hillclimb 0.7.0 → 0.8.0

package/dist/cli.js

@@ -1,8 +1,8 @@
 #!/usr/bin/env node
 
 // src/cli.ts
-import fs21 from "fs";
-import path23 from "path";
+import fs23 from "fs";
+import path24 from "path";
 import * as p6 from "@clack/prompts";
 
 // src/commands/init.ts
@@ -13,6 +13,7 @@ import * as p3 from "@clack/prompts";
 import fs from "fs";
 import os from "os";
 import path from "path";
+var MAX_SNAPSHOT_LIMIT_OVERRIDE_BYTES = 100 * 1024 * 1024;
 var DEFAULT_CONFIG_DIR = path.join(os.homedir(), ".hillclimb");
 function normalizeProjectConfig(raw) {
   if (!raw || typeof raw !== "object") return null;
@@ -34,9 +35,24 @@ function normalizeProjectConfig(raw) {
     workspaceName: config.workspaceName ?? projectName,
     contributionTypeSlug: config.contributionTypeSlug,
     contributionTypeName: config.contributionTypeName,
-    autoSubmit: config.autoSubmit
+    autoSubmit: config.autoSubmit,
+    snapshotLimits: normalizeSnapshotLimits(config.snapshotLimits)
   };
 }
+function normalizeSnapshotLimits(raw) {
+  if (!raw || typeof raw !== "object") return void 0;
+  const limits = { ...raw };
+  if (!isValidSnapshotLimit(limits.maxTrackedFileBytes))
+    delete limits.maxTrackedFileBytes;
+  if (!isValidSnapshotLimit(limits.maxUntrackedFileBytes))
+    delete limits.maxUntrackedFileBytes;
+  if (!isValidSnapshotLimit(limits.maxBinaryFileBytes))
+    delete limits.maxBinaryFileBytes;
+  return Object.keys(limits).length > 0 ? limits : void 0;
+}
+function isValidSnapshotLimit(value) {
+  return typeof value === "number" && Number.isInteger(value) && value > 0 && value <= MAX_SNAPSHOT_LIMIT_OVERRIDE_BYTES;
+}
 function configDir() {
   return process.env.HILLCLIMB_CONFIG_DIR ?? DEFAULT_CONFIG_DIR;
 }
@@ -72,7 +88,12 @@ async function upsertProject(repoRoot, config) {
   const file = await loadProjects();
   const normalized = normalizeProjectConfig(config);
   if (!normalized) throw new Error("Invalid project config.");
-  file.projects[path.resolve(repoRoot)] = normalized;
+  const resolvedRepoRoot = path.resolve(repoRoot);
+  const existing = file.projects[resolvedRepoRoot];
+  if (!normalized.snapshotLimits && existing?.snapshotLimits) {
+    normalized.snapshotLimits = existing.snapshotLimits;
+  }
+  file.projects[resolvedRepoRoot] = normalized;
   await saveProjects(file);
 }
 async function findProjectForCwd(cwd) {
@@ -350,6 +371,9 @@ var PlatformError = class extends Error {
     this.name = "PlatformError";
   }
 };
+function isContributionUploadNotUploaded(err) {
+  return err instanceof PlatformError && err.status === 409 && err.code === "CONTRIBUTION_UPLOAD_NOT_UPLOADED";
+}
 var PlatformClient = class {
   apiBaseUrl;
   sessionCookie;
@@ -2282,16 +2306,444 @@ async function runStatus(args = []) {
 
 // src/commands/upload.ts
 import { spawn as spawn2 } from "child_process";
-import crypto4 from "crypto";
-import fs13 from "fs";
-import os6 from "os";
-import path14 from "path";
+import crypto5 from "crypto";
+import fs15 from "fs";
+import os7 from "os";
+import path15 from "path";
+
+// src/codex-lineage.ts
+import crypto from "crypto";
+import fs7 from "fs";
+import os3 from "os";
+import path9 from "path";
 import readline from "readline";
+var MAX_PREFIX_CANDIDATES = 32;
+var MAX_CANDIDATE_BYTES = 64 * 1024 * 1024;
+var VOLATILE_KEYS = /* @__PURE__ */ new Set([
+  "timestamp",
+  "started_at",
+  "completed_at",
+  "turn_id",
+  "session_id",
+  "forked_from_id",
+  "parent_thread_id",
+  "usage",
+  "rate_limits",
+  "input_tokens",
+  "output_tokens",
+  "cached_input_tokens",
+  "total_tokens",
+  "model_context_window",
+  "context_window",
+  "sequence_number",
+  "duration_ms",
+  "elapsed_ms",
+  "latency_ms",
+  "wall_time_ms"
+]);
+function sessionsDir() {
+  return process.env.HILLCLIMB_CODEX_SESSIONS_DIR ?? path9.join(os3.homedir(), ".codex", "sessions");
+}
+function asRecord(value) {
+  return value !== null && typeof value === "object" && !Array.isArray(value) ? value : null;
+}
+function parseSessionMeta(payloadValue) {
+  const payload = asRecord(payloadValue) ?? {};
+  const source = asRecord(payload.source);
+  return {
+    id: typeof payload.id === "string" ? payload.id : null,
+    forkedFromThreadId: typeof payload.forked_from_id === "string" ? payload.forked_from_id : null,
+    isSubagent: payload.thread_source === "subagent" || source !== null && Object.hasOwn(source, "subagent")
+  };
+}
+function normalizedValue(value, depth = 0) {
+  if (typeof value === "string") return value.replace(/\r\n/g, "\n");
+  if (Array.isArray(value)) {
+    return value.map((item) => normalizedValue(item, depth + 1));
+  }
+  const record = asRecord(value);
+  if (!record) return value;
+  const normalized = {};
+  for (const key of Object.keys(record).sort()) {
+    if (depth === 0 && (key === "id" || key === "item_id")) continue;
+    if (VOLATILE_KEYS.has(key)) continue;
+    normalized[key] = normalizedValue(record[key], depth + 1);
+  }
+  return normalized;
+}
+function canonicalRecord(record) {
+  if (record.type !== "response_item") return null;
+  return JSON.stringify({
+    type: "response_item",
+    payload: normalizedValue(record.payload)
+  });
+}
+function eventKind(record) {
+  if (record.type !== "event_msg") return null;
+  const payload = asRecord(record.payload);
+  return typeof payload?.type === "string" ? payload.type : null;
+}
+function recordTurnId(record) {
+  const payload = asRecord(record.payload);
+  return typeof payload?.turn_id === "string" ? payload.turn_id : null;
+}
+function startTurn(turnId) {
+  return {
+    turnId,
+    hash: crypto.createHash("sha256"),
+    responseItemCount: 0
+  };
+}
+async function parseRollout(filePath, maxTurns = Number.POSITIVE_INFINITY) {
+  const stream = fs7.createReadStream(filePath, { encoding: "utf-8" });
+  const lines = readline.createInterface({
+    input: stream,
+    crlfDelay: Infinity
+  });
+  let meta = null;
+  let active = null;
+  let malformed = false;
+  const turns = [];
+  try {
+    for await (const line of lines) {
+      if (!line.trim()) continue;
+      let record;
+      try {
+        const parsed = JSON.parse(line);
+        const parsedRecord = asRecord(parsed);
+        if (!parsedRecord) {
+          malformed = true;
+          continue;
+        }
+        record = parsedRecord;
+      } catch {
+        malformed = true;
+        continue;
+      }
+      if (record.type === "session_meta") {
+        if (meta === null) meta = parseSessionMeta(record.payload);
+        continue;
+      }
+      const kind = eventKind(record);
+      const turnId = recordTurnId(record);
+      if (kind === "task_started") {
+        active = startTurn(turnId);
+      } else if (record.type === "turn_context") {
+        if (active === null || active.turnId !== null && turnId !== null && active.turnId !== turnId) {
+          active = startTurn(turnId);
+        } else if (active.turnId === null) {
+          active.turnId = turnId;
+        }
+      }
+      if (active !== null) {
+        const canonical = canonicalRecord(record);
+        if (canonical !== null) {
+          active.hash.update(canonical).update("\n");
+          active.responseItemCount++;
+        }
+      }
+      if (kind === "task_complete" || kind === "turn_aborted") {
+        if (active !== null && (active.turnId === null || turnId === null || active.turnId === turnId) && active.responseItemCount > 0) {
+          turns.push({
+            turnId: active.turnId ?? turnId,
+            sha256: active.hash.digest("hex")
+          });
+          active = null;
+          if (turns.length >= maxTurns) break;
+        }
+      }
+    }
+  } catch {
+    malformed = true;
+  } finally {
+    lines.close();
+    stream.destroy();
+  }
+  return { meta, turns, malformed, incomplete: active !== null };
+}
+async function codexSessionIdFromFile(filePath) {
+  const stream = fs7.createReadStream(filePath, { encoding: "utf-8" });
+  const lines = readline.createInterface({
+    input: stream,
+    crlfDelay: Infinity
+  });
+  try {
+    for await (const line of lines) {
+      if (!line.trim()) continue;
+      try {
+        const record = asRecord(JSON.parse(line));
+        if (record?.type !== "session_meta") return null;
+        return parseSessionMeta(record.payload).id;
+      } catch {
+        return null;
+      }
+    }
+  } catch {
+    return null;
+  } finally {
+    lines.close();
+    stream.destroy();
+  }
+  return null;
+}
+async function findCodexRolloutPath(sessionId) {
+  const candidates = [];
+  async function walk(dir) {
+    let entries;
+    try {
+      entries = await fs7.promises.readdir(dir, { withFileTypes: true });
+    } catch {
+      return;
+    }
+    for (const entry of entries) {
+      const full = path9.join(dir, entry.name);
+      if (entry.isDirectory()) {
+        await walk(full);
+      } else if (entry.isFile() && entry.name.endsWith(".jsonl") && entry.name.includes(sessionId)) {
+        candidates.push(full);
+      }
+    }
+  }
+  await walk(sessionsDir());
+  candidates.sort();
+  for (const candidate of candidates) {
+    if (await codexSessionIdFromFile(candidate) === sessionId)
+      return candidate;
+  }
+  return void 0;
+}
+function commonPrefixLength(a, b) {
+  const limit = Math.min(a.length, b.length);
+  let count = 0;
+  while (count < limit && a[count]?.sha256 === b[count]?.sha256) count++;
+  return count;
+}
+function boundary(turns, inheritedTurnCount, detectedBy) {
+  if (inheritedTurnCount <= 0 || inheritedTurnCount > turns.length) {
+    return void 0;
+  }
+  const replayPrefixSha256 = crypto.createHash("sha256").update("codex-turn-prefix-v1\0").update(String(inheritedTurnCount)).update("\0").update(
+    turns.slice(0, inheritedTurnCount).map((turn) => turn.sha256).join("\0")
+  ).digest("hex");
+  return {
+    format: "codex-turn-prefix-v1",
+    inheritedTurnCount,
+    lastInheritedTurnId: turns[inheritedTurnCount - 1]?.turnId ?? null,
+    replayPrefixSha256,
+    detectedBy
+  };
+}
+function uuidV7Timestamp(id) {
+  if (!id || !/^[0-9a-f]{8}-[0-9a-f]{4}-7[0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12}$/i.test(
+    id
+  )) {
+    return null;
+  }
+  return `${id.slice(0, 8)}${id.slice(9, 13)}`.toLowerCase();
+}
+function uuidV7ReplayBoundary(meta, turns) {
+  const childTimestamp = uuidV7Timestamp(meta.id);
+  if (!childTimestamp || turns.length === 0) return void 0;
+  const turnTimestamps = [];
+  for (const turn of turns) {
+    const timestamp = uuidV7Timestamp(turn.turnId);
+    if (!timestamp) return void 0;
+    turnTimestamps.push(timestamp);
+  }
+  let inheritedTurnCount = 0;
+  while (inheritedTurnCount < turnTimestamps.length && (turnTimestamps[inheritedTurnCount] ?? childTimestamp) < childTimestamp) {
+    inheritedTurnCount++;
+  }
+  if (inheritedTurnCount === 0) return void 0;
+  if (turnTimestamps.slice(inheritedTurnCount).some((timestamp) => timestamp < childTimestamp)) {
+    return void 0;
+  }
+  return boundary(turns, inheritedTurnCount, "signature-only");
+}
+async function earlierCandidates(childPath, childId) {
+  const childCreatedAt = uuidV7Timestamp(childId);
+  const candidates = [];
+  async function walk(dir) {
+    let entries;
+    try {
+      entries = await fs7.promises.readdir(dir, { withFileTypes: true });
+    } catch {
+      return;
+    }
+    for (const entry of entries) {
+      const full = path9.join(dir, entry.name);
+      if (entry.isDirectory()) {
+        await walk(full);
+        continue;
+      }
+      if (!entry.isFile() || !entry.name.endsWith(".jsonl")) continue;
+      if (path9.resolve(full) === path9.resolve(childPath)) continue;
+      try {
+        const stat = await fs7.promises.stat(full);
+        if (stat.size > MAX_CANDIDATE_BYTES) continue;
+        const filenameId = entry.name.match(
+          /[0-9a-f]{8}-[0-9a-f]{4}-7[0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12}/i
+        )?.[0];
+        const createdAt = uuidV7Timestamp(filenameId ?? null);
+        if (childCreatedAt !== null && (createdAt === null || createdAt >= childCreatedAt)) {
+          continue;
+        }
+        candidates.push({ filePath: full, createdAt });
+      } catch {
+      }
+    }
+  }
+  await walk(sessionsDir());
+  return candidates.sort(
+    (a, b) => (b.createdAt ?? "").localeCompare(a.createdAt ?? "") || b.filePath.localeCompare(a.filePath)
+  ).slice(0, MAX_PREFIX_CANDIDATES).map((candidate) => candidate.filePath);
+}
+function withFields(lineage) {
+  return lineage.forkedFromThreadId || lineage.replayBoundary ? lineage : void 0;
+}
+function mergeCodexLineage(existing, detected) {
+  if (!existing) return detected;
+  if (!detected) return existing;
+  if (existing.forkedFromThreadId && detected.forkedFromThreadId && existing.forkedFromThreadId !== detected.forkedFromThreadId) {
+    const existingIsDirect = !existing.replayBoundary || existing.replayBoundary.detectedBy !== "local-prefix";
+    const detectedIsDirect = !detected.replayBoundary || detected.replayBoundary.detectedBy !== "local-prefix";
+    return detectedIsDirect && !existingIsDirect ? detected : existing;
+  }
+  const confidence = {
+    "signature-only": 0,
+    "local-prefix": 1,
+    "codex-metadata": 2
+  };
+  let replayBoundary = existing.replayBoundary ?? detected.replayBoundary;
+  if (existing.replayBoundary && detected.replayBoundary) {
+    const existingConfidence = confidence[existing.replayBoundary.detectedBy];
+    const detectedConfidence = confidence[detected.replayBoundary.detectedBy];
+    if (detectedConfidence > existingConfidence || detectedConfidence === existingConfidence && detected.replayBoundary.inheritedTurnCount > existing.replayBoundary.inheritedTurnCount) {
+      replayBoundary = detected.replayBoundary;
+    }
+  }
+  return withFields({
+    forkedFromThreadId: existing.forkedFromThreadId ?? detected.forkedFromThreadId,
+    replayBoundary
+  });
+}
+async function detectCodexLineage(childPath) {
+  try {
+    const child = await parseRollout(childPath);
+    if (!child.meta?.id) return { conclusive: false };
+    if (child.meta.isSubagent) return { conclusive: true };
+    const conclusive = !child.malformed && !child.incomplete;
+    const metadataParent = child.meta.forkedFromThreadId;
+    if (metadataParent && metadataParent !== child.meta.id) {
+      if (child.malformed) {
+        return {
+          conclusive: false,
+          lineage: { forkedFromThreadId: metadataParent }
+        };
+      }
+      const parentPath = await findCodexRolloutPath(metadataParent);
+      if (parentPath) {
+        const parent = await parseRollout(parentPath, child.turns.length);
+        if (!parent.malformed && !parent.incomplete) {
+          const inheritedTurnCount = commonPrefixLength(
+            parent.turns,
+            child.turns
+          );
+          const replayBoundary = boundary(
+            child.turns,
+            inheritedTurnCount,
+            "codex-metadata"
+          );
+          return {
+            conclusive,
+            lineage: withFields({
+              forkedFromThreadId: metadataParent,
+              replayBoundary: replayBoundary ?? uuidV7ReplayBoundary(child.meta, child.turns)
+            })
+          };
+        }
+      }
+      return {
+        conclusive: false,
+        lineage: withFields({
+          forkedFromThreadId: metadataParent,
+          replayBoundary: uuidV7ReplayBoundary(child.meta, child.turns)
+        })
+      };
+    }
+    if (child.malformed) return { conclusive: false };
+    const signatureOnly = uuidV7ReplayBoundary(child.meta, child.turns);
+    if (child.turns.length < 2) {
+      return {
+        conclusive,
+        lineage: withFields({ replayBoundary: signatureOnly })
+      };
+    }
+    const matches = [];
+    const childCreatedAt = uuidV7Timestamp(child.meta.id);
+    if (childCreatedAt === null) {
+      return {
+        conclusive,
+        lineage: withFields({ replayBoundary: signatureOnly })
+      };
+    }
+    for (const candidatePath of await earlierCandidates(
+      childPath,
+      child.meta.id
+    )) {
+      const candidate = await parseRollout(candidatePath, child.turns.length);
+      if (candidate.malformed || !candidate.meta?.id || candidate.meta.isSubagent || candidate.meta.id === child.meta.id) {
+        continue;
+      }
+      const candidateCreatedAt = uuidV7Timestamp(candidate.meta.id);
+      if (candidateCreatedAt === null || candidateCreatedAt >= childCreatedAt) {
+        continue;
+      }
+      const inheritedTurnCount = commonPrefixLength(
+        candidate.turns,
+        child.turns
+      );
+      if (inheritedTurnCount > 0 && inheritedTurnCount < child.turns.length) {
+        matches.push({
+          parentId: candidate.meta.id,
+          inheritedTurnCount
+        });
+      }
+    }
+    if (matches.length === 0) {
+      return {
+        conclusive,
+        lineage: withFields({ replayBoundary: signatureOnly })
+      };
+    }
+    const bestCount = Math.max(
+      ...matches.map((match) => match.inheritedTurnCount)
+    );
+    const best = matches.filter(
+      (match) => match.inheritedTurnCount === bestCount
+    );
+    if (best.length === 1 && bestCount >= 2) {
+      return {
+        conclusive,
+        lineage: {
+          forkedFromThreadId: best[0]?.parentId,
+          replayBoundary: boundary(child.turns, bestCount, "local-prefix")
+        }
+      };
+    }
+    return {
+      conclusive,
+      lineage: withFields({ replayBoundary: signatureOnly })
+    };
+  } catch {
+    return { conclusive: false };
+  }
+}
 
 // src/debug-logs.ts
-import crypto from "crypto";
-import fs10 from "fs";
-import path12 from "path";
+import crypto2 from "crypto";
+import fs12 from "fs";
+import path13 from "path";
 
 // src/hook-events.ts
 function classifyHookEvent(event) {
@@ -2340,21 +2792,73 @@ function inferSourceToolFromPayload(payload) {
 function fallbackSourceTool(payload) {
   const inferred = inferSourceToolFromPayload(payload);
   if (inferred) return inferred;
-  const eventKind = classifyHookEvent(payload.hook_event_name);
-  if (eventKind === "stop") return "codex";
+  const eventKind2 = classifyHookEvent(payload.hook_event_name);
+  if (eventKind2 === "stop") return "codex";
   return "claude";
 }
 
+// src/lock-reap.ts
+import fs8 from "fs";
+function isProcessAlive(pid) {
+  try {
+    process.kill(pid, 0);
+    return true;
+  } catch (err) {
+    return err.code === "EPERM";
+  }
+}
+async function readLockPid(lockPath) {
+  let contents;
+  try {
+    contents = await fs8.promises.readFile(lockPath, "utf-8");
+  } catch {
+    return null;
+  }
+  const value = contents.trim();
+  if (!/^[1-9]\d*$/.test(value)) return null;
+  const pid = Number(value);
+  return Number.isSafeInteger(pid) ? pid : null;
+}
+async function reapLockIfStaleImpl(lockPath, opts, beforeOwnerRecheck) {
+  let mtimeMs;
+  try {
+    mtimeMs = (await fs8.promises.stat(lockPath)).mtimeMs;
+  } catch {
+    return false;
+  }
+  const age = (opts.now ?? Date.now()) - mtimeMs;
+  if (age < (opts.graceMs ?? 15e3)) return false;
+  const ownerPid = await readLockPid(lockPath);
+  const shouldReap = ownerPid === null ? age > opts.maxAgeMs : !isProcessAlive(ownerPid) || age > opts.maxAgeMs;
+  if (!shouldReap) return false;
+  try {
+    await beforeOwnerRecheck?.(lockPath);
+  } catch {
+    return false;
+  }
+  const currentOwnerPid = await readLockPid(lockPath);
+  if (currentOwnerPid !== ownerPid) return false;
+  try {
+    await fs8.promises.unlink(lockPath);
+  } catch (err) {
+    if (err.code !== "ENOENT") return false;
+  }
+  return true;
+}
+async function reapLockIfStale(lockPath, opts) {
+  return reapLockIfStaleImpl(lockPath, opts);
+}
+
 // src/middleware/pattern-redact.ts
-import os3 from "os";
+import os4 from "os";
 import { Worker } from "worker_threads";
 
 // src/middleware/file-utils.ts
-import fs7 from "fs";
+import fs9 from "fs";
 async function checkBinary(filePath) {
   let handle = null;
   try {
-    handle = await fs7.promises.open(filePath, "r");
+    handle = await fs9.promises.open(filePath, "r");
     const buf = Buffer.alloc(8192);
     const { bytesRead } = await handle.read(buf, 0, 8192, 0);
     for (let i = 0; i < bytesRead; i++) {
@@ -2379,7 +2883,7 @@ async function readFileContent(file) {
     return { kind: "binary" };
   }
   try {
-    const content = await fs7.promises.readFile(file.absolutePath, "utf-8");
+    const content = await fs9.promises.readFile(file.absolutePath, "utf-8");
     return { kind: "text", content };
   } catch {
     return { kind: "error" };
@@ -10496,6 +11000,46 @@ var patterns_local_default = {
       name: "Hugging Face Organization API Token",
       regex: "(?:(?<![A-Za-z0-9])|(?<=\\\\[nrt]))api_org_[A-Za-z0-9]{34,40}",
       confidence: "high"
+    },
+    {
+      name: "OpenRouter API Key",
+      regex: "(?:(?<![A-Za-z0-9])|(?<=\\\\[nrt]))sk-or-v1-[a-fA-F0-9]{64}",
+      confidence: "high"
+    },
+    {
+      name: "OpenRouter API Key (generic)",
+      regex: "(?:(?<![A-Za-z0-9])|(?<=\\\\[nrt]))sk-or-[A-Za-z0-9-]{32,128}",
+      confidence: "high"
+    },
+    {
+      name: "Anthropic API Key",
+      regex: "(?:(?<![A-Za-z0-9])|(?<=\\\\[nrt]))sk-ant-[A-Za-z0-9_-]{32,256}",
+      confidence: "high"
+    },
+    {
+      name: "OpenAI Project API Key",
+      regex: "(?:(?<![A-Za-z0-9])|(?<=\\\\[nrt]))sk-proj-[A-Za-z0-9_-]{32,256}",
+      confidence: "high"
+    },
+    {
+      name: "OpenAI API Key (legacy)",
+      regex: "(?:(?<![A-Za-z0-9])|(?<=\\\\[nrt]))sk-[A-Za-z0-9]{20}T3BlbkFJ[A-Za-z0-9]{20}",
+      confidence: "high"
+    },
+    {
+      name: "sshpass Command-Line Password",
+      regex: `sshpass\\s+-p\\s*(?:'[^']{1,128}'|"[^"]{1,128}"|[^\\s'"-][^\\s'"]{0,127})`,
+      confidence: "high"
+    },
+    {
+      name: "URL Userinfo Credentials",
+      regex: ":\\/\\/([^\\s:@\\/]{1,64}:[^\\s@\\/]{1,128})@",
+      confidence: "high"
+    },
+    {
+      name: "SSH Root Host (rented GPU node)",
+      regex: "(?:(?<![A-Za-z0-9@._-])|(?<=\\\\[nrt]))root@(?:\\d{1,3}\\.){3}\\d{1,3}",
+      confidence: "high"
     }
   ]
 };
@@ -10681,7 +11225,7 @@ function redactPatternLine(line, patterns, memo, isJsonl) {
   return redactString(line, patterns);
 }
 var WORKER_COUNT = Math.min(
-  os3.availableParallelism?.() ?? os3.cpus().length,
+  os4.availableParallelism?.() ?? os4.cpus().length,
   4
 );
 var WORKER_THRESHOLD = 4;
@@ -10985,8 +11529,8 @@ var RedactMiddleware = class {
 var middleware = [];
 
 // src/middleware/secrets.ts
-import fs8 from "fs";
-import path9 from "path";
+import fs10 from "fs";
+import path10 from "path";
 var KNOWN_NON_SECRETS = /* @__PURE__ */ new Set([
   "true",
   "false",
@@ -11066,7 +11610,7 @@ async function parseEnvFile(filePath) {
   const values = [];
   let content;
   try {
-    content = await fs8.promises.readFile(filePath, "utf-8");
+    content = await fs10.promises.readFile(filePath, "utf-8");
   } catch {
     return values;
   }
@@ -11134,16 +11678,16 @@ function addWithVariants(set, value) {
 async function discoverEnvFiles(repoRoot) {
   let entries;
   try {
-    entries = await fs8.promises.readdir(repoRoot);
+    entries = await fs10.promises.readdir(repoRoot);
   } catch {
     return [];
   }
   const envFiles = [];
   for (const name of entries) {
     if (!name.startsWith(".env")) continue;
-    const filePath = path9.join(repoRoot, name);
+    const filePath = path10.join(repoRoot, name);
     try {
-      const stat = await fs8.promises.stat(filePath);
+      const stat = await fs10.promises.stat(filePath);
       if (stat.isFile()) envFiles.push(name);
     } catch {
     }
@@ -11166,7 +11710,7 @@ async function collectSecrets(repoRoot, envFiles, additionalFiles) {
     }
   }
   for (const filePath of additionalFiles) {
-    const resolved = path9.resolve(repoRoot, filePath);
+    const resolved = path10.resolve(repoRoot, filePath);
     sourceFiles.push(resolved);
     for (const value of await parseEnvFile(resolved)) {
       if (isUsableValue(value)) {
@@ -11195,25 +11739,25 @@ import { PassThrough } from "stream";
 import archiver from "archiver";
 
 // src/outputs/archive.ts
-import os4 from "os";
-import path10 from "path";
+import os5 from "os";
+import path11 from "path";
 function getSourceBaseDir(sourceName) {
-  const home = os4.homedir();
+  const home = os5.homedir();
   switch (sourceName) {
     case "claude":
-      return path10.join(home, ".claude", "projects");
+      return path11.join(home, ".claude", "projects");
     case "codex":
-      return path10.join(home, ".codex", "sessions");
+      return path11.join(home, ".codex", "sessions");
     case "debug-logs":
-      return path10.join(configDir(), "logs");
+      return path11.join(configDir(), "logs");
     default:
       return home;
   }
 }
 function archivePathFor(file) {
   const baseDir = getSourceBaseDir(file.sourceName);
-  const relativePath = file.absolutePath.startsWith(baseDir) ? path10.relative(baseDir, file.absolutePath) : path10.basename(file.absolutePath);
-  return path10.join(file.sourceName, relativePath);
+  const relativePath = file.absolutePath.startsWith(baseDir) ? path11.relative(baseDir, file.absolutePath) : path11.basename(file.absolutePath);
+  return path11.join(file.sourceName, relativePath);
 }
 function addGroupToArchive(archive, group, selectedSources) {
   for (const file of group.files) {
@@ -11331,21 +11875,21 @@ var PlatformUploadOutput = class {
 };
 
 // src/pipeline.ts
-import fs9 from "fs";
-import path11 from "path";
+import fs11 from "fs";
+import path12 from "path";
 function canonicalizePath(p7) {
-  let resolved = path11.resolve(p7);
-  if (resolved.endsWith(path11.sep) && resolved !== path11.sep) {
+  let resolved = path12.resolve(p7);
+  if (resolved.endsWith(path12.sep) && resolved !== path12.sep) {
     resolved = resolved.slice(0, -1);
   }
   return resolved;
 }
 function computeLabel(repoPath, allPaths) {
-  const segments = repoPath.split(path11.sep).filter(Boolean);
+  const segments = repoPath.split(path12.sep).filter(Boolean);
   for (let depth = 1; depth <= segments.length; depth++) {
     const label = segments.slice(-depth).join("/");
     const matches = allPaths.filter((p7) => {
-      const s = p7.split(path11.sep).filter(Boolean);
+      const s = p7.split(path12.sep).filter(Boolean);
       return s.slice(-depth).join("/") === label;
     });
     if (matches.length === 1) return label;
@@ -11367,7 +11911,7 @@ async function mergeByRepo(files) {
   const groups = [];
   for (const [repoPath, groupFiles] of grouped) {
     const stats = await Promise.all(
-      groupFiles.map((f) => fs9.promises.stat(f.absolutePath).catch(() => null))
+      groupFiles.map((f) => fs11.promises.stat(f.absolutePath).catch(() => null))
     );
     let lastModified = /* @__PURE__ */ new Date(0);
     for (const stat of stats) {
@@ -11390,7 +11934,7 @@ async function preloadFiles(group) {
     group.files.map(async (file) => {
       if (file.content) return file;
       try {
-        const buf = await fs9.promises.readFile(file.absolutePath);
+        const buf = await fs11.promises.readFile(file.absolutePath);
         const checkLen = Math.min(buf.length, 8192);
         for (let i = 0; i < checkLen; i++) {
           if (buf[i] === 0) {
@@ -11420,10 +11964,14 @@ async function runPipeline(group, middleware2, output, options, onProgress) {
 var DEBUG_LOGS_SLUG = "debug-logs";
 var CURRENT_SCHEMA_VERSION = 1;
 var DEFAULT_WAIT_MS = 6e4;
-var LOCK_RETRIES = 100;
+var DEFAULT_LOCK_WAIT_MS = 5 * 60 * 1e3;
 var LOCK_RETRY_DELAY_MS = 100;
+var LOCK_RETRIES = Math.ceil(DEFAULT_LOCK_WAIT_MS / LOCK_RETRY_DELAY_MS);
+var STALE_LOCK_TTL_MS = 60 * 60 * 1e3;
+var EVENT_STATE_TTL_MS = 24 * 60 * 60 * 1e3;
+var SESSION_STATE_TTL_MS = 30 * 24 * 60 * 60 * 1e3;
 function stateDir() {
-  return process.env.HILLCLIMB_DEBUG_LOG_STATE_DIR ?? path12.join(configDir(), "debug-log-uploads");
+  return process.env.HILLCLIMB_DEBUG_LOG_STATE_DIR ?? path13.join(configDir(), "debug-log-uploads");
 }
 function waitMs() {
   const raw = process.env.HILLCLIMB_DEBUG_LOG_WAIT_MS;
@@ -11432,11 +11980,27 @@ function waitMs() {
   return Number.isFinite(parsed) && parsed >= 0 ? parsed : DEFAULT_WAIT_MS;
 }
 function stateFile(eventId) {
-  return path12.join(stateDir(), `${eventId}.json`);
+  return path13.join(stateDir(), `${eventId}.json`);
 }
 function lockFile(eventId) {
   return `${stateFile(eventId)}.lock`;
 }
+function sessionKey(ctx) {
+  if (!ctx.sessionId) return null;
+  return crypto2.createHash("sha256").update(
+    JSON.stringify({
+      schema: "debug-log-session-v1",
+      apiBaseUrl: ctx.config.apiBaseUrl,
+      projectId: ctx.config.projectId,
+      repoRoot: ctx.repoRoot,
+      tool: ctx.tool,
+      sessionId: ctx.sessionId
+    })
+  ).digest("hex");
+}
+function sessionStateId(key) {
+  return `session-${key}`;
+}
 function sleep2(ms) {
   return new Promise((resolve) => setTimeout(resolve, ms));
 }
@@ -11465,8 +12029,8 @@ function resolveSessionId(payload) {
 function stringOrNull(value) {
   return typeof value === "string" && value.length > 0 ? value : null;
 }
-function expectedKinds(tool, eventKind, payload) {
-  if (eventKind === "stop") {
+function expectedKinds(tool, eventKind2, payload) {
+  if (eventKind2 === "stop") {
     return new Set(
       tool === "codex" || tool === "copilot-chat" || tool === "claude" || tool === "cursor" || tool === "opencode" ? ["agent", "git"] : ["git"]
     );
@@ -11479,9 +12043,9 @@ function expectedKinds(tool, eventKind, payload) {
 async function transcriptFingerprint(payload) {
   const transcriptPath = stringOrNull(payload.transcript_path);
   if (!transcriptPath) return {};
-  const resolved = path12.resolve(transcriptPath);
+  const resolved = path13.resolve(transcriptPath);
   try {
-    const stat = await fs10.promises.stat(resolved);
+    const stat = await fs12.promises.stat(resolved);
     return {
       transcriptPath: resolved,
       transcriptMtimeMs: stat.mtimeMs,
@@ -11492,8 +12056,8 @@ async function transcriptFingerprint(payload) {
   }
 }
 async function eventContext(tool, payload) {
-  const eventKind = classifyHookEvent(payload.hook_event_name);
-  if (!eventKind) return null;
+  const eventKind2 = classifyHookEvent(payload.hook_event_name);
+  if (!eventKind2) return null;
   const cwd = resolveCwd(payload);
   if (!cwd) return null;
   const project = await findProjectForCwd(cwd);
@@ -11504,15 +12068,15 @@ async function eventContext(tool, payload) {
   if (!sessionId && !turnId && !transcriptPath) {
     return null;
   }
-  const expected = expectedKinds(tool, eventKind, payload);
-  const eventNonce = eventKind === "stop" && expected.size === 1 && expected.has("git") && !turnId && !transcriptPath ? crypto.randomBytes(8).toString("hex") : null;
+  const expected = expectedKinds(tool, eventKind2, payload);
+  const eventNonce = eventKind2 === "stop" && expected.size === 1 && expected.has("git") && !turnId && !transcriptPath ? crypto2.randomBytes(8).toString("hex") : null;
   const fingerprint = {
     schema: "debug-log-event-v1",
     apiBaseUrl: project.config.apiBaseUrl,
     projectId: project.config.projectId,
     repoRoot: project.repoRoot,
     tool,
-    eventKind,
+    eventKind: eventKind2,
     hookEventName: payload.hook_event_name ?? null,
     sessionId,
     conversationId: stringOrNull(payload.conversation_id),
@@ -11521,15 +12085,15 @@ async function eventContext(tool, payload) {
     // Only stop events without stable turn IDs need the transcript to
     // disambiguate. When a turn_id exists, including mutable transcript
     // mtime/size can split agent+git completions for the same logical event.
-    ...eventKind === "stop" && !turnId ? await transcriptFingerprint(payload) : {}
+    ...eventKind2 === "stop" && !turnId ? await transcriptFingerprint(payload) : {}
   };
-  const eventId = crypto.createHash("sha256").update(JSON.stringify(fingerprint)).digest("hex").slice(0, 32);
+  const eventId = crypto2.createHash("sha256").update(JSON.stringify(fingerprint)).digest("hex").slice(0, 32);
   return {
     eventId,
     repoRoot: project.repoRoot,
     config: project.config,
     tool,
-    eventKind,
+    eventKind: eventKind2,
     hookEventName: payload.hook_event_name ?? null,
     sessionId,
     expectedKinds: expected
@@ -11537,7 +12101,7 @@ async function eventContext(tool, payload) {
 }
 async function readState(eventId) {
   try {
-    const raw = await fs10.promises.readFile(stateFile(eventId), "utf-8");
+    const raw = await fs12.promises.readFile(stateFile(eventId), "utf-8");
     const parsed = JSON.parse(raw);
     if (parsed.schemaVersion !== CURRENT_SCHEMA_VERSION) return null;
     return parsed;
@@ -11546,37 +12110,132 @@ async function readState(eventId) {
   }
 }
 async function writeState(state) {
-  await fs10.promises.mkdir(stateDir(), { recursive: true, mode: 448 });
+  await fs12.promises.mkdir(stateDir(), { recursive: true, mode: 448 });
   const file = stateFile(state.eventId);
   const tmp = `${file}.tmp`;
-  await fs10.promises.writeFile(tmp, JSON.stringify(state, null, 2), {
+  await fs12.promises.writeFile(tmp, JSON.stringify(state, null, 2), {
     mode: 384
   });
-  await fs10.promises.rename(tmp, file);
+  await fs12.promises.rename(tmp, file);
 }
-async function acquireLock(eventId) {
-  await fs10.promises.mkdir(stateDir(), { recursive: true, mode: 448 });
-  for (let i = 0; i < LOCK_RETRIES; i++) {
+async function readSessionState(key) {
+  try {
+    const raw = await fs12.promises.readFile(
+      stateFile(sessionStateId(key)),
+      "utf-8"
+    );
+    const parsed = JSON.parse(raw);
+    if (parsed.schemaVersion !== CURRENT_SCHEMA_VERSION || parsed.sessionKey !== key || typeof parsed.contributionId !== "string") {
+      return null;
+    }
+    return parsed;
+  } catch {
+    return null;
+  }
+}
+async function writeSessionState(state) {
+  await fs12.promises.mkdir(stateDir(), { recursive: true, mode: 448 });
+  const file = stateFile(sessionStateId(state.sessionKey));
+  const tmp = `${file}.tmp`;
+  await fs12.promises.writeFile(tmp, JSON.stringify(state, null, 2), {
+    mode: 384
+  });
+  await fs12.promises.rename(tmp, file);
+}
+async function deleteSessionState(key) {
+  try {
+    await fs12.promises.unlink(stateFile(sessionStateId(key)));
+  } catch (err) {
+    if (err.code !== "ENOENT") throw err;
+  }
+}
+async function tryCreateLock(lockId) {
+  try {
+    const fd = await fs12.promises.open(
+      lockFile(lockId),
+      fs12.constants.O_CREAT | fs12.constants.O_EXCL | fs12.constants.O_WRONLY
+    );
     try {
-      const fd = await fs10.promises.open(
-        lockFile(eventId),
-        fs10.constants.O_CREAT | fs10.constants.O_EXCL | fs10.constants.O_WRONLY
-      );
       await fd.write(String(process.pid));
+    } finally {
       await fd.close();
+    }
+    return true;
+  } catch (err) {
+    if (err.code === "EEXIST") return false;
+    throw err;
+  }
+}
+async function acquireLock(eventId) {
+  await fs12.promises.mkdir(stateDir(), { recursive: true, mode: 448 });
+  for (let i = 0; i < LOCK_RETRIES; i++) {
+    if (await tryCreateLock(eventId)) return;
+    if (await reapLockIfStale(lockFile(eventId), {
+      maxAgeMs: STALE_LOCK_TTL_MS
+    }) && await tryCreateLock(eventId)) {
       return;
-    } catch (err) {
-      if (err.code === "EEXIST" && i < LOCK_RETRIES - 1) {
-        await sleep2(LOCK_RETRY_DELAY_MS);
+    }
+    if (i < LOCK_RETRIES - 1) await sleep2(LOCK_RETRY_DELAY_MS);
+  }
+  throw new Error(
+    `Failed to acquire debug-log lock after ${DEFAULT_LOCK_WAIT_MS}ms (lock=${lockFile(eventId)})`
+  );
+}
+async function tryAcquireLock(eventId, now) {
+  await fs12.promises.mkdir(stateDir(), { recursive: true, mode: 448 });
+  if (await tryCreateLock(eventId)) return true;
+  if (await reapLockIfStale(lockFile(eventId), {
+    maxAgeMs: STALE_LOCK_TTL_MS,
+    now
+  })) {
+    return tryCreateLock(eventId);
+  }
+  return false;
+}
+async function sweepStaleDebugLogState(now = Date.now()) {
+  let entries;
+  try {
+    entries = await fs12.promises.readdir(stateDir(), { withFileTypes: true });
+  } catch {
+    return;
+  }
+  for (const entry of entries) {
+    if (!entry.isFile()) continue;
+    const file = path13.join(stateDir(), entry.name);
+    try {
+      if (entry.name.endsWith(".lock")) {
+        await reapLockIfStale(file, {
+          maxAgeMs: STALE_LOCK_TTL_MS,
+          now
+        });
         continue;
       }
-      throw err;
+      if (entry.name.startsWith("session-") && entry.name.endsWith(".json")) {
+        const stat2 = await fs12.promises.stat(file);
+        if (now - stat2.mtimeMs <= SESSION_STATE_TTL_MS) continue;
+        const sessionLockId = entry.name.slice(0, -".json".length);
+        if (!await tryAcquireLock(sessionLockId, now)) continue;
+        try {
+          const lockedStat = await fs12.promises.stat(file);
+          if (now - lockedStat.mtimeMs > SESSION_STATE_TTL_MS) {
+            await fs12.promises.unlink(file);
+          }
+        } finally {
+          await releaseLock(sessionLockId);
+        }
+        continue;
+      }
+      const stat = await fs12.promises.stat(file);
+      if (now - stat.mtimeMs > EVENT_STATE_TTL_MS) {
+        await fs12.promises.unlink(file);
+      }
+    } catch {
     }
   }
 }
 async function releaseLock(eventId) {
   try {
-    await fs10.promises.unlink(lockFile(eventId));
+    await fs12.promises.unlink(lockFile(eventId));
   } catch {
   }
 }
@@ -11592,7 +12251,7 @@ function initialState(ctx, now) {
     eventKind: ctx.eventKind,
     hookEventName: ctx.hookEventName,
     sessionId: ctx.sessionId,
-    logDate: path12.basename(todayLogPath(), ".log"),
+    logDate: path13.basename(todayLogPath(), ".log"),
     firstSeenAt: now.toISOString()
   };
 }
@@ -11654,7 +12313,7 @@ async function waitForExpectedKinds(ctx, state) {
 }
 async function buildMiddleware(repoRoot) {
   const envFileNames = await discoverEnvFiles(repoRoot);
-  const envFilePaths = envFileNames.map((n) => path12.join(repoRoot, n));
+  const envFilePaths = envFileNames.map((n) => path13.join(repoRoot, n));
   const secretResult = await collectSecrets(repoRoot, envFilePaths, []);
   const middleware2 = [];
   if (secretResult.values.size > 0) {
@@ -11663,21 +12322,21 @@ async function buildMiddleware(repoRoot) {
   middleware2.push(new PatternRedactMiddleware());
   return middleware2;
 }
-async function uploadDebugLog(ctx, state) {
+async function uploadDebugLog(ctx, state, sessionState, onContributionCreated) {
   const logPath = todayLogPath();
   let content;
   try {
-    content = await fs10.promises.readFile(logPath);
+    content = await fs12.promises.readFile(logPath);
   } catch (err) {
     appendLog(
       "warn",
       `debug-logs: skipped upload; log file not readable (${logPath}): ${err instanceof Error ? err.message : String(err)}`
     );
-    return null;
+    return { kind: "skipped" };
   }
   if (content.byteLength === 0) {
     appendLog("info", "debug-logs: skipped upload; log file is empty");
-    return null;
+    return { kind: "skipped" };
   }
   const identity = await loadIdentity(ctx.config.apiBaseUrl);
   if (!identity) {
@@ -11685,7 +12344,7 @@ async function uploadDebugLog(ctx, state) {
       "warn",
       `debug-logs: skipped upload; no saved login for ${ctx.config.apiBaseUrl}`
     );
-    return null;
+    return { kind: "skipped" };
   }
   const now = /* @__PURE__ */ new Date();
   appendLog(
@@ -11700,7 +12359,7 @@ async function uploadDebugLog(ctx, state) {
   };
   const group = {
     repoPath: ctx.repoRoot,
-    label: path12.basename(ctx.repoRoot),
+    label: path13.basename(ctx.repoRoot),
     files: [sourceFile],
     sourceNames: [DEBUG_LOGS_SLUG],
     lastModified: now
@@ -11708,27 +12367,44 @@ async function uploadDebugLog(ctx, state) {
   const shortSession = (ctx.sessionId ?? ctx.eventId).slice(0, 12);
   const epochSeconds = formatEpochSeconds(now);
   const label = toolLabel(ctx.tool);
-  const client = new PlatformClient(
-    ctx.config.apiBaseUrl,
-    identity.sessionCookie
-  );
-  const output = new PlatformUploadOutput({
-    client,
-    projectId: ctx.config.projectId,
-    contributionTypeSlug: DEBUG_LOGS_SLUG,
+  const sessionDescription = ctx.sessionId ? {
+    contributionTitle: `${label} debug logs ${shortSession}`,
+    contributionBody: [
+      `Session ID: ${ctx.sessionId}`,
+      `Tool: ${label}`,
+      `Repo: ${ctx.repoRoot}`,
+      "Log snapshots: complete Hillclimb daily log snapshots captured at hook events"
+    ].join("\n")
+  } : {
     contributionTitle: `${label} debug log ${shortSession} - ${epochSeconds}`,
     contributionBody: [
-      `Session ID: ${ctx.sessionId ?? "<none>"}`,
+      "Session ID: <none>",
       `Tool: ${label}`,
       `Event: ${ctx.hookEventName ?? ctx.eventKind}`,
       `Repo: ${ctx.repoRoot}`,
-      `Log: ${path12.basename(logPath)}`,
+      `Log: ${path13.basename(logPath)}`,
       `Agent done: ${state.agentDoneAt ?? "<not observed>"}`,
       `Git done: ${state.gitDoneAt ?? "<not observed>"}`,
       `Uploaded: ${now.toISOString()}`
-    ].join("\n"),
-    zipFilename: `hillclimb-debug-log-${sanitize(ctx.tool)}-${sanitize(shortSession)}-${epochSeconds}.zip`,
-    autoSubmit: true
+    ].join("\n")
+  };
+  const client = new PlatformClient(
+    ctx.config.apiBaseUrl,
+    identity.sessionCookie
+  );
+  let attemptContributionId = sessionState?.contributionId;
+  const output = new PlatformUploadOutput({
+    client,
+    projectId: ctx.config.projectId,
+    contributionTypeSlug: DEBUG_LOGS_SLUG,
+    ...sessionDescription,
+    zipFilename: `hillclimb-debug-log-${sanitize(ctx.tool)}-${sanitize(shortSession)}-${now.getTime()}-${ctx.eventId.slice(0, 8)}-${crypto2.randomBytes(6).toString("hex")}.zip`,
+    autoSubmit: !sessionState?.firstUploadSubmittedAt,
+    existingContributionId: sessionState?.contributionId,
+    onContributionCreated: onContributionCreated ? async (contributionId) => {
+      attemptContributionId = contributionId;
+      await onContributionCreated(contributionId);
+    } : void 0
   });
   try {
     const contributionId = await runPipeline(
@@ -11739,37 +12415,90 @@ async function uploadDebugLog(ctx, state) {
     );
     appendLog(
       "info",
-      `debug-logs: uploaded ${path12.basename(logPath)} to project ${ctx.config.projectSlug} (${ctx.config.projectId}) as contribution ${contributionId}`
+      `debug-logs: uploaded ${path13.basename(logPath)} to project ${ctx.config.projectSlug} (${ctx.config.projectId}) as contribution ${contributionId}`
     );
-    return contributionId;
+    return { kind: "uploaded", contributionId };
   } catch (err) {
+    if (attemptContributionId && err instanceof PlatformError && (err.status === 404 && err.code === "CONTRIBUTION_NOT_FOUND" || err.status === 409 && err.code === "CONTRIBUTION_UPLOAD_NOT_UPLOADED")) {
+      appendLog(
+        "warn",
+        `debug-logs: contribution ${attemptContributionId} abandoned after ${err.code}; the next hook event will create a fresh contribution`
+      );
+      return { kind: "abandon-session" };
+    }
     if (err instanceof PlatformError && err.status === 404) {
       appendLog(
         "warn",
         "debug-logs: upload skipped; platform does not have the debug-logs contribution type yet"
       );
-      return null;
+      return { kind: "skipped" };
     }
     appendLog(
       "error",
       `debug-logs: upload failed: ${err instanceof Error ? err.message : String(err)}`
     );
-    return null;
+    return { kind: "skipped" };
   }
 }
 async function uploadOnce(ctx, state) {
   await acquireLock(ctx.eventId);
   try {
     const latest = await readState(ctx.eventId) ?? state;
-    if (latest.uploadedAt) return;
-    const contributionId = await uploadDebugLog(ctx, latest);
-    if (!contributionId) return;
-    const uploadedAt = (/* @__PURE__ */ new Date()).toISOString();
-    await writeState({
-      ...latest,
-      uploadedAt,
-      uploadContributionId: contributionId ?? void 0
-    });
+    if (latest.uploadedAt || latest.sessionMappingAbandonedAt) return;
+    const key = sessionKey(ctx);
+    if (!key) {
+      const result = await uploadDebugLog(ctx, latest, null);
+      if (result.kind !== "uploaded") return;
+      await writeState({
+        ...latest,
+        uploadedAt: (/* @__PURE__ */ new Date()).toISOString(),
+        uploadContributionId: result.contributionId
+      });
+      return;
+    }
+    const sessionLockId = sessionStateId(key);
+    await acquireLock(sessionLockId);
+    try {
+      const currentSession = await readSessionState(key);
+      const result = await uploadDebugLog(
+        ctx,
+        latest,
+        currentSession,
+        async (contributionId) => {
+          await writeSessionState({
+            schemaVersion: CURRENT_SCHEMA_VERSION,
+            sessionKey: key,
+            contributionId,
+            createdAt: (/* @__PURE__ */ new Date()).toISOString()
+          });
+        }
+      );
+      if (result.kind === "abandon-session") {
+        await deleteSessionState(key);
+        await writeState({
+          ...latest,
+          sessionMappingAbandonedAt: (/* @__PURE__ */ new Date()).toISOString()
+        });
+        return;
+      }
+      if (result.kind !== "uploaded") return;
+      const uploadedAt = (/* @__PURE__ */ new Date()).toISOString();
+      const persisted = await readSessionState(key);
+      if (persisted?.contributionId === result.contributionId) {
+        await writeSessionState({
+          ...persisted,
+          firstUploadSubmittedAt: persisted.firstUploadSubmittedAt ?? uploadedAt,
+          lastUploadAt: uploadedAt
+        });
+      }
+      await writeState({
+        ...latest,
+        uploadedAt,
+        uploadContributionId: result.contributionId
+      });
+    } finally {
+      await releaseLock(sessionLockId);
+    }
   } finally {
     await releaseLock(ctx.eventId);
   }
@@ -11823,7 +12552,8 @@ function buildEpochMeta(params) {
     transcriptArchivePath: params.transcriptArchivePath,
     rawByteOffset: params.cursor.rawByteOffset,
     rawPrefixSha256: params.cursor.rawPrefixSha256,
-    recordedAt: new Date(params.recordedAt).toISOString()
+    recordedAt: new Date(params.recordedAt).toISOString(),
+    ...params.lineage
   };
   return Buffer.from(JSON.stringify(meta, null, 2));
 }
@@ -11852,16 +12582,16 @@ async function uploadArtifact(client, contributionId, filename, mimeType, buffer
 }
 
 // src/transcript-cursor.ts
-import crypto2 from "crypto";
-import fs11 from "fs";
+import crypto3 from "crypto";
+import fs13 from "fs";
 function sha256OfBuffer(buffer) {
-  return crypto2.createHash("sha256").update(buffer).digest("hex");
+  return crypto3.createHash("sha256").update(buffer).digest("hex");
 }
 async function hashPrefix(filePath, byteLength) {
-  const hash = crypto2.createHash("sha256");
+  const hash = crypto3.createHash("sha256");
   if (byteLength === 0) return hash;
   await new Promise((resolve, reject) => {
-    const stream = fs11.createReadStream(filePath, {
+    const stream = fs13.createReadStream(filePath, {
       start: 0,
       end: byteLength - 1
     });
@@ -11872,7 +12602,7 @@ async function hashPrefix(filePath, byteLength) {
   return hash;
 }
 async function readRange(filePath, start, end) {
-  const fd = await fs11.promises.open(filePath, "r");
+  const fd = await fs13.promises.open(filePath, "r");
   try {
     const buffer = Buffer.alloc(end - start);
     let filled = 0;
@@ -11892,7 +12622,7 @@ async function readRange(filePath, start, end) {
   }
 }
 async function evaluateTranscript(filePath, cursor) {
-  const stat = await fs11.promises.stat(filePath);
+  const stat = await fs13.promises.stat(filePath);
   if (stat.size < cursor.rawByteOffset) return { kind: "truncate" };
   const prefixHash = await hashPrefix(filePath, cursor.rawByteOffset);
   const continuation = prefixHash.copy();
@@ -11927,12 +12657,12 @@ function truncateAtLastNewline(buffer) {
 }
 async function cursorMatchesFile(filePath, cursor) {
   try {
-    const stat = await fs11.promises.stat(filePath);
+    const stat = await fs13.promises.stat(filePath);
     if (stat.size < cursor.rawByteOffset) return false;
     const prefixHash = await hashPrefix(filePath, cursor.rawByteOffset);
     if (prefixHash.digest("hex") !== cursor.rawPrefixSha256) return false;
     if (cursor.rawByteOffset === 0) return true;
-    const fd = await fs11.promises.open(filePath, "r");
+    const fd = await fs13.promises.open(filePath, "r");
     try {
       const byte = Buffer.alloc(1);
       const { bytesRead } = await fd.read(byte, 0, 1, cursor.rawByteOffset - 1);
@@ -11946,20 +12676,20 @@ async function cursorMatchesFile(filePath, cursor) {
 }
 
 // src/upload-state.ts
-import crypto3 from "crypto";
-import fs12 from "fs";
-import os5 from "os";
-import path13 from "path";
+import crypto4 from "crypto";
+import fs14 from "fs";
+import os6 from "os";
+import path14 from "path";
 var CURRENT_SCHEMA_VERSION2 = 1;
-var DEFAULT_STATE_DIR = path13.join(
-  os5.homedir(),
+var DEFAULT_STATE_DIR = path14.join(
+  os6.homedir(),
   ".hillclimb",
   "agent-uploads"
 );
-var DEFAULT_LOCK_WAIT_MS = 5 * 60 * 1e3;
+var DEFAULT_LOCK_WAIT_MS2 = 5 * 60 * 1e3;
 var DEFAULT_LOCK_RETRY_DELAY_MS = 500;
 var DEFAULT_STATE_TTL_MS = 24 * 60 * 60 * 1e3;
-var STALE_LOCK_TTL_MS = 60 * 60 * 1e3;
+var STALE_LOCK_TTL_MS2 = 60 * 60 * 1e3;
 function stateDir2() {
   return process.env.HILLCLIMB_UPLOAD_STATE_DIR ?? DEFAULT_STATE_DIR;
 }
@@ -11988,20 +12718,20 @@ function lockRetries() {
   return Math.max(
     1,
     Math.ceil(
-      readPositiveEnvMs("HILLCLIMB_UPLOAD_LOCK_WAIT_MS", DEFAULT_LOCK_WAIT_MS) / lockRetryDelayMs()
+      readPositiveEnvMs("HILLCLIMB_UPLOAD_LOCK_WAIT_MS", DEFAULT_LOCK_WAIT_MS2) / lockRetryDelayMs()
     )
   );
 }
 function stateFileFor(repoRoot, tool, sessionId) {
-  const hash = crypto3.createHash("sha256").update(`${path13.resolve(repoRoot)}\0${tool}\0${sessionId}`).digest("hex").slice(0, 16);
-  return path13.join(stateDir2(), `${hash}.json`);
+  const hash = crypto4.createHash("sha256").update(`${path14.resolve(repoRoot)}\0${tool}\0${sessionId}`).digest("hex").slice(0, 16);
+  return path14.join(stateDir2(), `${hash}.json`);
 }
 function lockFileFor(repoRoot, tool, sessionId) {
   return `${stateFileFor(repoRoot, tool, sessionId)}.lock`;
 }
 async function readUploadState(repoRoot, tool, sessionId) {
   try {
-    const raw = await fs12.promises.readFile(
+    const raw = await fs14.promises.readFile(
       stateFileFor(repoRoot, tool, sessionId),
       "utf-8"
     );
@@ -12014,20 +12744,20 @@ async function readUploadState(repoRoot, tool, sessionId) {
 }
 async function writeUploadState(state) {
   const file = stateFileFor(state.repoRoot, state.tool, state.sessionId);
-  await fs12.promises.mkdir(stateDir2(), { recursive: true, mode: 448 });
+  await fs14.promises.mkdir(stateDir2(), { recursive: true, mode: 448 });
   const tmp = `${file}.tmp`;
-  await fs12.promises.writeFile(tmp, JSON.stringify(state, null, 2), {
+  await fs14.promises.writeFile(tmp, JSON.stringify(state, null, 2), {
     mode: 384
   });
-  await fs12.promises.rename(tmp, file);
+  await fs14.promises.rename(tmp, file);
 }
 async function deleteUploadState(repoRoot, tool, sessionId) {
   try {
-    await fs12.promises.unlink(stateFileFor(repoRoot, tool, sessionId));
+    await fs14.promises.unlink(stateFileFor(repoRoot, tool, sessionId));
   } catch {
   }
   try {
-    await fs12.promises.unlink(cursorFileFor(repoRoot, tool, sessionId));
+    await fs14.promises.unlink(cursorFileFor(repoRoot, tool, sessionId));
   } catch {
   }
 }
@@ -12036,7 +12766,7 @@ function cursorFileFor(repoRoot, tool, sessionId) {
 }
 async function readCursorState(repoRoot, tool, sessionId) {
   try {
-    const raw = await fs12.promises.readFile(
+    const raw = await fs14.promises.readFile(
       cursorFileFor(repoRoot, tool, sessionId),
       "utf-8"
     );
@@ -12051,21 +12781,21 @@ async function readCursorState(repoRoot, tool, sessionId) {
 }
 async function writeCursorState(repoRoot, tool, sessionId, cursor) {
   const file = cursorFileFor(repoRoot, tool, sessionId);
-  await fs12.promises.mkdir(stateDir2(), { recursive: true, mode: 448 });
+  await fs14.promises.mkdir(stateDir2(), { recursive: true, mode: 448 });
   const tmp = `${file}.tmp`;
-  await fs12.promises.writeFile(tmp, JSON.stringify(cursor, null, 2), {
+  await fs14.promises.writeFile(tmp, JSON.stringify(cursor, null, 2), {
     mode: 384
   });
-  await fs12.promises.rename(tmp, file);
+  await fs14.promises.rename(tmp, file);
 }
 async function acquireLock2(repoRoot, tool, sessionId, retries = lockRetries(), delayMs = lockRetryDelayMs()) {
   const lockPath = lockFileFor(repoRoot, tool, sessionId);
-  await fs12.promises.mkdir(stateDir2(), { recursive: true, mode: 448 });
+  await fs14.promises.mkdir(stateDir2(), { recursive: true, mode: 448 });
   for (let i = 0; i < retries; i++) {
     try {
-      const fd = await fs12.promises.open(
+      const fd = await fs14.promises.open(
         lockPath,
-        fs12.constants.O_CREAT | fs12.constants.O_EXCL | fs12.constants.O_WRONLY
+        fs14.constants.O_CREAT | fs14.constants.O_EXCL | fs14.constants.O_WRONLY
       );
       try {
         await fd.write(String(process.pid));
@@ -12075,6 +12805,11 @@ async function acquireLock2(repoRoot, tool, sessionId, retries = lockRetries(),
       return;
     } catch (err) {
       if (err.code === "EEXIST" && i < retries - 1) {
+        if (await reapLockIfStale(lockPath, {
+          maxAgeMs: STALE_LOCK_TTL_MS2
+        })) {
+          continue;
+        }
         await new Promise((r) => setTimeout(r, delayMs));
         continue;
       }
@@ -12088,7 +12823,7 @@ async function acquireLock2(repoRoot, tool, sessionId, retries = lockRetries(),
 }
 async function releaseLock2(repoRoot, tool, sessionId) {
   try {
-    await fs12.promises.unlink(lockFileFor(repoRoot, tool, sessionId));
+    await fs14.promises.unlink(lockFileFor(repoRoot, tool, sessionId));
   } catch {
   }
 }
@@ -12100,43 +12835,27 @@ async function withUploadLock(repoRoot, tool, sessionId, fn) {
     await releaseLock2(repoRoot, tool, sessionId);
   }
 }
-function isProcessAlive(pid) {
-  try {
-    process.kill(pid, 0);
-    return true;
-  } catch (err) {
-    return err.code === "EPERM";
-  }
-}
 async function sweepStaleUploadStates(ttlMs = stateTtlMs(), now = Date.now()) {
   let entries;
   try {
-    entries = await fs12.promises.readdir(stateDir2(), { withFileTypes: true });
+    entries = await fs14.promises.readdir(stateDir2(), { withFileTypes: true });
   } catch {
     return;
   }
   for (const entry of entries) {
     if (!entry.isFile()) continue;
-    const file = path13.join(stateDir2(), entry.name);
+    const file = path14.join(stateDir2(), entry.name);
     try {
       if (entry.name.endsWith(".lock")) {
-        const raw = await fs12.promises.readFile(file, "utf-8").catch(() => "");
-        const pid = Number.parseInt(raw.trim(), 10);
-        if (Number.isInteger(pid) && pid > 0) {
-          if (!isProcessAlive(pid)) {
-            await fs12.promises.unlink(file);
-          }
-        } else {
-          const st2 = await fs12.promises.stat(file);
-          if (now - st2.mtimeMs > STALE_LOCK_TTL_MS) {
-            await fs12.promises.unlink(file);
-          }
-        }
+        await reapLockIfStale(file, {
+          maxAgeMs: STALE_LOCK_TTL_MS2,
+          now
+        });
         continue;
       }
-      const st = await fs12.promises.stat(file);
+      const st = await fs14.promises.stat(file);
       if (now - st.mtimeMs > ttlMs) {
-        await fs12.promises.unlink(file);
+        await fs14.promises.unlink(file);
       }
     } catch {
     }
@@ -12156,13 +12875,13 @@ function formatEpochSeconds2(date) {
   return String(Math.floor(date.getTime() / 1e3));
 }
 function newFlowId() {
-  return crypto4.randomBytes(3).toString("hex");
+  return crypto5.randomBytes(3).toString("hex");
 }
 function lineHasAssistant(line) {
   return line.includes('"type":"assistant"') || line.includes('"role":"assistant"') || line.includes('"type":"assistant.');
 }
 async function hasAssistantMessage(transcriptPath) {
-  const stream = fs13.createReadStream(transcriptPath, { encoding: "utf-8" });
+  const stream = fs15.createReadStream(transcriptPath, { encoding: "utf-8" });
   let buffer = "";
   try {
     for await (const chunk of stream) {
@@ -12223,53 +12942,8 @@ function summarizePayload(payload) {
     cursor_version_present: !!payload.cursor_version
   });
 }
-async function codexSessionIdFromFile(filePath) {
-  const stream = fs13.createReadStream(filePath, { encoding: "utf-8" });
-  const rl = readline.createInterface({ input: stream, crlfDelay: Infinity });
-  try {
-    for await (const line of rl) {
-      if (!line.trim()) continue;
-      try {
-        const obj = JSON.parse(line);
-        if (obj.type === "session_meta") return obj.payload?.id ?? null;
-      } catch {
-        return null;
-      }
-      return null;
-    }
-  } finally {
-    rl.close();
-    stream.destroy();
-  }
-  return null;
-}
 async function findCodexTranscriptPath(sessionId) {
-  const sessionsDir = process.env.HILLCLIMB_CODEX_SESSIONS_DIR ?? path14.join(os6.homedir(), ".codex", "sessions");
-  const candidates = [];
-  async function walk(dir) {
-    let entries;
-    try {
-      entries = await fs13.promises.readdir(dir, { withFileTypes: true });
-    } catch {
-      return;
-    }
-    for (const entry of entries) {
-      const full = path14.join(dir, entry.name);
-      if (entry.isDirectory()) {
-        await walk(full);
-      } else if (entry.isFile() && entry.name.endsWith(".jsonl") && entry.name.includes(sessionId)) {
-        candidates.push(full);
-      }
-    }
-  }
-  await walk(sessionsDir);
-  candidates.sort();
-  for (const filePath of candidates) {
-    if (await codexSessionIdFromFile(filePath) === sessionId) {
-      return filePath;
-    }
-  }
-  return void 0;
+  return findCodexRolloutPath(sessionId);
 }
 async function selfHealHook(repoRoot, tool) {
   if (process.env.HILLCLIMB_SKIP_HOOK_SELF_HEAL === "1") return;
@@ -12294,8 +12968,8 @@ function resolveCursorTranscriptPath(payload) {
   const workspace = payload.workspace_roots?.[0];
   if (!id || !workspace) return void 0;
   const encoded = workspace.replace(/^\//, "").replace(/\//g, "-");
-  return path14.join(
-    os6.homedir(),
+  return path15.join(
+    os7.homedir(),
     ".cursor",
     "projects",
     encoded,
@@ -12322,7 +12996,7 @@ async function resolveTranscriptPath(payload, sourceTool, sessionId) {
 async function runUploadInner(payload) {
   const sessionId = resolveHookSessionId(payload);
   const cwd = resolveHookCwd(payload);
-  const eventKind = classifyHookEvent(payload.hook_event_name);
+  const eventKind2 = classifyHookEvent(payload.hook_event_name);
   const recordedAt = Date.now();
   if (!sessionId || !cwd) {
     appendLog(
@@ -12348,7 +13022,7 @@ async function runUploadInner(payload) {
   payload.tool = sourceTool;
   appendLog(
     "info",
-    `[${sessionId}] payload parsed (tool=${sourceTool}, cwd=${cwd}, event=${eventKind ?? "?"})`
+    `[${sessionId}] payload parsed (tool=${sourceTool}, cwd=${cwd}, event=${eventKind2 ?? "?"})`
   );
   await selfHealHook(repoRoot, sourceTool);
   const transcriptPath = await resolveTranscriptPath(
@@ -12363,9 +13037,9 @@ async function runUploadInner(payload) {
     );
     return false;
   }
-  const transcriptResolved = path14.resolve(transcriptPath);
+  const transcriptResolved = path15.resolve(transcriptPath);
   try {
-    const stat = await fs13.promises.stat(transcriptResolved);
+    const stat = await fs15.promises.stat(transcriptResolved);
     if (!stat.isFile()) {
       appendLog(
         "warn",
@@ -12393,12 +13067,12 @@ async function runUploadInner(payload) {
     repoRoot,
     config,
     sourceTool,
-    eventKind,
+    eventKind: eventKind2,
     recordedAt
   });
 }
 var AGENT_MAX_UPLOAD_BYTES = 1024 * 1024 * 1024;
-var CLI_VERSION = "0.7.0";
+var CLI_VERSION = "0.8.0";
 function makeTranscriptGroup(repoRoot, sourceTool, transcriptPath, content) {
   const sourceFile = {
     sourceName: sourceTool,
@@ -12408,7 +13082,7 @@ function makeTranscriptGroup(repoRoot, sourceTool, transcriptPath, content) {
   };
   return {
     repoPath: repoRoot,
-    label: path14.basename(repoRoot),
+    label: path15.basename(repoRoot),
     files: [sourceFile],
     sourceNames: [sourceTool],
     lastModified: /* @__PURE__ */ new Date()
@@ -12416,7 +13090,7 @@ function makeTranscriptGroup(repoRoot, sourceTool, transcriptPath, content) {
 }
 async function buildRedactChain(repoRoot) {
   const envFileNames = await discoverEnvFiles(repoRoot);
-  const envFilePaths = envFileNames.map((n) => path14.join(repoRoot, n));
+  const envFilePaths = envFileNames.map((n) => path15.join(repoRoot, n));
   const secretResult = await collectSecrets(repoRoot, envFilePaths, []);
   const chain = [];
   if (secretResult.values.size > 0) {
@@ -12466,6 +13140,14 @@ async function handleUploadFailure(err, sessionId, repoRoot, sourceTool) {
     );
     return false;
   }
+  if (isContributionUploadNotUploaded(err)) {
+    await deleteUploadState(repoRoot, sourceTool, sessionId);
+    appendLog(
+      "warn",
+      `Session ${sessionId} upload failed: storage validation returned ${err.code}; contribution abandoned and local state cleared so the next hook uploads a complete snapshot to a fresh contribution.`
+    );
+    return false;
+  }
   appendLog(
     "error",
     `Session ${sessionId} upload failed: ${err instanceof Error ? err.message : String(err)}`
@@ -12479,13 +13161,24 @@ async function uploadSession(args) {
     repoRoot,
     config,
     sourceTool,
-    eventKind,
+    eventKind: eventKind2,
     recordedAt
   } = args;
-  const isSessionEnd = eventKind === "sessionEnd";
+  const isSessionEnd = eventKind2 === "sessionEnd";
   const eventLabel = isSessionEnd ? "SessionEnd" : "Stop";
   return await withUploadLock(repoRoot, sourceTool, sessionId, async () => {
     const prior = await readUploadState(repoRoot, sourceTool, sessionId);
+    const lineageDetection = sourceTool === "codex" && prior?.codexLineageChecked !== true ? await detectCodexLineage(transcriptPath) : void 0;
+    const codexLineage = sourceTool === "codex" ? mergeCodexLineage(prior?.codexLineage, lineageDetection?.lineage) : void 0;
+    const codexLineageChecked = sourceTool === "codex" ? prior?.codexLineageChecked === true || lineageDetection?.conclusive === true : void 0;
+    const lineageNeedsStamp = codexLineage !== void 0 && JSON.stringify(codexLineage) !== JSON.stringify(prior?.codexLineageStamped);
+    if (prior && sourceTool === "codex" && (JSON.stringify(codexLineage) !== JSON.stringify(prior.codexLineage) || codexLineageChecked !== prior.codexLineageChecked)) {
+      await writeUploadState({
+        ...prior,
+        codexLineage,
+        codexLineageChecked
+      });
+    }
     let cursor = null;
     let adoptedLegacy = false;
     let restored = null;
@@ -12539,16 +13232,22 @@ async function uploadSession(args) {
     if (cursor) {
       const evaluation = await evaluateTranscript(transcriptPath, cursor);
       if (evaluation.kind === "unchanged") {
-        appendLog(
-          "info",
-          `[${sessionId}] skipping ${sourceTool} ${eventLabel} upload (no new complete transcript lines past offset ${cursor.rawByteOffset}${isSessionEnd ? "; local state cleared" : ""})`
-        );
-        if (isSessionEnd) {
-          await deleteUploadState(repoRoot, sourceTool, sessionId);
+        if (lineageNeedsStamp && prior?.contributionId && prior.epochMeta) {
+          mode = "meta-refresh";
+        } else if (lineageNeedsStamp) {
+          mode = "snapshot";
+          transition = "state-lost";
+        } else {
+          appendLog(
+            "info",
+            `[${sessionId}] skipping ${sourceTool} ${eventLabel} upload (no new complete transcript lines past offset ${cursor.rawByteOffset}${isSessionEnd ? "; local state cleared" : ""})`
+          );
+          if (isSessionEnd) {
+            await deleteUploadState(repoRoot, sourceTool, sessionId);
+          }
+          return true;
         }
-        return true;
-      }
-      if (evaluation.kind === "append") {
+      } else if (evaluation.kind === "append") {
         mode = "patch";
         tail = evaluation.tail;
         nextCursor = evaluation.nextCursor;
@@ -12580,6 +13279,51 @@ async function uploadSession(args) {
     });
     const alreadySubmitted = prior?.submitted ?? false;
     const submitThisUpload = config.autoSubmit && !alreadySubmitted;
+    if (mode === "meta-refresh" && prior?.contributionId && prior.epochMeta && cursor) {
+      const epoch2 = prior.epoch ?? restored?.epoch ?? 1;
+      try {
+        await uploadArtifact(
+          client,
+          prior.contributionId,
+          metaFilename(epoch2, recordedAt),
+          "application/json",
+          buildEpochMeta({
+            sessionId,
+            tool: sourceTool,
+            cliVersion: CLI_VERSION,
+            epoch: epoch2,
+            transitionKind: prior.epochMeta.transitionKind,
+            baseline: prior.epochMeta.baseline,
+            snapshotFilename: prior.epochMeta.snapshotFilename,
+            transcriptArchivePath: prior.epochMeta.transcriptArchivePath,
+            cursor: {
+              rawByteOffset: prior.epochMeta.rawByteOffset,
+              rawPrefixSha256: prior.epochMeta.rawPrefixSha256
+            },
+            recordedAt,
+            lineage: codexLineage
+          })
+        );
+      } catch (err) {
+        return handleUploadFailure(err, sessionId, repoRoot, sourceTool);
+      }
+      await writeUploadState({
+        ...prior,
+        lastUploadedAt: now.toISOString(),
+        uploadCount: prior.uploadCount + 1,
+        codexLineage,
+        codexLineageChecked,
+        codexLineageStamped: codexLineage
+      });
+      appendLog(
+        "info",
+        `[${sessionId}] refreshed ${sourceTool} lineage meta for unchanged epoch=${epoch2}`
+      );
+      if (isSessionEnd) {
+        await deleteUploadState(repoRoot, sourceTool, sessionId);
+      }
+      return true;
+    }
     if (mode === "patch" && cursor && tail && nextCursor && prior?.contributionId) {
       const baseCursor = cursor;
       const contributionId2 = prior.contributionId;
@@ -12589,6 +13333,9 @@ async function uploadSession(args) {
         "info",
         `[${sessionId}] ${sourceTool} ${eventLabel} upload \u2192 patch epoch=${epoch2} turn=${turn} (${tail.length} raw tail bytes, contribution ${contributionId2})`
       );
+      let metaUploaded2 = 0;
+      let codexLineageStamped2 = prior.codexLineageStamped;
+      let epochMeta2 = prior.epochMeta;
       try {
         const redactedTail = await redactTail(
           tail,
@@ -12598,6 +13345,13 @@ async function uploadSession(args) {
           redactChain
         );
         if (adoptedLegacy) {
+          epochMeta2 = {
+            transitionKind: "legacy-adopted",
+            baseline: "legacy-latest-zip",
+            transcriptArchivePath,
+            rawByteOffset: baseCursor.rawByteOffset,
+            rawPrefixSha256: baseCursor.rawPrefixSha256
+          };
           await uploadArtifact(
             client,
             contributionId2,
@@ -12612,9 +13366,12 @@ async function uploadSession(args) {
               baseline: "legacy-latest-zip",
               transcriptArchivePath,
               cursor: baseCursor,
-              recordedAt
+              recordedAt,
+              lineage: codexLineage
             })
           );
+          metaUploaded2 = 1;
+          codexLineageStamped2 = codexLineage;
         }
         await uploadArtifact(
           client,
@@ -12636,7 +13393,7 @@ async function uploadSession(args) {
           projectId: config.projectId,
           contributionId: contributionId2,
           submitted: submitted2,
-          uploadCount: (prior.uploadCount ?? 0) + (adoptedLegacy ? 2 : 1),
+          uploadCount: (prior.uploadCount ?? 0) + 1 + metaUploaded2,
           firstUploadedAt: prior.firstUploadedAt ?? now.toISOString(),
           lastUploadedAt: now.toISOString(),
           // Mirrors the cursor from here on: describes the raw bytes covered
@@ -12649,7 +13406,11 @@ async function uploadSession(args) {
           turnCount: turn,
           rawByteOffset: nextCursor.rawByteOffset,
           rawPrefixSha256: nextCursor.rawPrefixSha256,
-          snapshotUploaded: true
+          snapshotUploaded: true,
+          codexLineage,
+          codexLineageChecked,
+          codexLineageStamped: codexLineageStamped2,
+          epochMeta: epochMeta2
         });
         await writeCursorState(repoRoot, sourceTool, sessionId, {
           contributionId: contributionId2,
@@ -12661,6 +13422,45 @@ async function uploadSession(args) {
         });
       };
       await persistState(alreadySubmitted);
+      if (!adoptedLegacy && codexLineage && epochMeta2 && JSON.stringify(codexLineage) !== JSON.stringify(prior.codexLineageStamped)) {
+        try {
+          await uploadArtifact(
+            client,
+            contributionId2,
+            metaFilename(epoch2, recordedAt),
+            "application/json",
+            buildEpochMeta({
+              sessionId,
+              tool: sourceTool,
+              cliVersion: CLI_VERSION,
+              epoch: epoch2,
+              transitionKind: epochMeta2.transitionKind,
+              baseline: epochMeta2.baseline,
+              snapshotFilename: epochMeta2.snapshotFilename,
+              transcriptArchivePath: epochMeta2.transcriptArchivePath,
+              cursor: {
+                rawByteOffset: epochMeta2.rawByteOffset,
+                rawPrefixSha256: epochMeta2.rawPrefixSha256
+              },
+              recordedAt,
+              lineage: codexLineage
+            })
+          );
+          metaUploaded2 = 1;
+          codexLineageStamped2 = codexLineage;
+          await persistState(alreadySubmitted);
+        } catch (err) {
+          appendLog(
+            "warn",
+            `[${sessionId}] lineage meta refresh failed after durable patch capture; lineage remains pending: ${err instanceof Error ? err.message : String(err)}`
+          );
+        }
+      } else if (lineageNeedsStamp && !epochMeta2) {
+        appendLog(
+          "info",
+          `[${sessionId}] lineage publication deferred after durable patch capture (pre-feature state has no reconstructable epoch metadata)`
+        );
+      }
       let submitted = alreadySubmitted;
       if (submitThisUpload) {
         try {
@@ -12675,6 +13475,8 @@ async function uploadSession(args) {
               "info",
               `contribution ${contributionId2} was already submitted (409); recording locally`
             );
+          } else if (isContributionUploadNotUploaded(err)) {
+            return handleUploadFailure(err, sessionId, repoRoot, sourceTool);
           } else {
             appendLog(
               "warn",
@@ -12699,7 +13501,7 @@ async function uploadSession(args) {
     }
     let raw;
     try {
-      raw = await fs13.promises.readFile(transcriptPath);
+      raw = await fs15.promises.readFile(transcriptPath);
     } catch (err) {
       if (err.code === "ERR_FS_FILE_TOO_LARGE") {
         appendLog(
@@ -12740,6 +13542,17 @@ Tool: ${toolLabel2}
 Repo: ${repoRoot}
 Uploaded: ${now.toISOString()}`;
     const zipFilename = snapshotFilename(epoch, recordedAt);
+    const epochMeta = {
+      transitionKind: transition,
+      baseline: "snapshot",
+      snapshotFilename: zipFilename,
+      transcriptArchivePath: archivePathFor({
+        sourceName: sourceTool,
+        absolutePath: transcriptPath
+      }),
+      rawByteOffset: truncated.cursor.rawByteOffset,
+      rawPrefixSha256: truncated.cursor.rawPrefixSha256
+    };
     const group = makeTranscriptGroup(
       repoRoot,
       sourceTool,
@@ -12771,7 +13584,10 @@ Uploaded: ${now.toISOString()}`;
         firstUploadedAt: prior?.firstUploadedAt ?? now.toISOString(),
         lastUploadedAt: prior?.lastUploadedAt ?? now.toISOString(),
         lastTranscriptSize: prior?.lastTranscriptSize,
-        lastTranscriptSha256: prior?.lastTranscriptSha256
+        lastTranscriptSha256: prior?.lastTranscriptSha256,
+        codexLineage,
+        codexLineageChecked,
+        epochMeta
       })
     });
     const reuseDesc = prior?.contributionId ? `reusing contribution ${prior.contributionId}` : prior ? "new contribution (prior state had no contribution \u2014 earlier create may have failed)" : "new contribution (first upload for session)";
@@ -12788,6 +13604,7 @@ Uploaded: ${now.toISOString()}`;
       return handleUploadFailure(err, sessionId, repoRoot, sourceTool);
     }
     let metaUploaded = 0;
+    let codexLineageStamped;
     try {
       await uploadArtifact(
         client,
@@ -12804,10 +13621,12 @@ Uploaded: ${now.toISOString()}`;
           snapshotFilename: zipFilename,
           transcriptArchivePath,
           cursor: truncated.cursor,
-          recordedAt
+          recordedAt,
+          lineage: codexLineage
         })
       );
       metaUploaded = 1;
+      codexLineageStamped = codexLineage;
     } catch (err) {
       appendLog(
         "warn",
@@ -12832,7 +13651,11 @@ Uploaded: ${now.toISOString()}`;
       turnCount: 0,
       rawByteOffset: truncated.cursor.rawByteOffset,
       rawPrefixSha256: truncated.cursor.rawPrefixSha256,
-      snapshotUploaded: true
+      snapshotUploaded: true,
+      codexLineage,
+      codexLineageChecked,
+      codexLineageStamped,
+      epochMeta
     });
     await writeCursorState(repoRoot, sourceTool, sessionId, {
       contributionId,
@@ -12975,6 +13798,7 @@ async function runUploadWorker() {
     }
     try {
       await sweepStaleUploadStates();
+      await sweepStaleDebugLogState();
     } catch {
     }
   }
@@ -12982,26 +13806,58 @@ async function runUploadWorker() {
 
 // src/git-traces/index.ts
 import { spawn as spawn3 } from "child_process";
-import crypto6 from "crypto";
+import crypto7 from "crypto";
 
 // src/git-traces/handlers.ts
 import { execFileSync as execFileSync3 } from "child_process";
-import path17 from "path";
+import path18 from "path";
 
 // src/git-traces/git-ops.ts
 import { execFileSync as execFileSync2, spawnSync } from "child_process";
-import fs14 from "fs";
-import os7 from "os";
-import path15 from "path";
+import fs16 from "fs";
+import os8 from "os";
+import path16 from "path";
 import { gzipSync as gzipSync2 } from "zlib";
 var GIT_COMMAND_TIMEOUT_MS = 12e4;
 var EXEC_OPTS = {
   timeout: GIT_COMMAND_TIMEOUT_MS,
-  maxBuffer: 50 * 1024 * 1024
+  // A rewrite diff for a text file capped at ≤100 MB must fit. This transient
+  // allocation only grows as large as the actual command output.
+  maxBuffer: 256 * 1024 * 1024
 };
 var MAX_ERROR_OUTPUT_CHARS = 2e3;
-var MAX_SNAPSHOT_FILE_BYTES = 10 * 1024 * 1024;
-var MAX_BINARY_SNAPSHOT_FILE_BYTES = 1024 * 1024;
+var DEFAULT_SNAPSHOT_LIMITS = {
+  maxTrackedFileBytes: 25 * 1024 * 1024,
+  // 25 MB
+  maxUntrackedFileBytes: 10 * 1024 * 1024,
+  // 10 MB
+  maxBinaryFileBytes: 1024 * 1024
+  // 1 MB
+};
+var LEGACY_SNAPSHOT_LIMITS = {
+  maxTrackedFileBytes: 10 * 1024 * 1024,
+  maxUntrackedFileBytes: 10 * 1024 * 1024,
+  maxBinaryFileBytes: 1024 * 1024
+};
+function resolveSnapshotLimits(overrides) {
+  return {
+    maxTrackedFileBytes: positiveIntOrDefault(
+      overrides?.maxTrackedFileBytes,
+      DEFAULT_SNAPSHOT_LIMITS.maxTrackedFileBytes
+    ),
+    maxUntrackedFileBytes: positiveIntOrDefault(
+      overrides?.maxUntrackedFileBytes,
+      DEFAULT_SNAPSHOT_LIMITS.maxUntrackedFileBytes
+    ),
+    maxBinaryFileBytes: positiveIntOrDefault(
+      overrides?.maxBinaryFileBytes,
+      DEFAULT_SNAPSHOT_LIMITS.maxBinaryFileBytes
+    )
+  };
+}
+function positiveIntOrDefault(value, fallback) {
+  return typeof value === "number" && Number.isInteger(value) && value > 0 && value <= MAX_SNAPSHOT_LIMIT_OVERRIDE_BYTES ? value : fallback;
+}
 var BINARY_SNIFF_BYTES = 8e3;
 var EXCLUDED_SNAPSHOT_EXTENSIONS = /* @__PURE__ */ new Set([
   // Documents
@@ -13098,8 +13954,8 @@ var EXCLUDED_SNAPSHOT_BASENAMES = /* @__PURE__ */ new Set([
 ]);
 var EMPTY_TREE_SHA = "4b825dc642cb6eb9a060e54bf8d69288fbee4904";
 function isExcludedSnapshotPath(filePath) {
-  if (EXCLUDED_SNAPSHOT_BASENAMES.has(path15.basename(filePath))) return true;
-  return EXCLUDED_SNAPSHOT_EXTENSIONS.has(path15.extname(filePath).toLowerCase());
+  if (EXCLUDED_SNAPSHOT_BASENAMES.has(path16.basename(filePath))) return true;
+  return EXCLUDED_SNAPSHOT_EXTENSIONS.has(path16.extname(filePath).toLowerCase());
 }
 function isBinaryBuffer(buffer) {
   return buffer.includes(0);
@@ -13119,25 +13975,26 @@ function readTreeBlobHead(repoRoot, sha) {
 function readWorkingFileHead(absPath) {
   let fd = null;
   try {
-    fd = fs14.openSync(absPath, "r");
+    fd = fs16.openSync(absPath, "r");
     const buffer = Buffer.alloc(BINARY_SNIFF_BYTES);
-    const bytesRead = fs14.readSync(fd, buffer, 0, BINARY_SNIFF_BYTES, 0);
+    const bytesRead = fs16.readSync(fd, buffer, 0, BINARY_SNIFF_BYTES, 0);
     return buffer.subarray(0, bytesRead);
   } catch {
     return null;
   } finally {
     if (fd !== null) {
       try {
-        fs14.closeSync(fd);
+        fs16.closeSync(fd);
       } catch {
       }
     }
   }
 }
-function classifyOmission(filePath, sizeBytes, readHead) {
+function classifyOmission(filePath, sizeBytes, readHead, limits, tracked) {
+  const maxFileBytes = tracked ? limits.maxTrackedFileBytes : limits.maxUntrackedFileBytes;
   if (isExcludedSnapshotPath(filePath)) return "excluded-extension";
-  if (sizeBytes > MAX_SNAPSHOT_FILE_BYTES) return "file-over-limit";
-  if (sizeBytes > MAX_BINARY_SNAPSHOT_FILE_BYTES) {
+  if (sizeBytes > maxFileBytes) return "file-over-limit";
+  if (sizeBytes > limits.maxBinaryFileBytes) {
     const head = readHead();
     if (!head) {
       appendLog(
@@ -13249,12 +14106,32 @@ function deleteRef(repoRoot, refName) {
 function captureSnapshotSha(repoRoot) {
   return captureWorkingCommitSha(repoRoot);
 }
-function recordOmittedSnapshotFile(omittedFiles, file, options = {}) {
-  omittedFiles?.push(file);
-  if (options.log === false) return;
-  const action = file.tracked ? "omitting tracked" : "skipping untracked";
-  const reason = file.reason === "file-over-limit" ? `${file.sizeBytes} bytes > ${MAX_SNAPSHOT_FILE_BYTES} limit` : file.reason === "binary-over-limit" ? `binary ${file.sizeBytes} bytes > ${MAX_BINARY_SNAPSHOT_FILE_BYTES} binary limit` : "excluded extension";
-  appendLog("warn", `git-traces: ${action} ${file.path} (${reason})`);
+function formatSize(bytes) {
+  if (bytes < 1024 * 1024) return `${(bytes / 1024).toFixed(1)} KB`;
+  return `${(bytes / (1024 * 1024)).toFixed(1)} MB`;
+}
+function summarizeOmittedFiles(files) {
+  const totalBytes = files.reduce((sum, file) => sum + file.sizeBytes, 0);
+  const top = [...files].sort((a, b) => b.sizeBytes - a.sizeBytes).slice(0, 3).map((file) => `${file.path} (${formatSize(file.sizeBytes)})`).join(", ");
+  const more = files.length > 3 ? ` +${files.length - 3} more` : "";
+  const plural = files.length === 1 ? "" : "s";
+  return `${files.length} file${plural} (${formatSize(totalBytes)}): ${top}${more}`;
+}
+function logOmittedSnapshotSummary(omittedFiles) {
+  const tracked = omittedFiles.filter((file) => file.tracked);
+  const untracked = omittedFiles.filter((file) => !file.tracked);
+  if (tracked.length > 0) {
+    appendLog(
+      "warn",
+      `git-traces: snapshot omitted tracked ${summarizeOmittedFiles(tracked)} \u2014 content excluded from the baseline bundle and all diffs; full list in baseline.json git.omittedFiles`
+    );
+  }
+  if (untracked.length > 0) {
+    appendLog(
+      "info",
+      `git-traces: snapshot skipped untracked ${summarizeOmittedFiles(untracked)}; full list in baseline.json git.omittedFiles`
+    );
+  }
 }
 function parseLsTreeLongZ(output) {
   const entries = [];
@@ -13272,26 +14149,24 @@ function parseLsTreeLongZ(output) {
   }
   return entries;
 }
-function listOmittedTreeFiles(repoRoot, treeSha, options = {}) {
+function listOmittedTreeFiles(repoRoot, treeSha, limits) {
   const output = gitBuffer(repoRoot, ["ls-tree", "-r", "-l", "-z", treeSha]);
   const omitted = [];
   for (const entry of parseLsTreeLongZ(output)) {
     const reason = classifyOmission(
       entry.path,
       entry.sizeBytes,
-      () => readTreeBlobHead(repoRoot, entry.sha)
+      () => readTreeBlobHead(repoRoot, entry.sha),
+      limits,
+      true
     );
     if (!reason) continue;
-    const file = {
+    omitted.push({
       path: entry.path,
       sizeBytes: entry.sizeBytes,
       tracked: true,
       reason,
       gitObjectSha: entry.sha
-    };
-    omitted.push(file);
-    recordOmittedSnapshotFile(options.omittedFiles, file, {
-      log: options.log
     });
   }
   return omitted;
@@ -13304,10 +14179,15 @@ function removePathsFromIndex(repoRoot, env, paths) {
   });
 }
 function filterOmittedFilesFromTree(repoRoot, treeSha, options = {}) {
-  const omittedFiles = listOmittedTreeFiles(repoRoot, treeSha, options);
+  const omittedFiles = listOmittedTreeFiles(
+    repoRoot,
+    treeSha,
+    options.limits ?? DEFAULT_SNAPSHOT_LIMITS
+  );
+  options.omittedFiles?.push(...omittedFiles);
   if (omittedFiles.length === 0) return treeSha;
-  const tmpIndex = path15.join(
-    os7.tmpdir(),
+  const tmpIndex = path16.join(
+    os8.tmpdir(),
     `hillclimb-filter-${Date.now()}-${process.pid}`
   );
   const env = { ...process.env, GIT_INDEX_FILE: tmpIndex };
@@ -13321,12 +14201,13 @@ function filterOmittedFilesFromTree(repoRoot, treeSha, options = {}) {
     return gitWithEnv(repoRoot, ["write-tree"], env);
   } finally {
     try {
-      fs14.unlinkSync(tmpIndex);
+      fs16.unlinkSync(tmpIndex);
     } catch {
     }
   }
 }
-function buildUntrackedTree(repoRoot, omittedFiles) {
+function buildUntrackedTree(repoRoot, options = {}) {
+  const limits = options.limits ?? DEFAULT_SNAPSHOT_LIMITS;
   const list = git(repoRoot, [
     "ls-files",
     "--others",
@@ -13338,15 +14219,17 @@ function buildUntrackedTree(repoRoot, omittedFiles) {
   for (const relPath of list.split("\0")) {
     if (!relPath) continue;
     try {
-      const absPath = path15.join(repoRoot, relPath);
-      const stat = fs14.lstatSync(absPath);
+      const absPath = path16.join(repoRoot, relPath);
+      const stat = fs16.lstatSync(absPath);
       const reason = classifyOmission(
         relPath,
         stat.size,
-        () => readWorkingFileHead(absPath)
+        () => readWorkingFileHead(absPath),
+        limits,
+        false
       );
       if (reason) {
-        recordOmittedSnapshotFile(omittedFiles, {
+        options.omittedFiles?.push({
           path: relPath,
           sizeBytes: stat.size,
           tracked: false,
@@ -13359,8 +14242,8 @@ function buildUntrackedTree(repoRoot, omittedFiles) {
     }
   }
   if (kept.length === 0) return null;
-  const tmpIndex = path15.join(
-    os7.tmpdir(),
+  const tmpIndex = path16.join(
+    os8.tmpdir(),
     `hillclimb-untracked-${Date.now()}-${process.pid}`
   );
   const env = { ...process.env, GIT_INDEX_FILE: tmpIndex };
@@ -13372,25 +14255,26 @@ function buildUntrackedTree(repoRoot, omittedFiles) {
     return gitWithEnv(repoRoot, ["write-tree"], env);
   } finally {
     try {
-      fs14.unlinkSync(tmpIndex);
+      fs16.unlinkSync(tmpIndex);
     } catch {
     }
   }
 }
 function buildSnapshotTree(repoRoot, stashSha, options = {}) {
+  const omittedFiles = options.omittedFiles ?? [];
+  const limits = options.limits ?? DEFAULT_SNAPSHOT_LIMITS;
   const trackedTree = git(repoRoot, ["rev-parse", `${stashSha}^{tree}`]);
   const filteredTrackedTree = filterOmittedFilesFromTree(
     repoRoot,
     trackedTree,
-    {
-      omittedFiles: options.omittedFiles
-    }
+    { omittedFiles, limits }
   );
-  const untrackedTree = buildUntrackedTree(repoRoot, options.omittedFiles);
+  const untrackedTree = buildUntrackedTree(repoRoot, { omittedFiles, limits });
+  if (options.log !== false) logOmittedSnapshotSummary(omittedFiles);
   if (!untrackedTree || untrackedTree === EMPTY_TREE_SHA)
     return filteredTrackedTree;
-  const tmpIndex = path15.join(
-    os7.tmpdir(),
+  const tmpIndex = path16.join(
+    os8.tmpdir(),
     `hillclimb-index-${Date.now()}-${process.pid}`
   );
   const env = { ...process.env, GIT_INDEX_FILE: tmpIndex };
@@ -13417,7 +14301,7 @@ function buildSnapshotTree(repoRoot, stashSha, options = {}) {
     return gitWithEnv(repoRoot, ["write-tree"], env);
   } finally {
     try {
-      fs14.unlinkSync(tmpIndex);
+      fs16.unlinkSync(tmpIndex);
     } catch {
     }
   }
@@ -13431,8 +14315,8 @@ function createBundleFromTree(repoRoot, treeSha, sessionId, label) {
   ]);
   const orphanRef = `refs/hillclimb/bundle/${sessionId}`;
   pinRef(repoRoot, orphanRef, orphanCommit);
-  const tmpFile = path15.join(
-    os7.tmpdir(),
+  const tmpFile = path16.join(
+    os8.tmpdir(),
     // Include the pid (like the other temp files in this module) so concurrent
     // git-traces workers — e.g. two sessions, or a parent + subagent — don't
     // collide on the same `git bundle create` path and its `.lock`.
@@ -13440,26 +14324,24 @@ function createBundleFromTree(repoRoot, treeSha, sessionId, label) {
   );
   try {
     git(repoRoot, ["bundle", "create", tmpFile, orphanRef]);
-    return fs14.readFileSync(tmpFile);
+    return fs16.readFileSync(tmpFile);
   } finally {
     try {
-      fs14.unlinkSync(tmpFile);
+      fs16.unlinkSync(tmpFile);
     } catch {
     }
     deleteRef(repoRoot, orphanRef);
   }
 }
-function createTreeDiffPatchGz(repoRoot, fromTreeSha, toTreeSha) {
+function createTreeDiffPatchGz(repoRoot, fromTreeSha, toTreeSha, options = {}) {
   if (fromTreeSha === toTreeSha) return null;
   const filteredFromTreeSha = filterOmittedFilesFromTree(
     repoRoot,
     fromTreeSha,
-    {
-      log: false
-    }
+    { limits: options.limits }
   );
   const filteredToTreeSha = filterOmittedFilesFromTree(repoRoot, toTreeSha, {
-    log: false
+    limits: options.limits
   });
   if (filteredFromTreeSha === filteredToTreeSha) return null;
   const diff = gitBuffer(repoRoot, [
@@ -13513,7 +14395,7 @@ function parseDirtyFilesFromStatus(status) {
     return pathPart;
   }).filter(Boolean);
 }
-function buildBaselineMetadata(repoRoot, sessionId, tool, baselineSha, cliVersion, epoch, prevHeadSha, transitionKind, startedAt, omittedFiles = []) {
+function buildBaselineMetadata(repoRoot, sessionId, tool, baselineSha, cliVersion, epoch, prevHeadSha, transitionKind, startedAt, omittedFiles = [], lineage) {
   const headSha = safeGit(repoRoot, ["rev-parse", "HEAD"]) ?? "unknown";
   const branch = safeGit(repoRoot, ["rev-parse", "--abbrev-ref", "HEAD"]) ?? null;
   const remoteUrl = safeGit(repoRoot, ["config", "--get", "remote.origin.url"]) ?? null;
@@ -13541,9 +14423,10 @@ function buildBaselineMetadata(repoRoot, sessionId, tool, baselineSha, cliVersio
       ...omittedFiles.length > 0 ? { omittedFiles } : {}
     },
     author: { name: authorName, email: authorEmail },
-    hostname: os7.hostname(),
+    hostname: os8.hostname(),
     cliVersion,
-    commits
+    commits,
+    ...lineage
   };
 }
 function enumerateCommits(repoRoot, fromSha, toSha) {
@@ -13630,9 +14513,9 @@ function parseCommitFiles(repoRoot, sha) {
         oldPath
       });
     } else {
-      const path24 = parts[parts.length - 1];
-      indexByPath.set(path24, files.length);
-      files.push({ path: path24, status, additions: 0, deletions: 0 });
+      const path25 = parts[parts.length - 1];
+      indexByPath.set(path25, files.length);
+      files.push({ path: path25, status, additions: 0, deletions: 0 });
     }
   }
   for (const line of numstat.split("\n")) {
@@ -13680,7 +14563,8 @@ function cleanupSessionRefs(repoRoot, sessionId) {
   for (const prefix of [
     `refs/hillclimb/baseline/${sessionId}`,
     `refs/hillclimb/turns/${sessionId}`,
-    `refs/hillclimb/bundle/${sessionId}`
+    `refs/hillclimb/bundle/${sessionId}`,
+    `refs/hillclimb/scoped/${sessionId}`
   ]) {
     deleteRef(repoRoot, prefix);
     try {
@@ -13698,30 +14582,37 @@ function cleanupSessionRefs(repoRoot, sessionId) {
 }
 
 // src/git-traces/session-state.ts
-import crypto5 from "crypto";
-import fs15 from "fs";
-import os8 from "os";
-import path16 from "path";
+import crypto6 from "crypto";
+import fs17 from "fs";
+import os9 from "os";
+import path17 from "path";
 var CURRENT_SCHEMA_VERSION3 = 3;
-var DEFAULT_STATE_DIR2 = path16.join(os8.homedir(), ".hillclimb", "git-traces");
+var DEFAULT_STATE_DIR2 = path17.join(os9.homedir(), ".hillclimb", "git-traces");
 var LOCK_RETRIES2 = 120;
 var LOCK_RETRY_DELAY_MS2 = 500;
-var STALE_LOCK_TTL_MS2 = 60 * 60 * 1e3;
+var STALE_LOCK_TTL_MS3 = 60 * 60 * 1e3;
+var LockContentionError = class extends Error {
+  constructor(lockPath, options) {
+    super(`Lock remains held: ${lockPath}`, options);
+    this.lockPath = lockPath;
+    this.name = "LockContentionError";
+  }
+};
 function stateDir3() {
   return process.env.HILLCLIMB_GIT_TRACES_STATE_DIR ?? DEFAULT_STATE_DIR2;
 }
 function stateFileForRepo(repoRoot, tool, sessionId) {
-  const hash = crypto5.createHash("sha256").update(
-    sessionId ? `${path16.resolve(repoRoot)}\0${tool}\0${sessionId}` : `${path16.resolve(repoRoot)}\0${tool}`
+  const hash = crypto6.createHash("sha256").update(
+    sessionId ? `${path17.resolve(repoRoot)}\0${tool}\0${sessionId}` : `${path17.resolve(repoRoot)}\0${tool}`
   ).digest("hex").slice(0, 16);
-  return path16.join(stateDir3(), `${hash}.json`);
+  return path17.join(stateDir3(), `${hash}.json`);
 }
 function lockFileForRepo(repoRoot, tool, sessionId) {
   return `${stateFileForRepo(repoRoot, tool, sessionId)}.lock`;
 }
 async function readStateFile(file) {
   try {
-    const raw = await fs15.promises.readFile(file, "utf-8");
+    const raw = await fs17.promises.readFile(file, "utf-8");
     const parsed = JSON.parse(raw);
     if (parsed.schemaVersion !== CURRENT_SCHEMA_VERSION3) {
       return null;
@@ -13731,29 +14622,38 @@ async function readStateFile(file) {
     return null;
   }
 }
+async function readStoredStateFile(file) {
+  const state = await readStateFile(file);
+  if (!state) return null;
+  try {
+    return { state, mtimeMs: (await fs17.promises.stat(file)).mtimeMs };
+  } catch {
+    return null;
+  }
+}
 async function listScopedSessionStates(repoRoot, tool) {
   let entries;
   try {
-    entries = await fs15.promises.readdir(stateDir3(), { withFileTypes: true });
+    entries = await fs17.promises.readdir(stateDir3(), { withFileTypes: true });
   } catch {
     return [];
   }
   const states = [];
   for (const entry of entries) {
     if (!entry.isFile() || !entry.name.endsWith(".json")) continue;
-    const file = path16.join(stateDir3(), entry.name);
+    const file = path17.join(stateDir3(), entry.name);
     const state = await readStateFile(file);
     if (!state) continue;
     if (typeof state.repoRoot !== "string" || typeof state.sessionId !== "string") {
       continue;
     }
-    if (path16.resolve(state.repoRoot) !== path16.resolve(repoRoot)) continue;
-    if (path16.resolve(file) !== path16.resolve(stateFileForRepo(repoRoot, tool, state.sessionId))) {
+    if (path17.resolve(state.repoRoot) !== path17.resolve(repoRoot)) continue;
+    if (path17.resolve(file) !== path17.resolve(stateFileForRepo(repoRoot, tool, state.sessionId))) {
       continue;
     }
     let mtimeMs = 0;
     try {
-      mtimeMs = (await fs15.promises.stat(file)).mtimeMs;
+      mtimeMs = (await fs17.promises.stat(file)).mtimeMs;
     } catch {
       continue;
     }
@@ -13764,26 +14664,26 @@ async function listScopedSessionStates(repoRoot, tool) {
 async function listSessionStatesForSession(tool, sessionId) {
   let entries;
   try {
-    entries = await fs15.promises.readdir(stateDir3(), { withFileTypes: true });
+    entries = await fs17.promises.readdir(stateDir3(), { withFileTypes: true });
   } catch {
     return [];
   }
   const states = [];
   for (const entry of entries) {
     if (!entry.isFile() || !entry.name.endsWith(".json")) continue;
-    const file = path16.join(stateDir3(), entry.name);
+    const file = path17.join(stateDir3(), entry.name);
     const state = await readStateFile(file);
     if (!state) continue;
     if (typeof state.repoRoot !== "string" || typeof state.sessionId !== "string") {
       continue;
     }
     if (state.sessionId !== sessionId) continue;
-    if (path16.resolve(file) !== path16.resolve(stateFileForRepo(state.repoRoot, tool, sessionId))) {
+    if (path17.resolve(file) !== path17.resolve(stateFileForRepo(state.repoRoot, tool, sessionId))) {
       continue;
     }
     let mtimeMs = 0;
     try {
-      mtimeMs = (await fs15.promises.stat(file)).mtimeMs;
+      mtimeMs = (await fs17.promises.stat(file)).mtimeMs;
     } catch {
       continue;
     }
@@ -13791,7 +14691,7 @@ async function listSessionStatesForSession(tool, sessionId) {
   }
   return states;
 }
-async function readSessionState(repoRoot, tool, sessionId) {
+async function readSessionState2(repoRoot, tool, sessionId) {
   if (sessionId) {
     const scoped = await readStateFile(
       stateFileForRepo(repoRoot, tool, sessionId)
@@ -13802,108 +14702,120 @@ async function readSessionState(repoRoot, tool, sessionId) {
   }
   return readStateFile(stateFileForRepo(repoRoot, tool));
 }
-async function writeSessionState(state, tool) {
+async function readLegacySessionState(repoRoot, tool, sessionId) {
+  const legacy = await readStateFile(stateFileForRepo(repoRoot, tool));
+  return legacy?.sessionId === sessionId ? legacy : null;
+}
+async function readSessionStateCandidates(repoRoot, tool, sessionId) {
+  const [scoped, legacyCandidate] = await Promise.all([
+    readStoredStateFile(stateFileForRepo(repoRoot, tool, sessionId)),
+    readStoredStateFile(stateFileForRepo(repoRoot, tool))
+  ]);
+  return {
+    scoped,
+    legacy: legacyCandidate?.state.sessionId === sessionId ? legacyCandidate : null
+  };
+}
+async function writeSessionState2(state, tool) {
   const file = stateFileForRepo(state.repoRoot, tool, state.sessionId);
-  await fs15.promises.mkdir(stateDir3(), { recursive: true, mode: 448 });
+  await writeStateFile(file, state);
+}
+async function writeLegacySessionState(state, tool) {
+  await writeStateFile(stateFileForRepo(state.repoRoot, tool), state);
+}
+async function writeStateFile(file, state) {
+  await fs17.promises.mkdir(stateDir3(), { recursive: true, mode: 448 });
   const tmp = `${file}.tmp`;
-  await fs15.promises.writeFile(tmp, JSON.stringify(state, null, 2), {
+  await fs17.promises.writeFile(tmp, JSON.stringify(state, null, 2), {
     mode: 384
   });
-  await fs15.promises.rename(tmp, file);
-  const legacyFile = stateFileForRepo(state.repoRoot, tool);
-  const legacy = await readStateFile(legacyFile);
-  if (legacy?.sessionId === state.sessionId) {
-    await deleteStateFile(legacyFile);
-  }
+  await fs17.promises.rename(tmp, file);
 }
 async function deleteStateFile(file) {
   try {
-    await fs15.promises.unlink(file);
+    await fs17.promises.unlink(file);
   } catch {
   }
 }
-async function deleteSessionState(repoRoot, tool, sessionId) {
+async function deleteSessionState2(repoRoot, tool, sessionId) {
   if (sessionId) {
     await deleteStateFile(stateFileForRepo(repoRoot, tool, sessionId));
-    const legacyFile = stateFileForRepo(repoRoot, tool);
-    const legacy = await readStateFile(legacyFile);
-    if (legacy?.sessionId === sessionId) {
-      await deleteStateFile(legacyFile);
-    }
     return;
   }
   await deleteStateFile(stateFileForRepo(repoRoot, tool));
 }
+async function deleteLegacySessionState(repoRoot, tool, sessionId) {
+  const legacyFile = stateFileForRepo(repoRoot, tool);
+  const legacy = await readStateFile(legacyFile);
+  if (legacy?.sessionId === sessionId) await deleteStateFile(legacyFile);
+}
 async function acquireLock3(repoRoot, tool, sessionId, retries = LOCK_RETRIES2, delayMs = LOCK_RETRY_DELAY_MS2) {
   const lockPath = lockFileForRepo(repoRoot, tool, sessionId);
-  await fs15.promises.mkdir(stateDir3(), { recursive: true, mode: 448 });
+  await fs17.promises.mkdir(stateDir3(), { recursive: true, mode: 448 });
   for (let i = 0; i < retries; i++) {
     try {
-      const fd = await fs15.promises.open(
+      const fd = await fs17.promises.open(
         lockPath,
-        fs15.constants.O_CREAT | fs15.constants.O_EXCL | fs15.constants.O_WRONLY
+        fs17.constants.O_CREAT | fs17.constants.O_EXCL | fs17.constants.O_WRONLY
       );
       await fd.write(String(process.pid));
       await fd.close();
       return fd.fd;
     } catch (err) {
-      if (err.code === "EEXIST" && i < retries - 1) {
+      if (err.code !== "EEXIST") throw err;
+      let regularLockFile = false;
+      try {
+        regularLockFile = (await fs17.promises.lstat(lockPath)).isFile();
+      } catch (statErr) {
+        if (statErr.code === "ENOENT") {
+          i--;
+          continue;
+        }
+      }
+      if (!regularLockFile) throw err;
+      if (i < retries - 1) {
+        if (await reapLockIfStale(lockPath, {
+          maxAgeMs: STALE_LOCK_TTL_MS3
+        })) {
+          continue;
+        }
         await new Promise((r) => setTimeout(r, delayMs));
         continue;
       }
-      throw err;
+      throw new LockContentionError(lockPath, { cause: err });
     }
   }
   throw new Error(`Failed to acquire lock after ${retries} retries`);
 }
 async function releaseLock3(repoRoot, tool, sessionId) {
   try {
-    await fs15.promises.unlink(lockFileForRepo(repoRoot, tool, sessionId));
+    await fs17.promises.unlink(lockFileForRepo(repoRoot, tool, sessionId));
   } catch {
   }
 }
-function isProcessAlive2(pid) {
-  try {
-    process.kill(pid, 0);
-    return true;
-  } catch (err) {
-    return err.code === "EPERM";
-  }
-}
-async function sweepStaleLockFiles(ttlMs = STALE_LOCK_TTL_MS2, now = Date.now()) {
+async function sweepStaleLockFiles(ttlMs = STALE_LOCK_TTL_MS3, now = Date.now()) {
   let entries;
   try {
-    entries = await fs15.promises.readdir(stateDir3(), { withFileTypes: true });
+    entries = await fs17.promises.readdir(stateDir3(), { withFileTypes: true });
   } catch {
     return 0;
   }
   let removed = 0;
   for (const entry of entries) {
     if (!entry.isFile() || !entry.name.endsWith(".lock")) continue;
-    const file = path16.join(stateDir3(), entry.name);
-    try {
-      const raw = await fs15.promises.readFile(file, "utf-8").catch(() => "");
-      const pid = Number.parseInt(raw.trim(), 10);
-      const havePid = Number.isInteger(pid) && pid > 0;
-      let reap;
-      if (havePid) {
-        reap = !isProcessAlive2(pid);
-      } else {
-        const st = await fs15.promises.stat(file);
-        reap = now - st.mtimeMs > ttlMs;
-      }
-      if (reap) {
-        await fs15.promises.unlink(file);
-        removed++;
-      }
-    } catch {
+    const file = path17.join(stateDir3(), entry.name);
+    if (await reapLockIfStale(file, {
+      maxAgeMs: ttlMs,
+      now
+    })) {
+      removed++;
     }
   }
   return removed;
 }
 
 // src/git-traces/handlers.ts
-var CLI_VERSION2 = "0.7.0";
+var CLI_VERSION2 = "0.8.0";
 var GIT_TRACES_SLUG = "git-traces";
 var MAX_UPLOAD_BYTES = 500 * 1024 * 1024;
 var STALE_SCOPED_STATE_TTL_MS = 24 * 60 * 60 * 1e3;
@@ -13920,12 +14832,12 @@ var TOOL_LABELS = {
 async function loadConfiguredRepos() {
   const file = await loadProjects();
   return Object.entries(file.projects).map(([repoRoot, config]) => ({
-    repoRoot: path17.resolve(repoRoot),
+    repoRoot: path18.resolve(repoRoot),
     config
   })).sort((a, b) => a.repoRoot.localeCompare(b.repoRoot));
 }
 function repoLabel(repoRoot) {
-  return path17.basename(repoRoot) || repoRoot;
+  return path18.basename(repoRoot) || repoRoot;
 }
 function resolveCwd2(payload) {
   return resolveHookCwd(payload);
@@ -13933,6 +14845,11 @@ function resolveCwd2(payload) {
 function resolveSessionId2(payload) {
   return resolveHookSessionId(payload);
 }
+async function detectCodexLineageForHook(payload, tool, sessionId) {
+  if (tool !== "codex" || !sessionId) return { conclusive: false };
+  const transcriptPath = payload.transcript_path ?? await findCodexRolloutPath(sessionId);
+  return transcriptPath ? detectCodexLineage(transcriptPath) : { conclusive: false };
+}
 function epochPrefix2(epoch) {
   return `epoch-${String(epoch).padStart(3, "0")}`;
 }
@@ -13980,18 +14897,48 @@ async function uploadFile(client, contributionId, filename, mimeType, buffer) {
   );
   return true;
 }
+function omissionKey(file) {
+  return `${file.tracked ? "tracked" : "untracked"}:${file.path}`;
+}
+function omissionKeys(files) {
+  return [...new Set(files.map(omissionKey))].sort();
+}
+function omissionKeysFromMetadata(metadata) {
+  const git2 = metadata.git;
+  if (!git2 || typeof git2 !== "object") return [];
+  const omitted = git2.omittedFiles;
+  if (!Array.isArray(omitted)) return [];
+  const keys = omitted.map(
+    (file) => file && typeof file === "object" ? metadataOmissionKey(file) : void 0
+  ).filter((key) => key !== void 0);
+  return [...new Set(keys)].sort();
+}
+function metadataOmissionKey(file) {
+  const { path: filePath, tracked } = file;
+  if (typeof filePath !== "string") return void 0;
+  return omissionKey({ path: filePath, tracked: tracked !== false });
+}
 function canUploadEpochBaselineArtifacts(epoch, artifacts) {
   const prefix = epochPrefix2(epoch);
   return canUploadFile(`${prefix}-baseline.bundle`, artifacts.bundleBuffer) && canUploadFile(`${prefix}-baseline.json`, artifacts.metadataBuffer);
 }
-function pinEpochBaseline(repoRoot, sessionId, epoch) {
+function pinEpochBaseline(repoRoot, sessionId, epoch, pinCanonicalRefs = true) {
   const baselineSha = captureBaselineSha(repoRoot);
   const baselineRefPrefix = `refs/hillclimb/baseline/${sessionId}/${epochPrefix2(epoch)}`;
-  deleteRef(repoRoot, baselineRefPrefix);
-  pinRef(repoRoot, `${baselineRefPrefix}/tracked`, baselineSha);
+  const scopedRefPrefix = `refs/hillclimb/scoped/${sessionId}/baseline/${epochPrefix2(epoch)}`;
+  if (pinCanonicalRefs) {
+    deleteRef(repoRoot, baselineRefPrefix);
+    pinRef(repoRoot, `${baselineRefPrefix}/tracked`, baselineSha);
+  }
+  pinRef(repoRoot, `${scopedRefPrefix}/tracked`, baselineSha);
   return { baselineSha, headSha: captureHeadSha(repoRoot) };
 }
-function pinFrozenBaselineTree(repoRoot, sessionId, epoch, baselineTreeSha) {
+function pinScopedTreeRef(repoRoot, refName, treeSha, message) {
+  const commit = execGit(repoRoot, ["commit-tree", treeSha, "-m", message]);
+  pinRef(repoRoot, refName, commit);
+  return commit;
+}
+function pinFrozenBaselineTree(repoRoot, sessionId, epoch, baselineTreeSha, pinCanonicalRefs = true) {
   const prefix = epochPrefix2(epoch);
   const commit = execGit(repoRoot, [
     "commit-tree",
@@ -13999,12 +14946,31 @@ function pinFrozenBaselineTree(repoRoot, sessionId, epoch, baselineTreeSha) {
     "-m",
     `frozen baseline ${prefix} for session ${sessionId}`
   ]);
+  if (pinCanonicalRefs) {
+    pinRef(
+      repoRoot,
+      `refs/hillclimb/baseline/${sessionId}/${prefix}/tree`,
+      commit
+    );
+  }
   pinRef(
     repoRoot,
-    `refs/hillclimb/baseline/${sessionId}/${prefix}/tree`,
+    `refs/hillclimb/scoped/${sessionId}/baseline/${prefix}/tree`,
     commit
   );
 }
+function pinScopedTurnSnapshot(repoRoot, sessionId, epoch, turnCount, snapshotSha, treeSha) {
+  const prefix = epochPrefix2(epoch);
+  const turnLabel = turnSuffix2(turnCount);
+  const refPrefix = `refs/hillclimb/scoped/${sessionId}/turns/${prefix}/${turnLabel}`;
+  pinRef(repoRoot, `${refPrefix}/tracked`, snapshotSha);
+  pinScopedTreeRef(
+    repoRoot,
+    `${refPrefix}/tree`,
+    treeSha,
+    `protected ${turnLabel} ${prefix} for session ${sessionId}`
+  );
+}
 function freezeEpochBaseline(params) {
   const {
     repoRoot,
@@ -14013,18 +14979,23 @@ function freezeEpochBaseline(params) {
     epoch,
     prevHeadSha,
     transitionKind,
-    startedAt
+    startedAt,
+    limits,
+    lineage,
+    pinCanonicalRefs = true
   } = params;
   const prefix = epochPrefix2(epoch);
   try {
     const { baselineSha, headSha } = pinEpochBaseline(
       repoRoot,
       sessionId,
-      epoch
+      epoch,
+      pinCanonicalRefs
     );
     const omittedFiles = [];
     const baselineTreeSha = buildSnapshotTree(repoRoot, baselineSha, {
-      omittedFiles
+      omittedFiles,
+      limits
     });
     const baselineMetadata = buildBaselineMetadata(
       repoRoot,
@@ -14036,10 +15007,23 @@ function freezeEpochBaseline(params) {
       prevHeadSha,
       transitionKind,
       startedAt,
-      omittedFiles
+      omittedFiles,
+      lineage
+    );
+    pinFrozenBaselineTree(
+      repoRoot,
+      sessionId,
+      epoch,
+      baselineTreeSha,
+      pinCanonicalRefs
     );
-    pinFrozenBaselineTree(repoRoot, sessionId, epoch, baselineTreeSha);
-    return { baselineSha, baselineTreeSha, baselineMetadata, headSha };
+    return {
+      baselineSha,
+      baselineTreeSha,
+      baselineMetadata,
+      headSha,
+      omittedFiles
+    };
   } catch (err) {
     appendLog(
       "error",
@@ -14061,7 +15045,12 @@ function buildFrozenEpochBaselineArtifacts(params) {
     const metadataBuffer = Buffer.from(
       JSON.stringify(baselineMetadata, null, 2)
     );
-    return { baselineTreeSha, metadataBuffer, bundleBuffer };
+    return {
+      baselineTreeSha,
+      metadataBuffer,
+      bundleBuffer,
+      omittedKeys: omissionKeysFromMetadata(baselineMetadata)
+    };
   } catch (err) {
     appendLog(
       "error",
@@ -14079,13 +15068,16 @@ function buildEpochBaselineArtifacts(params) {
     baselineSha,
     prevHeadSha,
     transitionKind,
-    startedAt
+    startedAt,
+    limits,
+    lineage
   } = params;
   const prefix = epochPrefix2(epoch);
   try {
     const omittedFiles = [];
     const baselineTreeSha = buildSnapshotTree(repoRoot, baselineSha, {
-      omittedFiles
+      omittedFiles,
+      limits
     });
     const metadata = buildBaselineMetadata(
       repoRoot,
@@ -14097,7 +15089,8 @@ function buildEpochBaselineArtifacts(params) {
       prevHeadSha,
       transitionKind,
       startedAt,
-      omittedFiles
+      omittedFiles,
+      lineage
     );
     return buildFrozenEpochBaselineArtifacts({
       repoRoot,
@@ -14135,7 +15128,16 @@ async function uploadEpochBaselineArtifacts(params) {
   );
 }
 async function createGitTracesContribution(params) {
-  const { client, config, repoRoot, state, tool, now, artifacts } = params;
+  const {
+    client,
+    config,
+    repoRoot,
+    state,
+    tool,
+    persistState,
+    now,
+    artifacts
+  } = params;
   const toolLabel2 = TOOL_LABELS[tool] ?? "Claude";
   const epochSeconds = formatEpochSeconds3(now);
   const shortId = state.sessionId.slice(0, 12);
@@ -14153,7 +15155,7 @@ Uploaded: ${now.toISOString()}`
     contributionId = contribution.id;
     state.contributionId = contributionId;
     state.baselineUploaded = false;
-    await writeSessionState(state, tool);
+    await persistState(state);
   }
   const uploaded = await uploadEpochBaselineArtifacts({
     client,
@@ -14172,6 +15174,12 @@ Uploaded: ${now.toISOString()}`
 async function uploadEpochBaseline(params) {
   const artifacts = buildEpochBaselineArtifacts(params);
   if (!artifacts) return null;
+  pinScopedTreeRef(
+    params.repoRoot,
+    `refs/hillclimb/scoped/${params.sessionId}/baseline/${epochPrefix2(params.epoch)}/tree`,
+    artifacts.baselineTreeSha,
+    `protected baseline ${epochPrefix2(params.epoch)} for session ${params.sessionId}`
+  );
   if (!canUploadEpochBaselineArtifacts(params.epoch, artifacts)) return null;
   const uploaded = await uploadEpochBaselineArtifacts({
     client: params.client,
@@ -14180,7 +15188,10 @@ async function uploadEpochBaseline(params) {
     artifacts
   });
   if (!uploaded) return null;
-  return { baselineTreeSha: artifacts.baselineTreeSha };
+  return {
+    baselineTreeSha: artifacts.baselineTreeSha,
+    omittedKeys: artifacts.omittedKeys
+  };
 }
 async function openEpoch(params) {
   const { baselineSha, headSha } = pinEpochBaseline(
@@ -14190,10 +15201,28 @@ async function openEpoch(params) {
   );
   const uploaded = await uploadEpochBaseline({ ...params, baselineSha });
   if (!uploaded) return null;
-  return { baselineSha, baselineTreeSha: uploaded.baselineTreeSha, headSha };
+  return {
+    baselineSha,
+    baselineTreeSha: uploaded.baselineTreeSha,
+    headSha,
+    omittedKeys: uploaded.omittedKeys
+  };
+}
+function isPositiveInteger(value) {
+  return typeof value === "number" && Number.isInteger(value) && value > 0;
 }
-async function initializeSession(repoRoot, tool, sessionId) {
+function sessionSnapshotLimits(state) {
+  const limits = state.snapshotLimits;
+  if (!limits || typeof limits !== "object") return LEGACY_SNAPSHOT_LIMITS;
+  const candidate = limits;
+  if (!isPositiveInteger(candidate.maxTrackedFileBytes) || !isPositiveInteger(candidate.maxUntrackedFileBytes) || !isPositiveInteger(candidate.maxBinaryFileBytes)) {
+    return LEGACY_SNAPSHOT_LIMITS;
+  }
+  return limits;
+}
+async function initializeSession(repoRoot, tool, sessionId, limits, lineage, legacyBoundaryPending = false) {
   const startedAt = (/* @__PURE__ */ new Date()).toISOString();
+  const effectiveLimits = limits ?? resolveSnapshotLimits(void 0);
   const frozen = freezeEpochBaseline({
     repoRoot,
     sessionId,
@@ -14201,7 +15230,10 @@ async function initializeSession(repoRoot, tool, sessionId) {
     epoch: 1,
     prevHeadSha: null,
     transitionKind: "initial",
-    startedAt
+    startedAt,
+    limits: effectiveLimits,
+    lineage,
+    pinCanonicalRefs: !legacyBoundaryPending
   });
   if (!frozen) return null;
   const state = {
@@ -14216,17 +15248,67 @@ async function initializeSession(repoRoot, tool, sessionId) {
     lastSnapshotTreeSha: frozen.baselineTreeSha,
     startedAt,
     epoch: 1,
+    nextEpoch: 2,
     turnCount: 0,
     headSha: frozen.headSha,
-    repoRoot
+    repoRoot,
+    snapshotLimits: effectiveLimits,
+    omittedKeys: omissionKeys(frozen.omittedFiles),
+    codexLineage: lineage,
+    codexLineageChecked: tool === "codex" ? false : void 0,
+    legacyBoundaryPending: legacyBoundaryPending || void 0
   };
-  await writeSessionState(state, tool);
+  await writeSessionState2(state, tool);
   appendLog(
     "info",
     `git-traces: session pending (repo=${repoRoot}, baseline=${frozen.baselineSha.slice(0, 8)}, awaiting first turn)`
   );
   return state;
 }
+function pinScopedStateRefs(repoRoot, state) {
+  const prefix = epochPrefix2(state.epoch);
+  const baselinePrefix = `refs/hillclimb/scoped/${state.sessionId}/baseline/${prefix}`;
+  pinRef(repoRoot, `${baselinePrefix}/tracked`, state.baselineSha);
+  if (state.baselineTreeSha) {
+    pinScopedTreeRef(
+      repoRoot,
+      `${baselinePrefix}/tree`,
+      state.baselineTreeSha,
+      `protected baseline ${prefix} for session ${state.sessionId}`
+    );
+  }
+  if (state.turnCount > 0 && state.lastSnapshotTreeSha) {
+    pinScopedTurnSnapshot(
+      repoRoot,
+      state.sessionId,
+      state.epoch,
+      state.turnCount,
+      state.lastSnapshotSha,
+      state.lastSnapshotTreeSha
+    );
+  }
+}
+function pinCanonicalStateRefs(repoRoot, state) {
+  pinScopedStateRefs(repoRoot, state);
+  const prefix = epochPrefix2(state.epoch);
+  const baselinePrefix = `refs/hillclimb/baseline/${state.sessionId}/${prefix}`;
+  pinRef(repoRoot, `${baselinePrefix}/tracked`, state.baselineSha);
+  if (state.baselineTreeSha) {
+    pinScopedTreeRef(
+      repoRoot,
+      `${baselinePrefix}/tree`,
+      state.baselineTreeSha,
+      `canonical baseline ${prefix} for session ${state.sessionId}`
+    );
+  }
+  if (state.turnCount > 0) {
+    pinRef(
+      repoRoot,
+      `refs/hillclimb/turns/${state.sessionId}/${prefix}/${turnSuffix2(state.turnCount)}`,
+      state.lastSnapshotSha
+    );
+  }
+}
 async function cleanupStaleScopedSessionStates(repoRoot, tool, currentSessionId, options = {}) {
   const nowMs = options.nowMs ?? Date.now();
   const ttlMs = options.ttlMs ?? STALE_SCOPED_STATE_TTL_MS;
@@ -14237,6 +15319,13 @@ async function cleanupStaleScopedSessionStates(repoRoot, tool, currentSessionId,
     const startedAtMs = Date.parse(state.startedAt);
     const ageBaseMs = Number.isNaN(startedAtMs) ? mtimeMs : startedAtMs;
     if (nowMs - ageBaseMs <= ttlMs) continue;
+    if (await readLegacySessionState(repoRoot, tool, state.sessionId)) {
+      appendLog(
+        "info",
+        `git-traces: preserving stale scoped session ${state.sessionId} while matching legacy state exists`
+      );
+      continue;
+    }
     try {
       await acquireLock3(repoRoot, tool, state.sessionId, 1, 0);
     } catch {
@@ -14252,7 +15341,7 @@ async function cleanupStaleScopedSessionStates(repoRoot, tool, currentSessionId,
         `git-traces: cleaning up stale scoped session ${state.sessionId}`
       );
       cleanupSessionRefs(repoRoot, state.sessionId);
-      await deleteSessionState(repoRoot, tool, state.sessionId);
+      await deleteSessionState2(repoRoot, tool, state.sessionId);
       removed++;
     } finally {
       await releaseLock3(repoRoot, tool, state.sessionId);
@@ -14260,7 +15349,26 @@ async function cleanupStaleScopedSessionStates(repoRoot, tool, currentSessionId,
   }
   return removed;
 }
-async function processSessionStartRepo(repo, tool, sessionId) {
+async function acquireBoundaryLegacyLock(repoRoot, tool, timing) {
+  for (; ; ) {
+    try {
+      if (timing) {
+        await acquireLock3(repoRoot, tool, null, timing.retries, timing.delayMs);
+      } else {
+        await acquireLock3(repoRoot, tool, null);
+      }
+      return;
+    } catch (err) {
+      if (!(err instanceof LockContentionError)) throw err;
+      appendLog(
+        "info",
+        `git-traces: detached lifecycle worker still waiting for legacy boundary lock (repo=${repoRoot}, tool=${tool})`
+      );
+      timing?.onChunkExhausted?.();
+    }
+  }
+}
+async function prepareSessionStartRepo(repo, tool, sessionId, lineage) {
   const { repoRoot } = repo;
   if (!isGitRepo(repoRoot)) {
     appendLog(
@@ -14269,34 +15377,71 @@ async function processSessionStartRepo(repo, tool, sessionId) {
     );
     return "skipped";
   }
-  let acquired = false;
+  let scopedLockAcquired = false;
   try {
     await acquireLock3(repoRoot, tool, sessionId);
-    acquired = true;
-    const staleLegacy = await readSessionState(repoRoot, tool);
-    if (staleLegacy && staleLegacy.sessionId !== sessionId) {
-      let acquiredLegacy = false;
-      try {
-        await acquireLock3(repoRoot, tool, staleLegacy.sessionId, 1, 0);
-        acquiredLegacy = true;
-      } catch {
-        appendLog(
-          "info",
-          `git-traces: leaving legacy session ${staleLegacy.sessionId} (lock held \u2014 still active)`
-        );
-      }
-      if (acquiredLegacy) {
-        try {
-          appendLog(
-            "info",
-            `git-traces: cleaning up stale session ${staleLegacy.sessionId} (repo=${repoRoot})`
-          );
-          cleanupSessionRefs(repoRoot, staleLegacy.sessionId);
-          await deleteSessionState(repoRoot, tool);
-        } finally {
-          await releaseLock3(repoRoot, tool, staleLegacy.sessionId);
-        }
-      }
+    scopedLockAcquired = true;
+    const scoped = (await readSessionStateCandidates(repoRoot, tool, sessionId)).scoped?.state;
+    if (scoped) {
+      pinScopedStateRefs(repoRoot, scoped);
+      return "initialized";
+    }
+    const state = await initializeSession(
+      repoRoot,
+      tool,
+      sessionId,
+      resolveSnapshotLimits(repo.config.snapshotLimits),
+      lineage,
+      true
+    );
+    return state ? "initialized" : "failed";
+  } catch (err) {
+    appendLog(
+      "error",
+      `git-traces: SessionStart failed for repo ${repoRoot}: ${formatError(err)}`
+    );
+    return "failed";
+  } finally {
+    if (scopedLockAcquired) await releaseLock3(repoRoot, tool, sessionId);
+  }
+}
+function hasPreparedSessionCaptureProgress(state) {
+  return state.contributionId !== null || state.baselineUploaded === true || state.epoch > 1 || state.turnCount > 0;
+}
+async function completeSessionStartRepo(repo, tool, sessionId, lineage, timing) {
+  const { repoRoot } = repo;
+  let legacyLockAcquired = false;
+  let scopedLockAcquired = false;
+  try {
+    await acquireBoundaryLegacyLock(repoRoot, tool, timing);
+    legacyLockAcquired = true;
+    await acquireLock3(repoRoot, tool, sessionId);
+    scopedLockAcquired = true;
+    const candidates = await readSessionStateCandidates(
+      repoRoot,
+      tool,
+      sessionId
+    );
+    if (!candidates.scoped) {
+      appendLog(
+        "info",
+        `git-traces: SessionStart state already cleaned before legacy reconciliation (repo=${repoRoot}, session=${sessionId})`
+      );
+      return "skipped";
+    }
+    const reconciled = reconcileLockedSessionState(candidates);
+    if (!reconciled.state) return "skipped";
+    const lineageChanged = mergeLineageIntoState(reconciled.state, lineage);
+    pinCanonicalStateRefs(repoRoot, reconciled.state);
+    if (reconciled.needsWrite || lineageChanged) {
+      await writeSessionState2(reconciled.state, tool);
+    }
+    if (candidates.legacy) {
+      await deleteLegacySessionState(repoRoot, tool, sessionId);
+      appendLog(
+        "info",
+        `git-traces: migrated legacy session on SessionStart (repo=${repoRoot}, session=${sessionId})`
+      );
     }
     const staleCount = await cleanupStaleScopedSessionStates(
       repoRoot,
@@ -14309,16 +15454,16 @@ async function processSessionStartRepo(repo, tool, sessionId) {
         `git-traces: cleaned stale scoped sessions (repo=${repoRoot}, count=${staleCount})`
       );
     }
-    const state = await initializeSession(repoRoot, tool, sessionId);
-    return state ? "initialized" : "failed";
+    return "initialized";
   } catch (err) {
     appendLog(
       "error",
-      `git-traces: SessionStart failed for repo ${repoRoot}: ${formatError(err)}`
+      `git-traces: SessionStart reconciliation failed for repo ${repoRoot}: ${formatError(err)}`
     );
     return "failed";
   } finally {
-    if (acquired) await releaseLock3(repoRoot, tool, sessionId);
+    if (scopedLockAcquired) await releaseLock3(repoRoot, tool, sessionId);
+    if (legacyLockAcquired) await releaseLock3(repoRoot, tool, null);
   }
 }
 async function handleSessionStart(payload, tool) {
@@ -14345,11 +15490,24 @@ async function handleSessionStart(payload, tool) {
     appendLog("info", `git-traces: reaped ${reaped} stale lock file(s)`);
   }
   const repos = await loadConfiguredRepos();
-  let initialized = 0;
+  const prepared = [];
   let skipped = 0;
   let failed = 0;
   for (const repo of repos) {
-    const outcome = await processSessionStartRepo(repo, tool, sessionId);
+    const outcome = await prepareSessionStartRepo(repo, tool, sessionId);
+    if (outcome === "initialized") prepared.push(repo);
+    else if (outcome === "skipped") skipped++;
+    else failed++;
+  }
+  const lineage = (await detectCodexLineageForHook(payload, tool, sessionId)).lineage;
+  let initialized = 0;
+  for (const repo of prepared) {
+    const outcome = await completeSessionStartRepo(
+      repo,
+      tool,
+      sessionId,
+      lineage
+    );
     if (outcome === "initialized") initialized++;
     else if (outcome === "skipped") skipped++;
     else failed++;
@@ -14359,7 +15517,7 @@ async function handleSessionStart(payload, tool) {
     `git-traces: SessionStart summary (session=${sessionId}, tool=${tool}, triggerRepo=${startingProject.repoRoot}, configured=${repos.length}, initialized=${initialized}, skipped=${skipped}, failed=${failed})`
   );
 }
-function buildInitialBaselineArtifactsForState(repoRoot, tool, state) {
+function buildInitialBaselineArtifactsForState(repoRoot, tool, state, limits) {
   if (state.baselineTreeSha && state.baselineMetadata) {
     return buildFrozenEpochBaselineArtifacts({
       repoRoot,
@@ -14377,9 +15535,81 @@ function buildInitialBaselineArtifactsForState(repoRoot, tool, state) {
     baselineSha: state.baselineSha,
     prevHeadSha: null,
     transitionKind: "initial",
-    startedAt: state.startedAt
+    startedAt: state.startedAt,
+    limits,
+    lineage: state.codexLineage
   });
 }
+function mergeLineageIntoState(state, detected) {
+  const merged = mergeCodexLineage(state.codexLineage, detected);
+  if (!merged || JSON.stringify(merged) === JSON.stringify(state.codexLineage)) {
+    return false;
+  }
+  state.codexLineage = merged;
+  if (state.baselineMetadata) {
+    const baselineMetadata = { ...state.baselineMetadata };
+    delete baselineMetadata.forkedFromThreadId;
+    delete baselineMetadata.replayBoundary;
+    state.baselineMetadata = {
+      ...baselineMetadata,
+      ...merged
+    };
+  }
+  return true;
+}
+function reconcileSessionStateCandidates(candidates) {
+  const { scoped, legacy } = candidates;
+  if (!scoped) {
+    if (!legacy) return { state: null, needsMigration: false };
+    return { state: { ...legacy.state }, needsMigration: true };
+  }
+  if (!legacy) return { state: { ...scoped.state }, needsMigration: false };
+  let authoritative = scoped;
+  let other = legacy;
+  const preferLegacy = scoped.state.legacyBoundaryPending === true && !hasPreparedSessionCaptureProgress(scoped.state);
+  if (preferLegacy || legacy.mtimeMs > scoped.mtimeMs || legacy.mtimeMs === scoped.mtimeMs && (legacy.state.epoch > scoped.state.epoch || legacy.state.epoch === scoped.state.epoch && legacy.state.turnCount > scoped.state.turnCount)) {
+    authoritative = legacy;
+    other = scoped;
+  }
+  const state = { ...authoritative.state };
+  mergeLineageIntoState(state, other.state.codexLineage);
+  if (other.state.codexLineageChecked === true) {
+    state.codexLineageChecked = true;
+  }
+  if (state.contributionId === other.state.contributionId) {
+    state.nextEpoch = Math.max(
+      state.nextEpoch ?? state.epoch + 1,
+      other.state.nextEpoch ?? other.state.epoch + 1
+    );
+    state.codexLineageStamped = mergeCodexLineage(
+      state.codexLineageStamped,
+      other.state.codexLineageStamped
+    );
+  }
+  return { state, needsMigration: true };
+}
+function reconcileLockedSessionState(candidates) {
+  const reconciled = reconcileSessionStateCandidates(candidates);
+  if (!reconciled.state) return { state: null, needsWrite: false };
+  const boundaryCleared = reconciled.state.legacyBoundaryPending === true;
+  delete reconciled.state.legacyBoundaryPending;
+  return {
+    state: reconciled.state,
+    needsWrite: reconciled.needsMigration || boundaryCleared
+  };
+}
+async function reserveEpoch(state, persistState) {
+  const reservedEpoch = Math.max(
+    state.nextEpoch ?? state.epoch + 1,
+    state.epoch + 1
+  );
+  state.nextEpoch = reservedEpoch + 1;
+  await persistState(state);
+  return reservedEpoch;
+}
+function isTerminalContributionError(err) {
+  return err instanceof PlatformError && err.status === 404 && err.code === "CONTRIBUTION_NOT_FOUND" || isContributionUploadNotUploaded(err);
+}
 async function loadRepoClient(repo) {
   const identity = await loadIdentity(repo.config.apiBaseUrl);
   if (!identity) {
@@ -14391,14 +15621,71 @@ async function loadRepoClient(repo) {
   }
   return new PlatformClient(repo.config.apiBaseUrl, identity.sessionCookie);
 }
+async function refreshLineageBaseline(params) {
+  const { repo, state, tool, persistState, client, limits } = params;
+  if (state.codexLineage === void 0 || JSON.stringify(state.codexLineage) === JSON.stringify(state.codexLineageStamped) || state.contributionId === null || !state.baselineUploaded) {
+    return false;
+  }
+  try {
+    const nextEpoch = await reserveEpoch(state, persistState);
+    const artifacts = await openEpoch({
+      repoRoot: repo.repoRoot,
+      client,
+      contributionId: state.contributionId,
+      sessionId: state.sessionId,
+      tool,
+      epoch: nextEpoch,
+      prevHeadSha: state.headSha || null,
+      // The downstream contract has no metadata-only transition. This is a
+      // complete baseline at the current HEAD, so use its compatible initial
+      // baseline shape and explain the refresh only in collector state/logs.
+      transitionKind: "initial",
+      startedAt: state.startedAt,
+      limits,
+      lineage: state.codexLineage
+    });
+    if (!artifacts) {
+      appendLog(
+        "warn",
+        `git-traces: lineage baseline refresh deferred after capture (repo=${repo.repoRoot}, project=${repo.config.projectId}, epoch=${nextEpoch})`
+      );
+      return false;
+    }
+    Object.assign(state, {
+      baselineSha: artifacts.baselineSha,
+      baselineTreeSha: artifacts.baselineTreeSha,
+      lastSnapshotSha: artifacts.baselineSha,
+      lastSnapshotTreeSha: artifacts.baselineTreeSha,
+      epoch: nextEpoch,
+      turnCount: 0,
+      headSha: artifacts.headSha,
+      omittedKeys: artifacts.omittedKeys,
+      codexLineageStamped: state.codexLineage
+    });
+    await persistState(state);
+    appendLog(
+      "info",
+      `git-traces: lineage metadata refresh baseline uploaded (repo=${repo.repoRoot}, project=${repo.config.projectId}, contribution=${state.contributionId}, epoch=${nextEpoch}, baseline=${artifacts.baselineSha.slice(0, 8)})`
+    );
+    return true;
+  } catch (err) {
+    if (isTerminalContributionError(err)) throw err;
+    appendLog(
+      "warn",
+      `git-traces: lineage baseline refresh failed after capture; lineage remains pending (repo=${repo.repoRoot}, project=${repo.config.projectId}): ${formatError(err)}`
+    );
+    return false;
+  }
+}
 async function registerInitialContribution(params) {
-  const { repo, state, tool, client, artifacts } = params;
+  const { repo, state, tool, persistState, client, artifacts } = params;
   const contributionId = await createGitTracesContribution({
     client,
     config: repo.config,
     repoRoot: repo.repoRoot,
     state,
     tool,
+    persistState,
     now: /* @__PURE__ */ new Date(),
     artifacts
   });
@@ -14407,14 +15694,44 @@ async function registerInitialContribution(params) {
   state.baselineUploaded = true;
   state.baselineTreeSha = artifacts.baselineTreeSha;
   state.lastSnapshotTreeSha = artifacts.baselineTreeSha;
-  await writeSessionState(state, tool);
+  state.codexLineageStamped = state.codexLineage;
+  await persistState(state);
   appendLog(
     "info",
     `git-traces: session registered on first changed turn (repo=${repo.repoRoot}, project=${repo.config.projectId}, contribution=${contributionId}, epoch=1, baseline=${state.baselineSha.slice(0, 8)})`
   );
   return true;
 }
-async function processStopRepo(repo, tool, sessionId, recordedAt) {
+function reportNewlyOmittedFiles(state, omittedFiles, repoRoot) {
+  const currentKeys = omissionKeys(omittedFiles);
+  const previousKeys = Array.isArray(state.omittedKeys) && state.omittedKeys.every((key) => typeof key === "string") ? state.omittedKeys : void 0;
+  if (previousKeys === void 0) {
+    state.omittedKeys = currentKeys;
+    return true;
+  }
+  const known = new Set(previousKeys);
+  const fresh = omittedFiles.filter((file) => !known.has(omissionKey(file)));
+  if (fresh.length > 0) {
+    const tracked = fresh.filter((file) => file.tracked);
+    const untracked = fresh.filter((file) => !file.tracked);
+    if (tracked.length > 0) {
+      appendLog(
+        "warn",
+        `git-traces: turn newly omitted tracked ${summarizeOmittedFiles(tracked)} \u2014 content excluded from bundle and diffs from here on (repo=${repoRoot})`
+      );
+    }
+    if (untracked.length > 0) {
+      appendLog(
+        "info",
+        `git-traces: turn newly skipped untracked ${summarizeOmittedFiles(untracked)} (repo=${repoRoot})`
+      );
+    }
+  }
+  const changed = currentKeys.length !== previousKeys.length || currentKeys.some((key, i) => key !== previousKeys[i]);
+  if (changed) state.omittedKeys = currentKeys;
+  return changed;
+}
+async function processStopRepo(repo, tool, sessionId, recordedAt, lineageCheck, options = {}) {
   const { repoRoot, config } = repo;
   if (!isGitRepo(repoRoot)) {
     appendLog(
@@ -14424,11 +15741,56 @@ async function processStopRepo(repo, tool, sessionId, recordedAt) {
     return "skipped";
   }
   let state = null;
-  let acquired = false;
+  let legacyLockAcquired = false;
+  let scopedLockAcquired = false;
+  const persistState = sessionId ? (next) => writeSessionState2(next, tool) : (next) => writeLegacySessionState(next, tool);
   try {
-    await acquireLock3(repoRoot, tool, sessionId);
-    acquired = true;
-    state = await readSessionState(repoRoot, tool, sessionId);
+    if (options.waitForLegacyBoundary) {
+      await acquireBoundaryLegacyLock(repoRoot, tool);
+      legacyLockAcquired = true;
+    } else {
+      const matchingLegacyHint = sessionId ? await readLegacySessionState(repoRoot, tool, sessionId) : await readSessionState2(repoRoot, tool);
+      if (matchingLegacyHint) {
+        try {
+          await acquireLock3(repoRoot, tool, null, 2, 0);
+          legacyLockAcquired = true;
+        } catch {
+          appendLog(
+            "info",
+            `git-traces: preserving repo on Stop (repo=${repoRoot}, project=${config.projectId}, reason=legacy-lock-held)`
+          );
+          return "skipped";
+        }
+      }
+    }
+    if (sessionId) {
+      await acquireLock3(repoRoot, tool, sessionId);
+      scopedLockAcquired = true;
+      const candidates = await readSessionStateCandidates(
+        repoRoot,
+        tool,
+        sessionId
+      );
+      if (legacyLockAcquired) {
+        const reconciled = reconcileLockedSessionState(candidates);
+        state = reconciled.state;
+        if (state) {
+          pinCanonicalStateRefs(repoRoot, state);
+          if (reconciled.needsWrite) await writeSessionState2(state, tool);
+        }
+        if (state && candidates.legacy) {
+          await deleteLegacySessionState(repoRoot, tool, state.sessionId);
+        }
+      } else {
+        state = candidates.scoped?.state ?? null;
+      }
+    } else {
+      if (!legacyLockAcquired) {
+        await acquireLock3(repoRoot, tool, null, 2, 0);
+        legacyLockAcquired = true;
+      }
+      state = await readSessionState2(repoRoot, tool);
+    }
     if (!state) {
       appendLog(
         "info",
@@ -14436,6 +15798,40 @@ async function processStopRepo(repo, tool, sessionId, recordedAt) {
       );
       return "no-state";
     }
+    const cleanupState = state;
+    const finishSuccessfulStop = async (outcome) => {
+      if (!options.cleanupOnSuccess) return outcome;
+      await options.onBeforeCleanup?.();
+      cleanupSessionRefs(repoRoot, cleanupState.sessionId);
+      await deleteSessionState2(
+        repoRoot,
+        tool,
+        sessionId ? cleanupState.sessionId : null
+      );
+      if (sessionId && legacyLockAcquired) {
+        await deleteLegacySessionState(repoRoot, tool, cleanupState.sessionId);
+      }
+      appendLog(
+        "info",
+        `git-traces: session ${cleanupState.sessionId} cleaned up (repo=${repoRoot}, epochCount=${cleanupState.epoch}, lastTurnCount=${cleanupState.turnCount})`
+      );
+      return outcome;
+    };
+    let lineageStateChanged = false;
+    if (lineageCheck?.performed) {
+      lineageStateChanged = mergeLineageIntoState(
+        state,
+        lineageCheck.detection?.lineage
+      );
+      if (tool === "codex" && lineageCheck.detection?.conclusive === true && state.codexLineageChecked !== true) {
+        state.codexLineageChecked = true;
+        lineageStateChanged = true;
+      }
+    }
+    if (lineageStateChanged) {
+      await persistState(state);
+    }
+    const limits = sessionSnapshotLimits(state);
     const lastSnapshotTreeSha = state.lastSnapshotTreeSha ?? state.baselineTreeSha;
     if (!lastSnapshotTreeSha) {
       appendLog(
@@ -14445,6 +15841,7 @@ async function processStopRepo(repo, tool, sessionId, recordedAt) {
       return "failed";
     }
     const currentHeadSha = captureHeadSha(repoRoot);
+    const lineageNeedsRefresh = state.codexLineage !== void 0 && JSON.stringify(state.codexLineage) !== JSON.stringify(state.codexLineageStamped);
     if (currentHeadSha !== state.headSha) {
       const client2 = await loadRepoClient(repo);
       if (!client2) return "skipped";
@@ -14452,7 +15849,8 @@ async function processStopRepo(repo, tool, sessionId, recordedAt) {
         const artifacts2 = buildInitialBaselineArtifactsForState(
           repoRoot,
           tool,
-          state
+          state,
+          limits
         );
         if (!artifacts2 || !canUploadEpochBaselineArtifacts(1, artifacts2)) {
           return "skipped";
@@ -14461,6 +15859,7 @@ async function processStopRepo(repo, tool, sessionId, recordedAt) {
           repo,
           state,
           tool,
+          persistState,
           client: client2,
           artifacts: artifacts2
         });
@@ -14479,7 +15878,7 @@ async function processStopRepo(repo, tool, sessionId, recordedAt) {
         state.headSha || null,
         currentHeadSha
       );
-      const nextEpoch = state.epoch + 1;
+      const nextEpoch = await reserveEpoch(state, persistState);
       appendLog(
         "info",
         `git-traces: HEAD moved (repo=${repoRoot}, project=${config.projectId}, contribution=${contributionId2}, transition=${transitionKind}, from=${state.headSha.slice(0, 8)}, to=${currentHeadSha.slice(0, 8)}, openingEpoch=${nextEpoch})`
@@ -14493,7 +15892,9 @@ async function processStopRepo(repo, tool, sessionId, recordedAt) {
         epoch: nextEpoch,
         prevHeadSha: state.headSha || null,
         transitionKind,
-        startedAt: state.startedAt
+        startedAt: state.startedAt,
+        limits,
+        lineage: state.codexLineage
       });
       if (!artifacts) return "failed";
       const next = {
@@ -14504,28 +15905,57 @@ async function processStopRepo(repo, tool, sessionId, recordedAt) {
         lastSnapshotTreeSha: artifacts.baselineTreeSha,
         epoch: nextEpoch,
         turnCount: 0,
-        headSha: artifacts.headSha
+        headSha: artifacts.headSha,
+        omittedKeys: artifacts.omittedKeys,
+        codexLineageStamped: state.codexLineage
       };
-      await writeSessionState(next, tool);
+      await persistState(next);
       appendLog(
         "info",
         `git-traces: epoch baseline uploaded (repo=${repoRoot}, project=${config.projectId}, contribution=${contributionId2}, epoch=${nextEpoch}, baseline=${artifacts.baselineSha.slice(0, 8)})`
       );
-      return "uploaded";
+      return await finishSuccessfulStop("uploaded");
     }
     const currentSha = captureSnapshotSha(repoRoot);
-    const currentTreeSha = buildSnapshotTree(repoRoot, currentSha);
+    const turnOmittedFiles = [];
+    const currentTreeSha = buildSnapshotTree(repoRoot, currentSha, {
+      omittedFiles: turnOmittedFiles,
+      log: false,
+      limits
+    });
+    const omissionsChanged = reportNewlyOmittedFiles(
+      state,
+      turnOmittedFiles,
+      repoRoot
+    );
     const patchBuffer = createTreeDiffPatchGz(
       repoRoot,
       lastSnapshotTreeSha,
-      currentTreeSha
+      currentTreeSha,
+      { limits }
     );
     if (!patchBuffer) {
+      if (omissionsChanged) await persistState(state);
       appendLog(
         "info",
         `git-traces: turn produced identical snapshot tree, skipping upload (repo=${repoRoot}, project=${config.projectId})`
       );
-      return "unchanged";
+      if (lineageNeedsRefresh && state.contributionId !== null && state.baselineUploaded) {
+        const client2 = await loadRepoClient(repo);
+        const refreshed = client2 !== null && await refreshLineageBaseline({
+          repo,
+          state,
+          tool,
+          persistState,
+          client: client2,
+          limits
+        });
+        if (refreshed) {
+          return await finishSuccessfulStop("uploaded");
+        }
+        if (options.cleanupOnSuccess) return "skipped";
+      }
+      return await finishSuccessfulStop("unchanged");
     }
     const prefix = epochPrefix2(state.epoch);
     const nextTurnCount = state.turnCount + 1;
@@ -14544,7 +15974,8 @@ async function processStopRepo(repo, tool, sessionId, recordedAt) {
       const artifacts = buildInitialBaselineArtifactsForState(
         repoRoot,
         tool,
-        state
+        state,
+        limits
       );
       if (!artifacts || !canUploadEpochBaselineArtifacts(1, artifacts)) {
         return "skipped";
@@ -14553,6 +15984,7 @@ async function processStopRepo(repo, tool, sessionId, recordedAt) {
         repo,
         state,
         tool,
+        persistState,
         client,
         artifacts
       });
@@ -14571,6 +16003,14 @@ async function processStopRepo(repo, tool, sessionId, recordedAt) {
       `refs/hillclimb/turns/${state.sessionId}/${prefix}/${turnLabel}`,
       currentSha
     );
+    pinScopedTurnSnapshot(
+      repoRoot,
+      state.sessionId,
+      state.epoch,
+      nextTurnCount,
+      currentSha,
+      currentTreeSha
+    );
     const uploaded = await uploadFile(
       client,
       contributionId,
@@ -14588,46 +16028,63 @@ async function processStopRepo(repo, tool, sessionId, recordedAt) {
     state.turnCount = nextTurnCount;
     state.lastSnapshotSha = currentSha;
     state.lastSnapshotTreeSha = currentTreeSha;
-    await writeSessionState(state, tool);
+    await persistState(state);
     appendLog(
       "info",
       `git-traces: patch uploaded (repo=${repoRoot}, project=${config.projectId}, contribution=${contributionId}, epoch=${state.epoch}, turn=${turnLabel}, bytes=${patchBuffer.byteLength})`
     );
-    return "uploaded";
+    const lineageStillNeedsRefresh = state.codexLineage !== void 0 && JSON.stringify(state.codexLineage) !== JSON.stringify(state.codexLineageStamped);
+    if (lineageStillNeedsRefresh) {
+      const refreshed = await refreshLineageBaseline({
+        repo,
+        state,
+        tool,
+        persistState,
+        client,
+        limits
+      });
+      if (!refreshed && options.cleanupOnSuccess) return "skipped";
+    }
+    return await finishSuccessfulStop("uploaded");
   } catch (err) {
     appendLog(
       "error",
       `git-traces: Stop failed for repo ${repoRoot}: ${formatError(err)}`
     );
-    if (state && err instanceof PlatformError && err.status === 404 && err.code === "CONTRIBUTION_NOT_FOUND") {
+    if (state && isTerminalContributionError(err)) {
+      const poisoned = isContributionUploadNotUploaded(err);
       if (state.baselineTreeSha) {
-        await writeSessionState(
-          {
-            ...state,
-            contributionId: null,
-            baselineUploaded: false,
-            lastSnapshotSha: state.baselineSha,
-            lastSnapshotTreeSha: state.baselineTreeSha,
-            turnCount: 0
-          },
-          tool
-        );
+        await persistState({
+          ...state,
+          contributionId: null,
+          baselineUploaded: false,
+          lastSnapshotSha: state.baselineSha,
+          lastSnapshotTreeSha: state.baselineTreeSha,
+          turnCount: 0
+        });
         appendLog(
           "warn",
-          `git-traces: cleared stale contribution state (repo=${repoRoot}, project=${config.projectId}, missingContribution=${state.contributionId})`
+          poisoned ? `git-traces: cleared abandoned contribution state (repo=${repoRoot}, project=${config.projectId}, contribution=${state.contributionId}, reason=${err.code})` : `git-traces: cleared stale contribution state (repo=${repoRoot}, project=${config.projectId}, missingContribution=${state.contributionId})`
         );
       } else {
         cleanupSessionRefs(repoRoot, state.sessionId);
-        await deleteSessionState(repoRoot, tool, state.sessionId);
+        await deleteSessionState2(
+          repoRoot,
+          tool,
+          sessionId ? state.sessionId : null
+        );
         appendLog(
           "warn",
-          `git-traces: deleted stale contribution state without a frozen baseline (repo=${repoRoot}, project=${config.projectId}, missingContribution=${state.contributionId})`
+          poisoned ? `git-traces: deleted abandoned contribution state without a frozen baseline (repo=${repoRoot}, project=${config.projectId}, contribution=${state.contributionId}, reason=${err.code})` : `git-traces: deleted stale contribution state without a frozen baseline (repo=${repoRoot}, project=${config.projectId}, missingContribution=${state.contributionId})`
         );
       }
     }
     return "failed";
   } finally {
-    if (acquired) await releaseLock3(repoRoot, tool, sessionId);
+    if (scopedLockAcquired) {
+      await releaseLock3(repoRoot, tool, sessionId);
+    }
+    if (legacyLockAcquired) await releaseLock3(repoRoot, tool, null);
   }
 }
 async function handleStop(payload, tool) {
@@ -14639,12 +16096,13 @@ async function handleStop(payload, tool) {
   const recordedAt = Date.now();
   const repos = await loadConfiguredRepos();
   const repoByRoot = new Map(repos.map((repo) => [repo.repoRoot, repo]));
-  const targets = [];
+  const targetsByRoot = /* @__PURE__ */ new Map();
   let missingConfig = 0;
+  let needsLineageCheck = false;
   if (sessionId) {
     const storedStates = await listSessionStatesForSession(tool, sessionId);
     for (const { state } of storedStates) {
-      const repo = repoByRoot.get(path17.resolve(state.repoRoot));
+      const repo = repoByRoot.get(path18.resolve(state.repoRoot));
       if (!repo) {
         missingConfig++;
         appendLog(
@@ -14653,21 +16111,53 @@ async function handleStop(payload, tool) {
         );
         continue;
       }
-      targets.push(repo);
+      if (tool === "codex" && state.codexLineageChecked !== true) {
+        needsLineageCheck = true;
+      }
+      targetsByRoot.set(repo.repoRoot, repo);
+    }
+    for (const repo of repos) {
+      const legacyState = await readLegacySessionState(
+        repo.repoRoot,
+        tool,
+        sessionId
+      );
+      if (!legacyState) continue;
+      targetsByRoot.set(repo.repoRoot, repo);
+      if (tool === "codex" && legacyState.codexLineageChecked !== true) {
+        needsLineageCheck = true;
+      }
     }
-    if (targets.length === 0 && missingConfig === 0) {
-      targets.push({ repoRoot: project.repoRoot, config: project.config });
+    if (targetsByRoot.size === 0 && missingConfig === 0) {
+      targetsByRoot.set(project.repoRoot, {
+        repoRoot: project.repoRoot,
+        config: project.config
+      });
     }
   } else {
-    targets.push({ repoRoot: project.repoRoot, config: project.config });
+    targetsByRoot.set(project.repoRoot, {
+      repoRoot: project.repoRoot,
+      config: project.config
+    });
   }
+  const targets = [...targetsByRoot.values()];
+  const lineageCheck = needsLineageCheck ? {
+    performed: true,
+    detection: await detectCodexLineageForHook(payload, tool, sessionId)
+  } : { performed: false };
   let uploaded = 0;
   let unchanged = 0;
   let skipped = missingConfig;
   let noState = 0;
   let failed = 0;
   for (const repo of targets) {
-    const outcome = await processStopRepo(repo, tool, sessionId, recordedAt);
+    const outcome = await processStopRepo(
+      repo,
+      tool,
+      sessionId,
+      recordedAt,
+      lineageCheck
+    );
     if (outcome === "uploaded") uploaded++;
     else if (outcome === "unchanged") unchanged++;
     else if (outcome === "skipped") skipped++;
@@ -14679,49 +16169,48 @@ async function handleStop(payload, tool) {
     `git-traces: Stop summary (session=${sessionId ?? "<none>"}, tool=${tool}, triggerRepo=${project.repoRoot}, configured=${repos.length}, frozenStates=${targets.length + missingConfig}, uploaded=${uploaded}, unchanged=${unchanged}, skipped=${skipped}, noState=${noState}, failed=${failed})`
   );
 }
-async function cleanupSessionStateForRepo(repoRoot, tool, sessionId) {
-  let acquired = false;
-  try {
-    await acquireLock3(repoRoot, tool, sessionId);
-    acquired = true;
-    const state = await readSessionState(repoRoot, tool, sessionId);
-    if (!state) return "no-state";
-    cleanupSessionRefs(repoRoot, state.sessionId);
-    await deleteSessionState(repoRoot, tool, state.sessionId);
-    appendLog(
-      "info",
-      `git-traces: session ${state.sessionId} cleaned up (repo=${repoRoot}, epochCount=${state.epoch}, lastTurnCount=${state.turnCount})`
-    );
-    return "cleaned";
-  } catch (err) {
-    appendLog(
-      "error",
-      `git-traces: SessionEnd cleanup failed for repo ${repoRoot}: ${formatError(err)}`
-    );
-    return "failed";
-  } finally {
-    if (acquired) await releaseLock3(repoRoot, tool, sessionId);
-  }
-}
 async function handleSessionEnd(payload, tool) {
   const cwd = resolveCwd2(payload);
   const sessionId = resolveSessionId2(payload);
   const project = cwd ? await findProjectForCwd(cwd) : null;
   const triggerRepo = project?.repoRoot ?? cwd ?? "<none>";
   const recordedAt = Date.now();
-  const repoRoots = [];
+  const repos = await loadConfiguredRepos();
+  const repoByRoot = new Map(repos.map((repo) => [repo.repoRoot, repo]));
+  const repoRoots = /* @__PURE__ */ new Set();
+  let needsLineageCheck = false;
   if (sessionId) {
     const states = await listSessionStatesForSession(tool, sessionId);
     for (const { state } of states) {
-      repoRoots.push(path17.resolve(state.repoRoot));
+      const repoRoot = path18.resolve(state.repoRoot);
+      repoRoots.add(repoRoot);
+      const canProcess = repoByRoot.has(repoRoot) || project && path18.resolve(project.repoRoot) === repoRoot;
+      if (canProcess && tool === "codex" && state.codexLineageChecked !== true) {
+        needsLineageCheck = true;
+      }
+    }
+    for (const repo of repos) {
+      const legacyState = await readLegacySessionState(
+        repo.repoRoot,
+        tool,
+        sessionId
+      );
+      if (!legacyState) continue;
+      repoRoots.add(repo.repoRoot);
+      if (tool === "codex" && legacyState.codexLineageChecked !== true) {
+        needsLineageCheck = true;
+      }
     }
   }
-  if (repoRoots.length === 0 && cwd) {
-    repoRoots.push(project?.repoRoot ?? cwd);
+  if (repoRoots.size === 0 && cwd) {
+    const fallbackRepoRoot = project?.repoRoot ?? cwd;
+    repoRoots.add(fallbackRepoRoot);
   }
-  if (repoRoots.length === 0) return;
-  const repos = await loadConfiguredRepos();
-  const repoByRoot = new Map(repos.map((repo) => [repo.repoRoot, repo]));
+  if (repoRoots.size === 0) return;
+  const lineageCheck = needsLineageCheck ? {
+    performed: true,
+    detection: await detectCodexLineageForHook(payload, tool, sessionId)
+  } : { performed: false };
   let cleaned = 0;
   let noState = 0;
   let uploaded = 0;
@@ -14729,7 +16218,7 @@ async function handleSessionEnd(payload, tool) {
   let skipped = 0;
   let failed = 0;
   for (const repoRoot of repoRoots) {
-    const repo = repoByRoot.get(path17.resolve(repoRoot)) ?? (project && path17.resolve(project.repoRoot) === path17.resolve(repoRoot) ? { repoRoot: project.repoRoot, config: project.config } : null);
+    const repo = repoByRoot.get(path18.resolve(repoRoot)) ?? (project && path18.resolve(project.repoRoot) === path18.resolve(repoRoot) ? { repoRoot: project.repoRoot, config: project.config } : null);
     if (!repo) {
       skipped++;
       appendLog(
@@ -14742,7 +16231,9 @@ async function handleSessionEnd(payload, tool) {
       repo,
       tool,
       sessionId,
-      recordedAt
+      recordedAt,
+      lineageCheck,
+      { waitForLegacyBoundary: true, cleanupOnSuccess: true }
     );
     if (finalOutcome === "uploaded") uploaded++;
     else if (finalOutcome === "unchanged") unchanged++;
@@ -14764,14 +16255,11 @@ async function handleSessionEnd(payload, tool) {
       noState++;
       continue;
     }
-    const outcome = await cleanupSessionStateForRepo(repoRoot, tool, sessionId);
-    if (outcome === "cleaned") cleaned++;
-    else if (outcome === "no-state") noState++;
-    else failed++;
+    cleaned++;
   }
   appendLog(
     "info",
-    `git-traces: SessionEnd summary (session=${sessionId ?? "<none>"}, tool=${tool}, triggerRepo=${triggerRepo}, states=${repoRoots.length}, uploaded=${uploaded}, unchanged=${unchanged}, skipped=${skipped}, cleaned=${cleaned}, noState=${noState}, failed=${failed})`
+    `git-traces: SessionEnd summary (session=${sessionId ?? "<none>"}, tool=${tool}, triggerRepo=${triggerRepo}, states=${repoRoots.size}, uploaded=${uploaded}, unchanged=${unchanged}, skipped=${skipped}, cleaned=${cleaned}, noState=${noState}, failed=${failed})`
   );
 }
 
@@ -14780,7 +16268,7 @@ var WORKER_ENV_FLAG2 = "HILLCLIMB_GIT_TRACES_WORKER";
 var TOOL_ENV_FLAG2 = "HILLCLIMB_GIT_TRACES_TOOL";
 var FLOW_ID_ENV2 = "HILLCLIMB_GIT_TRACES_FLOW";
 function newFlowId2() {
-  return crypto6.randomBytes(3).toString("hex");
+  return crypto7.randomBytes(3).toString("hex");
 }
 var KNOWN_TOOLS = /* @__PURE__ */ new Set([
   "claude",
@@ -15022,7 +16510,7 @@ async function runGitTracesWorker() {
     return;
   }
   const event = payload.hook_event_name;
-  const eventKind = classifyHookEvent2(event);
+  const eventKind2 = classifyHookEvent2(event);
   appendLog("info", `git-traces worker: handling event=${event}`);
   if (tool === "claude" && typeof payload.cursor_version === "string") {
     appendLog(
@@ -15033,7 +16521,7 @@ async function runGitTracesWorker() {
   }
   try {
     await selfHealHook2(payload, tool);
-    switch (eventKind) {
+    switch (eventKind2) {
       case "sessionStart":
         await handleSessionStart(payload, tool);
         break;
@@ -15055,7 +16543,7 @@ async function runGitTracesWorker() {
 ${stack}` : ""}`
     );
   } finally {
-    if (eventKind === "stop" || eventKind === "sessionEnd") {
+    if (eventKind2 === "stop" || eventKind2 === "sessionEnd") {
       await recordDebugLogCompletion({
         kind: "git",
         tool,
@@ -15066,29 +16554,29 @@ ${stack}` : ""}`
 }
 
 // src/outputs/zip.ts
-import fs17 from "fs";
-import path19 from "path";
+import fs19 from "fs";
+import path20 from "path";
 import archiver2 from "archiver";
 
 // src/outputs/downloads.ts
 import { execSync as execSync2 } from "child_process";
-import fs16 from "fs";
-import os9 from "os";
-import path18 from "path";
+import fs18 from "fs";
+import os10 from "os";
+import path19 from "path";
 function getDownloadsFolder() {
-  const home = os9.homedir();
+  const home = os10.homedir();
   if (process.platform === "linux") {
     try {
       const xdgDir = execSync2("xdg-user-dir DOWNLOAD", {
         encoding: "utf-8",
         timeout: 3e3
       }).trim();
-      if (xdgDir && fs16.existsSync(xdgDir)) return xdgDir;
+      if (xdgDir && fs18.existsSync(xdgDir)) return xdgDir;
     } catch {
     }
   }
-  const downloads = path18.join(home, "Downloads");
-  if (fs16.existsSync(downloads)) return downloads;
+  const downloads = path19.join(home, "Downloads");
+  if (fs18.existsSync(downloads)) return downloads;
   return home;
 }
 
@@ -15097,11 +16585,11 @@ function sanitizeFilename(name) {
   return name.replace(/[^a-zA-Z0-9._-]/g, "_");
 }
 function getUniqueFilename(dir, base, ext) {
-  let candidate = path19.join(dir, `${base}${ext}`);
-  if (!fs17.existsSync(candidate)) return candidate;
+  let candidate = path20.join(dir, `${base}${ext}`);
+  if (!fs19.existsSync(candidate)) return candidate;
   let i = 1;
-  while (fs17.existsSync(candidate)) {
-    candidate = path19.join(dir, `${base}-${i}${ext}`);
+  while (fs19.existsSync(candidate)) {
+    candidate = path20.join(dir, `${base}-${i}${ext}`);
     i++;
   }
   return candidate;
@@ -15111,13 +16599,13 @@ var ZipOutput = class {
   label = "Save as .zip to Downloads";
   async emit(group, options) {
     const downloadsDir = getDownloadsFolder();
-    const repoName = sanitizeFilename(path19.basename(group.repoPath));
+    const repoName = sanitizeFilename(path20.basename(group.repoPath));
     const timeRange = options.timeRange;
     const rangePart = timeRange?.label ?? "all";
     const epochSeconds = Math.floor(Date.now() / 1e3);
     const baseName = `logs-${repoName}-${rangePart}-${epochSeconds}`;
     const outputPath = getUniqueFilename(downloadsDir, baseName, ".zip");
-    const output = fs17.createWriteStream(outputPath);
+    const output = fs19.createWriteStream(outputPath);
     const archive = archiver2("zip", { zlib: { level: 6 } });
     const done = new Promise((resolve, reject) => {
       output.on("close", resolve);
@@ -15311,15 +16799,15 @@ async function confirmExport(group, output) {
 }
 
 // src/sources/claude.ts
-import fs18 from "fs";
-import os10 from "os";
-import path20 from "path";
+import fs20 from "fs";
+import os11 from "os";
+import path21 from "path";
 import readline2 from "readline";
 var SKIP_DIRS = /* @__PURE__ */ new Set(["tool-results"]);
 async function resolveRepoPath(projectDir) {
-  const indexPath = path20.join(projectDir, "sessions-index.json");
+  const indexPath = path21.join(projectDir, "sessions-index.json");
   try {
-    const raw = await fs18.promises.readFile(indexPath, "utf-8");
+    const raw = await fs20.promises.readFile(indexPath, "utf-8");
     const data = JSON.parse(raw);
     if (data.originalPath && typeof data.originalPath === "string") {
       return data.originalPath;
@@ -15327,12 +16815,12 @@ async function resolveRepoPath(projectDir) {
   } catch {
   }
   const cwdCounts = /* @__PURE__ */ new Map();
-  const entries = await fs18.promises.readdir(projectDir, {
+  const entries = await fs20.promises.readdir(projectDir, {
     withFileTypes: true
   });
   for (const entry of entries) {
     if (!entry.isFile() || !entry.name.endsWith(".jsonl")) continue;
-    const cwd = await extractCwdFromJsonl(path20.join(projectDir, entry.name));
+    const cwd = await extractCwdFromJsonl(path21.join(projectDir, entry.name));
     if (cwd) {
       cwdCounts.set(cwd, (cwdCounts.get(cwd) ?? 0) + 1);
     }
@@ -15351,7 +16839,7 @@ async function resolveRepoPath(projectDir) {
   return null;
 }
 async function extractCwdFromJsonl(filePath) {
-  const stream = fs18.createReadStream(filePath, { encoding: "utf-8" });
+  const stream = fs20.createReadStream(filePath, { encoding: "utf-8" });
   const rl = readline2.createInterface({ input: stream, crlfDelay: Infinity });
   try {
     for await (const line of rl) {
@@ -15373,12 +16861,12 @@ async function extractCwdFromJsonl(filePath) {
 async function collectFiles(dir, baseDir, sourceName, repoPath, results) {
   let entries;
   try {
-    entries = await fs18.promises.readdir(dir, { withFileTypes: true });
+    entries = await fs20.promises.readdir(dir, { withFileTypes: true });
   } catch {
     return;
   }
   for (const entry of entries) {
-    const fullPath = path20.join(dir, entry.name);
+    const fullPath = path21.join(dir, entry.name);
     if (entry.isDirectory()) {
       if (SKIP_DIRS.has(entry.name)) continue;
       await collectFiles(fullPath, baseDir, sourceName, repoPath, results);
@@ -15400,19 +16888,19 @@ function fallbackDecode(encodedName) {
 var ClaudeSource = class {
   name = "claude";
   async scan() {
-    const baseDir = path20.join(os10.homedir(), ".claude", "projects");
+    const baseDir = path21.join(os11.homedir(), ".claude", "projects");
     try {
-      await fs18.promises.access(baseDir);
+      await fs20.promises.access(baseDir);
     } catch {
       return [];
     }
-    const projectDirs = await fs18.promises.readdir(baseDir, {
+    const projectDirs = await fs20.promises.readdir(baseDir, {
       withFileTypes: true
     });
     const dirEntries = projectDirs.filter((d) => d.isDirectory());
     const resultArrays = await Promise.all(
       dirEntries.map(async (dir) => {
-        const projectPath = path20.join(baseDir, dir.name);
+        const projectPath = path21.join(baseDir, dir.name);
         const repoPath = await resolveRepoPath(projectPath) ?? fallbackDecode(dir.name);
         const files = [];
         await collectFiles(
@@ -15430,12 +16918,12 @@ var ClaudeSource = class {
 };
 
 // src/sources/codex.ts
-import fs19 from "fs";
-import os11 from "os";
-import path21 from "path";
+import fs21 from "fs";
+import os12 from "os";
+import path22 from "path";
 import readline3 from "readline";
-async function parseSessionMeta(filePath) {
-  const stream = fs19.createReadStream(filePath, { encoding: "utf-8" });
+async function parseSessionMeta2(filePath) {
+  const stream = fs21.createReadStream(filePath, { encoding: "utf-8" });
   const rl = readline3.createInterface({ input: stream, crlfDelay: Infinity });
   try {
     for await (const line of rl) {
@@ -15460,12 +16948,12 @@ async function findJsonlFiles(dir) {
   async function walk(d) {
     let entries;
     try {
-      entries = await fs19.promises.readdir(d, { withFileTypes: true });
+      entries = await fs21.promises.readdir(d, { withFileTypes: true });
     } catch {
       return;
     }
     for (const entry of entries) {
-      const full = path21.join(d, entry.name);
+      const full = path22.join(d, entry.name);
       if (entry.isDirectory()) {
         await walk(full);
       } else if (entry.isFile() && entry.name.endsWith(".jsonl")) {
@@ -15479,11 +16967,11 @@ async function findJsonlFiles(dir) {
 async function loadHistory(historyPath) {
   const map = /* @__PURE__ */ new Map();
   try {
-    await fs19.promises.access(historyPath);
+    await fs21.promises.access(historyPath);
   } catch {
     return map;
   }
-  const stream = fs19.createReadStream(historyPath, { encoding: "utf-8" });
+  const stream = fs21.createReadStream(historyPath, { encoding: "utf-8" });
   const rl = readline3.createInterface({ input: stream, crlfDelay: Infinity });
   try {
     for await (const line of rl) {
@@ -15510,22 +16998,22 @@ async function loadHistory(historyPath) {
 var CodexSource = class {
   name = "codex";
   async scan() {
-    const codexDir = path21.join(os11.homedir(), ".codex");
-    const sessionsDir = path21.join(codexDir, "sessions");
+    const codexDir = path22.join(os12.homedir(), ".codex");
+    const sessionsDir2 = path22.join(codexDir, "sessions");
     try {
-      await fs19.promises.access(sessionsDir);
+      await fs21.promises.access(sessionsDir2);
     } catch {
       return [];
     }
-    const historyPath = path21.join(codexDir, "history.jsonl");
+    const historyPath = path22.join(codexDir, "history.jsonl");
     const [jsonlFiles, historyMap] = await Promise.all([
-      findJsonlFiles(sessionsDir),
+      findJsonlFiles(sessionsDir2),
       loadHistory(historyPath)
     ]);
     const results = [];
     const metaResults = await Promise.all(
       jsonlFiles.map(async (filePath) => {
-        const meta = await parseSessionMeta(filePath);
+        const meta = await parseSessionMeta2(filePath);
         return meta ? { filePath, meta } : null;
       })
     );
@@ -15540,9 +17028,9 @@ var CodexSource = class {
       });
       const historyLines = historyMap.get(meta.sessionId);
       if (historyLines) {
-        const sessionDir = path21.relative(sessionsDir, path21.dirname(filePath));
-        const historyAbsPath = path21.join(
-          sessionsDir,
+        const sessionDir = path22.relative(sessionsDir2, path22.dirname(filePath));
+        const historyAbsPath = path22.join(
+          sessionsDir2,
           sessionDir,
           `history-${meta.sessionId}.jsonl`
         );
@@ -15561,18 +17049,18 @@ var CodexSource = class {
 };
 
 // src/sources/copilotChat.ts
-import fs20 from "fs";
-import os12 from "os";
-import path22 from "path";
+import fs22 from "fs";
+import os13 from "os";
+import path23 from "path";
 import { fileURLToPath } from "url";
 function vsCodeUserDirs() {
-  const home = os12.homedir();
+  const home = os13.homedir();
   const dirs = [
-    path22.join(home, "Library", "Application Support", "Code", "User"),
-    path22.join(home, ".config", "Code", "User")
+    path23.join(home, "Library", "Application Support", "Code", "User"),
+    path23.join(home, ".config", "Code", "User")
   ];
   if (process.env.APPDATA) {
-    dirs.push(path22.join(process.env.APPDATA, "Code", "User"));
+    dirs.push(path23.join(process.env.APPDATA, "Code", "User"));
   }
   return dirs;
 }
@@ -15587,7 +17075,7 @@ function uriToFsPath(uri) {
 async function readWorkspaceFolder(workspaceJsonPath) {
   let raw;
   try {
-    raw = await fs20.promises.readFile(workspaceJsonPath, "utf-8");
+    raw = await fs22.promises.readFile(workspaceJsonPath, "utf-8");
   } catch {
     return null;
   }
@@ -15609,10 +17097,10 @@ var CopilotChatSource = class {
   async scan() {
     const results = [];
     for (const userDir of vsCodeUserDirs()) {
-      const workspaceStorage = path22.join(userDir, "workspaceStorage");
+      const workspaceStorage = path23.join(userDir, "workspaceStorage");
       let hashDirs;
       try {
-        hashDirs = await fs20.promises.readdir(workspaceStorage, {
+        hashDirs = await fs22.promises.readdir(workspaceStorage, {
           withFileTypes: true
         });
       } catch {
@@ -15620,22 +17108,22 @@ var CopilotChatSource = class {
       }
       for (const hash of hashDirs) {
         if (!hash.isDirectory()) continue;
-        const wsRoot = path22.join(workspaceStorage, hash.name);
-        const transcriptsDir = path22.join(
+        const wsRoot = path23.join(workspaceStorage, hash.name);
+        const transcriptsDir = path23.join(
           wsRoot,
           "GitHub.copilot-chat",
           "transcripts"
         );
         let transcriptEntries;
         try {
-          transcriptEntries = await fs20.promises.readdir(transcriptsDir, {
+          transcriptEntries = await fs22.promises.readdir(transcriptsDir, {
             withFileTypes: true
           });
         } catch {
           continue;
         }
         const repoPath = await readWorkspaceFolder(
-          path22.join(wsRoot, "workspace.json")
+          path23.join(wsRoot, "workspace.json")
         );
         if (!repoPath) continue;
         for (const entry of transcriptEntries) {
@@ -15643,7 +17131,7 @@ var CopilotChatSource = class {
           const sessionId = entry.name.slice(0, -".jsonl".length);
           results.push({
             sourceName: this.name,
-            absolutePath: path22.join(transcriptsDir, entry.name),
+            absolutePath: path23.join(transcriptsDir, entry.name),
             repoPath,
             metadata: { sessionId }
           });
@@ -15683,7 +17171,7 @@ function reportRedactionStats(noun, stats) {
 async function filterByTimeRange(group, range) {
   const results = await Promise.all(
     group.files.map(
-      (f) => fs21.promises.stat(f.absolutePath).then((s) => ({ file: f, stat: s })).catch(() => null)
+      (f) => fs23.promises.stat(f.absolutePath).then((s) => ({ file: f, stat: s })).catch(() => null)
     )
   );
   const filtered = [];
@@ -15710,10 +17198,10 @@ async function runInteractive() {
   s.start(`Scanning ${source.name} logs...`);
   const allFiles = await source.scan();
   const allGroups = await mergeByRepo(allFiles);
-  const repoRoot = path23.resolve(repo.root);
+  const repoRoot = path24.resolve(repo.root);
   const matching = allGroups.filter((g) => {
-    const resolved = path23.resolve(g.repoPath);
-    return resolved === repoRoot || resolved.startsWith(repoRoot + path23.sep);
+    const resolved = path24.resolve(g.repoPath);
+    return resolved === repoRoot || resolved.startsWith(repoRoot + path24.sep);
   });
   if (matching.length === 0) {
     s.stop(`No ${source.name} logs found for ${repo.name}.`);
@@ -15744,7 +17232,7 @@ async function runInteractive() {
     }
   }
   const envFileNames = await discoverEnvFiles(repoRoot);
-  const envFilePaths = envFileNames.map((n) => path23.join(repoRoot, n));
+  const envFilePaths = envFileNames.map((n) => path24.join(repoRoot, n));
   const additionalFiles = await promptSecretFiles(envFileNames);
   const secretResult = await collectSecrets(
     repoRoot,