@wowyuarm/dsh-agent-team 0.1.14-alpha.2 → 0.1.15

package/packages/agent-team/lib/index.js

@@ -40,6 +40,8 @@ var __esDecorate = (this && this.__esDecorate) || function (ctor, descriptorIn,
     done = true;
 };
 import { randomUUID } from 'node:crypto';
+import { readFileSync } from 'node:fs';
+import { join } from 'node:path';
 import { isDeepStrictEqual } from 'node:util';
 import { Service } from '@deepseek-ai/cordis';
 import { installModelSelection } from '@deepseek-ai/dsh-agent';
@@ -50,11 +52,14 @@ import { Session, SessionId, SessionLogOffset } from '@deepseek-ai/dsh-session';
 import { setSandboxMode } from '@deepseek-ai/dsh-sandbox-policy';
 import { Remote, TypertRemoteService } from '@deepseek-ai/dsh-typert-protocol';
 import { ATTACHMENT_MAX_BYTES, attachmentPayloadPath, attachmentsRoot, copyPathAttachment, newAttachmentId, readAttachment, sanitizeMediaType, sweepAttachmentCache, validatePathAttachment, writeAttachment } from "./attachments.js";
+import { HUMAN_PROFILE_DEFAULT_NAME, HUMAN_PROFILE_REPO_URL, HUMAN_PROFILE_SETTINGS_NAMESPACE, HUMAN_PROFILE_SETTINGS_SCHEMA, HUMAN_PROFILE_VERSION, assertValidHumanName, normalizeHumanName, parseLegacyHumanProfile, planLegacyAdoption } from "./human-profile.js";
+import { humanAvatarsRoot, readHumanAvatar, removeHumanAvatar, writeHumanAvatar } from "./human-avatar.js";
+import { createHumanUpdateChecker } from "./human-update-check.js";
 import { PressurePolicyCoordinator } from "./pressure-policy.js";
-import { ContextManagementCoordinator } from "./context-management.js";
-import { AGENT_TEAM_PLUGIN_ID, createHandoffMessage, isAgentTeamSource, isAgentTeamSourceKind } from "./context-source.js";
-import { carriedInputOf, checkpointByRef, checkpointRefFor, contextProjectionFold, foldContextProjection, isReminderNoticeSummary, timelineCandidates } from "./context-projection.js";
-import { advanceOwnedSessionEventCursor } from "./session-event-cursor.js";
+import { CONTEXT_CONTINUITY_PROJECTION_KEY, readContextTimeline } from '@wowyuarm/dsh-context-continuity';
+import { createTeamContextManagement, TEAM_CONTEXT_CODEC } from "./context-continuity-host.js";
+import { AGENT_TEAM_PLUGIN_ID, isAgentTeamSource } from "./context-source.js";
+import { boundaryByRef, carriedInputOf, checkpointByRef, checkpointRefFor, createTeamContextProjectionConfig, createTeamContextProjectionDefinition, foldTeamContextProjection, retainedTopicsThrough, TeamContextProjectionHost } from "./context-projection.js";
 import { AGENT_TEAM_HUMAN_MEMBER_ID, AgentTeamLedger, agentTeamHumanActor } from "./ledger.js";
 import { AGENT_TEAM_TOOL_NAMES, deepCopyCapabilities, memberMemoryDirectoryName, MemberRuntime } from "./member-runtime.js";
 import { classifyRecoverableError, RecoveryCoordinator, RECOVERY_MAX_CONSECUTIVE_ERRORS } from "./recovery.js";
@@ -63,6 +68,8 @@ import { agentTeamDomainSpec } from "./spec.js";
 import { formatTeamTimestamp } from "./time-format.js";
 export { agentTeamDomainSpec, agentTeamOperationSchema } from "./spec.js";
 export { AGENT_TEAM_HUMAN_HANDLE, AGENT_TEAM_HUMAN_MEMBER_ID, AGENT_TEAM_INITIALIZE_REQUEST_ID } from "./ledger.js";
+export { HUMAN_PROFILE_DEFAULT_NAME, HUMAN_PROFILE_REPO_URL, HUMAN_PROFILE_SETTINGS_NAMESPACE, HUMAN_PROFILE_SETTINGS_SCHEMA, HUMAN_PROFILE_VERSION, assertValidHumanName, normalizeHumanName } from "./human-profile.js";
+export { humanAvatarsRoot } from "./human-avatar.js";
 export { AGENT_TEAM_TOOL_NAMES } from "./member-runtime.js";
 /** Process-stable marker carried by the final Team message tool definition. */
 export const AGENT_TEAM_PRESET_MARKER = Symbol.for('@wowyuarm/dsh-agent-team.preset');
@@ -85,9 +92,14 @@ const MAX_CHECKPOINT_NAME_CHARS = 120;
 /** Default and maximum number of timeline items one query returns. */
 const DEFAULT_TIMELINE_LIMIT = 12;
 const MAX_TIMELINE_LIMIT = 24;
-/** Deepest ancestor lineage the timeline and seed resolution walk. */
+/**
+ * Archived generations the timeline and seed resolution walk: the timeline
+ * reads this many ancestors behind the current generation, and the seed guard
+ * resolves a cited ref through the same depth, so the two surfaces cannot
+ * disagree about where history ends.
+ */
 const MAX_TIMELINE_ANCESTORS = 8;
-/** Product pressure budget constants (see docs/team-collaboration.md). */
+/** Product pressure budget constants (see docs/team-collaboration/README.md). */
 const CONTEXT_HARD_LIMIT_CAP = 256_000;
 const CONTEXT_HANDOFF_AT_CAP = 200_000;
 const CONTEXT_HANDOFF_RESERVE = 8_000;
@@ -163,6 +175,7 @@ let AgentTeam = (() => {
     let _classSuper = TypertRemoteService;
     let _instanceExtraInitializers = [];
     let _resolveTaskRefs_decorators;
+    let _resolveThreadRefs_decorators;
     let _membersForClient_decorators;
     let _changes_decorators;
     let _createChannel_decorators;
@@ -182,6 +195,11 @@ let AgentTeam = (() => {
     let _sendMessage_decorators;
     let _putAttachment_decorators;
     let _getAttachment_decorators;
+    let _humanProfileForClient_decorators;
+    let _putHumanAvatar_decorators;
+    let _getHumanAvatar_decorators;
+    let _removeHumanAvatar_decorators;
+    let _setHumanProfile_decorators;
     let _reply_decorators;
     let _changeAttention_decorators;
     let _inbox_decorators;
@@ -193,6 +211,7 @@ let AgentTeam = (() => {
         static {
             const _metadata = typeof Symbol === "function" && Symbol.metadata ? Object.create(_classSuper[Symbol.metadata] ?? null) : void 0;
             _resolveTaskRefs_decorators = [Remote('resolveTaskRefs')];
+            _resolveThreadRefs_decorators = [Remote('resolveThreadRefs')];
             _membersForClient_decorators = [Remote('members')];
             _changes_decorators = [Remote({ mode: 'stream' })];
             _createChannel_decorators = [Remote('createChannel')];
@@ -212,6 +231,11 @@ let AgentTeam = (() => {
             _sendMessage_decorators = [Remote('sendMessage')];
             _putAttachment_decorators = [Remote('putAttachment')];
             _getAttachment_decorators = [Remote('getAttachment')];
+            _humanProfileForClient_decorators = [Remote('humanProfile')];
+            _putHumanAvatar_decorators = [Remote('putHumanAvatar')];
+            _getHumanAvatar_decorators = [Remote('getHumanAvatar')];
+            _removeHumanAvatar_decorators = [Remote('removeHumanAvatar')];
+            _setHumanProfile_decorators = [Remote('setHumanProfile')];
             _reply_decorators = [Remote('reply')];
             _changeAttention_decorators = [Remote('changeAttention')];
             _inbox_decorators = [Remote('inbox')];
@@ -220,6 +244,7 @@ let AgentTeam = (() => {
             _threadHistory_decorators = [Remote('threadHistory')];
             _view_decorators = [Remote('view')];
             __esDecorate(this, null, _resolveTaskRefs_decorators, { kind: "method", name: "resolveTaskRefs", static: false, private: false, access: { has: obj => "resolveTaskRefs" in obj, get: obj => obj.resolveTaskRefs }, metadata: _metadata }, null, _instanceExtraInitializers);
+            __esDecorate(this, null, _resolveThreadRefs_decorators, { kind: "method", name: "resolveThreadRefs", static: false, private: false, access: { has: obj => "resolveThreadRefs" in obj, get: obj => obj.resolveThreadRefs }, metadata: _metadata }, null, _instanceExtraInitializers);
             __esDecorate(this, null, _membersForClient_decorators, { kind: "method", name: "membersForClient", static: false, private: false, access: { has: obj => "membersForClient" in obj, get: obj => obj.membersForClient }, metadata: _metadata }, null, _instanceExtraInitializers);
             __esDecorate(this, null, _changes_decorators, { kind: "method", name: "changes", static: false, private: false, access: { has: obj => "changes" in obj, get: obj => obj.changes }, metadata: _metadata }, null, _instanceExtraInitializers);
             __esDecorate(this, null, _createChannel_decorators, { kind: "method", name: "createChannel", static: false, private: false, access: { has: obj => "createChannel" in obj, get: obj => obj.createChannel }, metadata: _metadata }, null, _instanceExtraInitializers);
@@ -239,6 +264,11 @@ let AgentTeam = (() => {
             __esDecorate(this, null, _sendMessage_decorators, { kind: "method", name: "sendMessage", static: false, private: false, access: { has: obj => "sendMessage" in obj, get: obj => obj.sendMessage }, metadata: _metadata }, null, _instanceExtraInitializers);
             __esDecorate(this, null, _putAttachment_decorators, { kind: "method", name: "putAttachment", static: false, private: false, access: { has: obj => "putAttachment" in obj, get: obj => obj.putAttachment }, metadata: _metadata }, null, _instanceExtraInitializers);
             __esDecorate(this, null, _getAttachment_decorators, { kind: "method", name: "getAttachment", static: false, private: false, access: { has: obj => "getAttachment" in obj, get: obj => obj.getAttachment }, metadata: _metadata }, null, _instanceExtraInitializers);
+            __esDecorate(this, null, _humanProfileForClient_decorators, { kind: "method", name: "humanProfileForClient", static: false, private: false, access: { has: obj => "humanProfileForClient" in obj, get: obj => obj.humanProfileForClient }, metadata: _metadata }, null, _instanceExtraInitializers);
+            __esDecorate(this, null, _putHumanAvatar_decorators, { kind: "method", name: "putHumanAvatar", static: false, private: false, access: { has: obj => "putHumanAvatar" in obj, get: obj => obj.putHumanAvatar }, metadata: _metadata }, null, _instanceExtraInitializers);
+            __esDecorate(this, null, _getHumanAvatar_decorators, { kind: "method", name: "getHumanAvatar", static: false, private: false, access: { has: obj => "getHumanAvatar" in obj, get: obj => obj.getHumanAvatar }, metadata: _metadata }, null, _instanceExtraInitializers);
+            __esDecorate(this, null, _removeHumanAvatar_decorators, { kind: "method", name: "removeHumanAvatar", static: false, private: false, access: { has: obj => "removeHumanAvatar" in obj, get: obj => obj.removeHumanAvatar }, metadata: _metadata }, null, _instanceExtraInitializers);
+            __esDecorate(this, null, _setHumanProfile_decorators, { kind: "method", name: "setHumanProfile", static: false, private: false, access: { has: obj => "setHumanProfile" in obj, get: obj => obj.setHumanProfile }, metadata: _metadata }, null, _instanceExtraInitializers);
             __esDecorate(this, null, _reply_decorators, { kind: "method", name: "reply", static: false, private: false, access: { has: obj => "reply" in obj, get: obj => obj.reply }, metadata: _metadata }, null, _instanceExtraInitializers);
             __esDecorate(this, null, _changeAttention_decorators, { kind: "method", name: "changeAttention", static: false, private: false, access: { has: obj => "changeAttention" in obj, get: obj => obj.changeAttention }, metadata: _metadata }, null, _instanceExtraInitializers);
             __esDecorate(this, null, _inbox_decorators, { kind: "method", name: "inbox", static: false, private: false, access: { has: obj => "inbox" in obj, get: obj => obj.inbox }, metadata: _metadata }, null, _instanceExtraInitializers);
@@ -248,6 +278,8 @@ let AgentTeam = (() => {
             __esDecorate(this, null, _view_decorators, { kind: "method", name: "view", static: false, private: false, access: { has: obj => "view" in obj, get: obj => obj.view }, metadata: _metadata }, null, _instanceExtraInitializers);
             if (_metadata) Object.defineProperty(this, Symbol.metadata, { enumerable: true, configurable: true, writable: true, value: _metadata });
         }
+        config = __runInitializers(this, _instanceExtraInitializers);
+        static Config = HUMAN_PROFILE_SETTINGS_SCHEMA;
         static inject = [
             'storageDomain',
             'workspaceRegistry',
@@ -256,8 +288,9 @@ let AgentTeam = (() => {
             'agentPresets',
             'tools',
             'sessionPersistence',
+            'sessionProjections',
         ];
-        domain = __runInitializers(this, _instanceExtraInitializers);
+        domain;
         ledger;
         handles = new Map();
         /** Live Member per session id; drives the root session/event listener. */
@@ -297,6 +330,12 @@ let AgentTeam = (() => {
         pressurePolicy;
         notifiedInbox = new Map();
         attachmentGcTimer;
+        /**
+         * New-release check behind the settings footnote. Memory-only and
+         * background-refreshed, so the profile read path never waits on the
+         * network and every failure settles as "no update known".
+         */
+        humanUpdateCheck = createHumanUpdateChecker({ currentVersion: HUMAN_PROFILE_VERSION });
         recovery = new RecoveryCoordinator({
             wake: memberId => {
                 this.ctx.logger.info(`agent-team: automatic recovery wakeup for member '${this.memberLabel(memberId)}' after consecutive recoverable failures`);
@@ -307,42 +346,43 @@ let AgentTeam = (() => {
             },
         });
         /**
-         * Incremental fold state for {@link contextManagement}'s projection lookup:
-         * one entry per Member, replaced when that Member's Session changes. Keying
-         * by Member rather than by Session id is what bounds the map — a rollover
-         * that leaves the previous generation's projection behind retains it for the
-         * life of the process, and only the current Session can ever read it.
+         * Team's domain half of the continuity projection: the durable ref naming,
+         * the Team-notice rule, and the boundary judgement (committed messages,
+         * claim changes, first Thread arrivals). Its claim attribution resolves the
+         * Task's Thread through the ledger, which is why the resolver reads
+         * `this.ledger` lazily — the fold may run before the domain is open, and an
+         * unattributed boundary is still a valid anchor.
          */
-        contextCursors = new Map();
+        contextProjectionHost = new TeamContextProjectionHost({
+            threadForTask: taskRef => this.ledger?.threadForTask(taskRef),
+        });
         /**
          * Context self-management: the one deep module that turns a Member's
          * successful `context_rollover` tool result into its next private context
-         * generation. The ledger owns the binding audit, the Session projection
-         * owns intent, and this coordinator owns only reconstructible process
-         * state. See docs/architecture.md and docs/team-collaboration.md.
+         * generation. The ledger owns the binding audit, the engine's projection
+         * unit owns intent, and this coordinator owns only reconstructible process
+         * state. See docs/architecture/README.md and docs/team-collaboration/README.md.
          */
-        contextManagement = new ContextManagementCoordinator({
+        contextManagement = createTeamContextManagement({
             agentForMember: memberId => this.handles.get(memberId)?.agent,
             memberForAgent: agent => this.memberForAgent(agent),
             projectionForMember: (memberId, sessionId) => {
                 const handle = this.handles.get(memberId);
                 if (handle === undefined || handle.agent.session.id !== sessionId)
                     return undefined;
-                const session = handle.agent.session;
-                // The projection is read on every successful tool result and turn end, so
-                // it folds incrementally. The entry is keyed by Member and carries the
-                // Session it was built from: this Session's log keeps growing, a rollover
-                // replaces the entry instead of resuming from its predecessor's cursor,
-                // and a rewritten log falls back to a cold fold inside the cursor.
-                const owned = advanceOwnedSessionEventCursor(this.contextCursors.get(memberId), session.id, contextProjectionFold(session.id), session.ownEvents(), session.inheritedEventCount);
-                this.contextCursors.set(memberId, owned);
-                return owned.cursor.value;
+                // The engine's registered unit folds this Session's durable log (replay
+                // on attach, then incrementally per committed event) and keys every ref
+                // to the Session that recorded it; the registry materializes the cell
+                // lazily, so a Member that has not folded yet is built on this read.
+                return this.ctx.sessionProjections.stateOf(handle.agent.session, CONTEXT_CONTINUITY_PROJECTION_KEY);
             },
             executeTransition: (memberId, plan) => this.executeMemberTransition(memberId, plan),
             log: message => { this.ctx.logger.warn(`agent-team: ${message}`); },
         });
         lifecycleTail = Promise.resolve();
         accepting = true;
+        /** One adoption attempt per boot: the two readiness edges fire once each, and this keeps their attempt single. */
+        legacyAdoptionStarted = false;
         /**
          * Presence wake epoch: Agent running/idle/failure is runtime state with no
          * durable fact behind it, so the presence scope counts those edge wakes in
@@ -350,8 +390,9 @@ let AgentTeam = (() => {
          */
         presenceEpoch = 0;
         changeWaiters = new Set();
-        constructor(ctx) {
+        constructor(ctx, config) {
             super(ctx, 'agentTeam');
+            this.config = config;
             this.pressurePolicy = new PressurePolicyCoordinator({
                 agentForMember: memberId => this.handles.get(memberId)?.agent,
                 memberForAgent: agent => {
@@ -368,9 +409,133 @@ let AgentTeam = (() => {
                 },
                 log: message => { this.ctx.logger.warn(`agent-team: ${message}`); },
             });
+            // Human profile: this Host row's own Config (name + avatarRef, both
+            // volatile), so the settings service derives its form from the schema and
+            // an edit lands in the running plugin without a remount. Team's own page
+            // owns that surface, so the row declares itself presentation-owned rather
+            // than schema-page owned. Reads go straight to the live Config reference;
+            // this subscription is the change signal the retired section hook used to
+            // be — the ledger's runtime @ handle follows every edit.
+            this.ctx.inject(['settings'], settingsCtx => {
+                settingsCtx.effect(() => settingsCtx.settings.configure({ auto: false }, this.ctx.fiber));
+                this.adoptLegacyHumanProfile();
+            });
+            this.ctx.on('loader/volatile-update', () => { this.syncHumanHandle(); });
+        }
+        /** Current human display name; the single source for team_view and @ matching. */
+        humanHandle() {
+            const name = normalizeHumanName(this.config.name.get());
+            return name === '' ? HUMAN_PROFILE_DEFAULT_NAME : name;
+        }
+        /** Current human profile reference held in this Host row's Config (name + avatarRef). */
+        humanProfile() {
+            const avatarRef = this.config.avatarRef.get();
+            return Object.freeze({ name: this.humanHandle(), ...(avatarRef === undefined ? {} : { avatarRef }) });
+        }
+        /** Push the current Config name into the ledger's runtime @ handle. */
+        syncHumanHandle() {
+            try {
+                this.ledger?.setHumanDisplayHandle(this.humanHandle());
+            }
+            catch {
+                // The ledger is absent before Service.init; the post-open sync covers it.
+            }
+        }
+        /**
+         * The two judgements the Config schema cannot make about a Human name: the
+         * same non-empty floor as Member handles, plus global uniqueness against live
+         * Members. `setHumanProfile` runs it before the write, so a colliding rename
+         * rejects instead of persisting.
+         */
+        validateHumanProfile(value) {
+            const name = assertValidHumanName(value.name);
+            const ledger = this.ledger;
+            if (ledger === undefined)
+                return;
+            const normalized = name.normalize('NFKC').trim().toLowerCase();
+            for (const member of ledger.listMembers()) {
+                if (member.state === 'inactive' || member.state === 'archived')
+                    continue;
+                if (member.handle.normalize('NFKC').trim().toLowerCase() === normalized) {
+                    throw new Error(`human name '${name}' collides with an existing Member handle`);
+                }
+            }
+        }
+        /**
+         * One-time adoption of the profile facts the retired `agent-team-human`
+         * settings section held (see `LEGACY_HUMAN_PROFILE_SECTION` for why the
+         * upstream importer cannot carry them over). The values land in this Host
+         * row's own Config through the same Remote the profile page writes, so the
+         * page, the ledger's @ handle, and every avatar seat follow as after any
+         * edit. Readiness has two one-way edges — the settings service arrives, the
+         * ledger opens — and whichever fires second starts the attempt; only a
+         * pristine profile is adopted, and one attempt per boot is its whole
+         * lifetime, so adoption never loops and never re-writes.
+         */
+        adoptLegacyHumanProfile() {
+            if (this.legacyAdoptionStarted)
+                return;
+            if (this.ctx.get('settings') === undefined || this.ledger === undefined)
+                return;
+            this.legacyAdoptionStarted = true;
+            void this.adoptLegacyHumanProfileNow().catch((error) => {
+                this.ctx.logger.warn('agent-team: legacy human profile adoption failed: %s', String(error));
+            });
+        }
+        /** Carry the first legacy document that still has the section into a pristine profile. */
+        async adoptLegacyHumanProfileNow() {
+            // A profile-launched Host always carries the profile context; a Host booted
+            // without one still adopts from the DSH home, which is where a pre-rc.1
+            // install kept the document. Read through `get`: cordis refuses a direct
+            // `ctx.profileContext` for a service this plugin does not declare, and
+            // adoption may not gate the Host on app-boot.
+            const profileHome = this.ctx.get('profileContext')?.home;
+            const homes = profileHome === undefined ? [dshHomePath()] : [dshHomePath(), profileHome];
+            const candidates = new Set(homes.flatMap(home => [join(home, 'settings.yaml'), join(home, 'settings.yaml.imported')]));
+            let legacy;
+            let source;
+            for (const candidate of candidates) {
+                let text;
+                try {
+                    text = readFileSync(candidate, 'utf8');
+                }
+                catch {
+                    // Absent candidates are the steady state once adoption settles; the
+                    // live document is one only because the first boot after the upgrade
+                    // can race the importer that renames it.
+                    continue;
+                }
+                const parsed = parseLegacyHumanProfile(text);
+                if (parsed !== undefined) {
+                    legacy = parsed;
+                    source = candidate;
+                    break;
+                }
+            }
+            if (legacy === undefined || source === undefined)
+                return;
+            // The reference is carried only while its bytes still draw: the avatar
+            // store is the authority for whether this avatar exists at all.
+            let avatarRef = legacy.avatarRef;
+            if (avatarRef !== undefined && await readHumanAvatar(humanAvatarsRoot(), avatarRef) === undefined)
+                avatarRef = undefined;
+            const plan = planLegacyAdoption(this.humanProfile(), {
+                ...(legacy.name === undefined ? {} : { name: legacy.name }),
+                ...(avatarRef === undefined ? {} : { avatarRef }),
+            });
+            if (plan === undefined)
+                return;
+            await this.setHumanProfile(plan);
+            this.ctx.logger.info('agent-team: adopted the legacy human profile from %s', source);
         }
         /** Open the durable ledger and restore every enabled Member independently. */
         async [Service.init]() {
+            // The continuity projection registers once per Host: the framework keeps
+            // one unit per projection key and drives it for every Session, so Team's
+            // fold is session-agnostic and the state carries the identity it folds.
+            // The registration rides this plugin's fiber — unloading Team removes the
+            // key (and its cached cells) from later drives and snapshots.
+            this.ctx.effect(() => this.ctx.root.sessionProjections.register(createTeamContextProjectionDefinition(this.contextProjectionHost)), 'agentTeam.contextProjection');
             this.ctx.on('agent/error', ({ agent, error }) => {
                 const member = this.memberForAgent(agent);
                 if (member === undefined)
@@ -456,6 +621,11 @@ let AgentTeam = (() => {
             this.domain = domain;
             const ledger = new AgentTeamLedger(domain.table('operations'));
             this.ledger = ledger;
+            // A live Config edit in the constructor's window may have arrived before
+            // the ledger existed; sync once here so @ matching starts from the stored
+            // name.
+            this.syncHumanHandle();
+            this.adoptLegacyHumanProfile();
             const initialization = await ledger.initialize();
             if (initialization.committed)
                 this.emitCommitted(initialization.value);
@@ -531,6 +701,18 @@ let AgentTeam = (() => {
             });
             return Object.freeze({ resolved: Object.freeze(this.requireLedger().resolveTaskRefs(request.workspaceId, taskRefs)) });
         }
+        /** Read-only navigation lookup for branded Thread refs found in message bodies. */
+        resolveThreadRefs(request) {
+            this.requireWorkspace(request.workspaceId);
+            const seen = new Set();
+            const threadRefs = request.threadRefs.filter(threadRef => {
+                if (seen.has(threadRef))
+                    return false;
+                seen.add(threadRef);
+                return true;
+            });
+            return Object.freeze({ resolved: Object.freeze(this.requireLedger().resolveThreadRefs(request.workspaceId, threadRefs)) });
+        }
         /** Browser-safe Human roster, optionally filtered to one participation. */
         membersForClient(request) {
             if (request.workspaceId !== undefined)
@@ -634,13 +816,16 @@ let AgentTeam = (() => {
                     privateMemoryPath: dshHomePath('agent-team', 'members', memberMemoryDirectoryName(memberId)),
                     state: 'enabled',
                 });
-                const result = await this.requireLedger().addMember({ ...request, actor: agentTeamHumanActor(), member });
+                const ledger = this.requireLedger();
+                const result = await ledger.addMember({ ...request, actor: agentTeamHumanActor(), member });
                 if (result.committed)
                     this.emitCommitted(result.value.receipt);
                 const stored = result.value.member;
                 if (!this.handles.has(stored.memberId))
                     await this.activateMember(stored, workspace.path);
-                return Object.freeze({ receipt: result.value.receipt, status: this.memberStatus(stored) });
+                // Creation seeds exactly the creation Workspace participation; attach it
+                // here (like membersForClient) so the Client never synthesizes it.
+                return Object.freeze({ receipt: result.value.receipt, status: this.memberStatus(stored), workspaceIds: ledger.workspacesOf(stored.memberId) });
             });
         }
         /** Commit suspended intent, then wait for the owned AgentHandle to become quiescent. */
@@ -820,6 +1005,9 @@ let AgentTeam = (() => {
                     throw new Error(`the context rollover is refused: this Member now owns jobs that would not survive the switch (${blockingJobs.join(', ')}); collect or stop them, then retry`);
                 }
                 const rolled = await this.rolloverSessionForAgent(active.agent, {
+                    // The engine plan carries the host-derived request id as a plain
+                    // string; Team's rollover operation vocabulary brands it, and the
+                    // context-continuity host adapter is its only producer.
                     requestId: plan.requestId,
                     workspaceId: stored.workspaceId,
                     memberId,
@@ -836,8 +1024,9 @@ let AgentTeam = (() => {
                 // to override the fold.
                 const preRetireCapture = this.contextManagement.drainCapturedInput(memberId);
                 await this.retireMemberGeneration(memberId, active, plan.previousSessionId);
-                const finalState = foldContextProjection(active.agent.session.ownEvents(), active.agent.session.inheritedEventCount, active.agent.session.id);
-                const foldedCarried = carriedInputOf(finalState);
+                const finalEvents = active.agent.session.ownEvents();
+                const finalState = foldTeamContextProjection(finalEvents, { sessionId: active.agent.session.id, inheritedEventCount: active.agent.session.inheritedEventCount }, this.contextProjectionHost);
+                const foldedCarried = carriedInputOf(finalState, finalEvents);
                 const carriedById = new Map(plan.carriedInput.map(message => [message.id, message]));
                 for (const message of foldedCarried)
                     carriedById.set(message.id, message);
@@ -1119,6 +1308,91 @@ let AgentTeam = (() => {
                 throw new Error(`attachment '${request.attachmentId}' is no longer cached`);
             return Object.freeze({ name: stored.name, mediaType: stored.mediaType, byteSize: stored.byteSize, bytesBase64: stored.bytes.toString('base64') });
         }
+        /**
+         * Human profile read for the settings page and footnote: name + avatar
+         * reference from this Host row's live Config plus version facts. Human-scoped
+         * (the Web Client calls it); agent tools never receive avatar bytes, only the
+         * name through team_view. The new-release check stays best-effort and cached —
+         * `updateAvailable` is false until a background refresh actually observes a
+         * newer published release.
+         */
+        humanProfileForClient(_request) {
+            const profile = this.humanProfile();
+            const update = this.humanUpdateCheck.snapshot();
+            return Object.freeze({
+                name: profile.name,
+                ...(profile.avatarRef === undefined ? {} : { avatarRef: profile.avatarRef }),
+                version: HUMAN_PROFILE_VERSION,
+                repoUrl: HUMAN_PROFILE_REPO_URL,
+                updateAvailable: update.updateAvailable,
+                ...(update.latestVersion === undefined ? {} : { latestVersion: update.latestVersion }),
+            });
+        }
+        /**
+         * Upload one human avatar image into the persistent store. Human-only by
+         * construction: only the Web Client calls this Remote, never agent tools.
+         * The caller stores the returned ref in settings; bytes never enter the
+         * TTL-bound attachment cache.
+         */
+        async putHumanAvatar(request) {
+            this.requireAccepting();
+            const bytes = Buffer.from(request.bytesBase64, 'base64');
+            return Object.freeze(await writeHumanAvatar(humanAvatarsRoot(), request.name, request.mediaType ?? 'application/octet-stream', bytes));
+        }
+        /** Read one human avatar back; removed entries throw and the UI falls back to hue/initial. */
+        async getHumanAvatar(request) {
+            const stored = await readHumanAvatar(humanAvatarsRoot(), request.avatarRef);
+            if (stored === undefined)
+                throw new Error(`human avatar '${request.avatarRef}' is no longer stored`);
+            return Object.freeze({ name: stored.name, mediaType: stored.mediaType, byteSize: stored.byteSize, bytesBase64: stored.bytes.toString('base64') });
+        }
+        /** Remove one human avatar entry; the UI falls back to hue/initial afterwards. */
+        async removeHumanAvatar(request) {
+            this.requireAccepting();
+            await removeHumanAvatar(humanAvatarsRoot(), request.avatarRef);
+            return Object.freeze({ removed: true });
+        }
+        /**
+         * Overwrite the Human profile fields the caller supplies. The Host owns this
+         * write because the profile is the Host row's own Config: the schema supplies
+         * the shape, this method supplies the two judgements the schema cannot make
+         * (a non-empty name, a name no live Member already answers to), and the
+         * settings service persists the result into the active profile's patch
+         * document and applies it to the running plugin live.
+         *
+         * No expected revision accompanies the write: the profile is two scalar
+         * fields written from the Human's own pages, where the last write wins. This
+         * is not a hard boundary around a user-editable document — the settings
+         * service's own document opener (and a text editor) can change the stored
+         * name without passing here, exactly as the retired section validator could
+         * not stop it.
+         */
+        async setHumanProfile(request) {
+            this.requireAccepting();
+            const settings = this.ctx.get('settings');
+            if (settings === undefined)
+                throw new Error('the settings service is unavailable');
+            const name = request.name === undefined ? undefined : assertValidHumanName(request.name);
+            if (name !== undefined)
+                this.validateHumanProfile({ name });
+            const ops = [];
+            if (name !== undefined)
+                ops.push({ op: 'set', path: ['name'], value: name });
+            if (request.avatarRef === null)
+                ops.push({ op: 'unset', path: ['avatarRef'] });
+            else if (request.avatarRef !== undefined)
+                ops.push({ op: 'set', path: ['avatarRef'], value: request.avatarRef });
+            if (ops.length !== 0) {
+                // The settings namespace IS this Host row's id in the composition, and it
+                // must be addressed by that name rather than by `ctx.fiber.entry` here: a
+                // Remote call runs under its caller's context, whose fiber entry is the
+                // RPC gateway's row (`typert-gateway`), which the settings service then
+                // looks up as an unrelated plugin. shipping.spec.ts pins the constant to
+                // the row `cordis.patch.yml` declares.
+                await settings.mutate(HUMAN_PROFILE_SETTINGS_NAMESPACE, ops);
+            }
+            return Object.freeze({ ...this.humanProfile() });
+        }
         /** Human existing-Thread reply; unread and revision conflicts are business outcomes. */
         async reply(request) {
             return this.replyAs(this.humanCall(request.workspaceId), request);
@@ -1429,7 +1703,7 @@ let AgentTeam = (() => {
             let sessionId = agent.session.id;
             let live = true;
             let guard = 0;
-            while (sessionId !== undefined && guard++ < MAX_TIMELINE_ANCESTORS) {
+            while (sessionId !== undefined && guard++ <= MAX_TIMELINE_ANCESTORS) {
                 let events;
                 let inheritedEventCount;
                 let parentSession;
@@ -1454,19 +1728,19 @@ let AgentTeam = (() => {
                 // Fold the source with its inherited cut respected: inherited events
                 // are resolved history in that source, never fresh intent; checkpoints
                 // recorded in this source's own span are the selectable targets.
-                const state = foldContextProjection(events, inheritedEventCount, sessionId);
+                const state = foldTeamContextProjection(events, { sessionId, inheritedEventCount }, this.contextProjectionHost);
                 // A Team-boundary default checkpoint: the boundary's completed-turn
                 // anchor is the seed cut, and it is selectable exactly when one
                 // Thread's facts entered the context through it — the same proof the
                 // timeline requires, revalidated here because the model may cite a
                 // boundary the timeline never surfaced.
                 const boundary = checkpointRef.startsWith('team-boundary-')
-                    ? state.boundaries.find(entry => entry.key === checkpointRef)
+                    ? boundaryByRef(state, checkpointRef)
                     : undefined;
                 const entry = checkpointByRef(state, checkpointRef);
                 const anchorTurnEndSeq = boundary !== undefined ? boundary.turnEndSeq : entry?.turnEndSeq;
                 if (anchorTurnEndSeq !== undefined && anchorTurnEndSeq !== -1) {
-                    if (boundary !== undefined && boundary.source !== 'team-boundary') {
+                    if (boundary !== undefined && boundary.kind !== 'team-boundary') {
                         throw new Error(`checkpoint '${checkpointRef}' is not a restorable boundary`);
                     }
                     // The seed is the exact contiguous prefix through the anchor's
@@ -1474,7 +1748,12 @@ let AgentTeam = (() => {
                     const throughSeq = anchorTurnEndSeq + 1;
                     const prefix = events.slice(0, throughSeq);
                     if (boundary !== undefined) {
-                        const threads = this.threadsEnteringContext(events, anchorTurnEndSeq);
+                        // The seed must stay inside one Thread's context: the retained
+                        // prefix through the anchor holds exactly one Thread's facts, read
+                        // from the fold's own boundary attributions — the same accumulated
+                        // set the timeline shows, so a ref the timeline offered is never
+                        // refused here for a reason it did not state.
+                        const threads = retainedTopicsThrough(state, anchorTurnEndSeq);
                         if (threads.length !== 1) {
                             throw new Error(threads.length === 0
                                 ? `boundary '${checkpointRef}' has no single attributable Thread; write a fresh handoff instead`
@@ -1535,11 +1814,11 @@ let AgentTeam = (() => {
                 return;
             }
             const inspection = previousRead.inspection;
-            const state = foldContextProjection(inspection.events, inspection.inheritedEventCount, previousSessionId);
+            const state = foldTeamContextProjection(inspection.events, { sessionId: previousSessionId, inheritedEventCount: inspection.inheritedEventCount }, this.contextProjectionHost);
             if (state.pending === null)
                 return;
             const pending = state.pending;
-            const message = createHandoffMessage({
+            const message = TEAM_CONTEXT_CODEC.createHandoffMessage({
                 handoff: pending.handoff,
                 previousSessionId,
                 newSessionId: agent.session.id,
@@ -1573,9 +1852,9 @@ let AgentTeam = (() => {
             if (!Number.isSafeInteger(through) || through < 0 || through > inspection.events.length) {
                 throw new Error(`the recorded checkpoint-return seed cut ${through} is not a valid prefix of Session '${seed.sourceSessionId}'`);
             }
-            const state = foldContextProjection(inspection.events, inspection.inheritedEventCount, seed.sourceSessionId);
+            const state = foldTeamContextProjection(inspection.events, { sessionId: seed.sourceSessionId, inheritedEventCount: inspection.inheritedEventCount }, this.contextProjectionHost);
             const anchorProven = checkpointByRef(state, seed.checkpointRef) !== undefined
-                || state.boundaries.some(boundary => boundary.key === seed.checkpointRef);
+                || boundaryByRef(state, seed.checkpointRef) !== undefined;
             if (!anchorProven) {
                 throw new Error(`the recorded checkpoint-return anchor '${seed.checkpointRef}' no longer resolves in Session '${seed.sourceSessionId}'`);
             }
@@ -1641,8 +1920,8 @@ let AgentTeam = (() => {
             }
             inspectionEvents = previousRead.inspection.events;
             inspectionInherited = previousRead.inspection.inheritedEventCount;
-            const state = foldContextProjection(inspectionEvents, inspectionInherited, transition.previousSessionId);
-            const carried = carriedInputOf(state);
+            const state = foldTeamContextProjection(inspectionEvents, { sessionId: transition.previousSessionId, inheritedEventCount: inspectionInherited }, this.contextProjectionHost);
+            const carried = carriedInputOf(state, inspectionEvents);
             if (carried.length === 0)
                 return 0;
             const known = new Set();
@@ -1693,9 +1972,11 @@ let AgentTeam = (() => {
          * Agent-only bounded structural timeline: resolved checkpoints plus Team
          * delivery, handoff, and compaction boundaries across the current
          * generation and its archived ancestor lineage. Structural only — no
-         * transcript content. The meter prices retained/discarded tokens; entries
-         * the Host cannot prove restorable carry a rejection reason instead of
-         * silently disappearing.
+         * transcript content. The walk, the per-source folds, the pricing, and the
+         * anchor rules are the engine's `readContextTimeline`; Team contributes the
+         * fold configuration, the measurement, and the one judgement the engine
+         * leaves to its host — which Threads a boundary's retained prefix holds — so
+         * a ref this list offers is a ref `context_rollover` accepts.
          */
         async contextTimelineForAgent(agent, request) {
             const member = this.memberForAgent(agent);
@@ -1710,70 +1991,111 @@ let AgentTeam = (() => {
             const limits = await this.routeLimitsForAgent(agent);
             const hardLimit = limits?.hardLimit ?? CONTEXT_HARD_LIMIT_CAP;
             const handoffAt = limits?.handoffAt ?? CONTEXT_HANDOFF_AT_CAP;
-            // Fold the current generation, then walk archived ancestors through their
-            // persisted logs; the same projection definition folds every source.
-            const items = [];
-            const seen = new Set();
-            let incompleteFrom;
-            let sessionId = member.sessionId;
-            let live = true;
-            let guard = 0;
-            while (sessionId !== undefined && guard++ < MAX_TIMELINE_ANCESTORS) {
-                let state;
-                let sourceSessionId = sessionId;
-                let sourceEvents = [];
-                // Capture this iteration's source identity BEFORE the branch advances
-                // the lineage flag: measurement and discard pricing both key on it.
-                const sourceIsCurrent = live;
-                if (live) {
-                    state = foldContextProjection(agent.session.ownEvents(), agent.session.inheritedEventCount, agent.session.id);
-                    sourceEvents = agent.session.snapshotEvents();
-                    sessionId = agent.session.header.parentSession;
-                    live = false;
+            // One measurement per lineage source, memoized by Session: the engine
+            // measures a source once before pricing its anchors, and the boundary
+            // overlay below reads the same map to tell an unprovable budget (never
+            // priced as free) from a real budget rejection.
+            const measurements = new Map();
+            const timeline = await readContextTimeline({
+                current: {
+                    sessionId: agent.session.id,
+                    header: agent.session.header,
+                    inheritedEventCount: agent.session.inheritedEventCount,
+                    events: agent.session.snapshotEvents(),
+                },
+                config: this.contextFoldConfig(),
+                readAncestor: sessionId => this.sessionReader.read(sessionId),
+                measureSource: source => {
+                    const key = String(source.sessionId);
+                    if (!measurements.has(key))
+                        measurements.set(key, this.measureContextSourceForAgent(agent, source));
+                    return measurements.get(key);
+                },
+                currentUsageTokens: usageTokens,
+                handoffAt,
+                limit,
+                // Archived ancestors the engine walks; the seed guard resolves a cited
+                // ref through the same depth, so the timeline never offers a ref the
+                // guard cannot reach.
+                maxAncestors: MAX_TIMELINE_ANCESTORS,
+            });
+            return {
+                usageTokens,
+                hardLimit,
+                handoffAt,
+                items: timeline.items.map(item => this.teamTimelineItemFor(item, agent.session.id, handoffAt, measurements)),
+                ...(timeline.incompleteFrom === undefined ? {} : { incompleteFrom: timeline.incompleteFrom }),
+            };
+        }
+        /**
+         * Map one engine timeline item onto the model-facing Team item. The engine
+         * decided the walk, the fold, the pricing, and the head, checkpoint, and
+         * measurable-source verdicts; Team restates exactly one policy of its own: a
+         * Team boundary is selectable only when the RETAINED PREFIX through it stays
+         * inside one Thread — the same proof the seed guard revalidates before it
+         * swaps a generation. The engine judges a boundary by its OWN attribution
+         * instead, so a boundary that arrived after a second Thread's facts would be
+         * offered here and refused by `context_rollover`; Team's stricter rule is
+         * what keeps the two surfaces answering one question.
+         */
+        teamTimelineItemFor(item, currentSessionId, handoffAt, measurements) {
+            const source = item.source === 'boundary'
+                ? item.kind === 'handoff' || item.kind === 'compaction' ? item.kind : 'team-boundary'
+                : item.source === 'checkpoint' ? 'agent' : 'head';
+            const affectedThreads = item.affectedTopics;
+            let restorable = item.restorable;
+            let reason = item.reason;
+            // A boundary's verdict is Team's to make, but only once its source is
+            // measurable: "the budget cannot be proven" is the engine's first
+            // rejection and stays first — an unmeasurable boundary is not selectable
+            // even when its prefix holds exactly one Thread.
+            if (item.source === 'boundary' && measurements.get(String(item.sourceSessionId ?? currentSessionId)) !== undefined) {
+                if (source === 'handoff' || source === 'compaction') {
+                    // A handoff opens a generation and a compaction rewrites the visible
+                    // surface: rewinding into either is not a proven-safe target. The
+                    // engine has no vocabulary for that and would answer "no single topic
+                    // is attributable", which misdescribes why.
+                    restorable = false;
+                    reason = `source '${source}' is not a restorable checkpoint`;
                 }
-                else {
-                    const read = await this.sessionReader.read(sessionId);
-                    if (!read.ok) {
-                        // An unreadable ancestor ends the lineage walk here — recorded in
-                        // the result, never silent, and never a Member-availability fact.
-                        incompleteFrom = { sessionId, reason: `${read.failure.kind}: ${read.failure.detail}` };
-                        sessionId = undefined;
-                    }
-                    else {
-                        state = foldContextProjection(read.inspection.events, read.inspection.inheritedEventCount, sessionId);
-                        sourceEvents = read.inspection.events;
-                        sourceSessionId = sessionId;
-                        sessionId = read.inspection.header.parentSession;
-                    }
+                else if (affectedThreads.length !== 1) {
+                    restorable = false;
+                    reason = affectedThreads.length === 0
+                        ? 'no single Thread is attributable to this boundary'
+                        : 'multiple Threads entered the context through this boundary; write a fresh handoff instead';
                 }
-                if (state === undefined)
-                    break;
-                // Price every candidate of this source against the SOURCE's own
-                // replayed measurement — a small current generation never shrinks a
-                // large ancestor's real seed cost. An unmeasurable source (no meter,
-                // unreadable ancestor) prices as UNKNOWN, never as zero: the timeline
-                // marks its candidates unprovable and the return guard rejects them.
-                const sourceUsage = await this.sourceUsageTokens(sourceSessionId, sourceIsCurrent, agent);
-                for (const candidate of timelineCandidates(state, limit)) {
-                    if (seen.has(candidate.ref))
-                        continue;
-                    seen.add(candidate.ref);
-                    items.push(this.timelineItemFor(candidate, sourceUsage, usageTokens, hardLimit, handoffAt, sourceSessionId, sourceIsCurrent, sourceEvents));
-                    if (items.length >= limit)
-                        break;
+                else if (item.retainedTokens >= handoffAt) {
+                    restorable = false;
+                    reason = 'retained context would not materially shrink the working set';
+                }
+                else {
+                    restorable = true;
+                    reason = undefined;
                 }
-                if (items.length >= limit)
-                    break;
             }
-            return { usageTokens, hardLimit, handoffAt, items, ...(incompleteFrom === undefined ? {} : { incompleteFrom }) };
+            return {
+                checkpointRef: item.ref,
+                name: item.label,
+                source,
+                retainedTokens: item.retainedTokens,
+                discardedTokens: item.discardedTokens,
+                affectedThreads,
+                restorable,
+                ...(reason === undefined ? {} : { reason }),
+                // Team's field semantics, unchanged: every item that is not a
+                // checkpoint names the Session it anchors in — an ancestor generation's
+                // boundary is how a lineage reads — and a checkpoint is keyed to its own
+                // Session by its ref already.
+                ...(source === 'agent' ? {} : { sourceSessionId: item.sourceSessionId ?? currentSessionId }),
+            };
         }
         /**
          * Replayed measurement of one lineage source: the live current Session
-         * measures directly; an archived ancestor measures through a borrowed
-         * prepared Session, so a seed's retained cost is priced in the SOURCE's
-         * own tokens — never the current generation's. Returns undefined when no
-         * meter is available or the source cannot be borrowed; callers fail
-         * closed on the unknown.
+         * measures directly; an archived ancestor measures through a detached
+         * Session rebuilt from the source's own log, so a seed's retained cost is
+         * priced in the SOURCE's own tokens — never the current generation's.
+         * Returns undefined when no meter is available or the source cannot be
+         * replayed; callers fail closed on the unknown.
          */
         async sourceUsageTokens(sessionId, live, agent) {
             const meter = agent.ctx.get('tokenMeter');
@@ -1788,14 +2110,50 @@ let AgentTeam = (() => {
             const read = await this.sessionReader.read(sessionId);
             if (!read.ok)
                 return undefined;
+            return this.measureDetachedSource(agent, {
+                sessionId,
+                header: read.inspection.header,
+                inheritedEventCount: read.inspection.inheritedEventCount,
+                events: read.inspection.events,
+            });
+        }
+        /**
+         * One already-read source's replayed measurement: an archived generation is
+         * rebuilt as a detached Session and measured in its own tokens. Undefined
+         * means unmeasurable, never free.
+         */
+        measureDetachedSource(agent, source) {
+            const meter = agent.ctx.get('tokenMeter');
+            if (meter === undefined)
+                return undefined;
             try {
-                const session = Session.create(sessionId, read.inspection.events, read.inspection.header, read.inspection.inheritedEventCount);
+                const session = Session.create(source.sessionId, source.events, source.header, source.inheritedEventCount);
                 return meter.measure(session)?.totalTokens;
             }
             catch {
                 return undefined;
             }
         }
+        /**
+         * One source's replayed measurement, in that source's own tokens, for a
+         * caller that already holds the source: the live generation measures
+         * directly, an archived one is rebuilt from the log it came with. Undefined
+         * means unmeasurable — a caller must never price an unknown source as free.
+         */
+        measureContextSourceForAgent(agent, source) {
+            if (String(source.sessionId) === String(agent.session.id)) {
+                return agent.ctx.get('tokenMeter')?.measure(agent.session)?.totalTokens;
+            }
+            return this.measureDetachedSource(agent, source);
+        }
+        /**
+         * The one fold configuration the registered projection unit and every cold
+         * fold use, so a generation read back for the timeline reads exactly as the
+         * projection folded it — same codec, same boundary attribution.
+         */
+        contextFoldConfig() {
+            return createTeamContextProjectionConfig(this.contextProjectionHost);
+        }
         /**
          * Monotonic anchor-share estimate of a seed's retained cost, priced in the
          * SOURCE Session's own measurement: the fraction of the source log the
@@ -1811,155 +2169,6 @@ let AgentTeam = (() => {
             const share = Math.min(1, Math.max(0, (anchorTurnEndSeq + 1) / sourceLength));
             return Math.round(sourceUsageTokens * share);
         }
-        /**
-         * Threads whose facts entered this Session's model context by the given
-         * seq: delivered Team notices (their bodies quote `Thread: <ref>`
-         * structurally) and successful Team-claim mutations (their task overlays
-         * resolve to Threads through the ledger). Never from unread ledger
-         * activity — a Thread the Member never saw did not enter its context.
-         * Order-stable, deduplicated.
-         */
-        threadsEnteringContext(events, throughSeq) {
-            const refs = [];
-            const openAttributions = new Map();
-            const push = (ref) => {
-                if (ref !== undefined && !refs.includes(ref))
-                    refs.push(ref);
-            };
-            for (const event of events) {
-                if (event.seq > throughSeq)
-                    break;
-                if (event.type === 'tool/call' && (event.data.name === 'team_claim' || event.data.name === 'team_message')) {
-                    openAttributions.set(event.data.callId, { name: event.data.name, arguments: event.data.arguments });
-                }
-                else if (event.type === 'tool/result') {
-                    const result = event.data.message;
-                    if (result.isError !== true) {
-                        const recorded = openAttributions.get(result.toolCallId);
-                        if (recorded !== undefined) {
-                            openAttributions.delete(result.toolCallId);
-                            try {
-                                const args = JSON.parse(recorded.arguments);
-                                // A claim mutation resolves its Task overlay through the ledger;
-                                // a team_message committed reply names its Thread in its call
-                                // arguments; a committed start's Thread is born in the result
-                                // and is read from the durable presentation meta.
-                                if (recorded.name === 'team_claim' && typeof args.taskRef === 'string' && args.taskRef !== '') {
-                                    push(this.requireLedger().threadForTask(args.taskRef));
-                                }
-                                else if (recorded.name === 'team_message') {
-                                    const meta = event.data.meta;
-                                    if (meta !== undefined && typeof meta === 'object' && meta.kind === 'committed') {
-                                        const metaThreadRef = meta.threadRef;
-                                        if (typeof metaThreadRef === 'string' && metaThreadRef !== '')
-                                            push(metaThreadRef);
-                                    }
-                                    else if (typeof args.threadRef === 'string' && args.threadRef !== '') {
-                                        push(args.threadRef);
-                                    }
-                                }
-                            }
-                            catch {
-                                // Malformed call arguments contribute no attribution.
-                            }
-                        }
-                    }
-                }
-                else if (event.type === 'user/message') {
-                    const source = event.data.source;
-                    // Only this plugin's own delivered notices attribute Threads, by exact
-                    // kind identity — the shape written now and the read-time conversion's
-                    // rename of the released V3 history. A `plugin:` prefix test would
-                    // claim third-party producers' rows as Team facts.
-                    if (source === undefined || !isAgentTeamSourceKind(source.kind))
-                        continue;
-                    // Reminder notices never enter attribution — a recovery instruction
-                    // (or a historical progress-nudge notice, kept decodable in session
-                    // logs recorded before that system was removed) is not a Team fact.
-                    if (source.form === 'notice' && source.summary !== undefined && isReminderNoticeSummary(source.summary))
-                        continue;
-                    const text = event.data.content.filter(block => block.type === 'text').map(block => block.text ?? '').join('\n');
-                    for (const match of text.matchAll(/Thread: (thread:[0-9a-f-]{6,})/g)) {
-                        push(match[1]);
-                    }
-                }
-            }
-            return refs;
-        }
-        /**
-         * Price and annotate one timeline candidate without mutating anything.
-         * Retained prices in the SOURCE Session's own replayed measurement (the
-         * monotonic anchor-share of the source log); discarded is what a return
-         * replaces — for a current-generation anchor, the measured usage beyond
-         * the anchor; for an ancestor anchor, the current generation's whole
-         * usage (an approximation: the ancestor's own suffix is not part of this
-         * generation). A small current child therefore discards little but may
-         * still retain a large ancestor seed, and both numbers say so honestly.
-         */
-        timelineItemFor(candidate, sourceUsage, currentUsage, _hardLimit, handoffAt, sourceSessionId, sourceIsCurrent, sourceEvents) {
-            const retainedTokens = candidate.source === 'head'
-                ? currentUsage
-                : this.retainedEstimate(sourceUsage ?? 0, sourceEvents.length, candidate.turnEndSeq);
-            const discardedTokens = candidate.source === 'head'
-                ? 0
-                : sourceIsCurrent
-                    ? Math.max(0, currentUsage - retainedTokens)
-                    : currentUsage;
-            const affectedThreads = candidate.turnEndSeq === -1 ? [] : this.threadsEnteringContext(sourceEvents, candidate.turnEndSeq);
-            let restorable = candidate.turnEndSeq !== -1;
-            let reason;
-            if (candidate.source === 'head') {
-                // The head is the current working set: returning to it discards
-                // nothing and is never a meaningful return target.
-                restorable = false;
-                reason = 'the head is the current working set; returning to it discards nothing';
-            }
-            else if (sourceUsage === undefined) {
-                // The source's cost cannot be measured (no meter, or the archived
-                // ancestor cannot be borrowed): the budget cannot be proven, so the
-                // candidate is not selectable. Never price an unknown as zero.
-                restorable = false;
-                reason = 'the source Session\'s context cost cannot be measured, so the return budget cannot be proven';
-            }
-            else if (candidate.source === 'handoff' || candidate.source === 'compaction') {
-                // A handoff starts a generation and a compaction rewrites the visible
-                // surface: rewinding into them is not a proven-safe V1 target.
-                restorable = false;
-                reason = `source '${candidate.source}' is not a restorable checkpoint`;
-            }
-            else if (candidate.source === 'team-boundary') {
-                // A Team delivery is a selectable default checkpoint exactly when the
-                // Host can prove it stays inside one Thread's context: the boundary
-                // resolved at a completed turn AND exactly one Thread's facts entered
-                // the Session context through it. Multi-Thread or unattributable
-                // boundaries document why they are not selectable.
-                if (affectedThreads.length !== 1) {
-                    restorable = false;
-                    reason = affectedThreads.length === 0
-                        ? 'no single Thread is attributable to this boundary'
-                        : 'multiple Threads entered the context through this boundary; write a fresh handoff instead';
-                }
-                else if (retainedTokens >= handoffAt) {
-                    restorable = false;
-                    reason = 'retained context would not materially shrink the working set';
-                }
-            }
-            else if (candidate.source === 'agent' && retainedTokens >= handoffAt) {
-                restorable = false;
-                reason = 'retained context would be at or above the handoff budget';
-            }
-            return {
-                checkpointRef: candidate.ref,
-                name: candidate.label,
-                source: candidate.source,
-                retainedTokens,
-                discardedTokens,
-                affectedThreads,
-                restorable,
-                ...(reason === undefined ? {} : { reason }),
-                ...(candidate.source === 'agent' ? {} : { sourceSessionId }),
-            };
-        }
         /**
          * Agent-only rollover request validation: the tool calls this to check its
          * Member binding, exclusivity, and checkpoint ownership. It performs no
@@ -2284,7 +2493,8 @@ let AgentTeam = (() => {
                 // old Session; the projection still carries the intent, so finish the
                 // transition (or keep waiting for the containing turn) from here.
                 if (persisted) {
-                    const state = foldContextProjection(created.agent.session.ownEvents(), created.agent.session.inheritedEventCount, created.agent.session.id);
+                    const inheritedEventCount = created.agent.session.inheritedEventCount;
+                    const state = foldTeamContextProjection(created.agent.session.ownEvents(), { sessionId: created.agent.session.id, inheritedEventCount }, this.contextProjectionHost);
                     if (state.pending !== null)
                         this.contextManagement.recoverPendingTransition(member.memberId, created.agent, member.sessionId);
                     // A restart between one checkpoint's durable result and its quiet
@@ -2299,7 +2509,7 @@ let AgentTeam = (() => {
                     // by the projection boundary alone: every handoff this Host ever
                     // published classifies under the context source's recognizer,
                     // including the history the read-time conversion renamed.
-                    if (!state.boundaries.some(boundary => boundary.source === 'handoff')) {
+                    if (!state.boundaries.some(boundary => boundary.kind === 'handoff')) {
                         await this.reconstructMissingHandoff(member, created.agent);
                     }
                     // Carried input redelivery binds to the committed transition target —