memhouse 0.18.12 → 0.20.1

package/memhouse/shipper/capture.js

@@ -0,0 +1,2571 @@
+#!/usr/bin/env node
+// memhouse CAPTURE — the schema-v3 shipper (docs/design/source-identity.md, draft 5, §4–§5;
+// the build contract is docs/design/source-identity-build.md).
+//
+// One pass:
+//   1. stat every source file under MEMHOUSE_SOURCE_ROOTS against the local cache; an
+//      unchanged file costs a stat and nothing else.
+//   2. for a changed file, read its `files` row from the house FIRST — the house is the truth,
+//      the cache is only an accelerator — and validate the bytes it describes: the inode and
+//      the 64 KiB before `upto` on every pass; the whole prefix (a SHA-256 digest of [0, upto))
+//      the first time this process touches the file, after an inode change, when the cache was
+//      rebuilt, and once a day. A copy shorter than `upto` written by another host is a lagging
+//      synced copy and waits; anything else that fails is a non-append change: `fgen` is bumped,
+//      the file re-archived and re-derived, and the keys that vanished are tombstoned.
+//   3. read only from `reparse_from` (the start of the earliest open unit), archive the bytes
+//      past `upto` exactly (UTF-8, or base64 when not UTF-8), derive, and write in this order:
+//      archive → turns/calls → files → sessions; the local cache advances last. A crash re-sends,
+//      and every key is idempotent.
+//   A trailing line without its newline is held; once unchanged for 10 minutes it is archived
+//   as kind = 'fragment' (and parsed only when complete). A pass reads no conversation rows —
+//   except once per session that holds converted legacy rows:
+//   4. DEDUPE (dedupe-v3.js): when a session's capture has caught up with its files for the first
+//      time, its converted `legacy:` rows are matched row by row against what was captured;
+//      every matched legacy ship row is tombstoned, every unmatched one stays live (and is
+//      reported), and their share of the totals is kept in a `files` row of role 'legacy' that
+//      also marks the session deduped. A sweep finds sessions captured before that marker existed.
+//
+// CLI:   node memhouse/shipper/capture.js [--loop [sec]] [--backfill] [--no-dedupe] [--duplicates] [--redupe] [--dry-run]
+//        --redupe: a one-shot repair after the pass — re-plans deduped sessions that still have live
+//        legacy ship rows (dedupeSweep before 0.20.0-dev.2 deduped against partial captures)
+//        (also `memhouse ship --v3`, or `ship.js` with MEMHOUSE_SCHEMA=3)
+// Env:   MEMHOUSE_URL, MEMHOUSE_USER, MEMHOUSE_PASSWORD (or MEMHOUSE_PASSWORD_FILE), MEMHOUSE_DB
+//        (default mem; the archive is <db>_archive), MEMHOUSE_SCHEMA=3, MEMHOUSE_HOME (state),
+//        MEMHOUSE_SOURCE_ROOTS — comma-separated `[claude:|codex:][name=]<dir>`, each a Claude
+//        Code config dir or its projects/ dir, or a Codex home or its sessions/ dir. Unset, it
+//        defaults to what the 0.18 shipper reads on this machine (source-roots.js: every Claude
+//        Code config dir the legacy adapter finds, honouring MEMHOUSE_CLAUDE_ROOTS and
+//        MEMHOUSE_EDITORS, plus the Codex sessions dirs) and is re-resolved every pass, so a new
+//        playbook install is picked up without a restart. Set it to read only a copy (the dev CT).
+
+'use strict';
+
+const fs = require('fs');
+const os = require('os');
+const path = require('path');
+const crypto = require('crypto');
+const zlib = require('zlib');
+const { isUtf8 } = require('buffer');
+
+const base = require('../../editors/base').capture;
+const dedupe = require('./dedupe-v3');
+const forks = require('./forks');
+
+const BLOCK = 256 * 1024;                 // prefix digest block: a steady pass re-hashes at most one
+const ANCHOR = 64 * 1024;                 // the window validated on every pass
+const CHUNK = 1 << 20;                    // one archive row carries at most this many raw bytes
+const BATCH_ROWS = 2000;
+const BATCH_BYTES = 16 * 1024 * 1024;
+const PASS_BUDGET = Number(process.env.MEMHOUSE_PASS_BYTES) || 512 * 1024 * 1024;
+const GROUP_BYTES = 64 * 1024 * 1024;     // what one write cycle holds in memory
+const FRAGMENT_MS = 10 * 60 * 1000;
+const PREFIX_EVERY_MS = 24 * 3600 * 1000;
+const LIVE_MS = 15 * 60 * 1000;
+const EPOCH_TS = '1970-01-01 00:00:00.000';
+
+function defaultAdapters() {
+  return { 'claude-code': require('../../editors/claude').capture, codex: require('../../editors/codex').capture };
+}
+
+const sha256 = (buf) => crypto.createHash('sha256').update(buf).digest('hex');
+// A session's key within this machine: harness, the harness's data folder, session id, and the
+// incarnation when the harness reuses ids inside one store (layout 3.2).
+const skey = (harness, sid, hp = '', inc = '') => `${harness}\t${hp}\t${sid}${inc ? `\t${inc}` : ''}`;
+// A source file's key within this machine: its session's key and its file key.
+const fkey = (x) => `${skey(x.harness, x.session_id, x.harness_path || '', x.incarnation || '')}\t${x.file_key}`;
+/** The harness's data folder for a capture root, symlink-resolved: ~/.claude for <dir>/projects, ~/.codex for <dir>/sessions. */
+function harnessPathOf(r) {
+  if (r.harness_path) return r.harness_path;
+  let d = r.dir;
+  const b = path.basename(d);
+  if ((r.harness === 'claude-code' && b === 'projects') || (r.harness === 'codex' && (b === 'sessions' || b === 'archived_sessions'))) d = path.dirname(d);
+  // The contract's rule: absolute, symlink-resolved, the on-disk case (native resolver), no trailing slash.
+  try { return fs.realpathSync.native(d); } catch { return path.resolve(d); }
+}
+/**
+ * The adapter of a store. A pass that reads the bridge and the normalised logs sets one per store
+ * (ctx.storeAdapters): one harness may have a bridged store beside a logged one (Devin Desktop,
+ * Devin Local), and each must be derived by its own adapter. Else the harness's (ctx.adapters).
+ */
+function adapterOf(ctx, x) {
+  const s = ctx.storeAdapters && ctx.storeAdapters.get(`${x.harness}\t${x.harness_path || ''}`);
+  return s || ctx.adapters[x.harness];
+}
+function parseJson(s, dflt) { try { return s ? JSON.parse(s) : dflt; } catch { return dflt; } }
+function hexOrEmpty(v) { const s = String(v || '').replace(/\u0000/g, ''); return /^[0-9a-f]{64}$/i.test(s) ? s.toLowerCase() : ''; }
+
+// ── source roots ────────────────────────────────────────────────────────────────────────────
+function claudeRootName(configDir) {
+  const b = path.basename(configDir);
+  // ~/.claude is the 'default' install; a copy of it may be named for it ('claude').
+  if (b === '.claude' || b === 'claude') return 'default';
+  if (b === 'playbook') return path.basename(path.dirname(configDir));
+  return b.replace(/^\./, '') || 'default';
+}
+function isDir(p) { try { return fs.statSync(p).isDirectory(); } catch { return false; } }
+function classifyRoot(dir, harness, name) {
+  if (!isDir(dir)) throw new Error(`source root ${dir} is not a directory`);
+  const b = path.basename(dir);
+  const claudeOk = harness !== 'codex';
+  const codexOk = harness !== 'claude-code';
+  if (claudeOk && isDir(path.join(dir, 'projects'))) return [{ harness: 'claude-code', dir: path.join(dir, 'projects'), name: name || claudeRootName(dir) }];
+  if (claudeOk && b === 'projects') return [{ harness: 'claude-code', dir, name: name || claudeRootName(path.dirname(dir)) }];
+  if (codexOk) {
+    const subs = ['sessions', 'archived_sessions'].filter((x) => isDir(path.join(dir, x)));
+    if (subs.length) return subs.map((x) => ({ harness: 'codex', dir: path.join(dir, x), name: name || 'default' }));
+    if (b === 'sessions' || b === 'archived_sessions') return [{ harness: 'codex', dir, name: name || 'default' }];
+  }
+  // A directory of Claude Code config dirs (a transcript copy: <dir>/<root>/projects): each one a root.
+  if (claudeOk && !name) {
+    let subs = [];
+    try { subs = fs.readdirSync(dir).filter((x) => isDir(path.join(dir, x, 'projects'))).sort(); } catch { /* unreadable */ }
+    if (subs.length) return subs.map((x) => ({ harness: 'claude-code', dir: path.join(dir, x, 'projects'), name: claudeRootName(path.join(dir, x)) }));
+  }
+  if (harness) return [{ harness, dir, name: name || (harness === 'codex' ? 'default' : claudeRootName(dir)) }];
+  throw new Error(`source root ${dir}: neither a Claude Code projects dir nor a Codex sessions dir — prefix it with claude: or codex:`);
+}
+/** MEMHOUSE_SOURCE_ROOTS → [{ harness, dir, name }]. Entries: `[claude:|codex:][name=]<dir>`, comma-separated. */
+function parseSourceRoots(spec) {
+  const out = [];
+  for (const raw of String(spec || '').split(/[,\n;]/)) {
+    let s = raw.trim();
+    if (!s) continue;
+    let harness = null; let name = null;
+    const m = /^(claude-code|claude|codex):(.*)$/.exec(s);
+    if (m) { harness = m[1] === 'codex' ? 'codex' : 'claude-code'; s = m[2]; }
+    const eq = s.indexOf('=');
+    if (eq > 0 && !s.slice(0, eq).includes('/')) { name = s.slice(0, eq); s = s.slice(eq + 1); }
+    out.push(...classifyRoot(path.resolve(s.replace(/^~(?=$|\/)/, os.homedir())), harness, name));
+  }
+  return out;
+}
+
+// ── discovery ───────────────────────────────────────────────────────────────────────────────
+function statSafe(p) { try { const s = fs.statSync(p); return s.isFile() ? { size: s.size, mtimeMs: Math.floor(s.mtimeMs), ino: Number(s.ino) } : null; } catch { return null; } }
+
+/** Every session under the roots, each with its source files (one entry per file_key). */
+function discover(roots, adapters, report = {}) {
+  const sessions = new Map();
+  report.duplicates = 0;
+  for (const r of roots) {
+    const ad = r.adapter || adapters[r.harness];
+    if (!ad) continue;
+    const hp = harnessPathOf(r);
+    for (const s of ad.sessions(r)) {
+      const k = skey(r.harness, s.session_id, hp, s.incarnation || '');
+      let S = sessions.get(k);
+      if (!S) sessions.set(k, S = { harness: r.harness, session_id: String(s.session_id), harness_path: hp, incarnation: String(s.incarnation || ''), root: s.root || r.name, files: new Map() });
+      for (const f of ad.sourceFiles(s)) {
+        const st = statSafe(f.path);
+        if (!st) continue;
+        const prev = S.files.get(f.file_key);
+        if (prev) {
+          // The same file under two roots (a copied config dir, an archived copy): keep the
+          // longer, then the newer. Two writers must never drive one files row.
+          report.duplicates++;
+          if (st.size < prev.stat.size || (st.size === prev.stat.size && st.mtimeMs <= prev.stat.mtimeMs)) continue;
+        }
+        S.files.set(f.file_key, { ...f, harness: r.harness, session_id: S.session_id, harness_path: hp, incarnation: S.incarnation, root: s.root || r.name, stat: st });
+        if (f.role === 'main') S.root = s.root || r.name;
+      }
+    }
+  }
+  for (const S of sessions.values()) for (const f of S.files.values()) f.root = S.root;
+  return sessions;
+}
+
+// ── local cache: $MEMHOUSE_HOME/state/capture-v3-<house>.json ───────────────────────────────
+// v2: layout 3.2 keys (the store in every key); a v1 cache is rebuilt from the house.
+const CACHE_V = 2;
+class Cache {
+  constructor(file) { this.file = file; this.data = { v: CACHE_V, files: {}, deduped: {} }; this.rebuilt = false; this.dirty = false; }
+  load() {
+    try {
+      const d = JSON.parse(fs.readFileSync(this.file, 'utf-8'));
+      if (d && d.v === CACHE_V && d.files) { this.data = { ...d, deduped: d.deduped || {} }; delete this.data.reconciled; } else this.rebuilt = true;
+    } catch { this.rebuilt = true; }
+    return this;
+  }
+  get(k) { return this.data.files[k] || null; }
+  set(k, v) { this.data.files[k] = v; this.dirty = true; }
+  save() {
+    // A pass that lost its lock (reloadCache sets the guard) never writes the file: it is the holder's.
+    if (!this.dirty || !this.file || (this.guard && this.guard())) return;
+    fs.mkdirSync(path.dirname(this.file), { recursive: true });
+    const tmp = `${this.file}.${process.pid}.tmp`;
+    fs.writeFileSync(tmp, JSON.stringify(this.data), { mode: 0o600 });
+    fs.renameSync(tmp, this.file);
+    this.dirty = false;
+  }
+}
+function cachePath(home, ident) {
+  return path.join(home, 'state', `capture-v3-${sha256(ident).slice(0, 12)}.json`);
+}
+
+// ── bytes ───────────────────────────────────────────────────────────────────────────────────
+function readRange(fd, from, to) {
+  const len = Math.max(0, to - from);
+  const buf = Buffer.allocUnsafe(len);
+  let got = 0;
+  while (got < len) {
+    const n = fs.readSync(fd, buf, got, len - got, from + got);
+    if (!n) break;
+    got += n;
+  }
+  return got === len ? buf : buf.subarray(0, got);
+}
+/** SHA-256 over the SHA-256s of the 256 KiB blocks of [0, upto): computable from the file alone, and extendable. */
+function digestOf(blocks, partialHex) {
+  const h = crypto.createHash('sha256');
+  for (const b of blocks) h.update(Buffer.from(b, 'hex'));
+  if (partialHex) h.update(Buffer.from(partialHex, 'hex'));
+  return h.digest('hex');
+}
+function prefixDigest(fd, upto) {
+  const blocks = [];
+  let partial = null;
+  for (let off = 0; off < upto; off += BLOCK) {
+    const end = Math.min(off + BLOCK, upto);
+    const hx = sha256(readRange(fd, off, end));
+    if (end - off === BLOCK) blocks.push(hx); else partial = hx;
+  }
+  return { hex: digestOf(blocks, partial), blocks };
+}
+/** Extend full-block hashes over [0, newUpto) given `buf` that starts at `bufFrom` <= blocks.length·BLOCK. */
+function extendDigest(blocks, buf, bufFrom, newUpto) {
+  const out = blocks.slice();
+  let off = out.length * BLOCK;
+  let partial = null;
+  while (off < newUpto) {
+    const end = Math.min(off + BLOCK, newUpto);
+    const hx = sha256(buf.subarray(off - bufFrom, end - bufFrom));
+    if (end - off === BLOCK) out.push(hx); else partial = hx;
+    off = end;
+  }
+  return { hex: digestOf(out, partial), blocks: out };
+}
+function digestBuffer(buf) {
+  const blocks = [];
+  let partial = null;
+  for (let off = 0; off < buf.length; off += BLOCK) {
+    const end = Math.min(off + BLOCK, buf.length);
+    const hx = sha256(buf.subarray(off, end));
+    if (end - off === BLOCK) blocks.push(hx); else partial = hx;
+  }
+  return digestOf(blocks, partial);
+}
+function anchorOf(fd, upto) { return sha256(readRange(fd, Math.max(0, upto - ANCHOR), upto)); }
+
+/** Archive rows for one record's bytes: UTF-8 travels as text, anything else as base64; chunked at CHUNK. */
+function archiveRows(f, fgen, pos, bytes, kind, host, capturedAt) {
+  const sha = sha256(bytes);
+  const utf8 = isUtf8(bytes);
+  const rows = [];
+  let off = 0; let chunk = 0;
+  do {
+    let end = Math.min(bytes.length, off + CHUNK);
+    if (utf8) while (end < bytes.length && end > off && (bytes[end] & 0xC0) === 0x80) end--;
+    const part = bytes.subarray(off, end);
+    rows.push({
+      harness: f.harness, harness_path: String(f.harness_path || ''), session_id: f.session_id, incarnation: String(f.incarnation || ''),
+      file_key: f.file_key, fgen, pos, chunk, sha, kind,
+      enc: utf8 ? '' : 'b64', raw: utf8 ? part.toString('utf-8') : part.toString('base64'), host, captured_at: capturedAt,
+    });
+    off = end; chunk++;
+  } while (off < bytes.length);
+  return rows;
+}
+/**
+ * A read manifest (harness-sessions-sql §4.1): one archive row per read, so the archive alone shows what
+ * went away too — a source reset to empty, a source that vanished. pos 0, chunk 0, kind and enc
+ * 'manifest', sha the sha256 of raw (a record at pos 0 has another sha, so the two never collide).
+ * raw: { progress, continuity: 'appended' | 'reset' | 'snapshot', units: [[pos, sha], …], gone,
+ * source_gone, policy? } — policy ('kept' | 'removed') only on a source_gone manifest.
+ */
+function manifestRow(f, fgen, m, host, capturedAt) {
+  const raw = JSON.stringify({
+    progress: m.progress, continuity: m.continuity, units: m.units || [], gone: [], source_gone: !!m.source_gone,
+    ...(m.source_gone ? { policy: m.policy } : {}),
+  });
+  return {
+    harness: f.harness, harness_path: String(f.harness_path || ''), session_id: f.session_id, incarnation: String(f.incarnation || ''),
+    file_key: f.file_key, fgen, pos: 0, chunk: 0, sha: sha256(Buffer.from(raw, 'utf-8')), kind: 'manifest', enc: 'manifest', raw, host, captured_at: capturedAt,
+  };
+}
+/** The units a read delivered, as its archive rows name them: [pos, the whole record's sha], in order. */
+const unitsOf = (rows) => rows.filter((r) => r.kind !== 'manifest' && r.kind !== 'fragment' && Number(r.chunk) === 0).map((r) => [String(r.pos), r.sha]);
+
+/**
+ * The records a source holds now, from its archive rows alone (every generation, any order): the
+ * harness-sessions-sql §4.1 replay. The highest generation is current; a source_gone one replays as its
+ * policy says ('kept': the generation before it; 'removed', or no policy: empty). Within the
+ * generation, manifests fold in progress order (units added, gone dropped); a generation archived
+ * before manifests existed has no opening manifest and starts from all its records.
+ * Returns { fgen, records, empty, source_gone, policy } (fgen null when nothing was archived).
+ */
+function replayArchive(rows) {
+  const gens = new Map();
+  for (const r of rows) {
+    const g = Number(r.fgen);
+    if (!gens.has(g)) gens.set(g, { records: [], manifests: [] });
+    if (r.kind === 'manifest') gens.get(g).manifests.push({ ...JSON.parse(r.raw), at: String(r.captured_at || '') });
+    else if (r.kind === 'record') gens.get(g).records.push(r);
+  }
+  const order = [...gens.keys()].sort((a, b) => b - a);
+  let i = 0; let gone = null;
+  while (i < order.length) {
+    // Two source_gone events in one generation should not happen (each is allocated past the
+    // archive's highest); if they do, the later one is what was done last, and "removed" wins a tie.
+    const m = gens.get(order[i]).manifests.filter((x) => x.source_gone)
+      .sort((a, b) => (a.at < b.at ? -1 : a.at > b.at ? 1 : (a.policy === 'kept' ? -1 : 1) - (b.policy === 'kept' ? -1 : 1))).pop();
+    if (!m) break;
+    gone = gone || { policy: m.policy === 'kept' ? 'kept' : 'removed' };
+    if (gone.policy !== 'kept') return { fgen: order[i], records: [], empty: true, source_gone: true, policy: gone.policy };
+    i++;
+  }
+  if (i >= order.length) return { fgen: null, records: [], empty: true, source_gone: !!gone, policy: gone ? gone.policy : null };
+  const fgen = order[i]; const G = gens.get(fgen);
+  const ms = G.manifests.slice().sort((a, b) => a.progress - b.progress);
+  const opened = ms.some((x) => x.continuity === 'reset' || x.continuity === 'snapshot');
+  const units = new Map();
+  if (!opened) for (const r of G.records) if (Number(r.chunk) === 0 && !units.has(String(r.pos))) units.set(String(r.pos), null);
+  for (const x of ms) {
+    if (x.continuity === 'reset' || x.continuity === 'snapshot') units.clear();
+    for (const [k, sha] of x.units) { units.delete(k); units.set(k, sha); }
+    for (const k of x.gone || []) units.delete(String(k));
+  }
+  const want = new Set(units.keys());
+  const picked = G.records.filter((r) => want.has(String(r.pos)) && (units.get(String(r.pos)) == null || units.get(String(r.pos)) === r.sha));
+  const recs = recordsFromArchive(picked);
+  const at = new Map(recs.map((r) => [String(r.pos), r]));
+  const records = [...units.keys()].map((k) => at.get(k)).filter(Boolean);
+  return { fgen, records, empty: !records.length, source_gone: !!gone, policy: gone ? gone.policy : null };
+}
+
+/** Archive rows of one generation → derive records (kind = 'record' only; a fragment is never parsed). */
+function recordsFromArchive(rows) {
+  const byPos = new Map();
+  for (const r of rows) {
+    if (r.kind !== 'record') continue;
+    const pos = Number(r.pos);
+    let g = byPos.get(pos);
+    if (!g) byPos.set(pos, g = new Map());
+    const v = g.get(r.sha) || { chunks: [], at: r.captured_at };
+    v.chunks[Number(r.chunk)] = r.enc === 'b64' ? Buffer.from(r.raw, 'base64') : Buffer.from(r.raw, 'utf-8');
+    if (r.captured_at < v.at) v.at = r.captured_at;
+    g.set(r.sha, v);
+  }
+  const out = [];
+  for (const pos of [...byPos.keys()].sort((a, b) => a - b)) {
+    // Byte history: two versions at one position within a generation should not happen (a
+    // change bumps fgen); if it does, the newest capture is the one the file holds.
+    const versions = [...byPos.get(pos).values()].sort((a, b) => (a.at < b.at ? -1 : 1));
+    const v = versions[versions.length - 1];
+    const bytes = Buffer.concat(v.chunks.filter(Boolean));
+    out.push(toRecord(pos, bytes, Date.parse(String(v.at).replace(' ', 'T') + 'Z')));
+  }
+  return out;
+}
+/** The file a generation's archive rows describe, byte for byte (records, each with its newline). */
+function rebuildFromArchive(rows) {
+  const parts = [];
+  const byPos = new Map();
+  for (const r of rows) {
+    if (r.kind !== 'record') continue;
+    const g = byPos.get(Number(r.pos)) || [];
+    g[Number(r.chunk)] = r.enc === 'b64' ? Buffer.from(r.raw, 'base64') : Buffer.from(r.raw, 'utf-8');
+    byPos.set(Number(r.pos), g);
+  }
+  for (const pos of [...byPos.keys()].sort((a, b) => a - b)) { parts.push(Buffer.concat(byPos.get(pos).filter(Boolean)), Buffer.from('\n')); }
+  return Buffer.concat(parts);
+}
+function toRecord(pos, bytes, capturedAt) {
+  let obj = null;
+  if (bytes.length && isUtf8(bytes)) { try { obj = JSON.parse(bytes.toString('utf-8')); } catch { obj = null; } }
+  if (obj !== null && (typeof obj !== 'object' || Array.isArray(obj))) obj = null;
+  return { pos, end: pos + bytes.length + 1, obj, capturedAt, empty: bytes.length === 0 };
+}
+/** Complete lines of `buf` (which starts at `bufFrom`) from `start`; the bytes after the last newline. */
+function splitLines(buf, bufFrom, start) {
+  const lines = [];
+  let off = start - bufFrom;
+  for (;;) {
+    const nl = buf.indexOf(0x0A, off);
+    if (nl === -1) break;
+    lines.push({ pos: bufFrom + off, bytes: buf.subarray(off, nl) });
+    off = nl + 1;
+  }
+  return { lines, tailPos: bufFrom + off, tail: buf.subarray(off) };
+}
+
+// ── one source file ─────────────────────────────────────────────────────────────────────────
+function fileCtx(f, host, fgen, upto, reparseFrom, attr) {
+  return {
+    harness: f.harness, session_id: f.session_id, harness_path: String(f.harness_path || ''), incarnation: String(f.incarnation || ''), file_key: f.file_key, root: f.root, host,
+    agent_id: f.agent_id || '', agent_type: attr.agent_type || '', agent_desc: attr.agent_desc || '',
+    workflow: f.workflow || '', fgen, upto, reparse_from: reparseFrom,
+  };
+}
+function filesRow(f, ctx, o) {
+  const c = o.contrib || {};
+  return {
+    harness: f.harness, harness_path: String(f.harness_path || ''), session_id: f.session_id, incarnation: String(f.incarnation || ''),
+    file_key: f.file_key, agent_id: f.agent_id || '', role: f.role,
+    agent_type: o.attr.agent_type || '', agent_desc: o.attr.agent_desc || '',
+    fgen: o.fgen, upto: o.upto, reparse_from: o.reparse_from, derive_state: JSON.stringify(o.state || {}),
+    adapter_ver: o.adapter_ver, size: o.size, inode: o.ino, anchor_sha: o.anchor, prefix_sha: o.prefix,
+    is_deleted: 0, contrib: JSON.stringify(c), first_ts: c.first_ts || EPOCH_TS, last_ts: c.last_ts || EPOCH_TS,
+    host: ctx.host,
+  };
+}
+const verOf = (r) => base.revOf(r.fgen, r.upto);
+/**
+ * Layout 3.2: a session belongs to its harness store. The reference every house query takes:
+ * the harness, this machine's host, the harness root's label, the session id, the incarnation.
+ */
+function refOf(x, host) {
+  return {
+    harness: String(x.harness), host: String(host ?? x.host ?? ''), harness_path: String(x.harness_path || ''),
+    session_id: String(x.session_id), incarnation: String(x.incarnation || ''),
+  };
+}
+
+/** Tombstones for vanished keys: the exact old rows read back from the house, copied whole. */
+async function tombstonesFor(ctx, fc, vanished, rev, { removed = false } = {}) {
+  // `removed`: the keys left the source (a rewrite) — kept as removed versions. Otherwise they are
+  // duplicates of a re-derivation (an adapter upgrade, re-keyed open units) — physical tombstones.
+  const mark = removed ? base.removedOf : base.tombstoneOf;
+  const ref = refOf(fc, fc.host);
+  const out = { turns: [], calls: [] };
+  if (vanished.turns.length) {
+    for (const r of await ctx.house.rowsByKey('turns', ref, vanished.turns)) out.turns.push(mark('turns', r, rev));
+  }
+  if (vanished.calls.length) {
+    for (const r of await ctx.house.rowsByKey('calls', ref, vanished.calls)) out.calls.push(mark('calls', r, rev));
+  }
+  return out;
+}
+/** Keys ({ t: [[message_id, part_id, ts]], c: [[call_id, ts]] }) the new derivation no longer produces. */
+function vanishedFrom(old, res) {
+  const have = { t: new Set(res.turns.map(base.turnKey)), c: new Set(res.calls.map(base.callKey)) };
+  return {
+    turns: (old.t || []).filter(([message_id, part_id, ts]) => !have.t.has(base.turnKey({ ts, message_id, part_id })))
+      .map(([message_id, part_id, ts]) => ({ message_id, part_id: String(part_id), ts })),
+    calls: (old.c || []).filter(([call_id, ts]) => !have.c.has(base.callKey({ ts, call_id })))
+      .map(([call_id, ts]) => ({ call_id, ts })),
+  };
+}
+function liveKeys(res) {
+  return {
+    t: res.turns.map((r) => [r.message_id, r.part_id, r.ts, r.role, r.kind]),
+    c: res.calls.map((r) => [r.call_id, r.ts, r.message_id]),
+  };
+}
+
+async function captureSide(ctx, f, H, C) {
+  const out = { archive: [], turns: [], calls: [], files: null, cache: null, bytes: 0, more: false, event: null };
+  const ad = adapterOf(ctx, f);
+  let bytes;
+  try { bytes = fs.readFileSync(f.path); } catch { return out; }
+  const size = bytes.length;
+  const sha = sha256(bytes);
+  const digest = digestBuffer(bytes);
+  // A side file back after it vanished opens a generation past the source_gone one, whatever its bytes.
+  const goneGen = goneGenOf(C, H, ctx.archGen && ctx.archGen.get(fkey(f)));
+  const unchanged = goneGen < 0 && H && hexOrEmpty(H.prefix_sha) === digest && Number(H.upto) === size;
+  const fgen = H ? (unchanged ? Number(H.fgen) : Math.max(Number(H.fgen), goneGen) + 1) : (C ? Math.max(Number(C.fgen), goneGen + 1) : 0);
+  const attr = ad.attribution ? ad.attribution(f) : {};
+  if (!unchanged) {
+    out.archive = archiveRows(f, fgen, 0, bytes, 'side-file', ctx.host, base.chTs(ctx.now()));
+    out.archive.push(manifestRow(f, fgen, { progress: size, continuity: 'snapshot', units: [['0', sha]] }, ctx.host, base.chTs(ctx.now())));
+    out.files = filesRow(f, ctx, {
+      attr, fgen, upto: size, reparse_from: size, state: {}, adapter_ver: ad.deriveVersion, size, ino: f.stat.ino,
+      anchor: sha256(bytes.subarray(Math.max(0, size - ANCHOR))), prefix: digest,
+      contrib: base.serializeContrib(base.newContrib()),
+    });
+    out.bytes = size;
+    out.event = H ? 'side-changed' : 'side-new';
+  }
+  out.cache = { size, mtimeMs: f.stat.mtimeMs, ino: f.stat.ino, fgen, upto: size, adapter_ver: ad.deriveVersion, prefixAt: ctx.now(), path: f.path, archAt: archAtOf(ctx, fkey(f), C, ctx.now()) };
+  return out;
+}
+
+/**
+ * Plan the capture of one changed file: what to archive, which rows to write, its new `files`
+ * row and cache entry. Reads the file; writes nothing (the caller writes, in order).
+ */
+async function captureFile(ctx, f, H, C, budget) {
+  if (f.role === 'side') return captureSide(ctx, f, H, C);
+  const ad = adapterOf(ctx, f);
+  const now = ctx.now();
+  const out = { archive: [], turns: [], calls: [], files: null, cache: null, bytes: 0, more: false, event: null };
+  const k = fkey(f);
+  let fd;
+  try { fd = fs.openSync(f.path, 'r'); } catch { out.event = 'unreadable'; return out; }
+  try {
+    const st = fs.fstatSync(fd);
+    const size = st.size; const ino = Number(st.ino);
+    let fgen = H ? Number(H.fgen) : (C ? Number(C.fgen) : 0);
+    let upto = H ? Number(H.upto) : 0;
+    let reparseFrom = H ? Number(H.reparse_from) : 0;
+    let state = H ? parseJson(H.derive_state, null) : null;
+    // A replay starts from the snapshot taken at reparse_from. Without a usable one (unreadable,
+    // or an older state format) the only safe start is the beginning of the file.
+    if (state && state.v !== base.CAPTURE_STATE_V) state = null;
+    if (!state) reparseFrom = 0;
+    let blocks = [];
+    let prefixAt = C && C.prefixAt ? C.prefixAt : 0;
+    let rewrite = null;
+
+    // A source back after it vanished (a source_gone manifest recorded it) is read again from the
+    // start, as a new generation past the source_gone one: the archive's current generation is then
+    // the file as it is, not the event that it was gone.
+    const goneGen = goneGenOf(C, H, ctx.archGen && ctx.archGen.get(k));
+    // A gone mark without a generation (recordVanished found the files row deleted: a superseded
+    // bridge source) still forces the re-read: appended into the deleted row's generation, the
+    // source would share it with that generation's "removed" manifest and replay as empty.
+    if (H && (goneGen >= 0 || (C && C.gone))) rewrite = 'reappeared';
+    // Validate what the house row describes against the bytes here.
+    else if (H && upto > 0) {
+      if (size < upto) {
+        rewrite = 'shrunk';
+      } else if (anchorOf(fd, upto) !== hexOrEmpty(H.anchor_sha)) {
+        rewrite = 'anchor';
+      } else {
+        const cacheMatches = C && Number(C.fgen) === fgen && Number(C.upto) === upto && Array.isArray(C.blocks);
+        const full = !cacheMatches || C.ino !== ino || !ctx.validated.has(k) || now - prefixAt > PREFIX_EVERY_MS;
+        if (full) {
+          const p = prefixDigest(fd, upto);
+          if (p.hex !== hexOrEmpty(H.prefix_sha)) rewrite = 'prefix';
+          else { blocks = p.blocks; prefixAt = now; ctx.validated.add(k); }
+        } else blocks = C.blocks;
+      }
+    }
+    // A row derived by a NEWER adapter (another host already upgraded) is never re-derived
+    // backwards: two versions would rewrite each other's rows on every pass.
+    if (!rewrite && H && Number(H.adapter_ver) > ad.deriveVersion) { out.event = 'newer-adapter'; out.wait = true; return out; }
+    // Derived by an older adapter: an upgrade — or, with different bytes, a harness switching from
+    // the bridge to its normaliser (log derive versions sit above every bridge version). Either way
+    // the old keys are the house's, and the ones the new derivation no longer produces are
+    // duplicates of it: physical tombstones, never removed versions. With a rewrite in the same
+    // pass, only those the upgrade dropped are (retireBoth).
+    const reAdapter = !!H && Number(H.adapter_ver) < ad.deriveVersion;
+    const upgrade = !rewrite && reAdapter;
+    const attr = ad.attribution ? ad.attribution(f) : {};
+
+    if (rewrite || upgrade) {
+      // Re-derive the whole file: a new generation (rewrite) or a new adapter version (upgrade).
+      // The keys before: re-derived from the archive (rewrite), or what the house holds for this
+      // file (upgrade — the old version's derivation cannot be reproduced).
+      const oldKeys = rewrite && !reAdapter ? await oldGenerationKeys(ctx, f, H, state) : await ctx.house.fileKeys(refOf(f, ctx.host), f.agent_id || '', ctx.agentFileIds(f));
+      // A new generation never reuses one the archive already holds (a source_gone manifest sits one
+      // past the cursor's).
+      const archived = ctx.archChecked && ctx.archChecked.has(k) ? (ctx.archGen.has(k) ? ctx.archGen.get(k) : -1) : await maxGeneration(ctx, f);
+      const newFgen = rewrite ? Math.max(fgen, goneGen, archived) + 1 : fgen;
+      const buf = readRange(fd, 0, size);
+      const { lines, tailPos, tail } = splitLines(buf, 0, 0);
+      const newUpto = tailPos;
+      const records = lines.map((l) => toRecord(l.pos, l.bytes, now));
+      const fc = fileCtx(f, ctx.host, newFgen, newUpto, 0, attr);
+      // A rewrite moves records: positional first-seen times go, those kept by a stable id stay (tsOf).
+      const fbIds = (fb) => Object.fromEntries(Object.entries(fb || {}).filter(([k]) => k.startsWith('id:')));
+      const freshState = { ...base.initialState(ad.adapter), fb: rewrite ? fbIds(state && state.fb) : ((state && state.fb) || {}) };
+      const res = ad.derive({ file: fc, records, state: freshState });
+      const rev = String(base.revOf(newFgen, newUpto));
+      const tomb = rewrite && reAdapter ? await retireBoth(ctx, f, H, state, fc, oldKeys, res, rev)
+        : await tombstonesFor(ctx, fc, vanishedFrom(oldKeys, res), rev, { removed: !!rewrite });
+      // A new generation is archived whole; an upgrade archives only what lies past `upto`.
+      for (const l of lines) if (rewrite || l.pos >= upto) out.archive.push(...archiveRows(f, newFgen, l.pos, l.bytes, 'record', ctx.host, base.chTs(now)));
+      // The read's manifest: a rewrite opens its generation (written even when the file is now empty);
+      // an upgrade that read past the cursor appended to the one it had.
+      if (rewrite) out.archive.push(manifestRow(f, newFgen, { progress: newUpto, continuity: 'reset', units: unitsOf(out.archive) }, ctx.host, base.chTs(now)));
+      else if (newUpto > upto) out.archive.push(manifestRow(f, newFgen, { progress: newUpto, continuity: 'appended', units: unitsOf(out.archive) }, ctx.host, base.chTs(now)));
+      out.turns = [...res.turns, ...tomb.turns];
+      out.calls = [...res.calls, ...tomb.calls];
+      const digest = prefixDigest(fd, newUpto);
+      out.files = filesRow(f, ctx, {
+        attr, fgen: newFgen, upto: newUpto, reparse_from: res.reparse_from, state: res.state, adapter_ver: ad.deriveVersion,
+        size, ino, anchor: anchorOf(fd, newUpto), prefix: digest.hex, contrib: res.contrib,
+      });
+      out.bytes = size;
+      out.event = rewrite ? `rewrite:${rewrite}` : 'upgrade';
+      out.tombstones = [...tomb.turns, ...tomb.calls].filter((r) => Number(r.is_deleted) || Number(r.removed)).length;
+      ctx.validated.add(k);
+      out.cache = cacheEntry(f, { size, ino, fgen: newFgen, upto: newUpto, blocks: digest.blocks, prefixAt: now, adapter_ver: ad.deriveVersion, frag: fragState(C, newFgen, tailPos, tail, now, size, out, f, ctx), archAt: archAtOf(ctx, k, C, now) });
+      return out;
+    }
+
+    // Append: read from the earliest open unit; archive and derive only complete lines.
+    const blockStart = blocks.length * BLOCK;
+    const readFrom = Math.min(reparseFrom, blockStart, upto);
+    const limit = Math.min(size, upto + Math.max(1, budget));
+    let readTo = limit;
+    let buf = readRange(fd, readFrom, readTo);
+    // A single line longer than the budget is read whole: a pass must make progress.
+    while (readTo < size && buf.lastIndexOf(0x0A) < upto - readFrom) {
+      readTo = Math.min(size, readTo + Math.max(readTo - upto, 65536));
+      buf = readRange(fd, readFrom, readTo);
+    }
+    // Consume the complete lines inside the budget — or, when none fits, the one that crosses it.
+    if (readTo > limit || readTo < size) {
+      const inBudget = limit > readFrom ? buf.lastIndexOf(0x0A, limit - readFrom - 1) : -1;
+      const cut = inBudget >= upto - readFrom ? inBudget + 1 : buf.indexOf(0x0A, upto - readFrom) + 1;
+      if (cut > 0 && readFrom + cut < readTo) { buf = buf.subarray(0, cut); readTo = readFrom + cut; }
+    }
+    const { lines, tailPos, tail } = splitLines(buf, readFrom, reparseFrom);
+    const newUpto = Math.max(upto, tailPos);
+    out.more = readTo < size;
+    const fresh = lines.filter((l) => l.pos >= upto);
+    for (const l of fresh) out.archive.push(...archiveRows(f, fgen, l.pos, l.bytes, 'record', ctx.host, base.chTs(now)));
+    // The read's manifest: the first read of a source opens its generation (written even when it
+    // delivered nothing); a later read only when it moved the cursor — one that delivered nothing
+    // would add nothing to the fold.
+    if (!H || newUpto > upto) out.archive.push(manifestRow(f, fgen, { progress: newUpto, continuity: H ? 'appended' : 'reset', units: unitsOf(out.archive) }, ctx.host, base.chTs(now)));
+    out.bytes = newUpto - upto;
+    const frag = fragState(C, fgen, tailPos, readTo === size ? tail : null, now, size, out, f, ctx);
+
+    if (newUpto > upto || !H) {
+      const records = lines.map((l) => toRecord(l.pos, l.bytes, now));
+      if (!state) await restoreFirstSeen(ctx, f, fgen, records);
+      const fc = fileCtx(f, ctx.host, fgen, newUpto, reparseFrom, attr);
+      const res = ad.derive({ file: fc, records, state });
+      const rev = String(base.revOf(fgen, newUpto));
+      const tomb = await tombstonesFor(ctx, fc, base.vanishedKeys(state, res), rev);
+      out.turns = [...res.turns.filter((r) => r._touch >= upto), ...tomb.turns];
+      out.calls = [...res.calls.filter((r) => r._touch >= upto), ...tomb.calls];
+      out.tombstones = tomb.turns.length + tomb.calls.length;
+      const digest = extendDigest(blocks, buf, readFrom, newUpto);
+      blocks = digest.blocks;
+      out.files = filesRow(f, ctx, {
+        attr, fgen, upto: newUpto, reparse_from: res.reparse_from, state: res.state, adapter_ver: ad.deriveVersion,
+        size, ino, anchor: anchorOf(fd, newUpto), prefix: digest.hex, contrib: res.contrib,
+      });
+      out.event = H ? 'append' : 'new';
+      ctx.validated.add(k);
+    }
+    out.cache = cacheEntry(f, { size, ino, fgen, upto: newUpto, blocks, prefixAt: prefixAt || now, adapter_ver: ad.deriveVersion, frag, more: out.more, archAt: archAtOf(ctx, k, C, now) });
+    return out;
+  } finally {
+    fs.closeSync(fd);
+  }
+}
+/**
+ * A record with no timestamp of its own is dated by the captured_at of its FIRST archive row
+ * (§2.1). With the files row (and its derive_state) gone, that first sighting is still in the
+ * archive: read it back, so a re-derive keeps the key instead of minting a new one.
+ * Known limit: the lookup is by byte position within `fgen`, the generation this read starts at.
+ * With the local cache gone as well, that is generation 0, so for a source rewritten since (a
+ * normalised log that changed its history) the positions name other records, or none, and the
+ * records are re-dated under new keys. Not fixed in 0.20 (release notes, Known issues).
+ */
+async function restoreFirstSeen(ctx, f, fgen, records) {
+  const ad = adapterOf(ctx, f);
+  const tsless = ad.tsless || ((o) => typeof o.timestamp !== 'string');
+  const need = records.filter((r) => r.obj && tsless(r.obj)).map((r) => r.pos);
+  if (!need.length || typeof ctx.house.firstCaptured !== 'function') return;
+  const seen = await ctx.house.firstCaptured(refOf(f, ctx.host), f.file_key, fgen, need);
+  for (const r of records) if (seen.has(r.pos)) r.capturedAt = seen.get(r.pos);
+}
+function cacheEntry(f, o) {
+  return { size: o.size, mtimeMs: f.stat.mtimeMs, ino: o.ino, fgen: o.fgen, upto: o.upto, blocks: o.blocks, prefixAt: o.prefixAt, adapter_ver: o.adapter_ver, frag: o.frag || null, more: !!o.more, path: f.path, archAt: o.archAt || 0 };
+}
+/** The highest generation the archive holds for each source ({ fkey: g }; absent: none). */
+async function maxGenerations(ctx, files) {
+  if (!files.length || typeof ctx.house.maxGenerations !== 'function') return new Map();
+  return ctx.house.maxGenerations(files.map((f) => ({ ref: refOf(f, ctx.host), file_key: f.file_key })));
+}
+async function maxGeneration(ctx, f) {
+  const g = (await maxGenerations(ctx, [f])).get(fkey(f));
+  return g === undefined ? -1 : g;
+}
+/**
+ * The source_gone generation of a source that is back (-1: none). The cache says so (C.gone). An
+ * entry without the mark — no entry at all (a lost or rebuilt cache), or one from an older save —
+ * asks the archive (archGen, see runPass): only a source_gone manifest is ever written past the files
+ * row's generation, so an archived generation above it means the source was recorded gone (or a
+ * pass died after its archive insert — a re-read from the start is right for that too).
+ */
+function goneGenOf(C, H, archGen) {
+  if (C && C.gone && Number.isFinite(C.gone.fgen)) return C.gone.fgen;
+  if (H && Number.isFinite(archGen) && archGen > Number(H.fgen)) return archGen;
+  return -1;
+}
+// How often a cache entry without a gone mark is checked against the archive. An older cache
+// restored over a newer one cannot be told from the house's files rows (a vanish leaves them as they
+// were), so the check runs on a missing entry at once and on every other entry at most daily. Until
+// it runs, a returning source appends into its old generation; the archive still replays it right
+// (the "kept" generation replays the one before it, appends included), and the check then moves it.
+const ARCH_CHECK_MS = 24 * 3600 * 1000;
+/** When this source was last checked against the archive: now, if it was this pass. */
+const archAtOf = (ctx, k, C, now) => (ctx.archChecked && ctx.archChecked.has(k) ? now : (C && C.archAt) || 0);
+/** The trailing fragment: held while it changes; archived once (kind = 'fragment') after 10 minutes unchanged. */
+function fragState(C, fgen, pos, tail, now, size, out, f, ctx) {
+  if (!tail || !tail.length) return null;
+  const sha = sha256(tail);
+  const prev = C && C.frag && C.frag.fgen === fgen && C.frag.pos === pos && C.frag.sha === sha ? C.frag : null;
+  const frag = prev ? { ...prev } : { fgen, pos, len: tail.length, sha, since: now, archived: false };
+  if (!frag.archived && now - frag.since >= FRAGMENT_MS) {
+    out.archive.push(...archiveRows(f, fgen, pos, tail, 'fragment', ctx.host, base.chTs(now)));
+    frag.archived = true;
+    out.event = out.event || 'fragment';
+  }
+  return frag;
+}
+/** The previous generation, re-derived from the archive by the current adapter; null when nothing is archived. */
+async function oldGeneration(ctx, f, H, state) {
+  const ad = adapterOf(ctx, f);
+  const rows = await ctx.house.archiveRecords(refOf(f, ctx.host), f.file_key, Number(H.fgen));
+  if (!rows.length) return null;
+  const records = recordsFromArchive(rows);
+  const fc = fileCtx(f, ctx.host, Number(H.fgen), Number(H.upto), 0, {});
+  return ad.derive({ file: fc, records, state: { ...base.initialState(ad.adapter), fb: (state && state.fb) || {} } });
+}
+/** The keys the previous generation produced, re-derived from the archive (draft 5 §5). */
+async function oldGenerationKeys(ctx, f, H, state) {
+  const res = await oldGeneration(ctx, f, H, state);
+  return res ? liveKeys(res) : (state && state.keys) || { t: [], c: [] };
+}
+
+/**
+ * A rewrite and an adapter upgrade in one pass, retired as the two passes they stand for: the
+ * upgrade over the previous generation, then the rewrite (sessions §4). The previous generation,
+ * re-derived by the new adapter, tells the causes apart:
+ *   - a held key that neither it nor the new generation produces is one the upgrade dropped: a
+ *     tombstone of the house row;
+ *   - a key it produces that the new generation does not left the source: a removed version of its
+ *     re-derived row, at the new rev. (The upgrade alone would first have written that row live at
+ *     the previous generation's rev, where the house already holds the old adapter's row: a second,
+ *     different row at one rev, which harness-sessions-sql's principle 4 forbids. It is skipped.)
+ * With no previous generation archived the causes cannot be told apart, and nothing is tombstoned.
+ * `held`: the house's live keys for the file (fileKeys).
+ */
+async function retireBoth(ctx, f, H, state, fc, held, res, rev) {
+  const prev = await oldGeneration(ctx, f, H, state);
+  if (!prev) return tombstonesFor(ctx, fc, vanishedFrom(held, res), rev, { removed: true });
+  const out = await tombstonesFor(ctx, fc, vanishedFrom(held, { turns: [...prev.turns, ...res.turns], calls: [...prev.calls, ...res.calls] }), rev);
+  const now = { t: new Set(res.turns.map(base.turnKey)), c: new Set(res.calls.map(base.callKey)) };
+  for (const r of prev.turns) if (!now.t.has(base.turnKey(r))) out.turns.push(base.removedOf('turns', r, rev));
+  for (const r of prev.calls) if (!now.c.has(base.callKey(r))) out.calls.push(base.removedOf('calls', r, rev));
+  return out;
+}
+
+// ── sessions ────────────────────────────────────────────────────────────────────────────────
+function cleanTitle(prompt) {
+  if (!prompt) return '';
+  const t = String(prompt)
+    .replace(/<system-reminder>[\s\S]*?<\/system-reminder>/g, '')
+    .replace(/<local-command-caveat>[\s\S]*?<\/local-command-caveat>/g, '')
+    .replace(/<command-(?:name|message|args|contents|stdout|stderr)>[\s\S]*?<\/command-\1>/g, '')
+    .replace(/<[^>]+>/g, '').replace(/\s+/g, ' ').trim();
+  return t.slice(0, 120);
+}
+
+/**
+ * One `sessions` row from every live files row of the session: metadata + exact totals; rev = Σ files.ver.
+ * The 'legacy' row (dedupe-v3.js) is summed like a file: the share of the legacy rows still live.
+ */
+function buildSession(harness, sessionId, rows, { host, hostLabel = '', harnessPath = '', incarnation = '' }) {
+  const live = rows.filter((r) => !Number(r.is_deleted));
+  const n = {}; const usage = new Map(); const tools = new Map(); const days = new Set(); const models = {};
+  const agents = new Map();
+  let rev = 0n; let started = null; let ended = null;
+  const mains = [];
+  const attr = new Map();
+  let legacyLive = 0; let legacyMeta = {}; let inherits = null;
+  for (const r of live) {
+    rev += BigInt(r.ver !== undefined ? r.ver : verOf(r));
+    const c = typeof r.contrib === 'string' ? parseJson(r.contrib, {}) : (r.contrib || {});
+    if (r.role === dedupe.LEGACY_ROLE) {
+      legacyLive += (Number(c.legacy && c.legacy.turns) || 0) + (Number(c.legacy && c.legacy.calls) || 0);
+      legacyMeta = c.meta || {};
+    }
+    if (r.role === forks.INHERITED_ROLE && c.inherits) inherits = c.inherits;
+    if (r.agent_id && (r.agent_type || r.agent_desc)) {
+      const prev = attr.get(r.agent_id) || {};
+      // The side file (.meta.json) is the authority on what an agent is; the transcript row second.
+      if (r.role === 'side' || !prev.type) attr.set(r.agent_id, { type: r.agent_type || prev.type || '', description: r.agent_desc || prev.description || '' });
+    }
+    if (r.role === 'side') continue;
+    for (const f of ['messages', 'user_messages', 'assistant_messages', 'agent_messages', 'tool_calls', 'input_tokens', 'output_tokens',
+      'cache_read_tokens', 'cache_write_tokens', 'reasoning_tokens', 'user_chars', 'assistant_chars']) n[f] = (n[f] || 0) + (Number(c[f]) || 0);
+    for (const u of c.usage || []) {
+      const k = `${u.hour}\u0000${u.model}`;
+      const v = usage.get(k) || { hour: u.hour, model: u.model, messages: 0, input: 0, output: 0, cache_read: 0, cache_write: 0, reasoning: 0 };
+      for (const x of ['messages', 'input', 'output', 'cache_read', 'cache_write', 'reasoning']) v[x] += Number(u[x]) || 0;
+      usage.set(k, v);
+    }
+    for (const t of c.tools || []) {
+      const v = tools.get(t.name) || { name: t.name, calls: 0, errors: 0 };
+      v.calls += Number(t.calls) || 0; v.errors += Number(t.errors) || 0; tools.set(t.name, v);
+    }
+    for (const d of c.days || []) days.add(d);
+    for (const [m, cnt] of Object.entries(c.models || {})) models[m] = (models[m] || 0) + Number(cnt);
+    for (const a of c.agents || []) {
+      const v = agents.get(a.agent_id) || { agent_id: a.agent_id, type: '', description: '', workflow: '', messages: 0, first_ts: null };
+      v.messages += Number(a.messages) || 0;
+      if (a.type && !v.type) v.type = a.type;
+      if (a.description && !v.description) v.description = a.description;
+      if (a.workflow && !v.workflow) v.workflow = a.workflow;
+      if (a.first_ts && (!v.first_ts || a.first_ts < v.first_ts)) v.first_ts = a.first_ts;
+      if (!v.prompt && c.meta && c.meta.agent_prompt) v.prompt = c.meta.agent_prompt;
+      agents.set(a.agent_id, v);
+    }
+    if (c.first_ts && (!started || c.first_ts < started)) started = c.first_ts;
+    if (c.last_ts && (!ended || c.last_ts > ended)) ended = c.last_ts;
+    if (r.role === 'main') mains.push({ r, c });
+  }
+  mains.sort((a, b) => String(a.c.first_ts || '9').localeCompare(String(b.c.first_ts || '9')));
+  const meta = {};
+  let links = [];
+  for (const { c } of mains) {
+    const m = c.meta || {};
+    if (Array.isArray(m.links)) links = m.links;
+    for (const k of ['folder', 'first_prompt', 'session_id']) if (!meta[k] && m[k]) meta[k] = m[k];
+    for (const k of ['git_branch', 'version', 'title', 'ai_title', 'agent_name']) if (m[k]) meta[k] = m[k];
+    if (m.agent_names) meta.agent_names = { ...(meta.agent_names || {}), ...m.agent_names };
+  }
+  // A fork the engine verified by content (forks.js) is a link the store never stated: shown as inferred.
+  if (inherits && inherits.evidence === 'inferred' && !links.some((l) => l.origin === inherits.session_id)) {
+    links = [...links, { kind: inherits.kind, origin: inherits.session_id, evidence: 'inferred', at: inherits.at || '', through: inherits.through || '' }];
+  }
+  // What only the live legacy rows know (a transcript that lost its start): a fallback, never an override.
+  for (const k of ['folder', 'first_prompt']) if (!meta[k] && legacyMeta[k]) meta[k] = legacyMeta[k];
+  for (const v of agents.values()) {
+    const a = attr.get(v.agent_id) || {};
+    const named = (meta.agent_names || {})[v.agent_id] || {};
+    v.type = a.type || v.type || named.type || '';
+    v.description = a.description || v.description || named.description || v.prompt || '';
+  }
+  const agentList = [...agents.values()].sort((a, b) => String(a.first_ts || '').localeCompare(String(b.first_ts || '')) || a.agent_id.localeCompare(b.agent_id));
+  // An hour whose usage a fork's copies netted to nothing (forks.js) is no usage at all.
+  const usageList = [...usage.values()].filter((u) => u.messages || u.input || u.output || u.cache_read || u.cache_write || u.reasoning)
+    .sort((a, b) => a.hour.localeCompare(b.hour) || a.model.localeCompare(b.model));
+  const toolList = [...tools.values()].sort((a, b) => a.name.localeCompare(b.name));
+  const dominant = Object.entries(models).sort((a, b) => b[1] - a[1] || a[0].localeCompare(b[0]))[0];
+  const folder = meta.folder || '';
+  const row = {
+    harness, session_id: sessionId, incarnation: String(incarnation || ''), harness_version: meta.version || '', harness_path: String(harnessPath || ''), host, host_label: String(hostLabel || ''),
+    name: meta.title || meta.ai_title || cleanTitle(meta.first_prompt) || '', mode: harness === 'claude-code' ? 'claude' : harness,
+    folder, project: folder ? folder.replace(/\/+$/, '').split('/').pop() : '', git_branch: meta.git_branch || '',
+    created_at: started, updated_at: ended, started: started || EPOCH_TS, ended: ended || started || EPOCH_TS,
+    messages: n.messages || 0, user_messages: n.user_messages || 0, assistant_messages: n.assistant_messages || 0,
+    agent_messages: n.agent_messages || 0, tool_calls: n.tool_calls || 0,
+    input_tokens: n.input_tokens || 0, output_tokens: n.output_tokens || 0, cache_read_tokens: n.cache_read_tokens || 0,
+    cache_write_tokens: n.cache_write_tokens || 0, reasoning_tokens: n.reasoning_tokens || 0,
+    user_chars: n.user_chars || 0, assistant_chars: n.assistant_chars || 0,
+    first_prompt: meta.first_prompt || '',
+    models: Object.keys(models).filter((m) => models[m] > 0).sort(),
+    dominant_model: dominant && dominant[1] > 0 ? dominant[0] : '',
+    days: [...days].sort(),
+    // Nested columns travel as dotted keys: the nested-object form is silently dropped.
+    'usage.hour': usageList.map((u) => u.hour), 'usage.model': usageList.map((u) => u.model),
+    'usage.messages': usageList.map((u) => u.messages), 'usage.input': usageList.map((u) => u.input),
+    'usage.output': usageList.map((u) => u.output), 'usage.cache_read': usageList.map((u) => u.cache_read),
+    'usage.cache_write': usageList.map((u) => u.cache_write), 'usage.reasoning': usageList.map((u) => u.reasoning),
+    'tools.name': toolList.map((t) => t.name), 'tools.calls': toolList.map((t) => t.calls), 'tools.errors': toolList.map((t) => t.errors),
+    'agents.agent_id': agentList.map((a) => a.agent_id), 'agents.type': agentList.map((a) => a.type),
+    'agents.description': agentList.map((a) => a.description), 'agents.workflow': agentList.map((a) => a.workflow),
+    'agents.messages': agentList.map((a) => a.messages), 'agents.first_ts': agentList.map((a) => a.first_ts || EPOCH_TS),
+    // 'mixed': captured rows (tokens per response) next to legacy rows still live (tokens per record).
+    'links.kind': links.map((l) => String(l.kind || '')), 'links.origin': links.map((l) => String(l.origin || '')),
+    'links.origin_store': links.map((l) => String(l.origin_store || '')), 'links.evidence': links.map((l) => String(l.evidence || '')),
+    'links.at': links.map((l) => String(l.at || '')), 'links.through': links.map((l) => String(l.through || '')),
+    usage_basis: legacyLive ? 'mixed' : 'per_response', origin: 'ship', rev: String(rev), is_deleted: 0, removed: 0,
+  };
+  return row;
+}
+
+/**
+ * A source this machine captured and no longer has — the harness deleted the session's file. The
+ * house keeps what it captured (harness-sessions-sql §4.1 policy "kept"; the archive outlives the store),
+ * and the event is recorded once, as a manifest opening a new generation with source_gone. Only a
+ * file under a root this pass read, whose path is really gone (ENOENT), counts: a missing or
+ * unreadable root, or an adapter that no longer lists a file still on disk, says nothing.
+ */
+async function recordVanished(ctx, sessions, stats) {
+  const seen = new Set();
+  for (const S of sessions.values()) {
+    for (const f of S.files.values()) {
+      const k = fkey(f); seen.add(k);
+      // Older cache entries learn their path from the file that is still here.
+      const C = ctx.cache.get(k);
+      if (C && C.path !== f.path) { C.path = f.path; ctx.cache.dirty = true; }
+    }
+  }
+  // The root directories read this pass. Two roots can share a store (Codex sessions/ and
+  // archived_sessions/), so a file counts only under a directory that was itself read.
+  const dirs = (ctx.roots || []).filter((r) => r.dir && isDir(r.dir)).map((r) => ({ harness: r.harness, dir: path.resolve(r.dir) + path.sep }));
+  const cands = [];
+  for (const [k, C] of Object.entries(ctx.cache.data.files)) {
+    if (seen.has(k) || !C || C.gone || !C.path) continue;
+    const [harness, harness_path, session_id] = k.split('\t');
+    const p = path.resolve(C.path);
+    if (!dirs.some((d) => d.harness === harness && p.startsWith(d.dir)) || !enoent(C.path)) continue;
+    const rest = k.split('\t').slice(3);
+    // skey omits an empty incarnation: three fields, then the file key (which has no tab).
+    const incarnation = rest.length > 1 ? rest[0] : ''; const file_key = rest[rest.length - 1];
+    cands.push({ k, C, f: { harness, harness_path, session_id, incarnation, file_key } });
+  }
+  // The paths learned above are saved now, whatever a later step of the pass does.
+  ctx.cache.save();
+  if (!cands.length) return;
+  const H = new Map();
+  for (const r of await ctx.house.filesRows(cands.map((c) => refOf(c.f, ctx.host)))) H.set(fkey(r), r);
+  const gens = await maxGenerations(ctx, cands.map((c) => c.f));
+  const now = ctx.now(); const rows = []; const marks = [];
+  for (const c of cands) {
+    const h = H.get(c.k);
+    // Nothing captured (or already deleted): no history to keep, nothing to record.
+    if (!h || Number(h.is_deleted) || h.role === dedupe.LEGACY_ROLE || h.role === forks.INHERITED_ROLE) { marks.push([c.C, { fgen: null, at: now }]); continue; }
+    const g = gens.get(c.k);
+    const fgen = Math.max(Number(h.fgen), g === undefined ? -1 : g) + 1;
+    rows.push(manifestRow(c.f, fgen, { progress: 0, continuity: 'reset', units: [], source_gone: true, policy: 'kept' }, ctx.host, base.chTs(now)));
+    marks.push([c.C, { fgen, at: now }]);
+  }
+  await ctx.house.insert('records', rows);
+  // Marked only once the manifests are in the house: a failed insert leaves them to the next pass.
+  for (const [C, gone] of marks) C.gone = gone;
+  ctx.cache.dirty = true;
+  ctx.cache.save();
+  stats.vanished = (stats.vanished || 0) + rows.length;
+  stats.archiveRows += rows.length;
+}
+function isDir(p) { try { return fs.statSync(p).isDirectory(); } catch { return false; } }
+function enoent(p) { try { fs.lstatSync(p); return false; } catch (e) { return e && e.code === 'ENOENT'; } }
+
+// ── the pass ────────────────────────────────────────────────────────────────────────────────
+function isChanged(f, C, ad, now) {
+  if (!C || C.gone) return true;
+  const st = f.stat;
+  if (C.size !== st.size || C.mtimeMs !== st.mtimeMs || C.ino !== st.ino) return true;
+  if (f.role !== 'side' && C.adapter_ver !== ad.deriveVersion) return true;
+  if (C.more) return true;
+  if (C.frag && !C.frag.archived && now - C.frag.since >= FRAGMENT_MS) return true;
+  return false;
+}
+
+/**
+ * One capture pass. `ctx`: { house, cache, host, roots, adapters, now, log, budget, dedupe (default on), sweep }.
+ * Returns counts. Never deletes, never mutates: every change is an insert at a higher rev.
+ */
+async function runPass(ctx) {
+  if (ctx.layout === 'profile') return profilePass(ctx);
+  ctx.adapters = ctx.adapters || defaultAdapters();
+  ctx.now = ctx.now || Date.now;
+  ctx.validated = ctx.validated || new Set();
+  const log = ctx.log || (() => {});
+  const now = ctx.now();
+  const report = {};
+  const sessions = ctx.sessions || discover(ctx.roots, ctx.adapters, report);
+  if (ctx.adapterHarnesses && ctx.adapterHarnesses.length && ctx.adapterStores) await routeAdapterSessions(ctx, sessions);
+  const stats = { sessions: sessions.size, files: 0, changed: 0, written: 0, bytes: 0, archiveRows: 0, turns: 0, calls: 0,
+    tombstones: 0, sessionRows: 0, waits: 0, rewrites: 0, upgrades: 0, more: 0, duplicates: report.duplicates || 0, events: {},
+    deduped: 0, legacyTombstoned: 0, legacyKept: 0, legacyImports: 0 };
+  ctx.agentFileIds = (f) => {
+    const S = sessions.get(skey(f.harness, f.session_id, f.harness_path, f.incarnation));
+    return S ? [...S.files.values()].filter((x) => x.role === 'agent').map((x) => x.agent_id) : [];
+  };
+
+  let queue = [];
+  for (const S of sessions.values()) {
+    const files = [...S.files.values()];
+    stats.files += files.length;
+    const changed = files.filter((f) => isChanged(f, ctx.cache.get(fkey(f)), adapterOf(ctx, f), now));
+    if (!changed.length) continue;
+    const newest = Math.max(...files.map((f) => f.stat.mtimeMs));
+    const oldest = Math.min(...files.map((f) => f.stat.mtimeMs));
+    queue.push({ S, changed, live: now - newest < LIVE_MS, newest, oldest });
+  }
+  // Backfill order: live sessions first, then oldest first.
+  queue.sort((a, b) => (b.live - a.live) || (a.live ? b.newest - a.newest : a.oldest - b.oldest));
+  stats.changed = queue.reduce((s, q) => s + q.changed.length, 0);
+
+  let budget = ctx.budget || PASS_BUDGET;
+  const forkItems = [];   // sessions whose rows moved this pass: fork billing looks at them after the groups
+  while (queue.length && budget > 0) {
+    if (ctx.stopped && ctx.stopped()) { stats.stopped = true; break; }
+    const group = [];
+    let est = 0;
+    while (queue.length && (est < GROUP_BYTES || !group.length)) {
+      const q = queue.shift();
+      group.push(q);
+      for (const f of q.changed) { const C = ctx.cache.get(fkey(f)); est += Math.max(0, f.stat.size - (C ? C.upto : 0)); }
+    }
+    const H = new Map();
+    const bySession = new Map();
+    for (const r of await ctx.house.filesRows(group.map((q) => refOf(q.S, ctx.host)))) {
+      H.set(fkey(r), r);
+      const sk = skey(r.harness, r.session_id, r.harness_path, r.incarnation);
+      if (!bySession.has(sk)) bySession.set(sk, new Map());
+      bySession.get(sk).set(r.file_key, r);
+    }
+    // Whether a source was recorded gone, from the archive, for an entry that cannot say (goneGenOf):
+    // one query per group, only for sources the house has a files row for.
+    const ask = group.flatMap((q) => q.changed.filter((f) => {
+      const C = ctx.cache.get(fkey(f));
+      return H.has(fkey(f)) && (!C || (!C.gone && now - (C.archAt || 0) >= ARCH_CHECK_MS));
+    }));
+    ctx.archChecked = new Set(ask.map(fkey));
+    ctx.archGen = await maxGenerations(ctx, ask);
+    const plans = [];
+    const again = [];
+    for (const q of group) {
+      const more = [];
+      for (const f of q.changed) {
+        const k = fkey(f);
+        const plan = await captureFile(ctx, f, H.get(k) || null, ctx.cache.get(k), Math.min(Math.max(budget, 1), GROUP_BYTES));
+        budget -= plan.bytes;
+        plans.push({ q, f, k, plan });
+        if (plan.event) stats.events[plan.event.split(':')[0]] = (stats.events[plan.event.split(':')[0]] || 0) + 1;
+        if (plan.wait) stats.waits++;
+        if (plan.more) { more.push(f); stats.more++; }
+      }
+      if (more.length) again.push({ ...q, changed: more });
+    }
+    // archive → turns/calls → files → sessions → cache
+    const all = (key) => plans.flatMap((p) => p.plan[key] || []);
+    const archive = all('archive'); const turns = all('turns'); const calls = all('calls');
+    const files = plans.map((p) => p.plan.files).filter(Boolean);
+    await ctx.house.insert('records', archive);
+    await ctx.house.insert('turns', turns);
+    await ctx.house.insert('calls', calls);
+    await ctx.house.insert('files', files);
+    const touched = new Set();
+    for (const p of plans) if (!p.plan.wait) touched.add(skey(p.f.harness, p.f.session_id, p.f.harness_path, p.f.incarnation));
+    // The sessions whose row can have changed: a files row written, or a file cursor that moved
+    // since the cache last recorded it. A file whose bytes changed without a complete new line (an
+    // editor mid-way through writing a record) or whose mtime alone moved makes neither, and its
+    // session row is left alone. The cursor test keeps a pass that died between the files insert
+    // and the sessions insert recoverable: the cache was not saved, so the cursor still differs.
+    const moved = new Set();
+    for (const p of plans) {
+      if (p.plan.wait) continue;
+      const C = ctx.cache.get(p.k);
+      const N = p.plan.cache;
+      if (p.plan.files || !C || (N && (Number(N.upto) !== Number(C.upto) || Number(N.fgen) !== Number(C.fgen)))) moved.add(skey(p.f.harness, p.f.session_id, p.f.harness_path, p.f.incarnation));
+    }
+    for (const fr of files) {
+      const sk = skey(fr.harness, fr.session_id, fr.harness_path, fr.incarnation);
+      if (!bySession.has(sk)) bySession.set(sk, new Map());
+      bySession.get(sk).set(fr.file_key, fr);
+    }
+    // Dedupe, once per session, when its capture has caught up: no file left for a later
+    // group (`again`) and none waiting on a lagging copy. Before the sessions row, so the row
+    // counts the legacy rows that stay live — and none that were just tombstoned.
+    if (ctx.dedupe !== false) {
+      for (const q of group) {
+        const sk = skey(q.S.harness, q.S.session_id, q.S.harness_path, q.S.incarnation);
+        const have = bySession.get(sk);
+        if (!touched.has(sk) || !have || again.some((x) => x.S === q.S) || plans.some((p) => p.q === q && p.plan.wait)) continue;
+        if ([...have.values()].some((r) => r.role === dedupe.LEGACY_ROLE) || ctx.cache.data.deduped[sk] === 'none') continue;
+        // Only against a captured transcript: matched against nothing, every legacy row would be
+        // kept under a marker, and the transcript captured later would duplicate them.
+        if (![...have.values()].some((r) => r.role === 'main' || r.role === 'agent')) continue;
+        const d = await dedupeSession(ctx, refOf(q.S, ctx.host), stats);
+        if (d.filesRow) { have.set(d.filesRow.file_key, d.filesRow); moved.add(sk); }
+      }
+    }
+    // A session's row is written only when what it says changed. A pass that saw a file change on
+    // disk used to rewrite its session whatever it found: on the dev house ~1,000 session rows a day
+    // against ~2,000 turns and 133 files rows (2026-10-15..18). Sessions without a moved file are
+    // skipped; a moved cursor over records that make no rows (progress, snapshots) is caught
+    // by the digest. `rev` (Σ files.ver) is left out of the comparison — it moves with every byte
+    // — so the stored row keeps its older rev until its content changes, and the next real write
+    // still carries a higher one.
+    const sessionRows = [];
+    const sessionDigests = [];
+    const known = ctx.cache.data.sessions || (ctx.cache.data.sessions = {});
+    for (const q of group) {
+      const sk = skey(q.S.harness, q.S.session_id, q.S.harness_path, q.S.incarnation);
+      if (!moved.has(sk) || !bySession.has(sk)) continue;
+      const row = buildSession(q.S.harness, q.S.session_id, [...bySession.get(sk).values()], { host: ctx.host, hostLabel: ctx.hostLabel, harnessPath: q.S.harness_path, incarnation: q.S.incarnation });
+      const dg = sessionDigest(row);
+      if (known[sk] === dg) { stats.sessionsUnchanged = (stats.sessionsUnchanged || 0) + 1; continue; }
+      sessionRows.push(row); sessionDigests.push([sk, dg]);
+    }
+    await ctx.house.insert('sessions', sessionRows);
+    for (const [sk, dg] of sessionDigests) known[sk] = dg;
+    // Fork billing waits for the end of the pass; its work is saved with this group's cursors, so a
+    // pass that fails before it is done leaves the work for the next pass, not lost with the cursors moved.
+    const pendingForks = ctx.cache.data.forkPending || (ctx.cache.data.forkPending = {});
+    for (const q of group) {
+      const sk = skey(q.S.harness, q.S.session_id, q.S.harness_path, q.S.incarnation);
+      if (!moved.has(sk) || !bySession.has(sk) || forks.NATIVE.has(q.S.harness)) continue;
+      forkItems.push({ ref: refOf(q.S, ctx.host), rows: [...bySession.get(sk).values()] });
+      pendingForks[sk] = { ...(pendingForks[sk] || {}), ref: refOf(q.S, ctx.host) };
+    }
+    // The lock lost while this group ran: its rows are in, but the cache file is the new holder's now.
+    // Left unsaved, the next pass reads these files' state from the house.
+    // The group goes back whole (its continuations are the same sessions): the next pass redoes it from the house.
+    if (ctx.stopped && ctx.stopped()) { stats.stopped = true; queue = [...group, ...queue]; break; }
+    for (const p of plans) if (p.plan.cache) ctx.cache.set(p.k, p.plan.cache);
+    ctx.cache.save();
+    stats.written += files.length;
+    stats.bytes += plans.reduce((s, p) => s + p.plan.bytes, 0);
+    stats.archiveRows += archive.length; stats.turns += turns.length; stats.calls += calls.length;
+    stats.tombstones += plans.reduce((s, p) => s + (p.plan.tombstones || 0), 0);
+    stats.sessionRows += sessionRows.length;
+    stats.rewrites += plans.filter((p) => String(p.plan.event || '').startsWith('rewrite')).length;
+    stats.upgrades += plans.filter((p) => p.plan.event === 'upgrade').length;
+    queue = [...again, ...queue];
+  }
+  stats.more = queue.length;
+  // A pass whose lock was taken over leaves the fork billing and the maintenance, and the files they
+  // save, to the pass that holds it now.
+  if (stats.stopped) { log(stats); return stats; }
+  // Fork billing once (forks.js): an 'inherited' row on each verified fork, and its sessions row rebuilt.
+  // The work list is the saved one (this pass's sessions, and any a failed pass left), cleared only
+  // once the sessions rows are written; a rebuild owed is saved before the insert that pays it.
+  const pendingForks = ctx.cache.data.forkPending || {};
+  if (ctx.forks !== false && Object.keys(pendingForks).length) {
+    const skOf = (r) => skey(r.harness, r.session_id, r.harness_path, r.incarnation);
+    const rowsOf = new Map(forkItems.map((x) => [skOf(x.ref), x.rows]));
+    // Owed work (a row saved, a rebuild owed) is paid first, before anything is verified again, so a
+    // verification that fails cannot hold back a rebuild already owed; then the rest is verified,
+    // and what that owes is paid in the same pass.
+    const payOwed = async () => {
+      const owed = Object.entries(pendingForks).filter(([, p]) => p.rebuild);
+      if (!owed.length) return;
+      // Inserting a saved row again is harmless: the same key at the same ver.
+      const rowsToInsert = owed.map(([, p]) => p.row).filter(Boolean);
+      if (rowsToInsert.length) await ctx.house.insert('files', rowsToInsert);
+      const rebuild = owed.map(([, p]) => p.ref);
+      const by = new Map();
+      for (const r of await ctx.house.filesRows(rebuild)) {
+        const sk = skey(r.harness, r.session_id, r.harness_path, r.incarnation);
+        if (!by.has(sk)) by.set(sk, []);
+        by.get(sk).push(r);
+      }
+      const known = ctx.cache.data.sessions || (ctx.cache.data.sessions = {});
+      const rows = [];
+      for (const ref of rebuild) {
+        const sk = skey(ref.harness, ref.session_id, ref.harness_path, ref.incarnation);
+        if (!by.has(sk)) continue;
+        const row = buildSession(ref.harness, ref.session_id, by.get(sk), { host: ctx.host, hostLabel: ctx.hostLabel, harnessPath: ref.harness_path, incarnation: ref.incarnation });
+        rows.push(row); known[sk] = sessionDigest(row);
+      }
+      await ctx.house.insert('sessions', rows);
+      stats.sessionRows += rows.length;
+      for (const [sk] of owed) delete pendingForks[sk];
+      ctx.cache.dirty = true; ctx.cache.save();
+    };
+    await payOwed();
+    const work = Object.entries(pendingForks).filter(([, p]) => !p.rebuild);
+    if (work.length) {
+      const { writes, deferred } = await forks.forkPass(ctx, work.map(([sk, p]) => ({ ref: p.ref, rows: rowsOf.get(sk) })), stats, ctx.forkBudget ? { budget: ctx.forkBudget } : {});
+      // Saved before the insert: the rows and the rebuild they owe outlive any failure from here on.
+      const later = new Set(deferred.map(skOf));
+      for (const [sk] of work) if (!later.has(sk)) delete pendingForks[sk];
+      for (const w of writes) pendingForks[skOf(w.ref)] = { ref: w.ref, row: w.row, rebuild: true };
+      for (const ref of deferred) pendingForks[skOf(ref)] = pendingForks[skOf(ref)] || { ref };
+      ctx.cache.dirty = true; ctx.cache.save();
+      await payOwed();
+    }
+  }
+  if (ctx.vanished !== false) await recordVanished(ctx, sessions, stats);
+  // Files no pass sees on disk any more are re-derived from the archive after an adapter upgrade.
+  // One small query per harness; at start, then every six hours.
+  if (ctx.sweep !== false && !(ctx.sweptAt && now - ctx.sweptAt < 6 * 3600 * 1000)) {
+    await upgradeSweep(ctx, sessions, stats);
+    ctx.sweptAt = now;
+  }
+  await supersedeBridge(ctx, sessions, stats);
+  // Sessions captured before they could be deduped (an older build, a conversion that ran after
+  // the capture): at start, then every six hours — sooner while some are still pending.
+  if (ctx.dedupe !== false && ctx.sweep !== false && !(ctx.dedupeSweptAt && now - ctx.dedupeSweptAt < 6 * 3600 * 1000)) {
+    if (await dedupeSweep(ctx, sessions, stats)) ctx.dedupeSweptAt = now;
+  }
+  if (ctx.redupe && ctx.dedupe !== false) stats.redupe = await redupe(ctx, sessions, stats);
+  // Tombstone cleanup: daily once no session waits for its dedupe, or when asked (--cleanup).
+  if (ctx.cleanup !== false && (ctx.cleanupNow || (ctx.dedupeSweptAt && !(ctx.cleanedAt && now - ctx.cleanedAt < 24 * 3600 * 1000)))) {
+    try { stats.cleanup = await require('./maintenance').tombstoneCleanup(ctx.house, { force: !!ctx.cleanupNow }); } catch (e) { stats.cleanup = [{ error: e.message.split('\n')[0] }]; }
+    ctx.cleanedAt = now; ctx.cleanupNow = false;
+  }
+  // The harnesses read through the harness-session-adapters package (MEMHOUSE_ADAPTERS): their roots left the
+  // file capture in applyAdapters; one store at a time here.
+  if (ctx.adapterStores && ctx.adapterStores.length) {
+    try { stats.adapters = await adapterPass(ctx, stats); } catch (e) { stats.adapters = [{ error: e.message.split('\n')[0] }]; }
+  }
+  if (ctx.bridgeStats) { stats.bridge = ctx.bridgeStats; ctx.bridgeStats = null; }
+  if (ctx.normaliseStats) { stats.normalise = ctx.normaliseStats; ctx.normaliseStats = null; }
+  // What the maintenance learned (recordVanished's paths, supersedeBridge's marks) is saved before
+  // the next pass reads the file again (reloadCache).
+  if (ctx.cache) ctx.cache.save();
+  log(stats);
+  return stats;
+}
+
+/**
+ * Adapter upgrade (draft 5 §5): a file whose `files` row was derived by an older adapter_ver and
+ * that this pass did not see on disk is re-derived FROM THE ARCHIVE, so a fix reaches sessions
+ * whose transcripts were deleted long ago.
+ */
+/**
+ * What upgradeSweep looks at: each store with its own adapter (bridge, log), and each other harness
+ * whole (the native ones). A log adapter re-derives only files a log adapter wrote (adapter_ver at
+ * or above the floor): bridge-era files are a different format, and re-derived by the log derive
+ * they would yield nothing — every row tombstoned, including sessions the user has since deleted.
+ */
+function adapterScopes(ctx) {
+  const floor = require('../../editors/sessions-log').LOG_VERSION_FLOOR;
+  const scopes = []; const covered = new Set();
+  for (const [k, ad] of ctx.storeAdapters || []) {
+    const i = k.indexOf('\t');
+    scopes.push({ harness: k.slice(0, i), harnessPath: k.slice(i + 1), ad, minVer: ad.deriveVersion >= floor ? floor : 0 });
+    covered.add(k.slice(0, i));
+  }
+  for (const [harness, ad] of Object.entries(ctx.adapters)) if (!covered.has(harness)) scopes.push({ harness, harnessPath: null, ad, minVer: 0 });
+  return scopes;
+}
+async function upgradeSweep(ctx, sessions, stats) {
+  for (const { harness, harnessPath, ad, minVer } of adapterScopes(ctx)) {
+    let stale = [];
+    try { stale = await ctx.house.staleFiles(harness, ad.deriveVersion, 200, ctx.host, { harnessPath, minVer }); } catch { continue; }
+    const pending = stale.filter((r) => {
+      const S = sessions.get(skey(r.harness, r.session_id, r.harness_path, r.incarnation));
+      // The legacy row is no source file: nothing to re-derive (an empty derive would tombstone the capture).
+      return r.role !== 'side' && r.role !== dedupe.LEGACY_ROLE && r.role !== forks.INHERITED_ROLE && !(S && S.files.has(r.file_key));
+    });
+    if (!pending.length) continue;
+    const sessionsTouched = new Map();
+    for (const H of pending) {
+      const f = { harness, session_id: H.session_id, harness_path: H.harness_path, incarnation: H.incarnation || '', file_key: H.file_key, agent_id: H.agent_id, role: H.role, root: '', workflow: '' };
+      const ref = refOf(f, ctx.host);
+      const recs = recordsFromArchive(await ctx.house.archiveRecords(ref, H.file_key, Number(H.fgen)))
+        .filter((r) => r.end <= Number(H.upto));
+      const state = parseJson(H.derive_state, null);
+      const fc = fileCtx(f, ctx.host, Number(H.fgen), Number(H.upto), 0, { agent_type: H.agent_type, agent_desc: H.agent_desc });
+      const res = ad.derive({ file: fc, records: recs, state: { ...base.initialState(ad.adapter), fb: (state && state.fb) || {} } });
+      const S = sessions.get(skey(harness, H.session_id, H.harness_path, H.incarnation));
+      const agentIds = S ? [...S.files.values()].filter((x) => x.role === 'agent').map((x) => x.agent_id) : [];
+      const tomb = await tombstonesFor(ctx, fc, vanishedFrom(await ctx.house.fileKeys(ref, f.agent_id || '', agentIds), res), String(base.revOf(H.fgen, H.upto)));
+      await ctx.house.insert('turns', [...res.turns, ...tomb.turns]);
+      await ctx.house.insert('calls', [...res.calls, ...tomb.calls]);
+      const row = { ...H, reparse_from: res.reparse_from, derive_state: JSON.stringify(res.state), adapter_ver: ad.deriveVersion, contrib: JSON.stringify(res.contrib), host: ctx.host };
+      delete row.ver;
+      await ctx.house.insert('files', [row]);
+      sessionsTouched.set(skey(harness, H.session_id, H.harness_path, H.incarnation), ref);
+      stats.upgrades++; stats.tombstones += tomb.turns.length + tomb.calls.length;
+    }
+    for (const ref of sessionsTouched.values()) {
+      const rows = (await ctx.house.filesRows([ref]));
+      await ctx.house.insert('sessions', [buildSession(harness, ref.session_id, rows, { host: ctx.host, hostLabel: ctx.hostLabel, harnessPath: ref.harness_path, incarnation: ref.incarnation })]);
+      stats.sessionRows++;
+    }
+  }
+}
+
+/**
+ * A normaliser that keys a harness's sessions by incarnation (Goose: created_at, as id reuse cannot be
+ * detected) replaces the bridge's `<id>` (incarnation '') with `<id>@<incarnation>`: another key, so
+ * the switch alone would leave the bridge-era rows live beside the log's. Once a logged store holds
+ * an id only under incarnations, the bridge-era session of that id in that store is a duplicate: its
+ * files rows and its sessions row are deleted, and its rows retired (retireBridged): tombstoned where
+ * the normaliser holds them again, kept as removed versions where it does not. Only what a bridge
+ * wrote (adapter_ver below the log floor); a session the normaliser does not list is never touched.
+ * Once per session (cache), after the normaliser's sessions of that id are captured to their end.
+ */
+async function supersedeBridge(ctx, sessions, stats) {
+  if (!ctx.storeAdapters || !ctx.storeAdapters.size) return;
+  const floor = require('../../editors/sessions-log').LOG_VERSION_FLOOR;
+  const done = ctx.cache.data.superseded || (ctx.cache.data.superseded = {});
+  const want = new Map(); const logged = new Map();
+  for (const S of sessions.values()) {
+    if (!S.incarnation) continue;
+    const ad = adapterOf(ctx, S);
+    if (!ad || ad.deriveVersion < floor) continue;
+    const k = skey(S.harness, S.session_id, S.harness_path, '');
+    if (sessions.has(k) || done[k]) continue;
+    want.set(k, { harness: S.harness, host: ctx.host, harness_path: S.harness_path, session_id: S.session_id, incarnation: '' });
+    if (!logged.has(k)) logged.set(k, []);
+    logged.get(k).push(S);
+  }
+  // Until then a bridge row could miss its twin and be kept as removed beside the copy that follows.
+  for (const [k, list] of logged) if (!list.every((S) => caughtUp(ctx, S))) want.delete(k);
+  if (!want.size) return;
+  const byKey = new Map();
+  for (const H of await ctx.house.filesRows([...want.values()])) {
+    if (Number(H.is_deleted) || (H.incarnation || '') !== '' || H.role === dedupe.LEGACY_ROLE || H.role === forks.INHERITED_ROLE) continue;
+    const k = skey(H.harness, H.session_id, H.harness_path, '');
+    if (!byKey.has(k)) byKey.set(k, []);
+    byKey.get(k).push(H);
+  }
+  for (const [k, ref] of want) {
+    const files = byKey.get(k) || [];
+    if (!files.length || files.some((H) => Number(H.adapter_ver) >= floor)) { done[k] = 'none'; ctx.cache.dirty = true; continue; }
+    // Each source's new generation sits past the highest the archive holds (recordVanished may have
+    // written a "kept" one past the files row in this same pass), never in it.
+    const arch = await maxGenerations(ctx, files);
+    const genOf = (H) => Math.max(Number(H.fgen), arch.has(fkey(H)) ? arch.get(fkey(H)) : -1) + 1;
+    const rev = String(base.revOf(Math.max(...files.map(genOf)), 0));
+    const tomb = await retireBridged(ctx, ref, logged.get(k), rev);
+    // Calls first: a retry decides a call by its message, which must still be live then.
+    await ctx.house.insert('calls', tomb.calls);
+    await ctx.house.insert('turns', tomb.turns);
+    // The bridge-era sources leave this key (their content is the normaliser's now, under incarnation
+    // keys): recorded as source_gone with policy "removed" — the rows were tombstoned or removed live,
+    // and a replay of the archive gives these sources nothing.
+    await ctx.house.insert('records', files.map((H) => manifestRow(H, genOf(H), { progress: 0, continuity: 'reset', units: [], source_gone: true, policy: 'removed' }, ctx.host, base.chTs(ctx.now()))));
+    // The sessions row before the files rows: until those are deleted, a stopped pass is done again.
+    // A session whose rows were all duplicates goes; one that keeps removed rows stays, removed.
+    // Kept rows from this run, or from before it (a retry after a stop, history removed earlier).
+    const kept = [...tomb.turns, ...tomb.calls].some((r) => Number(r.removed)) || await ctx.house.hasRemoved(ref);
+    const gone = buildSession(ref.harness, ref.session_id, kept ? files : [], { host: ctx.host, hostLabel: ctx.hostLabel, harnessPath: ref.harness_path, incarnation: '' });
+    if (kept) gone.removed = 1; else gone.is_deleted = 1;
+    gone.rev = String(files.reduce((a, H) => a + BigInt(base.revOf(genOf(H), 0)), 0n));
+    await ctx.house.insert('sessions', [gone]);
+    await ctx.house.insert('files', files.map((H) => { const r = { ...H, fgen: genOf(H), upto: 0, is_deleted: 1 }; delete r.ver; return r; }));
+    done[k] = 'done'; ctx.cache.dirty = true;
+    stats.superseded = (stats.superseded || 0) + 1;
+    stats.tombstones += tomb.turns.length + tomb.calls.length;
+  }
+}
+
+/**
+ * The live rows of a superseded bridge-era session, retired at `rev`. A bridge row is one message
+ * (0.18's text: its text parts joined by '\n') or one call. A message the normaliser's sessions of
+ * that id (`logged`) hold again — the same role and text, in a message no newer than the newest the
+ * bridge holds — is a duplicate and tombstoned; so is a call of a tombstoned message that they hold
+ * again (the same tool and arguments, no newer). Each of their rows is a twin once. Any other row
+ * left the source before the switch (a cleared session typed again, a reused id), or is in a shape
+ * the normaliser does not reproduce: kept as a removed version (harness-sessions-sql principle 3). A
+ * normaliser row with no time is no twin.
+ */
+async function retireBridged(ctx, ref, logged, rev) {
+  const v = vanishedFrom(await ctx.house.fileKeys(ref, '', []), { turns: [], calls: [] });
+  const turns = v.turns.length ? await ctx.house.rowsByKey('turns', ref, v.turns) : [];
+  const calls = v.calls.length ? await ctx.house.rowsByKey('calls', ref, v.calls) : [];
+  // Times as ClickHouse prints them or as ISO: the same fixed-width string compares in order.
+  const tsKey = (t) => String(t || '').replace('T', ' ').replace('Z', '').slice(0, 23);
+  const bound = [...turns, ...calls].reduce((a, r) => (tsKey(r.ts) > a ? tsKey(r.ts) : a), '');
+  const seen = (t) => !!tsKey(t) && tsKey(t) <= bound;
+  const bag = new Map();
+  const add = (sig) => bag.set(sig, (bag.get(sig) || 0) + 1);
+  const take = (sig) => { const n = bag.get(sig) || 0; if (n) bag.set(sig, n - 1); return n > 0; };
+  for (const S of logged) {
+    const cur = await ctx.house.capturedRows(refOf(S, ctx.host));
+    const msgs = new Map();
+    for (const r of [...cur.turns].sort((a, b) => a.part_ord - b.part_ord)) {
+      if (r.kind !== 'text' || !r.text) continue;
+      if (!msgs.has(r.message_id)) msgs.set(r.message_id, { role: r.role, texts: [], seen: true });
+      const m = msgs.get(r.message_id);
+      m.texts.push(r.text); m.seen = m.seen && seen(r.ts);
+    }
+    for (const m of msgs.values()) if (m.seen) add(`t\u0000${m.role}\u0000${m.texts.join('\n')}`);
+    for (const c of cur.calls) if (seen(c.ts)) add(`c\u0000${c.tool_name}\u0000${c.args}`);
+  }
+  const twinned = new Set();
+  const out = {
+    turns: turns.map((r) => {
+      if (!take(`t\u0000${r.role}\u0000${r.text}`)) return base.removedOf('turns', r, rev);
+      twinned.add(r.message_id);
+      return base.tombstoneOf('turns', r, rev);
+    }),
+  };
+  out.calls = calls.map((r) => (twinned.has(r.message_id) && take(`c\u0000${r.tool_name}\u0000${r.args}`) ? base.tombstoneOf : base.removedOf)('calls', r, rev));
+  return out;
+}
+
+// ── dedupe of the converted legacy rows (draft 5 §7 step 5; dedupe-v3.js) ───────────────────
+/**
+ * Match one session's legacy rows against its capture, tombstone the matched ship rows, and write
+ * the 'legacy' files row (the share of the rows that stay live, and the marker). Reads the
+ * session's legacy rows in every version (a tombstoned one keeps the run it matched) and its live
+ * captured rows. Returns { none } when the session has no legacy rows at all, else { plan, filesRow }.
+ * Order: tombstones before the marker, so a crash between them re-runs the match — which decides
+ * the same way — instead of leaving a marker over live duplicates.
+ */
+/** codexRepeats over the session's rollouts on disk (its main, agent and side files); [] when none is readable. */
+async function codexRepeatsOf(ctx, ref) {
+  const files = (await ctx.house.filesRows([ref])).filter((f) => !Number(f.is_deleted) && ['main', 'agent', 'side'].includes(String(f.role)));
+  return repeatsOfKeys(ref, files.map((f) => String(f.file_key)));
+}
+/** The same over the session's sources on the profile (session_sources). */
+async function profileRepeatsOf(ph, ref) {
+  const srcs = (await ph.sources(ref)).filter((s) => !Number(s.is_deleted) && ['main', 'agent', 'side'].includes(String(s.role)));
+  return repeatsOfKeys(ref, srcs.map((s) => String(s.source_key)));
+}
+async function repeatsOfKeys(ref, keys) {
+  const out = [];
+  for (const key of keys) {
+    // The package keys a rollout by its path under the store; the 0.20 engine by its base name,
+    // which dates it: sessions/YYYY/MM/DD/rollout-YYYY-MM-DDT…, or archived_sessions/.
+    const day = /^rollout-(\d{4})-(\d{2})-(\d{2})T/.exec(key);
+    const root = String(ref.harness_path || '/');
+    const file = [path.resolve(root, key),
+      ...(day && !key.includes('/') ? [path.join(root, 'sessions', day[1], day[2], day[3], key), path.join(root, 'archived_sessions', key)] : [])]
+      .find((x) => fs.existsSync(x));
+    if (!file) continue;
+    // Unreadable is no proof: those rows stay live, and the pass goes on.
+    try {
+      const records = [];
+      const rl = require('readline').createInterface({ input: fs.createReadStream(file, { encoding: 'utf8' }), crlfDelay: Infinity });
+      for await (const line of rl) {
+        if (!line.includes('"event_msg"') && !line.includes('"response_item"')) continue;
+        let o;
+        try { o = JSON.parse(line); } catch { continue; }
+        const p = o && o.payload ? o.payload : {};
+        records.push({ type: o.type, payload: { type: p.type, role: p.role, info: p.type === 'token_count' ? p.info : undefined } });
+      }
+      out.push(...dedupe.codexRepeats(records));
+    } catch { /* an unreadable rollout proves nothing */ }
+  }
+  return out;
+}
+
+async function dedupeSession(ctx, ref, stats = {}, { redo = false } = {}) {
+  const harness = ref.harness; const sid = ref.session_id;
+  const sk = skey(harness, sid, ref.harness_path, ref.incarnation);
+  const legacy = await ctx.house.legacyRowsAll(ref, ctx.hostAliases || []);
+  if (!legacy.turns.length && !legacy.calls.length) {
+    ctx.cache.data.deduped[sk] = 'none'; ctx.cache.dirty = true;
+    return { none: true };
+  }
+  const captured = await ctx.house.capturedRows(ref);
+  // Matched against nothing, every legacy row would be kept under the marker for good and the
+  // capture landing later would duplicate them: no marker until there is a capture to match.
+  if (!captured.turns.length && !captured.calls.length) return { skipped: true };
+  const input = {
+    harness, session_id: sid, legacyTurns: legacy.turns, legacyCalls: legacy.calls,
+    capturedTurns: captured.turns, capturedCalls: captured.calls,
+  };
+  let plan = dedupe.planDedupe(input);
+  // A Codex '[assistant activity]' row in a turn aborted before any output is retired only on the
+  // transcript's proof that its tokens are a re-emitted count (dedupe-v3 codexRepeats): read the
+  // session's rollouts, once, only when the plan has such a row.
+  if (plan.report.rereport_unproven > 0) {
+    const repeats = await codexRepeatsOf(ctx, ref);
+    if (repeats.length) plan = dedupe.planDedupe({ ...input, repeats });
+  }
+  // A repair re-plan that finds nothing new to tombstone changes nothing (and keeps the marker's ver),
+  // unless the marker reports other kept rows than the house holds now: a marker that lost to an
+  // older one (a repair after a tombstone cleanup, before the upto floor below) is rewritten.
+  const prev = (await ctx.house.filesRows([ref])).find((f) => f.role === dedupe.LEGACY_ROLE && f.file_key === dedupe.LEGACY_FILE_KEY && !Number(f.is_deleted));
+  const keptOf = (f) => { try { const k = JSON.parse(f.derive_state).dedupe.kept; return `${k.turns}/${k.calls}`; } catch { return null; } };
+  if (redo && !plan.tombstones.turns.length && !plan.tombstones.calls.length
+    && (!prev || keptOf(prev) === `${plan.report.kept.turns}/${plan.report.kept.calls}`)) return { plan, unchanged: true };
+  await ctx.house.insert('turns', plan.tombstones.turns);
+  await ctx.house.insert('calls', plan.tombstones.calls);
+  const filesRow = dedupe.legacyFilesRow({ harness, session_id: sid, harness_path: ref.harness_path, incarnation: ref.incarnation }, plan, ctx.host);
+  // The marker's ver is 1 + the legacy rows tombstoned, and a repair must outrank the marker it
+  // replaces. A tombstone cleanup drops tombstoned rows with their originals, so a repair after it
+  // counts fewer: its upto is at least the old marker's + 1.
+  if (prev && Number(prev.upto) >= filesRow.upto) filesRow.upto = Number(prev.upto) + 1;
+  await ctx.house.insert('files', [filesRow]);
+  // The converted session under another key — this machine's pre-0.20 host id, or the unknown store
+  // — is this one now: its rows are tombstoned, or counted by the 'legacy' row above. Its own
+  // sessions row would list the session twice (found by misc/upgrade-drill-0.20.sh): retired, at a
+  // higher rev.
+  const foreign = new Map();
+  for (const r of [...legacy.turns, ...legacy.calls]) {
+    if (r.host === ref.host && String(r.harness_path || '') === String(ref.harness_path || '')) continue;
+    foreign.set(`${r.host}\t${r.harness_path || ''}`, { harness, host: r.host, harness_path: String(r.harness_path || ''), session_id: sid, incarnation: String(ref.incarnation || '') });
+  }
+  if (foreign.size && typeof ctx.house.sessionRows === 'function') {
+    const retired = (await ctx.house.sessionRows([...foreign.values()])).filter((r) => !Number(r.is_deleted))
+      .map((r) => ({ ...r, is_deleted: 1, rev: String(BigInt(r.rev) + 1n) }));
+    if (retired.length) { await ctx.house.insert('sessions', retired); stats.legacySessionsRetired = (stats.legacySessionsRetired || 0) + retired.length; }
+  }
+  ctx.cache.data.deduped[sk] = 'done'; ctx.cache.dirty = true;
+  const r = plan.report;
+  stats.deduped = (stats.deduped || 0) + 1;
+  stats.legacyTombstoned = (stats.legacyTombstoned || 0) + r.tombstoned.turns + r.tombstoned.calls;
+  stats.legacyKept = (stats.legacyKept || 0) + r.kept.turns + r.kept.calls;
+  stats.legacyImports = (stats.legacyImports || 0) + r.imports.turns + r.imports.calls;
+  stats.tombstones = (stats.tombstones || 0) + r.tombstoned.turns + r.tombstoned.calls;
+  // Unmatched legacy rows are content the transcript no longer has: kept, and said so.
+  if (r.kept.turns || r.kept.calls) (ctx.log || (() => {}))({ dedupe: sk, matched: r.matched, kept: r.kept, captured: r.captured });
+  ctx.dedupeReports = ctx.dedupeReports || [];
+  ctx.dedupeReports.push(r);
+  if (ctx.dedupeReports.length > 1000) ctx.dedupeReports.shift();
+  return { plan, filesRow };
+}
+
+/**
+ * Sessions with live legacy rows and captured files but no 'legacy' files row: captured by a build
+ * without dedupe, or converted after their capture. Each is deduped and its sessions row rebuilt.
+ * Returns true when nothing is left pending (the next sweep may wait six hours).
+ */
+async function dedupeSweep(ctx, sessions, stats) {
+  if (typeof ctx.house.pendingDedupe !== 'function') return true;
+  const LIMIT = 5000;
+  const pending = await ctx.house.pendingDedupe(LIMIT, ctx.host, ctx.hostAliases || []);
+  let waiting = 0;
+  for (const { harness, session_id: sid, harness_path: hp, incarnation: inc } of pending) {
+    const S = sessions.get(skey(harness, sid, hp, inc));
+    // Only a session whose transcript this machine has captured to the end. A files row exists
+    // from the first partial group of a backfill on; matched then, the legacy rows whose twins
+    // were not captured yet are kept for good and duplicated by the rest of the capture
+    // (2026-10-14, the dev house: 82 sessions). A session not on this machine is its capturer's.
+    if (!S) continue;
+    if (!caughtUp(ctx, S)) { waiting++; continue; }
+    const ref = refOf(S, ctx.host);
+    const d = await dedupeSession(ctx, ref, stats);
+    if (d.skipped) { waiting++; continue; }
+    await ctx.house.insert('sessions', [buildSession(harness, sid, await ctx.house.filesRows([ref]), { host: ctx.host, hostLabel: ctx.hostLabel, harnessPath: S.harness_path, incarnation: S.incarnation })]);
+    stats.sessionRows = (stats.sessionRows || 0) + 1;
+  }
+  return !waiting && pending.length < LIMIT;
+}
+
+/** Every file of a session this machine has on disk is captured to its end: none missing from the cache, none partway. */
+function caughtUp(ctx, S) {
+  return [...S.files.values()].every((f) => { const C = ctx.cache.get(fkey(f)); return !!C && !C.more; });
+}
+
+/** What a sessions row says, without its `rev`: equal digests mean an identical row to readers. */
+function sessionDigest(row) {
+  const { rev, ...rest } = row;
+  return crypto.createHash('sha1').update(JSON.stringify(rest)).digest('base64').slice(0, 16);
+}
+
+/**
+ * Repair (--redupe): re-plan every deduped session that still has live legacy ship rows and that
+ * this machine has captured to the end, and write where the new plan tombstones more — the
+ * sessions a sweep deduped against a capture that had not caught up. A re-plan decides the same
+ * way for rows already decided, so a session deduped correctly is left as it is.
+ */
+async function redupe(ctx, sessions, stats) {
+  const r = { candidates: 0, repaired: 0, unchanged: 0, waiting: 0, elsewhere: 0, tombstoned: 0 };
+  // The package's stores are repaired in adapterPass: their sessions left the file capture.
+  const pkg = new Set((ctx.adapterStores || []).map((s) => `${s.harness}\t${s.harness_path}`));
+  const rows = (await ctx.house.dedupedWithLiveLegacy(ctx.host, ctx.hostAliases || [])).filter((x) => !pkg.has(`${x.harness}\t${x.harness_path || ''}`));
+  r.candidates = rows.length;
+  for (const { harness, session_id: sid, harness_path: hp, incarnation: inc } of rows) {
+    const S = sessions.get(skey(harness, sid, hp, inc));
+    if (!S) { r.elsewhere++; continue; }
+    if (!caughtUp(ctx, S)) { r.waiting++; continue; }
+    const before = stats.legacyTombstoned || 0;
+    const ref = refOf(S, ctx.host);
+    const d = await dedupeSession(ctx, ref, stats, { redo: true });
+    if (d.skipped || d.unchanged) { r.unchanged++; continue; }
+    r.repaired++; r.tombstoned += (stats.legacyTombstoned || 0) - before;
+    await ctx.house.insert('sessions', [buildSession(harness, sid, await ctx.house.filesRows([ref]), { host: ctx.host, hostLabel: ctx.hostLabel, harnessPath: S.harness_path, incarnation: S.incarnation })]);
+    stats.sessionRows = (stats.sessionRows || 0) + 1;
+  }
+  return r;
+}
+
+// ── the house over HTTP ─────────────────────────────────────────────────────────────────────
+function sqlStr(s) { return `'${String(s).replace(/\\/g, '\\\\').replace(/'/g, "\\'")}'`; }
+/** WHERE clause for one session's store (refOf). */
+function storeWhere(ref) {
+  return `harness = ${sqlStr(ref.harness)} AND host = ${sqlStr(ref.host)} AND harness_path = ${sqlStr(ref.harness_path)}`
+    + ` AND session_id = ${sqlStr(ref.session_id)} AND incarnation = ${sqlStr(ref.incarnation || '')}`;
+}
+const STORE_TUPLE = '(harness, host, harness_path, session_id, incarnation)';
+const storeTuple = (ref) => `(${[ref.harness, ref.host, ref.harness_path, ref.session_id, ref.incarnation || ''].map(sqlStr).join(', ')})`;
+/** Split a column list at its top-level commas. */
+function splitTop(s) {
+  const out = []; let depth = 0; let buf = '';
+  for (const ch of `${s},`) {
+    if (ch === '(') depth++;
+    if (ch === ')') depth--;
+    if (ch === ',' && depth === 0) { if (buf.trim()) out.push(buf.trim()); buf = ''; continue; }
+    buf += ch;
+  }
+  return out;
+}
+/**
+ * Each table's insertable columns, read from the schema template (memhouse/house/schema-v3.sql.tpl):
+ * every declared column but the MATERIALIZED ones, a Nested column as its dotted subcolumns. A
+ * column a row leaves out takes its DEFAULT. Hand-kept lists drifted from the template once
+ * (layout 3.2: records, files and sessions still listed 3.1 columns) — only a real house saw it.
+ */
+const TABLE_COLUMNS = (() => {
+  const v3 = require('../house/schema-v3');
+  const out = {};
+  for (const [type, cols] of Object.entries(v3.templateColumns(v3.readTemplate()))) {
+    out[type] = cols.filter((c) => !/\b(MATERIALIZED|ALIAS)\b/i.test(c.type)).flatMap((c) => {
+      const m = /^Nested\s*\(([\s\S]*)\)\s*$/i.exec(c.type.replace(/--[^\n]*/g, ''));
+      return m ? splitTop(m[1]).map((sub) => `${c.name}.${sub.split(/\s+/)[0]}`) : [c.name];
+    });
+  }
+  return out;
+})();
+/** Split rows into insert batches of at most BATCH_ROWS rows and BATCH_BYTES of JSON. */
+function batches(rows, maxRows = BATCH_ROWS, maxBytes = BATCH_BYTES) {
+  const out = [];
+  let cur = []; let bytes = 0;
+  for (const r of rows) {
+    const line = JSON.stringify(r);
+    const n = Buffer.byteLength(line) + 1;
+    if (cur.length && (cur.length >= maxRows || bytes + n > maxBytes)) { out.push(cur); cur = []; bytes = 0; }
+    cur.push(line); bytes += n;
+  }
+  if (cur.length) out.push(cur);
+  return out;
+}
+
+class HttpHouse {
+  constructor({ url, user, password, db, member }) {
+    this.url = String(url).replace(/\/+$/, '');
+    this.user = user; this.password = password || '';
+    this.db = db || 'mem'; this.adb = `${this.db}_archive`; this.member = member || null;
+    this.inserted = {};
+  }
+  async init() {
+    if (!this.member) this.member = (await this.query('SELECT currentUser() AS u'))[0].u;
+    const m = this.member;
+    this.t = {
+      turns: `${this.db}.${m}_turns`, calls: `${this.db}.${m}_calls`, sessions: `${this.db}.${m}_sessions`,
+      records: `${this.adb}.${m}_records`, files: `${this.adb}.${m}_files`,
+    };
+    return this;
+  }
+  async post(params, body, gzip) {
+    const qs = new URLSearchParams({ database: this.db, ...params });
+    const headers = { 'X-ClickHouse-User': this.user, 'X-ClickHouse-Key': this.password };
+    let payload = body;
+    if (gzip) { payload = zlib.gzipSync(Buffer.from(body)); headers['Content-Encoding'] = 'gzip'; }
+    const res = await fetch(`${this.url}/?${qs}`, { method: 'POST', headers, body: payload });
+    const text = await res.text();
+    if (!res.ok) throw new Error(`ClickHouse ${res.status}: ${text.trim().split('\n')[0].slice(0, 400)}`);
+    return text;
+  }
+  async query(sql, settings = {}) {
+    const params = { default_format: 'JSONEachRow', output_format_json_quote_64bit_integers: '1' };
+    for (const [k, v] of Object.entries(settings)) params[k] = String(v);
+    const text = await this.post(params, sql);
+    return text.split('\n').filter(Boolean).map((l) => JSON.parse(l));
+  }
+  /** The transport-free query interface memhouse/house/*-v3.js modules take (q.rows(sql, settings)). */
+  async rows(sql, settings) { return this.query(sql, settings); }
+  async insert(kind, rows) {
+    if (!rows.length) return;
+    const cols = TABLE_COLUMNS[kind];
+    for (const lines of batches(rows)) {
+      await this.post({
+        query: `INSERT INTO ${this.t[kind]} (${cols.map((c) => (c.includes('.') ? `\`${c}\`` : c)).join(', ')}) FORMAT JSONEachRow`,
+        async_insert: '0', input_format_skip_unknown_fields: '0',
+      }, lines.join('\n'), true);
+    }
+    this.inserted[kind] = (this.inserted[kind] || 0) + rows.length;
+  }
+  /** The live sessions rows at these session keys (FINAL), every column — to retire one whole. */
+  async sessionRows(refs) {
+    if (!refs.length) return [];
+    const cols = TABLE_COLUMNS.sessions.map((c) => (c.includes('.') ? `\`${c}\`` : c)).join(', ');
+    return this.query(`SELECT ${cols} FROM ${this.t.sessions} FINAL WHERE ${STORE_TUPLE} IN (${refs.map(storeTuple).join(', ')}) AND is_deleted = 0`);
+  }
+  async filesRows(refs) {
+    if (!refs.length) return [];
+    const out = [];
+    for (let i = 0; i < refs.length; i += 500) {
+      const list = refs.slice(i, i + 500).map(storeTuple).join(', ');
+      out.push(...await this.query(`SELECT harness, harness_path, session_id, incarnation, file_key, agent_id, role, agent_type, agent_desc, fgen, upto,
+        reparse_from, derive_state, adapter_ver, size, inode, anchor_sha, prefix_sha, is_deleted, contrib,
+        toString(first_ts) AS first_ts, toString(last_ts) AS last_ts, toString(ver) AS ver, host
+        FROM ${this.t.files} FINAL WHERE ${STORE_TUPLE} IN (${list})`));
+    }
+    return out.map((r) => ({ ...r, fgen: Number(r.fgen), upto: Number(r.upto), reparse_from: Number(r.reparse_from), adapter_ver: Number(r.adapter_ver) }));
+  }
+  async staleFiles(harness, ver, limit, host, { harnessPath = null, minVer = 0 } = {}) {
+    return (await this.query(`SELECT harness, harness_path, session_id, incarnation, file_key, agent_id, role, agent_type, agent_desc, fgen, upto,
+      reparse_from, derive_state, adapter_ver, size, inode, anchor_sha, prefix_sha, is_deleted, contrib,
+      toString(first_ts) AS first_ts, toString(last_ts) AS last_ts, host
+      FROM ${this.t.files} FINAL WHERE harness = ${sqlStr(harness)} AND host = ${sqlStr(host)}${harnessPath == null ? '' : ` AND harness_path = ${sqlStr(harnessPath)}`}
+        AND adapter_ver < ${Number(ver)} AND adapter_ver >= ${Number(minVer)} AND role NOT IN ('side', ${sqlStr(dedupe.LEGACY_ROLE)}, ${sqlStr(forks.INHERITED_ROLE)}) AND is_deleted = 0
+      LIMIT ${Number(limit)}`)).map((r) => ({ ...r, fgen: Number(r.fgen), upto: Number(r.upto), adapter_ver: Number(r.adapter_ver) }));
+  }
+  async archiveRecords(ref, fileKey, fgen) {
+    return this.query(`SELECT pos, chunk, sha, kind, enc, raw, toString(captured_at) AS captured_at
+      FROM ${this.t.records} FINAL WHERE ${storeWhere(ref)}
+      AND file_key = ${sqlStr(fileKey)} AND fgen = ${Number(fgen)} AND kind = 'record' ORDER BY pos, chunk`);
+  }
+  /** The archived session-adapter units of one source generation (adapter-capture.js). */
+  async archiveUnits(ref, fileKey, fgen) {
+    return (await this.query(`SELECT pos, chunk, sha, kind, raw
+      FROM ${this.t.records} FINAL WHERE ${storeWhere(ref)}
+      AND file_key = ${sqlStr(fileKey)} AND fgen = ${Number(fgen)} AND kind = 'unit' ORDER BY pos, chunk`))
+      .map((r) => ({ ...r, pos: Number(r.pos), chunk: Number(r.chunk) }));
+  }
+  /**
+   * A session's messages on its main line, in order, for fork verification (forks.js): per message,
+   * the sha256 of its full parts (kind and text, by part_ord), whether any text is truncated
+   * (text_len counts UTF-16 units), its first text, and its tokens with the hour and model they
+   * were billed under.
+   */
+  async sessionMessages(ref) {
+    const tok = 'input_tokens + output_tokens + cache_read_tokens + cache_write_tokens + reasoning_tokens';
+    const rows = await this.query(`SELECT message_id, any(role) AS role, min(ord) AS o,
+        lower(hex(SHA256(arrayStringConcat(arrayMap(x -> concat(x.2, '\x01', x.3), arraySort(x -> x.1, groupArray((part_ord, toString(kind), text)))), '\x02')))) AS sha,
+        max(text_len > lengthUTF8(text) + countMatches(text, '[\\\\x{10000}-\\\\x{10FFFF}]')) AS truncated,
+        argMinIf(text, part_ord, kind = 'text') AS first_text,
+        formatDateTime(toStartOfHour(if(countIf(${tok} > 0) > 0, minIf(ts, ${tok} > 0), min(ts))), '%Y-%m-%d %H:00:00') AS hour,
+        if(countIf(${tok} > 0) > 0, anyIf(model, ${tok} > 0), any(model)) AS model,
+        sum(input_tokens) AS input, sum(output_tokens) AS output, sum(cache_read_tokens) AS cache_read,
+        sum(cache_write_tokens) AS cache_write, sum(reasoning_tokens) AS reasoning
+      FROM ${this.t.turns} FINAL
+      WHERE ${storeWhere(ref)} AND agent_id = '' AND kind != 'usage' AND is_deleted = 0 AND removed = 0
+      GROUP BY message_id ORDER BY o, message_id`);
+    return rows.map((r) => ({ ...r, truncated: Number(r.truncated) === 1 }));
+  }
+  /** Sessions of a store whose main line has an assistant text exactly `text` (fork nomination). */
+  async sessionsWithText(store, text) {
+    return this.query(`SELECT DISTINCT session_id, incarnation FROM ${this.t.turns} FINAL
+      WHERE harness = ${sqlStr(store.harness)} AND host = ${sqlStr(store.host)} AND harness_path = ${sqlStr(store.harness_path)}
+        AND agent_id = '' AND role = 'assistant' AND kind = 'text' AND is_deleted = 0 AND removed = 0 AND text = ${sqlStr(text)}
+      LIMIT 50`);
+  }
+  /** The live sessions of a store with this id (one per incarnation). */
+  async sessionsById(store, sessionId) {
+    return this.query(`SELECT DISTINCT incarnation FROM ${this.t.files} FINAL
+      WHERE harness = ${sqlStr(store.harness)} AND host = ${sqlStr(store.host)} AND harness_path = ${sqlStr(store.harness_path)}
+        AND session_id = ${sqlStr(sessionId)} AND role = 'main' AND is_deleted = 0`);
+  }
+  /** Sessions of a store whose own record states a link to this one as their origin (child side). */
+  async linkedChildren(store, sessionId) {
+    return this.query(`SELECT session_id, incarnation FROM ${this.t.sessions} FINAL
+      WHERE harness = ${sqlStr(store.harness)} AND host = ${sqlStr(store.host)} AND harness_path = ${sqlStr(store.harness_path)}
+        AND is_deleted = 0 AND has(\`links.origin\`, ${sqlStr(sessionId)})`);
+  }
+  /** The forks of a session: live 'inherited' files rows of its store that name it as their origin. */
+  async inheritedFrom(store, sessionId) {
+    return this.query(`SELECT harness, harness_path, session_id, incarnation FROM ${this.t.files} FINAL
+      WHERE harness = ${sqlStr(store.harness)} AND host = ${sqlStr(store.host)} AND harness_path = ${sqlStr(store.harness_path)}
+        AND role = ${sqlStr(forks.INHERITED_ROLE)} AND is_deleted = 0 AND JSONExtractString(contrib, 'inherits', 'session_id') = ${sqlStr(sessionId)}`);
+  }
+  /** The highest generation archived per source ({ ref, file_key }[] → Map fkey → g; absent: none). */
+  async maxGenerations(items) {
+    const out = new Map();
+    // A source belongs to its host; capture asks only about its own. The map is keyed like the
+    // cache (fkey, no host), so one call names one host.
+    if (new Set(items.map((x) => x.ref.host)).size > 1) throw new Error('maxGenerations: one host per call');
+    for (let i = 0; i < items.length; i += 500) {
+      const list = items.slice(i, i + 500).map((x) => `(${[x.ref.harness, x.ref.host, x.ref.harness_path, x.ref.session_id, x.ref.incarnation || '', x.file_key].map(sqlStr).join(', ')})`).join(', ');
+      const rows = await this.query(`SELECT harness, host, harness_path, session_id, incarnation, file_key, max(fgen) AS g FROM ${this.t.records}
+        WHERE (harness, host, harness_path, session_id, incarnation, file_key) IN (${list})
+        GROUP BY harness, host, harness_path, session_id, incarnation, file_key`);
+      for (const r of rows) out.set(fkey(r), Number(r.g));
+    }
+    return out;
+  }
+  async firstCaptured(ref, fileKey, fgen, positions) {
+    const out = new Map();
+    for (let i = 0; i < positions.length; i += 1000) {
+      const rows = await this.query(`SELECT pos, toString(min(captured_at)) AS at FROM ${this.t.records}
+        WHERE ${storeWhere(ref)} AND file_key = ${sqlStr(fileKey)}
+        AND fgen = ${Number(fgen)} AND kind = 'record' AND pos IN (${positions.slice(i, i + 1000).map(Number).join(', ')}) GROUP BY pos`);
+      for (const r of rows) out.set(Number(r.pos), Date.parse(`${r.at.replace(' ', 'T')}Z`));
+    }
+    return out;
+  }
+  /** Every insertable column, DateTime64 as its wire string — what a full-copy tombstone needs. */
+  selectAll(kind) {
+    const dt = { turns: ['ts'], calls: ['ts', 'result_ts'] }[kind];
+    return TABLE_COLUMNS[kind].map((c) => (dt.includes(c) ? `toString(${c}) AS ${c}` : c)).join(', ');
+  }
+  /** The exact rows (FINAL, live) at these keys — read back before tombstoning them. */
+  async rowsByKey(kind, ref, keys) {
+    const out = [];
+    for (let i = 0; i < keys.length; i += 200) {
+      const ks = keys.slice(i, i + 200);
+      const days = [...new Set(ks.map((k) => k.ts.slice(0, 10)))].map(sqlStr).join(', ');
+      const tuples = kind === 'turns'
+        ? ks.map((k) => `(${sqlStr(k.ts)}, ${sqlStr(k.message_id)}, ${sqlStr(k.part_id)})`).join(', ')
+        : ks.map((k) => `(${sqlStr(k.ts)}, ${sqlStr(k.call_id)})`).join(', ');
+      const key = kind === 'turns' ? '(toString(ts), message_id, part_id)' : '(toString(ts), call_id)';
+      out.push(...await this.query(`SELECT ${this.selectAll(kind)} FROM ${this.t[kind]} FINAL
+        WHERE toDate(ts) IN (${days}) AND ${storeWhere(ref)}
+        AND ${key} IN (${tuples}) AND is_deleted = 0`));
+    }
+    return out.map((r) => (kind === 'turns' ? { ...r, part_ord: Number(r.part_ord) } : r));
+  }
+  /** The keys this file's shipped rows hold in the conversation layer (adapter upgrade only). */
+  async fileKeys(ref, agentId, agentFileIds) {
+    const who = agentId ? `agent_id = ${sqlStr(agentId)}`
+      : (agentFileIds.length ? `agent_id NOT IN (${agentFileIds.map(sqlStr).join(', ')})` : '1');
+    // Removed history (removed = 1) is never a candidate: it is what the source no longer has, not a
+    // duplicate of the new derivation, and an upgrade must not erase it.
+    const where = `${storeWhere(ref)} AND ${who} AND is_deleted = 0 AND removed = 0`;
+    const t = await this.query(`SELECT message_id, part_id, toString(ts) AS ts FROM ${this.t.turns} FINAL
+      WHERE ${where} AND origin = 'ship' AND NOT startsWith(message_id, 'legacy:')`);
+    const c = await this.query(`SELECT call_id, toString(ts) AS ts FROM ${this.t.calls} FINAL
+      WHERE ${where} AND NOT startsWith(call_id, 'legacy:')`);
+    return { t: t.map((r) => [r.message_id, r.part_id, r.ts]), c: c.map((r) => [r.call_id, r.ts]) };
+  }
+  /**
+   * Every `legacy:` row of one session in EVERY version — no FINAL, so tombstoned rows come back
+   * too (dedupe-v3 takes the newest per key: a tombstone is a full copy, it still has its text).
+   * Full rows, every insertable column: what a full-copy tombstone needs.
+   */
+  async legacyRowsAll(ref, hostAliases = []) {
+    // Its own store, and the unknown store ('': a 0.18 row whose transcript path was empty) of the
+    // same host and id — converted rows that could not name their store still dedupe. The host
+    // also under its aliases (this machine's pre-0.20 memhouse id, which 0.18 shipped under).
+    const refs = [];
+    for (const h of [ref.host, ...hostAliases]) for (const p of [ref.harness_path, '']) refs.push(storeWhere({ ...ref, host: h, harness_path: p }));
+    const where = `(${refs.join(' OR ')})`;
+    const turns = (await this.query(`SELECT ${this.selectAll('turns')} FROM ${this.t.turns}
+      WHERE ${where} AND startsWith(message_id, 'legacy:')`)).map((r) => ({ ...r, part_ord: Number(r.part_ord) }));
+    const calls = await this.query(`SELECT ${this.selectAll('calls')} FROM ${this.t.calls}
+      WHERE ${where} AND startsWith(call_id, 'legacy:')`);
+    return { turns, calls };
+  }
+  /** Whether the session keeps any removed version (content that left its source), in turns or calls. */
+  async hasRemoved(ref) {
+    const where = `${storeWhere(ref)} AND removed = 1 AND is_deleted = 0`;
+    const r = await this.query(`SELECT (SELECT count() FROM ${this.t.turns} FINAL WHERE ${where}) + (SELECT count() FROM ${this.t.calls} FINAL WHERE ${where}) AS n`);
+    return Number((r[0] || {}).n) > 0;
+  }
+  /** The live captured rows of one session — what its legacy rows are matched against. */
+  async capturedRows(ref) {
+    const where = `${storeWhere(ref)} AND is_deleted = 0 AND removed = 0`;
+    const turns = (await this.query(`SELECT message_id, part_id, part_ord, toString(ts) AS ts, ord, role, kind, text, text_len, agent_id, response_id, extra, toString(rev) AS rev
+      FROM ${this.t.turns} FINAL WHERE ${where} AND NOT startsWith(message_id, 'legacy:')`))
+      .map((r) => ({ ...r, part_ord: Number(r.part_ord), ord: Number(r.ord), text_len: Number(r.text_len) }));
+    const calls = await this.query(`SELECT call_id, message_id, toString(ts) AS ts, tool_name, args, agent_id, toString(rev) AS rev
+      FROM ${this.t.calls} FINAL WHERE ${where} AND NOT startsWith(call_id, 'legacy:')`);
+    return { turns, calls };
+  }
+  /** The stores (h, p, s, i) of this host's live legacy rows; `prefix` 'legacy:' or 'legacy:ship:'. */
+  legacyStoresSQL(host, prefix, hostAliases = []) {
+    const hosts = [host, ...hostAliases].map(sqlStr).join(', ');
+    const one = (t, id) => `SELECT DISTINCT toString(harness) AS h, toString(harness_path) AS p, session_id AS s, incarnation AS i FROM ${t} FINAL
+          WHERE is_deleted = 0 AND host IN (${hosts}) AND startsWith(${id}, ${sqlStr(prefix)})`;
+    return `${one(this.t.turns, 'message_id')} UNION DISTINCT ${one(this.t.calls, 'call_id')}`;
+  }
+  /**
+   * Captured stores (files rows) of this host whose session has legacy rows in that store or in the
+   * unknown store ('': a 0.18 row without a transcript path). `marked`: with a 'legacy' files row
+   * (redupe) or without one (the sweep).
+   */
+  storesWithLegacySQL(host, prefix, { marked, hostAliases = [] }) {
+    const L = sqlStr(dedupe.LEGACY_ROLE);
+    const files = (role) => `SELECT toString(harness), toString(harness_path), session_id, incarnation FROM ${this.t.files} FINAL WHERE host = ${sqlStr(host)} AND ${role}`;
+    // A marker reporting kept rows is a candidate too (marked): after a tombstone cleanup a repair could
+    // write a marker that lost to the old one, which still counts rows that are gone.
+    const kept = `JSONExtractUInt(derive_state, 'dedupe', 'kept', 'turns') + JSONExtractUInt(derive_state, 'dedupe', 'kept', 'calls')`;
+    return `SELECT h AS harness, p AS harness_path, s AS session_id, i AS incarnation FROM (
+        SELECT DISTINCT toString(harness) AS h, toString(harness_path) AS p, session_id AS s, incarnation AS i, ${kept} AS k FROM ${this.t.files} FINAL
+        WHERE is_deleted = 0 AND host = ${sqlStr(host)} AND role ${marked ? `= ${L}` : `NOT IN ('side', ${L}, ${sqlStr(forks.INHERITED_ROLE)})`})
+      WHERE ((h, p, s, i) IN (${this.legacyStoresSQL(host, prefix, hostAliases)}) OR (h, '', s, i) IN (${this.legacyStoresSQL(host, prefix, hostAliases)})${marked ? ' OR k > 0' : ''})
+        ${marked ? '' : `AND (h, p, s, i) NOT IN (${files(`role = ${L}`)})`}
+      ORDER BY h, p, s`;
+  }
+  /** Deduped sessions (a 'legacy' files row) that still have live legacy ship rows, or whose marker reports kept rows (redupe). */
+  async dedupedWithLiveLegacy(host, hostAliases = []) {
+    return this.query(this.storesWithLegacySQL(host, 'legacy:ship:', { marked: true, hostAliases }));
+  }
+  /** Sessions with live legacy rows and captured files rows but no 'legacy' files row (dedupeSweep). */
+  async pendingDedupe(limit, host, hostAliases = []) {
+    return this.query(`${this.storesWithLegacySQL(host, 'legacy:', { marked: false, hostAliases })} LIMIT ${Number(limit)}`);
+  }
+}
+
+/**
+ * One capture pass at a time per memhouse home. A daemon and a `memhouse ship` (or two daemons) would
+ * otherwise run passes over the same cache, local state and house rows at once. The lock is
+ * state/capture.lock, { pid, at }, created whole (a hard link of a written file, so no reader sees it
+ * half written). Its holder rewrites `at` every PASS_LOCK_REFRESH_MS (a rename over it), so however
+ * long a pass runs, its lock stays fresh. A pass that finds it held by a live process with a fresh
+ * `at` skips; one that finds it held by a dead process, by itself, unreadable, or not refreshed for
+ * PASS_LOCK_STALE_MS takes it over.
+ *
+ * A takeover is one taker at a time: it first takes state/capture.lock.takeover (a hard link too), then
+ * reads the lock again, moves it aside by a rename, and checks that what moved is what it judged stale.
+ * When another process took the lock in between, what moved is that process's fresh lock: it is put
+ * back, and this pass skips. A takeover guard older than a minute was left by a taker that died, and is
+ * cleared for the next pass; a taker removes the guard only while it is its own. Temporary files a
+ * pass that died left beside the lock (capture.lock.<pid>, capture.lock.stale.<pid>) are swept.
+ *
+ * A holder whose refresh finds the lock no longer its own (taken over while it stalled past the stale
+ * limit: a machine asleep, a process stopped) marks it `lost`, and its pass stops at the next session.
+ */
+const PASS_LOCK_STALE_MS = 12 * 3600 * 1000;
+const PASS_LOCK_REFRESH_MS = 10 * 60 * 1000;
+function passLock(home, { now = Date.now(), pid = process.pid, refreshMs = PASS_LOCK_REFRESH_MS, onTakeover = null } = {}) {
+  if (!home) return { release() {} };
+  const file = path.join(home, 'state', 'capture.lock');
+  const guard = `${file}.takeover`;
+  fs.mkdirSync(path.dirname(file), { recursive: true });
+  const alive = (p) => { try { process.kill(p, 0); return true; } catch (e) { return e.code === 'EPERM'; } };
+  const written = (at) => { const tmp = `${file}.${pid}`; fs.writeFileSync(tmp, JSON.stringify({ pid, at })); return tmp; };
+  const linked = (target) => {
+    const tmp = written(now);
+    try { fs.linkSync(tmp, target); return true; } catch (e) { if (e.code !== 'EEXIST') throw e; return false; } finally { fs.rmSync(tmp, { force: true }); }
+  };
+  const ownedBy = (f) => { try { return JSON.parse(fs.readFileSync(f, 'utf-8')).pid === pid; } catch { return false; } };
+  const mine = () => ownedBy(file);
+  for (const name of fs.readdirSync(path.dirname(file))) {
+    const m = /^capture\.lock\.(?:stale\.)?(\d+)$/.exec(name);
+    if (m && Number(m[1]) !== pid && !alive(Number(m[1]))) fs.rmSync(path.join(path.dirname(file), name), { force: true });
+  }
+  const holding = () => {
+    const h = { lost: false };
+    // The holder's pid, null when the lock is gone; undefined when it cannot be read now (EMFILE, EIO):
+    // that is no evidence of a takeover, so the next tick decides.
+    const holder = () => { try { return JSON.parse(fs.readFileSync(file, 'utf-8')).pid; } catch (e) { return e.code === 'ENOENT' ? null : undefined; } };
+    const timer = refreshMs > 0 ? setInterval(() => {
+      try { const who = holder(); if (who === pid) fs.renameSync(written(Date.now()), file); else if (who !== undefined) h.lost = true; } catch { /* next tick */ }
+    }, refreshMs) : null;
+    if (timer && timer.unref) timer.unref();
+    h.release = () => { if (timer) clearInterval(timer); try { if (mine()) fs.rmSync(file, { force: true }); } catch { /* gone already */ } };
+    // Now, not at the next refresh: a pass resumed after a stall (a machine asleep) learns at its next
+    // check that another pass took the lock meanwhile. One small read.
+    // Lost only when another pid holds the lock: a missing file (another pass mid-takeover has moved it
+    // aside, and puts it back when it was fresh) or one that cannot be read is no evidence.
+    h.check = () => { if (!h.lost) { const who = holder(); if (Number.isInteger(who) && who !== pid) h.lost = true; } return h.lost; };
+    return h;
+  };
+  const skip = (o) => ({ held: o || { pid: null } });
+  const fresh = (o) => o && Number.isInteger(o.pid) && o.pid !== pid && alive(o.pid) && now - Number(o.at || 0) < PASS_LOCK_STALE_MS;
+  const read = () => { try { return fs.readFileSync(file, 'utf-8'); } catch (e) { if (e.code === 'ENOENT') return null; throw e; } };
+  const parse = (raw) => { try { return JSON.parse(raw); } catch { return null; } };
+
+  if (linked(file)) return holding();
+  const seen = parse(read());
+  if (fresh(seen)) return skip(seen);
+  if (!linked(guard)) {
+    try { if (now - fs.statSync(guard).mtimeMs > 60 * 1000) fs.rmSync(guard, { force: true }); } catch { /* taken over and gone */ }
+    return skip(seen);
+  }
+  try {
+    const raw = read();
+    if (raw === null) return linked(file) ? holding() : skip();
+    const o = parse(raw);
+    if (fresh(o)) return skip(o);
+    if (onTakeover) onTakeover();
+    const moved = `${file}.stale.${pid}`;
+    try { fs.renameSync(file, moved); } catch (e) { if (e.code === 'ENOENT') return linked(file) ? holding() : skip(); throw e; }
+    const was = fs.readFileSync(moved, 'utf-8');
+    if (was !== raw) {
+      try { fs.linkSync(moved, file); } catch { /* a third process holds it now */ }
+      fs.rmSync(moved, { force: true });
+      return skip(parse(was));
+    }
+    fs.rmSync(moved, { force: true });
+    return linked(file) ? holding() : skip();
+  } finally { if (ownedBy(guard)) fs.rmSync(guard, { force: true }); }
+}
+
+/** --dry-run: discovers, reads and derives, writes nothing (every files row reads as absent). */
+class DryHouse {
+  constructor() { this.inserted = {}; this.member = '(dry-run)'; }
+  async init() { return this; }
+  async insert(kind, rows) { this.inserted[kind] = (this.inserted[kind] || 0) + rows.length; }
+  async filesRows() { return []; }
+  async staleFiles() { return []; }
+  async archiveRecords() { return []; }
+  async maxGenerations() { return new Map(); }
+  async sessionMessages() { return []; }
+  async sessionsWithText() { return []; }
+  async sessionsById() { return []; }
+  async inheritedFrom() { return []; }
+  async linkedChildren() { return []; }
+  async firstCaptured() { return new Map(); }
+  async rowsByKey() { return []; }
+  async fileKeys() { return { t: [], c: [] }; }
+  async hasRemoved() { return false; }
+  async legacyRowsAll() { return { turns: [], calls: [] }; }
+  async capturedRows() { return { turns: [], calls: [] }; }
+  async pendingDedupe() { return []; }
+  async dedupedWithLiveLegacy() { return []; }
+}
+
+// ── CLI ─────────────────────────────────────────────────────────────────────────────────────
+function summary(s) {
+  const ev = Object.entries(s.events).map(([k, v]) => `${k} ${v}`).join(', ');
+  // The profile layout writes through the package and the normalised logs only: its line leads with
+  // what those wrote, never the file engine's counts, which do not run there (profilePass).
+  const lead = s.layout === 'profile'
+    ? `[memhouse] v3 capture: profile layout → ${s.sessionRows} sessions, ${s.profileRows || 0} rows${s.profileRemoved ? ` (${s.profileRemoved} kept as removed versions)` : ''}, `
+      + `${s.archiveRows} archive rows`
+    : `[memhouse] v3 capture: ${s.changed}/${s.files} files changed in ${s.sessions} sessions → ${s.written} files rows, `
+      + `${s.archiveRows} archive rows (${(s.bytes / 1048576).toFixed(1)} MiB), ${s.turns} turns, ${s.calls} calls, `
+      + `${s.tombstones} tombstones, ${s.sessionRows} sessions${s.sessionsUnchanged ? ` (${s.sessionsUnchanged} unchanged, not rewritten)` : ''}`;
+  return lead
+    + `${ev ? ` [${ev}]` : ''}${s.waits ? `, ${s.waits} waiting on a lagging copy` : ''}${s.more ? `, ${s.more} sessions continue next pass` : ''}`
+    + `${s.duplicates ? `, ${s.duplicates} duplicate files ignored` : ''}`
+    + `${s.stopped ? ', STOPPED EARLY: another pass took the lock over' : ''}`
+    + `${s.deduped ? `, deduped ${s.deduped} sessions: ${s.legacyTombstoned} legacy rows tombstoned, ${s.legacyKept} kept (not in the transcript)`
+      + `${s.legacyImports ? `, ${s.legacyImports} imports` : ''}` : ''}`
+    + `${s.cleanup ? `; cleanup: ${s.cleanup.map((c) => c.error ? `${c.kind || ''} failed: ${c.error}` : c.cleaned ? `${c.kind} ${c.tombstones} tombstones dropped (${c.rows} → ${c.after_rows} rows, ${c.ms} ms)` : `${c.kind} ${c.tombstones} tombstones kept`).join(', ')}` : ''}`
+    + `${s.bridge ? `; bridge: ${s.bridge.chats} sessions in ${s.bridge.editors} editors (${s.bridge.read} read: ${s.bridge.new} new, ${s.bridge.append} appended, ${s.bridge.rewrite} rewritten) in ${s.bridge.ms} ms` : ''}`
+    + `${s.adapters && s.adapters.length ? `; adapters: ${s.adapters.reduce((a, x) => a + (x.captured || 0), 0)} sessions captured in ${s.adapters.reduce((a, x) => a + (x.steps || 0), 0)} steps`
+      + `${s.adapters.reduce((a, x) => a + (x.kept || 0), 0) ? `, ${s.adapters.reduce((a, x) => a + (x.kept || 0), 0)} kept on the 0.20 engine (too big at first sight)` : ''}`
+      + `${s.adapters.reduce((a, x) => a + (x.heldBack || 0), 0) ? `, ${s.adapters.reduce((a, x) => a + (x.heldBack || 0), 0)} held back from the profile (too big at first sight)` : ''}`
+      + `${((v, w) => (v || w ? `, ${v} vanished from their store${w ? ` (${w} more wait for the next pass)` : ''}` : ''))(s.adapters.reduce((a, x) => a + (x.vanished || 0), 0), s.adapters.reduce((a, x) => a + (x.vanishWaiting || 0), 0))}`
+      + `${s.adapters.some(refusesVanish) ? `, VANISH REFUSED in ${storesN(s.adapters.filter(refusesVanish).length)} (below)` : ''}`
+      + `${s.adapters.some((x) => x.unconfirmed) ? `, vanish warnings in ${storesN(s.adapters.filter((x) => x.unconfirmed).length)} (below)` : ''}`
+      + `${s.adapters.some((x) => x.errors && x.errors.length) ? `, ${s.adapters.reduce((a, x) => a + ((x.errors && x.errors.length) || 0), 0)} errors` : ''}`
+      + `${s.adapters.some((x) => x.error) ? `, ${s.adapters.filter((x) => x.error).length} failed (${s.adapters.filter((x) => x.error).map((x) => `${x.harness ? `${x.harness}: ` : ''}${x.error}`).join('; ')})` : ''}` : ''}`
+    + `${s.normalise && (s.normalise.sessions || s.normalise.errors.length) ? `; normalise: ${s.normalise.sessions} sessions in ${s.normalise.harnesses} editors (${s.normalise.normalised} read: ${s.normalise.written.new} new, ${s.normalise.written.append} appended, ${s.normalise.written.rewrite} rewritten${s.normalise.deferred ? `, ${s.normalise.deferred} next pass` : ''}${s.normalise.errors.length ? `, ${s.normalise.errors.length} errors` : ''}) in ${s.normalise.ms} ms` : ''}`
+    + `${s.redupe ? `; redupe: ${s.redupe.candidates} candidates, ${s.redupe.repaired} repaired (${s.redupe.tombstoned} legacy rows tombstoned), `
+      + `${s.redupe.unchanged} unchanged, ${s.redupe.waiting} not caught up, ${s.redupe.elsewhere} not on this machine` : ''}`;
+}
+
+/**
+ * A pass's refused vanish sweeps (adapter-capture.js captureStore: THE VANISH SWEEP), one line per
+ * store and cause, printed after the pass line, and its warnings (a listed session's source the list
+ * left out that still reads). passlog.js reads them back for doctor: a refusal fails it, a warning
+ * is shown, so neither is a quiet pass.
+ */
+const refusesVanish = (x) => !!(x.vanishRefused || x.stillThere || x.candidateErrors);
+const storesN = (n) => `${n} store${n === 1 ? '' : 's'}`;
+/** One shell word: as is when it is plain, else single-quoted (a store path may hold spaces). */
+const shellWord = (w) => (/^[A-Za-z0-9_./:@%+=,-]+$/.test(w) ? w : `'${String(w).replace(/'/g, "'\\''")}'`);
+function vanishLines(s) {
+  const out = [];
+  for (const x of s.adapters || []) {
+    if (x.stillThere) out.push(`[memhouse] vanish refused: ${x.harness} ${x.harness_path}: its list left out ${x.stillThere} session${x.stillThere === 1 ? '' : 's'} the store still has; read as listed, not recorded as vanished`);
+    if (x.candidateErrors) out.push(`[memhouse] vanish refused: ${x.harness} ${x.harness_path}: ${x.candidateErrors} session${x.candidateErrors === 1 ? '' : 's'} its list left out could not be read (see the errors); not recorded as vanished`);
+    if (x.vanishRefused) {
+      out.push(`[memhouse] vanish refused: ${x.harness} ${x.harness_path}: ${x.vanishRefused}; nothing of it is recorded as vanished or removed${x.emptyStore
+        ? `. If its sessions were deleted, run: memhouse doctor --confirm-empty-store ${shellWord(`${x.harness}:${x.harness_path}`)}` : ''}`);
+    }
+    if (x.confirmedEmpty) out.push(`[memhouse] vanish: ${x.harness} ${x.harness_path}: confirmed empty; ${x.vanished} of its sessions taken as deleted on the editor's answer${x.vanishWaiting ? `, ${x.vanishWaiting} more next pass` : ''}`);
+    if (x.confirmDiscarded) out.push(`[memhouse] vanish: ${x.harness} ${x.harness_path}: the empty-store confirmation is discarded: its list names a session again`);
+    if (x.unconfirmed) out.push(`[memhouse] vanish warning: ${x.harness} ${x.harness_path}: its list left out ${x.unconfirmed} source${x.unconfirmed === 1 ? '' : 's'} of listed sessions that still read; read as listed, not recorded as vanished`);
+  }
+  return out;
+}
+
+/**
+ * The bridge step of a pass: run the bridged editors' readers into their snapshot logs, then add
+ * one root per snapshot directory (and its bridge capture) to what this pass captures.
+ */
+/**
+ * The bridge's roots beside the normalised logs' (editors/sessions-log.js): a store with a log is
+ * captured from it, not from the bridge — its normaliser replaced the 0.18 reader there. Per STORE,
+ * not per harness: one harness may have a bridged store and a logged one (Devin Desktop, Devin Local).
+ */
+function combineRoots(bridgeRoots, logRoots) {
+  const logged = new Set(logRoots.map((r) => `${r.harness}\t${r.harness_path}`));
+  // A bridged store is covered by its harness's logs when a logged store is it, or lies in its
+  // folder: OpenCode's stores are its DB files, inside the data folder the bridge keys by.
+  const inside = (r) => logRoots.some((l) => l.harness === r.harness && String(l.harness_path).startsWith(`${r.harness_path}/`));
+  return [...bridgeRoots.filter((r) => !logged.has(`${r.harness}\t${r.harness_path}`) && !inside(r)), ...logRoots];
+}
+/**
+ * The sources beside the native transcripts, refreshed each pass: the bridge's snapshots (0.18
+ * readers), and the v4 normalisers' session logs (memhouse/shipper/normalise-run.js) — then the
+ * roots and adapters this pass captures.
+ */
+/** Bridge and log roots, each carrying its adapter, and the adapter of each store (adapterOf). */
+function storeRoots(bridgeRoots, bridgeAdapters, logRoots) {
+  const slog = require('../../editors/sessions-log');
+  const roots = combineRoots(bridgeRoots.map((r) => ({ ...r, adapter: bridgeAdapters[r.harness] })),
+    logRoots.map((r) => ({ ...r, adapter: slog.logCapture(r.harness) })));
+  return { roots, storeAdapters: new Map(roots.map((r) => [`${r.harness}\t${r.harness_path}`, r.adapter])) };
+}
+// The harnesses read through @agent-realm/harness-session-adapters (memhouse/shipper/adapter-capture.js).
+// MEMHOUSE_ADAPTERS names them, comma-separated; step 3 of the switch takes Claude Code and Codex,
+// the other harnesses keep their 0.20 path until step 4.
+const ADAPTER_READY = new Set(['claude-code', 'codex']);
+function adapterHarnesses(value = process.env.MEMHOUSE_ADAPTERS) {
+  return String(value || '').split(',').map((s) => s.trim()).filter((h) => ADAPTER_READY.has(h));
+}
+/**
+ * Move the roots of the harnesses read through the package out of the file capture, into stores
+ * ({host, harness, harness_path}), one per harness data folder: every Claude Code config directory is
+ * its own store; Codex's sessions/ and archived_sessions/ are one.
+ */
+function applyAdapters(ctx) {
+  const want = ctx.adapterHarnesses || adapterHarnesses();
+  const stores = new Map();
+  // The roots stay: the file engine still discovers these sessions, and routeAdapterSessions hands each
+  // to the package or keeps it (a session too big for the package path, at first sight).
+  for (const r of ctx.roots || []) {
+    if (!want.includes(r.harness)) continue;
+    const hp = harnessPathOf(r);
+    stores.set(`${r.harness}\t${hp}`, { host: ctx.host, harness: r.harness, harness_path: hp });
+  }
+  ctx.adapterStores = [...stores.values()];
+  return ctx.adapterStores;
+}
+
+// A session whose files total more than this at first sight stays on the 0.20 file engine for good.
+// The package path holds the session's whole record view (records-to-rows anchors usage on a
+// response's first row; profile-capture keeps the view and refolds a whole generation), so its memory
+// grows with the session. On the profile layout such a session is held back (profileRouting) until
+// a bounded refold lands. MEMHOUSE_ADAPTER_MAX_SESSION_BYTES overrides it.
+const ADAPTER_MAX_SESSION_BYTES = 256 * 1024 * 1024;
+function routingPath(home) { return path.join(home, 'state', 'adapter-routing.json'); }
+/**
+ * Which engine captures each discovered session of a package harness, decided once and kept
+ * ($MEMHOUSE_HOME/state/adapter-routing.json), so a session never flips between engines (each keys
+ * its rows its own way). Up to the limit, the package; above it, the 0.20 file engine, unless the
+ * house already holds package rows for it (it grew past the limit after the switch). Sessions handed
+ * to the package leave `sessions`; the kept ones stay, and go into ctx.adapterKept.
+ */
+async function routeAdapterSessions(ctx, sessions) {
+  const want = new Set(ctx.adapterHarnesses || []);
+  const limit = Number(process.env.MEMHOUSE_ADAPTER_MAX_SESSION_BYTES) || ctx.adapterMaxSessionBytes || ADAPTER_MAX_SESSION_BYTES;
+  const file = ctx.home ? routingPath(ctx.home) : null;
+  let routing = {};
+  try { routing = file ? JSON.parse(fs.readFileSync(file, 'utf-8')) || {} : {}; } catch { routing = {}; }
+  let dirty = false;
+  ctx.adapterKept = new Map();
+  for (const [sk, S] of [...sessions]) {
+    if (!want.has(S.harness)) continue;
+    let owner = routing[sk];
+    const size = [...S.files.values()].reduce((a, f) => a + (Number(f.stat && f.stat.size) || 0), 0);
+    if (!owner) {
+      if (size <= limit) owner = 'package';
+      else {
+        const rows = await ctx.house.filesRows([refOf(S, ctx.host)]);
+        owner = rows.some((r) => Number(r.adapter_ver) >= 1e9 && !Number(r.is_deleted)) ? 'package' : 'file';
+      }
+      routing[sk] = owner; dirty = true;
+    }
+    if (owner === 'package') sessions.delete(sk);
+    else ctx.adapterKept.set(`${S.harness}\t${S.harness_path}\t${S.session_id}`, size);
+  }
+  if (dirty && file) {
+    fs.mkdirSync(path.dirname(file), { recursive: true });
+    const tmp = `${file}.${process.pid}.tmp`;
+    fs.writeFileSync(tmp, JSON.stringify(routing), { mode: 0o600 });
+    fs.renameSync(tmp, file);
+  }
+  return ctx.adapterKept;
+}
+/**
+ * The package pass: every store, then the legacy dedupe of the package's sessions. The dedupe is a
+ * sweep over the house's pending sessions (as dedupeSweep is for the file engine's), not over this
+ * pass's captures: a session captured on an earlier pass, or one whose dedupe was cut short, is
+ * deduped once the package has captured it to the end (its local state holds the list hint, which
+ * is saved only after the last step). The file engine's sweep never sees these sessions: routing
+ * takes them out of its list.
+ */
+async function adapterPass(ctx, stats) {
+  const ac = require('./adapter-capture');
+  if (ctx.layout === 'profile') return profileAdapterPass(ctx, stats, ac);
+  const pkg = ctx.sessionAdapters || ac.loadPackage();
+  const actx = { house: ctx.house, home: ctx.home, host: ctx.host, now: ctx.now, hostLabel: ctx.hostLabel || '', buildSession, stopped: ctx.stopped };
+  const out = [];
+  const kept = ctx.adapterKept || new Map();
+  const isKept = (k) => kept.has(`${k.harness}\t${k.harness_path}\t${k.session_id}`);
+  for (const store of ctx.adapterStores) {
+    const st = await ac.captureStore(actx, pkg.adapterFor(store.harness), store, { skip: isKept });
+    const { refs, ...rest } = st;
+    out.push(rest);
+    stats.turns += st.turns; stats.calls += st.calls; stats.archiveRows += st.archived;
+    stats.sessionRows = (stats.sessionRows || 0) + st.captured;
+    stats.more += st.more || 0;
+    if (st.stopped) { stats.stopped = true; return out; }
+  }
+  if (ctx.dedupe !== false && ctx.cache && typeof ctx.house.pendingDedupe === 'function') {
+    const stores = new Set(ctx.adapterStores.map((s) => `${s.harness}\t${s.harness_path}`));
+    for (const p of await ctx.house.pendingDedupe(5000, ctx.host, ctx.hostAliases || [])) {
+      const ref = { harness: p.harness, host: ctx.host, harness_path: String(p.harness_path || ''), session_id: p.session_id, incarnation: String(p.incarnation || '') };
+      if (!stores.has(`${ref.harness}\t${ref.harness_path}`) || isKept(ref)) continue;
+      const sk = skey(ref.harness, ref.session_id, ref.harness_path, ref.incarnation);
+      if (ctx.cache.data.deduped[sk]) continue;
+      const local = ac.loadLocal(ctx.home, ref);
+      if (!local || local.hint == null) continue;   // not captured to the end yet
+      const d = await dedupeSession(ctx, ref, stats);
+      if (d && d.plan) {
+        await ctx.house.insert('sessions', [buildSession(ref.harness, ref.session_id, await ctx.house.filesRows([ref]), { host: ctx.host, hostLabel: ctx.hostLabel, harnessPath: ref.harness_path, incarnation: ref.incarnation })]);
+        stats.sessionRows = (stats.sessionRows || 0) + 1;
+      }
+    }
+    ctx.cache.save();
+    // --redupe for the package's sessions, as redupe() does for the file capture's.
+    if (ctx.redupe) {
+      const r = stats.redupe || (stats.redupe = { candidates: 0, repaired: 0, unchanged: 0, waiting: 0, elsewhere: 0, tombstoned: 0 });
+      for (const p of await ctx.house.dedupedWithLiveLegacy(ctx.host, ctx.hostAliases || [])) {
+        const ref = { harness: p.harness, host: ctx.host, harness_path: String(p.harness_path || ''), session_id: p.session_id, incarnation: String(p.incarnation || '') };
+        if (!stores.has(`${ref.harness}\t${ref.harness_path}`) || isKept(ref)) continue;
+        r.candidates++;
+        const local = ac.loadLocal(ctx.home, ref);
+        if (!local || local.hint == null) { r.waiting++; continue; }
+        const before = stats.legacyTombstoned || 0;
+        const d = await dedupeSession(ctx, ref, stats, { redo: true });
+        if (d.skipped || d.unchanged) { r.unchanged++; continue; }
+        r.repaired++; r.tombstoned += (stats.legacyTombstoned || 0) - before;
+        await ctx.house.insert('sessions', [buildSession(ref.harness, ref.session_id, await ctx.house.filesRows([ref]), { host: ctx.host, hostLabel: ctx.hostLabel, harnessPath: ref.harness_path, incarnation: ref.incarnation })]);
+        stats.sessionRows = (stats.sessionRows || 0) + 1;
+      }
+    }
+  }
+  return out;
+}
+
+/**
+ * The profile layout's pass: the package's stores and the normalised logs of the other editors
+ * (log-adapter.js), both through profile-capture.js. The file engine, the snapshot bridge and
+ * schema 3's maintenance write schema 3's tables, and two of those share their names with the
+ * profile's (`{m}_sessions`, `{m}_calls`): none of them runs on a profile house.
+ */
+async function profilePass(ctx) {
+  // layout: 'profile' makes summary() lead with what this pass wrote (profileRows), not the file
+  // engine's counts, which stay zero here.
+  const stats = { layout: 'profile', sessions: 0, files: 0, changed: 0, written: 0, bytes: 0, archiveRows: 0, turns: 0, calls: 0, tombstones: 0, sessionRows: 0, waits: 0,
+    rewrites: 0, upgrades: 0, more: 0, duplicates: 0, events: {}, deduped: 0, legacyTombstoned: 0, legacyKept: 0, legacyImports: 0, profileRows: 0, profileRemoved: 0 };
+  try { stats.adapters = await adapterPass(ctx, stats); } catch (e) { stats.adapters = [{ error: e.message.split('\n')[0] }]; }
+  if (ctx.normaliseStats) { stats.normalise = ctx.normaliseStats; ctx.normaliseStats = null; }
+  // This machine's 0.18 id (the dedupe's alias) recorded in the member's meta, so readers fold its
+  // converted rows into this machine (host-alias.js). Once per pair; a read-only or failed write
+  // costs nothing and is tried again next pass.
+  if (ctx.profileHouse && !ctx.dry && (ctx.hostAliases || [])[0]) {
+    try {
+      const P = ctx.profileHouse.P;
+      if (await require('../house/host-alias').record(ctx.profileHouse, { meta: P.meta, sessions: P.sessions }, ctx.hostAliases[0], ctx.host)) stats.hostAlias = { old: ctx.hostAliases[0], host: ctx.host };
+    } catch { /* next pass */ }
+  }
+  (ctx.log || (() => {}))(stats);
+  return stats;
+}
+
+/**
+ * Which sessions the profile layout holds back, decided once per session at first sight and kept
+ * ($MEMHOUSE_HOME/state/profile-routing.json) so a session never starts on the profile half way: one
+ * whose source files total more than the limit (ADAPTER_MAX_SESSION_BYTES) is not captured on the
+ * profile until a bounded refold lands. Sources that are not files under the store count 0.
+ */
+function profileRouting(home, { stopped = () => false } = {}) {
+  const file = path.join(home, 'state', 'profile-routing.json');
+  let routes = {};
+  try { routes = JSON.parse(fs.readFileSync(file, 'utf-8')) || {}; } catch { routes = {}; }
+  let dirty = false;
+  const max = Number(process.env.MEMHOUSE_ADAPTER_MAX_SESSION_BYTES) || ADAPTER_MAX_SESSION_BYTES;
+  return {
+    heldBack(key, listed) {
+      const k = [key.harness, key.harness_path, key.session_id, key.incarnation || ''].join('\t');
+      // A session the profile capture has written is on the profile: it goes on, whatever was decided
+      // before (a route a stopped or killed pass could not save, a file that grew since).
+      if (routes[k] !== 'profile' && require('./profile-capture').onProfile(home, key)) {
+        routes[k] = 'profile'; dirty = true;
+      }
+      if (!(k in routes)) {
+        let bytes = 0;
+        for (const s of (listed && listed.sources) || []) { try { bytes += fs.statSync(path.resolve(key.harness_path, String(s.source_key))).size; } catch { /* not a file */ } }
+        routes[k] = bytes > max ? 'held-back' : 'profile';
+        dirty = true;
+      }
+      return routes[k] !== 'profile';
+    },
+    // A pass that lost its lock never writes the file: it is the holder's now.
+    save() {
+      if (!dirty || stopped()) return;
+      fs.mkdirSync(path.dirname(file), { recursive: true });
+      const tmp = `${file}.${process.pid}.tmp`;
+      fs.writeFileSync(tmp, JSON.stringify(routes), { mode: 0o600 });
+      fs.renameSync(tmp, file);
+      dirty = false;
+    },
+  };
+}
+
+/**
+ * The package pass on harness-sessions-sql's profile (MEMHOUSE_LAYOUT=profile, step B): every store through
+ * profile-capture.js, then the legacy dedupe of its sessions (profile-dedupe.js), a sweep over the
+ * house's pending sessions as on schema 3, and --redupe over the marked ones that still hold live
+ * legacy rows or report kept ones. A session too big at first sight is held back (profileRouting):
+ * there is no file engine on the profile. The file engine and the bridge still write schema 3 until
+ * their profile writers land.
+ */
+async function profileAdapterPass(ctx, stats, ac) {
+  const pc = require('./profile-capture');
+  const pd = require('../house/profile-dedupe');
+  const ph = ctx.profileHouse;
+  const actx = { house: ph, home: ctx.home, now: ctx.now, hostLabel: ctx.hostLabel || '', captureSession: pc.captureSession, stateNs: pc.NS, prefetch: pc.prefetch,
+    rowsVer: pc.ROWS_VER, edgesVer: pc.EDGES_VER, edgeBudget: { left: pc.FORK_BUDGET }, stopped: ctx.stopped };
+  const out = [];
+  const routing = profileRouting(ctx.home, { stopped: () => !!(ctx.stopped && ctx.stopped()) });
+  // The normalised logs of the editors the package does not read (adapter 'memhouse-bridge').
+  const { logAdapter } = require('./log-adapter');
+  const pkgHarnesses = new Set((ctx.adapterStores || []).map((s) => s.harness));
+  const logStores = (ctx.logRoots || scopedLogRoots(ctx))
+    .filter((r) => !pkgHarnesses.has(r.harness)).map((r) => ({ host: ctx.host, harness: r.harness, harness_path: r.harness_path }));
+  // The package is loaded only for the stores it reads: the logs need none, and a package that is
+  // missing or broken fails its own stores, never the pass. So does any store that throws.
+  let pkg = ctx.sessionAdapters || null;
+  const pkgOf = () => pkg || (pkg = ac.loadPackage());
+  const runs = [...(ctx.adapterStores || []).map((s) => [s, () => pkgOf().adapterFor(s.harness)]), ...logStores.map((s) => [s, () => logAdapter(ctx.home, s.harness)])];
+  for (const [store, adOf] of runs) {
+    let st;
+    try { st = await ac.captureStore(actx, adOf(), store, { skip: routing.heldBack }); } catch (e) {
+      out.push({ harness: store.harness, harness_path: store.harness_path, sessions: 0, captured: 0, steps: 0, errors: [], error: String(e && e.message).split('\n')[0] });
+      continue;
+    }
+    const { refs, kept, ...rest } = st;
+    out.push({ ...rest, heldBack: kept });
+    stats.archiveRows += st.archived;
+    stats.sessionRows = (stats.sessionRows || 0) + st.captured;
+    stats.profileRows = (stats.profileRows || 0) + (st.rows || 0);
+    stats.profileRemoved = (stats.profileRemoved || 0) + (st.removed || 0);
+    stats.more += st.more || 0;
+    if (st.stopped) { stats.stopped = true; break; }
+  }
+  // A stopped pass does not save: the routes file is the holder's. A session it captured first keeps
+  // going on the profile anyway (heldBack reads its local state).
+  if (stats.stopped) return out;
+  routing.save();
+  if (ctx.dedupe === false) return out;
+  const stores = new Set(runs.map(([s]) => `${s.harness}\t${s.harness_path}`));
+  const aliases = ctx.hostAliases || [];
+  const refOf = (p) => ({ harness: p.harness, host: ctx.host, harness_path: String(p.harness_path || ''), session_id: p.session_id, incarnation: String(p.incarnation || '') });
+  // Captured to the end: the local state holds the list hint, saved only after the last step.
+  const caught = (ref) => { const l = ac.loadLocal(ctx.home, ref, pc.NS); return !!l && l.hint != null; };
+  const o = { aliases, repeatsOf: (ref) => profileRepeatsOf(ph, ref) };
+  const count = (d) => {
+    const r = d.plan.report;
+    stats.deduped = (stats.deduped || 0) + 1;
+    stats.legacyTombstoned = (stats.legacyTombstoned || 0) + r.tombstoned.turns + r.tombstoned.calls;
+    stats.legacyKept = (stats.legacyKept || 0) + r.kept.turns + r.kept.calls;
+    stats.legacyImports = (stats.legacyImports || 0) + r.imports.turns + r.imports.calls;
+    if (r.kept.turns || r.kept.calls) (ctx.log || (() => {}))({ dedupe: `${r.harness}:${r.session_id}`, matched: r.matched, kept: r.kept, captured: r.captured });
+  };
+  const passStores = runs.map(([x]) => ({ harness: x.harness, harness_path: x.harness_path }));
+  for (const p of await ph.rows(`${pd.storesWithLegacySQL(ph.P, ctx.host, { marked: false, aliases, stores: passStores })} LIMIT 5000`)) {
+    const ref = refOf(p);
+    if (!stores.has(`${ref.harness}\t${ref.harness_path}`) || !caught(ref)) continue;
+    const d = await pd.dedupeProfileSession(ph, ph.P, ref, o);
+    if (d.plan) count(d);
+  }
+  if (ctx.redupe) {
+    const r = stats.redupe || (stats.redupe = { candidates: 0, repaired: 0, unchanged: 0, waiting: 0, elsewhere: 0, tombstoned: 0 });
+    for (const p of await ph.rows(pd.storesWithLegacySQL(ph.P, ctx.host, { marked: true, aliases }))) {
+      const ref = refOf(p);
+      if (!stores.has(`${ref.harness}\t${ref.harness_path}`)) continue;
+      r.candidates++;
+      if (!caught(ref)) { r.waiting++; continue; }
+      const before = stats.legacyTombstoned || 0;
+      const d = await pd.dedupeProfileSession(ph, ph.P, ref, { ...o, redo: true });
+      if (!d.plan || d.unchanged) { r.unchanged++; continue; }
+      count(d);
+      r.repaired++; r.tombstoned += (stats.legacyTombstoned || 0) - before;
+    }
+  }
+  return out;
+}
+
+/**
+ * The normalised logs a pass may capture. Logs an excluded editor's normaliser wrote before
+ * MEMHOUSE_EDITORS (or ctx.editors) narrowed it are not captured, whether the normalisers run this
+ * pass or not.
+ */
+function scopedLogRoots(ctx) {
+  const editors = ctx.editors !== undefined ? ctx.editors : process.env.MEMHOUSE_EDITORS;
+  const scope = require('../../editors/scope');
+  return require('../../editors/sessions-log').logRoots(ctx.home).filter((r) => scope.normaliserInScope(r.harness, editors));
+}
+
+function applyBridge(ctx) {
+  let m = null; let b = { roots: [], adapters: {} };
+  // ctx.editors narrows like MEMHOUSE_EDITORS (tests); the environment otherwise.
+  const editors = ctx.editors !== undefined ? ctx.editors : process.env.MEMHOUSE_EDITORS;
+  if (ctx.bridge !== false) {
+    const snapshots = require('./snapshots');
+    m = snapshots.materialize({ home: ctx.home, editors, log: (l) => console.error(l) });
+    b = snapshots.bridgeRoots(m.dir, m.harnesses);
+  }
+  if (ctx.normalise !== false) {
+    try { ctx.normaliseStats = require('./normalise-run').run({ home: ctx.home, editors, log: (l) => console.error(l) }); }
+    catch (e) { console.error(`[memhouse] normalisers skipped this pass: ${e.message}`); }
+  }
+  ctx.logRoots = scopedLogRoots(ctx);
+  const s = storeRoots(b.roots, b.adapters, ctx.logRoots);
+  ctx.roots = [...(ctx.baseRoots || []), ...s.roots];
+  ctx.storeAdapters = s.storeAdapters;
+  if (ctx.adapterHarnesses && ctx.adapterHarnesses.length) applyAdapters(ctx);
+  ctx.adapters = { ...defaultAdapters(), ...b.adapters };
+  ctx.bridgeStats = m ? m.stats : null;
+  return m;
+}
+
+/**
+ * opts.afterSleep: called after each loop interval, before the next pass — ship.js passes its
+ * self-update check, so a capture daemon notices an upgrade the way the 0.18 shipper does.
+ */
+/** The cache as the file holds it now (see the ship loop: read again by every pass that takes the lock). */
+function reloadCache(ctx) {
+  if (ctx.cache && ctx.cache.file) ctx.cache = new Cache(ctx.cache.file).load();
+  if (ctx.cache) ctx.cache.guard = () => !!(ctx.stopped && ctx.stopped());
+}
+
+/**
+ * `ship --duplicates` lists live captured + legacy pairs in layout 3.2's turns (dedupe-v3.duplicates).
+ * A profile house has no turns table to read: refused, with what to run there instead.
+ */
+function duplicatesRefusal(layout) {
+  if (layout !== 'profile') return null;
+  return 'ship --duplicates reads layout 3.2\'s turns, and this capture runs on the profile layout, which has no duplicates report yet '
+    + '(a 3.2 development house takes MEMHOUSE_LAYOUT=v3-dev). Every profile pass dedupes the sessions it captures against their '
+    + 'converted rows; `memhouse ship --redupe` repairs the ones deduped too early.';
+}
+
+async function main(argv = process.argv.slice(2), opts = {}) {
+  const env = process.env;
+  if (env.MEMHOUSE_SCHEMA && env.MEMHOUSE_SCHEMA !== '3') {
+    console.error(`[memhouse] capture is the schema-3 writer; MEMHOUSE_SCHEMA=${env.MEMHOUSE_SCHEMA}. Refusing.`);
+    process.exit(2);
+  }
+  const doctor = argv.includes('--duplicates');   // reads the house only: no source roots needed
+  const dry = argv.includes('--dry-run');
+  // Unset MEMHOUSE_SOURCE_ROOTS: the machine's default (source-roots.js), re-resolved each pass.
+  const defaulted = !env.MEMHOUSE_SOURCE_ROOTS;
+  const resolveRoots = () => (defaulted ? require('./source-roots').defaultSourceRoots().roots : parseSourceRoots(env.MEMHOUSE_SOURCE_ROOTS));
+  let roots = [];
+  if (!doctor) {
+    try { roots = resolveRoots(); } catch (e) { console.error(`[memhouse] ${e.message}`); process.exit(2); }
+    // No Claude Code or Codex here is no reason to stop: the normalisers and the bridge read every
+    // other editor (a machine with Cursor alone ships). Said once, then the pass goes on.
+    if (defaulted && !roots.length) {
+      console.error('[memhouse]   no Claude Code projects dir or Codex sessions dir in the default places (~/.claude, ~/.claude-playbooks/*, ~/.codex);');
+      console.error('[memhouse]   the other editors are still read. Set MEMHOUSE_SOURCE_ROOTS to name one elsewhere.');
+    }
+  }
+  let house;
+  if (dry) house = new DryHouse();
+  else {
+    if (!env.MEMHOUSE_URL || !env.MEMHOUSE_USER) { console.error('[memhouse] MEMHOUSE_URL and MEMHOUSE_USER are required (or --dry-run).'); process.exit(2); }
+    let password = env.MEMHOUSE_PASSWORD || '';
+    if (!password && env.MEMHOUSE_PASSWORD_FILE) password = fs.readFileSync(env.MEMHOUSE_PASSWORD_FILE, 'utf-8').trim();
+    house = new HttpHouse({ url: env.MEMHOUSE_URL, user: env.MEMHOUSE_USER, password, db: env.MEMHOUSE_DB || 'mem', member: env.MEMHOUSE_MEMBER || null });
+  }
+  // Schema 3 is harness-sessions-sql's profile (step B): the package's stores write it, and every reader
+  // reads it. MEMHOUSE_LAYOUT=v3-dev keeps the 0.20 development builds' writers (turns, files,
+  // records) for a development house; a dry run uses them too, since it writes nothing.
+  const layout = dry || env.MEMHOUSE_LAYOUT === 'v3-dev' ? '3' : 'profile';
+  const loopIdx = argv.indexOf('--loop');
+  const loop = loopIdx !== -1;
+  const interval = loop && Number(argv[loopIdx + 1]) > 0 ? Number(argv[loopIdx + 1]) : 300;
+  // A daemon started before the network (login, boot) must wait for the house, not die: the
+  // 0.18 loop retried with backoff, and an unsupervised `memhouse start` daemon that exits here
+  // never comes back. Logged as a failed pass so `status` and `doctor` can say why.
+  for (let wait = 15; ; wait = Math.min(wait * 2, interval)) {
+    try { await house.init(); break; } catch (e) {
+      if (!loop) throw e;
+      console.error(`[memhouse] v3 pass failed: ${e.message} — retrying in ${wait}s`);
+      await new Promise((r) => setTimeout(r, wait * 1000));
+    }
+  }
+  // The profile is never captured into a house that still holds the member's development layout
+  // (<m>_turns): its admin moves the member first. MEMHOUSE_LAYOUT=v3-dev keeps capturing into it.
+  if (layout === 'profile' && !dry) {
+    const sc = require('../house/schema-choice');
+    const devOf = async () => sc.devLayoutRefusal(await sc.detectHouseSchema((sql) => house.rows(sql), house.db, house.member), house.member);
+    // A looping shipper waits, captures nothing, and checks again each interval: it starts once
+    // the member has been moved, and never writes the profile beside <m>_turns meanwhile.
+    for (let dev = await devOf(); dev; dev = await devOf()) {
+      console.error(`[memhouse] ✗ not capturing: ${dev}. Until then this machine can keep capturing the development layout with MEMHOUSE_LAYOUT=v3-dev.`);
+      if (!loop) { process.exitCode = 2; return; }
+      await new Promise((r) => setTimeout(r, interval * 1000));
+    }
+  }
+  const home = env.MEMHOUSE_HOME || path.join(os.homedir(), '.memhouse');
+  const ident = dry ? 'dry-run' : `${env.MEMHOUSE_URL}|${house.db}|${house.member}`;
+  const cache = dry ? new Cache(null) : new Cache(cachePath(home, ident)).load();
+  // The machine in every key: sessions-model/host/v0, derived from the OS machine id (host.js).
+  // memhouse's own `<short>-<fp8>` id is this machine's alias for rows written before 0.20 (0.18
+  // shipped them under it): the dedupe matches them as this host's.
+  const hostMod = require('../host');
+  const host = env.MEMHOUSE_HOST_ID || hostMod.sessionsHost();
+  const legacyHost = (() => { try { return hostMod.identity().id; } catch { return ''; } })();
+  const backfill = argv.includes('--backfill');
+  const ctx = {
+    house, cache, host, roots, adapters: defaultAdapters(), now: Date.now,
+    hostLabel: hostMod.hostLabel(), hostAliases: legacyHost && legacyHost !== host ? [legacyHost] : [],
+    // Dedupe is always on (the rule: never two copies of a record); --no-dedupe exists for
+    // diagnosis. --reconcile, its predecessor's opt-in, is accepted and changes nothing.
+    dedupe: !argv.includes('--no-dedupe') && env.MEMHOUSE_DEDUPE !== '0',
+    redupe: argv.includes('--redupe'),
+    // Tombstone cleanup (tombstoneCleanup): daily; --cleanup forces one now; MEMHOUSE_CLEANUP=0 / --no-cleanup turn it off.
+    cleanup: !argv.includes('--no-cleanup') && env.MEMHOUSE_CLEANUP !== '0' && !dry,
+    cleanupNow: argv.includes('--cleanup'),
+    // The bridge (editors/bridge.js, snapshots.js): every editor without a transcript-file capture,
+    // read through its 0.18 reader into snapshot logs. On unless MEMHOUSE_BRIDGE=0 or --no-bridge.
+    bridge: !argv.includes('--no-bridge') && env.MEMHOUSE_BRIDGE !== '0' && !dry,
+    // The v4 normalisers (editors/normalise/): their session logs replace the bridge store by store.
+    // On unless MEMHOUSE_NORMALISE=0 or --no-normalise.
+    normalise: !argv.includes('--no-normalise') && env.MEMHOUSE_NORMALISE !== '0' && !dry,
+    // The harnesses read through @agent-realm/harness-session-adapters instead (MEMHOUSE_ADAPTERS; step 3).
+    adapterHarnesses: adapterHarnesses(env.MEMHOUSE_ADAPTERS),
+    home, layout, dry,
+  };
+  if (layout === 'profile') {
+    // The package reads its harnesses; the normalisers write the other editors' logs, which the
+    // profile engine reads through log-adapter.js. The snapshot bridge (schema 3's writer for the
+    // editors with neither) stays off: those editors are not captured on the profile yet.
+    ctx.bridge = false;
+    if (!env.MEMHOUSE_ADAPTERS) ctx.adapterHarnesses = [...ADAPTER_READY];
+    console.error(`[memhouse] profile layout: ${ctx.adapterHarnesses.join(', ') || 'no harness'} through the package, the normalised editors through their logs; editors with neither are not captured on this layout yet.`);
+    const { ProfileHouse } = require('../house/profile-house');
+    ctx.profileHouse = new ProfileHouse(house, require('../house/schema-profile').profileNames(house.db, house.member));
+  }
+  ctx.baseRoots = roots;
+  if (doctor) {
+    // The doctor: live captured + legacy pairs with the same text, per session (dedupe-v3.duplicates).
+    if (dry) { console.error('[memhouse] --duplicates reads the house; it has nothing to read in a dry run.'); process.exit(2); }
+    const refused = duplicatesRefusal(layout);
+    if (refused) { console.error(`[memhouse] ${refused}`); process.exit(2); }
+    const d = await dedupe.duplicates(house, house.t);
+    console.log(JSON.stringify(d, null, 2));
+    return;
+  }
+  console.log(`[memhouse] v3 capture → ${dry ? 'dry run (nothing written)' : `${env.MEMHOUSE_URL} as ${house.member} (${house.db}, ${house.adb})`}; host ${host}`);
+  const showRoots = (rs) => { for (const r of rs) console.log(`[memhouse]   ${r.harness.padEnd(11)} ${r.name.padEnd(14)} ${r.dir}`); };
+  if (defaulted) console.log('[memhouse]   (MEMHOUSE_SOURCE_ROOTS unset — the default roots, re-read every pass)');
+  showRoots(roots);
+  let passes = 0;
+  do {
+    const t0 = Date.now();
+    if (defaulted && passes++ > 0) {
+      // A playbook installed since the last pass is a new root; one removed drops out.
+      try {
+        const next = resolveRoots();
+        const key = (rs) => rs.map((r) => `${r.harness}|${r.name}|${r.dir}`).join('\n');
+        if (key(next) !== key(ctx.baseRoots)) { console.log('[memhouse] source roots changed:'); showRoots(next); ctx.baseRoots = next; ctx.roots = next; }
+      } catch (e) { console.error(`[memhouse] could not re-read the default roots (keeping the last set): ${e.message}`); }
+    }
+    if (ctx.bridge || ctx.normalise) {
+      try { applyBridge(ctx); } catch (e) { console.error(`[memhouse] bridge skipped this pass: ${e.message}`); }
+    } else if (ctx.adapterHarnesses.length) {
+      ctx.roots = [...(ctx.baseRoots || [])];
+      applyAdapters(ctx);
+    }
+    const lock = dry ? { release() {} } : passLock(ctx.home);
+    if (lock.held) console.log(`[memhouse] another capture pass is running in this home${lock.held.pid ? ` (pid ${lock.held.pid})` : ''}: this pass is skipped`);
+    else try {
+      let s;
+      ctx.stopped = () => !!(lock.lost || (lock.check && lock.check()));
+      // The cache file is read again by every pass that takes the lock: another pass may have saved
+      // it since this process last did (a one-shot ship while a daemon slept, or a pass that took
+      // over from this one), and this pass's save must never write an older copy back over it.
+      reloadCache(ctx);
+      do {
+        s = await runPass(ctx);
+        console.log(`${summary(s)} in ${((Date.now() - t0) / 1000).toFixed(1)}s`);
+        for (const line of vanishLines(s)) console.log(line);
+        // Without the package a profile pass captures no Claude Code or Codex session at all; that
+        // must not read as a quiet pass with nothing new.
+        const ac = require('./adapter-capture');
+        const unusable = (s.adapters || []).find((x) => ac.isPackageMissing(x.error));
+        if (unusable) {
+          console.error(`[memhouse] ✗ ${ac.packageMessage(unusable.error)}`);
+          if (!loop) process.exitCode = 1;
+        }
+        if (s.stopped || lock.lost) {
+          console.error('[memhouse] another capture pass took this home\'s lock over (this one stalled past its stale limit): this pass stopped early');
+          if (!loop) process.exitCode = 1;
+          break;
+        }
+      } while (backfill && s.more > 0);
+    } catch (e) {
+      console.error(`[memhouse] v3 pass failed: ${e.message}`);
+      if (env.MEMHOUSE_DEBUG) console.error(e);
+      if (!loop) process.exitCode = 1;
+    } finally { lock.release(); ctx.stopped = null; }
+    if (loop) {
+      await new Promise((r) => setTimeout(r, interval * 1000));
+      if (opts.afterSleep) opts.afterSleep();
+    }
+  } while (loop);
+}
+
+module.exports = {
+  applyAdapters, adapterHarnesses, adapterPass, routeAdapterSessions, ADAPTER_MAX_SESSION_BYTES,
+  parseSourceRoots, classifyRoot, discover, Cache, cachePath, captureFile, runPass, buildSession, batches,
+  archiveRows, recordsFromArchive, rebuildFromArchive, replayArchive, manifestRow, fkey, splitLines, prefixDigest, extendDigest, digestOf, digestBuffer, HttpHouse, DryHouse,
+  TABLE_COLUMNS, dedupeSession, dedupeSweep, codexRepeatsOf, profileRepeatsOf, profileAdapterPass, profileRouting, main, defaultAdapters, applyBridge, combineRoots, storeRoots, adapterOf, summary, vanishLines,
+  passLock, PASS_LOCK_STALE_MS, PASS_LOCK_REFRESH_MS, duplicatesRefusal, reloadCache,
+  BLOCK, ANCHOR, CHUNK, BATCH_ROWS, BATCH_BYTES, FRAGMENT_MS,
+};
+
+if (require.main === module) {
+  main().catch((e) => { console.error(`[memhouse] fatal: ${e.message}`); process.exit(1); });
+}