granttap-mcp 0.8.4 → 0.8.6

package/apps/bridge/src/attachment-store.ts

@@ -13,6 +13,9 @@ import type { UserAttachment, UserAttachmentUpload } from "../../../packages/pro
 import { configDir } from "./config";
 
 export const ATTACHMENT_TTL_MS = 2 * 60 * 60_000;
+/** How many attachments may wait for their messages at once, and how much disk they may take. */
+export const MAX_STAGED_ATTACHMENTS = 32;
+export const MAX_STAGED_BYTES = 48 * 1_024 * 1_024;
 
 function directory(): string {
   const dir = join(configDir(), "attachments");
@@ -39,10 +42,44 @@ export function storeAttachment(upload: UserAttachmentUpload, room?: string, now
     name: upload.name, mimeType: upload.mimeType, data: upload.data, receivedAt: now,
     ...(room ? { room } : {}),
   };
-  writeFileSync(join(dir, `${id}.json`), JSON.stringify(record), { mode: 0o600 });
+  const body = JSON.stringify(record);
+  // The staging area is bounded. One attachment too large for it is refused
+  // (the message that names it is rejected and the phone sends it inline);
+  // otherwise the oldest waiting ones make room, since a message that never
+  // came is the likeliest reason they are still here.
+  if (body.length > MAX_STAGED_BYTES) return false;
+  makeRoom(dir, body.length, id);
+  writeFileSync(join(dir, `${id}.json`), body, { mode: 0o600 });
   return true;
 }
 
+function makeRoom(dir: string, incoming: number, incomingId: string): void {
+  let staged: Array<{ path: string; size: number; mtimeMs: number }> = [];
+  try {
+    staged = readdirSync(dir)
+      .filter((name) => name.endsWith(".json") && name !== `${incomingId}.json`)
+      .flatMap((name) => {
+        try {
+          const stat = statSync(join(dir, name));
+          return [{ path: join(dir, name), size: stat.size, mtimeMs: stat.mtimeMs }];
+        } catch {
+          return [];
+        }
+      })
+      .sort((left, right) => left.mtimeMs - right.mtimeMs);
+  } catch {
+    return;
+  }
+  let count = staged.length;
+  let bytes = staged.reduce((total, item) => total + item.size, 0);
+  for (const item of staged) {
+    if (count < MAX_STAGED_ATTACHMENTS && bytes + incoming <= MAX_STAGED_BYTES) break;
+    rmSync(item.path, { force: true });
+    count -= 1;
+    bytes -= item.size;
+  }
+}
+
 /** The attachment the message named, taken off disk; nothing when it never came. */
 export function takeAttachment(attachmentId: string, room?: string, now = Date.now()): UserAttachment | undefined {
   const id = safeId(attachmentId);

package/apps/bridge/src/mesh/admin.ts

@@ -0,0 +1,37 @@
+/**
+ * What the person may do to the mesh that no agent may.
+ *
+ * A claim is released by its owner, and only its owner: that is what keeps
+ * one agent from clearing another's hold on a file. It also means a claim
+ * whose owner died, or will not let go, stays until it expires. The person
+ * is not an owner and is not bound by that rule; they are the authority the
+ * rule protects. A release from the phone is therefore a command of its
+ * own, checked against the Project it names, and written down.
+ */
+import type { MeshClaimRelease, ResourceClaim } from "../../../../packages/protocol/schema";
+import type { MeshStore } from "./store";
+
+export type PersonRelease =
+  | { released: true; claim: ResourceClaim }
+  | { released: false; reason: "unknown_claim" | "other_project" };
+
+export function releaseClaimByPerson(
+  store: MeshStore,
+  request: MeshClaimRelease,
+  log: (line: string) => void = (line) => process.stderr.write(`[monitor] mesh: ${line}\n`),
+): PersonRelease {
+  // The claim must be one of this Project's: a claim id is not a secret, and
+  // a Project's person does not reach into another Project with it.
+  const inProject = store.snapshot(request.projectId)?.claims.find((item) => item.claimId === request.claimId);
+  if (!inProject) {
+    const elsewhere = store.activeClaims().some((item) => item.claimId === request.claimId);
+    log(`release of ${request.claimId} refused: ${elsewhere ? "not in this Project" : "no such claim"}`);
+    return { released: false, reason: elsewhere ? "other_project" : "unknown_claim" };
+  }
+  store.releaseClaim(request.claimId);
+  log(
+    `claim ${request.claimId} on ${inProject.resource} held by ${inProject.ownerSessionId} `
+    + `released by the person${request.reason ? `: ${request.reason}` : ""}`,
+  );
+  return { released: true, claim: inProject };
+}

package/apps/bridge/src/mesh/capsule.ts

@@ -87,7 +87,9 @@ export function buildTaskCapsule(
   };
   // A checkpoint commit is the fact the capsule carries instead of the dirty
   // tree: it holds every change the tree had, so relative to it the tree is
-  // clean. Whether the destination has that commit is its own check.
+  // clean. Whether the destination has that commit is its own check. What
+  // the commit does not hold is said too, so the destination never takes a
+  // partial checkpoint for the whole of the work.
   const described = checkpoint
     ? {
       ...capsule,
@@ -99,13 +101,38 @@ export function buildTaskCapsule(
       remainingWork: [
         `Continue from checkpoint ${checkpoint.sha.slice(0, 12)} on ${checkpoint.branch}.`,
         `Push ${checkpoint.branch} from ${computerId} if the destination does not have it.`,
+        ...checkpointRemainingWork(checkpoint, computerId),
       ],
+      importantDecisions: checkpointDecisions(checkpoint),
+      checkpoint: {
+        status: checkpoint.status,
+        files: checkpoint.files,
+        excluded: checkpoint.excluded.slice(0, 32),
+      },
     }
     : capsule;
   const parsed = TaskCapsule.safeParse(described);
   return parsed.success ? parsed.data : undefined;
 }
 
+function checkpointRemainingWork(checkpoint: Checkpoint, computerId: string): string[] {
+  if (checkpoint.excluded.length === 0) return [];
+  return [
+    `Left on ${computerId}, not in the checkpoint: ${checkpoint.excluded.slice(0, 8).join(", ")}`
+    + `${checkpoint.excluded.length > 8 ? ` (+${checkpoint.excluded.length - 8})` : ""}. `
+    + "They look like secrets; recreate them there if the work needs them.",
+  ].map((line) => line.slice(0, 1_000));
+}
+
+function checkpointDecisions(checkpoint: Checkpoint): string[] {
+  switch (checkpoint.status) {
+    case "complete": return [];
+    case "partial": return ["Checkpoint is partial: files that look like secrets stayed on the source computer."];
+    case "requires_review":
+      return ["Checkpoint needs review: the checkout was shared with other work, so the commit may carry changes that are not this Task's."];
+  }
+}
+
 function changedFilesBetween(cwd: string, from: string, to: string): string[] {
   const listed = git(cwd, ["diff", "--name-only", `${from}..${to}`]) ?? "";
   return [...new Set(listed.split("\n").map((line) => line.trim()).filter(Boolean))].slice(0, 64);

package/apps/bridge/src/mesh/checkpoint.ts

@@ -2,7 +2,7 @@ import { execFileSync } from "node:child_process";
 import { mkdtempSync, rmSync } from "node:fs";
 import { tmpdir } from "node:os";
 import { join } from "node:path";
-import { sensitivePath } from "../sessions/edit-stats";
+import { secretFilePath } from "../sessions/edit-stats";
 
 /**
  * Commit everything uncommitted to a checkpoint branch, touching nothing else.
@@ -14,12 +14,21 @@ import { sensitivePath } from "../sessions/edit-stats";
  * publishing a branch is the person's decision, and the destination says so
  * if the commit has not reached it yet.
  */
+export type CheckpointStatus = "complete" | "partial" | "requires_review";
+
 export type Checkpoint = {
   sha: string;
   branch: string;
   files: number;
-  /** Paths left out because they look like secrets; never part of a checkpoint. */
+  /** Paths left out because they are secrets by name; never part of a checkpoint. */
   excluded: string[];
+  /**
+   * complete: every uncommitted change is in the commit. partial: secrets
+   * stayed behind, named in `excluded`. requires_review: the checkout was
+   * shared with other work, so the commit may carry changes that are not
+   * this Task's; the person decides.
+   */
+  status: CheckpointStatus;
 };
 
 export const CHECKPOINT_BRANCH_PREFIX = "granttap/checkpoint/";
@@ -34,13 +43,16 @@ function git(cwd: string, args: string[], env: NodeJS.ProcessEnv = process.env):
 /**
  * One branch per checkpoint, not per Task. A Task handed off twice used to
  * force-move the same branch, and the first checkpoint's commit was left
- * unreachable; a stamp on the name keeps each one.
+ * unreachable. The name carries the moment to the millisecond: the same
+ * request tried again lands on the same branch, two requests never do.
  */
 export function checkpointBranchName(taskId: string, at?: number): string {
   const base = CHECKPOINT_BRANCH_PREFIX + taskId.replace(/[^A-Za-z0-9._-]/g, "-").slice(0, 64);
   if (at == null) return base;
-  const stamp = new Date(at).toISOString().replace(/[-:]/g, "").replace(/\.\d+Z$/, "");
-  return `${base}-${stamp}`;
+  const iso = new Date(at).toISOString();
+  const stamp = iso.slice(0, 19).replace(/[-:]/g, "");
+  const millis = iso.slice(20, 23);
+  return `${base}-${stamp}-${millis}`;
 }
 
 export function createCheckpoint(
@@ -58,9 +70,9 @@ export function createCheckpoint(
     git(cwd, ["add", "-A"], env);
     // A checkpoint is the whole checkout's uncommitted work, so an .env or a
     // key that happened to change in it would be committed and, when the
-    // person pushes, published. Those stay as HEAD has them.
+    // person pushes, published. Those stay as HEAD has them, and are named.
     const excluded = git(cwd, ["diff", "--cached", "--name-only"], env)
-      .split("\n").filter(Boolean).filter(sensitivePath);
+      .split("\n").filter(Boolean).filter(secretFilePath);
     if (excluded.length > 0) git(cwd, ["reset", "-q", "--", ...excluded], env);
     const tree = git(cwd, ["write-tree"], env);
     if (tree === git(cwd, ["rev-parse", "HEAD^{tree}"])) return undefined; // nothing to keep
@@ -69,7 +81,7 @@ export function createCheckpoint(
     const branch = checkpointBranchName(taskId, at);
     git(cwd, ["branch", "-f", branch, sha]);
     const files = git(cwd, ["diff", "--name-only", `${head}..${sha}`]).split("\n").filter(Boolean).length;
-    return { sha, branch, files, excluded };
+    return { sha, branch, files, excluded, status: excluded.length > 0 ? "partial" : "complete" };
   } catch {
     return undefined;
   } finally {

package/apps/bridge/src/mesh/journal.ts

@@ -111,13 +111,20 @@ export function markRunsDelivered(sessionId: string, at: number, only?: readonly
   }
 }
 
+/** How much of a run one line may carry: fewer files, a shorter outcome, when room is short. */
+export type RunDescriptionLimits = { files?: number; outcome?: number };
+
 /** One line a person or a model can read: what was asked, what happened, what it touched. */
-export function describeRun(record: RunRecord): string {
-  const parts = [`«${record.prompt}» → ${record.ok ? "" : "failed: "}${record.outcome}`];
-  if (record.files.length > 0) {
-    const shown = record.files.slice(0, 6).join(", ");
-    const more = record.files.length > 6 ? ` (+${record.files.length - 6})` : "";
+export function describeRun(record: RunRecord, limits: RunDescriptionLimits = {}): string {
+  const outcome = limits.outcome == null ? record.outcome : compactText(record.outcome, limits.outcome);
+  const parts = [`«${record.prompt}» → ${record.ok ? "" : "failed: "}${outcome}`];
+  const files = limits.files ?? 6;
+  if (record.files.length > 0 && files > 0) {
+    const shown = record.files.slice(0, files).join(", ");
+    const more = record.files.length > files ? ` (+${record.files.length - files})` : "";
     parts.push(`wrote ${shown}${more}`);
+  } else if (record.files.length > 0) {
+    parts.push(`wrote ${record.files.length} file${record.files.length === 1 ? "" : "s"} (see the transcript)`);
   }
   if (record.tools > 0) parts.push(`${record.tools} tool call${record.tools === 1 ? "" : "s"}`);
   if (record.cutOff) {

package/apps/bridge/src/mesh/prompt-context.ts

@@ -7,17 +7,23 @@
  * `UserPromptSubmit` hook to add to the prompt — the unread journal first,
  * then the Mesh brief — so the model coordinates without being told to look.
  *
- * The text is bounded, and the bound is honoured by showing fewer runs, never
- * by cutting the text: a run is marked read only once it was actually shown,
- * so what did not fit this time comes on the next turn instead of vanishing.
+ * The text is bounded, and the bound is honoured by saying less, never by
+ * cutting: fewer runs, then fewer Mesh lines, then shorter run lines. The
+ * Project's name and the way to the full map are always kept. A run is
+ * marked read only once it was actually shown, whole or in its short form;
+ * what did not fit comes on the next turn instead of vanishing.
  */
 import { liveExecutionScope } from "./capability";
-import { describeRun, markRunsDelivered, unreadRuns, type RunRecord } from "./journal";
+import {
+  describeRun, markRunsDelivered, unreadRuns, type RunDescriptionLimits, type RunRecord,
+} from "./journal";
 import { meshBrief } from "./map";
 import type { MeshSnapshot } from "../../../../packages/protocol/schema";
 
 export const MAX_CONTEXT_CHARS = 2_400;
 const MAX_RUNS_SHOWN = 5;
+/** Ever shorter ways to say one run, tried in order when room is short. */
+const COMPACTIONS: RunDescriptionLimits[] = [{}, { files: 3, outcome: 300 }, { files: 0, outcome: 120 }];
 
 export type PromptContextDeps = {
   unread: (sessionId: string) => RunRecord[];
@@ -39,22 +45,30 @@ function clock(at: number): string {
   return new Date(at).toISOString().slice(11, 16);
 }
 
-function runLines(total: number, shown: RunRecord[]): string[] {
+function runLines(total: number, shown: RunRecord[], limits: RunDescriptionLimits): string[] {
   if (shown.length === 0) return [];
   const lines = [
     `GrantTap: ${total} message${total === 1 ? "" : "s"} from the phone ${total === 1 ? "was" : "were"} `
     + "handled in this chat by background runs since your last turn. Their turns are in the transcript but not in your context:",
   ];
   shown.forEach((run, index) => {
-    lines.push(`${index + 1}. [${clock(run.at)}] ${describeRun(run)}`);
+    lines.push(`${index + 1}. [${clock(run.at)}] ${describeRun(run, limits)}`);
   });
   if (total > shown.length) lines.push(`(+${total - shown.length} earlier; they follow on your next turn)`);
   lines.push("Continue from what they did; check the working tree before redoing or undoing it.");
   return lines;
 }
 
-function compose(runs: string[], brief: string[]): string {
-  return [...runs, ...(runs.length > 0 && brief.length > 0 ? [""] : []), ...brief].join("\n");
+/** The Mesh part of the prompt: the Project's name and the map are the envelope, the bullets can go. */
+type Brief = { head: string; bullets: string[]; map: string };
+
+function briefLines(brief: Brief | undefined): string[] {
+  return brief ? [brief.head, ...brief.bullets, brief.map] : [];
+}
+
+function compose(runs: string[], brief: Brief | undefined): string {
+  const mesh = briefLines(brief);
+  return [...runs, ...(runs.length > 0 && mesh.length > 0 ? [""] : []), ...mesh].join("\n");
 }
 
 /** The text to add to the next prompt of a chat, or nothing when there is nothing new. */
@@ -66,33 +80,44 @@ export function promptContext(
   if (!sessionId) return undefined;
   const runs = deps.unread(sessionId);
   const scope = deps.scope(sessionId);
-  let brief: string[] = [];
+  let brief: Brief | undefined;
   if (scope) {
     const lines = meshBrief(scope.snapshot, scope.taskId, now);
     if (lines.length > 0) {
-      brief = [
-        `Project Mesh «${scope.snapshot.project.name}»:`,
-        ...lines.map((line) => `- ${line}`),
+      brief = {
+        head: `Project Mesh «${scope.snapshot.project.name}»:`,
+        bullets: lines.map((line) => `- ${line}`),
         // Listed by name, not by token: Claude Code reads only listed resources,
         // and the server finds the chat from its own environment.
-        "Full map: read the granttap MCP resource granttap://mesh/map",
-      ];
+        map: "Full map: read the granttap MCP resource granttap://mesh/map",
+      };
     }
   }
-  if (runs.length === 0 && brief.length === 0) return undefined;
-  // The newest runs first, as many as fit; then the brief gives way, one line
-  // at a time, because it is rebuilt from the Mesh on every turn anyway.
+  if (runs.length === 0 && !brief) return undefined;
   let shown = runs.slice(-MAX_RUNS_SHOWN);
-  let text = compose(runLines(runs.length, shown), brief);
+  let limits = COMPACTIONS[0]!;
+  let text = compose(runLines(runs.length, shown, limits), brief);
+  // The newest runs first, as many as fit; then the Mesh bullets give way,
+  // because they are rebuilt from the Mesh on every turn; then each run is
+  // said more briefly. The envelope — the Project and the map — stays.
   while (text.length > MAX_CONTEXT_CHARS && shown.length > 1) {
     shown = shown.slice(1);
-    text = compose(runLines(runs.length, shown), brief);
+    text = compose(runLines(runs.length, shown, limits), brief);
+  }
+  while (text.length > MAX_CONTEXT_CHARS && brief && brief.bullets.length > 0) {
+    brief = { ...brief, bullets: brief.bullets.slice(0, -1) };
+    text = compose(runLines(runs.length, shown, limits), brief);
   }
-  while (text.length > MAX_CONTEXT_CHARS && brief.length > 2) {
-    brief = [...brief.slice(0, -2), brief[brief.length - 1]!];
-    text = compose(runLines(runs.length, shown), brief);
+  for (const compaction of COMPACTIONS.slice(1)) {
+    if (text.length <= MAX_CONTEXT_CHARS) break;
+    limits = compaction;
+    text = compose(runLines(runs.length, shown, limits), brief);
   }
-  if (text.length > MAX_CONTEXT_CHARS) text = `${text.slice(0, MAX_CONTEXT_CHARS - 1)}…`;
-  if (shown.length > 0) deps.markDelivered(sessionId, now, shown.map((run) => run.at));
+  // Bounded by construction; should a line still not fit, it is cut and the
+  // run it belongs to is left unread rather than marked as told.
+  const cut = text.length > MAX_CONTEXT_CHARS;
+  if (cut) text = `${text.slice(0, MAX_CONTEXT_CHARS - 1)}…`;
+  const told = cut ? shown.slice(0, -1) : shown;
+  if (told.length > 0) deps.markDelivered(sessionId, now, told.map((run) => run.at));
   return text;
 }

package/apps/bridge/src/mesh/runtime-handoff.ts

@@ -20,6 +20,15 @@ export function createHandoffFlow(deps: MeshRuntimeDependencies) {
       `Base SHA: ${capsule.baseSha}`,
     ];
     if (capsule.latestCommit) lines.push(`Latest commit: ${capsule.latestCommit}`);
+    if (capsule.checkpoint) {
+      const { status, files, excluded } = capsule.checkpoint;
+      const line = status === "complete"
+        ? `Checkpoint: complete (${files} file${files === 1 ? "" : "s"}).`
+        : status === "partial"
+          ? `Checkpoint: partial (${files} file${files === 1 ? "" : "s"}); left on the source computer as secrets: ${excluded.join(", ")}.`
+          : `Checkpoint: needs review (${files} file${files === 1 ? "" : "s"}); the checkout was shared with other work, so some changes may not be this task's.`;
+      lines.push(line);
+    }
     if (capsule.testsStatus) lines.push(`Tests: ${capsule.testsStatus}`);
     if (capsule.importantDecisions.length) {
       lines.push(`Important decisions:\n- ${capsule.importantDecisions.join("\n- ")}`);

package/apps/bridge/src/mesh/runtime.ts

@@ -110,10 +110,21 @@ export function createMeshRuntime(deps: MeshRuntimeDependencies) {
       }
       // Asked to checkpoint, uncommitted work is committed to a branch of its
       // own first, so the Task can leave without losing it. Nothing is pushed.
+      // The branch is named by the request's own moment, so the same request
+      // tried again lands on the same branch and two requests never do.
       const cwd = session.worktree ?? session.cwd;
-      const checkpoint = request.checkpoint && cwd && workingTreeState(cwd) === "dirty"
-        ? createCheckpoint(cwd, request.taskId, session.title ?? request.taskId, deps.now())
+      const made = request.checkpoint && cwd && workingTreeState(cwd) === "dirty"
+        ? createCheckpoint(cwd, request.taskId, session.title ?? request.taskId, request.createdAt)
         : undefined;
+      // A checkout other Tasks are working in at the same time holds their
+      // changes too; the commit cannot tell them apart, so it says so.
+      const shared = made && cwd
+        ? sessions.some((other) =>
+          other.sessionId !== session.sessionId
+          && other.taskId != null && other.taskId !== request.taskId
+          && (other.worktree ?? other.cwd) === cwd)
+        : false;
+      const checkpoint = made && shared ? { ...made, status: "requires_review" as const } : made;
       const capsule = buildTaskCapsule(deps.store(), session, request, deps.computer(), checkpoint);
       const readiness = handoffReadiness({
         capsule,

package/apps/bridge/src/mesh/store-state.ts

@@ -20,9 +20,25 @@ import {
   type TaskDependency as DependencyValue,
 } from "../../../../packages/protocol/schema";
 import { lstatSync, readFileSync } from "node:fs";
+import { z } from "zod";
+import { capsuleHash } from "./handoff";
 
 const MAX_STORE_BYTES = 4 * 1_024 * 1_024;
 
+/**
+ * A capsule rewritten when two Tasks were rejoined, on record: its hash
+ * changed with its Task id, and a receipt that names the old hash is still a
+ * receipt for it. Kept locally only; nothing on the wire carries it.
+ */
+export const CapsuleMigration = z.object({
+  at: z.number().nonnegative(),
+  taskIdFrom: z.string().min(1).max(128),
+  taskIdTo: z.string().min(1).max(128),
+  capsuleHashFrom: z.string().regex(/^[0-9a-f]{64}$/),
+  capsuleHashTo: z.string().regex(/^[0-9a-f]{64}$/),
+}).strict();
+export type CapsuleMigration = z.infer<typeof CapsuleMigration>;
+
 export type StoreState = {
   version: 1;
   projects: ProjectValue[];
@@ -34,14 +50,16 @@ export type StoreState = {
   dependencies: DependencyValue[];
   events: MeshEventValue[];
   receipts: ReceiptValue[];
+  migrations: CapsuleMigration[];
 };
 
 const EMPTY: StoreState = {
   version: 1, projects: [], bindings: [], peers: [], tasks: [], executions: [], claims: [],
-  dependencies: [], events: [], receipts: [],
+  dependencies: [], events: [], receipts: [], migrations: [],
 };
 
 export const MAX_STORE_PEERS = 256;
+export const MAX_STORE_MIGRATIONS = 64;
 
 function parsedArray<T>(value: unknown, schema: { safeParse: (input: unknown) => { success: boolean; data?: T } }): T[] {
   if (!Array.isArray(value)) return [];
@@ -98,6 +116,7 @@ export function readStoreState(path: string): StoreLoad {
         dependencies: parsedArray(value.dependencies, TaskDependency),
         events: parsedArray(value.events, MeshEvent),
         receipts: parsedArray(value.receipts, HandoffReceipt),
+        migrations: parsedArray(value.migrations, CapsuleMigration).slice(-MAX_STORE_MIGRATIONS),
       }),
     };
   } catch {
@@ -172,15 +191,39 @@ function collapseSplitChats(state: StoreState): StoreState {
     if (next.taskId === next.dependsOnTaskId) continue;
     dependencies.set(`${next.taskId}\0${next.dependsOnTaskId}`, next);
   }
+  // A capsule carries its Task id and is named by its hash; moving the id
+  // changes the hash, so every receipt that named the old hash names the new
+  // one, and the move itself is written down for a receipt still on its way.
+  const now = Date.now();
+  const migrations = new Map(state.migrations.map((item) => [item.capsuleHashFrom, item]));
+  const rehashed = new Map<string, string>();
+  const events = state.events.map((event) => {
+    const next = rescopedEvent(event, target);
+    const before = event.payload.capsule;
+    const after = next.payload.capsule;
+    if (before && after && event.taskId !== next.taskId) {
+      const from = capsuleHash(before);
+      const to = capsuleHash(after);
+      rehashed.set(from, to);
+      migrations.set(from, {
+        at: now, taskIdFrom: event.taskId, taskIdTo: next.taskId, capsuleHashFrom: from, capsuleHashTo: to,
+      });
+    }
+    return next;
+  });
+  const rehash = (hash: string): string => rehashed.get(hash) ?? hash;
   return {
     ...state,
     tasks: state.tasks.filter((task) => target(task.taskId) === task.taskId),
     executions: state.executions.map(scoped),
     claims: state.claims.map(scoped),
     dependencies: [...dependencies.values()],
-    events: state.events.map((item) => rescopedEvent(item, target)),
-    // A receipt decides who owns a chat, so it must name the surviving Task.
-    receipts: state.receipts.map(scoped),
+    events: events.map((event) => event.payload.receipt
+      ? { ...event, payload: { ...event.payload, receipt: { ...event.payload.receipt, capsuleHash: rehash(event.payload.receipt.capsuleHash) } } }
+      : event),
+    // A receipt decides who owns a chat, so it must name the surviving Task and its capsule.
+    receipts: state.receipts.map((item) => ({ ...scoped(item), capsuleHash: rehash(item.capsuleHash) })),
+    migrations: [...migrations.values()].slice(-MAX_STORE_MIGRATIONS),
   };
 }