mirror-mind 0.36.0 → 0.36.1

package/docs/releases/index.md

@@ -12,6 +12,7 @@ Future release notes should use the structure defined in [Release Notes](../proc
 
 ## Releases
 
+- [v0.36.1 — A Home Keeps Only Its Own Pi Sessions](v0.36.1.md) — patch release of one Change Request, CR153: session maintenance imports no Pi session, so the Mirror homes on one machine no longer copy each other's Pi conversations; a home's Pi conversations are the ones the Pi extension logged into it. `PI_SESSIONS_DIR` is inert. Conversations an earlier version imported stay, and the note shows how to list them. Update every install that has a home. No migration.
 - [v0.36.0 — Five Runtimes, and a Home's Extensions on Every One](v0.36.0.md) — minor release closing CV21.DS10: Grok Build is the fifth runtime, at its honest L3 through the canonical plugin in two printed steps, measured live on grok 1.0.62. With it, CV21.DS5.US2: a home's installed extensions reach Claude Code, Codex, Antigravity, and Grok Build as one generated plugin per home, chosen by measurement on all four. Three Change Requests found by use: an extension's settings file (`extensions/<id>.env`, merged under the environment for the one spawned process), a quiet exit on a closed pipe, and a `bind` that refuses what it cannot bind. No migration.
 - [v0.35.0 — Four Runtimes, One Successor](v0.35.0.md) — minor release closing CV21.DS8: the Gemini CLI integration no longer ships and Antigravity stands in its place, the gate met by DS7's live L4 on agy 1.4.2. Four runtimes — Pi, Claude Code, Codex, Antigravity — named everywhere; the cutoff recorded in full, with the four hook entries a Gemini CLI user deletes and v0.34.0 as the last release that carries the integration; a retired-surface guard keeps it removed. No migration.
 - [v0.34.0 — Codex Through the Canonical Plugin](v0.34.0.md) — minor release closing CV21.DS4: Codex runs Mirror through the canonical plugin, installed in two commands from a marketplace the package ships, measured live at L4 on Codex 0.163.0. The v0.32.1 wrapper wiring no longer ships; `runtime diagnose` and `runtime update` say when Codex's cached plugin copy is behind and name the re-add that brings it level. No migration.

package/docs/releases/v0.36.1.md

@@ -0,0 +1,137 @@
+---
+digest: >
+  v0.36.1 is a patch release of one Change Request, CR153. Session
+  maintenance used to read Pi's session directory and import every session a
+  home did not already track, so on a machine with more than one Mirror home
+  each home copied the other's Pi conversations and titled them again through
+  the provider. Maintenance now imports no Pi session: a home's Pi
+  conversations are the ones the Pi extension logged into it, as they
+  happened, and `PI_SESSIONS_DIR` is no longer read. Conversations an earlier
+  version imported stay where they are, and this note shows how to list them.
+  Update every install that has a home. No migration.
+---
+
+# v0.36.1 — A Home Keeps Only Its Own Pi Sessions
+
+**Date:** 2026-10-21
+
+## Highlights
+
+- **Session maintenance imports no Pi session**
+  ([CR153](../project/refinement/rs010-cv22-oracle-and-port-hygiene/cr153-a-home-s-pi-backfill-imports-another-home-s-sessions.md)).
+  It used to read every file in Pi's session directory and import each one the home
+  did not track, every session another Mirror home on the same machine had logged
+  among them. A home's Pi conversations are now exactly the ones the Pi extension
+  logged into it, as they happened.
+- **Nothing in Mirror reads Pi's session files.** Not your history from before Mirror,
+  not sessions you run without it, and not another home's. `PI_SESSIONS_DIR` is inert:
+  a `.env` that sets it keeps working, and it changes nothing.
+- **What was already imported stays.** This release removes the cause, not the copies;
+  [Upgrading](#upgrading) shows how to list them.
+- **Update every install that has a home.** A home is safe from a neighbour's
+  maintenance only once the install that neighbour runs carries this release.
+
+## Where We Started
+
+The import is older than the idea of two homes on one machine. It existed to fill a
+gap: a Pi session the extension never logged reached the home anyway, at the next
+maintenance. v0.32.0 narrowed it to sessions newer than the home, so a new home would
+not swallow a lifetime of Pi history. Nothing scoped it to the home.
+
+CV21.DS5.US3's live route exposed it. A Claude Code cell ran on the real `HOME` against
+a scratch home born that evening, and two seconds into its first session, maintenance
+imported four of the person's Pi sessions from that day, from both of their real homes,
+and titled them through the provider. The route closed its own hole the same evening;
+the product's was CR153.
+
+Measured before planning, read-only, on the maintainer's two homes, one a copy of the
+other since July: each had taken the other's Pi conversations all along, 543 between
+them, and both were still doing it. Titling them took 411 provider calls. No memory
+came from any of them, because extraction needs a journey and an import carries none,
+but every one listed as the newest conversation, since an import's start is the moment
+it was imported. The gap the import existed to fill came up once in three months.
+
+## What Changed
+
+**The decision.** Three ways out were weighed: a claim recorded at session start, so a
+home imports only sessions it saw begin; a mark written into each Pi session file, so a
+home imports only files carrying its name; or no import at all. The claim would have
+kept the one recovery in three months for a table, a migration, and a claim lifecycle.
+The mark would have left every home reading every other home's files at every start.
+Retiring the import is the only option in which no home reads Pi's files at all, and
+it gives up almost nothing
+([decision](../project/decisions.md#session-maintenance-imports-no-pi-session-a-home-holds-the-pi-conversations-it-logged-live)).
+
+**The change.** The Pi backfill, the import seam only it still used, and v0.32.0's
+birth floor are deleted, and a retired-surface guard keeps them deleted. The tests came
+first: three cases — a session in Pi's default directory, one under `PI_SESSIONS_DIR`,
+and the full `session-start` the SessionStart hooks run — failed on the old code, each
+importing a session another home had logged, and pass now. The Navigator then ran the
+published 0.36.0 beside the change on the same session: the old version took it and
+the new one did not. On the real Pi history the new one took nothing, and a live Pi
+session against a scratch home was logged as before.
+
+### What you will notice
+
+- The maintenance report has four lines: `Closed stale conversations`, `Retitled pending
+  conversations`, `Extracted pending conversations`, and `Finished deferred close tails`.
+- If you have run more than one home on this machine, each may hold Pi conversations
+  the other logged. They are not removed.
+- A Pi session you run without Mirror's extension never appears in Mirror. Run Pi with
+  the Mirror package, and its sessions are logged as they happen.
+
+## Upgrading
+
+```bash
+mirror runtime update          # or: npm install -g mirror-mind
+```
+
+Update every install that has a home: the package, and each clone. There is no
+database migration, and no runtime wiring changes.
+
+To list the Pi conversations an earlier version imported into a home, read-only:
+
+```bash
+sqlite3 ~/.mirror-minds/<user>/memory.db \
+  "SELECT id, title, started_at FROM conversations
+    WHERE interface = 'pi' AND julianday(started_at) >= julianday(ended_at)
+    ORDER BY started_at"
+```
+
+An import gives itself away: it started when it was imported, after its last message.
+The home's dated backups and its pre-write backup hold the same rows.
+
+## Conscious Exclusions
+
+- **Removing what was imported.** A command that lists and removes those conversations
+  is [CR154](../project/refinement/rs010-cv22-oracle-and-port-hygiene/cr154-a-home-cannot-list-or-remove-the-pi-conversations-it-imported.md).
+- **A session whose logging never reached the core** is now simply missing from the
+  home, with an error line in `mirror-logger.log` and nowhere else. `runtime diagnose`
+  reading those lines is
+  [CR155](../project/refinement/rs010-cv22-oracle-and-port-hygiene/cr155-runtime-diagnose-does-not-read-the-pi-extension-s-error-lines.md).
+- **A home made by copying another's database** is the same home twice — the same ids,
+  the same history. The docs saying so is
+  [CR156](../project/refinement/rs010-cv22-oracle-and-port-hygiene/cr156-a-home-made-by-copying-another-s-database-is-the-same-home-twice.md).
+- **Importing a Pi session on request.** If it is wanted, it is a feature with its own
+  story, not something maintenance does in the background.
+- **The transcript backfill** matches a session's replies by time window — the same
+  shape, inside one home. That is
+  [CR151](../project/refinement/rs010-cv22-oracle-and-port-hygiene/cr151-the-transcript-backfill-writes-a-session-s-replies-into-other-sessions-conversations.md),
+  its own change.
+
+## What We Learned
+
+The import decided ownership from an absence: a session the home did not track was the
+home's to take. That was true while a machine had one home, and it stopped being true
+on the day a second home appeared, with nothing to mark the day.
+
+The leak was also invisible to the check that should have caught it. The first look at
+the real homes asked by journey, and an import has no journey. Measured by construction
+instead — an import starts after its own last message — the same homes held 543. A
+measurement taken before planning turned "consider pulling it first" into a fact about
+the maintainer's own data.
+
+## Next Horizon
+
+CR154: a home lists, and on request removes, the Pi conversations an earlier version
+imported. Then CV21.DS5.TS4 and DS11, and CV21's own release.

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "mirror-mind",
-  "version": "0.36.0",
+  "version": "0.36.1",
   "description": "Mirror Mind: a local-first memory and identity framework for agentic AI runtimes (Pi, Claude Code, Codex, Antigravity)",
   "license": "MIT",
   "repository": {

package/plugins/mirror-mind/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "mirror-mind",
-  "version": "0.36.0",
+  "version": "0.36.1",
   "description": "Mirror Mind — local-first memory and identity for agentic runtimes.",
   "author": {
     "name": "Mirror Mind"

package/plugins/mirror-mind/plugin.json

@@ -1,7 +1,7 @@
 {
   "name": "mirror-mind",
   "description": "Mirror Mind — local-first memory and identity for agentic runtimes.",
-  "version": "0.36.0",
+  "version": "0.36.1",
   "mcpServers": {
     "mirror-mind": {
       "command": "/bin/sh",

package/ts/src/conversation/loggerRuntime.ts

@@ -2,10 +2,10 @@
 //
 // Everything the `conversation-logger` subcommands need beyond the database
 // is assembled here, once per invocation, from an EXPLICIT environment: the
-// clock and id generator, the transcript/session resolution inputs, the Pi
-// sessions directory, the pre-write backup, and -- only for the subcommands
-// that cross the LLM close tail -- the replay providers and the maintenance
-// dependencies built on them.
+// clock and id generator, the transcript/session resolution inputs, the
+// pre-write backup, and -- only for the subcommands that cross the LLM close
+// tail -- the replay providers and the maintenance dependencies built on them.
+// (No Pi sessions directory: maintenance reads no Pi session file, CR153.)
 //
 // The providers are loaded lazily. `diagnose-journeys`
 // or `session-start --fast` must never fail because a replay fixture is not
@@ -17,7 +17,6 @@
 // Nothing here reads `process.env` or `os.homedir()`; the front door passes
 // them in, which is what keeps every test of this module hermetic.
 
-import { backfillPiSessions, homeBornAt, resolvePiSessionsDir } from "#conversation/backfill.ts";
 import { createCloseHooks, maybeGenerateTitle } from "#conversation/closeTail.ts";
 import { runConversationExtraction } from "#conversation/extraction.ts";
 import { runExtractionWithAccounting } from "#conversation/extractionRun.ts";
@@ -47,7 +46,6 @@ import {
 export type LoggerRuntimeEnv = {
   MIRROR_SESSION_ID?: string;
   CLAUDE_PROJECT_DIR?: string;
-  PI_SESSIONS_DIR?: string;
   MIRROR_TS_CONVERSATION_LLM_REPLAY?: string;
   MIRROR_TS_CONVERSATION_EMBEDDING_REPLAY?: string;
   /** Read by the live providers when the close tail runs against a real model. */
@@ -100,12 +98,11 @@ export interface LoggerRuntime {
   readonly homeDir: string;
   readonly claudeProjectDir: string | null;
   readonly environmentSessionId: string | null;
-  readonly piSessionsDir: string;
   /** Which transport answers the close tail here: replay, incomplete replay, or live. */
   readonly transportMode: ProviderTransportMode;
   /** The close hooks (extraction + finalization) behind the replay transport. */
   closeHooks(): Promise<CloseHooks>;
-  /** The full maintenance wiring, including the real Pi backfill. */
+  /** The full maintenance wiring. */
   maintenanceDeps(): Promise<MaintenanceDeps>;
   /** The dated zip backup for the mutating journey repair; see `LoggerRuntimeOptions.backup`. */
   readonly backup: ((stdout: (line: string) => void) => string | null) | null;
@@ -135,7 +132,6 @@ function liveTailOverrides(
 
 export function createLoggerRuntime(options: LoggerRuntimeOptions): LoggerRuntime {
   const { db, env, deps } = options;
-  const piSessionsDir = resolvePiSessionsDir(null, env, options.homeDir);
 
   // One precedence, shared with the router so the two cannot disagree about
   // which transport is live: replay -> incomplete -> live. The pair rule that
@@ -225,7 +221,6 @@ export function createLoggerRuntime(options: LoggerRuntimeOptions): LoggerRuntim
     homeDir: options.homeDir,
     claudeProjectDir: env.CLAUDE_PROJECT_DIR || null,
     environmentSessionId: env.MIRROR_SESSION_ID?.trim() || null,
-    piSessionsDir,
     transportMode: transport.mode,
     backup: options.backup ?? null,
     closeHooks,
@@ -246,14 +241,6 @@ export function createLoggerRuntime(options: LoggerRuntimeOptions): LoggerRuntim
         // CV21.DS4.TS2: the finalization a bounded runtime's SessionEnd deferred.
         finalizeCloseTail: (database, conversationId) =>
           hooks.finalizeMetadata(database, conversationId),
-        // CR121: only the sessions newer than this home; its birth is read from
-        // the ledger once per maintenance run, and an unknown birth is an error.
-        backfillPiSessions: (database) =>
-          backfillPiSessions(
-            database,
-            { sessionsDir: piSessionsDir, notBefore: homeBornAt(database) },
-            deps,
-          ),
         extractionLimit: resolveMaintenanceMaxExtractions({ env }),
         staleOrphanMinutes: resolveStaleOrphanMinutes({ env }),
         monotonic: options.monotonic,

package/ts/src/conversation/sessionComposites.ts

@@ -48,12 +48,6 @@ export interface MaintenanceDeps {
    * only for callers written before the step existed; the front door wires it.
    */
   finalizeCloseTail?: (db: WritableDatabase, conversationId: string) => Promise<void> | void;
-  /**
-   * `backfillPiSessions` (slice E) bound to its resolved sessions directory.
-   * Injected rather than resolved here so the composite never reads the
-   * environment itself; the front door owns that resolution.
-   */
-  backfillPiSessions: (db: WritableDatabase) => Promise<number> | number;
   /** Python's `MEMORY_MAINTENANCE_MAX_EXTRACTIONS` (AI-05); defaults to the released budget. */
   extractionLimit?: number;
   /** `MIRROR_STALE_ORPHAN_MINUTES` (CV21.DS4.US4); defaults to the 30-minute threshold. */
@@ -231,6 +225,11 @@ function formatElapsed(elapsed: number): string {
  * warning tails. The step order is behavior, not presentation — closing stale
  * orphans first is what makes their conversations eligible for the extraction
  * step in the same run.
+ *
+ * CR153: there is no Pi backfill step. Python's walked Pi's session directory
+ * and imported every file this home did not track, which on a machine with two
+ * homes meant each other's sessions; a home's Pi conversations are the ones the
+ * Pi extension logged into it, and maintenance reads no Pi session file.
  */
 export async function sessionMaintenance(
   db: WritableDatabase,
@@ -246,7 +245,6 @@ export async function sessionMaintenance(
         thresholdMinutes: deps.staleOrphanMinutes ?? STALE_ORPHAN_THRESHOLD_MINUTES,
       }),
     ),
-    await timedStep("Backfilled Pi sessions", monotonic, () => deps.backfillPiSessions(db)),
     await timedStep("Retitled pending conversations", monotonic, () =>
       retitlePendingConversations(db, { retitleConversation: deps.retitleConversation }),
     ),

package/ts/src/conversation/transcriptBackfill.ts

@@ -23,7 +23,11 @@ function isRecord(value: unknown): value is Record<string, unknown> {
   return typeof value === "object" && value !== null && !Array.isArray(value);
 }
 
-/** Python `dict.get` on something that must be a dict; see `backfill.ts`. */
+/**
+ * Python `dict.get(key, default)` on a value that MUST be a dict: anything else
+ * raises, as Python's AttributeError does. The default applies only when the
+ * key is ABSENT -- a present `null` comes back as null, as Python returns None.
+ */
 function getOr(container: unknown, key: string, fallback: unknown): unknown {
   if (!isRecord(container)) throw new TypeError(`expected an object with '${key}'`);
   return key in container ? container[key] : fallback;

package/ts/src/db/migrations.ts

@@ -548,13 +548,10 @@ export const MIGRATIONS: readonly (readonly [string, MigrationApply])[] = [
  * contract.
  */
 export function runMigrations(db: WritableDatabase): void {
-  // The ledger has a second reader: `homeBornAt` (conversation/backfill.ts,
-  // CR121) takes MIN(applied_at) as the instant this home was born, and
-  // session maintenance imports only the Pi sessions newer than it. Never
-  // rewrite history here -- no re-stamping, no squash that deletes rows and
-  // re-inserts them with a later date. Retiring a migration id moves the
-  // minimum forward at worst, which imports less; re-stamping could move it
-  // and would be a lie about the home's age.
+  // The ledger records which migrations ran, and when -- nothing more. Do not
+  // infer a home's birth from its first `applied_at`: a database copied to
+  // make a second home carries its source's ledger, so two homes would share
+  // one birth (CR153 retired the reader that did, CR156 records the copy).
   db.exec(`
     CREATE TABLE IF NOT EXISTS _migrations (
         id TEXT PRIMARY KEY,

package/ts/src/guards/retiredSurfaces.ts

@@ -280,9 +280,9 @@ export const RETIRED: readonly RetiredSurface[] = [
     absentPaths: [],
     forbiddenPatterns: [
       // The flags and the two service methods. NOT the bare word `backfill`:
-      // `conversation-logger backfill-pi-sessions` and
-      // `ts/src/conversation/backfill.ts` are the TRANSCRIPT backfills, a
-      // different feature that is ported and staying.
+      // the transcript backfill (`ts/src/conversation/transcriptBackfill.ts`)
+      // is a different feature, ported and staying. (The Pi session backfill
+      // that stood beside it is retired by its own row, `pi-session-backfill`.)
       "--metadata-backfill-",
       "metadata_backfill",
       "preview_metadata_backfill",
@@ -492,8 +492,6 @@ export const RETIRED: readonly RetiredSurface[] = [
     exemptions: {
       "docs/getting-started.md":
         "the un-wiring guidance: a user who started codex through the retired wrapper needs its name to undo that wiring",
-      "ts/src/conversation/backfill.ts":
-        "the header names the retired importer to say where it went, beside the Pi importer that stays",
     },
   },
   {
@@ -545,6 +543,45 @@ export const RETIRED: readonly RetiredSurface[] = [
     ],
     exemptions: {},
   },
+  {
+    surfaceId: "pi-session-backfill",
+    story: "CR153",
+    // Session maintenance's Pi backfill: a walk of Pi's session directory that
+    // imported every file this home's `runtime_sessions` did not track. That
+    // held while a machine had one home. With two, each imported the other's
+    // sessions -- 543 conversations on the maintainer's machine, both ways,
+    // each titled again through the provider -- and both imported the sessions
+    // of scratch homes and of Pi run without Mirror, while the gap it existed
+    // to fill, a session the home's own extension never logged, came up once
+    // in three months. A home's Pi conversations are the ones the Pi extension
+    // logged into it, and nothing reads a Pi session file. `importClosedConversation`
+    // went with it: the Codex importer that also wrote through it retired with
+    // DS4.TS5. `PI_SESSIONS_DIR` is inert, and only the records that say so,
+    // and the test that proves it, may name it.
+    absentPaths: [
+      "ts/src/conversation/backfill.ts",
+      "ts/src/conversation/sessionImport.ts",
+      "ts/test/conversation/backfill.test.ts",
+      "ts/test/db/homeBornAt.test.ts",
+      "ts/test/fixtures/backfill/pi-sessions/",
+    ],
+    forbiddenPatterns: [
+      "backfillPiSessions",
+      "resolvePiSessionsDir",
+      "homeBornAt",
+      "importClosedConversation",
+      "PI_SESSIONS_DIR",
+      "Backfilled Pi sessions",
+    ],
+    exemptions: {
+      "docs/reference/configuration.md":
+        "the inert-values record: a `.env` may still carry PI_SESSIONS_DIR, and the reference says nothing reads it",
+      ".env.example.advanced":
+        "marks PI_SESSIONS_DIR inert, so a leftover line is recognized rather than trusted",
+      "ts/test/conversation/loggerCli.test.ts":
+        "sets PI_SESSIONS_DIR to a directory holding a fresh session and proves maintenance imports nothing from it",
+    },
+  },
 ];
 
 export interface SurfaceProblem {

package/ts/src/conversation/backfill.ts

@@ -1,271 +0,0 @@
-// Session backfills from runtime-written JSONL (CV22.DS7.US10 slice E).
-//
-// Ports `backfill_pi_sessions` from `src/memory/cli/conversation_logger.py`:
-// it imports closed sessions the live hooks never saw, through the atomic
-// seam in `sessionImport.ts`, and is graded against
-// `ts/test/goldens/backfill.golden.json`. (The Codex importer,
-// `backfill_codex_session`, was ported beside it and retired with the
-// v0.32.1 Codex wrapper by CV21.DS4.TS5: its only caller was the wrapper's
-// session-end hook, and the plugin logs Codex turns live.)
-//
-// Pi titles through `set_provisional_title` (whitespace collapse plus
-// `title_source`/`title_status` provenance in metadata), tolerates a corrupt
-// or structurally invalid file by skipping THAT file and continuing the
-// walk, and parses every timestamp form (millisecond epoch, string, absent).
-//
-// Nothing here touches a provider or the clock directly: `now` is injected
-// through `LoggerDeps`, which is what makes "no timestamp -> now" pinnable.
-//
-// CR121 (2026-10-11): a home imports only the Pi sessions newer than itself.
-// Python imported every untracked session on the machine, which for a new
-// home meant the person's whole Pi history, copied and spent on before the
-// first prompt. The floor is explicit (`notBefore`), never defaulted, and
-// the rule fails closed: there is no value that means "everything" except
-// the epoch, which says so.
-
-import { existsSync, readdirSync, readFileSync, statSync } from "node:fs";
-import { join, relative, sep } from "node:path";
-import { type LoggerDeps, setProvisionalTitle } from "#conversation/logger.ts";
-import { type ImportedMessage, importClosedConversation } from "#conversation/sessionImport.ts";
-import type { WritableDatabase } from "#db/database.ts";
-import { expandHome } from "#util/paths.ts";
-import { comparePathComponents, sliceCodePoints } from "#util/pythonText.ts";
-
-/** Python `_DEFAULT_PI_SESSIONS_DIR`: `~/.pi/agent/sessions`. */
-export function defaultPiSessionsDir(homeDir: string): string {
-  return join(homeDir, ".pi", "agent", "sessions");
-}
-
-/**
- * Python's source-directory resolution for the Pi backfill, in order:
- * explicit argument -> `PI_SESSIONS_DIR` -> `~/.pi/agent/sessions`.
- * (Python's module-level `_PI_SESSIONS_DIR` override exists only for its own
- * test monkey-patching and has no runtime input; it is not a contract.)
- */
-export function resolvePiSessionsDir(
-  explicit: string | null | undefined,
-  env: { PI_SESSIONS_DIR?: string },
-  homeDir: string,
-): string {
-  if (explicit) return expandHome(explicit);
-  if (env.PI_SESSIONS_DIR) return expandHome(env.PI_SESSIONS_DIR);
-  return defaultPiSessionsDir(homeDir);
-}
-
-function isRecord(value: unknown): value is Record<string, unknown> {
-  return typeof value === "object" && value !== null && !Array.isArray(value);
-}
-
-/**
- * Python `dict.get(key, default)` on a value that MUST be a dict: anything
- * else raises AttributeError, which each parser turns into its own failure
- * mode. The default applies only when the key is ABSENT -- a present `null`
- * is returned as null, exactly as Python returns None, so a later `.get` on
- * it raises rather than silently reading from the default.
- */
-function getOr(container: unknown, key: string, fallback: unknown): unknown {
-  if (!isRecord(container)) throw new TypeError(`expected an object with '${key}'`);
-  return key in container ? container[key] : fallback;
-}
-
-function getFrom(container: unknown, key: string): unknown {
-  return getOr(container, key, undefined);
-}
-
-/** Python `_parse_pi_content`: a string as-is, text blocks joined by `\n`, else `""`. */
-export function parsePiContent(content: unknown): string {
-  if (typeof content === "string") return content;
-  if (Array.isArray(content)) {
-    const parts: string[] = [];
-    for (const block of content) {
-      if (!isRecord(block) || block.type !== "text") continue;
-      const text = block.text ?? "";
-      // `"\n".join(...)` raises on a non-str item; the file is skipped.
-      if (typeof text !== "string") throw new TypeError("text block is not a string");
-      parts.push(text);
-    }
-    return parts.join("\n");
-  }
-  return "";
-}
-
-/**
- * Python `datetime.fromtimestamp(ms / 1000, tz=utc).isoformat()`:
- * `+00:00` suffix (not `Z`), microseconds only when non-zero, rounded from
- * the fractional second the way CPython does (`round(frac * 1e6)`).
- */
-function pythonUtcIsoFromEpochMs(epochMs: number): string {
-  const seconds = epochMs / 1000;
-  let whole = Math.floor(seconds);
-  let micros = Math.round((seconds - whole) * 1e6);
-  if (micros >= 1_000_000) {
-    whole += 1;
-    micros -= 1_000_000;
-  }
-  const base = new Date(whole * 1000).toISOString().slice(0, 19);
-  const fraction = micros === 0 ? "" : `.${String(micros).padStart(6, "0")}`;
-  return `${base}${fraction}+00:00`;
-}
-
-/**
- * Python `_parse_pi_timestamp`: a number above 1e10 is a millisecond epoch;
- * a string is stored verbatim; anything else (absent, null, a seconds epoch,
- * a boolean -- which is an int in Python but never exceeds 1e10) is `now`.
- */
-export function parsePiTimestamp(value: unknown, now: () => string): string {
-  if (typeof value === "number" && value > 1e10) return pythonUtcIsoFromEpochMs(value);
-  if (typeof value === "string") return value;
-  return now();
-}
-
-/**
- * Parse one Pi session file into importable messages. Throws on any line
- * that is not valid JSON or not the expected shape -- Python wraps the whole
- * file loop in one `try` and skips the file on the first failure, even after
- * earlier lines parsed cleanly.
- */
-function parsePiSessionFile(path: string, now: () => string): ImportedMessage[] {
-  const messages: ImportedMessage[] = [];
-  for (const line of readFileSync(path, "utf8").split(/\r?\n|\r/)) {
-    if (!line.trim()) continue;
-    const entry: unknown = JSON.parse(line);
-    if (getFrom(entry, "type") !== "message") continue;
-    const message = getOr(entry, "message", {});
-    const role = getOr(message, "role", "");
-    if (role !== "user" && role !== "assistant") continue;
-    const content = parsePiContent(getOr(message, "content", ""));
-    if (!content.trim()) continue;
-    const createdAt = parsePiTimestamp(getFrom(message, "timestamp"), now);
-    messages.push({ role, content, createdAt });
-  }
-  return messages;
-}
-
-/**
- * Python `sorted(pi_sessions_dir.rglob("*.jsonl"))`: every `.jsonl` file
- * under the directory, ordered by path components (see
- * `comparePathComponents` for why that is not a string sort).
- */
-function listPiSessionFiles(sessionsDir: string): string[] {
-  const entries = readdirSync(sessionsDir, { recursive: true, withFileTypes: true });
-  const found: string[][] = [];
-  for (const entry of entries) {
-    if (!entry.name.endsWith(".jsonl")) continue;
-    const parents = relative(sessionsDir, entry.parentPath).split(sep).filter(Boolean);
-    found.push([...parents, entry.name]);
-  }
-  found.sort(comparePathComponents);
-  return found.map((components) => join(sessionsDir, ...components));
-}
-
-export interface PiBackfillOptions {
-  /** Already resolved through `resolvePiSessionsDir`. */
-  sessionsDir: string;
-  /**
-   * An ISO instant: a session that ended at or before it is not imported
-   * (CR121). Production passes the home's birth (`homeBornAt`); a caller
-   * that wants no floor passes the epoch and says so.
-   */
-  notBefore: string;
-}
-
-/**
- * When this home was born: the first `applied_at` in the `_migrations`
- * ledger. A fresh database stamps its whole ledger at its first open, and a
- * database from any earlier era carries the ledger from its own first open,
- * so the minimum is the birth of every home there is -- with no new table,
- * column, or marker. Read once per maintenance run.
- *
- * The ledger means "which migrations ran, when"; reading its minimum as a
- * birth is an inference, accepted because every plausible edit to the ledger
- * moves the minimum forward and imports less, never more. `migrations.ts`
- * names this consumer at the ledger's definition. A second consumer of
- * "birth" is the trigger to model it as a row of its own.
- *
- * Fails closed: an empty ledger is an error, not a home born at the epoch.
- */
-export function homeBornAt(db: WritableDatabase): string {
-  const row = db.prepare("SELECT MIN(applied_at) AS born FROM _migrations").get() as
-    | { born: string | null }
-    | undefined;
-  if (typeof row?.born !== "string" || !row.born) {
-    throw new Error("the _migrations ledger is empty: this home's birth is unknown");
-  }
-  return row.born;
-}
-
-/** The instant of an ISO timestamp, or NaN for anything `Date.parse` rejects. */
-function instant(iso: string): number {
-  return Date.parse(iso);
-}
-
-/**
- * Python `backfill_pi_sessions`: import every untracked Pi session with at
- * least two messages as a closed `pi` conversation, titled provisionally from
- * the first user line. Returns the number imported.
- *
- * The session id is the session file's path, exactly as Python's
- * `str(session_file)` -- which is also what the live Pi extension binds, so a
- * session the hooks already track is skipped before its file is even read.
- *
- * CR121: a session is Mirror's only if it ended after `notBefore`. Two
- * checks, in cost order. A file whose mtime is at or before the floor is
- * skipped unread: its last message was written at or before its last write,
- * so it cannot be newer. (This is what keeps a skipped session, which is
- * never tracked, from being parsed again at every start for the rest of the
- * home's life.) A file written after the floor is parsed and judged by its
- * last message, the same instant it stores as `endedAt` -- a copy or a sync
- * can touch a file long after its conversation ended. A session whose
- * messages carry no parseable instant dates to `now` under the existing rule
- * and is imported: undated is newer, not older.
- */
-export function backfillPiSessions(
-  db: WritableDatabase,
-  options: PiBackfillOptions,
-  deps: LoggerDeps,
-): number {
-  const floor = instant(options.notBefore);
-  if (Number.isNaN(floor)) {
-    throw new Error(`notBefore is not an instant: ${JSON.stringify(options.notBefore)}`);
-  }
-  if (!existsSync(options.sessionsDir)) return 0;
-
-  let count = 0;
-  for (const sessionFile of listPiSessionFiles(options.sessionsDir)) {
-    const sessionId = sessionFile;
-    if (db.prepare("SELECT 1 FROM runtime_sessions WHERE session_id = ?").get(sessionId)) {
-      continue;
-    }
-    if (statSync(sessionFile).mtimeMs <= floor) continue;
-    let messages: ImportedMessage[];
-    try {
-      messages = parsePiSessionFile(sessionFile, deps.nowIso);
-    } catch {
-      continue;
-    }
-    if (messages.length < 2) continue;
-    const endedAt = instant((messages.at(-1) as ImportedMessage).createdAt);
-    if (endedAt <= floor) continue;
-
-    const conversationId = importClosedConversation(
-      db,
-      sessionId,
-      { interface: "pi", messages, endedAt: (messages.at(-1) as ImportedMessage).createdAt },
-      deps,
-    );
-    if (conversationId === null) {
-      // A concurrent writer (a live hook) bound this session while the import
-      // waited for the write lock -- their binding wins.
-      continue;
-    }
-    const firstUser = messages.find((message) => message.role === "user");
-    if (firstUser) {
-      // Python: `content.strip().split("\n")[0][:60]` -- cut BEFORE the
-      // provisional-title whitespace collapse, by code point.
-      const title = sliceCodePoints(firstUser.content.trim().split("\n")[0] ?? "", 60);
-      setProvisionalTitle(db, conversationId, title);
-    }
-    count += 1;
-  }
-  return count;
-}

package/ts/src/conversation/sessionImport.ts

@@ -1,90 +0,0 @@
-// Atomic closed-session import (CV22.DS7.US10 slice E).
-//
-// Ports `RuntimeSessionService.import_closed_conversation` from
-// `src/memory/services/runtime_session.py`, the seam both backfills write
-// through. It is the sibling of `getOrCreateSessionConversation` in
-// `logger.ts` and shares its transaction discipline for the same reason:
-// a backfill imports against the SAME `runtime_sessions` key a live hook
-// binds (Pi's live session id is the session file path), and the two can
-// interleave.
-//
-// Resolved decision 4B (plan.md): the binding check runs INSIDE the
-// `BEGIN IMMEDIATE` transaction, so a binding a concurrent hook committed
-// while this import waited for the write lock is seen and honored -- the
-// import returns null instead of clobbering a live session with
-// `active=0`/`closed_at`. The same atomicity removes the crash-window
-// duplicate-import path: either the conversation, every message, and the
-// binding all land, or nothing does.
-//
-// Titles are deliberately NOT set here. The two callers title differently
-// (Pi through `setProvisionalTitle`, Codex through a bare column write) and
-// Python applies both after commit; reproducing that asymmetry is the
-// callers' job.
-
-import type { LoggerDeps } from "#conversation/logger.ts";
-import { type WritableDatabase, withTransaction } from "#db/database.ts";
-
-export interface ImportedMessage {
-  role: string;
-  content: string;
-  createdAt: string;
-}
-
-export interface ClosedSessionImport {
-  interface: string;
-  messages: readonly ImportedMessage[];
-  endedAt: string;
-}
-
-/**
- * Import a closed session transcript as one conversation bound to
- * `sessionId`. Returns the new conversation id, or null when the session is
- * already tracked -- including by a writer that won the binding while this
- * call waited for the lock.
- */
-export function importClosedConversation(
-  db: WritableDatabase,
-  sessionId: string,
-  session: ClosedSessionImport,
-  deps: LoggerDeps,
-): string | null {
-  return withTransaction(db, () => {
-    const tracked = db
-      .prepare("SELECT 1 FROM runtime_sessions WHERE session_id = ?")
-      .get(sessionId);
-    if (tracked) return null;
-
-    // Python's Conversation(...) draws its id before its started_at; keep the
-    // same generator order so injected sequences line up with the oracle.
-    const conversationId = deps.newId();
-    const startedAt = deps.nowIso();
-    db.prepare(
-      `INSERT INTO conversations
-         (id, title, started_at, ended_at, interface, persona, journey, summary, tags, metadata)
-       VALUES (?, NULL, ?, ?, ?, NULL, NULL, NULL, NULL, NULL)`,
-    ).run(conversationId, startedAt, session.endedAt, session.interface);
-
-    const insertMessage = db.prepare(
-      `INSERT INTO messages (id, conversation_id, role, content, created_at, token_count, metadata)
-       VALUES (?, ?, ?, ?, ?, NULL, NULL)`,
-    );
-    for (const message of session.messages) {
-      insertMessage.run(
-        deps.newId(),
-        conversationId,
-        message.role,
-        message.content,
-        message.createdAt,
-      );
-    }
-
-    db.prepare(
-      `INSERT INTO runtime_sessions
-         (session_id, conversation_id, interface, mirror_active, persona, journey,
-          hook_injected, active, started_at, updated_at, closed_at, metadata)
-       VALUES (?, ?, ?, 0, NULL, NULL, 0, 0, ?, ?, ?, NULL)`,
-    ).run(sessionId, conversationId, session.interface, startedAt, startedAt, session.endedAt);
-
-    return conversationId;
-  });
-}