dsh-bettertaskgraphs 0.3.1-rc.35 → 0.3.1-rc.37

package/DSH-COMPATIBILITY.json

@@ -1,13 +1,14 @@
 {
   "schema": 1,
   "updateRound": 3,
-  "slot": 5,
-  "branch": "0.2.1-alpha.2",
-  "host": "0.2.1-alpha.2",
+  "slot": 7,
+  "branch": "0.2.0-rc.2",
+  "host": "0.2.0-rc.2",
   "hosts": [
-    "0.2.1-alpha.2"
+    "0.2.0-rc.2",
+    "0.2.0-rc.1"
   ],
-  "channel": "dsh-0.2.1-alpha.2",
-  "taskgraph": "0.3.1-rc.35",
-  "dynamicContext": "0.1.1-rc.35"
+  "channel": "dsh-0.2.0-rc.2",
+  "taskgraph": "0.3.1-rc.37",
+  "dynamicContext": "0.1.1-rc.37"
 }

package/README.md

@@ -1,6 +1,6 @@
 # dsh-bettertaskgraphs
 
-本构建版本为 `0.3.1-rc.35`。适用宿主和配套版本见 [兼容清单](DSH-COMPATIBILITY.json)。
+本构建版本为 `0.3.1-rc.37`。适用宿主和配套版本见 [兼容清单](DSH-COMPATIBILITY.json)。
 
 独立运行保留动态上下文开发前 `0.2.3` 的五个工具、初始指引与事务语义；通用扩展接口供其他插件登记工作流和会话策略。动态上下文装配、修改审批及其提示词由扩展插件实现。
 
@@ -12,9 +12,9 @@ DeepSeek Harness 的事务型任务图 Bundle，包含模型侧的任务图工
 
 ## 兼容范围
 
-分支 `0.2.1-alpha.2` 采用 npm 标签 `dsh-0.2.1-alpha.2`。配套动态上下文版本为 `0.1.1-rc.35`。
+分支 `0.2.0-rc.2` 采用 npm 标签 `dsh-0.2.0-rc.2`。配套动态上下文版本为 `0.1.1-rc.37`。
 
-- DSH `0.2.1-alpha.2`，使用 Web profile。
+- DSH `0.2.0-rc.2`、`0.2.0-rc.1`，使用 Web profile。
 - Node.js `^22.19.0 || >=24.0.0`，开发用 npm。此包与 DSH 共享会话、工具和远程调用接口，升级 DSH 时需要重新验证这些接口。
 
 ## 构建和打包
@@ -26,7 +26,7 @@ npm test
 npm run pack:bundle
 ```
 
-`build` 从前端源码生成可由 DSH Web 加载的 `client.js`。`check` 校验生成物与源码一致，`pack:bundle` 会重新构建前端并生成 `dist/dsh-bettertaskgraphs-0.3.1-rc.35.tgz`。包内包含服务端模块、Web 构建产物、对应源码和构建脚本，以及 Bundle 配置补丁。
+`build` 从前端源码生成可由 DSH Web 加载的 `client.js`。`check` 校验生成物与源码一致，`pack:bundle` 会重新构建前端并生成 `dist/dsh-bettertaskgraphs-0.3.1-rc.37.tgz`。包内包含服务端模块、Web 构建产物、对应源码和构建脚本，以及 Bundle 配置补丁。
 
 ## 安装到独立 Web profile
 
@@ -34,7 +34,7 @@ npm run pack:bundle
 
 ```sh
 dsh --profile bettertaskgraphs --from-default-profile web --dump-config
-dsh plugin --profile bettertaskgraphs add "$PWD/dist/dsh-bettertaskgraphs-0.3.1-rc.35.tgz"
+dsh plugin --profile bettertaskgraphs add "$PWD/dist/dsh-bettertaskgraphs-0.3.1-rc.37.tgz"
 dsh --profile bettertaskgraphs --dump-config
 dsh --profile bettertaskgraphs
 ```
@@ -43,6 +43,8 @@ dsh --profile bettertaskgraphs
 
 ## 工作区与已有任务图
 
+在这条维护线上，宿主 JSONL 目录保存独立的插件会话记录与标记。备份和恢复会话时应一起保留，任务图事务仍以宿主持久化的原始工具记录校验证据。插件会话记录缺失时，先从完整备份恢复。
+
 Bundle 默认将会话创建时的工作目录作为项目根，账本位于根目录下的 `.dsh/transaction-graphs-v4/`。后续工作目录必须位于该根内，账本路径拒绝符号链接。也可以在 profile 的 `cordis.patch.yml` 中固定项目根。
 
 ```yaml

package/VALIDATION.md

@@ -1,4 +1,4 @@
-# Candidate 0.3.1-rc.35
+# Candidate 0.3.1-rc.37
 
 See [the compatibility manifest](DSH-COMPATIBILITY.json) for the exact host versions and package pairing.
 

package/client.js

@@ -1,5 +1,5 @@
 // SPDX-License-Identifier: GPL-3.0-only
-// Corresponding source: https://github.com/oldcitynight/dsh-bettertaskgraphs/tree/v0.3.1-rc.35
+// Corresponding source: https://github.com/oldcitynight/dsh-bettertaskgraphs/tree/v0.3.1-rc.37
 // Generated by scripts/build-client.mjs.
 window.__ModuleLoader__.load({id:"dsh-bettertaskgraphs",factory(require){
 // SPDX-License-Identifier: GPL-3.0-only

package/host.mjs

@@ -109,7 +109,7 @@ export function resolveEvidence({ references, state, binding, activeProof, outco
 
 export class DshTransactionHost {
   constructor(ctx, { projectRoot, storageRelative = '.dsh/transaction-graphs-v4', enableSwitch = false,
-    appendPluginRecord, journalFactory = options => new HostJournal(options), owner = `owner_${randomUUID()}` }) {
+    appendPluginRecord, sessionRecords, journalFactory = options => new HostJournal(options), owner = `owner_${randomUUID()}` }) {
     if (typeof appendPluginRecord !== 'function') fail('SESSION_WRITER_REQUIRED')
     if (projectRoot !== undefined && (typeof projectRoot !== 'string' || !path.isAbsolute(projectRoot)
         || fs.realpathSync(projectRoot) !== path.resolve(projectRoot) || !fs.lstatSync(projectRoot).isDirectory()))
@@ -119,6 +119,7 @@ export class DshTransactionHost {
     if (typeof enableSwitch !== 'boolean') fail('INVALID_SWITCH_POLICY')
     this.ctx = ctx; this.projectRoot = projectRoot === undefined ? undefined : path.resolve(projectRoot)
     this.storageRelative = storageRelative; this.enableSwitch = enableSwitch
+    this.sessionRecords = sessionRecords
     this.append = appendPluginRecord; this.journalFactory = journalFactory; this.owner = owner
     this.journals = new Map(); this.serial = new WeakMap(); this.tasks = new Set(); this.definitions = new Map(); this.closed = false
     this.recoveryVerifier = null
@@ -126,7 +127,7 @@ export class DshTransactionHost {
     this.lifecycle = new AbortController()
   }
   projection(session) {
-    const state = this.ctx.sessionProjections.stateOf(session, KEY)
+    const state = this.sessionRecords ? this.sessionRecords.projection(session) : this.ctx.sessionProjections.stateOf(session, KEY)
     if (!state || state.failure) fail('TRANSACTION_PROJECTION_UNAVAILABLE', state?.failure ?? 'Required projection missing')
     return state
   }
@@ -134,7 +135,7 @@ export class DshTransactionHost {
     if (this.ctx.sessions.get(session.id) !== session || session.header.id !== session.id || !Number.isSafeInteger(session.header.createdAt)) fail('SESSION_NOT_EXACT_LIVE_OWNER')
     const original = realProjectPath(this.projectRoot ?? session.header.cwd, session.header.cwd)
     const projectRoot = this.projectRoot ?? original
-    realProjectPath(projectRoot, this.ctx.workingDirectory.get(session))
+    realProjectPath(projectRoot, this.ctx.get('workingDirectory')?.get(session) ?? original)
     return { contract: 'DSH_TRANSACTION_GRAPH_HOST_V4', projectRoot, sessionId: session.id,
       sessionCreatedAt: session.header.createdAt, originalCwd: original, enableSwitch: this.enableSwitch }
   }
@@ -204,9 +205,10 @@ export class DshTransactionHost {
   }
   presence(session) {
     if (!this.inProject(session)) return { state: 'OUTSIDE_SCOPE', previouslyCommitted: false }
-    const projected = this.projection(session)
-    const previouslyCommitted = projected.receipts.some(row => row.status === 'COMMITTED')
+    let previouslyCommitted = false
     try {
+      const projected = this.projection(session)
+      previouslyCommitted = projected.receipts.some(row => row.status === 'COMMITTED')
       const binding = this.binding(session)
       const file = path.join(binding.projectRoot, this.storageRelative, digest(binding), 'transaction-host-journal.json')
       if (!fs.existsSync(file)) {
@@ -235,7 +237,8 @@ export class DshTransactionHost {
   async authorize(exec) {
     if (this.allowClassic && !this.allowClassic(exec.agent)) fail('TRANSACTION_GRAPH_SESSION_EXTENSION_DENIED')
     if (!exec.agent || this.ctx.agents.get(exec.agent.id) !== exec.agent || this.ctx.agents.currentInitiator() !== exec.agent) fail('EXACT_CALLING_AGENT_REQUIRED')
-    await this.ctx.workingDirectory.ensure(exec.agent, exec.signal)
+    exec.signal?.throwIfAborted()
+    await this.ctx.get('workingDirectory')?.ensure(exec.agent, exec.signal)
     const { binding, key } = this.journal(exec.agent.session)
     const authority = { agent: exec.agent, session: exec.agent.session, agentId: exec.agent.id,
       sessionScope: key, currentInitiatorVerified: true, binding }
@@ -291,6 +294,7 @@ export class DshTransactionHost {
       if (handle.access !== 'read' || handle.id !== session.id || !sameStoredSessionHeader(handle.header, session.header)
           || handle.inheritedEventCount !== session.inheritedEventCount) fail('DURABLE_SESSION_HEADER_OR_SCOPE_MISMATCH')
       for (const proof of proofs) {
+        if (this.sessionRecords && await this.sessionRecords.verify(session, handle, proof)) continue
         const result = await handle.read(proof.seq, 1)
         if (result.events.length !== 1 || result.events[0].seq !== proof.seq || digest(result.events[0]) !== proof.digest)
           fail('DURABLE_SESSION_EVENT_PROOF_REQUIRED')

package/index.mjs

@@ -1,11 +1,10 @@
 // SPDX-License-Identifier: GPL-3.0-only
 import { z } from 'zod'
 import { defineTool } from '@deepseek-ai/dsh-tools'
-import { appendPluginRecord } from '@deepseek-ai/dsh-session'
+import { LegacySessionRecords } from './session-records.mjs'
 import { Remote, RemoteError, TypertRemoteService } from '@deepseek-ai/dsh-typert-protocol'
 import { createToolDefinitions } from './tools.mjs'
 import { DshTransactionHost } from './host.mjs'
-import { projection, KEY } from './projection.mjs'
 import { createRemoteContribution } from './remote.mjs'
 import { WorkflowRegistry, WORKFLOW_CONTRACT } from './interop.mjs'
 import { EXTENSION_CONTRACT, SessionPolicies } from './extensions.mjs'
@@ -19,20 +18,21 @@ Remote('status')(undefined, {
 const guidance = 'For work the user asks to track in a transaction graph, read the program-generated revision and choices before creating or resuming it. One leaf may be active. Begin must commit before work starts. Pending or UNKNOWN work blocks finish and dependent work. Never replay blindly. Complete requires a qualified successful tool result after begin. Incomplete requires known failure, confirmed non-execution, or an unsatisfied outcome. Wait for the enclosing tool call to finish and read the committed state before continuing. Containers aggregate. Transaction completion does not complete Goal.'
 
 export default class TransactionGraphPlugin extends TypertRemoteService {
-  static inject = ['agents', 'sessions', 'sessionProjections', 'sessionPersistence', 'workingDirectory', 'tools', 'systemPrompt']
+  static inject = ['agents', 'sessions', 'sessionProjections', 'sessionPersistence', 'tools', 'systemPrompt']
   constructor(ctx, config = {}) {
     super(ctx, 'transactionGraph', { namespace: 'transactionGraphView' })
     bindSessionResource.call(this)
     if (!config || typeof config !== 'object' || Array.isArray(config)
         || Object.keys(config).some(key => !['projectRoot', 'storageRelative', 'enableSwitch'].includes(key)))
       throw new Error('Invalid transaction graph configuration')
-    this.host = new DshTransactionHost(ctx, { ...config, appendPluginRecord })
+    this.sessionRecords = new LegacySessionRecords(ctx)
+    this.host = new DshTransactionHost(ctx, { ...config, sessionRecords: this.sessionRecords,
+      appendPluginRecord: (session, type, data) => this.sessionRecords.append(session, type, data) })
     this.workflows = new WorkflowRegistry(ctx)
     this.sessionPolicies = new SessionPolicies()
     this.host.allowClassic = agent => this.sessionPolicies.allowClassic(agent)
     Object.defineProperty(this, 'workflowContract', { value: WORKFLOW_CONTRACT })
     Object.defineProperty(this, 'extensionContract', { value: EXTENSION_CONTRACT })
-    ctx.sessionProjections.register(projection)
     for (const definition of createToolDefinitions({ defineTool, hostPort: this.host })) {
       this.host.definitions.set(definition.name, definition)
       ctx.tools.register(definition)
@@ -55,8 +55,10 @@ export default class TransactionGraphPlugin extends TypertRemoteService {
       try { return await next() } finally { running.delete(exec) }
     })
     ctx.on('session/event', (session, event) => {
-      if ((event.type === 'tool/result' || event.type === 'turn/end')
-          && ctx.sessionProjections.stateOf(session, KEY)?.intents.length) {
+      if (event.type === 'tool/result' || event.type === 'turn/end') {
+        if (!this.host.inProject(session)) return
+        try { if (!this.host.projection(session).intents.length) return }
+        catch (error) { ctx.logger.warn('Legacy transaction projection unavailable', error); return }
         // Appending during publication is forbidden by Session; defer the
         // durability barrier and journal CAS until publication has unwound.
         queueMicrotask(() => { if (!this.host.closed) this.host.schedule(session) })

package/interop.mjs

@@ -42,7 +42,7 @@ export class WorkflowRegistry {
   authorize(entry, agent) {
     if (this.closed || !agent || this.ctx.agents.get(agent.id) !== agent || this.ctx.sessions.get(agent.session.id) !== agent.session)
       fail('WORKFLOW_EXACT_CONTROLLER_REQUIRED')
-    const cwd = this.ctx.workingDirectory.get(agent.session)
+    const cwd = this.ctx.get?.('workingDirectory')?.get(agent.session) ?? agent.session.header.cwd
     if (typeof cwd !== 'string' || !within(entry.projectRoot, fs.realpathSync(cwd))
         || !within(entry.projectRoot, fs.realpathSync(agent.session.header.cwd))) fail('WORKFLOW_CONTROLLER_OUTSIDE_PROJECT')
     if (entry.authorize(agent) !== true) fail('WORKFLOW_CONTROLLER_NOT_AUTHORIZED')

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "dsh-bettertaskgraphs",
-  "version": "0.3.1-rc.35",
+  "version": "0.3.1-rc.37",
   "description": "Transactional task graphs with a conversation panel for DeepSeek Harness",
   "license": "GPL-3.0-only",
   "keywords": [
@@ -46,11 +46,12 @@
     "work-policy.mjs",
     "extensions.mjs",
     "VALIDATION.md",
+    "session-records.mjs",
     "DSH-COMPATIBILITY.json"
   ],
   "engines": {
     "node": "^22.19.0 || >=24.0.0",
-    "dsh": "0.2.1-alpha.2"
+    "dsh": "0.2.0-rc.2 || 0.2.0-rc.1"
   },
   "scripts": {
     "build": "node scripts/build-client.mjs",
@@ -62,23 +63,23 @@
   },
   "publishConfig": {
     "access": "public",
-    "tag": "dsh-0.2.1-alpha.2",
+    "tag": "dsh-0.2.0-rc.2",
     "registry": "https://registry.npmjs.org/"
   },
   "dependencies": {
     "zod": "4.6.7"
   },
   "peerDependencies": {
-    "@deepseek-ai/dsh-session": "0.2.1-alpha.2",
-    "@deepseek-ai/dsh-tools": "0.2.1-alpha.2",
-    "@deepseek-ai/dsh-typert-protocol": "0.2.1-alpha.2"
+    "@deepseek-ai/dsh-session": "0.2.0-rc.2 || 0.2.0-rc.1",
+    "@deepseek-ai/dsh-tools": "0.2.0-rc.2 || 0.2.0-rc.1",
+    "@deepseek-ai/dsh-typert-protocol": "0.2.0-rc.2 || 0.2.0-rc.1"
   },
   "devDependencies": {
     "@deepseek-ai/cordis": "4.0.5",
-    "@deepseek-ai/dsh-session": "0.2.1-alpha.2",
-    "@deepseek-ai/dsh-session-projection": "0.2.1-alpha.2",
-    "@deepseek-ai/dsh-tools": "0.2.1-alpha.2",
-    "@deepseek-ai/dsh-typert-protocol": "0.2.1-alpha.2"
+    "@deepseek-ai/dsh-session": "0.2.0-rc.2",
+    "@deepseek-ai/dsh-session-projection": "0.2.0-rc.2",
+    "@deepseek-ai/dsh-tools": "0.2.0-rc.2",
+    "@deepseek-ai/dsh-typert-protocol": "0.2.0-rc.2"
   },
   "dsh": {
     "bundle": {

package/session-records.mjs

@@ -0,0 +1,153 @@
+// SPDX-License-Identifier: GPL-3.0-only
+import path from 'node:path'
+import fs from 'node:fs'
+import { canonical, copy, digest, GraphError } from './core.mjs'
+import { FileGraphStore } from './store.mjs'
+import { applyEvent, initialState } from './projection.mjs'
+
+const firstRecord = 2 ** 52
+const isPluginType = type => typeof type === 'string' && /^plugin:[a-z][a-z0-9-]*\/[a-z][a-z0-9-]*$/.test(type)
+const abort = code => { throw new GraphError(code) }
+const recordLimit = 4096
+const normalizedHeader = header => ({ ...header, delegationDepth: header.delegationDepth ?? 0 })
+
+/** For DSH releases before appendPluginRecord. Native log positions and bytes
+ * stay intact. A separate, exact-owner journal supplies plugin facts only. */
+export class LegacySessionRecords {
+  constructor(ctx) {
+    this.ctx = ctx
+    this.projected = new WeakMap()
+  }
+  binding(session) {
+    if (this.ctx.sessions.get(session.id) !== session || session.header.id !== session.id
+        || !Number.isSafeInteger(session.header.createdAt)) abort('SESSION_NOT_EXACT_LIVE_OWNER')
+    return digest({ header: normalizedHeader(session.header), inheritedEventCount: session.inheritedEventCount })
+  }
+  root(create = false) {
+    const configured = this.ctx.sessionPersistence.config?.root
+    if (typeof configured !== 'string' || !path.isAbsolute(configured)) abort('LEGACY_RECORDS_REQUIRE_JSONL_ROOT')
+    if (create) fs.mkdirSync(configured, { recursive: true, mode: 0o700 })
+    return fs.realpathSync(configured)
+  }
+  directory(session, root = this.root()) { return path.join(root, '.taskgraph-session-records-v1', digest(session.id)) }
+  marker(session, root) { return path.join(root, `.taskgraph-record-${digest(session.id)}`) }
+  validate(value, binding) {
+    if (!value || value.schema !== 1 || value.binding !== binding || !Array.isArray(value.rows)
+        || value.revision !== value.rows.length || value.revision < 1 || value.revision > recordLimit
+        || digest({ schema: value.schema, binding: value.binding, revision: value.revision, rows: value.rows }) !== value.checksum)
+      abort('LEGACY_SESSION_RECORD_JOURNAL_INVALID')
+    let last = -1
+    for (const [index, row] of value.rows.entries()) {
+      if (!row?.event || !Number.isSafeInteger(row.event.time) || !Object.hasOwn(row.event, 'data')
+          || row.event.seq !== firstRecord + index || row.event.ignorable !== true || !isPluginType(row.event.type)
+          || !Number.isSafeInteger(row.anchor) || row.anchor < 0 || row.anchor >= firstRecord
+          || row.anchor < last || (row.anchor === 0 ? row.anchorDigest !== null : !/^[a-f0-9]{64}$/.test(row.anchorDigest)))
+        abort('LEGACY_SESSION_RECORD_ANCHOR_INVALID')
+      last = row.anchor
+    }
+  }
+  store(session, readOnly) {
+    const binding = this.binding(session)
+    const root = this.root(!readOnly)
+    return new FileGraphStore({ projectRoot: root, directory: this.directory(session, root), readOnly,
+      fileName: 'records.json', maximumBytes: 12 * 1024 * 1024,
+      validator: value => this.validate(value, binding),
+      updateValidator(previous, next) {
+        if (next.revision !== (previous?.revision ?? 0) + 1
+            || previous && canonical(next.rows.slice(0, -1)) !== canonical(previous.rows))
+          abort('LEGACY_SESSION_RECORD_HISTORY_CHANGED')
+      },
+    })
+  }
+  read(session, events = session.snapshotEvents()) {
+    let journal
+    try { journal = this.store(session, true).read() } catch (error) {
+      if (error.code !== 'ENOENT') throw error
+      try {
+        if (fs.existsSync(this.marker(session, this.root()))) abort('LEGACY_SESSION_RECORD_JOURNAL_MISSING')
+      } catch (missingRoot) { if (missingRoot.code !== 'ENOENT') throw missingRoot }
+      return []
+    }
+    if (!journal) {
+      // The independently written admission marker distinguishes an absent
+      // record stream from a session that has never used the plugin.
+      if (fs.existsSync(this.marker(session, this.root()))) abort('LEGACY_SESSION_RECORD_JOURNAL_MISSING')
+      return []
+    }
+    const marker = this.marker(session, this.root())
+    const fd = fs.openSync(marker, fs.constants.O_RDONLY | fs.constants.O_NOFOLLOW | fs.constants.O_NONBLOCK)
+    try {
+      const info = fs.fstatSync(fd)
+      if (!info.isFile() || info.nlink !== 1 || info.size !== 65 || fs.readFileSync(fd, 'utf8') !== journal.binding + '\n')
+        abort('LEGACY_SESSION_RECORD_BINDING_INVALID')
+    } finally { fs.closeSync(fd) }
+    const rows = journal.rows
+    for (const { anchor, anchorDigest } of rows) {
+      if (anchor < session.inheritedEventCount || anchor > events.length
+          || anchor && digest(events[anchor - 1]) !== anchorDigest)
+        abort('LEGACY_SESSION_NATIVE_ANCHOR_CHANGED')
+    }
+    return rows
+  }
+  append(session, type, data) {
+    if (!isPluginType(type)) abort('INVALID_PLUGIN_RECORD_TYPE')
+    const events = session.snapshotEvents(), anchor = events.length
+    const anchorDigest = anchor ? digest(events[anchor - 1]) : null
+    const prior = this.read(session, events)
+    if (prior.length >= recordLimit) abort('LEGACY_SESSION_RECORD_LIMIT')
+    const serialized = JSON.stringify(data)
+    if (serialized === undefined || canonical(JSON.parse(serialized)) !== canonical(data))
+      abort('LEGACY_SESSION_RECORD_DATA_INVALID')
+    const seq = firstRecord + prior.length, binding = this.binding(session)
+    const store = this.store(session, false)
+    const root = this.root()
+    const marker = this.marker(session, root)
+    if (!prior.length) {
+      const fd = fs.openSync(marker, fs.constants.O_WRONLY | fs.constants.O_CREAT | fs.constants.O_EXCL | fs.constants.O_NOFOLLOW, 0o600)
+      try { fs.writeFileSync(fd, binding + '\n'); fs.fsyncSync(fd) } finally { fs.closeSync(fd) }
+      const directory = fs.openSync(root, fs.constants.O_RDONLY | fs.constants.O_DIRECTORY)
+      try { fs.fsyncSync(directory) } finally { fs.closeSync(directory) }
+    }
+    // Compare JSON round-trip bytes before reserving a durable record.
+    // Replay consumes the same data shape that the writer observed.
+    const row = { anchor, anchorDigest, event: { type, seq, time: Date.now(), ignorable: true, data: copy(data) } }
+    store.compareAndSwap(prior.length, previous => {
+      const document = { schema: 1, binding, revision: prior.length + 1, rows: [...(previous?.rows ?? []), row] }
+      return { ...document, checksum: digest(document) }
+    })
+    return seq
+  }
+  projection(session) {
+    const events = session.snapshotEvents()
+    const rows = this.read(session, events)
+    const prior = this.projected.get(session)
+    const samePrefix = prior && prior.events.length <= events.length
+      && events[prior.events.length - 1] === prior.events.at(-1)
+      && prior.rows.length <= rows.length
+      && prior.rows.every((row, i) => canonical(row) === canonical(rows[i]))
+      && (rows.length === prior.rows.length || rows[prior.rows.length].anchor >= prior.events.length)
+    let position = samePrefix ? prior.events.length : session.inheritedEventCount
+    let state = samePrefix ? prior.state : initialState(session.header, session.inheritedEventCount)
+    for (const { anchor, event } of rows.slice(samePrefix ? prior.rows.length : 0)) {
+      while (position < anchor) state = applyEvent(state, events[position++])
+      // A synthetic record id must never widen the admitted native evidence range.
+      const lastSeq = state.lastSeq
+      state = { ...applyEvent(state, event), lastSeq }
+    }
+    while (position < events.length) state = applyEvent(state, events[position++])
+    this.projected.set(session, { events, rows, state })
+    return state
+  }
+  async verify(session, handle, proof) {
+    if (proof.seq < firstRecord) return false
+    const row = this.read(session).at(proof.seq - firstRecord)
+    if (!row || row.event.seq !== proof.seq || digest(row.event) !== proof.digest)
+      abort('LEGACY_SESSION_RECORD_PROOF_REQUIRED')
+    if (row.anchor) {
+      const { events } = await handle.read(row.anchor - 1, 1)
+      if (events.length !== 1 || events[0].seq !== row.anchor - 1 || digest(events[0]) !== row.anchorDigest)
+        abort('DURABLE_SESSION_EVENT_PROOF_REQUIRED')
+    }
+    return true
+  }
+}