unreachable'}`];
+    lines.push(saved?.machine ? `Connector  ${saved.machine.name ?? saved.machine.id} · ${running ? 'running' : 'not running'}${saved.service?.kind ? ` (${saved.service.kind})` : ''}` : 'Connector  not connected (supercode teams connect)');
+    lines.push(...syncStatusLines(sync));
+    process.stdout.write(`${lines.join('\n')}\n`);
+    return;
+  }
   if (verb === 'connect') {
     let saved = state.read();
+    const path = realpathSync(resolve(flags.cwd ?? '.'));
+    // A broad root is refused before enrolling anything. The service reruns connect without a terminal, and
+    // without --force, for the root accepted here; a broad root enrolled before rules covered subfolders keeps
+    // its exact-folder sync there.
+    const rootScope = connectRootScope(path, { force: flags.force, saved, interactive: Boolean(process.stdin.isTTY && process.stdout.isTTY) });
     if (!saved) { const enrollment_key = crypto.randomUUID(); saved = { version: 1, enrollment_key, phase: 'enrolling' }; state.write(saved); }
     if (!saved.machine) {
       const response = await team.machines.create({ name: flags.name ?? hostname(), enrollment_key: saved.enrollment_key });
@@ -640,8 +663,7 @@ async function connectorCommand(verb, { flags, rest, output, client, context, te
     try { support = await core.supportReport(); } catch (error) { core.close(); throw error; }
     const harnesses = [...new Set((support.harnesses ?? []).map(item => item.id).filter(id => typeof id === 'string'))];
     if (!harnesses.length) { core.close(); unsupported('the native core reported no discoverable harness adapters'); }
-    const path = realpathSync(resolve(flags.cwd ?? '.'));
-    const root = { id: `root_${createHash('sha256').update(`${saved.machine.id}\0${path}`).digest('hex').slice(0, 32)}`, machine_id: saved.machine.id, name: basename(path), harnesses, path };
+    const root = { id: `root_${createHash('sha256').update(`${saved.machine.id}\0${path}`).digest('hex').slice(0, 32)}`, machine_id: saved.machine.id, name: basename(path), harnesses, path, ...rootScope };
     saved = state.update(current => ({ ...current, roots: [root] }));
     // Run from a terminal, connect installs the service that keeps this machine connected (launchd or systemd) and
     // returns; the service itself runs connect without a terminal, in the foreground. --foreground runs it here.
@@ -676,6 +698,7 @@ async function connectorCommand(verb, { flags, rest, output, client, context, te
     const hostKeyId = publicKeyId(loadOrCreateKeyPair(paths(daemonHome).machineKey).publicKeyPem);
     const connector = new TeamsConnector({ server: context.origin, teamId: context.team_id, machineId: saved.machine.id, sourceId: saved.source.id, credential: saved.credential.token, stateDir: state.directory, core, hostKeyId });
     const machine = new TeamsMachine({ home: daemonHome, supercode: binary, ...(flags.tmux_socket ? { tmuxSocket: String(flags.tmux_socket) } : {}), link: { server: context.origin, teamId: context.team_id, machineId: saved.machine.id, credential: saved.credential.token, incarnationId: connector.state.incarnation_id, configuration: () => connector.configuration() } });
+    machine.on('link', (event) => { if (event.event === 'replaced') process.stderr.write(`supercode teams: ${event.error}. Two connectors were running for this machine; stop one of them (\`supercode teams disconnect\` where it should not run).\n`); });
     const stopAll = async () => { await machine.stop().catch(() => {}); await connector.stop(); await core.close(); await lifecycle.close(); state.update(current => current ? ({ ...current, process: undefined }) : null); };
     try { await connector.start({ roots: () => saved.roots }); await machine.start(); } catch (error) { await stopAll(); throw error; }
     output({ version: 1, context: scope(context), data: { machine: saved.machine, source: saved.source, roots: saved.roots.map(({ path: _path, ...item }) => item), socket: machine.socketPath, foreground: true } });

package/connector/index.d.ts

@@ -57,10 +57,17 @@ export interface ConnectorConfigurationValue {
   authorization_revision: number;
 }
 
+export interface SyncErrorSummary { code: string | null; message: string; at: number }
+export interface SyncProblem extends SyncErrorSummary { harness: string; session_id: string; rule_id: string | null }
+/** What `supercode teams status` shows: sessions not syncing (most recent first) and the last error; null without state. */
+export declare function readSyncStatus(stateDir: string): { not_syncing: SyncProblem[]; last_error: SyncErrorSummary | null; queued_captures: number } | null;
+
 export declare class TeamsConnector {
   constructor(options: TeamsConnectorOptions);
   readonly lastError?: unknown;
   configuration(): Promise<ConnectorConfigurationValue>;
+  /** Resolves when the first sync pass after `start` ends (rejects if it failed; the connector keeps running). `start` returns after the first heartbeat, without waiting for it. */
+  firstPass?: Promise<void> | null;
   start(options?: { bindings?: () => unknown | Promise<unknown>; roots?: () => Array<{ id: string; machine_id: string; name: string; harnesses: HarnessId[]; path?: string; workspace?: string; homes?: unknown }> | Promise<Array<{ id: string; machine_id: string; name: string; harnesses: HarnessId[]; path?: string; workspace?: string; homes?: unknown }>> }): Promise<ConnectorConfigurationValue>;
   capture(options: CaptureOptions): Promise<CaptureReceipt | null>;
   flush(): Promise<CaptureReceipt | null>;

package/connector/index.mjs

@@ -5,6 +5,39 @@ import { canonicalJson } from '../contracts/index.mjs';
 import { EffectConsumer } from './effects.mjs';
 import { NativeEffects } from './native-effects.mjs';
 
+const SYNC_PROBLEM_LIMIT=20;
+const errorSummary=(error,at)=>error==null?null:{code:typeof error.code==='string'?error.code:null,message:String(error.message??error).slice(0,500),at};
+/** The sync status a connector keeps in its state directory (see TeamsConnector#syncStatus); null when it has none. */
+export function readSyncStatus(stateDir){
+  let state;try{state=JSON.parse(readFileSync(join(stateDir,'connector.json'),'utf8'));}catch{return null;}
+  const status=state?.sync_status;
+  return {not_syncing:Array.isArray(status?.problems)?status.problems:[],last_error:status?.last_error??null,queued_captures:Array.isArray(state?.outbox)?state.outbox.length:0};
+}
+// A tool call still running when the core reads a session has no result yet; the core answers it with a synthesized
+// placeholder (crates/interchange session/helpers.rs ensure_tool_results_paired: a `tool` message for that call id,
+// right after the assistant message that made the call, marked `sc.tool_error`, whose only distinct trait is its
+// text), and the real result replaces it at the same position once it is written. So a `none` rule that first sees
+// a session mid tool call keeps back history whose last positions will change. Rather than match the placeholder's
+// text, the kept-back history is identified by its shape: the trailing run of tool results and the call ids they
+// answer (recorded when the rule starts). A later rewrite confined to that run, answering the same calls of the
+// unchanged assistant message before it, is the same history settling: it stays kept back and is never published.
+const trailingToolResults=messages=>{
+  let from=messages.length;while(from>0&&messages[from-1].value?.role==='tool'&&typeof messages[from-1].value.tool_call_id==='string')from--;
+  return from===messages.length||from===0?null:{from,call_ids:messages.slice(from).map(message=>message.value.tool_call_id)};
+};
+// The kept-back digests after such a settled rewrite, or null when the kept-back history changed in any other way.
+// A baseline recorded before its tool tail was (baseline_tool_tail absent) takes the tail from the current messages.
+function settledToolTail(previous,messages){
+  const baseline=previous.baseline,count=baseline.length,digestOf=message=>hash(canonicalJson(message.value));
+  if(messages.length<count||baseline.some((native_key,index)=>messages[index].native_key!==native_key))return null;
+  const tail=previous.baseline_tool_tail??trailingToolResults(messages.slice(0,count));
+  if(!tail||!Number.isSafeInteger(tail.from)||tail.from<1||tail.from+tail.call_ids.length!==count)return null;
+  for(let index=0;index<tail.from;index++)if(digestOf(messages[index])!==previous.baseline_digests?.[index])return null;
+  const run=messages.slice(tail.from,count),ids=run.map(message=>message.value?.role==='tool'?message.value.tool_call_id:null);
+  const calls=new Set((messages[tail.from-1].value?.tool_calls??[]).map(call=>call?.id).filter(id=>typeof id==='string'));
+  if(ids.some(id=>typeof id!=='string'||!calls.has(id))||new Set(ids).size!==ids.length||[...ids].sort().join('\0')!==[...tail.call_ids].sort().join('\0'))return null;
+  return messages.slice(0,count).map(digestOf);
+}
 const hash=value=>createHash('sha256').update(value).digest('hex');
 const recordedAt=entry=>{if(Number.isSafeInteger(entry.recorded_at))return entry.recorded_at;if(Number.isSafeInteger(entry.timestamp))return entry.timestamp;const value=entry.metadata?.timestamp??entry.value?.metadata?.timestamp??entry.timestamp;if(typeof value!=='string')return null;const parsed=Date.parse(value);return Number.isSafeInteger(parsed)?parsed:null;};
 const serverOrigin=value=>{const url=new URL(value),loopback=url.hostname==='localhost'||url.hostname==='::1'||url.hostname==='[::1]'||/^127(?:\.\d{1,3}){3}$/.test(url.hostname);if(!['http:','https:'].includes(url.protocol)||url.username||url.password||url.search||url.hash||(url.pathname!==''&&url.pathname!=='/')||(url.protocol==='http:'&&!loopback))throw new TypeError('server must be an HTTPS origin (HTTP is loopback-only)');return url.origin;};
@@ -25,34 +58,81 @@ function atomic(path, value) {
 }
 export class TeamsConnector {
   constructor({server,teamId,machineId,sourceId,credential,stateDir,core,hostKeyId=null,effectExecutor=null,clock={nowMs:()=>Date.now()},fetch:fetchImpl=globalThis.fetch}){Object.assign(this,{server:serverOrigin(server),teamId,machineId,sourceId,credential,stateDir,core,hostKeyId,effectExecutor,clock,fetch:fetchImpl});mkdirSync(stateDir,{recursive:true,mode:0o700});chmodSync(stateDir,0o700);this.statePath=join(stateDir,'connector.json');this.state=existsSync(this.statePath)?JSON.parse(readFileSync(this.statePath,'utf8')):{version:1,sequence:0,origins:{},outbox:[]};this.state.effects??={};this.state.incarnation_id=`inc_${randomBytes(16).toString('hex')}`;this.abort=new AbortController();this.work=Promise.resolve();this.nativeEffects=new NativeEffects(this);this.effects=new EffectConsumer(this,effectExecutor?{prepare:async effect=>({execute:()=>effectExecutor(effect,{core:this.core,signal:this.abort.signal})})}:this.nativeEffects);this.save();}
-  save(){atomic(this.statePath,this.state);} async request(method,path,body){const json=body===undefined?undefined:JSON.stringify(body),mutation=['POST','PATCH','DELETE'].includes(method);const response=await this.fetch(this.server+`/api/v1/teams/${this.teamId}`+path,{method,redirect:'manual',headers:{Authorization:`Bearer ${this.credential}`,'Content-Type':'application/json',...(mutation?{'Idempotency-Key':hash(`${method}\n${path}\n${json??''}`)}:{})},body:json,signal:this.abort.signal});if(response.type==='opaqueredirect'||response.status>=300&&response.status<400)throw Object.assign(new Error('cross-origin redirects are refused'),{code:'invalid_request',status:400});const value=await response.json();if(!response.ok)throw Object.assign(new Error(value.error?.message??`HTTP ${response.status}`),value.error,{status:response.status});return value.data;}
-  async configuration(){const value=await this.request('GET',`/machines/${this.machineId}/configuration`);this.configurationValue=value;return value;}
+  save(){atomic(this.statePath,this.state);}
+  // What `supercode teams status` shows about this connector: its last error, and the sessions it could not capture
+  // (most recent first, bounded; an entry clears when that session next captures). They are kept in connector.json,
+  // so another process reads them while this one runs; the error itself stays in memory as lastError.
+  get lastError(){return this.lastErrorValue;}
+  set lastError(error){this.lastErrorValue=error;this.syncStatus().last_error=errorSummary(error,this.clock.nowMs());this.saveQuietly();}
+  syncStatus(){const status=this.state.sync_status??={problems:[],last_error:null};status.problems??=[];return status;}
+  saveQuietly(){try{this.save();}catch{}}
+  noteSessionProblem({harness,nativeSessionId,ruleId=null},error){
+    const status=this.syncStatus(),at=this.clock.nowMs();
+    status.problems=[{harness,session_id:nativeSessionId,rule_id:ruleId,...errorSummary(error,at)},...status.problems.filter(item=>!(item.harness===harness&&item.session_id===nativeSessionId))].slice(0,SYNC_PROBLEM_LIMIT);
+    this.lastError=error;
+  }
+  clearSessionProblem(harness,nativeSessionId){
+    const status=this.state.sync_status;if(!status?.problems?.some(item=>item.harness===harness&&item.session_id===nativeSessionId))return;
+    status.problems=status.problems.filter(item=>!(item.harness===harness&&item.session_id===nativeSessionId));this.saveQuietly();
+  } async request(method,path,body){const json=body===undefined?undefined:JSON.stringify(body),mutation=['POST','PATCH','DELETE'].includes(method);let response;for(let attempt=0;;attempt++){response=await this.fetch(this.server+`/api/v1/teams/${this.teamId}`+path,{method,redirect:'manual',headers:{Authorization:`Bearer ${this.credential}`,'Content-Type':'application/json',...(mutation?{'Idempotency-Key':hash(`${method}\n${path}\n${json??''}`)}:{})},body:json,signal:this.abort.signal});
+    // A rate limit is waited out (the server says how long; the same idempotency key makes the retry safe), so a
+    // large first sync slows down instead of failing its pass and restarting the connector.
+    if(response.status!==429||attempt>=5)break;// The server names the wait in error.details (wire.mjs validationFailure); a Retry-After header is the fallback.
+    const limited=await response.json().catch(()=>null),named=limited?.error?.details?.retry_after_seconds??limited?.error?.retry_after_seconds??response.headers?.get?.('retry-after'),asked=named==null||named===''?NaN:Number(named),seconds=Number.isFinite(asked)?Math.min(60,Math.max(0,asked)):1;
+    await new Promise((resolve,reject)=>{const stop=()=>{clearTimeout(timer);reject(this.abort.signal.reason);},timer=setTimeout(()=>{this.abort.signal.removeEventListener('abort',stop);resolve();},seconds*1000);this.abort.signal.addEventListener('abort',stop,{once:true});});}if(response.type==='opaqueredirect'||response.status>=300&&response.status<400)throw Object.assign(new Error('cross-origin redirects are refused'),{code:'invalid_request',status:400});const value=await response.json();if(!response.ok)throw Object.assign(new Error(value.error?.message??`HTTP ${response.status}`),value.error,{status:response.status});return value.data;}
+  async configuration(){const value=await this.request('GET',`/machines/${this.machineId}/configuration`);this.configurationValue=value;this.pruneStamps(value);return value;}
+  // A capture stamp belongs to one rule; once that rule is no longer active its stamps are dropped.
+  pruneStamps(configuration){
+    if(!Array.isArray(configuration?.rules))return;
+    const active=new Set(configuration.rules.filter(rule=>rule.state==='active').map(rule=>rule.id));let pruned=false;
+    for(const origin of Object.values(this.state.origins??{}))for(const ruleId of Object.keys(origin?.capture_stamps??{}))if(!active.has(ruleId)){delete origin.capture_stamps[ruleId];pruned=true;}
+    // A session that stopped syncing under a rule no longer active is no longer that rule's problem.
+    const problems=this.state.sync_status?.problems;
+    if(problems?.some(item=>item.rule_id&&!active.has(item.rule_id))){this.state.sync_status.problems=problems.filter(item=>!item.rule_id||active.has(item.rule_id));pruned=true;}
+    if(pruned)this.save();
+  }
   async start({bindings=()=>[],roots=()=>[]}={}) {
     await this.configuration();
-    const heartbeat = async () => {
-      this.state.sequence += 1;
-      await this.request('POST', `/machines/${this.machineId}/heartbeat`, {
-        incarnation_id: this.state.incarnation_id, sequence: this.state.sequence,
-        bindings: [...this.nativeEffects.published(), ...await bindings()],
-        roots: this.localRoots.map(({id,machine_id,name,harnesses})=>({id,machine_id,name,harnesses})),
-        ...(this.hostKeyId ? { host_key_id: this.hostKeyId } : {}),
+    // Heartbeats are serialized (the server takes each sequence number once) and run on their own
+    // timer: a long sync pass (a large first capture) never makes a live machine read as offline.
+    let beating = Promise.resolve();
+    const heartbeat = () => {
+      const next = beating.then(async () => {
+        this.state.sequence += 1;
+        await this.request('POST', `/machines/${this.machineId}/heartbeat`, {
+          incarnation_id: this.state.incarnation_id, sequence: this.state.sequence,
+          bindings: [...this.nativeEffects.published(), ...await bindings()],
+          roots: this.localRoots.map(({id,machine_id,name,harnesses})=>({id,machine_id,name,harnesses})),
+          ...(this.hostKeyId ? { host_key_id: this.hostKeyId } : {}),
+        });
+        this.save();
       });
-      this.save();
+      beating = next.catch(() => {});
+      return next;
     };
-    const beat = async () => {
-      this.localRoots = await roots();
-      await heartbeat();
+    const pass = async () => {
       const configuration = await this.configuration();
       await this.syncConfiguredSessions(configuration, this.localRoots);
       await heartbeat();
       await this.pollEffects();
     };
-    await beat();
+    this.localRoots = await roots();
+    await heartbeat();
+    // The first sync pass runs behind `start`, so the machine's link opens without waiting for it.
     let running = false;
-    this.timer = setInterval(() => {
-      if (running || this.abort.signal.aborted) return;
+    const syncPass = () => {
+      if (running || this.abort.signal.aborted) return null;
       running = true;
-      void beat().catch(error => { this.lastError = error; }).finally(() => { running = false; });
+      const run = (async () => { this.localRoots = await roots(); await pass(); })();
+      void run.catch(error => { this.lastError = error; }).finally(() => { running = false; });
+      return run;
+    };
+    /** The first sync pass, for a caller that waits on it; the connector keeps running if it fails. */
+    this.firstPass = syncPass();
+    this.timer = setInterval(syncPass, 15000);
+    this.heartbeatTimer = setInterval(() => {
+      if (this.abort.signal.aborted) return;
+      void heartbeat().catch(error => { this.lastError = error; });
     }, 15000);
     return this.configurationValue;
   }
@@ -82,28 +162,39 @@ export class TeamsConnector {
     this.nativeEffects.beginDiscovery();
     const activeRules=new Map(configuration.rules.filter(item=>item.state==='active').map(rule=>[rule.id,rule]));
     for(const [key,follower] of this.followers){const rule=activeRules.get(follower.ruleId);if(!rule||rule.revision!==follower.ruleRevision){follower.controller.abort();this.followers.delete(key);}}
+    // A rule covers its root folder and every folder under it. Core discovery filters that subtree before it
+    // reads any session's tail, so a beat costs one bounded scan per root, not one over every session on the
+    // machine; rules over the same root and harnesses share the scan.
+    const discoveries=new Map();
     for(const rule of activeRules.values()){
       const root=roots.find(item=>item.id===rule.selector.root_id);
       if(!root)continue;
-      const descriptors=[];
-      let cursor;
-      do {
-        const page=await this.core.discover({workspace:root.path??root.workspace,harnesses:rule.selector.harnesses,homes:root.homes,limit:2048,...(cursor?{cursor}:{})});
-        descriptors.push(...(page.sessions??page.entries??[]));
-        cursor=page.next_cursor??page.nextCursor??null;
-      } while(cursor);
+      const workspace=root.path??root.workspace,subtree=!root.exact_only,discoveryKey=JSON.stringify([workspace,subtree,[...(rule.selector.harnesses??[])].sort(),root.homes??null]);
+      if(!discoveries.has(discoveryKey))discoveries.set(discoveryKey,(async()=>{
+        const descriptors=[];
+        let cursor;
+        do {
+          // A broad root enrolled before rules covered subfolders keeps its exact-folder discovery.
+          const page=await this.core.discover({workspace,...(subtree?{workspace_subtree:true}:{}),harnesses:rule.selector.harnesses,homes:root.homes,limit:2048,...(cursor?{cursor}:{})});
+          descriptors.push(...(page.sessions??page.entries??[]));
+          cursor=page.next_cursor??page.nextCursor??null;
+        } while(cursor);
+        return descriptors;
+      })());
+      const descriptors=await discoveries.get(discoveryKey);
       for(const descriptor of descriptors){
         const locator=descriptor.locator,nativeSessionId=locator?.session_id,harness=locator?.harness;
         if(!locator||!nativeSessionId||!harness)continue;
-        const options={locator,descriptor,harness,nativeSessionId,ruleId:rule.id,ruleRevision:rule.revision,backfill:rule.backfill,rootPath:root.path??root.workspace};
+        const options={locator,descriptor,harness,nativeSessionId,ruleId:rule.id,ruleRevision:rule.revision,backfill:rule.backfill,rootPath:workspace,configuration};
+        // A session whose native store has not changed since this rule last captured it is not reloaded.
         // One session that cannot be captured (a transcript that rewrote its history needs an explicit resync)
         // is recorded, logged and skipped; it must not stop every other session, or the connector itself, from
         // syncing. An error of the connection itself (the outbox, authentication, the server, a stop) still ends
         // the pass. The session keeps its native binding either way, so it can still be attached to.
         let captured = true;
-        try { await this.capture(options); } catch (error) {
+        if (this.sessionChanged(options)) try { await this.capture(options); } catch (error) {
           if (error.outbox || error.status === 401 || error.status === 403 || error.status >= 500 || this.abort.signal.aborted) throw error;
-          captured = false; this.lastError = error;
+          captured = false; this.noteSessionProblem(options, error);
           process.stderr.write(`supercode teams: ${harness} session ${nativeSessionId} not synced: ${error.message}\n`);
         }
         try { await this.nativeEffects.discover(descriptor, rule.id); } catch (error) { this.lastError = error; }
@@ -111,42 +202,86 @@ export class TeamsConnector {
         const key=`${rule.id}:${harness}:${nativeSessionId}`;
         if(this.followers.has(key)||typeof this.core.session(locator).follow!=='function')continue;
         const controller=new AbortController(),stop=()=>controller.abort(this.abort.signal.reason);this.abort.signal.addEventListener('abort',stop,{once:true});
-        const task=(async()=>{for await(const _event of this.core.session(locator).follow({signal:controller.signal})){if(controller.signal.aborted)break;await this.capture(options);}})().catch(error=>{if(!controller.signal.aborted)this.lastError=error;}).finally(()=>{this.abort.signal.removeEventListener('abort',stop);this.followers.delete(key);});
+        // A follow event may land between beats, after the rule changed: it reads the configuration afresh.
+        const followed={...options,configuration:null,stamp:undefined};
+        const task=(async()=>{for await(const _event of this.core.session(locator).follow({signal:controller.signal})){if(controller.signal.aborted)break;await this.capture(followed);}})().catch(error=>{if(!controller.signal.aborted)this.noteSessionProblem(followed,error);}).finally(()=>{this.abort.signal.removeEventListener('abort',stop);this.followers.delete(key);});
         this.followers.set(key,{ruleId:rule.id,ruleRevision:rule.revision,controller,task});
       }
     }
     this.nativeEffects.endDiscovery();
   }
+  // What a session's native store looked like when discovery listed it: its file's size and modification
+  // time (read before any load, so a write after it reads as a change), those of the file's SQLite write-ahead
+  // log, and the descriptor's updated_at_ms and message_count. A SQLite store (Hermes state.db, OpenCode,
+  // Goose) is shared by many sessions, and a live one appends to `<path>-wal` until a checkpoint while the
+  // database file, and a Hermes session's updated_at_ms (its start until it ends), stay put; its message count
+  // still moves. Null when nothing is known; such a session is reloaded every beat.
+  sessionStamp({locator,descriptor}){
+    const stat=path=>{try{const value=statSync(path);return `${value.size}:${value.mtimeMs}`;}catch{return null;}};
+    const path=typeof locator?.storage?.path==='string'?locator.storage.path:null;
+    const file=path?stat(path):null,wal=path?stat(`${path}-wal`):null;
+    const updated=Number.isSafeInteger(descriptor?.updated_at_ms)?descriptor.updated_at_ms:null;
+    const count=Number.isSafeInteger(descriptor?.message_count)?descriptor.message_count:null;
+    return file===null&&updated===null&&count===null?null:JSON.stringify([file,wal,updated,count]);
+  }
+  sessionChanged(options){
+    const stamp=this.sessionStamp(options);options.stamp=stamp;
+    if(stamp===null||this.state.outbox.length)return true;
+    const rule=options.configuration?.rules?.find(item=>item.id===options.ruleId&&item.revision===options.ruleRevision&&item.state==='active');if(!rule)return true;
+    const configured=rule.backfill??options.backfill??'all',mode=typeof configured==='string'?configured:configured.mode;
+    const seen=this.state.origins[`${options.harness}:${options.nativeSessionId}`]?.capture_stamps?.[options.ruleId];
+    return !(seen&&seen.stamp===stamp&&seen.rule_revision===options.ruleRevision&&seen.backfill_mode===mode);
+  }
+  recordStamp(key,ruleId,ruleRevision,backfillMode,stamp){
+    const origin=this.state.origins[key];
+    if(origin&&ruleId&&stamp)origin.capture_stamps={...origin.capture_stamps,[ruleId]:{stamp,rule_revision:ruleRevision,backfill_mode:backfillMode}};
+    this.save();
+  }
   capture(options) {
-    const work=this.work.then(()=>this.captureSerial(options));
+    const work=this.work.then(()=>this.captureSerial(options)).then(receipt=>{this.clearSessionProblem(options.harness,options.nativeSessionId);return receipt;});
     this.work=work.catch(()=>{});
     return work;
   }
-  async captureSerial({locator,descriptor=null,harness,nativeSessionId,visibility='restricted',ruleId=null,ruleRevision=null,coverage={completeness:'complete',reasons:[],missing:[]},backfill='all',rootPath=null}) {
+  async captureSerial({locator,descriptor=null,harness,nativeSessionId,visibility='restricted',ruleId=null,ruleRevision=null,coverage={completeness:'complete',reasons:[],missing:[]},backfill='all',rootPath=null,configuration=null,stamp}) {
     if(this.state.outbox.length)await this.flushSerial();
-    const configuration=await this.configuration(),rule=configuration.rules.find(item=>item.id===ruleId&&item.revision===ruleRevision&&item.state==='active');if(!rule)throw Object.assign(new Error('sync rule is absent, inactive, or stale'),{code:'forbidden'});visibility=rule.visibility;
+    // Discovery hands each session the configuration its beat fetched; a follow event fetches its own.
+    if(stamp===undefined)stamp=this.sessionStamp({locator,descriptor});
+    if(!configuration)configuration=await this.configuration();const rule=configuration.rules.find(item=>item.id===ruleId&&item.revision===ruleRevision&&item.state==='active');if(!rule)throw Object.assign(new Error('sync rule is absent, inactive, or stale'),{code:'forbidden'});visibility=rule.visibility;
     const artifactSource=locator?.storage?.kind==='file'&&existsSync(locator.storage.path)?realpathSync(locator.storage.path):null;
     const artifactBefore=artifactSource?statSync(artifactSource):null;
     const loaded=await this.core.session(locator).load(),configuredBackfill=rule.backfill??backfill??'all',backfillPolicy=typeof configuredBackfill==='string'?{mode:configuredBackfill,since:null}:configuredBackfill;
     const key=`${harness}:${nativeSessionId}`,previous=this.state.origins[key]??null;
     let messages=(loaded.messages??loaded.turns??[]).map((entry,index)=>{const value=entry.value??Object.fromEntries(Object.entries(entry).filter(([key])=>!['id','native_key','recorded_at','timestamp'].includes(key)));return{native_key:entry.id??entry.native_key??String(index),recorded_at:recordedAt(entry),value};});
-    if(previous?.last_rule_revision===ruleRevision&&previous?.backfill_mode===backfillPolicy.mode&&previous?.observed_keys?.length===messages.length&&messages.every((message,index)=>message.native_key===previous.observed_keys[index]&&hash(canonicalJson(message.value))===previous.observed_digests?.[index]))return null;
-    let effectivePrevious=previous;
-    if(!previous&&backfillPolicy.mode==='none'){this.state.origins[key]={generation:1,sequence:0,digest:null,baseline:messages.map(x=>x.native_key),baseline_digests:messages.map(x=>hash(canonicalJson(x.value))),observed_keys:messages.map(x=>x.native_key),observed_digests:messages.map(x=>hash(canonicalJson(x.value))),last_rule_revision:ruleRevision,backfill_mode:backfillPolicy.mode};this.save();return null;}
+    if(previous?.last_rule_revision===ruleRevision&&previous?.backfill_mode===backfillPolicy.mode&&previous?.observed_keys?.length===messages.length&&messages.every((message,index)=>message.native_key===previous.observed_keys[index]&&hash(canonicalJson(message.value))===previous.observed_digests?.[index])){this.recordStamp(key,ruleId,ruleRevision,backfillPolicy.mode,stamp);return null;}
+    let effectivePrevious=previous;const clearBaseline=backfillPolicy.mode==='all';
+    if(!previous&&backfillPolicy.mode==='none'){const toolTail=trailingToolResults(messages);this.state.origins[key]={generation:1,sequence:0,digest:null,baseline:messages.map(x=>x.native_key),baseline_digests:messages.map(x=>hash(canonicalJson(x.value))),...(toolTail?{baseline_tool_tail:toolTail}:{}),observed_keys:messages.map(x=>x.native_key),observed_digests:messages.map(x=>hash(canonicalJson(x.value))),last_rule_revision:ruleRevision,backfill_mode:backfillPolicy.mode};this.recordStamp(key,ruleId,ruleRevision,backfillPolicy.mode,stamp);return null;}
     if(!previous&&backfillPolicy.mode==='since'){
       if(!Number.isSafeInteger(backfillPolicy.since))throw Object.assign(new Error('since backfill requires an integer timestamp'),{code:'invalid_request'});
       const excluded=messages.filter(message=>message.recorded_at==null||message.recorded_at<backfillPolicy.since);
       effectivePrevious={generation:1,sequence:0,digest:null,baseline:excluded.map(message=>message.native_key),baseline_digests:excluded.map(message=>hash(canonicalJson(message.value)))};
       this.state.origins[key]=effectivePrevious;
     }
-    if(previous?.observed_keys?.every(x=>/^\d+$/.test(x))){
-      const prefix=messages.slice(0,previous.observed_keys.length);
-      const rewritten=prefix.length!==previous.observed_keys.length||prefix.some((message,index)=>message.native_key!==previous.observed_keys[index]||hash(canonicalJson(message.value))!==previous.observed_digests?.[index]);
-      if(rewritten)throw Object.assign(new Error('index-key source rewrote its baseline; explicit backfill is required'),{code:'resync_required'});
+    // A source keyed by position (a Claude Code transcript is) can change a message it already reported: the core
+    // reports a tool call still running as an interrupted placeholder, and the result replaces it at the same
+    // position; a compaction or a parser change rewrites more. Every capture is a whole snapshot (the server keeps
+    // only the latest capture's messages as the session's history), so a rewrite of what was published is simply
+    // republished by the next capture. Only the unpublished baseline of a `none` or `since` rule is a problem:
+    // positions no longer identify the history the rule kept back. A `since` rule derives it again from the
+    // timestamps; a `none` rule cannot tell old history from new, so that session waits for an explicit
+    // `supercode teams sync resume RULE --backfill all` (or a since window), which republishes it whole.
+    if(!clearBaseline&&effectivePrevious?.baseline?.length&&effectivePrevious.baseline.every(x=>/^\d+$/.test(x))){
+      let baselineMoved=effectivePrevious.baseline.some((native_key,index)=>messages[index]?.native_key!==native_key||hash(canonicalJson(messages[index].value))!==effectivePrevious.baseline_digests?.[index]);
+      // A rule that started mid tool call kept back the core's placeholder result; the real result replaces it.
+      const settled=baselineMoved&&backfillPolicy.mode==='none'?settledToolTail(effectivePrevious,messages):null;
+      if(settled){baselineMoved=false;effectivePrevious={...effectivePrevious,baseline_digests:settled};this.state.origins[key]={...this.state.origins[key],baseline_digests:settled};this.save();}
+      if(baselineMoved&&backfillPolicy.mode==='since'&&Number.isSafeInteger(backfillPolicy.since)){
+        const excluded=messages.filter(message=>message.recorded_at==null||message.recorded_at<backfillPolicy.since);
+        effectivePrevious={...effectivePrevious,baseline:excluded.map(message=>message.native_key),baseline_digests:excluded.map(message=>hash(canonicalJson(message.value)))};
+        this.state.origins[key]={...this.state.origins[key],baseline:effectivePrevious.baseline,baseline_digests:effectivePrevious.baseline_digests};
+      }else if(baselineMoved)throw Object.assign(new Error(`the history kept back when rule ${ruleId} started was rewritten; run \`supercode teams sync resume ${ruleId} --backfill all\` (or a since window) to republish this session`),{code:'resync_required'});
     }
-    const clearBaseline=backfillPolicy.mode==='all';
     if(effectivePrevious?.baseline&&!clearBaseline)messages=messages.filter(x=>!effectivePrevious.baseline.includes(x.native_key));
-    if(!messages.length)return null;
+    if(!messages.length){this.recordStamp(key,ruleId,ruleRevision,backfillPolicy.mode,stamp);return null;}
     const captureId=`cap_${randomBytes(16).toString('hex')}`,generation=effectivePrevious?.generation??1,sequence=(effectivePrevious?.sequence??0)+1;
     const begin={native_session_id:nativeSessionId,harness,generation,sequence,capture_id:captureId,previous_digest:effectivePrevious?.digest??null,visibility,rule_id:ruleId,rule_revision:ruleRevision};
     const parts=[];for(let index=0;index<messages.length;index+=500)parts.push({capture_id:captureId,index:parts.length,messages:messages.slice(index,index+500)});
@@ -172,7 +307,7 @@ export class TeamsConnector {
     }
     const recordedTimes=messages.map(message=>message.recorded_at).filter(Number.isSafeInteger),commit={capture_id:captureId,parts:parts.length,digest:'',title:descriptor?.title??null,repository:null,reported_user:null,recorded_activity_at:recordedTimes.length?Math.max(...recordedTimes):null,parent_native_id:descriptor?.parent_session_id??null,coverage:effectivePrevious?.baseline&&!clearBaseline?{...coverage,completeness:'partial',reasons:[...new Set([...coverage.reasons,'prefix_not_captured'])]}:coverage,artifacts:artifacts.map(item=>item.manifest),...(nativeBundle?{native_bundle:nativeBundle}:{})};
     const digestCommit={...commit};delete digestCommit.digest;commit.digest=hash(canonicalJson({begin,parts,commit:digestCommit}));
-    this.state.outbox.push({begin,parts,commit,artifacts,clearBaseline,backfillMode:backfillPolicy.mode,observed:{keys:(loaded.messages??loaded.turns??[]).map((entry,index)=>entry.id??entry.native_key??String(index)),digests:(loaded.messages??loaded.turns??[]).map(entry=>hash(canonicalJson(entry.value??Object.fromEntries(Object.entries(entry).filter(([key])=>!['id','native_key','recorded_at','timestamp'].includes(key))))))}});this.save();return this.flushSerial();
+    this.state.outbox.push({begin,parts,commit,artifacts,clearBaseline,backfillMode:backfillPolicy.mode,stamp,observed:{keys:(loaded.messages??loaded.turns??[]).map((entry,index)=>entry.id??entry.native_key??String(index)),digests:(loaded.messages??loaded.turns??[]).map(entry=>hash(canonicalJson(entry.value??Object.fromEntries(Object.entries(entry).filter(([key])=>!['id','native_key','recorded_at','timestamp'].includes(key))))))}});this.save();return this.flushSerial();
   }
   flush() {
     const work=this.work.then(()=>this.flushSerial());
@@ -181,6 +316,18 @@ export class TeamsConnector {
   }
   // Every outbox error is the connection's, not one session's: a capture's own catch passes it on (syncConfiguredSessions).
   async flushSerial(){try{return await this.flushOutbox();}catch(error){throw Object.assign(error,{outbox:true});}}
-  async flushOutbox(){let latest=null;while(this.state.outbox.length){const item=this.state.outbox[0];const begun=await this.request('POST',`/sources/${this.sourceId}/captures`,item.begin);let receipt;if(begun.state==='committed')receipt=begun.receipt;else{for(const part of item.parts)await this.request('PUT',`/sources/${this.sourceId}/captures/${item.begin.capture_id}/parts/${part.index}`,part);for(const artifact of item.artifacts??[])for(const chunk of artifact.chunks)await this.request('PUT',`/sources/${this.sourceId}/uploads/${chunk.upload_id}/chunks/${chunk.index}`,chunk);receipt=await this.request('POST',`/sources/${this.sourceId}/captures/${item.begin.capture_id}/commit`,item.commit);}const key=`${item.begin.harness}:${item.begin.native_session_id}`,prior=this.state.origins[key]??{},next={...prior,generation:item.begin.generation,sequence:item.begin.sequence,digest:item.commit.digest,observed_keys:item.observed?.keys??prior.observed_keys,observed_digests:item.observed?.digests??prior.observed_digests,last_rule_revision:item.begin.rule_revision,backfill_mode:item.backfillMode};if(item.clearBaseline){delete next.baseline;delete next.baseline_digests;}this.state.origins[key]=next;this.state.outbox.shift();this.save();latest=receipt;}return latest;}
-  stop(){if(this.timer)clearInterval(this.timer);this.abort.abort();for(const follower of this.followers?.values()??[])follower.controller.abort();return this.nativeEffects.close();}
+  async sendCapture(item){const begun=await this.request('POST',`/sources/${this.sourceId}/captures`,item.begin);if(begun.state==='committed')return begun.receipt;for(const part of item.parts)await this.request('PUT',`/sources/${this.sourceId}/captures/${item.begin.capture_id}/parts/${part.index}`,part);for(const artifact of item.artifacts??[])for(const chunk of artifact.chunks)await this.request('PUT',`/sources/${this.sourceId}/uploads/${chunk.upload_id}/chunks/${chunk.index}`,chunk);return this.request('POST',`/sources/${this.sourceId}/captures/${item.begin.capture_id}/commit`,item.commit);}
+  // True when the server refused a queued capture because its sync rule was removed, paused or revised since it
+  // was queued: the capture can never be accepted, so it must not hold every later capture behind it. The
+  // refusal is confirmed against a fresh configuration; any other refusal (a revoked credential, a paused
+  // source) or a network or server error keeps the capture queued for the next flush.
+  async ruleRejected(item,error){
+    if(!item.begin.rule_id||!(error.status===403||error.status===404||error.code==='source_paused'))return false;
+    let configuration;try{configuration=await this.configuration();}catch{return false;}
+    // A configuration without a rule list says nothing about the rule, so the capture stays queued.
+    if(!Array.isArray(configuration?.rules))return false;
+    return !configuration.rules.some(rule=>rule.id===item.begin.rule_id&&rule.revision===item.begin.rule_revision&&rule.state==='active');
+  }
+  async flushOutbox(){let latest=null;while(this.state.outbox.length){const item=this.state.outbox[0];let receipt;try{receipt=await this.sendCapture(item);}catch(error){if(!await this.ruleRejected(item,error))throw error;this.lastError=error;process.stderr.write(`supercode teams: dropped a queued capture of ${item.begin.harness} session ${item.begin.native_session_id}; its sync rule changed or was removed: ${error.message}\n`);this.state.outbox.shift();this.save();continue;}const key=`${item.begin.harness}:${item.begin.native_session_id}`,prior=this.state.origins[key]??{},next={...prior,generation:item.begin.generation,sequence:item.begin.sequence,digest:item.commit.digest,observed_keys:item.observed?.keys??prior.observed_keys,observed_digests:item.observed?.digests??prior.observed_digests,last_rule_revision:item.begin.rule_revision,backfill_mode:item.backfillMode};if(item.clearBaseline){delete next.baseline;delete next.baseline_digests;delete next.baseline_tool_tail;}if(item.stamp&&item.begin.rule_id)next.capture_stamps={...prior.capture_stamps,[item.begin.rule_id]:{stamp:item.stamp,rule_revision:item.begin.rule_revision,backfill_mode:item.backfillMode}};this.state.origins[key]=next;this.state.outbox.shift();this.save();latest=receipt;}return latest;}
+  stop(){if(this.timer)clearInterval(this.timer);if(this.heartbeatTimer)clearInterval(this.heartbeatTimer);this.abort.abort();for(const follower of this.followers?.values()??[])follower.controller.abort();return this.nativeEffects.close();}
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@volter/supercode-teams",
-  "version": "0.2.21",
+  "version": "0.2.23",
   "type": "module",
   "description": "A machine daemon serving this machine's doors, and a local or remote Teams server for shared session discovery, OpenTelemetry ingestion and access to enrolled machines.",
   "license": "MIT",
@@ -62,7 +62,7 @@
     "@volter/supercode-harness-sdk": "^0.3.43",
     "@volter/supercode-terminal": "^0.2.30",
     "@volter/identity": "^0.4.0",
-    "@volter/teams": "^0.1.7",
+    "@volter/teams": "^0.1.8",
     "@xterm/addon-serialize": "^0.14.0",
     "@xterm/headless": "^6.0.0",
     "protobufjs": "8.8.0",