@volter/twin-github 0.1.1 → 2.0.0

package/dist/src/github-twin.js

@@ -0,0 +1,4084 @@
+// GitHub twin — the fifth twin. CONTENT note: the `github` world is now a CONTENT
+// mirror for the text GitHub's REST API actually returns — OBSERVED PR/issue events
+// carry title, body, state and the BODIES of reviews/comments (folded by the
+// connector on pull), alongside the metadata (number, repo, base ref, head sha,
+// file/commit counts). A mirror read of observed data therefore reads back the real
+// title/body, not null. LOCAL simulator/fork writes also carry content and overlay
+// the observed fold (R5/R18). The remaining honesty boundary is the Non-goal: actual
+// repository file CONTENTS are not pulled by this connector. PR authors retain observed
+// identity or the modeled local caller; PR node IDs address the twin's GraphQL nodes.
+// Other unmodeled fields remain declared scope. The shapes match GitHub's REST objects (R1).
+import { createHash, createHmac } from 'node:crypto';
+import { applyTwinWrite, applyTwinWriteAtomic, getActiveWorldStore, ownFields, resolveSubjectId, subjectHistory, transitionFor, treeStamp, twinResources } from '@volter/world-core';
+// The REAL git plane (bare repos + spawned git — see github-git-plane.ts). Git Data writes
+// materialize REAL objects there (real shas); reads fall back to it for objects that only
+// exist in the plane (a `git push` via smart HTTP); ref writes materialize whenever the
+// target object exists. One object store, not two.
+import { diffFilesInPlane, hasBareRepo, listGitPlaneRefs, mergeIntoBranchInPlane, objectExistsInPlane, readGitBlobFromPlane, readGitCommitFromPlane, readGitTagFromPlane, readGitTreeFromPlane, } from "./github-git-plane.js";
+import surface from './generated/surface.gen.json' with { type: 'json' };
+/** What the World keeps of a person's password: its hash, never the password (src/screens/session.tsx checks it). */
+export const passwordHash = (login, password) => createHash('sha256').update(`password:${login.toLowerCase()}:${password}`).digest('hex');
+/** A person's authenticator app: the RFC 6238 code of a base32 secret at an instant, as GitHub's TOTP setup encodes it
+ *  (docs.github.com/authentication/securing-your-account-with-two-factor-authentication-2fa/configuring-two-factor-authentication:
+ *  SHA1, 6 digits, a 30-second period). `step` counts 30-second periods since the epoch. */
+export const totpStep = (at) => Math.floor(Date.parse(at) / 1000 / 30);
+export function totpCode(secret, step) {
+    const A = 'ABCDEFGHIJKLMNOPQRSTUVWXYZ234567';
+    let bits = '';
+    for (const ch of secret.replace(/=+$/, '').toUpperCase())
+        bits += A.indexOf(ch).toString(2).padStart(5, '0');
+    const key = Buffer.from((bits.match(/.{8}/g) ?? []).map((b) => parseInt(b, 2)));
+    const counter = Buffer.alloc(8);
+    counter.writeBigUInt64BE(BigInt(step));
+    const mac = createHmac('sha1', key).update(counter).digest();
+    const at = mac[mac.length - 1] & 0x0f;
+    return String((mac.readUInt32BE(at) & 0x7fffffff) % 1_000_000).padStart(6, '0');
+}
+const base32 = (bytes) => {
+    const A = 'ABCDEFGHIJKLMNOPQRSTUVWXYZ234567';
+    const bits = [...bytes].map((b) => b.toString(2).padStart(8, '0')).join('');
+    return (bits.match(/.{1,5}/g) ?? []).map((b) => A[parseInt(b.padEnd(5, '0'), 2)]).join('');
+};
+const SERVICE = 'github';
+/** The engine slot's plane, as handlers reach it (semantics/ imports shared helpers from here). */
+export { deleteBareRepo, deleteGitRefInPlane, diffFilesInPlane, mergeBaseInPlane, mergeIntoBranchInPlane, ensureBareRepo, forkBareRepo, setBareRepoHead, hasBareRepo, isAncestorInPlane, isValidBranchName, listGitPlaneRefs, objectExistsInPlane, objectTypeInPlane, readGitBlobFromPlane, readGitCommitFromPlane, readGitTagFromPlane, readGitTreeFromPlane, updateGitRefInPlane, writeGitBlobToPlane, writeGitCommitToPlane, writeGitTagToPlane, writeGitTreeToPlane, } from "./github-git-plane.js";
+// Deterministic 40-hex merge-commit sha derived from repo+number — NEVER random
+// (repo forbids Math.random/Date.now in non-runtime code). Stable per repo+number,
+// and a PR can only merge once (a second attempt 405s), so this is unique per merge.
+// ── Landing a pull request: the gates, then the merge ───────────────────────────────────────
+// The base branch's protection names required status checks; each must be a successful check run or
+// commit status on the pull request's head sha (real GitHub: 405 "Required status check … is expected.").
+function requiredChecksMissing(st, repo, baseRef, headSha) {
+    const branch = st.branches.find((b) => b.repository === repo && b.name === baseRef);
+    const contexts = branch?.protection_config?.required_status_checks?.contexts ?? [];
+    return contexts.filter((ctx) => {
+        const check = st.checkRuns.filter((c) => c.repository === repo && c.head_sha === headSha && c.name === ctx).sort((a, b) => b.id - a.id)[0];
+        const status = st.statuses.filter((c) => c.repository === repo && c.sha === headSha && c.context === ctx).sort((a, b) => b.id - a.id)[0];
+        return (!check && !status) || (check !== undefined && check.conclusion !== 'success') || (status !== undefined && status.state !== 'success');
+    });
+}
+// A protected branch's required approving reviews: the latest review of each reviewer other than the author who has
+// write access, APPROVED, at least the count the protection asks for. People with admin access to the repository are
+// not held to it unless the protection includes administrators (enforce_admins)
+// (docs.github.com/repositories/configuring-branches-and-merges-in-your-repository/managing-protected-branches/about-protected-branches#require-pull-request-reviews-before-merging).
+function requiredReviewsMissing(st, repo, pr, merger) {
+    const protection = st.branches.find((b) => b.repository === repo && b.name === (pr.base_ref ?? 'main'))?.protection_config;
+    const reviews = protection?.required_pull_request_reviews;
+    if (!reviews || typeof reviews !== 'object')
+        return undefined;
+    const need = Number(reviews.required_approving_review_count ?? 1);
+    const owner = repo.split('/')[0];
+    const admin = (login) => !!login && (login === owner || st.orgMembers.some((m) => m.org === owner && m.login === login && m.role === 'admin' && m.state === 'active') || st.collaborators.some((c) => c.repository === repo && c.login === login && c.permission === 'admin'));
+    if (admin(merger ?? GITHUB_WORLD_USER) && protection.enforce_admins !== true)
+        return undefined;
+    const writer = (login) => admin(login) || st.collaborators.some((c) => c.repository === repo && c.login === login && ['push', 'write', 'maintain'].includes(c.permission));
+    const latest = new Map();
+    for (const r of st.reviews.filter((x) => x.repository === repo && x.number === pr.number && x.state !== 'COMMENTED' && x.state !== 'PENDING').sort((a, b) => (a.submitted_at ?? '').localeCompare(b.submitted_at ?? '') || a.id - b.id))
+        latest.set(r.user_login ?? '', r);
+    const have = [...latest.values()].filter((r) => r.state === 'APPROVED' && r.user_login && r.user_login !== pr.user_login && writer(r.user_login)).length;
+    return have >= need ? undefined : `At least ${need} approving review${need === 1 ? ' is' : 's are'} required by reviewers with write access.`;
+}
+// Merge = the gates, then a REAL merge commit on the git plane when the repository has one (main moves
+// on the git wire, as it does on GitHub — a REST merge that left the clone behind was a fake success),
+// then the pull request folded closed+merged. Without a plane the merge sha is the deterministic one.
+export async function mergePullRequest(repo, pr, method, occurredAt, root, merger, write) {
+    if (pr.draft)
+        return { ok: false, status: 405, message: 'Draft pull requests cannot be merged' };
+    const missing = requiredChecksMissing(githubState(root), repo, pr.base_ref ?? 'main', pr.head_sha ?? '');
+    if (missing.length)
+        return { ok: false, status: 405, message: `Required status check "${missing[0]}" is expected.` };
+    const reviewsMissing = requiredReviewsMissing(githubState(root), repo, pr, merger);
+    if (reviewsMissing)
+        return { ok: false, status: 405, message: reviewsMissing };
+    const rules = await evaluateMergeRules(repo, pr, merger, occurredAt, root, write);
+    if (rules && rules.result === 'fail')
+        return { ok: false, status: 405, message: `Repository rule violations found\n\n${rules.message}` };
+    let sha = mergeCommitSha(repo, pr.number);
+    if (pr.head_sha) {
+        const landed = await mergeIntoBranchInPlane(repo, pr.base_ref ?? 'main', pr.head_sha, `Merge pull request #${pr.number} from ${pr.head_ref ? `${(pr.head_repo ?? repo).split('/')[0]}/${pr.head_ref}` : 'head'}\n\n${pr.title ?? ''}`, method, occurredAt, root, merger ? { name: merger, email: `${twinUserId(merger)}+${merger}@users.noreply.github.com` } : undefined);
+        if (landed && 'conflict' in landed)
+            return { ok: false, status: 405, message: 'Pull Request is not mergeable' };
+        if (landed) {
+            sha = landed.sha;
+            // the base branch moved on the plane: its ref and branch records follow, as a push's do (github-git-http.ts)
+            const base = pr.base_ref ?? 'main';
+            await write({ operation: 'git_ref.update', subjectType: 'git_ref', subjectId: `gitref:${repo}#refs/heads/${base}`, fields: { repository: repo, ref: `refs/heads/${base}`, object_sha: sha, object_type: 'commit' } });
+            await write({ operation: 'branch.create', subjectType: 'branch', subjectId: `branch:${repo}#${base}`, fields: { repository: repo, name: base, commit_sha: sha } });
+        }
+    }
+    const fields = { number: pr.number, repository: repo, state: 'closed', merged: true, merged_at: occurredAt, merge_commit_sha: sha, merge_method: method, ...(merger ? { merged_by_login: merger } : {}) };
+    await write({ operation: 'pull_request.merge', subjectType: 'pull_request', subjectId: pr.id, fields });
+    if (rules)
+        await recordRuleSuite(repo, { ...rules.suite, after_sha: sha }, occurredAt, root, write);
+    return { ok: true, sha };
+}
+// The active branch rulesets whose ref_name condition covers `branch` (~ALL, ~DEFAULT_BRANCH or refs/heads/<branch>,
+// minus its excludes). A ruleset with no ref_name condition targets no branch.
+export function rulesetsFor(st, repo, branch, enforcement = 'active') {
+    const isDefault = (st.repos.find((r) => r.full_name === repo)?.default_branch ?? 'main') === branch;
+    const hit = (pats) => (Array.isArray(pats) ? pats.map(String) : []).some((p) => p === '~ALL' || (p === '~DEFAULT_BRANCH' && isDefault) || p === `refs/heads/${branch}`);
+    return st.rulesets.filter((r) => rulesetTargets(r, repo, enforcement, hit));
+}
+/** Whether a ruleset of this repository and enforcement names the branch in its ref_name condition. */
+function rulesetTargets(r, repo, enforcement, hit) {
+    const cond = (r.conditions?.ref_name ?? null);
+    return r.repository === repo && r.target === 'branch' && r.enforcement === enforcement && !!cond && hit(cond.include) && !hit(cond.exclude);
+}
+// A merge into a ruled branch is evaluated as GitHub evaluates it: each pull_request rule needs its count of approving
+// reviews from someone other than the author (on the head commit when stale reviews are dismissed on push). A violation
+// fails unless the caller is one of the ruleset's bypass actors (an organization administrator when OrganizationAdmin
+// or the admin repository role is listed), in which case the merge goes through as a bypass. Either way the evaluation
+// is a rule suite.
+async function evaluateMergeRules(repo, pr, merger, occurredAt, root, write) {
+    const st = githubState(root);
+    const branch = pr.base_ref ?? 'main';
+    const sets = rulesetsFor(st, repo, branch);
+    return sets.length ? evaluateRulesets(st, sets, repo, pr, merger, occurredAt, root, write) : null;
+}
+/** The pull_request rules of the rulesets on a merge's base branch, evaluated into a rule suite. */
+async function evaluateRulesets(st, sets, repo, pr, merger, occurredAt, root, write) {
+    const branch = pr.base_ref ?? 'main';
+    const latest = new Map();
+    for (const r of st.reviews.filter((x) => x.repository === repo && x.number === pr.number && x.state !== 'COMMENTED' && x.state !== 'PENDING').sort((a, b) => (a.submitted_at ?? '').localeCompare(b.submitted_at ?? '') || a.id - b.id))
+        latest.set(r.user_login ?? '', r);
+    const isAdmin = !!merger && st.orgMembers.some((m) => m.org === repo.split('/')[0] && m.login === merger && m.role === 'admin' && m.state !== 'pending');
+    const evaluations = [];
+    let failed = false, bypassed = false, message = '';
+    for (const set of sets) {
+        const canBypass = isAdmin && (set.bypass_actors ?? []).some((b) => b.actor_type === 'OrganizationAdmin' || (b.actor_type === 'RepositoryRole' && Number(b.actor_id) === 5));
+        for (const rule of set.rules.filter((x) => x.type === 'pull_request')) {
+            const params = (rule.parameters ?? {});
+            const need = Number(params.required_approving_review_count ?? 0);
+            const have = [...latest.values()].filter((r) => r.state === 'APPROVED' && r.user_login && r.user_login !== pr.user_login && (!params.dismiss_stale_reviews_on_push || !pr.head_sha || r.commit_id === pr.head_sha)).length;
+            const ok = have >= need;
+            const details = ok ? null : `At least ${need} approving review${need === 1 ? ' is' : 's are'} required by reviewers with write access.`;
+            evaluations.push({ ruleset_id: set.id, ruleset_name: set.name, rule_type: 'pull_request', enforcement: 'active', result: ok ? 'pass' : 'fail', details });
+            if (!ok) {
+                if (canBypass)
+                    bypassed = true;
+                else {
+                    failed = true;
+                    message = details;
+                }
+            }
+        }
+    }
+    const result = failed ? 'fail' : bypassed ? 'bypass' : 'pass';
+    const before = (await resolvePlaneRef(repo, branch, branch, root)) ?? st.branches.find((b) => b.repository === repo && b.name === branch)?.commit_sha ?? '';
+    const suite = { repository: repo, ref: `refs/heads/${branch}`, actor_login: merger ?? '', before_sha: before, after_sha: '', pushed_at: occurredAt, result, rules: evaluations };
+    if (failed)
+        await recordRuleSuite(repo, suite, occurredAt, root, write);
+    return { result, message, suite };
+}
+export function kernelAtomic(occurredAt, root) {
+    return async (decide) => (await applyTwinWriteAtomic(SERVICE, () => {
+        const d = decide();
+        return d.write ? { kind: 'write', value: d.value, write: { ...d.write, occurredAt, actor: { kind: 'agent' } } } : { kind: 'skip', value: d.value };
+    }, root)).value;
+}
+// A ruleset write adds a version holding the ruleset as it now stands and who wrote it.
+export async function recordRulesetVersion(repo, id, login, occurredAt, root, write) {
+    const r = githubState(root).rulesets.find((x) => x.repository === repo && x.id === id);
+    if (!r)
+        return;
+    const { versions, ...state } = r;
+    const next = [...(versions ?? []), { version_id: (versions?.length ?? 0) + 1, actor_login: login, updated_at: occurredAt, state: toGithubRuleset(state) }];
+    await write({ operation: 'ruleset.version', subjectType: 'ruleset', subjectId: `ruleset:${id}`, fields: { repository: repo, versions: next } });
+}
+export async function recordRuleSuite(repo, suite, occurredAt, root, write) {
+    const id = nextSeq('rule_suite', root);
+    await write({ operation: 'rule_suite.evaluate', subjectType: 'rule_suite', subjectId: `rulesuite:${id}`, fields: { ...suite, repository: repo } });
+}
+function mergeCommitSha(repo, number) {
+    return createHash('sha256').update(`${repo}#${number}`).digest('hex').slice(0, 40);
+}
+/** The registered GitHub Apps at `root`. */
+export function githubApps(root) {
+    return twinResources(SERVICE, root).filter((r) => r.type === 'app_registration' && r.deleted !== true).map((r) => ownFields(r)).sort((a, b) => a.id - b.id);
+}
+/** GitHub's App object (GET /apps/{app_slug}). */
+export function toGithubApp(a, installations, st) {
+    return {
+        // an app an organization registered is the organization's
+        id: a.id, slug: a.slug, node_id: nodeId('App', a.id), client_id: a.client_id, owner: { login: a.owner, type: st?.orgs.some((o) => o.login === a.owner) ? 'Organization' : 'User' }, name: a.name,
+        description: a.description ?? null, external_url: a.url ?? a.setup_url ?? `https://github.com/apps/${a.slug}`, html_url: `https://github.com/apps/${a.slug}`,
+        created_at: a.created_at ?? null, updated_at: a.created_at ?? null, permissions: a.permissions, events: a.events, installations_count: installations,
+    };
+}
+const countBy = (keys) => keys.reduce((m, k) => m.set(k, (m.get(k) ?? 0) + 1), new Map());
+// Linguist's programming languages by extension; prose (Markdown) and data (JSON, YAML) are not a repository's language
+// (docs.github.com/repositories/managing-your-repositorys-settings-and-features/customizing-your-repository/about-repository-languages)
+const LANGUAGES = {
+    js: 'JavaScript', mjs: 'JavaScript', cjs: 'JavaScript', jsx: 'JavaScript', ts: 'TypeScript', tsx: 'TypeScript', py: 'Python', rb: 'Ruby', go: 'Go', rs: 'Rust',
+    java: 'Java', kt: 'Kotlin', swift: 'Swift', c: 'C', h: 'C', cpp: 'C++', cc: 'C++', cs: 'C#', php: 'PHP', sh: 'Shell', html: 'HTML', css: 'CSS', scss: 'SCSS', vue: 'Vue', dart: 'Dart', ex: 'Elixir', scala: 'Scala',
+};
+/** The language most of a repository's code bytes are in, or null when it holds no code. */
+function languageOf(files) {
+    const byLang = new Map();
+    for (const f of files) {
+        const lang = LANGUAGES[(f.path.split('.').pop() ?? '').toLowerCase()];
+        if (lang)
+            byLang.set(lang, (byLang.get(lang) ?? 0) + f.bytes);
+    }
+    return [...byLang].sort((a, b) => b[1] - a[1] || a[0].localeCompare(b[0]))[0]?.[0] ?? null;
+}
+// GitHub's licence records (GET /licenses/{key}): key, name, SPDX id and node id
+const LICENSES = [
+    [/MIT License/i, 'mit', 'MIT License', 'MIT', 'MDc6TGljZW5zZTEz'], [/Apache License[,\s]+Version 2\.0/i, 'apache-2.0', 'Apache License 2.0', 'Apache-2.0', 'MDc6TGljZW5zZTI='],
+    [/GNU GENERAL PUBLIC LICENSE[\s\S]*Version 3/i, 'gpl-3.0', 'GNU General Public License v3.0', 'GPL-3.0', 'MDc6TGljZW5zZTk='], [/BSD 3-Clause/i, 'bsd-3-clause', 'BSD 3-Clause "New" or "Revised" License', 'BSD-3-Clause', 'MDc6TGljZW5zZTU='],
+];
+/** The licence GitHub detects in a repository's licence file, `other` when it names none it knows, or null when there is no file. */
+function licenseOf(file) {
+    if (!file)
+        return null;
+    const text = Buffer.from(file.content_b64 ?? '', 'base64').toString('utf8');
+    const [, key, name, spdx, nodeId] = LICENSES.find(([re]) => re.test(text)) ?? [null, 'other', 'Other', 'NOASSERTION', 'MDc6TGljZW5zZTA='];
+    return { key, name, spdx_id: spdx, url: key === 'other' ? null : `https://api.github.com/licenses/${key}`, node_id: nodeId };
+}
+const edgesOf = (m) => [...m.entries()].filter(([, on]) => on).map(([k]) => { const i = k.indexOf('|'); return { from: k.slice(0, i), to: k.slice(i + 1) }; });
+/** The World's user's side of the edges, as the set its own endpoints read. */
+const pairsOf = (m, login) => new Set(edgesOf(m).filter((e) => e.from === login).map((e) => e.to));
+// The default Discussion categories every repo starts with (mirrors GitHub's defaults).
+// Only Q&A is answerable. Ids are deterministic (hash of repo+slug) — never random.
+const DEFAULT_DISCUSSION_CATEGORIES = [
+    { name: 'Announcements', slug: 'announcements', emoji: '📣', description: 'Updates from maintainers', is_answerable: false },
+    { name: 'General', slug: 'general', emoji: '💬', description: 'Chat about anything and everything here', is_answerable: false },
+    { name: 'Ideas', slug: 'ideas', emoji: '💡', description: 'Share ideas for new features', is_answerable: false },
+    { name: 'Q&A', slug: 'q-a', emoji: '🙏', description: 'Ask the community for help', is_answerable: true },
+    { name: 'Show and tell', slug: 'show-and-tell', emoji: '🙌', description: 'Show off something you have made', is_answerable: false },
+];
+function discussionCategoryId(repository, slug) {
+    return 0x60000000 + (parseInt(createHash('sha256').update(`${repository}:catg:${slug}`).digest('hex').slice(0, 8), 16) % 0x0fffffff);
+}
+/** The category list for a repo: GitHub's defaults (a custom category is made on github.com's discussion settings,
+ *  which the twin does not have). */
+export function discussionCategoriesFor(repository) {
+    return DEFAULT_DISCUSSION_CATEGORIES.map((c) => ({ id: discussionCategoryId(repository, c.slug), repository, name: c.name, slug: c.slug, emoji: c.emoji, description: c.description, is_answerable: c.is_answerable }))
+        .sort((a, b) => (a.name < b.name ? -1 : a.name > b.name ? 1 : 0));
+}
+// Deterministic positive integer id for an OBSERVED review/comment whose subject id is
+// not a numeric local sequence (e.g. "rev1", "c1"). Derived from a stable hash — never
+// random — and offset above the local sequence space to avoid colliding with it.
+export function observedId(subjectId) {
+    return 0x40000000 + (parseInt(createHash('sha256').update(subjectId).digest('hex').slice(0, 8), 16) % 0x3fffffff);
+}
+// Deterministic check_suite id for a (repo, head_sha) — all check runs for a sha belong to
+// one suite (real GitHub groups runs into a suite per commit). Never random.
+function checkSuiteId(repository, headSha, app) {
+    return 0x70000000 + (parseInt(createHash('sha256').update(`${repository}:suite:${headSha}${app ? `:${app}` : ''}`).digest('hex').slice(0, 8), 16) % 0x0fffffff);
+}
+// GitHub's projection is folded once per World state, not once per read: a request reads it many times
+// (its caller's login, every handler's lookups), and a long-lived World made each fold cost more. The
+// projection is shared between readers, so its rows are frozen: a reader that wants a changed row copies it.
+const stateMemos = new WeakMap();
+/** GitHub's projection of the tree at `root`. */
+export function githubState(root) {
+    const store = getActiveWorldStore();
+    const memos = stateMemos.get(store) ?? stateMemos.set(store, new Map()).get(store);
+    const stamp = treeStamp(SERVICE, root);
+    const held = memos.get(root ?? '');
+    if (held && held.stamp === stamp)
+        return held.state;
+    const state = foldGithubState(root);
+    for (const value of Object.values(state))
+        if (Array.isArray(value))
+            for (const row of value)
+                Object.freeze(row);
+    Object.freeze(state.userProfile);
+    memos.set(root ?? '', { stamp, state });
+    return state;
+}
+/** Where each subject a repository's transfer moved lives now (semantics/repos.ts, moveRepository): a subject whose
+ *  id names the repository is written anew under its new name, and the old one keeps a pointer (`moved_to`), so
+ *  what is read by subject (an issue's timeline, from its writes) follows it. */
+function movedSubjects(root) {
+    const to = new Map();
+    for (const r of twinResources(SERVICE, root))
+        if (typeof r.moved_to === 'string')
+            to.set(`${r.type}:${r.id}`, r.moved_to);
+    return (type, id) => { let at = id; for (let next = to.get(`${type}:${at}`); next !== undefined; next = to.get(`${type}:${at}`))
+        at = next; return at; };
+}
+function foldGithubState(root) {
+    const prs = new Map();
+    const issues = new Map();
+    const reviews = [];
+    const comments = [];
+    // LOCAL comment writes are keyed by their action-log subject id so an EDIT overlays the
+    // comment it names instead of appending a second copy of it (the list and the per-comment
+    // door have to be the same object), and a DELETE tombstones it.
+    const localCommentBySubject = new Map();
+    const deletedCommentSubjects = new Set();
+    const statuses = [];
+    // Check runs are last-write-wins per subject id (a PATCH updates the run's status/output),
+    // unlike commit statuses which keep history. Keyed by `check:<id>`.
+    const checkRunsById = new Map();
+    const milestones = new Map();
+    // Actions: workflows keyed by their action-log subject id; runs + jobs accumulate, and a
+    // later write to the SAME run/job subject id overlays the earlier state (rerun/cancel
+    // transition an existing run rather than appending a new one). Last write per id wins.
+    const workflows = new Map();
+    const runsById = new Map();
+    const jobsById = new Map();
+    // Releases + assets keyed by their action-log subject id (last write per id wins, so a
+    // PATCH overlays the created release / a DELETE tombstones it). LOCAL constructs only.
+    const releasesById = new Map();
+    const assetsById = new Map();
+    const deletedReleases = new Set();
+    const deletedAssets = new Set();
+    // Discussions + their comments + custom categories — all LOCAL constructs keyed by their
+    // action-log subject id (last write per id wins; a DELETE tombstones).
+    const discussionsById = new Map();
+    const discussionCommentsById = new Map();
+    const deletedDiscussions = new Set();
+    const deletedDiscussionComments = new Set();
+    // Reactions, labels, review threads, repos, branches, collaborators, webhooks, contents,
+    // gists, notifications — all LOCAL constructs keyed by their action-log subject id (last
+    // write per id wins; a DELETE/remove tombstones). Vendor-faithful CRUD over the kernel.
+    const reactionsById = new Map();
+    const deletedReactions = new Set();
+    const labelsById = new Map();
+    const deletedLabels = new Set();
+    const reposById = new Map();
+    const deletedRepos = new Set();
+    const pushedAt = new Map();
+    const branchesById = new Map();
+    const deletedBranches = new Set();
+    // Protection survives a branch tombstone (GitHub's pattern-rule semantics) — keyed by the
+    // branch subject id, consumed (and cleared) by the next branch.create for that id.
+    const branchProtectionMemory = new Map();
+    const collaboratorsById = new Map();
+    const deletedCollaborators = new Set();
+    const webhooksById = new Map();
+    const deletedWebhooks = new Set();
+    const contentsById = new Map();
+    const deletedContents = new Set();
+    const gistsById = new Map();
+    const deletedGists = new Set();
+    const notificationsById = new Map();
+    // Git Data API objects — refs/commits/trees/blobs/annotated tags. LOCAL constructs keyed
+    // by their action-log subject id (last write per id wins; a DELETE tombstones refs).
+    const gitRefsById = new Map();
+    const deletedGitRefs = new Set();
+    const gitCommitsById = new Map();
+    const gitTreesById = new Map();
+    const gitBlobsById = new Map();
+    const gitTagObjectsById = new Map();
+    // Deployments + their statuses + environments. LOCAL constructs keyed by subject id.
+    const deploymentsById = new Map();
+    const deploymentStatusesById = new Map();
+    const environmentsById = new Map();
+    const deletedEnvironments = new Set();
+    // Actions secrets/variables/caches/artifacts. LOCAL constructs keyed by subject id.
+    const actionsSecretsById = new Map();
+    const deletedActionsSecrets = new Set();
+    const actionsVariablesById = new Map();
+    const deletedActionsVariables = new Set();
+    const actionsCachesById = new Map();
+    const deletedActionsCaches = new Set();
+    const actionsArtifactsById = new Map();
+    const deletedActionsArtifacts = new Set();
+    // Activity: the authenticated user's star + watch (repo subscription) on each repo. A PUT
+    // sets the flag, a DELETE clears it (last write per subject id wins) — booleans, not objects.
+    // who stars and watches what, and who follows whom: `<login>|<repo>` and `<follower>|<followee>`
+    const starsByRepo = new Map();
+    const watchingByRepo = new Map();
+    // Following: the authenticated user's follow on each login (PUT sets, DELETE clears).
+    const followingByLogin = new Map();
+    // Orgs / Teams / commit-comments / issue-types — LOCAL constructs keyed by subject id
+    // (last write per id wins; a DELETE/remove tombstones). Vendor-faithful CRUD over the kernel.
+    const orgsById = new Map();
+    const orgMembersById = new Map();
+    const deletedOrgMembers = new Set();
+    const outsideCollabsById = new Map();
+    const deletedOutsideCollabs = new Set();
+    const orgWebhooksById = new Map();
+    const deletedOrgWebhooks = new Set();
+    const teamsById = new Map();
+    const deletedTeams = new Set();
+    const teamMembersById = new Map();
+    const deletedTeamMembers = new Set();
+    const teamReposById = new Map();
+    const deletedTeamRepos = new Set();
+    const commitCommentsById = new Map();
+    const deletedCommitComments = new Set();
+    const issueTypesById = new Map();
+    const deletedIssueTypes = new Set();
+    // Repos niche: deploy keys / autolinks / rulesets — LOCAL constructs keyed by subject id.
+    const deployKeysById = new Map();
+    const deletedDeployKeys = new Set();
+    const autolinksById = new Map();
+    const deletedAutolinks = new Set();
+    const rulesetsById = new Map();
+    const deletedRulesets = new Set();
+    const ruleSuitesById = new Map();
+    // User niche: emails (email-keyed) / SSH keys / GPG keys / blocked logins / profile overlay.
+    const userEmailsByAddr = new Map();
+    const deletedUserEmails = new Set();
+    const userSshKeysById = new Map();
+    const deletedUserSshKeys = new Set();
+    const userGpgKeysById = new Map();
+    const deletedUserGpgKeys = new Set();
+    const blockedByLogin = new Map();
+    const userProfile = {};
+    // Projects v2: projects / fields / items / views — LOCAL constructs keyed by subject id.
+    const projectsById = new Map();
+    const deletedProjects = new Set();
+    const projectParts = { project_field: new Map(), project_item: new Map(), project_view: new Map() };
+    // Security alerts (code scanning / dependabot / secret scanning) + scanning analyses —
+    // LOCAL constructs keyed by subject id (last write per id wins; the alert's state machine
+    // is just a field overlay: open→dismissed/fixed/resolved). A DELETE tombstones analyses.
+    const codeScanningAlertsById = new Map();
+    const codeScanningAnalysesById = new Map();
+    const deletedCodeScanningAnalyses = new Set();
+    const dependabotAlertsById = new Map();
+    const secretScanningAlertsById = new Map();
+    // Apps / OAuth — LOCAL constructs keyed by subject id. Installations seed by simulator;
+    // OAuth grants are minted by the authorize flow (token→scopes binding).
+    const appInstallationsById = new Map();
+    const deletedAppInstallations = new Set();
+    const oauthGrantsById = new Map();
+    const deletedOAuthGrants = new Set();
+    // Packages + versions / Pages site+builds / Codespaces — LOCAL constructs keyed by subject id.
+    const packagesById = new Map();
+    const deletedPackages = new Set();
+    const packageVersionsById = new Map();
+    const deletedPackageVersions = new Set();
+    const pagesSitesById = new Map();
+    const deletedPagesSites = new Set();
+    const pagesBuildsById = new Map();
+    const codespacesById = new Map();
+    const deletedCodespaces = new Set();
+    // Review overlays — a dismiss/body-edit on an already-submitted review, keyed by review id.
+    const reviewOverlaysById = new Map();
+    const ensure = (id, number, repository) => {
+        let pr = prs.get(id);
+        if (!pr) {
+            pr = { id, number, repository, review_count: 0, comment_count: 0 };
+            prs.set(id, pr);
+        }
+        return pr;
+    };
+    // a transferred repository's subjects were written anew under its new name: their history follows them
+    const moved = movedSubjects(root);
+    const transitionsOf = (type) => {
+        const current = new Map();
+        const out = new Map();
+        for (const e of subjectHistory(SERVICE, { type }, root)) {
+            const sid = moved(type, e.subject.id);
+            const fields = (e.fields ?? {});
+            const changed = e.fields === undefined ? undefined : fields.changed;
+            const state = fields.state ?? changed?.state?.after;
+            if (state === undefined || state === null)
+                continue;
+            const next = String(state);
+            const prev = current.get(sid);
+            current.set(sid, next);
+            if (prev === undefined || prev === next)
+                continue;
+            // the instant: the row's own updated_at when it carries one; a pull-request write's is its occurredAt
+            const at = fields.updated_at ?? (type === 'pull_request' ? e.occurredAt : undefined);
+            (out.get(sid) ?? out.set(sid, []).get(sid)).push({ state: next, state_reason: fields.state_reason === undefined ? null : fields.state_reason, ...(typeof at === 'string' ? { at } : {}) });
+        }
+        return out;
+    };
+    // What was done to each issue or pull request, from the order of its writes: each write compared with the
+    // fields before it (labels, assignees, milestone, lock, state, merge), stamped with its instant and the login
+    // its actor carries (the core records the caller's identity on every write it makes).
+    const activityOf = (type) => {
+        const seen = new Map();
+        const out = new Map();
+        const names = (v) => (Array.isArray(v) ? v.map((x) => (typeof x === 'string' ? x : String(x?.name ?? x?.login ?? ''))).filter(Boolean) : []);
+        for (const e of subjectHistory(SERVICE, { type }, root)) {
+            const sid = moved(type, e.subject.id);
+            if (e.fields === undefined)
+                continue;
+            const f = e.fields;
+            const before = seen.get(sid) ?? {};
+            const at = typeof e.occurredAt === 'string' ? e.occurredAt : undefined;
+            const by = typeof e.actor?.id === 'string' ? e.actor.id : undefined;
+            const push = (a) => (out.get(sid) ?? out.set(sid, []).get(sid)).push({ ...a, ...(at ? { at } : {}), ...(by ? { by } : {}) });
+            const first = !seen.has(sid);
+            if ('labels' in f) {
+                const was = new Set(names(before.labels));
+                const now = new Set(names(f.labels));
+                for (const l of now)
+                    if (!was.has(l))
+                        push({ event: 'labeled', label: l });
+                if (!first)
+                    for (const l of was)
+                        if (!now.has(l))
+                            push({ event: 'unlabeled', label: l });
+            }
+            // who was assigned or unassigned
+            const assigneeActivity = () => {
+                const was = new Set(names(before.assignees));
+                const now = new Set(names(f.assignees));
+                for (const a of now)
+                    if (!was.has(a))
+                        push({ event: 'assigned', assignee: a });
+                if (!first)
+                    for (const a of was)
+                        if (!now.has(a))
+                            push({ event: 'unassigned', assignee: a });
+            };
+            if ('assignees' in f)
+                assigneeActivity();
+            if ('milestone' in f && f.milestone !== before.milestone)
+                push(f.milestone === null || f.milestone === undefined ? { event: 'demilestoned', milestone: before.milestone } : { event: 'milestoned', milestone: f.milestone });
+            if ('locked' in f && Boolean(f.locked) !== Boolean(before.locked) && !(first && !f.locked))
+                push(f.locked ? { event: 'locked', lock_reason: f.active_lock_reason ?? null } : { event: 'unlocked' });
+            // an issue or pull request is open until a write says otherwise
+            if ('state' in f && !first && f.state !== (before.state ?? 'open'))
+                push(f.state === 'closed' ? { event: 'closed', state_reason: f.state_reason ?? null } : { event: 'reopened' });
+            if ('merged' in f && f.merged === true && before.merged !== true)
+                push({ event: 'merged', commit_id: f.merge_commit_sha ?? null });
+            seen.set(sid, { ...before, ...f });
+        }
+        return out;
+    };
+    // PROTOCOL 2: the serve path reads only the TREE — observed, landed and this branch's own
+    // entries are one projection (checkpoint plus suffix): one resource per subject, last write per
+    // field. A delete is the tombstone the write carried (`deleted: true`); open↔closed transitions
+    // are HISTORY, replayed from the subject's entries after the fold, never accumulated in it.
+    // Older local creates predate the author field. Recover only the modeled caller
+    // from an explicit local create, never from a repository owner or a missing observation.
+    const prHistory = subjectHistory(SERVICE, { type: 'pull_request' }, root);
+    const localPrWrites = new Map(prHistory.filter(e => e.actor?.kind === 'agent' && !e.event && !e.batch && e.operation !== 'repository.transfer').map(e => [moved('pull_request', e.subject.id), e.occurredAt]));
+    const localPrCreates = new Set(prHistory
+        .filter(e => e.operation === 'pull_request.create' && e.actor?.kind === 'agent' && !e.event && !e.batch)
+        .map(e => moved('pull_request', e.subject.id)));
+    for (const r of twinResources(SERVICE, root)) {
+        // what a transfer moved lives on under its new id; the old one is only the pointer there
+        if (typeof r.moved_to === 'string')
+            continue;
+        const a = { subject: { type: r.type, id: r.id }, fields: ownFields(r), occurredAt: r.updatedAt };
+        const f = a.fields;
+        // a repository was pushed to when a branch, a ref or a file in it last changed
+        if ((r.type === 'branch' || r.type === 'git_ref' || r.type === 'content_file') && typeof f.repository === 'string' && r.updatedAt && !(pushedAt.get(f.repository) >= r.updatedAt))
+            pushedAt.set(f.repository, r.updatedAt);
+        // Both observation and write paths carry these vendor fields; legacy observation aliases
+        // are normalized in the read projection, without consulting the old action/event logs.
+        for (const [from, to] of [['pr', 'number'], ['authorLogin', 'user_login'], ['createdAt', 'created_at'], ['updatedAt', 'updated_at'], ['submittedAt', 'submitted_at']]) {
+            if (f[to] === undefined && f[from] !== undefined)
+                f[to] = f[from];
+        }
+        if (f.user_type === undefined && f.authorType !== undefined)
+            f.user_type = f.authorType === 'bot' ? 'Bot' : 'User';
+        if (f.review_key !== undefined)
+            f.review_id = observedId(String(f.review_key));
+        if (typeof f.in_reply_to === 'string' && !/^\d+$/.test(f.in_reply_to))
+            f.in_reply_to = observedId(f.in_reply_to);
+        // The pulled pull-request shape names a few fields the connector's way; read both.
+        if (a.subject.type === 'pull_request') {
+            for (const [from, to] of [['changedFiles', 'changed_files'], ['commitsCount', 'commits'], ['baseRef', 'base_ref'], ['headSha', 'head_sha'], ['mergeCommit', 'merge_commit_sha']])
+                if (f[to] === undefined && f[from] !== undefined)
+                    f[to] = f[from];
+        }
+        if (a.subject.type === 'pull_request') {
+            const number = Number(f.number ?? a.subject.id.split('#').pop());
+            const repository = String(f.repository ?? a.subject.id.split('#')[0]);
+            const pr = ensure(a.subject.id, number, repository);
+            pr.is_pull_request = true; // a pull_request write: this row IS a pull request
+            // A local mutation has a source instant; observation time is never vendor updated_at.
+            const localUpdatedAt = localPrWrites.get(a.subject.id);
+            const observedUpdatedAt = f.updated_at ?? f.updatedAt;
+            pr.updated_at = localUpdatedAt && (!observedUpdatedAt || Date.parse(localUpdatedAt) >= Date.parse(observedUpdatedAt)) ? localUpdatedAt : observedUpdatedAt;
+            pr.user_login = f.user_login !== undefined ? f.user_login : localPrCreates.has(a.subject.id) ? 'octocat' : undefined;
+            if (f.user_type !== undefined)
+                pr.user_type = String(f.user_type);
+            else if (f.user_login === undefined && localPrCreates.has(a.subject.id))
+                pr.user_type = 'User';
+            for (const k of ['base_ref', 'head_sha', 'head_ref', 'changed_files', 'commits', 'additions', 'deletions', 'title', 'body', 'state', 'merged', 'merged_at', 'merge_commit_sha', 'labels', 'assignees', 'requested_reviewers', 'milestone', 'draft', 'merge_method', 'mergeable_state', 'merged_by_login', 'created_at', 'locked', 'active_lock_reason', 'author_association', 'maintainer_can_modify', 'head_repo', 'born_in']) {
+                if (f[k] !== undefined)
+                    pr[k] = f[k];
+            }
+        }
+        else if (a.subject.type === 'issue') {
+            const number = Number(f.number ?? a.subject.id.split('#issue:').pop());
+            const repository = String(f.repository ?? a.subject.id.split('#issue:')[0]);
+            if (!repository || !Number.isFinite(number))
+                continue;
+            let iss = issues.get(a.subject.id);
+            if (!iss) {
+                iss = { id: a.subject.id, number, repository };
+                issues.set(a.subject.id, iss);
+            }
+            for (const k of ['title', 'body', 'state', 'created_at', 'updated_at', 'labels', 'assignees', 'milestone', 'state_reason', 'locked', 'active_lock_reason', 'sub_issue_numbers', 'parent_issue_number', 'user_login', 'author_association', 'born_in']) {
+                if (f[k] !== undefined)
+                    iss[k] = f[k];
+            }
+        }
+        else if (a.subject.type === 'commit_status') {
+            // Commit status: a LOCAL CI construct keyed by sha. Each write is a distinct status
+            // (GitHub keeps history per context); the local sequence id makes them distinct.
+            const m = /^status:(\d+)$/.exec(a.subject.id);
+            statuses.push({
+                id: m ? Number(m[1]) : observedId(a.subject.id),
+                repository: String(f.repository ?? ''), sha: String(f.sha ?? ''), state: String(f.state ?? 'pending'),
+                context: f.context, description: f.description, target_url: f.target_url, created_at: f.created_at, updated_at: f.updated_at,
+            });
+        }
+        else if (a.subject.type === 'check_run') {
+            const m = /^check:(\d+)$/.exec(a.subject.id);
+            const prev = checkRunsById.get(a.subject.id);
+            const cr = {
+                id: m ? Number(m[1]) : observedId(a.subject.id),
+                repository: String(f.repository ?? prev?.repository ?? ''), head_sha: String(f.head_sha ?? prev?.head_sha ?? ''), name: String(f.name ?? prev?.name ?? ''),
+                status: f.status ?? prev?.status, conclusion: f.conclusion ?? prev?.conclusion, details_url: f.details_url ?? prev?.details_url, external_id: f.external_id ?? prev?.external_id,
+                started_at: f.started_at ?? prev?.started_at, completed_at: f.completed_at ?? prev?.completed_at,
+            };
+            // each app's runs on a commit share that app's suite (docs.github.com/rest/guides/using-the-rest-api-to-interact-with-checks)
+            const app = f.app_slug ?? prev?.app_slug;
+            if (typeof app === 'string')
+                cr.app_slug = app;
+            cr.check_suite_id = checkSuiteId(cr.repository, cr.head_sha, cr.app_slug);
+            cr.output_title = f.output_title !== undefined ? String(f.output_title) : prev?.output_title;
+            cr.output_summary = f.output_summary !== undefined ? String(f.output_summary) : prev?.output_summary;
+            cr.output_text = f.output_text !== undefined ? String(f.output_text) : prev?.output_text;
+            if (Array.isArray(f.annotations))
+                cr.annotations = f.annotations.map((an) => ({
+                    path: String(an.path), start_line: Number(an.start_line), end_line: Number(an.end_line),
+                    annotation_level: String(an.annotation_level), message: String(an.message),
+                    title: an.title !== undefined ? String(an.title) : undefined,
+                    raw_details: an.raw_details !== undefined ? String(an.raw_details) : undefined,
+                    start_column: an.start_column !== undefined ? Number(an.start_column) : undefined,
+                    end_column: an.end_column !== undefined ? Number(an.end_column) : undefined,
+                }));
+            else
+                cr.annotations = prev?.annotations;
+            checkRunsById.set(a.subject.id, cr);
+        }
+        else if (a.subject.type === 'milestone') {
+            const number = Number(f.number ?? a.subject.id.split('#milestone:').pop());
+            const repository = String(f.repository ?? a.subject.id.split('#milestone:')[0]);
+            let ms = milestones.get(a.subject.id);
+            if (!ms) {
+                ms = { id: observedId(a.subject.id), number, repository };
+                milestones.set(a.subject.id, ms);
+            }
+            for (const k of ['title', 'description', 'state', 'due_on', 'created_at', 'updated_at', 'creator_login']) {
+                if (f[k] !== undefined)
+                    ms[k] = f[k];
+            }
+        }
+        else if (a.subject.type === 'workflow') {
+            // A registered workflow file (LOCAL — Actions has no observed-CI evidence). The
+            // action-log subject id is `workflow:<id>`; later writes to the same id overlay.
+            const m = /^workflow:(\d+)$/.exec(a.subject.id);
+            const id = m ? Number(m[1]) : observedId(a.subject.id);
+            const wf = {
+                id, repository: String(f.repository ?? ''), name: String(f.name ?? ''), path: String(f.path ?? ''),
+                state: f.state, created_at: f.created_at, updated_at: f.updated_at,
+            };
+            workflows.set(a.subject.id, wf);
+        }
+        else if (a.subject.type === 'workflow_run') {
+            // A workflow run (created by dispatch, transitioned by rerun/cancel). Subject id is
+            // `run:<id>`; a rerun/cancel write to the SAME id overlays status/conclusion.
+            const m = /^run:(\d+)$/.exec(a.subject.id);
+            const id = m ? Number(m[1]) : observedId(a.subject.id);
+            const run = {
+                id, repository: String(f.repository ?? ''), workflow_id: Number(f.workflow_id ?? 0),
+                name: f.name ?? undefined, run_number: Number(f.run_number ?? 0), event: String(f.event ?? 'workflow_dispatch'),
+                status: String(f.status ?? 'queued'), conclusion: f.conclusion ?? undefined, head_sha: String(f.head_sha ?? ''),
+                head_branch: f.head_branch ?? undefined, created_at: f.created_at ?? undefined, updated_at: f.updated_at ?? undefined,
+                ...(typeof (f.actor_login ?? runsById.get(a.subject.id)?.actor_login) === 'string' ? { actor_login: String(f.actor_login ?? runsById.get(a.subject.id)?.actor_login) } : {}),
+                approvals: Array.isArray(f.approvals) ? f.approvals : runsById.get(a.subject.id)?.approvals,
+                ...(typeof (f.head_repository ?? runsById.get(a.subject.id)?.head_repository) === 'string' ? { head_repository: String(f.head_repository ?? runsById.get(a.subject.id)?.head_repository) } : {}),
+            };
+            runsById.set(a.subject.id, run);
+        }
+        else if (a.subject.type === 'workflow_job') {
+            const m = /^job:(\d+)$/.exec(a.subject.id);
+            const id = m ? Number(m[1]) : observedId(a.subject.id);
+            const job = {
+                id, run_id: Number(f.run_id ?? 0), repository: String(f.repository ?? ''), name: String(f.name ?? ''),
+                status: String(f.status ?? 'queued'), conclusion: f.conclusion ?? undefined, head_sha: String(f.head_sha ?? ''),
+                started_at: f.started_at ?? undefined, completed_at: f.completed_at ?? undefined,
+                labels: Array.isArray(f.labels) ? f.labels.map(String) : [], workflow_name: f.workflow_name ?? undefined,
+                head_branch: f.head_branch ?? undefined, created_at: f.created_at ?? undefined,
+                steps: Array.isArray(f.steps) ? f.steps.map((s) => ({ name: String(s.name), status: String(s.status), conclusion: s.conclusion ?? undefined, number: Number(s.number) })) : [],
+            };
+            jobsById.set(a.subject.id, job);
+        }
+        else if (a.subject.type === 'release') {
+            // A release (LOCAL construct). Subject id `release:<id>`; a PATCH overlays the same
+            // id, a DELETE marks it tombstoned so it drops out of the read.
+            const m = /^release:(\d+)$/.exec(a.subject.id);
+            const id = m ? Number(m[1]) : observedId(a.subject.id);
+            if (f.deleted === true) {
+                deletedReleases.add(a.subject.id);
+                continue;
+            }
+            const prev = releasesById.get(a.subject.id);
+            const rel = {
+                id,
+                repository: String(f.repository ?? prev?.repository ?? ''),
+                tag_name: String(f.tag_name ?? prev?.tag_name ?? ''),
+                target_commitish: f.target_commitish ?? prev?.target_commitish,
+                name: f.name ?? prev?.name,
+                body: f.body ?? prev?.body,
+                draft: f.draft !== undefined ? Boolean(f.draft) : prev?.draft,
+                prerelease: f.prerelease !== undefined ? Boolean(f.prerelease) : prev?.prerelease,
+                created_at: f.created_at ?? prev?.created_at,
+                published_at: f.published_at ?? prev?.published_at,
+                ...(typeof (f.author_login ?? prev?.author_login) === 'string' ? { author_login: String(f.author_login ?? prev?.author_login) } : {}),
+            };
+            releasesById.set(a.subject.id, rel);
+        }
+        else if (a.subject.type === 'release_asset') {
+            const m = /^asset:(\d+)$/.exec(a.subject.id);
+            const id = m ? Number(m[1]) : observedId(a.subject.id);
+            if (f.deleted === true) {
+                deletedAssets.add(a.subject.id);
+                continue;
+            }
+            const prev = assetsById.get(a.subject.id);
+            const asset = {
+                id,
+                repository: String(f.repository ?? prev?.repository ?? ''),
+                release_id: Number(f.release_id ?? prev?.release_id ?? 0),
+                name: String(f.name ?? prev?.name ?? ''),
+                label: f.label ?? prev?.label,
+                content_type: f.content_type ?? prev?.content_type,
+                size: f.size !== undefined ? Number(f.size) : prev?.size,
+                ...(typeof (f.uploader_login ?? prev?.uploader_login) === 'string' ? { uploader_login: String(f.uploader_login ?? prev?.uploader_login) } : {}),
+                state: f.state ?? prev?.state,
+                download_count: f.download_count !== undefined ? Number(f.download_count) : prev?.download_count,
+                created_at: f.created_at ?? prev?.created_at,
+                updated_at: f.updated_at ?? prev?.updated_at,
+            };
+            assetsById.set(a.subject.id, asset);
+        }
+        else if (a.subject.type === 'discussion') {
+            // A discussion (LOCAL construct). Subject id `discussion:<repo>#<number>`; a PATCH
+            // overlays the same id, a DELETE tombstones it.
+            if (f.deleted === true) {
+                deletedDiscussions.add(a.subject.id);
+                continue;
+            }
+            const prev = discussionsById.get(a.subject.id);
+            const disc = {
+                number: Number(f.number ?? prev?.number ?? 0),
+                repository: String(f.repository ?? prev?.repository ?? ''),
+                title: f.title ?? prev?.title,
+                body: f.body ?? prev?.body,
+                category_slug: f.category_slug ?? prev?.category_slug,
+                state: f.state ?? prev?.state,
+                state_reason: f.state_reason ?? prev?.state_reason,
+                // answer_comment_id is DERIVED from the comments' is_answer flags after the fold —
+                // never read from a write (avoids a dedup-prone discussion write on each answer mark).
+                answer_comment_id: prev?.answer_comment_id ?? null,
+                locked: f.locked !== undefined ? Boolean(f.locked) : prev?.locked,
+                created_at: f.created_at ?? prev?.created_at,
+                updated_at: f.updated_at ?? prev?.updated_at,
+            };
+            discussionsById.set(a.subject.id, disc);
+        }
+        else if (a.subject.type === 'discussion_comment') {
+            // A discussion comment/reply (LOCAL). Subject id `discomment:<id>`; an answer-mark
+            // write overlays is_answer on the same id, a DELETE tombstones it.
+            const m = /^discomment:(\d+)$/.exec(a.subject.id);
+            const id = m ? Number(m[1]) : observedId(a.subject.id);
+            if (f.deleted === true) {
+                deletedDiscussionComments.add(a.subject.id);
+                continue;
+            }
+            const prev = discussionCommentsById.get(a.subject.id);
+            const comment = {
+                id,
+                repository: String(f.repository ?? prev?.repository ?? ''),
+                discussion_number: Number(f.discussion_number ?? prev?.discussion_number ?? 0),
+                parent_id: f.parent_id !== undefined ? (f.parent_id === null ? null : Number(f.parent_id)) : prev?.parent_id,
+                body: f.body ?? prev?.body,
+                is_answer: f.is_answer !== undefined ? Boolean(f.is_answer) : prev?.is_answer,
+                created_at: f.created_at ?? prev?.created_at,
+                updated_at: f.updated_at ?? prev?.updated_at,
+            };
+            discussionCommentsById.set(a.subject.id, comment);
+        }
+        else if (a.subject.type === 'reaction') {
+            const m = /^reaction:(\d+)$/.exec(a.subject.id);
+            const id = m ? Number(m[1]) : observedId(a.subject.id);
+            if (f.deleted === true) {
+                deletedReactions.add(a.subject.id);
+                continue;
+            }
+            reactionsById.set(a.subject.id, {
+                id, repository: String(f.repository ?? ''), subject_type: (f.subject_type ?? 'issue'),
+                subject_key: String(f.subject_key ?? ''), content: String(f.content ?? '+1'), created_at: f.created_at,
+            });
+        }
+        else if (a.subject.type === 'label') {
+            const m = /^label:(\d+)$/.exec(a.subject.id);
+            const id = m ? Number(m[1]) : observedId(a.subject.id);
+            if (f.deleted === true) {
+                deletedLabels.add(a.subject.id);
+                continue;
+            }
+            const prev = labelsById.get(a.subject.id);
+            labelsById.set(a.subject.id, {
+                id, repository: String(f.repository ?? prev?.repository ?? ''), name: String(f.name ?? prev?.name ?? ''),
+                color: f.color ?? prev?.color, description: f.description !== undefined ? f.description : prev?.description,
+                default: f.default !== undefined ? Boolean(f.default) : prev?.default,
+            });
+        }
+        else if (a.subject.type === 'repository') {
+            if (f.deleted === true) {
+                deletedRepos.add(a.subject.id);
+                // Cascade: the repo's refs/branches die WITH it (the bare repo is removed too), so a
+                // re-created repo starts truly empty on BOTH planes — REST must not serve dead refs.
+                const dyingRepo = reposById.get(a.subject.id);
+                const dyingFull = dyingRepo ? `${dyingRepo.owner}/${dyingRepo.name}` : `${String(f.owner ?? '')}/${String(f.name ?? '')}`;
+                for (const [k, v] of [...gitRefsById])
+                    if (v.repository === dyingFull) {
+                        gitRefsById.delete(k);
+                        deletedGitRefs.delete(k);
+                    }
+                for (const [k, v] of [...branchesById])
+                    if (v.repository === dyingFull) {
+                        branchesById.delete(k);
+                        deletedBranches.delete(k);
+                    }
+                for (const k of [...branchProtectionMemory.keys()])
+                    if (k.startsWith(`branch:${dyingFull}#`))
+                        branchProtectionMemory.delete(k);
+                continue;
+            }
+            const m = /^repo:(\d+)$/.exec(a.subject.id);
+            const id = m ? Number(m[1]) : observedId(a.subject.id);
+            const prev = reposById.get(a.subject.id);
+            const owner = String(f.owner ?? prev?.owner ?? '');
+            const name = String(f.name ?? prev?.name ?? '');
+            reposById.set(a.subject.id, {
+                id, owner, name, full_name: `${owner}/${name}`,
+                description: f.description !== undefined ? f.description : prev?.description,
+                private: f.private !== undefined ? Boolean(f.private) : prev?.private,
+                default_branch: f.default_branch ?? prev?.default_branch ?? 'main',
+                topics: f.topics !== undefined ? f.topics : prev?.topics,
+                homepage: f.homepage !== undefined ? f.homepage : prev?.homepage,
+                has_issues: f.has_issues !== undefined ? Boolean(f.has_issues) : prev?.has_issues,
+                has_projects: f.has_projects !== undefined ? Boolean(f.has_projects) : prev?.has_projects,
+                has_wiki: f.has_wiki !== undefined ? Boolean(f.has_wiki) : prev?.has_wiki,
+                has_discussions: f.has_discussions !== undefined ? Boolean(f.has_discussions) : prev?.has_discussions,
+                archived: f.archived !== undefined ? Boolean(f.archived) : prev?.archived,
+                fork: f.fork !== undefined ? Boolean(f.fork) : prev?.fork,
+                parent_full_name: f.parent_full_name ?? prev?.parent_full_name,
+                created_at: f.created_at ?? prev?.created_at, updated_at: f.updated_at ?? prev?.updated_at,
+                // an observed repository carries GitHub's own counts; a local one gets the fold's
+            });
+        }
+        else if (a.subject.type === 'branch') {
+            if (f.deleted === true) {
+                // The row dies, but PROTECTION does not: real GitHub's classic protection is a
+                // repo-level pattern rule, so deleting `main` and re-pushing it comes back
+                // protected. Remember the protection across the tombstone.
+                const dying = branchesById.get(a.subject.id);
+                if (dying && (dying.protected || dying.protection_config)) {
+                    branchProtectionMemory.set(a.subject.id, { protected: dying.protected, protection_config: dying.protection_config });
+                }
+                deletedBranches.add(a.subject.id);
+                branchesById.delete(a.subject.id);
+                continue;
+            }
+            deletedBranches.delete(a.subject.id); // delete→re-create resurrects (see git_ref fold below)
+            const prev = branchesById.get(a.subject.id) ?? branchProtectionMemory.get(a.subject.id);
+            if (branchesById.get(a.subject.id) === undefined && branchProtectionMemory.has(a.subject.id))
+                branchProtectionMemory.delete(a.subject.id);
+            branchesById.set(a.subject.id, {
+                repository: String(f.repository ?? prev?.repository ?? ''), name: String(f.name ?? prev?.name ?? ''),
+                commit_sha: String(f.commit_sha ?? prev?.commit_sha ?? ''),
+                protected: f.protected !== undefined ? Boolean(f.protected) : prev?.protected,
+                ...(f.protection_config !== undefined
+                    ? (f.protection_config === null ? {} : { protection_config: f.protection_config })
+                    : (prev?.protection_config !== undefined ? { protection_config: prev.protection_config } : {})),
+            });
+        }
+        else if (a.subject.type === 'collaborator') {
+            if (f.deleted === true) {
+                deletedCollaborators.add(a.subject.id);
+                continue;
+            }
+            const prev = collaboratorsById.get(a.subject.id);
+            collaboratorsById.set(a.subject.id, {
+                repository: String(f.repository ?? prev?.repository ?? ''), login: String(f.login ?? prev?.login ?? ''),
+                permission: String(f.permission ?? prev?.permission ?? 'push'),
+            });
+        }
+        else if (a.subject.type === 'webhook') {
+            if (f.deleted === true) {
+                deletedWebhooks.add(a.subject.id);
+                continue;
+            }
+            const m = /^webhook:(\d+)$/.exec(a.subject.id);
+            const id = m ? Number(m[1]) : observedId(a.subject.id);
+            const prev = webhooksById.get(a.subject.id);
+            webhooksById.set(a.subject.id, {
+                id, repository: String(f.repository ?? prev?.repository ?? ''), name: 'web',
+                active: f.active !== undefined ? Boolean(f.active) : (prev?.active ?? true),
+                events: f.events !== undefined ? f.events : (prev?.events ?? ['push']),
+                url: f.url ?? prev?.url, content_type: f.content_type ?? prev?.content_type,
+                secret: f.secret !== undefined ? String(f.secret) : prev?.secret,
+                created_at: f.created_at ?? prev?.created_at, updated_at: f.updated_at ?? prev?.updated_at,
+            });
+        }
+        else if (a.subject.type === 'content_file') {
+            if (f.deleted === true) {
+                deletedContents.add(a.subject.id);
+                contentsById.delete(a.subject.id);
+                continue;
+            }
+            deletedContents.delete(a.subject.id);
+            const prev = contentsById.get(a.subject.id);
+            contentsById.set(a.subject.id, {
+                repository: String(f.repository ?? prev?.repository ?? ''), path: String(f.path ?? prev?.path ?? ''),
+                content_b64: f.content_b64 ?? prev?.content_b64, sha: String(f.sha ?? prev?.sha ?? ''),
+                size: f.size !== undefined ? Number(f.size) : (prev?.size ?? 0), branch: f.branch ?? prev?.branch,
+            });
+        }
+        else if (a.subject.type === 'gist') {
+            if (f.deleted === true) {
+                deletedGists.add(a.subject.id);
+                continue;
+            }
+            const prev = gistsById.get(a.subject.id);
+            gistsById.set(a.subject.id, {
+                id: String(f.id ?? prev?.id ?? a.subject.id.replace(/^gist:/, '')),
+                description: f.description !== undefined ? f.description : prev?.description,
+                public: f.public !== undefined ? Boolean(f.public) : prev?.public,
+                files: Array.isArray(f.files) ? f.files : (prev?.files ?? []),
+                created_at: f.created_at ?? prev?.created_at, updated_at: f.updated_at ?? prev?.updated_at,
+                history: Array.isArray(f.history) ? f.history : prev?.history,
+                owner: f.owner ?? prev?.owner,
+            });
+        }
+        else if (a.subject.type === 'notification') {
+            const prev = notificationsById.get(a.subject.id);
+            notificationsById.set(a.subject.id, {
+                id: String(f.id ?? prev?.id ?? a.subject.id.replace(/^notification:/, '')),
+                repository: String(f.repository ?? prev?.repository ?? ''),
+                subject_title: String(f.subject_title ?? prev?.subject_title ?? ''),
+                subject_type: String(f.subject_type ?? prev?.subject_type ?? 'Issue'),
+                subject_url: f.subject_url ?? prev?.subject_url,
+                reason: String(f.reason ?? prev?.reason ?? 'subscribed'),
+                unread: f.unread !== undefined ? Boolean(f.unread) : (prev?.unread ?? true),
+                updated_at: f.updated_at ?? prev?.updated_at,
+                ...(f.subscription !== undefined ? { subscription: f.subscription } : prev && 'subscription' in prev ? { subscription: prev.subscription } : {}),
+            });
+        }
+        else if (a.subject.type === 'git_ref') {
+            if (f.deleted === true) {
+                deletedGitRefs.add(a.subject.id);
+                gitRefsById.delete(a.subject.id);
+                continue;
+            }
+            deletedGitRefs.delete(a.subject.id); // a later create RESURRECTS a deleted ref (delete→re-push must not be tombstoned forever)
+            const prev = gitRefsById.get(a.subject.id);
+            gitRefsById.set(a.subject.id, {
+                repository: String(f.repository ?? prev?.repository ?? ''), ref: String(f.ref ?? prev?.ref ?? ''),
+                object_sha: String(f.object_sha ?? prev?.object_sha ?? ''), object_type: String(f.object_type ?? prev?.object_type ?? 'commit'),
+            });
+        }
+        else if (a.subject.type === 'git_commit') {
+            const prev = gitCommitsById.get(a.subject.id);
+            gitCommitsById.set(a.subject.id, {
+                repository: String(f.repository ?? prev?.repository ?? ''), sha: String(f.sha ?? prev?.sha ?? ''),
+                message: String(f.message ?? prev?.message ?? ''), tree_sha: String(f.tree_sha ?? prev?.tree_sha ?? ''),
+                parents: Array.isArray(f.parents) ? f.parents : (prev?.parents ?? []),
+                author_name: f.author_name ?? prev?.author_name, author_email: f.author_email ?? prev?.author_email, created_at: f.created_at ?? prev?.created_at,
+            });
+        }
+        else if (a.subject.type === 'git_tree') {
+            const prev = gitTreesById.get(a.subject.id);
+            gitTreesById.set(a.subject.id, {
+                repository: String(f.repository ?? prev?.repository ?? ''), sha: String(f.sha ?? prev?.sha ?? ''),
+                tree: Array.isArray(f.tree) ? f.tree : (prev?.tree ?? []), truncated: f.truncated ?? prev?.truncated ?? false,
+            });
+        }
+        else if (a.subject.type === 'git_blob') {
+            const prev = gitBlobsById.get(a.subject.id);
+            gitBlobsById.set(a.subject.id, {
+                repository: String(f.repository ?? prev?.repository ?? ''), sha: String(f.sha ?? prev?.sha ?? ''),
+                content_b64: String(f.content_b64 ?? prev?.content_b64 ?? ''), size: f.size !== undefined ? Number(f.size) : (prev?.size ?? 0),
+                encoding: String(f.encoding ?? prev?.encoding ?? 'base64'),
+            });
+        }
+        else if (a.subject.type === 'git_tag_object') {
+            const prev = gitTagObjectsById.get(a.subject.id);
+            gitTagObjectsById.set(a.subject.id, {
+                repository: String(f.repository ?? prev?.repository ?? ''), sha: String(f.sha ?? prev?.sha ?? ''),
+                tag: String(f.tag ?? prev?.tag ?? ''), message: String(f.message ?? prev?.message ?? ''),
+                object_sha: String(f.object_sha ?? prev?.object_sha ?? ''), object_type: String(f.object_type ?? prev?.object_type ?? 'commit'),
+                tagger_name: f.tagger_name ?? prev?.tagger_name, created_at: f.created_at ?? prev?.created_at,
+            });
+        }
+        else if (a.subject.type === 'deployment') {
+            const prev = deploymentsById.get(a.subject.id);
+            const m = /^deployment:(\d+)$/.exec(a.subject.id);
+            deploymentsById.set(a.subject.id, {
+                id: m ? Number(m[1]) : (prev?.id ?? observedId(a.subject.id)), repository: String(f.repository ?? prev?.repository ?? ''),
+                ref: String(f.ref ?? prev?.ref ?? ''), sha: String(f.sha ?? prev?.sha ?? ''), task: String(f.task ?? prev?.task ?? 'deploy'),
+                environment: String(f.environment ?? prev?.environment ?? 'production'), description: f.description !== undefined ? f.description : prev?.description,
+                payload: f.payload !== undefined ? f.payload : prev?.payload,
+                transient_environment: f.transient_environment ?? prev?.transient_environment, production_environment: f.production_environment ?? prev?.production_environment,
+                created_at: f.created_at ?? prev?.created_at, updated_at: f.updated_at ?? prev?.updated_at,
+                ...(typeof (f.creator_login ?? prev?.creator_login) === 'string' ? { creator_login: String(f.creator_login ?? prev?.creator_login) } : {}),
+            });
+        }
+        else if (a.subject.type === 'deployment_status') {
+            const prev = deploymentStatusesById.get(a.subject.id);
+            const m = /^depstatus:(\d+)$/.exec(a.subject.id);
+            deploymentStatusesById.set(a.subject.id, {
+                id: m ? Number(m[1]) : (prev?.id ?? observedId(a.subject.id)), repository: String(f.repository ?? prev?.repository ?? ''),
+                deployment_id: f.deployment_id !== undefined ? Number(f.deployment_id) : (prev?.deployment_id ?? 0), state: String(f.state ?? prev?.state ?? 'pending'),
+                description: f.description !== undefined ? f.description : prev?.description, environment: f.environment ?? prev?.environment,
+                environment_url: f.environment_url ?? prev?.environment_url, log_url: f.log_url ?? prev?.log_url, created_at: f.created_at ?? prev?.created_at,
+                ...(typeof (f.creator_login ?? prev?.creator_login) === 'string' ? { creator_login: String(f.creator_login ?? prev?.creator_login) } : {}),
+            });
+        }
+        else if (a.subject.type === 'environment') {
+            if (f.deleted === true) {
+                deletedEnvironments.add(a.subject.id);
+                continue;
+            }
+            const prev = environmentsById.get(a.subject.id);
+            environmentsById.set(a.subject.id, {
+                repository: String(f.repository ?? prev?.repository ?? ''), name: String(f.name ?? prev?.name ?? ''),
+                wait_timer: f.wait_timer !== undefined ? Number(f.wait_timer) : prev?.wait_timer,
+                reviewers: Array.isArray(f.reviewers) ? f.reviewers : prev?.reviewers,
+                created_at: f.created_at ?? prev?.created_at, updated_at: f.updated_at ?? prev?.updated_at,
+                ...(typeof f.born_in === 'string' ? { born_in: f.born_in } : {}),
+            });
+        }
+        else if (a.subject.type === 'actions_secret') {
+            if (f.deleted === true) {
+                deletedActionsSecrets.add(a.subject.id);
+                continue;
+            }
+            const prev = actionsSecretsById.get(a.subject.id);
+            actionsSecretsById.set(a.subject.id, {
+                scope: String(f.scope ?? prev?.scope ?? 'repo'), container: String(f.container ?? prev?.container ?? ''), name: String(f.name ?? prev?.name ?? ''),
+                created_at: f.created_at ?? prev?.created_at, updated_at: f.updated_at ?? prev?.updated_at, visibility: f.visibility ?? prev?.visibility,
+            });
+        }
+        else if (a.subject.type === 'actions_variable') {
+            if (f.deleted === true) {
+                deletedActionsVariables.add(a.subject.id);
+                continue;
+            }
+            const prev = actionsVariablesById.get(a.subject.id);
+            actionsVariablesById.set(a.subject.id, {
+                scope: String(f.scope ?? prev?.scope ?? 'repo'), container: String(f.container ?? prev?.container ?? ''), name: String(f.name ?? prev?.name ?? ''),
+                value: String(f.value ?? prev?.value ?? ''), created_at: f.created_at ?? prev?.created_at, updated_at: f.updated_at ?? prev?.updated_at, visibility: f.visibility ?? prev?.visibility,
+            });
+        }
+        else if (a.subject.type === 'actions_cache') {
+            if (f.deleted === true) {
+                deletedActionsCaches.add(a.subject.id);
+                continue;
+            }
+            const prev = actionsCachesById.get(a.subject.id);
+            const m = /^cache:(\d+)$/.exec(a.subject.id);
+            actionsCachesById.set(a.subject.id, {
+                id: m ? Number(m[1]) : (prev?.id ?? observedId(a.subject.id)), repository: String(f.repository ?? prev?.repository ?? ''),
+                key: String(f.key ?? prev?.key ?? ''), ref: String(f.ref ?? prev?.ref ?? 'refs/heads/main'),
+                size_in_bytes: f.size_in_bytes !== undefined ? Number(f.size_in_bytes) : (prev?.size_in_bytes ?? 0),
+                created_at: f.created_at ?? prev?.created_at, last_accessed_at: f.last_accessed_at ?? prev?.last_accessed_at,
+            });
+        }
+        else if (a.subject.type === 'actions_artifact') {
+            if (f.deleted === true) {
+                deletedActionsArtifacts.add(a.subject.id);
+                continue;
+            }
+            const prev = actionsArtifactsById.get(a.subject.id);
+            const m = /^artifact:(\d+)$/.exec(a.subject.id);
+            actionsArtifactsById.set(a.subject.id, {
+                id: m ? Number(m[1]) : (prev?.id ?? observedId(a.subject.id)), repository: String(f.repository ?? prev?.repository ?? ''),
+                name: String(f.name ?? prev?.name ?? ''), size_in_bytes: f.size_in_bytes !== undefined ? Number(f.size_in_bytes) : (prev?.size_in_bytes ?? 0),
+                run_id: f.run_id !== undefined ? Number(f.run_id) : prev?.run_id, expired: f.expired ?? prev?.expired ?? false, created_at: f.created_at ?? prev?.created_at,
+            });
+        }
+        else if (a.subject.type === 'star') {
+            // subject id = `star:<login>:<owner>/<repo>` (the World's user when no login); `starred` is the last-write boolean.
+            const m = /^star:(?:([^:/]+):)?(.+)$/.exec(a.subject.id);
+            if (m)
+                starsByRepo.set(`${m[1] ?? GITHUB_WORLD_USER}|${m[2]}`, f.starred !== false);
+        }
+        else if (a.subject.type === 'repo_subscription') {
+            const m = /^watch:(?:([^:/]+):)?(.+)$/.exec(a.subject.id);
+            if (m)
+                watchingByRepo.set(`${m[1] ?? GITHUB_WORLD_USER}|${m[2]}`, f.subscribed !== false);
+        }
+        else if (a.subject.type === 'user_following') {
+            // subject id = `following:<follower>:<login>` (the World's user when no follower); `following` is the last-write boolean.
+            const m = /^following:(?:([^:]+):)?(.+)$/.exec(a.subject.id);
+            if (m)
+                followingByLogin.set(`${m[1] ?? GITHUB_WORLD_USER}|${m[2]}`, f.following !== false);
+        }
+        else if (a.subject.type === 'organization') {
+            const prev = orgsById.get(a.subject.id);
+            orgsById.set(a.subject.id, {
+                login: String(f.login ?? prev?.login ?? a.subject.id.replace(/^org:/, '')),
+                description: f.description !== undefined ? f.description : prev?.description,
+                name: f.name !== undefined ? f.name : prev?.name,
+                company: f.company !== undefined ? f.company : prev?.company,
+                blog: f.blog !== undefined ? f.blog : prev?.blog,
+                location: f.location !== undefined ? f.location : prev?.location,
+                email: f.email !== undefined ? f.email : prev?.email,
+                billing_email: f.billing_email !== undefined ? f.billing_email : prev?.billing_email,
+                two_factor_requirement_enabled: typeof f.two_factor_requirement_enabled === 'boolean' ? f.two_factor_requirement_enabled : prev?.two_factor_requirement_enabled,
+                created_at: f.created_at ?? prev?.created_at, updated_at: f.updated_at ?? prev?.updated_at,
+            });
+        }
+        else if (a.subject.type === 'org_membership') {
+            if (f.deleted === true) {
+                deletedOrgMembers.add(a.subject.id);
+                continue;
+            }
+            const prev = orgMembersById.get(a.subject.id);
+            orgMembersById.set(a.subject.id, {
+                org: String(f.org ?? prev?.org ?? ''), login: String(f.login ?? prev?.login ?? ''),
+                role: String(f.role ?? prev?.role ?? 'member'), state: String(f.state ?? prev?.state ?? 'active'),
+                created_at: f.created_at ?? prev?.created_at,
+            });
+        }
+        else if (a.subject.type === 'outside_collaborator') {
+            if (f.deleted === true) {
+                deletedOutsideCollabs.add(a.subject.id);
+                continue;
+            }
+            const prev = outsideCollabsById.get(a.subject.id);
+            outsideCollabsById.set(a.subject.id, { org: String(f.org ?? prev?.org ?? ''), login: String(f.login ?? prev?.login ?? '') });
+        }
+        else if (a.subject.type === 'org_webhook') {
+            if (f.deleted === true) {
+                deletedOrgWebhooks.add(a.subject.id);
+                continue;
+            }
+            const m = /^orghook:(\d+)$/.exec(a.subject.id);
+            const id = m ? Number(m[1]) : observedId(a.subject.id);
+            const prev = orgWebhooksById.get(a.subject.id);
+            orgWebhooksById.set(a.subject.id, {
+                id, org: String(f.org ?? prev?.org ?? ''), name: 'web',
+                active: f.active !== undefined ? Boolean(f.active) : (prev?.active ?? true),
+                events: f.events !== undefined ? f.events : (prev?.events ?? ['push']),
+                url: f.url ?? prev?.url, content_type: f.content_type ?? prev?.content_type,
+                created_at: f.created_at ?? prev?.created_at, updated_at: f.updated_at ?? prev?.updated_at,
+            });
+        }
+        else if (a.subject.type === 'team') {
+            if (f.deleted === true) {
+                deletedTeams.add(a.subject.id);
+                continue;
+            }
+            const m = /^team:(\d+)$/.exec(a.subject.id);
+            const id = m ? Number(m[1]) : observedId(a.subject.id);
+            const prev = teamsById.get(a.subject.id);
+            teamsById.set(a.subject.id, {
+                id, org: String(f.org ?? prev?.org ?? ''), slug: String(f.slug ?? prev?.slug ?? ''),
+                name: String(f.name ?? prev?.name ?? ''),
+                description: f.description !== undefined ? f.description : prev?.description,
+                privacy: f.privacy !== undefined ? String(f.privacy) : (prev?.privacy ?? 'secret'),
+                permission: f.permission !== undefined ? String(f.permission) : (prev?.permission ?? 'pull'),
+                created_at: f.created_at ?? prev?.created_at, updated_at: f.updated_at ?? prev?.updated_at,
+            });
+        }
+        else if (a.subject.type === 'team_membership') {
+            if (f.deleted === true) {
+                deletedTeamMembers.add(a.subject.id);
+                continue;
+            }
+            const prev = teamMembersById.get(a.subject.id);
+            teamMembersById.set(a.subject.id, {
+                org: String(f.org ?? prev?.org ?? ''), team_slug: String(f.team_slug ?? prev?.team_slug ?? ''),
+                login: String(f.login ?? prev?.login ?? ''), role: String(f.role ?? prev?.role ?? 'member'),
+                state: String(f.state ?? prev?.state ?? 'active'),
+            });
+        }
+        else if (a.subject.type === 'team_repo') {
+            if (f.deleted === true) {
+                deletedTeamRepos.add(a.subject.id);
+                continue;
+            }
+            const prev = teamReposById.get(a.subject.id);
+            teamReposById.set(a.subject.id, {
+                org: String(f.org ?? prev?.org ?? ''), team_slug: String(f.team_slug ?? prev?.team_slug ?? ''),
+                repository: String(f.repository ?? prev?.repository ?? ''), permission: String(f.permission ?? prev?.permission ?? 'pull'),
+            });
+        }
+        else if (a.subject.type === 'commit_comment') {
+            if (f.deleted === true) {
+                deletedCommitComments.add(a.subject.id);
+                continue;
+            }
+            const m = /^commitcomment:(\d+)$/.exec(a.subject.id);
+            const id = m ? Number(m[1]) : observedId(a.subject.id);
+            const prev = commitCommentsById.get(a.subject.id);
+            commitCommentsById.set(a.subject.id, {
+                id, repository: String(f.repository ?? prev?.repository ?? ''), commit_sha: String(f.commit_sha ?? prev?.commit_sha ?? ''),
+                body: f.body !== undefined ? f.body : prev?.body,
+                path: f.path !== undefined ? f.path : prev?.path,
+                line: f.line !== undefined ? f.line : prev?.line,
+                position: f.position !== undefined ? f.position : prev?.position,
+                created_at: f.created_at ?? prev?.created_at, updated_at: f.updated_at ?? prev?.updated_at,
+            });
+        }
+        else if (a.subject.type === 'issue_type') {
+            if (f.deleted === true) {
+                deletedIssueTypes.add(a.subject.id);
+                continue;
+            }
+            const m = /^issuetype:(\d+)$/.exec(a.subject.id);
+            const id = m ? Number(m[1]) : observedId(a.subject.id);
+            const prev = issueTypesById.get(a.subject.id);
+            issueTypesById.set(a.subject.id, {
+                id, org: String(f.org ?? prev?.org ?? ''), name: String(f.name ?? prev?.name ?? ''),
+                description: f.description !== undefined ? f.description : prev?.description,
+                color: f.color !== undefined ? f.color : prev?.color,
+                is_enabled: f.is_enabled !== undefined ? Boolean(f.is_enabled) : (prev?.is_enabled ?? true),
+                created_at: f.created_at ?? prev?.created_at, updated_at: f.updated_at ?? prev?.updated_at,
+            });
+        }
+        else if (a.subject.type === 'deploy_key') {
+            if (f.deleted === true) {
+                deletedDeployKeys.add(a.subject.id);
+                continue;
+            }
+            const m = /^deploykey:(\d+)$/.exec(a.subject.id);
+            const prev = deployKeysById.get(a.subject.id);
+            deployKeysById.set(a.subject.id, {
+                id: m ? Number(m[1]) : observedId(a.subject.id), repository: String(f.repository ?? prev?.repository ?? ''),
+                key: String(f.key ?? prev?.key ?? ''), title: String(f.title ?? prev?.title ?? ''),
+                read_only: f.read_only !== undefined ? Boolean(f.read_only) : (prev?.read_only ?? true),
+                created_at: f.created_at ?? prev?.created_at,
+            });
+        }
+        else if (a.subject.type === 'autolink') {
+            if (f.deleted === true) {
+                deletedAutolinks.add(a.subject.id);
+                continue;
+            }
+            const m = /^autolink:(\d+)$/.exec(a.subject.id);
+            const prev = autolinksById.get(a.subject.id);
+            autolinksById.set(a.subject.id, {
+                id: m ? Number(m[1]) : observedId(a.subject.id), repository: String(f.repository ?? prev?.repository ?? ''),
+                key_prefix: String(f.key_prefix ?? prev?.key_prefix ?? ''), url_template: String(f.url_template ?? prev?.url_template ?? ''),
+                is_alphanumeric: f.is_alphanumeric !== undefined ? Boolean(f.is_alphanumeric) : (prev?.is_alphanumeric ?? true),
+            });
+        }
+        else if (a.subject.type === 'ruleset') {
+            if (f.deleted === true) {
+                deletedRulesets.add(a.subject.id);
+                continue;
+            }
+            const m = /^ruleset:(\d+)$/.exec(a.subject.id);
+            const prev = rulesetsById.get(a.subject.id);
+            rulesetsById.set(a.subject.id, {
+                id: m ? Number(m[1]) : observedId(a.subject.id), repository: String(f.repository ?? prev?.repository ?? ''),
+                name: String(f.name ?? prev?.name ?? ''), target: String(f.target ?? prev?.target ?? 'branch'),
+                enforcement: String(f.enforcement ?? prev?.enforcement ?? 'active'),
+                rules: Array.isArray(f.rules) ? f.rules : (prev?.rules ?? []),
+                conditions: f.conditions !== undefined ? f.conditions : prev?.conditions,
+                bypass_actors: Array.isArray(f.bypass_actors) ? f.bypass_actors : prev?.bypass_actors,
+                versions: Array.isArray(f.versions) ? f.versions : prev?.versions,
+                created_at: f.created_at ?? prev?.created_at, updated_at: f.updated_at ?? prev?.updated_at,
+            });
+        }
+        else if (a.subject.type === 'rule_suite') {
+            const m = /^rulesuite:(\d+)$/.exec(a.subject.id);
+            ruleSuitesById.set(a.subject.id, { id: m ? Number(m[1]) : observedId(a.subject.id), repository: String(f.repository ?? ''), ref: String(f.ref ?? ''), actor_login: String(f.actor_login ?? ''),
+                before_sha: String(f.before_sha ?? ''), after_sha: String(f.after_sha ?? ''), pushed_at: String(f.pushed_at ?? ''), result: (f.result ?? 'pass'),
+                rules: Array.isArray(f.rules) ? f.rules : [] });
+        }
+        else if (a.subject.type === 'user_email') {
+            if (f.deleted === true) {
+                deletedUserEmails.add(a.subject.id);
+                continue;
+            }
+            const prev = userEmailsByAddr.get(a.subject.id);
+            userEmailsByAddr.set(a.subject.id, {
+                email: String(f.email ?? prev?.email ?? ''), primary: f.primary !== undefined ? Boolean(f.primary) : (prev?.primary ?? false),
+                verified: f.verified !== undefined ? Boolean(f.verified) : (prev?.verified ?? true),
+                visibility: f.visibility !== undefined ? f.visibility : (prev?.visibility ?? null),
+            });
+        }
+        else if (a.subject.type === 'user_ssh_key') {
+            if (f.deleted === true) {
+                deletedUserSshKeys.add(a.subject.id);
+                continue;
+            }
+            const m = /^sshkey:(\d+)$/.exec(a.subject.id);
+            const prev = userSshKeysById.get(a.subject.id);
+            userSshKeysById.set(a.subject.id, {
+                id: m ? Number(m[1]) : observedId(a.subject.id), key: String(f.key ?? prev?.key ?? ''),
+                title: String(f.title ?? prev?.title ?? ''), created_at: f.created_at ?? prev?.created_at,
+            });
+        }
+        else if (a.subject.type === 'user_gpg_key') {
+            if (f.deleted === true) {
+                deletedUserGpgKeys.add(a.subject.id);
+                continue;
+            }
+            const m = /^gpgkey:(\d+)$/.exec(a.subject.id);
+            const prev = userGpgKeysById.get(a.subject.id);
+            userGpgKeysById.set(a.subject.id, {
+                id: m ? Number(m[1]) : observedId(a.subject.id), key_id: String(f.key_id ?? prev?.key_id ?? ''),
+                raw_key: String(f.raw_key ?? prev?.raw_key ?? ''), created_at: f.created_at ?? prev?.created_at,
+            });
+        }
+        else if (a.subject.type === 'user_block') {
+            // PUT sets, DELETE clears — boolean per login (last write per subject id wins).
+            blockedByLogin.set(String(f.login ?? a.subject.id.replace(/^block:/, '')), f.deleted !== true);
+        }
+        else if (a.subject.type === 'user_profile') {
+            // PATCH /user — overlay the authenticated user's editable profile fields.
+            for (const k of ['name', 'bio', 'company', 'blog', 'location', 'email']) {
+                if (f[k] !== undefined)
+                    userProfile[k] = f[k];
+            }
+        }
+        else if (a.subject.type === 'project_field' || a.subject.type === 'project_item' || a.subject.type === 'project_view') {
+            // a project's fields, items and views: the fields as written, the id the subject's
+            const parts = projectParts[a.subject.type];
+            if (f.deleted === true) {
+                parts.delete(a.subject.id);
+                continue;
+            }
+            parts.set(a.subject.id, { ...(parts.get(a.subject.id) ?? {}), ...f, id: Number(a.subject.id.split(':').pop()) });
+        }
+        else if (a.subject.type === 'project') {
+            if (f.deleted === true) {
+                deletedProjects.add(a.subject.id);
+                continue;
+            }
+            const m = /^project:(\d+)$/.exec(a.subject.id);
+            const prev = projectsById.get(a.subject.id);
+            projectsById.set(a.subject.id, {
+                id: m ? Number(m[1]) : observedId(a.subject.id), owner: String(f.owner ?? prev?.owner ?? ''),
+                owner_type: String(f.owner_type ?? prev?.owner_type ?? 'organization'),
+                number: f.number !== undefined ? Number(f.number) : (prev?.number ?? 0),
+                title: String(f.title ?? prev?.title ?? ''),
+                short_description: f.short_description !== undefined ? f.short_description : prev?.short_description,
+                readme: f.readme !== undefined ? f.readme : prev?.readme,
+                creator_login: f.creator_login ?? prev?.creator_login,
+                public: f.public !== undefined ? Boolean(f.public) : prev?.public,
+                closed: f.closed !== undefined ? Boolean(f.closed) : (prev?.closed ?? false),
+                created_at: f.created_at ?? prev?.created_at, updated_at: f.updated_at ?? prev?.updated_at,
+            });
+        }
+        else if (a.subject.type === 'code_scanning_alert') {
+            const m = /^csalert:(.+)#(\d+)$/.exec(a.subject.id);
+            const prev = codeScanningAlertsById.get(a.subject.id);
+            codeScanningAlertsById.set(a.subject.id, {
+                number: f.number !== undefined ? Number(f.number) : (prev?.number ?? (m ? Number(m[2]) : 0)),
+                repository: String(f.repository ?? prev?.repository ?? (m ? m[1] : '')), state: String(f.state ?? prev?.state ?? 'open'), rule_id: String(f.rule_id ?? prev?.rule_id ?? ''), rule_severity: String(f.rule_severity ?? prev?.rule_severity ?? 'warning'),
+                rule_description: f.rule_description !== undefined ? String(f.rule_description) : prev?.rule_description,
+                tool_name: String(f.tool_name ?? prev?.tool_name ?? 'CodeQL'), tool_version: f.tool_version !== undefined ? String(f.tool_version) : prev?.tool_version,
+                dismissed_reason: f.dismissed_reason !== undefined ? f.dismissed_reason : prev?.dismissed_reason,
+                dismissed_comment: f.dismissed_comment !== undefined ? f.dismissed_comment : prev?.dismissed_comment,
+                dismissed_at: f.dismissed_at !== undefined ? f.dismissed_at : prev?.dismissed_at,
+                dismissed_by_login: f.dismissed_by_login !== undefined ? f.dismissed_by_login : prev?.dismissed_by_login,
+                created_at: f.created_at ?? prev?.created_at, updated_at: f.updated_at ?? prev?.updated_at,
+                fixed_at: f.fixed_at !== undefined ? f.fixed_at : prev?.fixed_at,
+                most_recent_instance: f.most_recent_instance !== undefined ? f.most_recent_instance : prev?.most_recent_instance,
+            });
+        }
+        else if (a.subject.type === 'code_scanning_analysis') {
+            if (f.deleted === true) {
+                deletedCodeScanningAnalyses.add(a.subject.id);
+                continue;
+            }
+            const m = /^csanalysis:(\d+)$/.exec(a.subject.id);
+            const prev = codeScanningAnalysesById.get(a.subject.id);
+            codeScanningAnalysesById.set(a.subject.id, {
+                id: m ? Number(m[1]) : observedId(a.subject.id), repository: String(f.repository ?? prev?.repository ?? ''),
+                ref: String(f.ref ?? prev?.ref ?? 'refs/heads/main'), commit_sha: String(f.commit_sha ?? prev?.commit_sha ?? ''),
+                analysis_key: String(f.analysis_key ?? prev?.analysis_key ?? ''), environment: f.environment !== undefined ? String(f.environment) : prev?.environment,
+                tool_name: String(f.tool_name ?? prev?.tool_name ?? 'CodeQL'), results_count: Number(f.results_count ?? prev?.results_count ?? 0),
+                rules_count: Number(f.rules_count ?? prev?.rules_count ?? 0), sarif_id: f.sarif_id !== undefined ? String(f.sarif_id) : prev?.sarif_id,
+                created_at: f.created_at ?? prev?.created_at, deletable: f.deletable !== undefined ? Boolean(f.deletable) : (prev?.deletable ?? true),
+            });
+        }
+        else if (a.subject.type === 'dependabot_alert') {
+            const m = /^dependabot:(.+)#(\d+)$/.exec(a.subject.id);
+            const prev = dependabotAlertsById.get(a.subject.id);
+            dependabotAlertsById.set(a.subject.id, {
+                number: f.number !== undefined ? Number(f.number) : (prev?.number ?? (m ? Number(m[2]) : 0)),
+                repository: String(f.repository ?? prev?.repository ?? (m ? m[1] : '')), state: String(f.state ?? prev?.state ?? 'open'), package_name: String(f.package_name ?? prev?.package_name ?? ''), ecosystem: String(f.ecosystem ?? prev?.ecosystem ?? 'npm'), ghsa_id: String(f.ghsa_id ?? prev?.ghsa_id ?? ''), severity: String(f.severity ?? prev?.severity ?? 'high'),
+                summary: f.summary !== undefined ? String(f.summary) : prev?.summary, manifest_path: f.manifest_path !== undefined ? String(f.manifest_path) : prev?.manifest_path,
+                dismissed_reason: f.dismissed_reason !== undefined ? f.dismissed_reason : prev?.dismissed_reason,
+                dismissed_comment: f.dismissed_comment !== undefined ? f.dismissed_comment : prev?.dismissed_comment,
+                dismissed_at: f.dismissed_at !== undefined ? f.dismissed_at : prev?.dismissed_at,
+                dismissed_by_login: f.dismissed_by_login !== undefined ? f.dismissed_by_login : prev?.dismissed_by_login,
+                created_at: f.created_at ?? prev?.created_at, updated_at: f.updated_at ?? prev?.updated_at,
+            });
+        }
+        else if (a.subject.type === 'secret_scanning_alert') {
+            const m = /^secretscan:(.+)#(\d+)$/.exec(a.subject.id);
+            const prev = secretScanningAlertsById.get(a.subject.id);
+            secretScanningAlertsById.set(a.subject.id, {
+                number: f.number !== undefined ? Number(f.number) : (prev?.number ?? (m ? Number(m[2]) : 0)),
+                repository: String(f.repository ?? prev?.repository ?? (m ? m[1] : '')), state: String(f.state ?? prev?.state ?? 'open'), secret_type: String(f.secret_type ?? prev?.secret_type ?? ''),
+                secret_type_display_name: f.secret_type_display_name !== undefined ? String(f.secret_type_display_name) : prev?.secret_type_display_name,
+                resolution: f.resolution !== undefined ? f.resolution : prev?.resolution,
+                resolution_comment: f.resolution_comment !== undefined ? f.resolution_comment : prev?.resolution_comment,
+                resolved_at: f.resolved_at !== undefined ? f.resolved_at : prev?.resolved_at,
+                created_at: f.created_at ?? prev?.created_at, updated_at: f.updated_at ?? prev?.updated_at,
+                locations: Array.isArray(f.locations) ? f.locations : prev?.locations,
+                _secret: f._secret !== undefined ? String(f._secret) : prev?._secret,
+            });
+        }
+        else if (a.subject.type === 'app_installation') {
+            if (f.deleted === true) {
+                deletedAppInstallations.add(a.subject.id);
+                continue;
+            }
+            const m = /^installation:(\d+)$/.exec(a.subject.id);
+            const prev = appInstallationsById.get(a.subject.id);
+            appInstallationsById.set(a.subject.id, {
+                id: m ? Number(m[1]) : observedId(a.subject.id), account_login: String(f.account_login ?? prev?.account_login ?? ''),
+                account_type: String(f.account_type ?? prev?.account_type ?? 'Organization'), app_id: Number(f.app_id ?? prev?.app_id ?? 0),
+                app_slug: String(f.app_slug ?? prev?.app_slug ?? ''), target_type: String(f.target_type ?? prev?.target_type ?? 'Organization'),
+                repository_selection: String(f.repository_selection ?? prev?.repository_selection ?? 'all'),
+                permissions: f.permissions ?? prev?.permissions ?? {},
+                events: Array.isArray(f.events) ? f.events : (prev?.events ?? []),
+                created_at: f.created_at ?? prev?.created_at, updated_at: f.updated_at ?? prev?.updated_at,
+                ...(Array.isArray(f.repositories) ? { repositories: f.repositories } : prev?.repositories ? { repositories: prev.repositories } : {}),
+            });
+        }
+        else if (a.subject.type === 'oauth_grant') {
+            if (f.deleted === true) {
+                deletedOAuthGrants.add(a.subject.id);
+                continue;
+            }
+            const prev = oauthGrantsById.get(a.subject.id);
+            oauthGrantsById.set(a.subject.id, {
+                token: String(f.token ?? prev?.token ?? ''), client_id: String(f.client_id ?? prev?.client_id ?? ''),
+                scopes: Array.isArray(f.scopes) ? f.scopes : (prev?.scopes ?? []), created_at: f.created_at ?? prev?.created_at,
+                ...(typeof (f.login ?? prev?.login) === 'string' ? { login: String(f.login ?? prev?.login) } : {}),
+            });
+        }
+        else if (a.subject.type === 'package') {
+            if (f.deleted === true) {
+                deletedPackages.add(a.subject.id);
+                continue;
+            }
+            const m = /^package:(\d+)$/.exec(a.subject.id);
+            const prev = packagesById.get(a.subject.id);
+            packagesById.set(a.subject.id, {
+                id: m ? Number(m[1]) : observedId(a.subject.id), name: String(f.name ?? prev?.name ?? ''),
+                package_type: String(f.package_type ?? prev?.package_type ?? 'npm'), owner: String(f.owner ?? prev?.owner ?? ''),
+                visibility: String(f.visibility ?? prev?.visibility ?? 'private'), created_at: f.created_at ?? prev?.created_at, updated_at: f.updated_at ?? prev?.updated_at,
+            });
+        }
+        else if (a.subject.type === 'package_version') {
+            if (f.deleted === true) {
+                deletedPackageVersions.add(a.subject.id);
+                continue;
+            }
+            const m = /^packageversion:(\d+)$/.exec(a.subject.id);
+            const prev = packageVersionsById.get(a.subject.id);
+            packageVersionsById.set(a.subject.id, {
+                id: m ? Number(m[1]) : observedId(a.subject.id), package_name: String(f.package_name ?? prev?.package_name ?? ''),
+                package_type: String(f.package_type ?? prev?.package_type ?? 'npm'), owner: String(f.owner ?? prev?.owner ?? ''),
+                name: String(f.name ?? prev?.name ?? ''), tags: Array.isArray(f.tags) ? f.tags : prev?.tags,
+                created_at: f.created_at ?? prev?.created_at, updated_at: f.updated_at ?? prev?.updated_at,
+            });
+        }
+        else if (a.subject.type === 'pages_site') {
+            if (f.deleted === true) {
+                deletedPagesSites.add(a.subject.id);
+                continue;
+            }
+            // a site created again after a delete is live again
+            deletedPagesSites.delete(a.subject.id);
+            const prev = pagesSitesById.get(a.subject.id);
+            pagesSitesById.set(a.subject.id, {
+                repository: String(f.repository ?? prev?.repository ?? ''), cname: f.cname !== undefined ? f.cname : prev?.cname,
+                cert_requested_at: f.cert_requested_at !== undefined ? f.cert_requested_at : prev?.cert_requested_at,
+                status: String(f.status ?? prev?.status ?? 'built'), source_branch: String(f.source_branch ?? prev?.source_branch ?? 'main'),
+                source_path: String(f.source_path ?? prev?.source_path ?? '/'), build_type: f.build_type !== undefined ? String(f.build_type) : (prev?.build_type ?? 'legacy'),
+                public: f.public !== undefined ? Boolean(f.public) : (prev?.public ?? true), https_enforced: f.https_enforced !== undefined ? Boolean(f.https_enforced) : (prev?.https_enforced ?? true),
+                html_url: f.html_url !== undefined ? String(f.html_url) : prev?.html_url, created_at: f.created_at ?? prev?.created_at, updated_at: f.updated_at ?? prev?.updated_at,
+            });
+        }
+        else if (a.subject.type === 'pages_build') {
+            const m = /^pagesbuild:(\d+)$/.exec(a.subject.id);
+            const prev = pagesBuildsById.get(a.subject.id);
+            pagesBuildsById.set(a.subject.id, {
+                id: m ? Number(m[1]) : observedId(a.subject.id), repository: String(f.repository ?? prev?.repository ?? ''),
+                status: String(f.status ?? prev?.status ?? 'built'), error_message: f.error_message !== undefined ? f.error_message : (prev?.error_message ?? null),
+                commit: f.commit !== undefined ? String(f.commit) : prev?.commit, duration: f.duration !== undefined ? Number(f.duration) : prev?.duration,
+                created_at: f.created_at ?? prev?.created_at,
+            });
+        }
+        else if (a.subject.type === 'codespace') {
+            if (f.deleted === true) {
+                deletedCodespaces.add(a.subject.id);
+                continue;
+            }
+            const prev = codespacesById.get(a.subject.id);
+            codespacesById.set(a.subject.id, {
+                name: String(f.name ?? prev?.name ?? ''), repository: String(f.repository ?? prev?.repository ?? ''),
+                state: String(f.state ?? prev?.state ?? 'Available'), machine: String(f.machine ?? prev?.machine ?? 'basicLinux32gb'),
+                git_branch: String(f.git_branch ?? prev?.git_branch ?? 'main'), owner: String(f.owner ?? prev?.owner ?? 'octocat'),
+                created_at: f.created_at ?? prev?.created_at, updated_at: f.updated_at ?? prev?.updated_at,
+            });
+        }
+        else if (a.subject.type === 'pull_request_review') {
+            const repository = String(f.repository ?? '');
+            const number = Number(f.number);
+            if (!repository || !number)
+                continue;
+            // A review exists only on a pull request — evidence that this number is one.
+            ensure(`${repository}#${number}`, number, repository).is_pull_request = true;
+            const m = /^review:(\d+)$/.exec(a.subject.id);
+            reviews.push({ id: m ? Number(m[1]) : observedId(a.subject.id), repository, number, state: f.state, body: f.body, submitted_at: f.submitted_at, ...(f.commit_id !== undefined ? { commit_id: String(f.commit_id) } : {}), ...(f.user_login !== undefined ? { user_login: String(f.user_login) } : {}), ...(f.user_type !== undefined ? { user_type: f.user_type } : {}), ...(f.author_association !== undefined ? { author_association: String(f.author_association) } : {}) });
+        }
+        else if (a.subject.type === 'pull_request_review_overlay') {
+            // A dismiss / body-edit on a submitted review (keyed by review id). Overlaid below.
+            const rid = Number(f.review_id ?? 0);
+            const prev = reviewOverlaysById.get(rid);
+            reviewOverlaysById.set(rid, {
+                id: rid,
+                state: f.state !== undefined ? String(f.state) : prev?.state,
+                body: f.body !== undefined ? String(f.body) : prev?.body,
+                dismissed_message: f.dismissed_message !== undefined ? String(f.dismissed_message) : prev?.dismissed_message,
+            });
+        }
+        else if (a.subject.type === 'issue_comment' || a.subject.type === 'pull_request_review_comment') {
+            if (f.deleted === true) {
+                deletedCommentSubjects.add(a.subject.id);
+                continue;
+            }
+            const repository = String(f.repository ?? '');
+            const number = Number(f.number);
+            if (!repository || !number)
+                continue;
+            const shell = ensure(`${repository}#${number}`, number, repository);
+            // A review comment is PR-only evidence (see the observed fold); an issue comment is not.
+            if (a.subject.type === 'pull_request_review_comment')
+                shell.is_pull_request = true;
+            const m = /^comment:(\d+)$/.exec(a.subject.id);
+            // An edit (or a delete) names the SAME subject as the create, so the comment the list
+            // serves and the comment the per-comment door serves are one object, not two.
+            const prev = localCommentBySubject.get(a.subject.id);
+            const comment = prev ?? { id: m ? Number(m[1]) : observedId(a.subject.id), repository, number, kind: a.subject.type === 'pull_request_review_comment' ? 'review' : 'issue' };
+            comment.subject_id = a.subject.id;
+            if (typeof f.commit_id === 'string')
+                comment.commit_id = f.commit_id;
+            if (f.body !== undefined)
+                comment.body = f.body;
+            if (f.created_at !== undefined)
+                comment.created_at = f.created_at;
+            if (f.updated_at !== undefined)
+                comment.updated_at = f.updated_at;
+            // diff-position anchoring — LOCAL review-comment writes only.
+            if (f.path !== undefined)
+                comment.path = String(f.path);
+            if (f.line !== undefined)
+                comment.line = Number(f.line);
+            if (f.side !== undefined)
+                comment.side = String(f.side);
+            if (f.start_line !== undefined)
+                comment.start_line = Number(f.start_line);
+            if (f.diff_hunk !== undefined)
+                comment.diff_hunk = String(f.diff_hunk);
+            if (f.in_reply_to !== undefined)
+                comment.in_reply_to = Number(f.in_reply_to);
+            // The review this comment was submitted under (an explicit one when the write named it,
+            // otherwise the PR's implicit review) and WHO wrote it — both recorded at write time.
+            if (f.review_id !== undefined)
+                comment.review_id = Number(f.review_id);
+            if (typeof f.user_login === 'string')
+                comment.user_login = f.user_login;
+            if (f.user_type !== undefined)
+                comment.user_type = f.user_type;
+            if (f.author_association !== undefined)
+                comment.author_association = String(f.author_association);
+            if (f.external_id !== undefined)
+                comment.external_id = String(f.external_id);
+            if (!prev) {
+                comments.push(comment);
+                localCommentBySubject.set(a.subject.id, comment);
+            }
+        }
+    }
+    for (const [id, h] of transitionsOf('issue')) {
+        const iss = issues.get(id);
+        if (iss)
+            iss.state_history = h;
+    }
+    for (const [id, h] of transitionsOf('pull_request')) {
+        const pr = prs.get(id);
+        if (pr)
+            pr.state_history = h;
+    }
+    for (const [id, a] of activityOf('issue')) {
+        const iss = issues.get(id);
+        if (iss)
+            iss.activity = a;
+    }
+    for (const [id, a] of activityOf('pull_request')) {
+        const pr = prs.get(id);
+        if (pr)
+            pr.activity = a;
+    }
+    // Tombstoned comments leave the fold entirely — the list, the per-comment door and the
+    // issue's comment count all stop seeing a deleted comment at the same moment.
+    const tombstonedComments = new Set();
+    for (const id of deletedCommentSubjects) {
+        const c = localCommentBySubject.get(id);
+        if (c)
+            tombstonedComments.add(c);
+    }
+    const liveComments = tombstonedComments.size ? comments.filter((c) => !tombstonedComments.has(c)) : comments;
+    // Apply review overlays (dismiss / body-edit) — last write per field wins on the matching id.
+    for (const r of reviews) {
+        const ov = reviewOverlaysById.get(r.id);
+        if (!ov)
+            continue;
+        if (ov.state !== undefined)
+            r.state = ov.state;
+        if (ov.body !== undefined)
+            r.body = ov.body;
+    }
+    // Derive the evidence counts the _twin block still reports from the folded objects.
+    for (const r of reviews)
+        ensure(`${r.repository}#${r.number}`, r.number, r.repository).review_count += 1;
+    // THE IMPLICIT REVIEW IS ONE OF THEM. `GET /pulls/:n/reviews` synthesizes the wrapper from
+    // the comments that name it and SERVES it, exactly as real GitHub does — and real GitHub
+    // counts it. The count read only the STORED rows, so a PR whose reviews page answers one
+    // review reported `review_count: 0` and the mirror rendered "Review count 0" over it. The
+    // condition here is the handler's, verbatim, so the count and the list can never describe
+    // different populations: one wrapper per PR that has at least one comment naming it.
+    const wrappedPrs = new Set();
+    for (const c of liveComments) {
+        if (c.kind !== 'review' || c.review_id !== implicitReviewId(c.repository, c.number))
+            continue;
+        const key = `${c.repository}#${c.number}`;
+        if (wrappedPrs.has(key))
+            continue;
+        wrappedPrs.add(key);
+        ensure(key, c.number, c.repository).review_count += 1;
+    }
+    for (const c of liveComments)
+        ensure(`${c.repository}#${c.number}`, c.number, c.repository).comment_count += 1;
+    const byRepoNum = (a, b) => a.repository === b.repository ? a.number - b.number : a.repository < b.repository ? -1 : 1;
+    // Releases: drop tombstoned ids; sort newest-first per repo (descending id — GitHub lists
+    // releases most-recent-first). Assets: drop tombstoned + any whose release is gone.
+    const releases = [...releasesById.entries()].filter(([k]) => !deletedReleases.has(k)).map(([, v]) => v)
+        .sort((a, b) => (a.repository === b.repository ? b.id - a.id : a.repository < b.repository ? -1 : 1));
+    const liveReleaseKeys = new Set(releases.map((r) => `${r.repository}#${r.id}`));
+    const releaseAssets = [...assetsById.entries()].filter(([k]) => !deletedAssets.has(k)).map(([, v]) => v)
+        .filter((a) => liveReleaseKeys.has(`${a.repository}#${a.release_id}`))
+        .sort((a, b) => a.id - b.id);
+    // Tags derived from PUBLISHED (non-draft) releases — a published release creates its tag.
+    // The twin has no real git object, so the commit sha is deterministic (hash of repo+tag).
+    const tagMap = new Map();
+    for (const r of releases) {
+        if (r.draft)
+            continue;
+        const key = `${r.repository}#${r.tag_name}`;
+        if (!r.tag_name || tagMap.has(key))
+            continue;
+        tagMap.set(key, { name: r.tag_name, repository: r.repository, commit_sha: createHash('sha256').update(`${r.repository}:tag:${r.tag_name}`).digest('hex').slice(0, 40) });
+    }
+    const tags = [...tagMap.values()].sort((a, b) => (a.repository === b.repository ? (a.name < b.name ? -1 : 1) : a.repository < b.repository ? -1 : 1));
+    // Discussions: drop tombstoned; sort newest-first per repo (descending number — GitHub
+    // lists discussions most-recent-first). Comments: drop tombstoned + orphans (their
+    // discussion is gone); sort oldest-first (thread order).
+    const discussions = [...discussionsById.entries()].filter(([k]) => !deletedDiscussions.has(k)).map(([, v]) => v)
+        .sort((a, b) => (a.repository === b.repository ? b.number - a.number : a.repository < b.repository ? -1 : 1));
+    const liveDiscussionKeys = new Set(discussions.map((d) => `${d.repository}#${d.number}`));
+    const discussionComments = [...discussionCommentsById.entries()].filter(([k]) => !deletedDiscussionComments.has(k)).map(([, v]) => v)
+        .filter((c) => liveDiscussionKeys.has(`${c.repository}#${c.discussion_number}`))
+        .sort((a, b) => a.id - b.id);
+    // A discussion's accepted answer is DERIVED from its comments' is_answer flags (the single
+    // source of truth) — so the answer pointer never needs a separate, dedup-prone discussion
+    // write. The chosen answer is the answered comment with the highest id (last-marked wins).
+    for (const d of discussions) {
+        const answered = discussionComments.filter((c) => c.repository === d.repository && c.discussion_number === d.number && c.is_answer);
+        d.answer_comment_id = answered.length ? answered[answered.length - 1].id : null;
+    }
+    // New LOCAL collections — drop tombstoned ids, sort deterministically.
+    const reactions = [...reactionsById.entries()].filter(([k]) => !deletedReactions.has(k)).map(([, v]) => v).sort((a, b) => a.id - b.id);
+    const labels = [...labelsById.entries()].filter(([k]) => !deletedLabels.has(k)).map(([, v]) => v)
+        .sort((a, b) => (a.repository === b.repository ? (a.name < b.name ? -1 : 1) : a.repository < b.repository ? -1 : 1));
+    const repos = [...reposById.entries()].filter(([k]) => !deletedRepos.has(k)).map(([, v]) => v)
+        .sort((a, b) => (a.full_name < b.full_name ? -1 : a.full_name > b.full_name ? 1 : 0));
+    const branches = [...branchesById.entries()].filter(([k]) => !deletedBranches.has(k)).map(([, v]) => v)
+        .sort((a, b) => (a.repository === b.repository ? (a.name < b.name ? -1 : 1) : a.repository < b.repository ? -1 : 1));
+    const collaborators = [...collaboratorsById.entries()].filter(([k]) => !deletedCollaborators.has(k)).map(([, v]) => v)
+        .sort((a, b) => (a.repository === b.repository ? (a.login < b.login ? -1 : 1) : a.repository < b.repository ? -1 : 1));
+    const webhooks = [...webhooksById.entries()].filter(([k]) => !deletedWebhooks.has(k)).map(([, v]) => v).sort((a, b) => a.id - b.id);
+    const contents = [...contentsById.entries()].filter(([k]) => !deletedContents.has(k)).map(([, v]) => v)
+        .sort((a, b) => (a.repository === b.repository ? (a.path < b.path ? -1 : 1) : a.repository < b.repository ? -1 : 1));
+    const gists = [...gistsById.entries()].filter(([k]) => !deletedGists.has(k)).map(([, v]) => v)
+        .sort((a, b) => (a.id < b.id ? -1 : a.id > b.id ? 1 : 0));
+    const notifications = [...notificationsById.values()].sort((a, b) => (a.id < b.id ? -1 : a.id > b.id ? 1 : 0));
+    // Git Data objects — drop tombstoned refs; sort deterministically.
+    const gitRefs = [...gitRefsById.entries()].filter(([k]) => !deletedGitRefs.has(k)).map(([, v]) => v)
+        .sort((a, b) => (a.repository === b.repository ? (a.ref < b.ref ? -1 : 1) : a.repository < b.repository ? -1 : 1));
+    const gitCommits = [...gitCommitsById.values()].sort((a, b) => (a.sha < b.sha ? -1 : a.sha > b.sha ? 1 : 0));
+    const gitTrees = [...gitTreesById.values()].sort((a, b) => (a.sha < b.sha ? -1 : a.sha > b.sha ? 1 : 0));
+    const gitBlobs = [...gitBlobsById.values()].sort((a, b) => (a.sha < b.sha ? -1 : a.sha > b.sha ? 1 : 0));
+    const gitTagObjects = [...gitTagObjectsById.values()].sort((a, b) => (a.sha < b.sha ? -1 : a.sha > b.sha ? 1 : 0));
+    // Deployments newest-first per repo (descending id); statuses oldest-first (chronological).
+    const deployments = [...deploymentsById.values()].sort((a, b) => (a.repository === b.repository ? b.id - a.id : a.repository < b.repository ? -1 : 1));
+    const deploymentStatuses = [...deploymentStatusesById.values()].sort((a, b) => a.id - b.id);
+    const environments = [...environmentsById.entries()].filter(([k]) => !deletedEnvironments.has(k)).map(([, v]) => v)
+        .sort((a, b) => (a.repository === b.repository ? (a.name < b.name ? -1 : 1) : a.repository < b.repository ? -1 : 1));
+    const actionsSecrets = [...actionsSecretsById.entries()].filter(([k]) => !deletedActionsSecrets.has(k)).map(([, v]) => v)
+        .sort((a, b) => (a.name < b.name ? -1 : a.name > b.name ? 1 : 0));
+    const actionsVariables = [...actionsVariablesById.entries()].filter(([k]) => !deletedActionsVariables.has(k)).map(([, v]) => v)
+        .sort((a, b) => (a.name < b.name ? -1 : a.name > b.name ? 1 : 0));
+    const actionsCaches = [...actionsCachesById.entries()].filter(([k]) => !deletedActionsCaches.has(k)).map(([, v]) => v).sort((a, b) => a.id - b.id);
+    const actionsArtifacts = [...actionsArtifactsById.entries()].filter(([k]) => !deletedActionsArtifacts.has(k)).map(([, v]) => v).sort((a, b) => a.id - b.id);
+    // Orgs / teams / followers / commit comments / issue types — drop tombstoned, sort deterministically.
+    const orgs = [...orgsById.values()].sort((a, b) => (a.login < b.login ? -1 : a.login > b.login ? 1 : 0));
+    const orgMembers = [...orgMembersById.entries()].filter(([k]) => !deletedOrgMembers.has(k)).map(([, v]) => v)
+        .sort((a, b) => (a.org === b.org ? (a.login < b.login ? -1 : 1) : a.org < b.org ? -1 : 1));
+    const outsideCollaborators = [...outsideCollabsById.entries()].filter(([k]) => !deletedOutsideCollabs.has(k)).map(([, v]) => v)
+        .sort((a, b) => (a.org === b.org ? (a.login < b.login ? -1 : 1) : a.org < b.org ? -1 : 1));
+    const orgWebhooks = [...orgWebhooksById.entries()].filter(([k]) => !deletedOrgWebhooks.has(k)).map(([, v]) => v).sort((a, b) => a.id - b.id);
+    const teams = [...teamsById.entries()].filter(([k]) => !deletedTeams.has(k)).map(([, v]) => v)
+        .sort((a, b) => (a.org === b.org ? (a.slug < b.slug ? -1 : 1) : a.org < b.org ? -1 : 1));
+    const teamMembers = [...teamMembersById.entries()].filter(([k]) => !deletedTeamMembers.has(k)).map(([, v]) => v)
+        .sort((a, b) => (a.team_slug === b.team_slug ? (a.login < b.login ? -1 : 1) : a.team_slug < b.team_slug ? -1 : 1));
+    const teamRepos = [...teamReposById.entries()].filter(([k]) => !deletedTeamRepos.has(k)).map(([, v]) => v)
+        .sort((a, b) => (a.team_slug === b.team_slug ? (a.repository < b.repository ? -1 : 1) : a.team_slug < b.team_slug ? -1 : 1));
+    const commitComments = [...commitCommentsById.entries()].filter(([k]) => !deletedCommitComments.has(k)).map(([, v]) => v).sort((a, b) => a.id - b.id);
+    const issueTypes = [...issueTypesById.entries()].filter(([k]) => !deletedIssueTypes.has(k)).map(([, v]) => v)
+        .sort((a, b) => (a.org === b.org ? (a.name < b.name ? -1 : 1) : a.org < b.org ? -1 : 1));
+    // Repos niche / user niche / projects — drop tombstoned, sort deterministically.
+    const deployKeys = [...deployKeysById.entries()].filter(([k]) => !deletedDeployKeys.has(k)).map(([, v]) => v).sort((a, b) => a.id - b.id);
+    const autolinks = [...autolinksById.entries()].filter(([k]) => !deletedAutolinks.has(k)).map(([, v]) => v).sort((a, b) => a.id - b.id);
+    const rulesets = [...rulesetsById.entries()].filter(([k]) => !deletedRulesets.has(k)).map(([, v]) => v).sort((a, b) => a.id - b.id);
+    const ruleSuites = [...ruleSuitesById.values()].sort((a, b) => a.id - b.id);
+    const userEmails = [...userEmailsByAddr.entries()].filter(([k]) => !deletedUserEmails.has(k)).map(([, v]) => v)
+        .sort((a, b) => (a.primary === b.primary ? (a.email < b.email ? -1 : 1) : a.primary ? -1 : 1));
+    const userSshKeys = [...userSshKeysById.entries()].filter(([k]) => !deletedUserSshKeys.has(k)).map(([, v]) => v).sort((a, b) => a.id - b.id);
+    const userGpgKeys = [...userGpgKeysById.entries()].filter(([k]) => !deletedUserGpgKeys.has(k)).map(([, v]) => v).sort((a, b) => a.id - b.id);
+    const projects = [...projectsById.entries()].filter(([k]) => !deletedProjects.has(k)).map(([, v]) => v)
+        .sort((a, b) => (a.owner === b.owner ? a.number - b.number : a.owner < b.owner ? -1 : 1));
+    const liveProjects = new Set(projects.map((p) => p.id));
+    const partsOf = (parts) => [...parts.values()].filter((x) => liveProjects.has(Number(x.project_id))).sort((a, b) => Number(a.id) - Number(b.id));
+    const projectFields = partsOf(projectParts.project_field);
+    const projectItems = partsOf(projectParts.project_item);
+    const projectViews = partsOf(projectParts.project_view);
+    // Security alerts: sort per-repo ascending by number (GitHub lists alerts oldest-first).
+    const byRepoNumAsc = (a, b) => a.repository === b.repository ? a.number - b.number : a.repository < b.repository ? -1 : 1;
+    const codeScanningAlerts = [...codeScanningAlertsById.values()].sort(byRepoNumAsc);
+    const codeScanningAnalyses = [...codeScanningAnalysesById.entries()].filter(([k]) => !deletedCodeScanningAnalyses.has(k)).map(([, v]) => v)
+        .sort((a, b) => (a.repository === b.repository ? b.id - a.id : a.repository < b.repository ? -1 : 1));
+    const dependabotAlerts = [...dependabotAlertsById.values()].sort(byRepoNumAsc);
+    const secretScanningAlerts = [...secretScanningAlertsById.values()].sort(byRepoNumAsc);
+    const appInstallations = [...appInstallationsById.entries()].filter(([k]) => !deletedAppInstallations.has(k)).map(([, v]) => v).sort((a, b) => a.id - b.id);
+    const oauthGrants = [...oauthGrantsById.entries()].filter(([k]) => !deletedOAuthGrants.has(k)).map(([, v]) => v);
+    const packages = [...packagesById.entries()].filter(([k]) => !deletedPackages.has(k)).map(([, v]) => v)
+        .sort((a, b) => (a.owner === b.owner ? (a.name < b.name ? -1 : 1) : a.owner < b.owner ? -1 : 1));
+    const packageVersions = [...packageVersionsById.entries()].filter(([k]) => !deletedPackageVersions.has(k)).map(([, v]) => v).sort((a, b) => b.id - a.id);
+    const pagesSites = [...pagesSitesById.entries()].filter(([k]) => !deletedPagesSites.has(k)).map(([, v]) => v)
+        .sort((a, b) => (a.repository < b.repository ? -1 : a.repository > b.repository ? 1 : 0));
+    const livePagesRepos = new Set(pagesSites.map((s) => s.repository));
+    const pagesBuilds = [...pagesBuildsById.values()].filter((b) => livePagesRepos.has(b.repository)).sort((a, b) => (a.repository === b.repository ? b.id - a.id : a.repository < b.repository ? -1 : 1));
+    const codespaces = [...codespacesById.entries()].filter(([k]) => !deletedCodespaces.has(k)).map(([, v]) => v)
+        .sort((a, b) => (a.name < b.name ? -1 : a.name > b.name ? 1 : 0));
+    const liveIssues = [...issues.values()];
+    const livePrs = [...prs.values()];
+    const starCount = countBy(edgesOf(starsByRepo).map((e) => e.to));
+    const watchCount = countBy(edgesOf(watchingByRepo).map((e) => e.to));
+    const forkCount = countBy(repos.filter((r) => r.parent_full_name).map((r) => r.parent_full_name));
+    const openCount = countBy([...liveIssues.filter((i) => (i.state ?? 'open') === 'open').map((i) => i.repository), ...livePrs.filter((p) => p.is_pull_request && (p.state ?? 'open') === 'open').map((p) => p.repository)]);
+    // a milestone counts the issues and pull requests in it, open and closed (docs.github.com/rest/issues/milestones)
+    for (const ms of milestones.values()) {
+        const inIt = [...liveIssues, ...livePrs.filter((p) => p.is_pull_request)].filter((x) => x.repository === ms.repository && Number(x.milestone) === ms.number);
+        ms.open_issues = inIt.filter((x) => (x.state ?? 'open') === 'open').length;
+        ms.closed_issues = inIt.length - ms.open_issues;
+    }
+    for (const r of repos) {
+        if (r.facts)
+            continue;
+        const files = contents.filter((c) => c.repository === r.full_name && (c.branch ?? r.default_branch ?? 'main') === (r.default_branch ?? 'main'));
+        const bytes = (c) => Math.floor(((c.content_b64 ?? '').replace(/\s/g, '').length * 3) / 4);
+        r.facts = {
+            stargazers_count: starCount.get(r.full_name) ?? 0, subscribers_count: watchCount.get(r.full_name) ?? 0,
+            forks_count: forkCount.get(r.full_name) ?? 0, open_issues_count: openCount.get(r.full_name) ?? 0,
+            pushed_at: pushedAt.get(r.full_name) ?? r.created_at ?? null,
+            size: Math.ceil(files.reduce((n, c) => n + bytes(c), 0) / 1024),
+            language: languageOf(files.map((c) => ({ path: c.path, bytes: bytes(c) }))),
+            license: licenseOf(files.find((c) => /^(LICENSE|LICENCE|COPYING)(\.(md|txt))?$/i.test(c.path))),
+            has_pages: pagesSites.some((s) => s.repository === r.full_name),
+        };
+    }
+    return {
+        prs: [...prs.values()].sort(byRepoNum),
+        issues: [...issues.values()].sort(byRepoNum),
+        reviews,
+        comments: liveComments,
+        statuses,
+        checkRuns: [...checkRunsById.values()].sort((a, b) => a.id - b.id),
+        milestones: [...milestones.values()].sort(byRepoNum),
+        workflows: [...workflows.values()].sort((a, b) => (a.repository === b.repository ? a.id - b.id : a.repository < b.repository ? -1 : 1)),
+        workflowRuns: [...runsById.values()].sort((a, b) => (a.repository === b.repository ? a.id - b.id : a.repository < b.repository ? -1 : 1)),
+        jobs: [...jobsById.values()].sort((a, b) => a.id - b.id),
+        releases,
+        releaseAssets,
+        tags,
+        discussions,
+        discussionComments,
+        reactions,
+        labels,
+        repos,
+        branches,
+        collaborators,
+        webhooks,
+        contents,
+        gists,
+        notifications,
+        gitRefs,
+        gitCommits,
+        gitTrees,
+        gitBlobs,
+        gitTagObjects,
+        deployments,
+        deploymentStatuses,
+        environments,
+        actionsSecrets,
+        actionsVariables,
+        actionsCaches,
+        actionsArtifacts,
+        orgs,
+        orgMembers,
+        outsideCollaborators,
+        orgWebhooks,
+        teams,
+        teamMembers,
+        teamRepos,
+        commitComments,
+        issueTypes,
+        deployKeys,
+        autolinks,
+        rulesets,
+        ruleSuites,
+        userEmails,
+        userSshKeys,
+        userGpgKeys,
+        blockedUsers: new Set([...blockedByLogin.entries()].filter(([, on]) => on).map(([k]) => k)),
+        userProfile,
+        projects,
+        projectFields,
+        projectItems,
+        projectViews,
+        stars: pairsOf(starsByRepo, GITHUB_WORLD_USER), watching: pairsOf(watchingByRepo, GITHUB_WORLD_USER), following: pairsOf(followingByLogin, GITHUB_WORLD_USER),
+        starEdges: edgesOf(starsByRepo), watchEdges: edgesOf(watchingByRepo), followEdges: edgesOf(followingByLogin),
+        codeScanningAlerts,
+        codeScanningAnalyses,
+        dependabotAlerts,
+        secretScanningAlerts,
+        appInstallations,
+        oauthGrants,
+        packages,
+        packageVersions,
+        pagesSites,
+        pagesBuilds,
+        codespaces,
+    };
+}
+// GitHub takes labels by name on write and answers full label objects. A name the repository has no label
+// for is created with GitHub's defaults (grey, no description) when it is applied, and answers that way.
+export function toLabels(names, repository, labels = []) {
+    return (names ?? []).map((name) => toGithubLabel(labels.find((l) => l.repository === repository && l.name === name) ?? { id: actionsId(`${repository}:label:${name}`), repository, name }));
+}
+// Build the GitHub simple-user array for assignees from bare logins. Same honesty note:
+// only the login is known, the rest of the simple-user object is declared scope (assignee.*).
+export function toAssignees(logins) {
+    return (logins ?? []).map((login) => ({ login }));
+}
+// Map a milestone to GitHub's REST milestone shape, with the counts the fold made.
+export function toGithubMilestone(ms) {
+    const api = `https://api.github.com/repos/${ms.repository}`;
+    const out = {
+        id: ms.id,
+        node_id: nodeId('Milestone', ms.id),
+        number: ms.number,
+        creator: ms.creator_login ? toSimpleUser(ms.creator_login) : null,
+        state: ms.state ?? 'open',
+        title: ms.title ?? '',
+        description: ms.description ?? null,
+        url: `${api}/milestones/${ms.number}`,
+        html_url: `https://github.com/${ms.repository}/milestone/${ms.number}`,
+        labels_url: `${api}/milestones/${ms.number}/labels`,
+        open_issues: ms.open_issues ?? 0,
+        closed_issues: ms.closed_issues ?? 0,
+        created_at: ms.created_at ?? null,
+        updated_at: ms.updated_at ?? null,
+        closed_at: ms.state === 'closed' ? ms.updated_at ?? null : null,
+        due_on: ms.due_on ?? null,
+    };
+    return out;
+}
+// Map a twin PR to GitHub's REST pull-request shape (fields we have; observed-only
+// title/body stay null unless a local write supplied them).
+export function toGithubRest(pr, milestones) {
+    const repo = pr.repository;
+    const n = pr.number;
+    const api = `https://api.github.com/repos/${repo}`;
+    const ms = pr.milestone !== undefined ? (milestones ?? []).find((m) => m.repository === repo && m.number === pr.milestone) : undefined;
+    const out = {
+        number: n,
+        // Stable modeled REST identity, using the same namespace mapping as observed records.
+        id: observedId(`pull_request:${pr.born_in ?? repo}#${n}`),
+        ...(pr.updated_at ? { updated_at: pr.updated_at } : {}),
+        // The same synthetic node identity accepted by the twin's GraphQL API.
+        node_id: `PR_${repo}#${n}`,
+        ...(pr.user_login ? { user: { login: pr.user_login, ...(pr.user_type ? { type: pr.user_type } : {}) } } : {}),
+        state: pr.state ?? 'open',
+        author_association: pr.author_association ?? 'NONE',
+        merged: pr.merged ?? false,
+        maintainer_can_modify: pr.maintainer_can_modify ?? false,
+        _links: {
+            self: { href: `${api}/pulls/${n}` }, html: { href: `https://github.com/${repo}/pull/${n}` }, issue: { href: `${api}/issues/${n}` },
+            comments: { href: `${api}/issues/${n}/comments` }, review_comments: { href: `${api}/pulls/${n}/comments` },
+            review_comment: { href: `${api}/pulls/comments{/number}` }, commits: { href: `${api}/pulls/${n}/commits` },
+            statuses: { href: `${api}/statuses/${pr.head_sha ?? ''}` },
+        },
+        // URL templates — derivable from repo+number, so faithfully emitted (R1).
+        url: `${api}/pulls/${n}`,
+        html_url: `https://github.com/${repo}/pull/${n}`,
+        diff_url: `https://github.com/${repo}/pull/${n}.diff`,
+        patch_url: `https://github.com/${repo}/pull/${n}.patch`,
+        issue_url: `${api}/issues/${n}`,
+        commits_url: `${api}/pulls/${n}/commits`,
+        review_comments_url: `${api}/pulls/${n}/comments`,
+        review_comment_url: `${api}/pulls/comments{/number}`,
+        comments_url: `${api}/issues/${n}/comments`,
+        // Faithful empties/nulls — the real API returns these for a PR with none set.
+        body: pr.body ?? null,
+        labels: toLabels(pr.labels, pr.repository),
+        locked: pr.locked ?? false,
+        active_lock_reason: pr.active_lock_reason ?? null,
+        assignee: pr.assignees && pr.assignees.length ? { login: pr.assignees[0] } : null,
+        assignees: toAssignees(pr.assignees),
+        // requested_reviewers: bare-login simple-user array (like assignees). Empty for
+        // observed-only PRs (no review-REQUEST evidence). The rest of the user object is
+        // declared scope (requestedReviewer.*). requested_teams is not modeled (scope).
+        requested_reviewers: toAssignees(pr.requested_reviewers),
+        requested_teams: [],
+        // milestone: full object when a local PATCH set one and the milestone exists; else null
+        // (the faithful empty real GitHub returns for a PR with no milestone).
+        milestone: ms ? toGithubMilestone(ms) : null,
+        // draft: a PR opened/edited as a draft (LOCAL writes). Defaults to false (real GitHub
+        // returns the boolean). auto_merge: a {merge_method,...} object when enabled, else null.
+        draft: pr.draft ?? false,
+        auto_merge: null,
+        merge_commit_sha: null,
+        merged_at: null,
+        closed_at: null,
+        // mergeable: an observed pull request's reported mergeable_state (clean→true, dirty→false), else null; one with
+        // history has it computed when read (semantics/pulls.ts)
+        // (real GitHub returns null until it computes mergeability asynchronously).
+        mergeable: pr.mergeable_state === 'clean' ? true : pr.mergeable_state === 'dirty' ? false : null,
+        mergeable_state: pr.mergeable_state ?? 'unknown',
+        merged_by: null,
+        // The base repository is the PR's stored repository. Other repository fields,
+        // branch-owner identity and base.sha remain declared scope.
+        base: { ...(pr.base_ref !== undefined ? { ref: pr.base_ref } : {}), repo: { full_name: repo } },
+        // head.ref (the branch) + head.label (owner:ref) are emitted for LOCAL PRs that recorded the
+        // branch; observed PRs carry head_sha only (the declared head.ref/head.label deviation). A pull request from a
+        // fork names the fork: its owner in the label and its repository as the head's.
+        head: (pr.head_sha !== undefined || pr.head_ref !== undefined)
+            ? {
+                ...(pr.head_ref !== undefined ? { label: `${(pr.head_repo ?? pr.repository).split('/')[0]}:${pr.head_ref}`, ref: pr.head_ref } : {}),
+                ...(pr.head_repo !== undefined ? { repo: { full_name: pr.head_repo } } : {}),
+                ...(pr.head_sha !== undefined ? { sha: pr.head_sha } : {}),
+            }
+            : {},
+    };
+    if (pr.head_sha !== undefined)
+        out.statuses_url = `${api}/statuses/${pr.head_sha}`;
+    // Content + counts: present only when observed/written; emitted correctly typed
+    // when known, omitted (and declared scope) when not — never a wrong-typed null.
+    if (pr.title !== undefined)
+        out.title = pr.title;
+    if (pr.changed_files !== undefined)
+        out.changed_files = pr.changed_files;
+    if (pr.commits !== undefined)
+        out.commits = pr.commits;
+    // additions/deletions: roll up from a carried file list (LOCAL writes). Omitted (and
+    // declared scope) when no diff was supplied — observed PRs never carry line counts.
+    if (pr.additions !== undefined)
+        out.additions = pr.additions;
+    if (pr.deletions !== undefined)
+        out.deletions = pr.deletions;
+    // Merge outcome: emitted (correctly typed) once a local merge write lands; before
+    // that `merged` stays declared evidence-twin scope (omitted, not a faked boolean).
+    if (pr.merged !== undefined)
+        out.merged = pr.merged;
+    if (pr.merged_at !== undefined) {
+        out.merged_at = pr.merged_at;
+        out.closed_at = pr.merged_at;
+    }
+    if (pr.merge_commit_sha !== undefined)
+        out.merge_commit_sha = pr.merge_commit_sha;
+    if (pr.merged_by_login)
+        out.merged_by = toSimpleUser(pr.merged_by_login);
+    if (pr.created_at)
+        out.created_at = pr.created_at;
+    return out;
+}
+// ── WHO a write is by when its token names no personal account ──────────────────────────
+// On GitHub a token has one owner and every write it makes is that owner's. The World's shared token
+// authenticates the World's default user (GET /user answers octocat for it), so its writes are octocat's
+// too: a comment, a review or a webhook's sender names the same person the reads do. A personal token
+// minted at POST /_twin/users/:login/tokens names its own user (callerLogin). A PULLED review carries the
+// login real GitHub named instead.
+export const GITHUB_WORLD_USER = 'octocat';
+/** The user a request's token authenticates, as GitHub attributes a write to the token's owner: a personal token
+ *  minted at `POST /_twin/users/:login/tokens` names its user, an app installation's token its bot (`<app>[bot]`).
+ *  Any other token (the World's shared fake) names no one, and the twin keeps its deterministic defaults. */
+export function callerLogin(token, root) {
+    if (!token)
+        return undefined;
+    // every request asks, several times: the logins are read once per World state from the grant rows
+    const store = getActiveWorldStore();
+    const memos = loginMemos.get(store) ?? loginMemos.set(store, new Map()).get(store);
+    const stamp = treeStamp(SERVICE, root);
+    let held = memos.get(root ?? '');
+    if (!held || held.stamp !== stamp) {
+        const logins = new Map();
+        for (const r of twinResources(SERVICE, root)) {
+            if (r.deleted === true || typeof r.token !== 'string')
+                continue;
+            if (r.type === 'oauth_grant' && typeof r.login === 'string')
+                logins.set(r.token, r.login);
+            // an installation token acts as the app's bot
+            if (r.type === 'app_token' && typeof r.app_slug === 'string')
+                logins.set(r.token, `${r.app_slug}[bot]`);
+        }
+        held = { stamp, logins };
+        memos.set(root ?? '', held);
+    }
+    return held.logins.get(token);
+}
+const loginMemos = new WeakMap();
+/** Whether a token GitHub issued has stopped working (an installation token expired with its run, a grant revoked). It is
+ *  refused, never taken as the World's own user: "Authenticating with invalid credentials will initially return a
+ *  `401 Unauthorized` response" (https://docs.github.com/rest/authentication/authenticating-to-the-rest-api); the message,
+ *  "Bad credentials", is GitHub's live answer, which its pages do not quote. A token the twin never issued is the World's
+ *  shared token, and is not refused. */
+export function revokedToken(token, root) {
+    if (!token || callerLogin(token, root) !== undefined)
+        return false;
+    return twinResources(SERVICE, root).some((r) => r.deleted === true && r.token === token && (r.type === 'oauth_grant' || r.type === 'app_token'));
+}
+// Deterministic account id per login (never random, never Date.now), in its own id band so it
+// cannot collide with an observed subject id (0x40000000…) or a check-suite id (0x70000000…).
+export function twinUserId(login) {
+    return 0x10000000 + (parseInt(createHash('sha256').update(`user:${login}`).digest('hex').slice(0, 8), 16) % 0x0fffffff);
+}
+// GitHub's simple-user object for a login the twin actually knows. Only `login` and `type`
+// are FACTS; the URLs are derived shape and the unmodeled remainder is declared scope
+// (`user.*` in github-known-deviations.json), exactly like `toAssignees`.
+/** How GitHub describes a person's relation to a repository (author_association): its owner, a member of the
+ *  organization that owns it, a collaborator, someone whose pull request it merged, or none of these. */
+export function authorAssociation(st, repo, login) {
+    if (!login)
+        return 'NONE';
+    const owner = repo.split('/')[0];
+    if (login === owner)
+        return 'OWNER';
+    if (st.orgMembers.some((m) => m.org === owner && m.login === login && m.state === 'active'))
+        return 'MEMBER';
+    if (st.collaborators.some((c) => c.repository === repo && c.login === login))
+        return 'COLLABORATOR';
+    if (st.prs.some((p) => p.repository === repo && p.user_login === login && p.merged))
+        return 'CONTRIBUTOR';
+    return 'NONE';
+}
+/** A GitHub node id in the legacy form GitHub still issues and accepts: base64 of the type name's length, the type
+ *  name and the object's id (`MDU6SXNzdWUx` is `05:Issue1`). Deterministic, so a replay mints the same one. */
+export const nodeId = (type, id) => Buffer.from(`${String(type.length).padStart(2, '0')}:${type}${id}`).toString('base64');
+/** The links GitHub gives every account, as it writes them; the avatar is served by avatars.githubusercontent.com. */
+export function userLinks(login, id) {
+    const at = (path) => `https://api.github.com/users/${login}/${path}`;
+    return {
+        avatar_url: `https://avatars.githubusercontent.com/u/${id}?v=4`, gravatar_id: '', url: `https://api.github.com/users/${login}`, html_url: `https://github.com/${login}`,
+        followers_url: at('followers'), following_url: at('following{/other_user}'), gists_url: at('gists{/gist_id}'), starred_url: at('starred{/owner}{/repo}'),
+        subscriptions_url: at('subscriptions'), organizations_url: at('orgs'), repos_url: at('repos'), events_url: at('events{/privacy}'), received_events_url: at('received_events'),
+    };
+}
+export function toSimpleUser(login, type = 'User') {
+    return {
+        login,
+        id: twinUserId(login),
+        node_id: nodeId('User', twinUserId(login)),
+        type,
+        site_admin: false,
+        ...userLinks(login, twinUserId(login)),
+    };
+}
+// THE IMPLICIT REVIEW. Real GitHub wraps EVERY inline comment in a review: a comment posted
+// through `POST .../pulls/:n/comments` with no review of its own still comes back naming a
+// `pull_request_review_id`, and that wrapper review appears on `GET .../pulls/:n/reviews`.
+// The twin used to serve `pull_request_review_id: null` on every review comment, which made
+// the join a consumer does (comment → its review) DEAD against the twin's own data. So the
+// wrapper is minted DETERMINISTICALLY per (repo, PR): one implicit review per PR, the same id
+// every time. It is synthesized on the reviews READ from the comments that name it — never
+// stored as a review of its own, because it is a wrapper, not a verdict — and `githubState`
+// counts it into the pull request's review count under exactly the condition the read uses, so the count
+// and the list describe one population.
+//
+// WHY IT CANNOT COLLIDE, precisely — the band is NOT the reason. Its offset (0x80000000…)
+// separates it from the twin's own two id spaces, the local sequence (small integers) and
+// `observedId`'s hash band (0x40000000…), and that is all it does: real GitHub's own review
+// ids have been in the 0x80000000 range since ~2024, so a band argument against VENDOR ids
+// would be false. The actual invariant is that a vendor id is never a twin id: every pulled
+// review and comment is REHASHED through `observedId` before it is served (nothing arrives
+// carrying its raw GitHub id), and no review id is ever sent back OUT — a push addresses a
+// vendor comment by the `external_id` the pull recorded, never by a minted one.
+export function implicitReviewId(repository, number) {
+    return 0x80000000 + (parseInt(createHash('sha256').update(`implicit-review:${repository}#${number}`).digest('hex').slice(0, 8), 16) % 0x3fffffff);
+}
+// Map a submitted review to GitHub's pull-request-review shape. `id` is an INTEGER
+// (real GitHub ids are integers; the twin's internal subject id stays `review:N`).
+// node_id/_links/author_association are declared evidence-twin scope (not fabricated).
+// Real GitHub takes a submit VERB on POST .../reviews (`event`) and stores a review STATE —
+// they are deliberately different words: APPROVE→APPROVED, REQUEST_CHANGES→CHANGES_REQUESTED,
+// COMMENT→COMMENTED. A twin that stores the verb serves `state: "APPROVE"`, and every consumer
+// that gates on the vendor's own vocabulary (`state === 'APPROVED'`, a merge gate counting
+// CHANGES_REQUESTED, the GraphQL PullRequestReviewState enum) reads it as no approval at all.
+// The mapping is applied ONCE, at submission, so the state the reviews API serves, the state
+// the timeline lower-cases and the state a merge gate counts are the same stored string.
+// Already-vendor-shaped states (APPROVED, DISMISSED, PENDING, an observed review's own state)
+// pass through untouched, which also makes this idempotent.
+const REVIEW_EVENT_STATES = { APPROVE: 'APPROVED', REQUEST_CHANGES: 'CHANGES_REQUESTED', COMMENT: 'COMMENTED' };
+export function reviewStateForEvent(event) {
+    if (event === undefined || event === null || event === '')
+        return 'COMMENTED';
+    const verb = String(event);
+    return REVIEW_EVENT_STATES[verb.toUpperCase()] ?? verb;
+}
+export function toGithubReview(a) {
+    const api = `https://api.github.com/repos/${a.repository}`;
+    const out = {
+        id: a.id,
+        node_id: nodeId('PullRequestReview', a.id),
+        // WHO reviewed — the twin's own login on a local write, the vendor's on a pulled one,
+        // and `null` only when the author is genuinely unknown.
+        user: a.user_login === undefined ? null : toSimpleUser(a.user_login, a.user_type ?? 'User'),
+        body: a.body ?? '',
+        state: a.state ?? 'COMMENTED',
+        // The head sha the review bound to at submission (exact-head re-earn); null only for
+        // legacy/observed reviews whose submission head was never recorded.
+        commit_id: a.commit_id ?? null,
+        html_url: `https://github.com/${a.repository}/pull/${a.number}#pullrequestreview-${a.id}`,
+        pull_request_url: `${api}/pulls/${a.number}`,
+        author_association: a.author_association ?? 'NONE',
+        _links: { html: { href: `https://github.com/${a.repository}/pull/${a.number}#pullrequestreview-${a.id}` }, pull_request: { href: `${api}/pulls/${a.number}` } },
+    };
+    if (a.submitted_at !== undefined)
+        out.submitted_at = a.submitted_at;
+    return out;
+}
+// Map a created issue comment to GitHub's issue-comment shape. `id` is an INTEGER;
+// node_id is declared evidence-twin scope. created_at/updated_at use the write time.
+export function toGithubComment(a) {
+    const api = `https://api.github.com/repos/${a.repository}`;
+    const out = {
+        id: a.id,
+        node_id: nodeId('IssueComment', a.id),
+        user: a.user_login === undefined ? null : toSimpleUser(a.user_login, a.user_type ?? 'User'),
+        body: a.body ?? '',
+        url: `${api}/issues/comments/${a.id}`,
+        html_url: `https://github.com/${a.repository}/issues/${a.number}#issuecomment-${a.id}`,
+        issue_url: `${api}/issues/${a.number}`,
+    };
+    // Observed comments carry no timestamp — omit (declared scope) rather than fake an
+    // empty-string date. Local writes supply `at`, so they emit real created_at/updated_at.
+    // An EDIT moves updated_at off created_at, which is the only way a consumer can tell a
+    // comment has been edited, so the two are carried separately once they differ.
+    if (a.at !== undefined)
+        out.created_at = a.at;
+    if (a.updated_at !== undefined || a.at !== undefined)
+        out.updated_at = a.updated_at ?? a.at;
+    return out;
+}
+// The ONE mapping from a stored issue comment to the vendor's shape — shared by the thread
+// list (GET .../issues/:n/comments) and the per-comment door (GET/PATCH .../issues/comments/:id)
+// so the two can never disagree about the same comment.
+export function serializeIssueComment(c) {
+    return toGithubComment({
+        id: c.id, repository: c.repository, number: c.number, body: c.body,
+        ...(c.user_login !== undefined ? { user_login: c.user_login } : {}),
+        ...(c.user_type !== undefined ? { user_type: c.user_type } : {}),
+        ...(c.created_at !== undefined ? { at: c.created_at } : {}),
+        ...(c.updated_at !== undefined ? { updated_at: c.updated_at } : {}),
+    });
+}
+// Map a created review comment to GitHub's pull-request review-comment shape. Distinct
+// from an issue comment: it carries pull_request_url + pull_request_review_id. The
+// diff-position fields (path/line/side/start_line/diff_hunk) are emitted for LOCAL writes
+// that anchored the comment to the diff; for OBSERVED review comments (no diff evidence)
+// they are omitted and stay declared scope (reviewComment.*). `id` is an INTEGER.
+export function toGithubReviewComment(a) {
+    const api = `https://api.github.com/repos/${a.repository}`;
+    const out = {
+        id: a.id,
+        node_id: nodeId('PullRequestReviewComment', a.id),
+        ...(a.commit_id !== undefined ? { commit_id: a.commit_id } : {}),
+        user: a.user_login === undefined ? null : toSimpleUser(a.user_login, a.user_type ?? 'User'),
+        body: a.body ?? '',
+        url: `${api}/pulls/comments/${a.id}`,
+        html_url: `https://github.com/${a.repository}/pull/${a.number}#discussion_r${a.id}`,
+        pull_request_url: `${api}/pulls/${a.number}`,
+        author_association: a.author_association ?? 'NONE',
+        // the commit it was first written against: the same one until an outdated comment is carried forward
+        original_commit_id: a.commit_id ?? '',
+        _links: { self: { href: `${api}/pulls/comments/${a.id}` }, html: { href: `https://github.com/${a.repository}/pull/${a.number}#discussion_r${a.id}` }, pull_request: { href: `${api}/pulls/${a.number}` } },
+        // THE JOIN. Every inline comment names the review that wraps it — the review it was
+        // submitted under, or the PR's implicit review when it was posted on its own. `null`
+        // only for a row whose review is genuinely unknown; it is no longer the constant answer.
+        pull_request_review_id: a.review_id ?? null,
+    };
+    // Observed review comments carry no timestamp — omit rather than fake an empty date.
+    if (a.at !== undefined)
+        out.created_at = a.at;
+    if (a.updated_at !== undefined || a.at !== undefined)
+        out.updated_at = a.updated_at ?? a.at;
+    if (a.in_reply_to !== undefined)
+        out.in_reply_to_id = a.in_reply_to;
+    // Diff anchoring — present only when a LOCAL write supplied it. diff_hunk defaults to ''
+    // (the real API always returns the string) once a path is anchored; line/side per write.
+    if (a.path !== undefined) {
+        out.path = a.path;
+        out.diff_hunk = a.diff_hunk ?? '';
+        out.line = a.line ?? null;
+        out.side = a.side ?? 'RIGHT';
+        if (a.start_line !== undefined) {
+            out.start_line = a.start_line;
+            out.start_side = a.side ?? 'RIGHT';
+        }
+    }
+    return out;
+}
+// The ONE mapping from a stored review comment to the vendor's shape — shared by the diff-thread
+// list (GET .../pulls/:n/comments) and the per-comment door (GET/PATCH .../pulls/comments/:id).
+export function serializeReviewComment(c) {
+    return toGithubReviewComment({
+        ...(c.commit_id !== undefined ? { commit_id: c.commit_id } : {}),
+        ...(c.review_id !== undefined ? { review_id: c.review_id } : {}),
+        ...(c.in_reply_to !== undefined ? { in_reply_to: c.in_reply_to } : {}),
+        ...(c.user_login !== undefined ? { user_login: c.user_login } : {}),
+        ...(c.user_type !== undefined ? { user_type: c.user_type } : {}),
+        ...(c.author_association !== undefined ? { author_association: c.author_association } : {}),
+        id: c.id, repository: c.repository, number: c.number, body: c.body,
+        ...(c.created_at !== undefined ? { at: c.created_at } : {}),
+        ...(c.updated_at !== undefined ? { updated_at: c.updated_at } : {}),
+        ...(c.path !== undefined ? { path: c.path } : {}),
+        ...(c.line !== undefined ? { line: c.line } : {}),
+        ...(c.side !== undefined ? { side: c.side } : {}),
+        ...(c.start_line !== undefined ? { start_line: c.start_line } : {}),
+        ...(c.diff_hunk !== undefined ? { diff_hunk: c.diff_hunk } : {}),
+    });
+}
+// Map a per-file diff (LOCAL PR write) to GitHub's pull-request file shape. blob/raw/contents
+// url templates and the file sha are declared scope when not supplied (pullFile.*); the twin
+// emits the diff data it was actually given (filename/status/additions/deletions/patch).
+export function toGithubPullFile(repository, sha, f) {
+    const out = {
+        filename: f.filename,
+        status: f.status,
+        additions: f.additions,
+        deletions: f.deletions,
+        changes: f.changes,
+        sha: f.sha ?? createHash('sha256').update(`${repository}:${f.filename}:${sha}`).digest('hex').slice(0, 40),
+        blob_url: `https://github.com/${repository}/blob/${sha}/${f.filename}`,
+        raw_url: `https://github.com/${repository}/raw/${sha}/${f.filename}`,
+        contents_url: `https://api.github.com/repos/${repository}/contents/${f.filename}?ref=${sha}`,
+    };
+    if (f.patch !== undefined)
+        out.patch = f.patch;
+    if (f.previous_filename !== undefined)
+        out.previous_filename = f.previous_filename;
+    return out;
+}
+// Map a twin issue to GitHub's REST issue shape. A LOCAL construct (issues are not
+// in the observed evidence fold), so title/body/timestamps come from the write. The
+// same unmodeled sub-objects as PRs (id, node_id, user, etc.) are declared scope in
+// github-known-deviations.json — never fabricated.
+// `comments` is the COUNT of issue comments on this issue — real GitHub's issue object
+// carries it, and every consumer that decides whether a thread is worth opening reads it.
+// It is derived from the same stored comments the thread list serves (the whole `comments`
+// store is passed in rather than a pre-computed number, so the count and the list cannot
+// disagree); a caller with no comment store to hand gets the honest 0 of a world with none.
+export function issueCommentCount(repository, number, comments) {
+    if (!comments)
+        return 0;
+    let n = 0;
+    for (const c of comments)
+        if (c.repository === repository && c.number === number && c.kind === 'issue')
+            n += 1;
+    return n;
+}
+/** An issue's numeric id: GitHub's `id`, distinct from its number, what the sub-issue API names a child by. */
+export function githubIssueId(repo, number) {
+    return 0x40000000 + (parseInt(createHash('sha256').update(`${repo}#issue:${number}`).digest('hex').slice(0, 8), 16) % 0x0fffffff);
+}
+export function toGithubIssue(iss, milestones, pull, comments) {
+    const repo = iss.repository;
+    const n = iss.number;
+    const api = `https://api.github.com/repos/${repo}`;
+    const ms = iss.milestone !== undefined ? (milestones ?? []).find((m) => m.repository === repo && m.number === iss.milestone) : undefined;
+    const id = githubIssueId(iss.born_in ?? repo, n);
+    return {
+        id,
+        node_id: `I_kwDO${id.toString(36)}`,
+        number: n,
+        user: toSimpleUser(iss.user_login ?? GITHUB_WORLD_USER),
+        state: iss.state ?? 'open',
+        state_reason: iss.state_reason ?? null,
+        title: iss.title ?? '',
+        body: iss.body ?? null,
+        labels: toLabels(iss.labels, iss.repository),
+        locked: iss.locked ?? false,
+        active_lock_reason: iss.active_lock_reason ?? null,
+        assignee: iss.assignees && iss.assignees.length ? { login: iss.assignees[0] } : null,
+        assignees: toAssignees(iss.assignees),
+        milestone: ms ? toGithubMilestone(ms) : null,
+        comments: issueCommentCount(repo, n, comments),
+        url: `${api}/issues/${n}`,
+        repository_url: api,
+        labels_url: `${api}/issues/${n}/labels{/name}`,
+        comments_url: `${api}/issues/${n}/comments`,
+        events_url: `${api}/issues/${n}/events`,
+        html_url: `https://github.com/${repo}/issues/${n}`,
+        created_at: iss.created_at ?? null,
+        updated_at: iss.updated_at ?? null,
+        closed_at: iss.state === 'closed' ? iss.updated_at ?? null : null,
+        author_association: iss.author_association ?? 'NONE',
+        // Every pull request is an issue, and the `pull_request` key is how every real consumer
+        // tells the two apart in an issue list. It is present ONLY on a pull request — an issue
+        // that carries it would be misread as a PR, which is the whole point of the key.
+        ...(pull ? { pull_request: { url: `${api}/pulls/${n}`, html_url: `https://github.com/${repo}/pull/${n}`, diff_url: `https://github.com/${repo}/pull/${n}.diff`, patch_url: `https://github.com/${repo}/pull/${n}.patch`, merged_at: pull.merged_at ?? null } } : {}),
+    };
+}
+// A pull request's ISSUE face — the row `GET .../issues` returns for it. Real GitHub stores
+// one object; this twin stores PRs and issues as two constructs, so the issue list projects
+// each pull request through here and serializes it with the `pull_request` key attached.
+// The PR construct carries no created_at/updated_at (both are declared deviations), so the
+// projected row's timestamps are null — the same honest empty the PR object itself returns.
+export function pullRequestAsIssue(pr) {
+    return {
+        id: `${pr.repository}#issue:${pr.number}`,
+        number: pr.number,
+        repository: pr.repository,
+        title: pr.title,
+        body: pr.body,
+        state: pr.merged ? 'closed' : (pr.state ?? 'open'),
+        labels: pr.labels,
+        assignees: pr.assignees,
+        milestone: pr.milestone,
+        locked: pr.locked,
+        active_lock_reason: pr.active_lock_reason,
+        // The open↔closed transitions come with it: the timeline served at the issue address is
+        // built from the issue face, and a pull request that was closed and reopened must say so
+        // there for exactly the reason an issue must.
+        state_history: pr.state_history,
+        activity: pr.activity,
+    };
+}
+// Map a commit status to GitHub's status shape. `id` is an INTEGER; creator/node_id and
+// avatar_url are declared scope (status.*). The twin has the state/context it was written.
+export function toGithubStatus(s) {
+    const api = `https://api.github.com/repos/${s.repository}`;
+    const out = {
+        id: s.id,
+        node_id: nodeId('StatusContext', s.id),
+        state: s.state,
+        context: s.context ?? 'default',
+        description: s.description ?? null,
+        target_url: s.target_url ?? null,
+        url: `${api}/statuses/${s.sha}`,
+        avatar_url: null,
+        creator: null,
+    };
+    if (s.created_at !== undefined)
+        out.created_at = s.created_at;
+    if (s.updated_at !== undefined)
+        out.updated_at = s.updated_at;
+    return out;
+}
+// Combine commit statuses into GitHub's combined-status shape (GET .../commits/:ref/status).
+// The combined state is failure > pending > success precedence (GitHub's rollup); with no
+// statuses GitHub reports 'pending'. Only the latest status per context counts toward the rollup.
+export function combineStatuses(repository, sha, statuses) {
+    const api = `https://api.github.com/repos/${repository}`;
+    const forSha = statuses.filter((s) => s.repository === repository && s.sha === sha);
+    // latest per context (later writes have a higher sequence id)
+    const latest = new Map();
+    for (const s of forSha) {
+        const key = s.context ?? 'default';
+        const prev = latest.get(key);
+        if (!prev || s.id > prev.id)
+            latest.set(key, s);
+    }
+    const rolled = [...latest.values()];
+    let state = 'pending';
+    if (rolled.length) {
+        if (rolled.some((s) => s.state === 'failure' || s.state === 'error'))
+            state = 'failure';
+        else if (rolled.some((s) => s.state === 'pending'))
+            state = 'pending';
+        else if (rolled.every((s) => s.state === 'success'))
+            state = 'success';
+    }
+    return {
+        state,
+        total_count: rolled.length,
+        sha,
+        statuses: rolled.sort((a, b) => a.id - b.id).map(toGithubStatus),
+        repository_url: api,
+        commit_url: `${api}/commits/${sha}`,
+        url: `${api}/commits/${sha}/status`,
+    };
+}
+// Map a check run to GitHub's check-run shape. `id` is an INTEGER; app/node_id/output and
+// the check_suite link are declared scope (checkRun.*). conclusion is null until completed.
+export function toGithubCheckRun(c, st) {
+    const suiteId = c.check_suite_id ?? checkSuiteId(c.repository, c.head_sha, c.app_slug);
+    const annCount = c.annotations?.length ?? 0;
+    const out = {
+        id: c.id,
+        node_id: nodeId('CheckRun', c.id),
+        head_sha: c.head_sha,
+        name: c.name,
+        status: c.status ?? 'queued',
+        conclusion: c.conclusion ?? null,
+        details_url: c.details_url ?? null,
+        external_id: c.external_id ?? '',
+        pull_requests: pullRequestsOn(st, c.repository, c.head_sha),
+        url: `https://api.github.com/repos/${c.repository}/check-runs/${c.id}`,
+        html_url: `https://github.com/${c.repository}/runs/${c.id}`,
+        // The suite this run belongs to (the suite link real GitHub returns on a check run).
+        check_suite: { id: suiteId },
+        app: c.app_slug ? { slug: c.app_slug, name: c.app_slug } : null,
+        // output object: title/summary/text + annotations count (the annotations themselves are
+        // fetched via .../check-runs/:id/annotations). Empty (nulls/0) until a write supplies output.
+        output: {
+            title: c.output_title ?? null,
+            summary: c.output_summary ?? null,
+            text: c.output_text ?? null,
+            annotations_count: annCount,
+            annotations_url: `https://api.github.com/repos/${c.repository}/check-runs/${c.id}/annotations`,
+        },
+    };
+    if (c.started_at !== undefined)
+        out.started_at = c.started_at;
+    out.completed_at = c.completed_at ?? null;
+    return out;
+}
+// Map a check-run annotation to GitHub's annotation shape (GET .../check-runs/:id/annotations).
+export function toGithubAnnotation(c, an) {
+    return {
+        path: an.path,
+        start_line: an.start_line,
+        end_line: an.end_line,
+        start_column: an.start_column ?? null,
+        end_column: an.end_column ?? null,
+        annotation_level: an.annotation_level,
+        title: an.title ?? null,
+        message: an.message,
+        raw_details: an.raw_details ?? null,
+        blob_href: `https://github.com/${c.repository}/blob/${c.head_sha}/${an.path}`,
+    };
+}
+// Map a check SUITE (GET .../check-suites/:id, GET .../commits/:ref/check-suites): one app's runs on one
+// commit, rolled up into the suite's status/conclusion.
+export function toGithubCheckSuite(repository, headSha, runs, app, st) {
+    const id = checkSuiteId(repository, headSha, app);
+    const suiteRuns = runs.filter((r) => r.repository === repository && r.head_sha === headSha && r.app_slug === app);
+    const allCompleted = suiteRuns.length > 0 && suiteRuns.every((r) => (r.status ?? 'queued') === 'completed');
+    const status = suiteRuns.length === 0 ? 'queued' : allCompleted ? 'completed' : (suiteRuns.some((r) => r.status === 'in_progress') ? 'in_progress' : 'queued');
+    let conclusion = null;
+    if (allCompleted) {
+        if (suiteRuns.some((r) => r.conclusion === 'failure' || r.conclusion === 'timed_out'))
+            conclusion = 'failure';
+        else if (suiteRuns.some((r) => r.conclusion === 'cancelled'))
+            conclusion = 'cancelled';
+        else if (suiteRuns.every((r) => r.conclusion === 'success' || r.conclusion === 'neutral' || r.conclusion === 'skipped'))
+            conclusion = 'success';
+    }
+    const api = `https://api.github.com/repos/${repository}`;
+    return {
+        id,
+        node_id: nodeId('CheckSuite', id),
+        head_sha: headSha,
+        head_branch: null,
+        status,
+        conclusion,
+        url: `${api}/check-suites/${id}`,
+        latest_check_runs_count: suiteRuns.length,
+        check_runs_url: `${api}/check-suites/${id}/check-runs`,
+        before: null,
+        after: null,
+        pull_requests: pullRequestsOn(st, repository, headSha),
+        app: app ? { slug: app, name: app } : null,
+        // it is created with its first run and changes with its last
+        created_at: suiteRuns.map((r) => r.started_at).filter(Boolean).sort()[0] ?? null,
+        updated_at: suiteRuns.map((r) => r.completed_at ?? r.started_at).filter(Boolean).sort().at(-1) ?? null,
+        ...(st?.repos.some((x) => x.full_name === repository) ? { repository: Object.fromEntries(Object.entries(toGithubRepo(st.repos.find((x) => x.full_name === repository))).filter(([k]) => MINIMAL_REPOSITORY.has(k))) } : {}),
+    };
+}
+// Map a reaction to GitHub's reaction shape.
+export function toGithubReaction(r) {
+    const out = { id: r.id, node_id: nodeId('Reaction', r.id), content: r.content, user: null };
+    if (r.created_at !== undefined)
+        out.created_at = r.created_at;
+    return out;
+}
+// Map a repo label to GitHub's label shape.
+export function toGithubLabel(l) {
+    return {
+        id: l.id,
+        name: l.name,
+        color: l.color ?? 'ededed',
+        description: l.description ?? null,
+        default: l.default ?? false,
+        url: `https://api.github.com/repos/${l.repository}/labels/${encodeURIComponent(l.name)}`,
+        node_id: nodeId('Label', l.id),
+        archived_at: null,
+        archived_by: null,
+    };
+}
+// Map a repository to GitHub's repository shape (the fields the twin models; the rich
+// owner/permissions/license sub-objects are declared scope — not fabricated).
+export function toGithubRepo(r) {
+    const [owner] = r.full_name.split('/');
+    const api = `https://api.github.com`;
+    const repoApi = `${api}/repos/${r.full_name}`;
+    const facts = r.facts ?? { stargazers_count: 0, subscribers_count: 0, forks_count: 0, open_issues_count: 0, pushed_at: r.created_at ?? null, size: 0, language: null, license: null, has_pages: false };
+    return {
+        ...repoUrls(repoApi),
+        clone_url: `https://github.com/${r.full_name}.git`, git_url: `git://github.com/${r.full_name}.git`,
+        ssh_url: `git@github.com:${r.full_name}.git`, svn_url: `https://github.com/${r.full_name}`, mirror_url: null,
+        stargazers_count: facts.stargazers_count, watchers_count: facts.stargazers_count, watchers: facts.stargazers_count,
+        subscribers_count: facts.subscribers_count, network_count: facts.forks_count, forks_count: facts.forks_count, forks: facts.forks_count,
+        open_issues_count: facts.open_issues_count, open_issues: facts.open_issues_count,
+        pushed_at: facts.pushed_at, size: facts.size, language: facts.language, license: facts.license,
+        has_pages: facts.has_pages, has_downloads: true,
+        id: r.id,
+        name: r.name,
+        full_name: r.full_name,
+        owner: toSimpleUser(owner),
+        private: r.private ?? false,
+        description: r.description ?? null,
+        fork: r.fork ?? false,
+        default_branch: r.default_branch ?? 'main',
+        topics: r.topics ?? [],
+        homepage: r.homepage ?? null,
+        has_issues: r.has_issues ?? true,
+        has_projects: r.has_projects ?? true,
+        has_wiki: r.has_wiki ?? true,
+        has_discussions: r.has_discussions ?? false,
+        archived: r.archived ?? false,
+        disabled: false,
+        html_url: `https://github.com/${r.full_name}`,
+        url: `${api}/repos/${r.full_name}`,
+        ...(r.parent_full_name ? { parent: { full_name: r.parent_full_name, url: `${api}/repos/${r.parent_full_name}` } } : {}),
+        created_at: r.created_at ?? null,
+        updated_at: r.updated_at ?? null,
+        node_id: nodeId('Repository', r.id),
+    };
+}
+/** The API links GitHub gives every repository, as it writes them (templated where it templates them). */
+function repoUrls(repoApi) {
+    const at = (path) => `${repoApi}/${path}`;
+    return {
+        archive_url: at('{archive_format}{/ref}'), assignees_url: at('assignees{/user}'), blobs_url: at('git/blobs{/sha}'), branches_url: at('branches{/branch}'),
+        collaborators_url: at('collaborators{/collaborator}'), comments_url: at('comments{/number}'), commits_url: at('commits{/sha}'), compare_url: at('compare/{base}...{head}'),
+        contents_url: at('contents/{+path}'), contributors_url: at('contributors'), deployments_url: at('deployments'), downloads_url: at('downloads'), events_url: at('events'),
+        forks_url: at('forks'), git_commits_url: at('git/commits{/sha}'), git_refs_url: at('git/refs{/sha}'), git_tags_url: at('git/tags{/sha}'), hooks_url: at('hooks'),
+        issue_comment_url: at('issues/comments{/number}'), issue_events_url: at('issues/events{/number}'), issues_url: at('issues{/number}'), keys_url: at('keys{/key_id}'),
+        labels_url: at('labels{/name}'), languages_url: at('languages'), merges_url: at('merges'), milestones_url: at('milestones{/number}'),
+        notifications_url: at('notifications{?since,all,participating}'), pulls_url: at('pulls{/number}'), releases_url: at('releases{/id}'), stargazers_url: at('stargazers'),
+        statuses_url: at('statuses/{sha}'), subscribers_url: at('subscribers'), subscription_url: at('subscription'), tags_url: at('tags'), teams_url: at('teams'), trees_url: at('git/trees{/sha}'),
+    };
+}
+// Map a branch to GitHub's branch shape (GET .../branches[/:name]). The protection summary
+// carries the PERSISTED required-check contexts + the real enforcement_level semantics
+// (everyone when enforce_admins, non_admins otherwise, off when unprotected) — this summary
+// is what merge-gate scripts read their required contexts from.
+export function toGithubBranch(b) {
+    const api = `https://api.github.com/repos/${b.repository}`;
+    const rsc = b.protection_config?.required_status_checks;
+    // enforcement_level is about REQUIRED STATUS CHECKS: 'off' when the branch has none
+    // configured (even while otherwise protected), 'everyone' under enforce_admins,
+    // 'non_admins' otherwise — real GitHub's branch-summary semantics.
+    const enforcement = !(b.protected ?? false) || !rsc ? 'off' : (b.protection_config?.enforce_admins ? 'everyone' : 'non_admins');
+    return {
+        name: b.name,
+        commit: { sha: b.commit_sha, url: `${api}/commits/${b.commit_sha}` },
+        protected: b.protected ?? false,
+        protection: {
+            enabled: b.protected ?? false,
+            required_status_checks: { enforcement_level: enforcement, contexts: rsc?.contexts ?? [], checks: rsc?.checks ?? [] },
+        },
+        protection_url: `${api}/branches/${encodeURIComponent(b.name)}/protection`,
+    };
+}
+// Render the FULL classic protection object (GET/PUT .../branches/:b/protection).
+export function toGithubBranchProtection(b) {
+    const base = `https://api.github.com/repos/${b.repository}/branches/${encodeURIComponent(b.name)}/protection`;
+    const cfg = b.protection_config ?? {};
+    const out = { url: base, enabled: true };
+    if (cfg.required_status_checks) {
+        out.required_status_checks = {
+            url: `${base}/required_status_checks`,
+            strict: cfg.required_status_checks.strict,
+            contexts: cfg.required_status_checks.contexts,
+            contexts_url: `${base}/required_status_checks/contexts`,
+            checks: cfg.required_status_checks.checks,
+        };
+    }
+    out.enforce_admins = { url: `${base}/enforce_admins`, enabled: cfg.enforce_admins ?? false };
+    if (cfg.required_pull_request_reviews) {
+        out.required_pull_request_reviews = { url: `${base}/required_pull_request_reviews`, ...cfg.required_pull_request_reviews };
+    }
+    if (cfg.restrictions)
+        out.restrictions = restrictionsOf(base, cfg.restrictions);
+    return out;
+}
+/** A protection's push restrictions, with their url. */
+function restrictionsOf(base, restrictions) {
+    return { url: `${base}/restrictions`, ...restrictions };
+}
+// Normalize a PUT .../protection body's required_status_checks into the persisted shape.
+// Real GitHub accepts `contexts` (deprecated) or `checks` [{context, app_id}]; both are kept
+// in sync so either read-back form answers.
+export function normalizeRequiredStatusChecks(v) {
+    if (v === null || v === undefined || typeof v !== 'object')
+        return null;
+    const o = v;
+    const checksIn = Array.isArray(o.checks) ? o.checks : undefined;
+    const contextsIn = Array.isArray(o.contexts) ? o.contexts.map(String) : undefined;
+    const checks = checksIn
+        ? checksIn.map((c) => ({ context: String(c.context ?? ''), app_id: c.app_id === undefined || c.app_id === null || Number(c.app_id) === -1 ? null : Number(c.app_id) }))
+        : (contextsIn ?? []).map((context) => ({ context, app_id: null }));
+    const contexts = contextsIn ?? checks.map((c) => c.context);
+    return { strict: o.strict === true, contexts, checks };
+}
+// Map a collaborator to GitHub's collaborator simple-user shape (with a permissions block).
+export function toGithubCollaborator(c) {
+    const perm = c.permission;
+    return {
+        login: c.login,
+        id: twinUserId(c.login),
+        ...userLinks(c.login, twinUserId(c.login)),
+        site_admin: false,
+        type: 'User',
+        role_name: perm,
+        permissions: {
+            pull: true,
+            triage: ['triage', 'push', 'maintain', 'admin'].includes(perm),
+            push: ['push', 'maintain', 'admin'].includes(perm),
+            maintain: ['maintain', 'admin'].includes(perm),
+            admin: perm === 'admin',
+        },
+        node_id: nodeId('User', twinUserId(c.login)),
+        url: `https://api.github.com/users/${c.login}`,
+    };
+}
+// Both hook read doors share one configuration serializer. Never expose signing material.
+export function toGithubWebhookConfig(h) {
+    return { url: h.url ?? '', content_type: h.content_type ?? 'form', insecure_ssl: '0', ...(h.secret ? { secret: '********' } : {}) };
+}
+export function hookConfigOverlaps(hooks, candidate, excluding) {
+    return hooks.some(h => h.id !== excluding && h.repository === candidate.repository
+        && h.url === candidate.url && (h.content_type ?? 'form') === (candidate.content_type ?? 'form') && (h.secret ?? '') === (candidate.secret ?? '')
+        && (h.events.includes('*') || candidate.events.includes('*') || h.events.some(event => candidate.events.includes(event))));
+}
+export function validateGithubWebhook(body, configOnly, creating) {
+    const invalid = (field) => ({ status: 422, body: { message: 'Validation Failed', errors: [{ resource: 'Hook', field, code: 'invalid' }] } });
+    if (!body || typeof body !== 'object' || Array.isArray(body))
+        return invalid('body');
+    if (!configOnly) {
+        if (body.name !== undefined && body.name !== 'web')
+            return invalid('name');
+        if (body.active !== undefined && typeof body.active !== 'boolean')
+            return invalid('active');
+        for (const field of ['events', 'add_events', 'remove_events']) {
+            if (body[field] !== undefined && (!Array.isArray(body[field]) || body[field].some((event) => typeof event !== 'string' || !event.trim())))
+                return invalid(field);
+        }
+    }
+    const cfg = configOnly ? body : (body.config === undefined ? {} : body.config);
+    if (!cfg || typeof cfg !== 'object' || Array.isArray(cfg))
+        return invalid('config');
+    if (creating || cfg.url !== undefined) {
+        if (typeof cfg.url !== 'string')
+            return invalid('config.url');
+        try {
+            if (!['http:', 'https:'].includes(new URL(cfg.url).protocol))
+                return invalid('config.url');
+        }
+        catch {
+            return invalid('config.url');
+        }
+    }
+    if (cfg.content_type !== undefined && cfg.content_type !== 'json' && cfg.content_type !== 'form')
+        return invalid('config.content_type');
+    if (cfg.secret !== undefined && typeof cfg.secret !== 'string')
+        return invalid('config.secret');
+    if (cfg.insecure_ssl !== undefined && !['0', '1', 0, 1].includes(cfg.insecure_ssl))
+        return invalid('config.insecure_ssl');
+    if (String(cfg.insecure_ssl) === '1')
+        return { status: 501, body: { message: 'This twin does not support disabling webhook TLS verification' } };
+    return undefined;
+}
+// Map a webhook to GitHub's hook shape (GET .../hooks[/:id]).
+export function toGithubWebhook(h) {
+    const api = `https://api.github.com/repos/${h.repository}`;
+    const out = {
+        id: h.id,
+        name: h.name,
+        active: h.active,
+        events: h.events,
+        config: toGithubWebhookConfig(h),
+        url: `${api}/hooks/${h.id}`,
+        test_url: `${api}/hooks/${h.id}/test`,
+        ping_url: `${api}/hooks/${h.id}/pings`,
+        deliveries_url: `${api}/hooks/${h.id}/deliveries`,
+        type: 'Repository',
+        // a new hook's; the webhook handlers answer its last delivery's (github-events.ts hookLastResponse)
+        last_response: { code: null, status: 'unused', message: null },
+    };
+    if (h.created_at !== undefined)
+        out.created_at = h.created_at;
+    if (h.updated_at !== undefined)
+        out.updated_at = h.updated_at;
+    return out;
+}
+// Map a contents file to GitHub's contents shape (GET/PUT .../contents/:path). The twin
+// honors small content the caller PUT (base64), and serves it back; raw bytes for large
+// blobs remain the declared Non-goal.
+// ── Git-plane-backed READS for the content surfaces real GitHub serves from the same objects a
+// `git push` wrote: GET contents/*, GET readme, GET commits/:ref. A connector-pulled (REST-stored)
+// file is used only without a Git repository; a Git-backed repository reads its objects at the requested ref.
+export function planeQueryRef(query) {
+    if (!query)
+        return undefined;
+    const v = new URLSearchParams(query.startsWith('?') ? query.slice(1) : query).get('ref');
+    return v && v.length ? v : undefined;
+}
+export async function resolvePlaneRef(repo, ref, defaultBranch, root) {
+    const want = ref && ref.length ? ref : defaultBranch;
+    if (/^[0-9a-f]{40}$/.test(want) && await objectExistsInPlane(repo, want, root))
+        return want;
+    const refs = await listGitPlaneRefs(repo, root);
+    const hit = refs.find((r) => r.ref === want || r.ref === `refs/heads/${want}` || r.ref === `refs/tags/${want}`);
+    if (!hit)
+        return null;
+    if (hit.object_type === 'tag')
+        return (await readGitTagFromPlane(repo, hit.object_sha, root))?.object_sha ?? null;
+    return hit.object_sha;
+}
+export async function planeEntryAt(repo, commitSha, path, root) {
+    const commit = await readGitCommitFromPlane(repo, commitSha, root);
+    if (!commit)
+        return null;
+    let treeSha = commit.tree_sha;
+    const segs = path ? path.split('/').filter(Boolean) : [];
+    for (let i = 0;; i += 1) {
+        if (i === segs.length)
+            return directoryAt(repo, treeSha, root);
+        const entries = await readGitTreeFromPlane(repo, treeSha, root);
+        const e = entries?.find((x) => x.path === segs[i]);
+        if (!e)
+            return null;
+        if (e.type === 'blob' || e.type === 'commit')
+            return i === segs.length - 1 ? { kind: e.type === 'blob' ? 'file' : 'submodule', entry: e } : null;
+        if (e.type !== 'tree')
+            return null;
+        treeSha = e.sha;
+    }
+}
+/** A directory of the plane: its tree's entries. */
+async function directoryAt(repo, treeSha, root) {
+    const entries = await readGitTreeFromPlane(repo, treeSha, root);
+    return entries ? { kind: 'dir', entries } : null;
+}
+export async function planeFileContent(repo, ref, path, entry, root) {
+    const blob = await readGitBlobFromPlane(repo, entry.sha, root);
+    if (!blob)
+        return null;
+    return toGithubContent({ repository: repo, path, sha: entry.sha, size: blob.size, content_b64: blob.content_b64, branch: ref });
+}
+export async function planeContents(repo, ref, path, defaultBranch, root) {
+    const sha = await resolvePlaneRef(repo, ref, defaultBranch, root);
+    if (!sha)
+        return null;
+    const hit = await planeEntryAt(repo, sha, path, root);
+    if (!hit)
+        return null;
+    const shownRef = ref ?? defaultBranch;
+    if (hit.kind === 'submodule')
+        return null;
+    return hit.kind === 'file' ? planeFileAnswer(repo, shownRef, path, hit.entry, root) : directoryListing(path, hit.entries);
+}
+/** A file of the plane as the Contents API answers it. */
+async function planeFileAnswer(repo, ref, path, entry, root) {
+    const body = await planeFileContent(repo, ref, path, entry, root);
+    return body ? { status: 200, body } : null;
+}
+/** A directory's contents as the Contents API lists them. */
+function directoryListing(path, entries) {
+    const prefix = path ? `${path}/` : '';
+    return { status: 200, body: entries.map((e) => ({ type: e.type === 'tree' ? 'dir' : e.type === 'commit' ? 'submodule' : 'file', name: e.path, path: `${prefix}${e.path}`, sha: e.sha, size: e.size ?? 0 })) };
+}
+/** A path's contents: from the git plane when the repository has one; otherwise the file the REST
+ *  writes stored, a directory listing of the stored files under it, or the plane's (a `git push`). */
+export async function githubContents(state, repo, p, query, root) {
+    if (hasBareRepo(repo, root))
+        return await planeContents(repo, planeQueryRef(query), p, state.repos.find(r => r.full_name === repo)?.default_branch ?? 'main', root) ?? githubNotFound();
+    const inRepo = state.contents.filter((c) => c.repository === repo);
+    const file = inRepo.find((c) => c.path === p);
+    if (file)
+        return { status: 200, body: toGithubContent(file) };
+    // A directory: any stored file whose path is under this prefix → a dir listing array.
+    const prefix = p ? `${p}/` : '';
+    const children = inRepo.filter((c) => c.path.startsWith(prefix) && c.path !== p);
+    if (children.length)
+        return { status: 200, body: children.map((c) => ({ type: 'file', name: c.path.slice(prefix.length).split('/')[0], path: c.path, sha: c.sha, size: c.size })) };
+    // Nothing REST-stored at this path: the bare repo (a real `git push`) is the truth.
+    const planeHit = await planeContents(repo, planeQueryRef(query), p, state.repos.find((r) => r.full_name === repo)?.default_branch ?? 'main', root);
+    if (planeHit)
+        return planeHit;
+    return githubNotFound();
+}
+// Every commit reachable from `sha` in the git plane (breadth-first over parents), with its commit date.
+export async function planeAncestors(repo, sha, root) {
+    const out = new Map();
+    const queue = [sha];
+    while (queue.length) {
+        const next = queue.shift();
+        if (out.has(next))
+            continue;
+        const c = await readGitCommitFromPlane(repo, next, root);
+        if (!c)
+            continue;
+        out.set(next, Date.parse(c.created_at ?? ''));
+        queue.push(...c.parents);
+    }
+    return out;
+}
+/** The commits a repository's default branch reaches, read from its history: sha, message and author name (none in a
+ *  repository without history). */
+export async function defaultBranchCommits(state, repo, root) {
+    const branch = state.repos.find((r) => r.full_name === repo)?.default_branch ?? 'main';
+    const tip = hasBareRepo(repo, root) ? await resolvePlaneRef(repo, branch, branch, root) : null;
+    const out = [];
+    for (const sha of tip ? (await planeAncestors(repo, tip, root)).keys() : []) {
+        const c = await readGitCommitFromPlane(repo, sha, root);
+        if (c)
+            out.push({ sha, message: c.message, author: c.author_name ?? '' });
+    }
+    return out;
+}
+export async function planeCommitBody(repo, sha, root) {
+    const c = await readGitCommitFromPlane(repo, sha, root);
+    if (!c)
+        return null;
+    const who = { name: c.author_name ?? 'github-twin', email: c.author_email ?? 'github-twin@localhost', date: c.created_at ?? new Date(0).toISOString() };
+    return {
+        sha: c.sha,
+        node_id: `C_${c.sha.slice(0, 12)}`,
+        commit: { author: who, committer: who, message: c.message, tree: { sha: c.tree_sha, url: `https://api.github.com/repos/${repo}/git/trees/${c.tree_sha}` }, comment_count: 0 },
+        url: `https://api.github.com/repos/${repo}/commits/${c.sha}`,
+        html_url: `https://github.com/${repo}/commit/${c.sha}`,
+        comments_url: `https://api.github.com/repos/${repo}/commits/${c.sha}/comments`,
+        author: null,
+        committer: null,
+        parents: c.parents.map((sha) => ({ sha, url: `https://api.github.com/repos/${repo}/commits/${sha}`, html_url: `https://github.com/${repo}/commit/${sha}` })),
+    };
+}
+export function toGithubContent(f) {
+    const api = `https://api.github.com/repos/${f.repository}`;
+    const ref = f.branch ?? 'main';
+    return {
+        type: 'file',
+        encoding: 'base64',
+        name: f.path.split('/').pop() ?? f.path,
+        path: f.path,
+        sha: f.sha,
+        size: f.size,
+        content: f.content_b64 ?? '',
+        url: `${api}/contents/${f.path}?ref=${ref}`,
+        html_url: `https://github.com/${f.repository}/blob/${ref}/${f.path}`,
+        download_url: `https://raw.githubusercontent.com/${f.repository}/${ref}/${f.path}`,
+        git_url: `${api}/git/blobs/${f.sha}`,
+    };
+}
+// Map a user to GitHub's simple/public-user shape (GET /users/:login, GET /user).
+export function toGithubUser(u) {
+    return {
+        login: u.login,
+        id: u.id,
+        type: u.type,
+        name: u.name ?? null,
+        bio: u.bio ?? null,
+        company: u.company ?? null,
+        blog: u.blog ?? null,
+        location: u.location ?? null,
+        email: u.email ?? null,
+        ...userLinks(u.login, u.id),
+        site_admin: false,
+        node_id: nodeId('User', u.id),
+    };
+}
+// ── Orgs / Teams / commit-comments / issue-types serializers ───────────────────────────────
+/** An organization as GitHub answers it; with the World's state, its public repositories and followers counted. */
+export function toGithubOrg(o, st) {
+    const api = `https://api.github.com`;
+    const id = 0x20000000 + (parseInt(createHash('sha256').update(`org:${o.login}`).digest('hex').slice(0, 8), 16) % 0x0fffffff);
+    return {
+        login: o.login, id, node_id: nodeId('Organization', id), type: 'Organization',
+        description: o.description ?? null, name: o.name ?? null, company: o.company ?? null,
+        blog: o.blog ?? null, location: o.location ?? null, email: o.email ?? null,
+        url: `${api}/orgs/${o.login}`, repos_url: `${api}/orgs/${o.login}/repos`, hooks_url: `${api}/orgs/${o.login}/hooks`,
+        members_url: `${api}/orgs/${o.login}/members{/member}`, html_url: `https://github.com/${o.login}`,
+        avatar_url: `https://avatars.githubusercontent.com/u/${id}?v=4`, events_url: `${api}/orgs/${o.login}/events`, issues_url: `${api}/orgs/${o.login}/issues`,
+        public_members_url: `${api}/orgs/${o.login}/public_members{/member}`,
+        public_repos: st ? st.repos.filter((r) => r.owner === o.login && !r.private).length : 0,
+        followers: st ? st.followEdges.filter((e) => e.to === o.login).length : 0,
+        // an organization follows no one and holds no gists
+        following: 0, public_gists: 0,
+        has_organization_projects: true, has_repository_projects: true, archived_at: null,
+        ...(o.billing_email !== undefined ? { billing_email: o.billing_email ?? null } : {}),
+        created_at: o.created_at ?? null, updated_at: o.updated_at ?? null,
+    };
+}
+export function toGithubOrgMembership(m) {
+    const api = `https://api.github.com`;
+    return {
+        url: `${api}/orgs/${m.org}/memberships/${m.login}`, state: m.state, role: m.role,
+        organization_url: `${api}/orgs/${m.org}`,
+        organization: { login: m.org, url: `${api}/orgs/${m.org}` },
+        user: toGithubUser(seedUser(m.login)),
+    };
+}
+export function toGithubOrgWebhook(h) {
+    const api = `https://api.github.com`;
+    return {
+        id: h.id, type: 'Organization', name: h.name, active: h.active, events: h.events,
+        config: { url: h.url ?? null, content_type: h.content_type ?? 'form', insecure_ssl: '0' },
+        url: `${api}/orgs/${h.org}/hooks/${h.id}`, ping_url: `${api}/orgs/${h.org}/hooks/${h.id}/pings`,
+        created_at: h.created_at ?? null, updated_at: h.updated_at ?? null,
+    };
+}
+/** A team as GitHub answers it; with the World's state, its members and repositories counted (team-full). */
+export function toGithubTeam(t, st) {
+    const api = `https://api.github.com`;
+    return {
+        id: t.id, node_id: nodeId('Team', t.id), slug: t.slug, name: t.name, description: t.description ?? null,
+        privacy: t.privacy ?? 'secret', permission: t.permission ?? 'pull', notification_setting: 'notifications_enabled',
+        url: `${api}/teams/${t.id}`, html_url: `https://github.com/orgs/${t.org}/teams/${t.slug}`,
+        members_url: `${api}/teams/${t.id}/members{/member}`, repositories_url: `${api}/teams/${t.id}/repos`,
+        parent: null, organization: { login: t.org, url: `${api}/orgs/${t.org}` }, type: 'organization',
+        ...(st ? { members_count: st.teamMembers.filter((m) => m.org === t.org && m.team_slug === t.slug && m.state === 'active').length, repos_count: st.teamRepos.filter((r) => r.org === t.org && r.team_slug === t.slug).length } : {}),
+        created_at: t.created_at ?? null, updated_at: t.updated_at ?? null,
+    };
+}
+/** A team membership as GitHub answers it, addressed under its organization's and team's ids
+ *  (docs.github.com/rest/teams/members#get-team-membership-for-a-user). */
+export function toGithubTeamMembership(m, st) {
+    const api = `https://api.github.com`;
+    const org = st?.orgs.find((o) => o.login === m.org);
+    const team = st?.teams.find((t) => t.org === m.org && t.slug === m.team_slug);
+    return { url: org && team ? `${api}/organizations/${toGithubOrg(org).id}/team/${team.id}/memberships/${m.login}` : `${api}/orgs/${m.org}/teams/${m.team_slug}/memberships/${m.login}`, role: m.role, state: m.state };
+}
+export function toGithubCommitComment(c) {
+    const api = `https://api.github.com`;
+    return {
+        id: c.id, node_id: nodeId('CommitComment', c.id), commit_id: c.commit_sha, body: c.body ?? '',
+        path: c.path ?? null, line: c.line ?? null, position: c.position ?? null,
+        url: `${api}/repos/${c.repository}/comments/${c.id}`,
+        html_url: `https://github.com/${c.repository}/commit/${c.commit_sha}#commitcomment-${c.id}`,
+        user: toGithubUser(seedUser('octocat')), author_association: 'OWNER',
+        created_at: c.created_at ?? null, updated_at: c.updated_at ?? null,
+    };
+}
+export function toGithubIssueType(t) {
+    return {
+        id: t.id, node_id: nodeId('IssueType', t.id), name: t.name, description: t.description ?? null,
+        color: t.color ?? null, is_enabled: t.is_enabled ?? true,
+        created_at: t.created_at ?? null, updated_at: t.updated_at ?? null,
+    };
+}
+// Map a gist to GitHub's gist shape (GET /gists/:id).
+export function toGithubGist(g) {
+    const api = `https://api.github.com`;
+    const files = {};
+    for (const f of g.files) {
+        const content = f.content ?? '';
+        files[f.filename] = { filename: f.filename, language: f.language ?? null, size: f.size ?? content.length, content, type: 'text/plain', truncated: false };
+    }
+    const out = {
+        id: g.id,
+        description: g.description ?? null,
+        public: g.public ?? false,
+        files,
+        url: `${api}/gists/${g.id}`,
+        html_url: `https://gist.github.com/${g.id}`,
+        forks_url: `${api}/gists/${g.id}/forks`, commits_url: `${api}/gists/${g.id}/commits`, comments_url: `${api}/gists/${g.id}/comments`,
+        git_pull_url: `https://gist.github.com/${g.id}.git`, git_push_url: `https://gist.github.com/${g.id}.git`,
+        comments: 0,
+        owner: toSimpleUser(g.owner ?? GITHUB_WORLD_USER),
+        user: null,
+        node_id: nodeId('Gist', g.id),
+    };
+    if (g.created_at !== undefined)
+        out.created_at = g.created_at;
+    if (g.updated_at !== undefined)
+        out.updated_at = g.updated_at;
+    out.history = (g.history ?? []).map((v) => ({ version: v.version, committed_at: v.committed_at, change_status: { total: v.additions + v.deletions, additions: v.additions, deletions: v.deletions }, url: `${api}/gists/${g.id}/${v.version}`, user: toSimpleUser(v.user_login) }));
+    return out;
+}
+// Map a notification thread to GitHub's notification shape (GET /notifications).
+export function toGithubNotification(n) {
+    const api = `https://api.github.com`;
+    return {
+        id: n.id,
+        unread: n.unread,
+        reason: n.reason,
+        repository: { full_name: n.repository, url: `${api}/repos/${n.repository}` },
+        subject: { title: n.subject_title, type: n.subject_type, url: n.subject_url ?? null, latest_comment_url: null },
+        url: `${api}/notifications/threads/${n.id}`,
+        subscription_url: `${api}/notifications/threads/${n.id}/subscription`,
+        updated_at: n.updated_at ?? null,
+        last_read_at: null,
+    };
+}
+// Map a workflow to GitHub's REST workflow shape (GET .../actions/workflows). node_id and
+// the badge/html url templates the twin doesn't track are declared scope (workflow.*); the
+// twin emits the id/name/path/state it was registered with + derivable url templates.
+export function toGithubWorkflow(w) {
+    const api = `https://api.github.com/repos/${w.repository}`;
+    const out = {
+        id: w.id,
+        node_id: nodeId('Workflow', w.id),
+        name: w.name,
+        path: w.path,
+        state: w.state ?? 'active',
+        url: `${api}/actions/workflows/${w.id}`,
+        html_url: `https://github.com/${w.repository}/blob/main/${w.path}`,
+        badge_url: `https://github.com/${w.repository}/workflows/${encodeURIComponent(w.name)}/badge.svg`,
+    };
+    if (w.created_at !== undefined)
+        out.created_at = w.created_at;
+    if (w.updated_at !== undefined)
+        out.updated_at = w.updated_at;
+    return out;
+}
+// Map a workflow run to GitHub's REST workflow_run shape (GET .../actions/runs). conclusion
+// is null until the run completes. The rich actor/commit/repository sub-objects and node_id
+// are declared scope (workflowRun.*) — the twin emits the run-lifecycle fields it models.
+/** The open pull requests whose head is a commit, as a check run or a workflow run names them. */
+function pullRequestsOn(st, repository, sha) {
+    const api = `https://api.github.com/repos/${repository}`;
+    const repo = st?.repos.find((x) => x.full_name === repository);
+    const ref = { id: repo?.id ?? 0, url: api, name: repo?.name ?? repository.split('/')[1] };
+    return (st?.prs ?? []).filter((p) => p.repository === repository && p.head_sha === sha && (p.state ?? 'open') === 'open').map((p) => ({
+        id: observedId(`pull_request:${p.born_in ?? p.repository}#${p.number}`), number: p.number, url: `${api}/pulls/${p.number}`,
+        head: { ref: p.head_ref ?? '', sha: p.head_sha ?? '', repo: ref }, base: { ref: p.base_ref ?? '', sha: '', repo: ref },
+    }));
+}
+/** The fields of GitHub's minimal-repository, the form a workflow run names its repository in. */
+const MINIMAL_REPOSITORY = new Set(surface.resources.find((r) => r.name === 'minimal-repository')?.fields.map((f) => f.name) ?? []);
+export function toGithubWorkflowRun(r, st) {
+    const api = `https://api.github.com/repos/${r.repository}`;
+    const repo = st?.repos.find((x) => x.full_name === r.repository);
+    const minimal = repo ? Object.fromEntries(Object.entries(toGithubRepo(repo)).filter(([k]) => MINIMAL_REPOSITORY.has(k))) : { full_name: r.repository, url: `https://api.github.com/repos/${r.repository}` };
+    const workflow = st?.workflows.find((w) => w.id === r.workflow_id);
+    const out = {
+        artifacts_url: `${api}/actions/runs/${r.id}/artifacts`,
+        check_suite_url: `${api}/check-suites/${checkSuiteId(r.repository, r.head_sha, 'github-actions')}`,
+        logs_url: `${api}/actions/runs/${r.id}/logs`,
+        display_title: r.name ?? workflow?.name ?? '',
+        path: workflow?.path ?? '',
+        head_commit: null,
+        repository: minimal,
+        // a pull request from a fork runs on the fork's commit: the head repository is the fork
+        head_repository: r.head_repository ? (() => { const fork = st?.repos.find((x) => x.full_name === r.head_repository); return fork ? Object.fromEntries(Object.entries(toGithubRepo(fork)).filter(([k]) => MINIMAL_REPOSITORY.has(k))) : { full_name: r.head_repository, url: `https://api.github.com/repos/${r.head_repository}` }; })() : minimal,
+        pull_requests: pullRequestsOn(st, r.repository, r.head_sha),
+        id: r.id,
+        node_id: nodeId('WorkflowRun', r.id),
+        name: r.name ?? null,
+        workflow_id: r.workflow_id,
+        run_number: r.run_number,
+        event: r.event,
+        status: r.status,
+        conclusion: r.conclusion ?? null,
+        head_sha: r.head_sha,
+        head_branch: r.head_branch ?? null,
+        url: `${api}/actions/runs/${r.id}`,
+        html_url: `https://github.com/${r.repository}/actions/runs/${r.id}`,
+        jobs_url: `${api}/actions/runs/${r.id}/jobs`,
+        workflow_url: `${api}/actions/workflows/${r.workflow_id}`,
+        cancel_url: `${api}/actions/runs/${r.id}/cancel`,
+        rerun_url: `${api}/actions/runs/${r.id}/rerun`,
+        actor: r.actor_login ? toSimpleUser(r.actor_login, 'User') : null,
+        triggering_actor: r.actor_login ? toSimpleUser(r.actor_login, 'User') : null,
+    };
+    if (r.created_at !== undefined)
+        out.created_at = r.created_at;
+    if (r.updated_at !== undefined)
+        out.updated_at = r.updated_at;
+    return out;
+}
+// Map a job to GitHub's REST job shape (GET .../runs/:id/jobs, GET .../actions/jobs/:id).
+// node_id/check_run_url/labels/runner-* are declared scope (job.*); the twin emits the
+// id/run_id/name/status/conclusion + step list it modeled.
+export function toGithubJob(j) {
+    const api = `https://api.github.com/repos/${j.repository}`;
+    const out = {
+        check_run_url: `${api}/check-runs/${j.id}`,
+        created_at: j.created_at ?? j.started_at ?? null,
+        head_branch: j.head_branch ?? null,
+        labels: j.labels ?? [],
+        // the runner that ran it: a GitHub-hosted one the twin does not name
+        runner_id: null, runner_name: null, runner_group_id: null, runner_group_name: null,
+        workflow_name: j.workflow_name ?? null,
+        started_at: j.started_at ?? null,
+        id: j.id,
+        node_id: nodeId('CheckRun', j.id),
+        run_id: j.run_id,
+        name: j.name,
+        status: j.status,
+        conclusion: j.conclusion ?? null,
+        head_sha: j.head_sha,
+        url: `${api}/actions/jobs/${j.id}`,
+        html_url: `https://github.com/${j.repository}/actions/runs/${j.run_id}/job/${j.id}`,
+        run_url: `${api}/actions/runs/${j.run_id}`,
+        steps: j.steps.map((s) => ({ name: s.name, status: s.status, conclusion: s.conclusion ?? null, number: s.number })),
+    };
+    out.completed_at = j.completed_at ?? null;
+    return out;
+}
+// Map a release asset to GitHub's release-asset shape (GET .../releases/:id/assets,
+// GET .../releases/assets/:id). METADATA only: the twin emits name/label/content_type/
+// size/state/download_count + derivable url templates. The browser_download_url points at
+// the asset path, but the twin serves NO real bytes (declared Non-goal: asset.content
+// binary). node_id/uploader simple-user are declared scope (asset.*).
+export function toGithubReleaseAsset(a) {
+    const api = `https://api.github.com/repos/${a.repository}`;
+    const out = {
+        id: a.id,
+        node_id: nodeId('ReleaseAsset', a.id),
+        name: a.name,
+        label: a.label ?? null,
+        content_type: a.content_type ?? 'application/octet-stream',
+        size: a.size ?? 0,
+        state: a.state ?? 'uploaded',
+        download_count: a.download_count ?? 0,
+        url: `${api}/releases/assets/${a.id}`,
+        browser_download_url: `https://github.com/${a.repository}/releases/download/${a.release_id}/${encodeURIComponent(a.name)}`,
+        digest: null,
+        uploader: a.uploader_login ? toSimpleUser(a.uploader_login, a.uploader_login.endsWith('[bot]') ? 'Bot' : 'User') : null,
+    };
+    if (a.created_at !== undefined)
+        out.created_at = a.created_at;
+    if (a.updated_at !== undefined)
+        out.updated_at = a.updated_at;
+    return out;
+}
+// Map a release to GitHub's release shape (GET .../releases, .../releases/:id, .../latest,
+// .../tags/:tag). The twin emits the tag_name/name/body/draft/prerelease + target_commitish
+// it was written with, derivable url templates, its author and the asset list. Reactions are declared scope
+// (release.*).
+export function toGithubRelease(r, assets) {
+    const api = `https://api.github.com/repos/${r.repository}`;
+    const relAssets = (assets ?? []).filter((a) => a.repository === r.repository && a.release_id === r.id);
+    const out = {
+        id: r.id,
+        node_id: nodeId('Release', r.id),
+        tag_name: r.tag_name,
+        target_commitish: r.target_commitish ?? 'main',
+        name: r.name ?? null,
+        body: r.body ?? null,
+        draft: r.draft ?? false,
+        prerelease: r.prerelease ?? false,
+        url: `${api}/releases/${r.id}`,
+        html_url: `https://github.com/${r.repository}/releases/tag/${encodeURIComponent(r.tag_name)}`,
+        assets_url: `${api}/releases/${r.id}/assets`,
+        upload_url: `https://uploads.github.com/repos/${r.repository}/releases/${r.id}/assets{?name,label}`,
+        tarball_url: r.draft ? null : `${api}/tarball/${encodeURIComponent(r.tag_name)}`,
+        zipball_url: r.draft ? null : `${api}/zipball/${encodeURIComponent(r.tag_name)}`,
+        // the person or bot that created it (docs.github.com/rest/releases/releases#get-a-release)
+        author: r.author_login ? toSimpleUser(r.author_login, r.author_login.endsWith('[bot]') ? 'Bot' : 'User') : null,
+        assets: relAssets.map(toGithubReleaseAsset),
+    };
+    if (r.created_at !== undefined)
+        out.created_at = r.created_at;
+    // published_at is null for a draft (real GitHub behavior) — a draft has no publish time.
+    out.published_at = r.draft ? null : (r.published_at ?? null);
+    return out;
+}
+// Map a derived git tag to GitHub's repository-tag shape (GET .../tags). The commit object
+// carries the sha + its api/html urls; the full commit object (author/message) is the git
+// Non-goal. node_id is declared scope (tag.*).
+export function toGithubTag(t) {
+    const api = `https://api.github.com/repos/${t.repository}`;
+    return {
+        name: t.name,
+        commit: { sha: t.commit_sha, url: `${api}/commits/${t.commit_sha}` },
+        zipball_url: `${api}/zipball/refs/tags/${encodeURIComponent(t.name)}`,
+        tarball_url: `${api}/tarball/refs/tags/${encodeURIComponent(t.name)}`,
+        node_id: nodeId('Ref', `${t.repository}:refs/tags/${t.name}`),
+    };
+}
+// ── Git Data API serializers ─────────────────────────────────────────────────────────────
+// Map a git ref to GitHub's ref shape (GET/POST .../git/refs[/:ref], .../git/ref/:ref).
+export function toGithubGitRef(r) {
+    const api = `https://api.github.com/repos/${r.repository}`;
+    return {
+        ref: r.ref,
+        node_id: nodeId('Ref', `${r.repository}:${r.ref}`),
+        url: `${api}/git/${r.ref}`,
+        object: { type: r.object_type, sha: r.object_sha, url: `${api}/git/${r.object_type === 'tag' ? 'tags' : 'commits'}/${r.object_sha}` },
+    };
+}
+// Map a git commit object to GitHub's git-commit shape (GET .../git/commits/:sha).
+export function toGithubGitCommit(c) {
+    const api = `https://api.github.com/repos/${c.repository}`;
+    return {
+        sha: c.sha,
+        node_id: nodeId('Commit', c.sha),
+        url: `${api}/git/commits/${c.sha}`,
+        message: c.message,
+        tree: { sha: c.tree_sha, url: `${api}/git/trees/${c.tree_sha}` },
+        parents: c.parents.map((p) => ({ sha: p, url: `${api}/git/commits/${p}`, html_url: `https://github.com/${c.repository}/commit/${p}` })),
+        author: { name: c.author_name ?? null, email: c.author_email ?? null, date: c.created_at ?? null },
+        committer: { name: c.author_name ?? null, email: c.author_email ?? null, date: c.created_at ?? null },
+        // Real responses always carry a verification block. The twin's objects are unsigned —
+        // reported honestly (never a fabricated "verified": the signing GitHub's API does for
+        // bot-created commits needs GitHub's key, which a local twin cannot have).
+        verification: { verified: false, reason: 'unsigned', signature: null, payload: null },
+        html_url: `https://github.com/${c.repository}/commit/${c.sha}`,
+    };
+}
+// Map a git tree object to GitHub's git-tree shape (GET .../git/trees/:sha).
+export function toGithubGitTree(t) {
+    const api = `https://api.github.com/repos/${t.repository}`;
+    return {
+        sha: t.sha,
+        url: `${api}/git/trees/${t.sha}`,
+        truncated: t.truncated ?? false,
+        tree: t.tree.map((e) => ({ path: e.path, mode: e.mode, type: e.type, sha: e.sha, ...(e.size !== undefined ? { size: e.size } : {}), url: `${api}/git/${e.type === 'tree' ? 'trees' : 'blobs'}/${e.sha}` })),
+    };
+}
+// Map a git blob object to GitHub's git-blob shape (GET .../git/blobs/:sha).
+export function toGithubGitBlob(b) {
+    const api = `https://api.github.com/repos/${b.repository}`;
+    return { sha: b.sha, node_id: null, size: b.size, encoding: b.encoding, content: b.content_b64, url: `${api}/git/blobs/${b.sha}` };
+}
+// Map an annotated tag object to GitHub's git-tag shape (GET .../git/tags/:sha).
+export function toGithubGitTagObject(t) {
+    const api = `https://api.github.com/repos/${t.repository}`;
+    return {
+        sha: t.sha,
+        node_id: nodeId('Tag', t.sha),
+        tag: t.tag,
+        message: t.message,
+        url: `${api}/git/tags/${t.sha}`,
+        tagger: { name: t.tagger_name ?? null, email: null, date: t.created_at ?? null },
+        object: { type: t.object_type, sha: t.object_sha, url: `${api}/git/${t.object_type === 'tag' ? 'tags' : 'commits'}/${t.object_sha}` },
+        // Honest unsigned verification block (see toGithubGitCommit).
+        verification: { verified: false, reason: 'unsigned', signature: null, payload: null },
+    };
+}
+// ── Deployments / Environments serializers ───────────────────────────────────────────────
+export function toGithubDeployment(d) {
+    const api = `https://api.github.com/repos/${d.repository}`;
+    return {
+        id: d.id,
+        node_id: nodeId('Deployment', d.id),
+        sha: d.sha,
+        ref: d.ref,
+        task: d.task,
+        environment: d.environment,
+        description: d.description ?? null,
+        transient_environment: d.transient_environment ?? false,
+        production_environment: d.production_environment ?? false,
+        payload: d.payload ?? {},
+        url: `${api}/deployments/${d.id}`,
+        statuses_url: `${api}/deployments/${d.id}/statuses`,
+        repository_url: api,
+        creator: d.creator_login ? toSimpleUser(d.creator_login, 'User') : null,
+        created_at: d.created_at ?? null,
+        updated_at: d.updated_at ?? null,
+    };
+}
+export function toGithubDeploymentStatus(s) {
+    const api = `https://api.github.com/repos/${s.repository}`;
+    return {
+        id: s.id,
+        node_id: nodeId('DeploymentStatus', s.id),
+        state: s.state,
+        description: s.description ?? '',
+        environment: s.environment ?? null,
+        environment_url: s.environment_url ?? '',
+        log_url: s.log_url ?? '',
+        target_url: s.log_url ?? '',
+        url: `${api}/deployments/${s.deployment_id}/statuses/${s.id}`,
+        deployment_url: `${api}/deployments/${s.deployment_id}`,
+        repository_url: api,
+        creator: s.creator_login ? toSimpleUser(s.creator_login, 'User') : null,
+        created_at: s.created_at ?? null,
+        updated_at: s.created_at ?? null,
+    };
+}
+export function toGithubEnvironment(e) {
+    const api = `https://api.github.com/repos/${e.repository}`;
+    const protection_rules = [];
+    if (e.wait_timer)
+        protection_rules.push({ id: 1, type: 'wait_timer', wait_timer: e.wait_timer });
+    if (e.reviewers?.length)
+        protection_rules.push({ id: 2, type: 'required_reviewers', reviewers: e.reviewers.map((login) => ({ type: 'User', reviewer: { login, type: 'User' } })) });
+    return {
+        id: actionsId(`${e.born_in ?? e.repository}:env:${e.name}`),
+        node_id: nodeId('Environment', actionsId(`${e.born_in ?? e.repository}:env:${e.name}`)),
+        name: e.name,
+        url: `${api}/environments/${encodeURIComponent(e.name)}`,
+        html_url: `https://github.com/${e.repository}/deployments/${encodeURIComponent(e.name)}`,
+        created_at: e.created_at ?? null,
+        updated_at: e.updated_at ?? null,
+        protection_rules,
+        deployment_branch_policy: null,
+    };
+}
+// ── Repos niche serializers: deploy keys / autolinks / rulesets ──────────────────────────
+export function toGithubDeployKey(k) {
+    return {
+        id: k.id, key: k.key, title: k.title, read_only: k.read_only,
+        url: `https://api.github.com/repos/${k.repository}/keys/${k.id}`,
+        verified: true, created_at: k.created_at ?? null, added_by: 'octocat', last_used: null,
+    };
+}
+export function toGithubAutolink(a) {
+    return { id: a.id, key_prefix: a.key_prefix, url_template: a.url_template, is_alphanumeric: a.is_alphanumeric };
+}
+export function toGithubRuleset(r) {
+    return {
+        id: r.id, name: r.name, target: r.target, enforcement: r.enforcement,
+        source_type: 'Repository', source: r.repository, node_id: nodeId('RepositoryRuleset', r.id),
+        conditions: r.conditions ?? null, rules: r.rules, bypass_actors: r.bypass_actors ?? [],
+        created_at: r.created_at ?? null, updated_at: r.updated_at ?? null,
+        _links: { self: { href: `https://api.github.com/repos/${r.repository}/rulesets/${r.id}` } },
+    };
+}
+// ── User niche serializers: emails / SSH keys / GPG keys ─────────────────────────────────
+export function toGithubUserEmail(e) {
+    return { email: e.email, primary: e.primary, verified: e.verified, visibility: e.visibility };
+}
+export function toGithubUserSshKey(k) {
+    return { id: k.id, key: k.key, title: k.title, url: `https://api.github.com/user/keys/${k.id}`, verified: true, read_only: false, created_at: k.created_at ?? null };
+}
+export function toGithubUserGpgKey(k) {
+    return { id: k.id, key_id: k.key_id, raw_key: k.raw_key, public_key: k.raw_key, can_sign: true, can_encrypt_comms: true, can_encrypt_storage: true, can_certify: true, emails: [], subkeys: [], revoked: false, created_at: k.created_at ?? null, expires_at: null, primary_key_id: null };
+}
+// ── Projects v2 serializers ──────────────────────────────────────────────────────────────
+export function toGithubProject(p) {
+    return {
+        id: p.id, node_id: `PVT_${p.id}`, number: p.number, title: p.title,
+        short_description: p.short_description ?? null, description: p.short_description ?? null,
+        public: p.public ?? false, state: p.closed ? 'closed' : 'open', closed_at: p.closed ? (p.updated_at ?? null) : null,
+        ...(p.creator_login ? { creator: toSimpleUser(p.creator_login) } : {}),
+        is_template: false, deleted_at: null, deleted_by: null, latest_status_update: null,
+        owner: { login: p.owner, type: p.owner_type === 'user' ? 'User' : 'Organization' },
+        created_at: p.created_at ?? null, updated_at: p.updated_at ?? null,
+    };
+}
+// ── Security alert serializers (code scanning / dependabot / secret scanning) ───────────────
+export function toGithubCodeScanningAlert(a) {
+    const [owner, repo] = a.repository.split('/');
+    return {
+        number: a.number, created_at: a.created_at ?? null, updated_at: a.updated_at ?? null,
+        url: `https://api.github.com/repos/${a.repository}/code-scanning/alerts/${a.number}`,
+        html_url: `https://github.com/${a.repository}/security/code-scanning/${a.number}`,
+        state: a.state, fixed_at: a.state === 'fixed' ? (a.fixed_at ?? a.updated_at ?? null) : null,
+        dismissed_at: a.dismissed_at ?? null, dismissed_reason: a.dismissed_reason ?? null, dismissed_comment: a.dismissed_comment ?? null,
+        dismissed_by: a.dismissed_by_login ? toSimpleUser(a.dismissed_by_login) : null,
+        instances_url: `https://api.github.com/repos/${a.repository}/code-scanning/alerts/${a.number}/instances`,
+        rule: { id: a.rule_id, name: a.rule_id, severity: a.rule_severity, description: a.rule_description ?? a.rule_id, tags: [] },
+        tool: { name: a.tool_name, version: a.tool_version ?? null, guid: null },
+        most_recent_instance: a.most_recent_instance
+            ? { ref: a.most_recent_instance.ref, analysis_key: a.most_recent_instance.analysis_key, environment: '', category: '', state: a.most_recent_instance.state, commit_sha: a.most_recent_instance.commit_sha,
+                message: { text: a.most_recent_instance.message }, location: { path: a.most_recent_instance.path, start_line: a.most_recent_instance.start_line, end_line: a.most_recent_instance.end_line, start_column: 1, end_column: 1 }, classifications: [] }
+            : null,
+        repository: { full_name: a.repository, owner: { login: owner }, name: repo },
+    };
+}
+export function toGithubCodeScanningAnalysis(a) {
+    return {
+        id: a.id, ref: a.ref, commit_sha: a.commit_sha, analysis_key: a.analysis_key, environment: a.environment ?? '',
+        created_at: a.created_at ?? null, results_count: a.results_count, rules_count: a.rules_count,
+        sarif_id: a.sarif_id ?? null, tool: { name: a.tool_name, version: null, guid: null }, deletable: a.deletable ?? true, error: '', warning: '',
+        url: `https://api.github.com/repos/${a.repository}/code-scanning/analyses/${a.id}`,
+    };
+}
+export function toGithubDependabotAlert(a) {
+    return {
+        number: a.number, state: a.state, created_at: a.created_at ?? null, updated_at: a.updated_at ?? null,
+        dismissed_at: a.dismissed_at ?? null, dismissed_reason: a.dismissed_reason ?? null, dismissed_comment: a.dismissed_comment ?? null,
+        dismissed_by: a.dismissed_by_login ? toSimpleUser(a.dismissed_by_login) : null,
+        fixed_at: a.state === 'fixed' ? (a.updated_at ?? null) : null,
+        auto_dismissed_at: a.state === 'auto_dismissed' ? (a.updated_at ?? null) : null,
+        dependency: { package: { ecosystem: a.ecosystem, name: a.package_name }, manifest_path: a.manifest_path ?? 'package.json', scope: 'runtime' },
+        security_advisory: { ghsa_id: a.ghsa_id, severity: a.severity, summary: a.summary ?? `${a.package_name} vulnerability` },
+        security_vulnerability: { package: { ecosystem: a.ecosystem, name: a.package_name }, severity: a.severity },
+        url: `https://api.github.com/repos/${a.repository}/dependabot/alerts/${a.number}`,
+        html_url: `https://github.com/${a.repository}/security/dependabot/${a.number}`,
+    };
+}
+export function toGithubSecretScanningAlert(a) {
+    return {
+        number: a.number, state: a.state, created_at: a.created_at ?? null, updated_at: a.updated_at ?? null,
+        secret_type: a.secret_type, secret_type_display_name: a.secret_type_display_name ?? a.secret_type,
+        resolution: a.resolution ?? null, resolved_at: a.resolved_at ?? null, resolution_comment: a.resolution_comment ?? null,
+        url: `https://api.github.com/repos/${a.repository}/secret-scanning/alerts/${a.number}`,
+        html_url: `https://github.com/${a.repository}/security/secret-scanning/${a.number}`,
+    };
+}
+// ── Apps / OAuth serializers ────────────────────────────────────────────────────────────────
+export function toGithubAppInstallation(i) {
+    return {
+        id: i.id, app_id: i.app_id, app_slug: i.app_slug, target_id: 0, target_type: i.target_type,
+        account: { login: i.account_login, type: i.account_type },
+        repository_selection: i.repository_selection, permissions: i.permissions, events: i.events,
+        created_at: i.created_at ?? null, updated_at: i.updated_at ?? null,
+        access_tokens_url: `https://api.github.com/app/installations/${i.id}/access_tokens`,
+        repositories_url: 'https://api.github.com/installation/repositories',
+        html_url: i.account_type === 'Organization' ? `https://github.com/organizations/${i.account_login}/settings/installations/${i.id}` : `https://github.com/settings/installations/${i.id}`,
+        single_file_name: null, suspended_at: null, suspended_by: null,
+    };
+}
+// ── Packages / Pages / Codespaces serializers ───────────────────────────────────────────────
+export function toGithubPackage(p, versionCount) {
+    return {
+        id: p.id, name: p.name, package_type: p.package_type, visibility: p.visibility, version_count: versionCount,
+        owner: { login: p.owner }, created_at: p.created_at ?? null, updated_at: p.updated_at ?? null,
+        url: `https://api.github.com/users/${p.owner}/packages/${p.package_type}/${p.name}`,
+        html_url: `https://github.com/users/${p.owner}/packages/${p.package_type}/package/${p.name}`,
+    };
+}
+export function toGithubPackageVersion(v) {
+    return {
+        id: v.id, name: v.name, created_at: v.created_at ?? null, updated_at: v.updated_at ?? null,
+        metadata: { package_type: v.package_type, ...(v.tags ? { container: { tags: v.tags } } : {}) },
+        url: `https://api.github.com/users/${v.owner}/packages/${v.package_type}/${v.package_name}/versions/${v.id}`,
+        package_html_url: `https://github.com/users/${v.owner}/packages/${v.package_type}/package/${v.package_name}`,
+    };
+}
+export function toGithubPagesSite(s) {
+    return {
+        url: `https://api.github.com/repos/${s.repository}/pages`, status: s.status, cname: s.cname ?? null,
+        custom_404: false, html_url: s.html_url ?? `https://${s.repository.split('/')[0]}.github.io/${s.repository.split('/')[1]}/`,
+        build_type: s.build_type ?? 'legacy', source: { branch: s.source_branch, path: s.source_path },
+        public: s.public ?? true, https_enforced: s.https_enforced ?? true, https_certificate: null,
+    };
+}
+export function toGithubPagesBuild(b) {
+    return {
+        url: `https://api.github.com/repos/${b.repository}/pages/builds/${b.id}`, status: b.status,
+        error: { message: b.error_message ?? null }, pusher: null, commit: b.commit ?? null,
+        duration: b.duration ?? 0, created_at: b.created_at ?? null, updated_at: b.created_at ?? null,
+    };
+}
+export function toGithubCodespace(c) {
+    const [owner, name] = c.repository.split('/');
+    return {
+        name: c.name, state: c.state, owner: { login: c.owner }, machine: { name: c.machine, display_name: c.machine },
+        repository: { full_name: c.repository, owner: { login: owner }, name },
+        git_status: { ref: c.git_branch, ahead: 0, behind: 0, has_unpushed_changes: false, has_uncommitted_changes: false },
+        created_at: c.created_at ?? null, updated_at: c.updated_at ?? null,
+        web_url: `https://${c.name}.github.dev`,
+        id: actionsId(`codespace:${c.name}`), url: `https://api.github.com/user/codespaces/${c.name}`,
+        machines_url: `https://api.github.com/user/codespaces/${c.name}/machines`, start_url: `https://api.github.com/user/codespaces/${c.name}/start`,
+        stop_url: `https://api.github.com/user/codespaces/${c.name}/stop`, pulls_url: null, recent_folders: [], prebuild: false, environment_id: null,
+        billable_owner: toSimpleUser(c.owner), last_used_at: c.updated_at ?? c.created_at ?? null,
+        // GitHub's defaults: thirty idle minutes; the region is GitHub's choice by the person's location, and the
+        // twin's is WestUs2 (where the documentation stops and the twin decides)
+        idle_timeout_minutes: 30, location: 'WestUs2',
+    };
+}
+// ── Actions secrets/variables/caches/artifacts serializers ───────────────────────────────
+// Secrets NEVER return a value (GitHub omits it) — only name + timestamps. The twin stores
+// nothing secret, mirroring that exactly.
+export function toGithubActionsSecret(s) {
+    return { name: s.name, created_at: s.created_at ?? null, updated_at: s.updated_at ?? null, ...(s.scope === 'org' ? { visibility: s.visibility ?? 'private' } : {}) };
+}
+export function toGithubActionsVariable(v) {
+    return { name: v.name, value: v.value, created_at: v.created_at ?? null, updated_at: v.updated_at ?? null, ...(v.scope === 'org' ? { visibility: v.visibility ?? 'private' } : {}) };
+}
+export function toGithubActionsCache(c) {
+    return {
+        id: c.id, ref: c.ref, key: c.key, version: createHash('sha256').update(`${c.key}:${c.ref}`).digest('hex'),
+        last_accessed_at: c.last_accessed_at ?? c.created_at ?? null, created_at: c.created_at ?? null, size_in_bytes: c.size_in_bytes,
+    };
+}
+export function toGithubActionsArtifact(a) {
+    const api = `https://api.github.com/repos/${a.repository}`;
+    return {
+        id: a.id, node_id: nodeId('Artifact', a.id), name: a.name, size_in_bytes: a.size_in_bytes, expired: a.expired ?? false,
+        url: `${api}/actions/artifacts/${a.id}`, archive_download_url: `${api}/actions/artifacts/${a.id}/zip`,
+        created_at: a.created_at ?? null, updated_at: a.created_at ?? null,
+        // an artifact is kept 90 days, GitHub's default retention
+        expires_at: a.created_at ? new Date(Date.parse(a.created_at) + 90 * 86_400_000).toISOString().replace('.000Z', 'Z') : null,
+        ...(a.run_id !== undefined ? { workflow_run: { id: a.run_id } } : {}),
+    };
+}
+// Build an issue's timeline as GitHub-shaped events, derived from the issue's CURRENT
+// modeled state (labels/assignees/milestone/state/lock + cross-references). The twin has no
+// per-field change history, so each present attribute yields one `*ed` event; ids are a
+// stable per-issue sequence. Unmodeled event fields (actor/created_at) are declared scope.
+//
+// A PULL REQUEST answers at its issue address, so its timeline is built here too, from its
+// issue face plus what only a pull request has: the `merged` event, the reviews submitted on
+// it, and (for issues and pull requests alike) the comments on the thread. Everything served
+// here is read out of stored state — nothing on a real GitHub timeline that this twin does
+// not hold is fabricated to fill the list out. What is NOT served, and why, is declared:
+// github.pulls.timeline_unmodeled.
+export function buildIssueTimeline(repository, iss, extra) {
+    const events = [];
+    let id = 1;
+    const actor = (login) => (login ? { login, type: 'User' } : null);
+    const pull = extra?.pull;
+    // What was done to it, in order, with who and when: the activity its writes left (labels, assignees, the
+    // milestone, the lock, closing, reopening, merging). A subject whose writes predate that record (observed
+    // evidence) falls back to its current state and recorded transitions, with no actor to name.
+    // a pull request's issue face already carries its own activity, merge included
+    const activity = iss.activity?.some((x) => x.event === 'merged') ? iss.activity : [...(iss.activity ?? []), ...(pull?.activity ?? []).filter((x) => x.event === 'merged')];
+    if (iss.activity?.length) {
+        for (const x of activity) {
+            const base = { id: id++, event: x.event, actor: actor(x.by), created_at: x.at ?? null };
+            if (x.event === 'labeled' || x.event === 'unlabeled')
+                events.push({ ...base, label: { name: x.label, color: 'ededed' } });
+            else if (x.event === 'assigned' || x.event === 'unassigned')
+                events.push({ ...base, assignee: { login: x.assignee } });
+            else if (x.event === 'milestoned' || x.event === 'demilestoned')
+                events.push({ ...base, milestone: { title: String(x.milestone ?? '') } });
+            else if (x.event === 'locked')
+                events.push({ ...base, lock_reason: x.lock_reason ?? null });
+            else if (x.event === 'closed')
+                events.push({ ...base, state_reason: x.state_reason ?? null });
+            else if (x.event === 'merged')
+                events.push({ ...base, commit_id: x.commit_id ?? pull?.merge_commit_sha ?? null });
+            else
+                events.push(base);
+        }
+    }
+    else {
+        for (const label of iss.labels ?? [])
+            events.push({ id: id++, event: 'labeled', actor: null, created_at: null, label: { name: label, color: 'ededed' } });
+        for (const login of iss.assignees ?? [])
+            events.push({ id: id++, event: 'assigned', actor: null, created_at: null, assignee: { login } });
+        if (iss.milestone !== undefined)
+            events.push({ id: id++, event: 'milestoned', actor: null, created_at: null, milestone: { title: '' } });
+        const history = iss.state_history ?? [];
+        if (history.length) {
+            for (const t of history) {
+                events.push(t.state === 'closed'
+                    ? { id: id++, event: 'closed', actor: null, created_at: t.at ?? null, state_reason: t.state_reason ?? null }
+                    : { id: id++, event: 'reopened', actor: null, created_at: t.at ?? null });
+            }
+        }
+        else if (iss.state === 'closed') {
+            events.push({ id: id++, event: 'closed', actor: null, created_at: null, state_reason: iss.state_reason ?? null });
+        }
+        if (pull?.merged)
+            events.push({ id: id++, event: 'merged', actor: null, created_at: pull.merged_at ?? null, commit_id: pull.merge_commit_sha ?? null });
+        if (iss.locked)
+            events.push({ id: id++, event: 'locked', actor: null, created_at: null, lock_reason: iss.active_lock_reason ?? null });
+    }
+    // REVIEWED — the reviews submitted on this pull request, each with the verdict and the
+    // words. Real GitHub lower-cases the review state on the timeline (`approved`), while the
+    // reviews API returns it upper-case (`APPROVED`); both come off the one stored review.
+    for (const r of extra?.reviews ?? [])
+        events.push({
+            id: id++, event: 'reviewed', actor: actor(r.user_login), created_at: r.submitted_at ?? null,
+            state: (r.state ?? 'commented').toLowerCase(), body: r.body ?? null, submitted_at: r.submitted_at ?? null,
+        });
+    // COMMENTED — the thread itself. An issue and a pull request both take issue comments, and
+    // the timeline is where a consumer reads the conversation in order.
+    for (const c of extra?.comments ?? [])
+        events.push({
+            id: id++, event: 'commented', actor: actor(c.user_login), created_at: c.created_at ?? null,
+            updated_at: c.updated_at ?? c.created_at ?? null, body: c.body ?? null,
+        });
+    // the timeline reads in the order things happened, once they carry their instants
+    if (iss.activity?.length)
+        events.sort((a, b) => String(a.created_at ?? '').localeCompare(String(b.created_at ?? '')));
+    // an issue event is GitHub's own record, with an id unique in the repository (issues/get-event reads it by that
+    // id) and the fields every event carries; comments and cross-references are timeline items, not events
+    const api = `https://api.github.com/repos/${repository}`;
+    return events.map((e) => {
+        if (['commented', 'reviewed', 'cross-referenced', 'committed'].includes(String(e.event)))
+            return e;
+        const eventId = actionsId(`${repository}#${iss.number}:event:${String(e.id)}`);
+        const commit = typeof e.commit_id === 'string' ? e.commit_id : null;
+        return { ...e, id: eventId, node_id: nodeId('IssueEvent', eventId), url: `${api}/issues/events/${eventId}`, commit_id: commit, commit_url: commit ? `${api}/commits/${commit}` : null, performed_via_github_app: null };
+    });
+}
+// GitHub's vendor-exact "Not Found" envelope (R-V3 / D2 fidelity). Real GitHub's 404s —
+// both a missing resource on a modeled route AND the catch-all response for a route the
+// API doesn't recognize at all — share this literal body: {message, documentation_url,
+// status} (the OpenAPI "basic-error" schema). The twin previously leaked its own twin
+// identity in the catch-all fallthrough message and omitted documentation_url/status on
+// every interior 404, which is a fidelity seam for any caller that surfaces or
+// string-matches GitHub's error envelope. Used for BOTH cases so an octokit consumer
+// cannot distinguish "modeled resource missing" from "route not modeled" — exactly like
+// the real vendor, which also never reveals that distinction.
+const GITHUB_NOT_FOUND_DOCUMENTATION_URL = 'https://docs.github.com/rest';
+export function githubNotFound() {
+    return { status: 404, body: { message: 'Not Found', documentation_url: GITHUB_NOT_FOUND_DOCUMENTATION_URL, status: '404' } };
+}
+// GitHub list pagination: per_page default 30, max 100; page is 1-based. Callers that
+// pass no params get page 1 / per_page 30 — identical to the un-paginated behavior for
+// any list of <= 30 items.
+export function paginate(items, query) {
+    const params = new URLSearchParams((query ?? '').replace(/^\?/, ''));
+    let perPage = Number(params.get('per_page'));
+    if (!Number.isFinite(perPage) || perPage <= 0)
+        perPage = 30;
+    perPage = Math.min(Math.floor(perPage), 100);
+    let page = Number(params.get('page'));
+    if (!Number.isFinite(page) || page <= 0)
+        page = 1;
+    page = Math.floor(page);
+    const start = (page - 1) * perPage;
+    return items.slice(start, start + perPage);
+}
+// Derive the Activity event stream (GET /events, /users/:u/events, /users/:u/received_events)
+// from the modeled world — each first-class object the twin tracks maps to the GitHub event
+// type it would have fired (PRs→PullRequestEvent, issues→IssuesEvent, releases→ReleaseEvent,
+// pushes-as-contents→PushEvent, etc.). Honest: only events for objects the twin actually
+// models; ids are deterministic (hash of the natural key — never random/time). The stream is
+// the SAME projection the REST twin serves, surfaced as the public activity timeline.
+export function githubActivityEvents(state) {
+    const ev = (type, key, repo, payload, at) => {
+        const [owner] = repo.split('/');
+        const id = String(0x60000000 + (parseInt(createHash('sha256').update(`event:${type}:${key}`).digest('hex').slice(0, 8), 16) % 0x0fffffff));
+        return { id, type, actor: { login: owner, display_login: owner }, repo: { name: repo }, payload, public: true, created_at: at ?? null };
+    };
+    const events = [];
+    // A `PullRequestEvent` for a row that is not a pull request is the pulls-list defect in
+    // another door: `state.prs` also holds the SHELLS `ensure()` materializes for the
+    // review/comment counters, which hang off issue numbers, and an issue that was commented on
+    // is not a pull request that was opened. The feed reads the same marker the pulls list does.
+    for (const pr of state.prs.filter((p) => p.is_pull_request))
+        events.push(ev('PullRequestEvent', pr.id, pr.repository, { action: pr.merged ? 'closed' : (pr.state === 'closed' ? 'closed' : 'opened'), number: pr.number, pull_request: { number: pr.number, title: pr.title, merged: pr.merged ?? false } }, pr.merged_at));
+    for (const iss of state.issues)
+        events.push(ev('IssuesEvent', iss.id, iss.repository, { action: iss.state === 'closed' ? 'closed' : 'opened', issue: { number: iss.number, title: iss.title } }, iss.created_at));
+    for (const r of state.releases)
+        if (!r.draft)
+            events.push(ev('ReleaseEvent', `${r.repository}#${r.id}`, r.repository, { action: 'published', release: { tag_name: r.tag_name, name: r.name } }, r.published_at));
+    for (const c of state.comments)
+        events.push(ev(c.kind === 'review' ? 'PullRequestReviewCommentEvent' : 'IssueCommentEvent', `${c.repository}#${c.id}`, c.repository, { action: 'created', comment: { body: c.body } }, c.created_at));
+    return events.sort((a, b) => (String(a.id) < String(b.id) ? -1 : 1));
+}
+// Deterministic next number in the per-repo SHARED issue/PR number space (real GitHub
+// behavior): issues and PRs draw from ONE counter, so the next number is max(existing PR
+// or issue number in the repo) + 1. Used for both PR-create and issue-create.
+export function nextRepoNumber(st, repo) {
+    let max = 0;
+    for (const p of st.prs)
+        if (p.repository === repo)
+            max = Math.max(max, p.number);
+    for (const i of st.issues)
+        if (i.repository === repo)
+            max = Math.max(max, i.number);
+    // discussions are numbered in the same sequence (docs.github.com/discussions/collaborating-with-your-community-using-discussions/about-discussions)
+    for (const d of st.discussions)
+        if (d.repository === repo)
+            max = Math.max(max, d.number);
+    return max + 1;
+}
+// Coerce a labels write payload (string[] or {name}[] — both accepted by real GitHub)
+// into the bare-name list the twin stores.
+export function normalizeLabels(input) {
+    if (!Array.isArray(input))
+        return [];
+    return input.map((l) => (typeof l === 'string' ? l : String(l?.name ?? ''))).filter(Boolean);
+}
+// Coerce an assignees write payload (string[] of logins) into a bare-login list.
+export function normalizeLogins(input) {
+    if (!Array.isArray(input))
+        return [];
+    return input.map((u) => (typeof u === 'string' ? u : String(u?.login ?? ''))).filter(Boolean);
+}
+// The triage trio (labels / assignees / milestone) an issue or PR write may carry. Real
+// GitHub accepts all three on BOTH issue create (POST .../issues) and edit (PATCH
+// .../issues/:n), and on PR edit — one coercion, used by every one of them, so the paths
+// cannot diverge (they did: issue create silently dropped all three while edit honoured them).
+export function applyTriageFields(fields, body) {
+    if (body.labels !== undefined)
+        fields.labels = normalizeLabels(body.labels);
+    if (body.assignees !== undefined)
+        fields.assignees = normalizeLogins(body.assignees);
+    if (body.milestone !== undefined)
+        fields.milestone = body.milestone === null ? null : Number(body.milestone);
+}
+export function nextSeq(prefix, root) {
+    let max = 0;
+    for (const r of twinResources(SERVICE, root)) {
+        const m = new RegExp(`^${prefix}:(\\d+)$`).exec(r.id);
+        if (m)
+            max = Math.max(max, Number(m[1]));
+    }
+    return max + 1;
+}
+// Deterministic positive-integer id for an Actions object derived from a stable key (never
+// random / time-based — the repo forbids Math.random/Date.now in non-runtime code). Offset
+// above the local sequence space so it never collides with sequence ids like `run:1`.
+export function actionsId(key) {
+    return 0x50000000 + (parseInt(createHash('sha256').update(key).digest('hex').slice(0, 8), 16) % 0x0fffffff);
+}
+// Deterministic seeded profile for any login (so GET /users/:login round-trips a faithful
+// simple-user object even when no profile was explicitly written). An org login (ends with
+// '-org' or is all-lowercase 'octo'-style) is treated as a User by default. Never random.
+export function seedUser(login) {
+    const id = 0x10000000 + (parseInt(createHash('sha256').update(`user:${login}`).digest('hex').slice(0, 8), 16) % 0x0fffffff);
+    return { login, id, type: 'User', name: null, bio: null, company: null, blog: null, location: null, email: null };
+}
+/**
+ * Handle a GitHub REST WRITE as a local action (R5/R18). Supports:
+ *   POST   /repos/:o/:r/pulls            → create PR  (pull_request: opened)
+ *   PATCH  /repos/:o/:r/pulls/:n         → edit PR    (pull_request: edited/closed)
+ *   PUT    /repos/:o/:r/pulls/:n/merge   → merge PR   (pull_request: closed; 405 if not mergeable)
+ *   POST   /repos/:o/:r/pulls/:n/reviews → submit review (pull_request_review)
+ *   POST   /repos/:o/:r/issues           → create issue (issues: opened)
+ *   PATCH  /repos/:o/:r/issues/:n        → edit issue  (issues: edited/closed)
+ *   POST   /repos/:o/:r/issues/:n/comments → comment (issue_comment)
+ * Mirror mode rejects writes (R4). No real GitHub I/O (R16).
+ */
+/**
+ * The PR's REAL changed-file list from the git plane: resolve the base branch tip + the PR
+ * head sha; when both commits exist in the bare repo, `git diff-tree` computes the truth.
+ * Null when either side is not in the plane (observed/simulated PRs keep their carried or
+ * empty file lists — never fabricated). This is what merge-gate scope classification reads
+ * (GET /pulls/:n/files + GraphQL changedFiles), so a pushed PR must answer with its actual
+ * paths, not 0 files.
+ */
+export async function prPlaneDiffFiles(state, repo, pr, root) {
+    const headSha = pr.head_sha;
+    if (!headSha || !/^[0-9a-f]{40}$/i.test(headSha))
+        return null;
+    const baseBranch = pr.base_ref;
+    if (!baseBranch)
+        return null;
+    // A merged pull request keeps the diff it was merged with: its base is the merge commit's first parent,
+    // since the base branch's tip now holds the head and would diff to nothing.
+    const mergedFrom = pr.merged && pr.merge_commit_sha ? (await readGitCommitFromPlane(repo, pr.merge_commit_sha, root))?.parents[0] : undefined;
+    const baseSha = mergedFrom
+        ?? state.gitRefs.find((x) => x.repository === repo && x.ref === `refs/heads/${baseBranch}`)?.object_sha
+        ?? state.branches.find((b) => b.repository === repo && b.name === baseBranch)?.commit_sha;
+    if (!baseSha || !/^[0-9a-f]{40}$/i.test(baseSha))
+        return null;
+    const diff = await diffFilesInPlane(repo, baseSha, headSha, root, { patch: true });
+    if (!diff)
+        return null;
+    // Real post-image blob shas and the unified patch GitHub serves per text file (none for a binary one).
+    return diff.map((f) => ({ filename: f.filename, status: f.status, additions: f.additions, deletions: f.deletions, changes: f.additions + f.deletions, ...(f.sha !== undefined ? { sha: f.sha } : {}), ...(f.patch !== undefined ? { patch: f.patch } : {}) }));
+}
+/**
+ * GitHub closes open PRs whose HEAD BRANCH is deleted. Shared by the receive-pack reconcile
+ * and the REST ref delete so both paths converge. Returns the closed PR numbers. A pull request's head branch may
+ * live in a fork (`repo` is where the branch was, the callback names the pull request's own repository).
+ */
+export async function closePrsForDeletedBranch(repo, branch, root, occurredAt, onChanged, atomically, by) {
+    const changed = [];
+    // the close is the pull request's move by the deletion (manifest.ts), on the wire that made it
+    const { manifest } = await import("./manifest.js");
+    const machine = manifest.resources['pull-request'].state.state;
+    for (const candidate of githubState(root).prs) {
+        if ((candidate.head_repo ?? candidate.repository) !== repo || candidate.head_ref !== branch)
+            continue;
+        const snapshot = await atomically(() => {
+            const state = githubState(root);
+            const current = state.prs.find(pr => pr.id === candidate.id);
+            return !current || current.merged || !transitionFor('state', machine, by.operation, current.state ?? 'open', 'closed', current.id, by.actor).move ? { value: undefined } : closedWithItsBranch(current, state, occurredAt);
+        });
+        if (snapshot) {
+            changed.push(Number(snapshot.number));
+            onChanged?.(snapshot, candidate.repository);
+        }
+    }
+    return changed;
+}
+/** An open pull request closed because its head branch was deleted: its answer and the write. */
+function closedWithItsBranch(current, state, occurredAt) {
+    const fields = { number: current.number, repository: current.repository, state: 'closed' };
+    return { value: toGithubRest({ ...current, ...fields, updated_at: occurredAt }, state.milestones), write: { operation: 'pull_request.update', subjectType: 'pull_request', subjectId: current.id, fields } };
+}
+/**
+ * Re-point every OPEN PR whose head branch is `branch` at the branch's new tip — GitHub's
+ * `synchronize` semantic: a push (receive-pack or an API ref update) moves the PR head, so
+ * statuses/checks/reviews earned on the old head no longer match. Returns the PR numbers
+ * moved (the receive-pack path emits `pull_request synchronize` webhooks for them).
+ */
+export async function syncPrHeadsToBranchTip(repo, branch, sha, root, occurredAt, onChanged, atomically = kernelAtomic(occurredAt, root)) {
+    const changed = [];
+    for (const candidate of githubState(root).prs) {
+        if ((candidate.head_repo ?? candidate.repository) !== repo || candidate.head_ref !== branch)
+            continue;
+        const snapshot = await atomically(() => {
+            const state = githubState(root);
+            const current = state.prs.find(pr => pr.id === candidate.id);
+            if (!current || current.merged || (current.state ?? 'open') !== 'open' || current.head_sha === sha)
+                return { value: undefined };
+            const fields = { number: current.number, repository: current.repository, head_sha: sha };
+            return { value: toGithubRest({ ...current, ...fields, updated_at: occurredAt }, state.milestones), write: { operation: 'pull_request.update', subjectType: 'pull_request', subjectId: current.id, fields } };
+        });
+        if (snapshot) {
+            changed.push(Number(snapshot.number));
+            onChanged?.(snapshot, candidate.repository);
+        }
+    }
+    return changed;
+}
+/** Register a GitHub App: {slug, name, owner, permissions, events, setup_url?, callback_url?, request_oauth_on_install?,
+ *  hook_attributes?: {url}, webhook_secret?, description?}. GitHub registers apps in its settings UI (the twin's door,
+ *  POST /_twin/apps) or from a manifest (src/screens/app-manifest.tsx). A slug that is not one, or is taken, is 422. */
+export async function registerGithubApp(body, occurredAt, root) {
+    const req = { root };
+    const slug = String(body.slug ?? '');
+    if (!/^[a-z0-9](?:[a-z0-9-]{0,33})$/.test(slug))
+        return { response: { status: 422, body: { message: 'Validation Failed', errors: [{ resource: 'Integration', field: 'slug', code: 'invalid' }] } } };
+    const apps = githubApps(req.root);
+    if (apps.some((a) => a.slug === slug))
+        return { response: { status: 422, body: { message: 'Validation Failed', errors: [{ resource: 'Integration', field: 'slug', code: 'already_exists' }] } } };
+    const id = apps.reduce((n, a) => Math.max(n, a.id), 0) + 1;
+    const hook = body.hook_attributes && typeof body.hook_attributes === 'object' ? body.hook_attributes.url : undefined;
+    const fields = {
+        id, slug, name: String(body.name ?? slug), owner: String(body.owner ?? 'octocat'), client_id: `Iv1.${createHash('sha256').update(`app:${slug}`).digest('hex').slice(0, 16)}`,
+        permissions: body.permissions && typeof body.permissions === 'object' ? Object.fromEntries(Object.entries(body.permissions).map(([k, v]) => [k, String(v)])) : {},
+        events: Array.isArray(body.events) ? body.events.map(String) : [], request_oauth_on_install: body.request_oauth_on_install === true, description: body.description ?? null, created_at: occurredAt,
+        ...(typeof body.setup_url === 'string' ? { setup_url: body.setup_url } : {}), ...(typeof body.callback_url === 'string' ? { callback_url: body.callback_url } : {}),
+        ...(typeof hook === 'string' ? { hook_url: hook } : {}), ...(typeof body.webhook_secret === 'string' ? { webhook_secret: body.webhook_secret } : {}), ...(typeof body.url === 'string' ? { url: body.url } : {}),
+    };
+    await applyTwinWrite(SERVICE, { operation: 'app_registration.create', subjectType: 'app_registration', subjectId: `app:${slug}`, fields, occurredAt, actor: { kind: 'agent' } }, req.root);
+    return { response: { status: 201, body: toGithubApp(fields, 0, githubState(req.root)) }, app: fields };
+}
+/** The twin's own doors under /_twin/: what stands in for an act GitHub does in its web UI or its runners, which have
+ *  no API. A request to any other path is not a door's (undefined). */
+export async function handleGithubDoor(request, scope) {
+    const seg = new URL(request.url).pathname.replace(/\/+$/, '').replace(/^\/+/, '').split('/');
+    if (seg[0] !== '_twin')
+        return undefined;
+    const req = { root: scope.root };
+    const occurredAt = scope.now();
+    // GET /_twin/users/:login/totp → {code}: the person's authenticator app, showing the code of their two-factor secret for
+    //   the World clock's now (the secret POST /_twin/users/:login/two-factor set). GitHub has no such door; it is their phone.
+    if (request.method === 'GET' && seg[1] === 'users' && seg[2] && seg[3] === 'totp' && !seg[4]) {
+        const login = decodeURIComponent(seg[2]).toLowerCase();
+        const factor = twinResources(SERVICE, req.root).find((r) => r.type === 'user_two_factor' && String(r.login).toLowerCase() === login && r.deleted !== true);
+        if (!factor)
+            return Response.json(githubNotFound().body, { status: 404 });
+        return Response.json({ code: totpCode(String(factor.secret), totpStep(occurredAt)) }, { status: 200 });
+    }
+    if (request.method !== 'POST')
+        return undefined;
+    // the new-organization page (POST /_twin/orgs below) sends a visitor not signed in to the sign-in, returning them there
+    const newOrganization = seg[1] === 'orgs' && !seg[2];
+    const { signedIn, toSignIn } = await import("./screens/session.js");
+    const person = newOrganization ? signedIn(request, req.root) : undefined;
+    if (newOrganization && !person)
+        return toSignIn(request, undefined, '/account/organizations/new');
+    let body = {};
+    try {
+        body = JSON.parse((await request.text()) || '{}');
+    }
+    catch {
+        return Response.json({ message: 'invalid JSON body' }, { status: 400 });
+    }
+    const answer = async () => {
+        // POST /_twin/apps → register a GitHub App (GitHub makes them in its settings UI, which has no API):
+        //   {slug, name, owner, permissions, events, setup_url?, callback_url?, request_oauth_on_install?, hook_attributes?: {url},
+        //   webhook_secret?}. It is installed through its page, github.com/apps/{slug}/installations/new (src/screens/app-installation.tsx).
+        if (seg[1] === 'apps' && !seg[2])
+            return registerGithubApp(body, occurredAt, req.root);
+        // POST /_twin/users/:login/tokens → a personal access token for that user (GitHub mints these in its settings UI,
+        //   which has no API). Requests carrying it are that user's: writes are attributed to them and GET /user names them.
+        if (seg[1] === 'users' && seg[2] && seg[3] === 'tokens' && !seg[4]) {
+            const login = decodeURIComponent(seg[2]);
+            if (!/^[A-Za-z0-9](?:[A-Za-z0-9-]{0,38})$/.test(login))
+                return { response: { status: 422, body: { message: 'Validation Failed', errors: [{ resource: 'User', field: 'login', code: 'invalid' }] } } };
+            const token = `ghp_${createHash('sha256').update(`pat:${login}:${nextSeq('pat', req.root)}`).digest('hex').slice(0, 36)}`;
+            const scopes = Array.isArray(body.scopes) ? body.scopes.map(String) : ['repo', 'read:org'];
+            await applyTwinWrite(SERVICE, { operation: 'oauth_grant.create', subjectType: 'oauth_grant', subjectId: `oauthgrant:${token}`, fields: { token, client_id: 'personal-access-token', scopes, login, created_at: occurredAt }, occurredAt, actor: { kind: 'agent' } }, req.root);
+            return { response: { status: 201, body: { token, login, scopes } } };
+        }
+        // POST /_twin/users/:login/password → {password}: the password the World gives a person, with which they sign in at
+        //   github.com/login (src/screens/session.tsx). GitHub's sign-up and password pages are not modelled; the World keeps
+        //   the password's hash, never the password.
+        if (seg[1] === 'users' && seg[2] && seg[3] === 'password' && !seg[4]) {
+            const login = decodeURIComponent(seg[2]);
+            const password = typeof body.password === 'string' ? body.password : '';
+            if (!/^[A-Za-z0-9](?:[A-Za-z0-9-]{0,38})$/.test(login) || password.length < 8)
+                return { response: { status: 422, body: { message: 'Validation Failed', errors: [{ resource: 'User', field: password.length < 8 ? 'password' : 'login', code: 'invalid' }] } } };
+            await applyTwinWrite(SERVICE, { operation: 'user_credential.set', subjectType: 'user_credential', subjectId: `credential:${login.toLowerCase()}`, fields: { login, hash: passwordHash(login, password), set_at: occurredAt }, occurredAt, actor: { kind: 'agent' } }, req.root);
+            return { response: { status: 204, body: undefined } };
+        }
+        // POST /_twin/users/:login/two-factor → {secret}: the person turns on two-factor authentication with a TOTP app, as
+        //   GitHub's settings page does (docs.github.com/authentication/securing-your-account-with-two-factor-authentication-2fa/
+        //   configuring-two-factor-authentication): the answer is the setup key (base32; SHA1, 6 digits, 30 seconds) their
+        //   authenticator saves. From then on the sign-in asks for its code after the password (src/screens/session.tsx).
+        //   GitHub's verify-a-first-code and recovery-code steps are not modelled.
+        if (seg[1] === 'users' && seg[2] && seg[3] === 'two-factor' && !seg[4]) {
+            const login = decodeURIComponent(seg[2]);
+            if (!/^[A-Za-z0-9](?:[A-Za-z0-9-]{0,38})$/.test(login))
+                return { response: { status: 422, body: { message: 'Validation Failed', errors: [{ resource: 'User', field: 'login', code: 'invalid' }] } } };
+            const secret = base32(createHash('sha256').update(`totp:${login.toLowerCase()}:${occurredAt}:${nextSeq('totp', req.root)}`).digest().subarray(0, 20));
+            await applyTwinWrite(SERVICE, { operation: 'user_two_factor.set', subjectType: 'user_two_factor', subjectId: `twofactor:${login.toLowerCase()}`, fields: { login, secret, set_at: occurredAt }, occurredAt, actor: { kind: 'human', id: login } }, req.root);
+            return { response: { status: 201, body: { secret } } };
+        }
+        // POST /_twin/orgs → {login, name?}: GitHub's new-organization page (github.com/account/organizations/new; GitHub has
+        //   no API to create one). Its creator is the person signed in (the request's session cookie, src/screens/session.tsx),
+        //   who becomes its first admin member; a visitor not signed in is sent to the sign-in, as the page sends them.
+        if (newOrganization && person) {
+            const owner = person;
+            const login = String(body.login ?? '');
+            const LOGIN = /^[A-Za-z0-9](?:[A-Za-z0-9-]{0,38})$/;
+            if (!LOGIN.test(login))
+                return { response: { status: 422, body: { message: 'Validation Failed', errors: [{ resource: 'Organization', field: 'login', code: 'invalid' }] } } };
+            if (githubState(req.root).orgs.some((o) => o.login.toLowerCase() === login.toLowerCase()))
+                return { response: { status: 422, body: { message: 'Validation Failed', errors: [{ resource: 'Organization', field: 'login', code: 'already_exists' }] } } };
+            await applyTwinWrite(SERVICE, { operation: 'organization.create', subjectType: 'organization', subjectId: `org:${login}`, fields: { login, ...(body.name !== undefined ? { name: String(body.name) } : {}), created_at: occurredAt, updated_at: occurredAt }, occurredAt, actor: { kind: 'human', id: owner } }, req.root);
+            await applyTwinWrite(SERVICE, { operation: 'org_membership.upsert', subjectType: 'org_membership', subjectId: `orgmember:${login}#${owner}`, fields: { org: login, login: owner, role: 'admin', state: 'active', created_at: occurredAt }, occurredAt, actor: { kind: 'human', id: owner } }, req.root);
+            return { response: { status: 201, body: toGithubOrg(githubState(req.root).orgs.find((o) => o.login === login)) } };
+        }
+        // POST /_twin/repos/:o/:r/actions/runs/:id/start → the runner picking up a queued run (GitHub has no API for it): the
+        //   run and its jobs go in progress, and the job is handed its GITHUB_TOKEN, an installation token of the GitHub
+        //   Actions app for this repository only, with the permissions the workflow grants it, that expires when the job
+        //   finishes (docs.github.com/actions/security-for-github-actions/security-guides/automatic-token-authentication).
+        //   Answers {token, permissions}. Writes made with it are github-actions[bot]'s.
+        if (seg[1] === 'repos' && seg[4] === 'actions' && seg[5] === 'runs' && seg[6] && seg[7] === 'start' && !seg[8]) {
+            const repo = `${decodeURIComponent(seg[2])}/${decodeURIComponent(seg[3])}`;
+            const id = Number(decodeURIComponent(seg[6]));
+            const st = githubState(req.root);
+            const run = st.workflowRuns.find((r) => r.repository === repo && r.id === id);
+            if (!run)
+                return { response: githubNotFound() };
+            if (run.status !== 'queued')
+                return { response: { status: 409, body: { message: run.status === 'completed' ? 'The run has already completed' : 'The run has already started' } } };
+            const wf = st.workflows.find((w) => w.id === run.workflow_id);
+            const { tokenPermissions } = await import("./semantics/push-reactions.js");
+            const file = wf ? await planeEntryAt(repo, run.head_sha, wf.path, req.root) : undefined;
+            const blob = file?.kind === 'file' ? await readGitBlobFromPlane(repo, file.entry.sha, req.root) : null;
+            const permissions = tokenPermissions(blob ? Buffer.from(blob.content_b64, 'base64').toString('utf8') : '');
+            await applyTwinWrite(SERVICE, { operation: 'workflow_run.start', subjectType: 'workflow_run', subjectId: `run:${id}`, fields: { repository: repo, status: 'in_progress', updated_at: occurredAt }, occurredAt, actor: { kind: 'agent' } }, req.root);
+            for (const job of st.jobs.filter((j) => j.repository === repo && j.run_id === id)) {
+                await applyTwinWrite(SERVICE, { operation: 'workflow_job.start', subjectType: 'workflow_job', subjectId: `job:${job.id}`, fields: { repository: repo, status: 'in_progress', started_at: occurredAt }, occurredAt, actor: { kind: 'agent' } }, req.root);
+                await applyTwinWrite(SERVICE, { operation: 'check_run.update', subjectType: 'check_run', subjectId: `check:${job.id}`, fields: { repository: repo, status: 'in_progress', started_at: occurredAt }, occurredAt, actor: { kind: 'agent' } }, req.root);
+            }
+            // its steps run, uploading its artifacts (semantics/push-reactions.ts)
+            const { runOutputs } = await import("./semantics/push-reactions.js");
+            await runOutputs(repo, run, githubState(req.root), req.root, (w) => applyTwinWrite(SERVICE, { ...w, occurredAt, actor: { kind: 'agent' } }, req.root).then(() => undefined), (prefix) => nextSeq(prefix, req.root), occurredAt, { artifacts: true, caches: false });
+            const token = `ghs_${createHash('sha256').update(`github_token:${repo}:${id}`).digest('hex').slice(0, 36)}`;
+            await applyTwinWrite(SERVICE, { operation: 'app_token.create', subjectType: 'app_token', subjectId: `apptoken:${token}`, fields: { token, app_slug: 'github-actions', account_login: repo.split('/')[0], permissions, repository_selection: 'selected', repositories: [repo.split('/')[1]], run_id: id, repository: repo }, occurredAt, actor: { kind: 'agent' } }, req.root);
+            return { response: { status: 200, body: { token, permissions } } };
+        }
+        // POST /_twin/repos/:o/:r/actions/runs/:id/complete → {conclusion}: the runner finishing a run (GitHub has no API for
+        //   it; its runners report it). A run whose gated environment was rejected cannot succeed.
+        if (seg[1] === 'repos' && seg[4] === 'actions' && seg[5] === 'runs' && seg[6] && seg[7] === 'complete' && !seg[8]) {
+            const repo = `${decodeURIComponent(seg[2])}/${decodeURIComponent(seg[3])}`;
+            const id = Number(decodeURIComponent(seg[6]));
+            const run = githubState(req.root).workflowRuns.find((r) => r.repository === repo && r.id === id);
+            if (!run)
+                return { response: githubNotFound() };
+            const conclusion = String(body.conclusion ?? '');
+            if (!['success', 'failure', 'neutral', 'skipped', 'timed_out', 'action_required'].includes(conclusion))
+                return { response: { status: 422, body: { message: 'Validation Failed', errors: [{ resource: 'WorkflowRun', field: 'conclusion', code: 'invalid' }] } } };
+            // the runner finishing it is GitHub's move on the run's machine, and on each of its jobs' (manifest.ts)
+            const { manifest } = await import("./manifest.js");
+            const finished = transitionFor('status', manifest.resources['workflow-run'].state.status, '', run.status, 'completed', String(id), 'vendor');
+            if (finished.refusal)
+                return { response: { status: finished.refusal.status, body: { message: finished.refusal.message } } };
+            if (conclusion === 'success' && run.approvals?.some((x) => x.state === 'rejected'))
+                return { response: { status: 409, body: { message: 'A gated environment of this run was rejected' } } };
+            const runFields = { repository: repo, workflow_id: run.workflow_id, name: run.name, run_number: run.run_number, event: run.event, status: 'completed', conclusion, head_sha: run.head_sha, head_branch: run.head_branch, created_at: run.created_at, updated_at: occurredAt };
+            await applyTwinWrite(SERVICE, { operation: 'workflow_run.complete', subjectType: 'workflow_run', subjectId: `run:${id}`, fields: runFields, occurredAt, actor: { kind: 'agent' } }, req.root);
+            for (const job of githubState(req.root).jobs.filter((j) => j.repository === repo && j.run_id === id)) {
+                if (!transitionFor('status', manifest.resources.job.state.status, '', job.status, 'completed', String(job.id), 'vendor').move)
+                    continue;
+                const jobFields = { run_id: id, repository: repo, name: job.name, status: 'completed', conclusion, head_sha: job.head_sha, started_at: job.started_at ?? run.created_at, completed_at: occurredAt, steps: job.steps.map((s) => ({ ...s, status: 'completed', conclusion })) };
+                await applyTwinWrite(SERVICE, { operation: 'workflow_job.complete', subjectType: 'workflow_job', subjectId: `job:${job.id}`, fields: jobFields, occurredAt, actor: { kind: 'agent' } }, req.root);
+                // and reports its check run on the commit (semantics/push-reactions.ts)
+                const { actionsCheckRun } = await import("./semantics/push-reactions.js");
+                await applyTwinWrite(SERVICE, { ...actionsCheckRun(job, 'completed', conclusion, occurredAt), occurredAt, actor: { kind: 'agent' } }, req.root);
+            }
+            // its jobs' GITHUB_TOKEN expires with them
+            for (const t of twinResources(SERVICE, req.root).filter((r) => r.type === 'app_token' && r.app_slug === 'github-actions' && r.run_id === id && r.repository === repo && r.deleted !== true)) {
+                await applyTwinWrite(SERVICE, { operation: 'app_token.expire', subjectType: 'app_token', subjectId: String(t.id), fields: { deleted: true }, occurredAt, actor: { kind: 'agent' } }, req.root);
+            }
+            // what the run's steps uploaded stays with it: artifacts and caches (semantics/push-reactions.ts)
+            // (a run the runner picked up uploaded its artifacts as it ran)
+            const { runOutputs } = await import("./semantics/push-reactions.js");
+            await runOutputs(repo, run, githubState(req.root), req.root, (w) => applyTwinWrite(SERVICE, { ...w, occurredAt, actor: { kind: 'agent' } }, req.root).then(() => undefined), (prefix) => nextSeq(prefix, req.root), occurredAt, { artifacts: run.status === 'queued', caches: true });
+            return { response: { status: 200, body: { id, status: 'completed', conclusion } } };
+        }
+        return undefined;
+    };
+    const response = (await answer())?.response;
+    // a door that answers 204 has no body, as HTTP says
+    return response && (response.status === 204 ? new Response(null, { status: 204 }) : Response.json(response.body, { status: response.status }));
+}
+/** The subject id a write landed under: a head that performed it adopts the vendor's id (an issue's
+ *  number), recorded in the alias map. */
+export function adoptedSubjectId(type, id, root) {
+    return resolveSubjectId(SERVICE, type, id, root);
+}
+/** A request's issue or pull-request number, resolved through the alias map: a caller on a branch
+ *  may still name one by the number it minted locally after the head adopted GitHub's
+ *  (docs/contributing/architecture.md#alias-aware-lookup-at-the-request-boundary). */
+export function resolveGithubNumber(owner, name, number, root) {
+    return resolveSubjectId(SERVICE, 'issue', `${owner}/${name}#issue:${number}`, root).split('#issue:').pop();
+}
+/** A GitHub REST read made in-process, through the same fetch the server serves (the derived
+ *  dispatch, its semantics handlers, and the hand-written routes for what has not moved). */
+export async function handleGithubRequest(req) {
+    return inProcess(req);
+}
+/** A GitHub REST write made in-process, stamped at `occurredAt` (the World clock when absent). A write
+ *  GitHub announces delivers its webhooks from the fetch, as it does over HTTP, and the events it
+ *  announced ride the answer: one as `webhook`, several as `webhooks`. */
+export async function applyGithubWrite(req) {
+    const { collectAnnouncements } = await import("./semantics/shared.js");
+    const { value: response, events } = await collectAnnouncements(() => inProcess(req));
+    return { response, ...(events.length === 1 ? { webhook: events[0] } : events.length > 1 ? { webhooks: events } : {}) };
+}
+/** The origin an in-process call is answered at. */
+const GITHUB_API_ORIGIN = 'https://api.github.com';
+async function inProcess(req) {
+    const { createGithubTwinFetch } = await import("./github-server.js");
+    const twin = createGithubTwinFetch({ ...(req.root !== undefined ? { root: req.root } : {}), readOnly: req.readOnly ?? false, ...(req.occurredAt ? { clock: () => req.occurredAt } : {}) });
+    const method = req.method.toUpperCase();
+    // a page is asked for as its person's browser asks, with their session cookie (src/screens/session.tsx)
+    const headers = { 'content-type': req.contentType ?? 'application/json', ...(req.token ? { authorization: `token ${req.token}` } : {}), ...(req.cookie ? { cookie: req.cookie } : {}) };
+    // an absolute url is followed as given (a release's upload_url on uploads.github.com); a path is the API host's
+    const url = /^https:\/\//.test(req.path) ? req.path : `${GITHUB_API_ORIGIN}${req.path.startsWith('/') ? req.path : `/${req.path}`}`;
+    const response = await twin(new Request(url, { method, headers, ...(method !== 'GET' && method !== 'HEAD' && req.body ? { body: req.body } : {}) }));
+    const text = await response.text();
+    if (!text)
+        return { status: response.status, body: undefined };
+    try {
+        return { status: response.status, body: JSON.parse(text) };
+    }
+    catch {
+        return { status: response.status, body: text };
+    }
+}