codemem 0.47.0-beta.3 → 0.47.0-beta.4

package/dist/index.js

@@ -1,5 +1,5 @@
 #!/usr/bin/env node
-import { ACCOUNT_CONNECTION_MIGRATION_STATEMENTS, ACCOUNT_UNLINK_MIGRATION_STATEMENTS, AUTH_LINK_AUTHORITY_CUTOVER_SQL, ContextOnlyReplayError, CoordinatorAccountLinkError, DEDUP_KEY_BACKFILL_JOB, DEFAULT_COORDINATOR_DB_PATH, DedupKeyBackfillRunner, DeviceIdentityError, EXTRACTION_BENCHMARK_QUALITY_WEIGHTS, FILE_CONTEXT_TRANSPORT_MAX_BYTES, FILE_CONTEXT_TRANSPORT_PROFILE, MUTATING_TOOL_NAMES, MemoryStore, ObserverClient, ObserverOutputError, ObserverOutputTransportError, OwnerProfileEnrollmentError, PROMPT_TRANSPORT_PROTOCOL_RANGE, REF_BACKFILL_JOB, RawEventIngestValidationError, RawEventSweeper, RefBackfillRunner, RemoteCoordinatorRequestError, SCOPE_BACKFILL_JOB, SESSION_CONTEXT_BACKFILL_JOB, SUMMARY_DEDUP_BACKFILL_JOB, ScopeBackfillRunner, SessionContextBackfillRunner, SummaryDedupBackfillRunner, SyncRetentionRunner, TRUSTED_HOOK_MAPPER_OPTIONS, VERSION, VectorModelMigrationRunner, aiBackfillStructuredContent, applyBootstrapSnapshot, applyDistillRule, arePromptTransportProtocolRangesCompatible, atomicReplaceConfigFile, backfillMemoryDedupKeys, backfillNarrativeFromBody, backfillTagsText, backfillVectors, buildBaseUrl, buildDirectPeerAuthHeaders, buildDistillReport, buildPiFlushSignalFromEvent, buildRawEventEnvelopeFromHook, buildRawEventEnvelopeFromPiEvent, buildTieredObserverSelection, buildViewerIdentityTarget, classifyPromptTransportFailure, clonePromptPackAttempt, collectOperationalStatus, compareMemoryRoleReports, connect, connectReadOnly, coordinatorAuthControllerReviewAction, coordinatorCreateGroupAction, coordinatorCreateInviteAction, coordinatorCreateScopeAction, coordinatorDisableDeviceAction, coordinatorEnrollDeviceAction, coordinatorGrantIdentityGroupAction, coordinatorGrantScopeMembershipAction, coordinatorImportInviteAction, coordinatorListBootstrapGrantsAction, coordinatorListDevicesAction, coordinatorListGroupsAction, coordinatorListJoinRequestsAction, coordinatorListScopeMembershipsAction, coordinatorListScopesAction, coordinatorQualifyOwnerAction, coordinatorRemoveDeviceAction, coordinatorRenameDeviceAction, coordinatorReviewInviteAction, coordinatorReviewJoinRequestAction, coordinatorRevokeBootstrapGrantAction, coordinatorRevokeDeviceAction, coordinatorRevokeScopeMembershipAction, coordinatorUpdateScopeAction, createBetterSqliteCoordinatorApp, createFileContextRunner, deactivateLowSignalMemories, deactivateLowSignalObservations, dedupNearDuplicateMemories, describePiObserverStatus, detectInstallKind, dispatchFileContextTransport, draftDistillRule, enrollOwnerProfile, ensureDeviceIdentity, ensureSchemaBootstrapped, estimateExtractionModelCost, expandUserPath, exportMemories, extractApplyPatchPaths, extractionReplayObserverIdentity, fetchAllSnapshotPages, fingerprintPublicKey, flushRawEvents, formatHostPort, getAttributionDiagnostics, getCodememConfigPath, getExtractionBenchmarkProfile, getExtractionModelPricing, getInjectionEvalScenarioPack, getInjectionEvalScenarioPrompts, getMaintenanceJob, getMemoryArtifactReport, getMemoryRoleReport, getRawEventRelinkPlan, getRawEventRelinkReport, getRawEventStatus, getSemanticIndexDiagnostics, getSessionExtractionEval, getSessionExtractionEvalScenario, getUpdateStatus, getWorkspaceCodememConfigPath, hasPendingDedupKeyBackfill, hasPendingRefBackfill, hasPendingScopeBackfill, hasPendingSessionContextBackfill, hasPendingSummaryDedupBackfill, hasUnsyncedSharedMemoryChanges, importMemories, importPiSessions, ingestRawEvents, initDatabase, isAutomaticRecallMeasurement, isCoordinatorControllerAttestationReference, isEmbeddingDisabled, isExplicitUpdateInstallEligible, isReleaseVersionForChannel, judgeDistillReport, linkCoordinatorAccount, listMaintenanceJobs, listPerPeerScopeSyncState, listRetentionScopeIds, loadObserverConfig, loadPublicKey, loadRuntimeSigningPublicKey, loadSqliteVec, mdnsEnabled, mutateCodememConfigFile, normalizeCoordinatorAccountLinkOrigin, normalizePromptTransportProtocolRange, observerBaseUrlForProviderOverride, parseFileContextTransportRequest, planReplicationOpsAgePrune, probeCodememViewerLiveness, probeCodememViewerLiveness as probeCodememViewerLiveness$1, probeRequiredNativeRuntime, projectMatchesFilter, promptPackArtifactFingerprint, pruneReplicationOpsUntilCaughtUp, rawEventsGate, readAccountLinkDevice, readCodememConfigFile, readCodememConfigFileAtPath, readCoordinatorAccountLinkStatus, readCoordinatorOwnerReviewLocalEvidence, readCoordinatorSyncConfig, readImportPayload, recordAutomaticRecall, recordPromptPackArtifacts, recordPromptPackTerminal, renderUnifiedDiff, replayBatchExtraction, replayBatchExtractionWithTierRouting, requestJson, resolveCodememConfigPath, resolveComparablePath, resolveDbPath, resolveHookProject, resolveKeyPaths, resolvePiAgentDir, resolvePiObserverConfig, resolveProject, resolveProjectRoot, retryRawEventFailures, runSyncDaemon, runSyncPass, scanSecretsRetroactive, schema, scoreExtractionBenchmarkOutput, searchPiSessions, setPeerProjectFilter, syncPassPreflight, tryUpdateRetrievalDelivery, updatePeerAddresses, upgradeCoordinatorAccountSchemaFile, upgradeCoordinatorAuthSchemaFile, vacuumDatabase, viewerUrl, writeCodememConfigFile } from "@codemem/core";
+import { ACCOUNT_CONNECTION_MIGRATION_STATEMENTS, ACCOUNT_UNLINK_MIGRATION_STATEMENTS, AUTH_LINK_AUTHORITY_CUTOVER_SQL, ContextOnlyReplayError, CoordinatorAccountLinkError, DEDUP_KEY_BACKFILL_JOB, DEFAULT_COORDINATOR_DB_PATH, DedupKeyBackfillRunner, DeviceIdentityError, EXTRACTION_BENCHMARK_QUALITY_WEIGHTS, FILE_CONTEXT_TRANSPORT_MAX_BYTES, FILE_CONTEXT_TRANSPORT_PROFILE, LEGACY_OWNER_RESOLUTION_SCHEMA_STATEMENTS, MUTATING_TOOL_NAMES, MemoryStore, ObserverClient, ObserverOutputError, ObserverOutputTransportError, OwnerProfileEnrollmentError, PROMPT_TRANSPORT_PROTOCOL_RANGE, REF_BACKFILL_JOB, RawEventIngestValidationError, RawEventSweeper, RefBackfillRunner, RemoteCoordinatorRequestError, SCOPE_BACKFILL_JOB, SESSION_CONTEXT_BACKFILL_JOB, SUMMARY_DEDUP_BACKFILL_JOB, ScopeBackfillRunner, SessionContextBackfillRunner, SummaryDedupBackfillRunner, SyncRetentionRunner, TRUSTED_HOOK_MAPPER_OPTIONS, VERSION, VectorModelMigrationRunner, aiBackfillStructuredContent, applyBootstrapSnapshot, applyDistillRule, arePromptTransportProtocolRangesCompatible, atomicReplaceConfigFile, backfillMemoryDedupKeys, backfillNarrativeFromBody, backfillTagsText, backfillVectors, buildBaseUrl, buildDirectPeerAuthHeaders, buildDistillReport, buildPiFlushSignalFromEvent, buildRawEventEnvelopeFromHook, buildRawEventEnvelopeFromPiEvent, buildTieredObserverSelection, buildViewerIdentityTarget, classifyPromptTransportFailure, clonePromptPackAttempt, collectOperationalStatus, compareMemoryRoleReports, connect, connectReadOnly, coordinatorAuthControllerReviewAction, coordinatorCreateGroupAction, coordinatorCreateInviteAction, coordinatorCreateScopeAction, coordinatorDisableDeviceAction, coordinatorEnrollDeviceAction, coordinatorGrantIdentityGroupAction, coordinatorGrantScopeMembershipAction, coordinatorImportInviteAction, coordinatorListBootstrapGrantsAction, coordinatorListDevicesAction, coordinatorListGroupsAction, coordinatorListJoinRequestsAction, coordinatorListScopeMembershipsAction, coordinatorListScopesAction, coordinatorQualifyOwnerAction, coordinatorRemoveDeviceAction, coordinatorRenameDeviceAction, coordinatorReviewInviteAction, coordinatorReviewJoinRequestAction, coordinatorRevokeBootstrapGrantAction, coordinatorRevokeDeviceAction, coordinatorRevokeScopeMembershipAction, coordinatorUpdateScopeAction, createBetterSqliteCoordinatorApp, createFileContextRunner, deactivateLowSignalMemories, deactivateLowSignalObservations, dedupNearDuplicateMemories, describePiObserverStatus, detectInstallKind, dispatchFileContextTransport, draftDistillRule, enrollOwnerProfile, ensureDeviceIdentity, ensureSchemaBootstrapped, estimateExtractionModelCost, expandUserPath, exportMemories, extractApplyPatchPaths, extractionReplayObserverIdentity, fetchAllSnapshotPages, fingerprintPublicKey, flushRawEvents, formatHostPort, getAttributionDiagnostics, getCodememConfigPath, getExtractionBenchmarkProfile, getExtractionModelPricing, getInjectionEvalScenarioPack, getInjectionEvalScenarioPrompts, getMaintenanceJob, getMemoryArtifactReport, getMemoryRoleReport, getRawEventRelinkPlan, getRawEventRelinkReport, getRawEventStatus, getSemanticIndexDiagnostics, getSessionExtractionEval, getSessionExtractionEvalScenario, getUpdateStatus, getWorkspaceCodememConfigPath, hasPendingDedupKeyBackfill, hasPendingRefBackfill, hasPendingScopeBackfill, hasPendingSessionContextBackfill, hasPendingSummaryDedupBackfill, hasUnsyncedSharedMemoryChanges, importMemories, importPiSessions, ingestRawEvents, initDatabase, isAutomaticRecallMeasurement, isCoordinatorControllerAttestationReference, isEmbeddingDisabled, isExplicitUpdateInstallEligible, isReleaseVersionForChannel, judgeDistillReport, linkCoordinatorAccount, listMaintenanceJobs, listPerPeerScopeSyncState, listRetentionScopeIds, loadObserverConfig, loadPublicKey, loadRuntimeSigningPublicKey, loadSqliteVec, mdnsEnabled, mutateCodememConfigFile, normalizeCoordinatorAccountLinkOrigin, normalizePromptTransportProtocolRange, observerBaseUrlForProviderOverride, parseControllerHistoryEvidence, parseFileContextTransportRequest, planReplicationOpsAgePrune, probeCodememViewerLiveness, probeCodememViewerLiveness as probeCodememViewerLiveness$1, probeRequiredNativeRuntime, projectMatchesFilter, promptPackArtifactFingerprint, pruneReplicationOpsUntilCaughtUp, rawEventsGate, readAccountLinkDevice, readCodememConfigFile, readCodememConfigFileAtPath, readCoordinatorAccountLinkStatus, readCoordinatorOwnerReviewLocalEvidence, readCoordinatorSyncConfig, readImportPayload, recordAutomaticRecall, recordPromptPackArtifacts, recordPromptPackTerminal, renderUnifiedDiff, replayBatchExtraction, replayBatchExtractionWithTierRouting, requestJson, resolveCodememConfigPath, resolveComparablePath, resolveDbPath, resolveHookProject, resolveKeyPaths, resolvePiAgentDir, resolvePiObserverConfig, resolveProject, resolveProjectRoot, retryRawEventFailures, runSyncDaemon, runSyncPass, scanSecretsRetroactive, schema, scoreExtractionBenchmarkOutput, searchPiSessions, setPeerProjectFilter, syncPassPreflight, tryUpdateRetrievalDelivery, updatePeerAddresses, upgradeCoordinatorAccountSchemaFile, upgradeCoordinatorAuthSchemaFile, upgradeCoordinatorOwnerResolutionSchemaFile, vacuumDatabase, viewerUrl, writeCodememConfigFile } from "@codemem/core";
 import { Command, Option } from "commander";
 import omelette from "omelette";
 import { appendFileSync, copyFileSync, existsSync, mkdirSync, readFileSync, readdirSync, realpathSync, renameSync, rmSync, rmdirSync, statSync, unlinkSync, writeFileSync } from "node:fs";
@@ -1596,7 +1596,7 @@ async function buildLocalPack$2(context, project, dbPath, workingSetPaths = [])
 			packTokens: Number.isFinite(Number(pack.metrics?.pack_tokens)) ? Number(pack.metrics.pack_tokens) : 0
 		};
 	} finally {
-		store.close();
+		await store.closeAsync();
 	}
 }
 async function buildClaudeHookInjection(payload, opts, deps = {}) {
@@ -2237,7 +2237,7 @@ async function buildLocalPack$1(context, project, dbPath) {
 			packTokens: Number.isFinite(Number(pack.metrics?.pack_tokens)) ? Number(pack.metrics?.pack_tokens) : 0
 		};
 	} finally {
-		store.close();
+		await store.closeAsync();
 	}
 }
 async function prepareCodexHookInjection(payload, opts, deps = {}) {
@@ -2499,21 +2499,34 @@ function hasDatabaseSelection(options) {
 	return options.dbPath !== void 0 || options.db !== void 0;
 }
 function exportAccountSchema(options) {
-	const statements = options.deviceUnlink ? ACCOUNT_UNLINK_MIGRATION_STATEMENTS : ACCOUNT_CONNECTION_MIGRATION_STATEMENTS;
-	const text = `-- ${accountPrerequisites}\n-- Execute in ONE atomic D1 batch; do not split into autocommitted requests. Nothing has been applied.\n${statements.map((s) => `${s.trim().replace(/;$/u, "")};`).join("\n")}\n`;
+	let statements = options.deviceUnlink ? ACCOUNT_UNLINK_MIGRATION_STATEMENTS : ACCOUNT_CONNECTION_MIGRATION_STATEMENTS;
+	let prerequisites = accountPrerequisites;
+	if (options.ownerResolution) {
+		statements = LEGACY_OWNER_RESOLUTION_SCHEMA_STATEMENTS;
+		prerequisites += " Requires the current account-management schema first; installs inert receipt storage only, not ownership or access.";
+	}
+	const text = `-- ${prerequisites}\n-- Execute in ONE atomic D1 batch; do not split into autocommitted requests. Nothing has been applied.\n${statements.map((s) => `${s.trim().replace(/;$/u, "")};`).join("\n")}\n`;
 	process.stdout.write(options.json ? `${JSON.stringify({
 		statements,
 		applied: false
 	})}\n` : text);
 }
+function invalidAccountSelection(options, path) {
+	if (options.exportSql) return hasDatabaseSelection(options);
+	if (!path) return true;
+	return Boolean(options.ownerResolution && !hasDatabaseSelection(options));
+}
 async function upgradeAccount(options) {
+	if (options.ownerResolution && options.deviceUnlink) {
+		failure$4(options, "Use --owner-resolution without --device-unlink.", 2, "account_schema_upgrade_failed");
+		return;
+	}
 	if (options.deviceUnlink && !options.exportSql) {
 		failure$4(options, "Use --device-unlink only with --export-sql; local upgrades detect the installed schema.", 2, "account_schema_upgrade_failed");
 		return;
 	}
 	const path = resolveDbOpt(options);
-	const selected = hasDatabaseSelection(options);
-	if (options.exportSql && selected || !options.exportSql && !path) {
+	if (invalidAccountSelection(options, path)) {
 		failure$4(options, options.exportSql ? "Use --export-sql without --db-path; export opens no database." : `Select an existing coordinator database with --db-path. ${accountPrerequisites}`, 2, "account_schema_upgrade_failed");
 		return;
 	}
@@ -2524,14 +2537,23 @@ async function upgradeAccount(options) {
 		}
 		if (!path) return;
 		if (!options.json) process.stderr.write(`${accountPrerequisites}\n`);
-		await upgradeCoordinatorAccountSchemaFile(path);
-		process.stdout.write(options.json ? `${JSON.stringify({ upgraded: true })}\n` : "Coordinator account schema upgraded.\n");
+		if (options.ownerResolution) await upgradeCoordinatorOwnerResolutionSchemaFile(path);
+		else await upgradeCoordinatorAccountSchemaFile(path);
+		process.stdout.write(options.json ? `${JSON.stringify({ upgraded: true })}\n` : accountUpgradeSuccess(options));
 	} catch (error) {
-		failure$4(options, `Account schema upgrade stopped. Inspect the selected database before retrying. ${error instanceof Error ? error.message : "Coordinator account schema upgrade failed."}`, 1, "account_schema_upgrade_failed");
+		failure$4(options, `Account schema upgrade stopped. Inspect the selected database before retrying. ${accountUpgradeFailure(options, error)}`, 1, "account_schema_upgrade_failed");
 	}
 }
+function accountUpgradeSuccess(options) {
+	if (options.ownerResolution) return "Coordinator owner-resolution receipt storage ready; ownership and access unchanged.\n";
+	return "Coordinator account schema upgraded.\n";
+}
+function accountUpgradeFailure(options, error) {
+	if (options.ownerResolution) return "Owner-resolution storage requires the current account schema: first use upgrade-account-schema without --owner-resolution. Partial, unsupported or colliding receipt schemas cannot be repaired by this command. Check file access and writer locks.";
+	return error instanceof Error ? error.message : "Coordinator account schema upgrade failed.";
+}
 function buildCoordinatorAccountSchemaCommand() {
-	const command = new Command("upgrade-account-schema").configureHelp(helpStyle).description("Explicitly install optional coordinator account management on an existing V2 database").option("--device-unlink", "export only the delta for the prior account-management schema (requires --export-sql)").option("-e, --export-sql", "export statement boundaries for one atomic D1 batch without opening a database").addHelpText("after", `\n${accountPrerequisites}\nD1 export does not apply SQL or verify remote execution limits.\n`);
+	const command = new Command("upgrade-account-schema").configureHelp(helpStyle).description("Explicitly install optional coordinator account management on an existing V2 database").option("-o, --owner-resolution", "install inert owner-resolution receipt storage (requires current account schema)").option("--device-unlink", "export only the delta for the prior account-management schema (requires --export-sql)").option("-e, --export-sql", "export statement boundaries for one atomic D1 batch without opening a database").addHelpText("after", `\n${accountPrerequisites}\n--owner-resolution installs storage only; it does not resolve an owner or change access. It requires the current account schema and an explicit --db-path, or --export-sql without a database. It cannot be combined with --device-unlink.\nD1 export does not apply SQL or verify remote execution limits.\n`);
 	addDbOption(command);
 	addJsonOption(command);
 	command.action(upgradeAccount);
@@ -3064,7 +3086,8 @@ var REVIEW_REASONS = [
 	"key_mismatch",
 	"enrollment_identity_mismatch",
 	"invite_identity_mismatch",
-	"invite_evidence_invalid"
+	"invite_evidence_invalid",
+	"legacy_history_invalid"
 ];
 function validId$1(value) {
 	return typeof value === "string" && value.length > 0 && value.length <= 256 && value.trim() === value && !/[\p{Cc}\p{Cf}\p{Cs}]/u.test(value);
@@ -3073,6 +3096,7 @@ function isHash(value) {
 	return typeof value === "string" && value.length === 64 && /^[a-f0-9]{64}$/.test(value);
 }
 function reviewErrorMessage(error) {
+	if (error instanceof CoordinatorHistoryUnavailableError) return "Update the coordinator before reviewing this device owner: retained history evidence was missing or invalid in its response. Nothing changed.";
 	if (error instanceof RemoteCoordinatorRequestError) {
 		if (error.code === "review_stale") return "Evidence changed since the preview. Nothing changed; run the review again.";
 		if (error.code === "already_reviewed_or_needs_review") return "This device already has a reviewed owner, or needs a separate review. Nothing changed.";
@@ -3140,9 +3164,27 @@ function validInviteCount(reply, invites) {
 function validInviteRef(invite) {
 	return !!invite && validId$1(invite.invite_id) && (invite.kind === "team_member" || invite.kind === "add_device");
 }
+function previewEnrollment(enrollment) {
+	if (!enrollment) return null;
+	return {
+		device_id: enrollment.device_id,
+		fingerprint: enrollment.fingerprint,
+		display_name: null,
+		identity_label: enrollment.identity_label
+	};
+}
+var CoordinatorHistoryUnavailableError = class extends Error {};
+function parsePreviewHistory(value, coordinatorId) {
+	try {
+		return parseControllerHistoryEvidence(value, coordinatorId);
+	} catch {
+		throw new CoordinatorHistoryUnavailableError();
+	}
+}
 function parsePreview(payload, request) {
 	if (!payload || typeof payload !== "object" || Array.isArray(payload)) throw new Error("invalid_preview");
 	const reply = payload;
+	if (!Array.isArray(reply.legacy_history)) throw new CoordinatorHistoryUnavailableError();
 	const enrollment = reply.enrollment;
 	const invites = reply.reviewed_invites;
 	if (reply.state !== "ready" && reply.state !== "needs_review" || !validId$1(reply.coordinator_id) || !Array.isArray(reply.reasons) || !reply.reasons.every((reason) => typeof reason === "string" && REVIEW_REASONS.includes(reason)) || !Array.isArray(invites) || !validInviteCount(reply, invites) || !invites.every(validInviteRef)) throw new Error("invalid_preview");
@@ -3151,14 +3193,10 @@ function parsePreview(payload, request) {
 	return {
 		state: reply.state,
 		coordinator_id: reply.coordinator_id,
+		legacy_history: parsePreviewHistory(reply.legacy_history, reply.coordinator_id),
 		reasons: reply.reasons,
 		evidence_digest: reply.state === "ready" ? reply.evidence_digest : void 0,
-		enrollment: enrollment ? {
-			device_id: enrollment.device_id,
-			fingerprint: enrollment.fingerprint,
-			display_name: null,
-			identity_label: enrollment.identity_label
-		} : null,
+		enrollment: previewEnrollment(enrollment),
 		reviewed_invites: invites.map((invite) => ({
 			invite_id: invite.invite_id,
 			kind: invite.kind
@@ -3233,6 +3271,86 @@ function emitReviewPreview(evidence, preview) {
 		...stopped
 	})}\n`);
 }
+function terminalIdentifier(value) {
+	return JSON.stringify(value).replace(/[\p{Cc}\p{Cf}\p{Cs}\p{Zl}\p{Zp}]/gu, (character) => `\\u{${character.codePointAt(0)?.toString(16)}}`);
+}
+function historyAssociation(deviceId, fingerprint, subject) {
+	if (deviceId === subject.deviceId) {
+		if (fingerprint === subject.fingerprint) return "Current device; current fingerprint";
+		return "Current device; different recorded key";
+	}
+	if (fingerprint === subject.fingerprint) return "Other device; current fingerprint";
+	return "Other recorded device/key; canonical-key equivalence is not identified in this summary";
+}
+function* controllerHistoryRows(preview, subject) {
+	for (const record of preview.legacy_history) {
+		yield {
+			text: `Historical group ${terminalIdentifier(record.group_id)}; Team ${terminalIdentifier(record.manifest.team_id)}; completed ${terminalIdentifier(record.completed_at)}\nCandidate: ${terminalIdentifier(record.candidate_ref)}; manifest version: ${record.manifest_version}; recorded: ${terminalIdentifier(record.created_at)}\nOriginal retained manifest JSON: ${terminalIdentifier(record.manifest_json)}`,
+			records: 1,
+			decisions: 0
+		};
+		for (const decision of record.manifest.device_decisions) {
+			const identity = decision.identity_id === null ? "none" : terminalIdentifier(decision.identity_id);
+			yield {
+				text: `  ${decision.decision}; Identity: ${identity}; enabled: ${decision.enabled ? "yes" : "no"}\n  Device: ${terminalIdentifier(decision.device_id)}; fingerprint: ${terminalIdentifier(decision.key_fingerprint)}\n  ${historyAssociation(decision.device_id, decision.key_fingerprint, subject)}`,
+				records: 0,
+				decisions: 1
+			};
+		}
+	}
+}
+/** A truncated summary must never authorize the terminal confirmation. */
+function formatControllerReviewHistory(preview, subject) {
+	const lines = [
+		`Proposed current owner Identity: ${terminalIdentifier(subject.identityId)}`,
+		"Retained legacy sharing assignments (not ownership changes):",
+		"Records may contain other devices. Different fingerprints may represent known key aliases; no row below is assumed to belong to this device unless labeled as an exact device/fingerprint match."
+	];
+	let records = 0;
+	let decisions = 0;
+	let characters = lines.join("\n").length;
+	let complete = true;
+	for (const row of controllerHistoryRows(preview, subject)) {
+		if (records + row.records > 20 || decisions + row.decisions > 40 || characters + row.text.length + 1 > 24e3) {
+			complete = false;
+			break;
+		}
+		lines.push(row.text);
+		records += row.records;
+		decisions += row.decisions;
+		characters += row.text.length + 1;
+	}
+	if (preview.legacy_history.length === 0) lines.push("No relevant retained legacy assignments.");
+	if (!complete) {
+		const totalDecisions = preview.legacy_history.reduce((total, record) => total + record.manifest.device_decisions.length, 0);
+		lines.push(`TRUNCATED: showing ${records} of ${preview.legacy_history.length} records and ${decisions} of ${totalDecisions} device decisions. Terminal confirmation is disabled.`);
+	}
+	lines.push("Previous assignments are retained. This review records current ownership; it does not migrate sharing, move memories, merge Identities, or grant Team/Project access.", "Approval grants the existing controller authority, including account management when the coordinator permits it. Google account linking remains a separate step.");
+	return {
+		text: lines.join("\n"),
+		complete
+	};
+}
+function showCoordinatorReview(preview, request, options) {
+	p.log.info(`Coordinator: ${preview.coordinator_id}; reviewed invitations: ${preview.reviewed_invite_count}`, { output: process.stderr });
+	const history = formatControllerReviewHistory(preview, request);
+	p.log.message(history.text, { output: process.stderr });
+	if (history.complete) return true;
+	failure$1(options, "Nothing changed. Run the same command with --json to inspect all retained evidence. Ask the coordinator operator to use the administrator review API for evidence exceeding this terminal's display limit.", 2);
+	return false;
+}
+function reportReviewFailure(options, error) {
+	if (options.json && error instanceof CoordinatorHistoryUnavailableError) {
+		process.stdout.write(`${JSON.stringify({
+			error: "owner_review_unavailable",
+			message: reviewErrorMessage(error),
+			unchanged: true
+		})}\n`);
+		process.exitCode = 1;
+		return;
+	}
+	failure$1(options, reviewErrorMessage(error));
+}
 async function reviewDeviceOwner(group, options) {
 	try {
 		if (!validId$1(group)) return failure$1(options, "Use a valid coordinator group ID.", 2);
@@ -3261,10 +3379,10 @@ async function reviewDeviceOwner(group, options) {
 			return;
 		}
 		if (preview.state !== "ready") return failure$1(options, `Coordinator review stopped: ${preview.reasons.join(", ")}. Nothing changed.`);
-		p.log.info(`Coordinator: ${preview.coordinator_id}; reviewed invitations: ${preview.reviewed_invite_count}`, { output: process.stderr });
+		if (!showCoordinatorReview(preview, request, options)) return;
 		await confirmReview(group, options, evidence, request, preview);
 	} catch (error) {
-		failure$1(options, reviewErrorMessage(error));
+		reportReviewFailure(options, error);
 	}
 }
 function buildCoordinatorReviewDeviceOwnerCommand() {
@@ -5909,7 +6027,7 @@ function createInjectMemoryCommand() {
 			const pack = await store.buildMemoryPackAsync(context, limit, budget, filters);
 			console.log(pack.pack_text ?? "");
 		} finally {
-			store.close();
+			await store.closeAsync();
 		}
 	});
 	return cmd;
@@ -7076,7 +7194,7 @@ async function withStore(opts, errorCode, run) {
 		p.log.error(message);
 		process.exitCode = usageError ? 2 : 1;
 	} finally {
-		store?.close();
+		await store?.closeAsync();
 	}
 }
 function ledgerAutomaticContext(payload) {
@@ -7769,7 +7887,7 @@ async function buildLocalPack(context, project, dbPath) {
 			packTokens: Number.isFinite(Number(pack.metrics?.pack_tokens)) ? Number(pack.metrics?.pack_tokens) : 0
 		};
 	} finally {
-		store.close();
+		await store.closeAsync();
 	}
 }
 function isRecord$1(value) {
@@ -8658,6 +8776,12 @@ function readViewerPidRecord(dbPath) {
 	};
 	return null;
 }
+function removeOwnedViewerPidFile(dbPath) {
+	try {
+		if (readViewerPidRecord(dbPath)?.pid !== process.pid) return;
+		rmSync(pidFilePath(dbPath));
+	} catch {}
+}
 function normalizeViewerHost(host) {
 	const normalized = host.trim().toLowerCase();
 	if (normalized === "localhost" || normalized === "127.0.0.1" || normalized === "::1" || normalized === "[::1]") return "loopback";
@@ -9076,6 +9200,10 @@ function createRawEventTargetState(store) {
 		stop
 	};
 }
+function createOptionalOwnerRecovery(serverModule, options) {
+	if (!("createAccountOwnerRecoveryService" in serverModule) || typeof serverModule.createAccountOwnerRecoveryService !== "function") return void 0;
+	return serverModule.createAccountOwnerRecoveryService(options);
+}
 function createViewerAccountLink(store, invocation, serverModule) {
 	const configPath = resolveCodememConfigPath(invocation.configPath ?? void 0).resolved.path;
 	const keysDir = dirname(resolveKeyPaths(process.env.CODEMEM_KEYS_DIR?.trim() || void 0)[0]);
@@ -9091,15 +9219,31 @@ function createViewerAccountLink(store, invocation, serverModule) {
 		keysDir
 	});
 	const registry = serverModule.createAccountLinkRegistry({ readContext });
+	const ownerRecovery = createOptionalOwnerRecovery(serverModule, {
+		readContext,
+		registry,
+		readAdminSecret: () => {
+			const envSecret = process.env.CODEMEM_SYNC_COORDINATOR_ADMIN_SECRET?.trim();
+			if (envSecret) return envSecret;
+			const secret = readCodememConfigFileAtPath(configPath).sync_coordinator_admin_secret;
+			return typeof secret === "string" ? secret.trim() : null;
+		}
+	});
 	let actualBoundPort = null;
 	return {
 		registry,
+		ownerRecovery,
+		close: async () => {
+			if (ownerRecovery) await ownerRecovery.close();
+			await registry.close();
+		},
 		setBoundPort: (port) => {
 			actualBoundPort = port;
 		},
 		options: {
 			readContext,
 			registry,
+			ownerRecovery,
 			getListenerAddress: () => actualBoundPort === null ? null : {
 				host: invocation.host,
 				port: actualBoundPort
@@ -9121,7 +9265,7 @@ function announceViewerStartup(options) {
 }
 async function startForegroundViewer(invocation) {
 	const serverModule = await import("@codemem/server");
-	const { createApp, createSyncApp, closeStore, createViewerRawEventInbox, getStore } = serverModule;
+	const { createApp, createSyncApp, closeStoreAsync, createViewerRawEventInbox, getStore } = serverModule;
 	const createRawEventInbox = createViewerRawEventInbox;
 	const coordinatorMaintenanceDependencies = createServeCoordinatorMaintenanceDependencies(serverModule);
 	const { serve } = await import("@hono/node-server");
@@ -9143,7 +9287,7 @@ async function startForegroundViewer(invocation) {
 		p.log.warn("sqlite-vec failed to load; retrying viewer startup with embeddings disabled");
 		for (const line of sqliteVecFailureDiagnostics(err, resolveDbPath(invocation.dbPath ?? void 0))) p.log.warn(`sqlite-vec diagnostic: ${line}`);
 		process.env.CODEMEM_EMBEDDING_DISABLED = "1";
-		closeStore();
+		await closeStoreAsync();
 		store = getStore();
 		p.log.warn("Embeddings disabled for this viewer process; raw-event ingestion remains active.");
 	}
@@ -9237,51 +9381,72 @@ async function startForegroundViewer(invocation) {
 	server.on("error", (err) => {
 		if (err.code === "EADDRINUSE") p.log.warn(`Viewer already running at http://${invocation.host}:${invocation.port}`);
 		else p.log.error(err.message);
-		process.exit(1);
+		requestShutdown(1);
 	});
-	const shutdown = async () => {
+	let shutdownPromise;
+	let shutdownExitCode = 0;
+	const shutdown = (exitCode = 0) => {
+		shutdownExitCode = Math.max(shutdownExitCode, exitCode);
+		shutdownPromise ??= finishShutdown();
+		return shutdownPromise;
+	};
+	const finishShutdown = async () => {
 		p.outro("shutting down");
 		syncAbort.abort();
-		await accountLink.registry.close();
-		await stopMaintenanceWorkerProcess(maintenanceWorker, dbPath);
-		await new Promise((resolve) => {
-			let remaining = syncServer ? 2 : 1;
-			const done = () => {
-				if (--remaining === 0) resolve();
-			};
-			syncServer?.close(done);
-			server.close(done);
-		}).catch(() => {});
-		await rawEventProcessing.stop();
 		try {
-			rmSync(pidPath);
-		} catch {}
-		closeStore();
-		process.exit(0);
-	};
-	const forceShutdown = () => {
-		setTimeout(() => {
-			if (maintenanceWorker?.pid && isProcessRunning(maintenanceWorker.pid)) try {
-				process.kill(maintenanceWorker.pid, "SIGKILL");
-			} catch {}
 			try {
-				rmSync(pidPath);
-			} catch {}
+				await accountLink.close();
+				await stopMaintenanceWorkerProcess(maintenanceWorker, dbPath);
+			} finally {
+				await closeViewerListeners(syncServer ? [syncServer, server] : [server]);
+				await rawEventProcessing.stop();
+			}
+		} catch (error) {
+			shutdownExitCode = 1;
+			logViewerShutdownError(error);
+		} finally {
+			removeOwnedViewerPidFile(dbPath);
 			try {
-				rmSync(maintenanceWorkerPidFilePath(dbPath));
-			} catch {}
-			closeStore();
-			process.exit(1);
-		}, 3e4).unref();
+				await closeStoreAsync();
+			} catch (error) {
+				shutdownExitCode = 1;
+				logViewerShutdownError(error);
+			}
+		}
+		process.exit(shutdownExitCode);
 	};
-	process.on("SIGINT", () => {
-		forceShutdown();
-		shutdown();
-	});
-	process.on("SIGTERM", () => {
-		forceShutdown();
-		shutdown();
-	});
+	const requestShutdown = (exitCode = 0) => {
+		if (!shutdownPromise) forceViewerShutdown(maintenanceWorker, dbPath);
+		shutdown(exitCode).catch((error) => {
+			logViewerShutdownError(error);
+		});
+	};
+	process.on("SIGINT", () => requestShutdown());
+	process.on("SIGTERM", () => requestShutdown());
+}
+function logViewerShutdownError(error) {
+	p.log.error(error instanceof Error ? error.message : String(error));
+}
+function closeViewerListeners(listeners) {
+	return new Promise((resolve) => {
+		let remaining = listeners.length;
+		const done = () => {
+			if (--remaining === 0) resolve();
+		};
+		for (const listener of listeners) listener.close(done);
+	}).catch(() => {});
+}
+function forceViewerShutdown(maintenanceWorker, dbPath) {
+	setTimeout(() => {
+		if (maintenanceWorker?.pid && isProcessRunning(maintenanceWorker.pid)) try {
+			process.kill(maintenanceWorker.pid, "SIGKILL");
+		} catch {}
+		removeOwnedViewerPidFile(dbPath);
+		try {
+			rmSync(maintenanceWorkerPidFilePath(dbPath));
+		} catch {}
+		process.exit(1);
+	}, 3e4).unref();
 }
 async function runServeInvocation(invocation, dependencies = {
 	nativeRuntimeAllowsServeStart,