mirror-mind 0.36.0 → 0.36.2

package/ts/src/conversation/logger.ts

@@ -13,6 +13,7 @@
 import { closeSync, existsSync, mkdirSync, openSync, rmSync } from "node:fs";
 import { join } from "node:path";
 import { isCommandTurn } from "#conversation/commandTurn.ts";
+import { deleteConversation } from "#conversation/conversationDeletion.ts";
 import { markCloseTailPending } from "#conversation/deferredCloseTail.ts";
 import {
   lastAssistantMessageOf,
@@ -453,25 +454,10 @@ export async function endSession(
 }
 
 /**
- * Python `ConversationService.delete_conversations` for one resolved id:
- * extracted memories survive with a nulled FK rather than cascading away.
+ * Python `discard_current_conversation`: delete and mark the session discarded.
+ * The deletion is `conversationDeletion.ts`'s, shared with CR154's removal of
+ * imported Pi conversations.
  */
-function deleteConversation(db: WritableDatabase, conversationId: string): void {
-  db.prepare("DELETE FROM messages WHERE conversation_id = ?").run(conversationId);
-  db.prepare("DELETE FROM conversation_embeddings WHERE conversation_id = ?").run(conversationId);
-  db.prepare("UPDATE memories SET conversation_id = NULL WHERE conversation_id = ?").run(
-    conversationId,
-  );
-  db.prepare("UPDATE llm_calls SET conversation_id = NULL WHERE conversation_id = ?").run(
-    conversationId,
-  );
-  db.prepare("UPDATE runtime_sessions SET conversation_id = NULL WHERE conversation_id = ?").run(
-    conversationId,
-  );
-  db.prepare("DELETE FROM conversations WHERE id = ?").run(conversationId);
-}
-
-/** Python `discard_current_conversation`: delete and mark the session discarded. */
 export function discardCurrentConversation(
   db: WritableDatabase,
   sessionId: string | null,

package/ts/src/conversation/loggerRuntime.ts

@@ -2,10 +2,10 @@
 //
 // Everything the `conversation-logger` subcommands need beyond the database
 // is assembled here, once per invocation, from an EXPLICIT environment: the
-// clock and id generator, the transcript/session resolution inputs, the Pi
-// sessions directory, the pre-write backup, and -- only for the subcommands
-// that cross the LLM close tail -- the replay providers and the maintenance
-// dependencies built on them.
+// clock and id generator, the transcript/session resolution inputs, the
+// pre-write backup, and -- only for the subcommands that cross the LLM close
+// tail -- the replay providers and the maintenance dependencies built on them.
+// (No Pi sessions directory: maintenance reads no Pi session file, CR153.)
 //
 // The providers are loaded lazily. `diagnose-journeys`
 // or `session-start --fast` must never fail because a replay fixture is not
@@ -17,7 +17,6 @@
 // Nothing here reads `process.env` or `os.homedir()`; the front door passes
 // them in, which is what keeps every test of this module hermetic.
 
-import { backfillPiSessions, homeBornAt, resolvePiSessionsDir } from "#conversation/backfill.ts";
 import { createCloseHooks, maybeGenerateTitle } from "#conversation/closeTail.ts";
 import { runConversationExtraction } from "#conversation/extraction.ts";
 import { runExtractionWithAccounting } from "#conversation/extractionRun.ts";
@@ -47,7 +46,6 @@ import {
 export type LoggerRuntimeEnv = {
   MIRROR_SESSION_ID?: string;
   CLAUDE_PROJECT_DIR?: string;
-  PI_SESSIONS_DIR?: string;
   MIRROR_TS_CONVERSATION_LLM_REPLAY?: string;
   MIRROR_TS_CONVERSATION_EMBEDDING_REPLAY?: string;
   /** Read by the live providers when the close tail runs against a real model. */
@@ -100,12 +98,11 @@ export interface LoggerRuntime {
   readonly homeDir: string;
   readonly claudeProjectDir: string | null;
   readonly environmentSessionId: string | null;
-  readonly piSessionsDir: string;
   /** Which transport answers the close tail here: replay, incomplete replay, or live. */
   readonly transportMode: ProviderTransportMode;
   /** The close hooks (extraction + finalization) behind the replay transport. */
   closeHooks(): Promise<CloseHooks>;
-  /** The full maintenance wiring, including the real Pi backfill. */
+  /** The full maintenance wiring. */
   maintenanceDeps(): Promise<MaintenanceDeps>;
   /** The dated zip backup for the mutating journey repair; see `LoggerRuntimeOptions.backup`. */
   readonly backup: ((stdout: (line: string) => void) => string | null) | null;
@@ -135,7 +132,6 @@ function liveTailOverrides(
 
 export function createLoggerRuntime(options: LoggerRuntimeOptions): LoggerRuntime {
   const { db, env, deps } = options;
-  const piSessionsDir = resolvePiSessionsDir(null, env, options.homeDir);
 
   // One precedence, shared with the router so the two cannot disagree about
   // which transport is live: replay -> incomplete -> live. The pair rule that
@@ -225,7 +221,6 @@ export function createLoggerRuntime(options: LoggerRuntimeOptions): LoggerRuntim
     homeDir: options.homeDir,
     claudeProjectDir: env.CLAUDE_PROJECT_DIR || null,
     environmentSessionId: env.MIRROR_SESSION_ID?.trim() || null,
-    piSessionsDir,
     transportMode: transport.mode,
     backup: options.backup ?? null,
     closeHooks,
@@ -246,14 +241,6 @@ export function createLoggerRuntime(options: LoggerRuntimeOptions): LoggerRuntim
         // CV21.DS4.TS2: the finalization a bounded runtime's SessionEnd deferred.
         finalizeCloseTail: (database, conversationId) =>
           hooks.finalizeMetadata(database, conversationId),
-        // CR121: only the sessions newer than this home; its birth is read from
-        // the ledger once per maintenance run, and an unknown birth is an error.
-        backfillPiSessions: (database) =>
-          backfillPiSessions(
-            database,
-            { sessionsDir: piSessionsDir, notBefore: homeBornAt(database) },
-            deps,
-          ),
         extractionLimit: resolveMaintenanceMaxExtractions({ env }),
         staleOrphanMinutes: resolveStaleOrphanMinutes({ env }),
         monotonic: options.monotonic,

package/ts/src/conversation/sessionComposites.ts

@@ -48,12 +48,6 @@ export interface MaintenanceDeps {
    * only for callers written before the step existed; the front door wires it.
    */
   finalizeCloseTail?: (db: WritableDatabase, conversationId: string) => Promise<void> | void;
-  /**
-   * `backfillPiSessions` (slice E) bound to its resolved sessions directory.
-   * Injected rather than resolved here so the composite never reads the
-   * environment itself; the front door owns that resolution.
-   */
-  backfillPiSessions: (db: WritableDatabase) => Promise<number> | number;
   /** Python's `MEMORY_MAINTENANCE_MAX_EXTRACTIONS` (AI-05); defaults to the released budget. */
   extractionLimit?: number;
   /** `MIRROR_STALE_ORPHAN_MINUTES` (CV21.DS4.US4); defaults to the 30-minute threshold. */
@@ -231,6 +225,11 @@ function formatElapsed(elapsed: number): string {
  * warning tails. The step order is behavior, not presentation — closing stale
  * orphans first is what makes their conversations eligible for the extraction
  * step in the same run.
+ *
+ * CR153: there is no Pi backfill step. Python's walked Pi's session directory
+ * and imported every file this home did not track, which on a machine with two
+ * homes meant each other's sessions; a home's Pi conversations are the ones the
+ * Pi extension logged into it, and maintenance reads no Pi session file.
  */
 export async function sessionMaintenance(
   db: WritableDatabase,
@@ -246,7 +245,6 @@ export async function sessionMaintenance(
         thresholdMinutes: deps.staleOrphanMinutes ?? STALE_ORPHAN_THRESHOLD_MINUTES,
       }),
     ),
-    await timedStep("Backfilled Pi sessions", monotonic, () => deps.backfillPiSessions(db)),
     await timedStep("Retitled pending conversations", monotonic, () =>
       retitlePendingConversations(db, { retitleConversation: deps.retitleConversation }),
     ),

package/ts/src/conversation/transcriptBackfill.ts

@@ -23,7 +23,11 @@ function isRecord(value: unknown): value is Record<string, unknown> {
   return typeof value === "object" && value !== null && !Array.isArray(value);
 }
 
-/** Python `dict.get` on something that must be a dict; see `backfill.ts`. */
+/**
+ * Python `dict.get(key, default)` on a value that MUST be a dict: anything else
+ * raises, as Python's AttributeError does. The default applies only when the
+ * key is ABSENT -- a present `null` comes back as null, as Python returns None.
+ */
 function getOr(container: unknown, key: string, fallback: unknown): unknown {
   if (!isRecord(container)) throw new TypeError(`expected an object with '${key}'`);
   return key in container ? container[key] : fallback;

package/ts/src/db/migrations.ts

@@ -548,13 +548,10 @@ export const MIGRATIONS: readonly (readonly [string, MigrationApply])[] = [
  * contract.
  */
 export function runMigrations(db: WritableDatabase): void {
-  // The ledger has a second reader: `homeBornAt` (conversation/backfill.ts,
-  // CR121) takes MIN(applied_at) as the instant this home was born, and
-  // session maintenance imports only the Pi sessions newer than it. Never
-  // rewrite history here -- no re-stamping, no squash that deletes rows and
-  // re-inserts them with a later date. Retiring a migration id moves the
-  // minimum forward at worst, which imports less; re-stamping could move it
-  // and would be a lie about the home's age.
+  // The ledger records which migrations ran, and when -- nothing more. Do not
+  // infer a home's birth from its first `applied_at`: a database copied to
+  // make a second home carries its source's ledger, so two homes would share
+  // one birth (CR153 retired the reader that did, CR156 records the copy).
   db.exec(`
     CREATE TABLE IF NOT EXISTS _migrations (
         id TEXT PRIMARY KEY,

package/ts/src/frontDoor/cli.ts

@@ -22,6 +22,7 @@
 import { accessSync, constants, existsSync, readFileSync } from "node:fs";
 import { basename, dirname } from "node:path";
 import { pathToFileURL } from "node:url";
+import { createZipBackup } from "#backup/zipBackup.ts";
 import {
   AppendRejectedError,
   type AppendRejectionReason,
@@ -68,6 +69,7 @@ import {
   JOURNAL_TRANSPORT,
   WEEK_PLAN_TRANSPORT,
 } from "#providers/transport.ts";
+import { verifyBackupArchive } from "#runtime/backup.ts";
 import { exitQuietlyOnBrokenPipe } from "#runtime/brokenPipe.ts";
 import {
   configFilePath,
@@ -107,6 +109,10 @@ import { runBackupRoute, runRepairEncodingRoute } from "./dbSafetyToolsRoute.ts"
 import { defaultExploreRouteDeps, runExploreRoute } from "./exploreRoute.ts";
 import { frontDoorLogPath, logFrontDoor } from "./frontDoorLog.ts";
 import { applyIdentitySet } from "./identityWrite.ts";
+import {
+  isImportedConversationsCommand,
+  runImportedConversationsRoute,
+} from "./importedConversationsRoute.ts";
 import { applyJourneySetPath } from "./journeyWriteRoute.ts";
 import { openLiveWriteDatabase } from "./liveBackup.ts";
 import {
@@ -1759,6 +1765,22 @@ async function dispatchTs(argv: readonly string[]): Promise<number | DispatchOut
   if (argv[0] === "soul") return runSoulWrite(argv);
   if (argv[0] === "explore") return runExploreWrite(argv);
   if (isConversationsAppend(argv)) return runConversationsAppend(argv);
+  // CR154: allowlisted by name, like `append`, so the listing never answers it.
+  // The listing and the dry run read; `--apply` writes behind the pre-write
+  // backup, after its own dated, verified archive.
+  if (isImportedConversationsCommand(argv)) {
+    return runImportedConversationsRoute(argv, {
+      withReadOnlyDatabase: (read) => withMirrorReadDb(argv, read),
+      withLiveWriteDatabase: (write) => {
+        const dbPath = resolveDbPathForCli(argv.slice(1));
+        if (dbPath === null) return 2;
+        return withLiveWriteDbAt(dbPath, "conversations", (db) => write(db, dbPath));
+      },
+      backup: (dbPath) =>
+        createZipBackup({ dbPath, mirrorHome: dirname(dbPath), backupDir: null, silent: true }),
+      verifyBackup: (archive) => verifyBackupArchive(archive),
+    });
+  }
   // CV22.DS7.TS1: the DB safety tools. `backup` never opens or bootstraps the
   // database; `repair-encoding --apply` rides the live-write seam.
   if (argv[0] === "backup") {

package/ts/src/frontDoor/dbSafetyToolsRoute.ts

@@ -27,6 +27,7 @@ import {
   scanDatabase,
 } from "#repair/encodingRepair.ts";
 import { expandHome } from "#util/paths.ts";
+import { parseArgs } from "#util/strictArgs.ts";
 import { MirrorHomeNotConfiguredError } from "./dbPath.ts";
 
 const BACKUP_USAGE =
@@ -34,41 +35,6 @@ const BACKUP_USAGE =
 const REPAIR_USAGE =
   "usage: repair-encoding [-h] [--mirror-home MIRROR_HOME] [--apply] [--no-backup] [--limit LIMIT]";
 
-interface ParsedArgs {
-  flags: Set<string>;
-  values: Map<string, string>;
-  error: string | null;
-}
-
-/** argparse-shaped parsing: known flags, known valued options, nothing else. */
-function parseArgs(
-  args: readonly string[],
-  spec: { flags: readonly string[]; valued: readonly string[] },
-): ParsedArgs {
-  const flags = new Set<string>();
-  const values = new Map<string, string>();
-  const unrecognized: string[] = [];
-  for (let index = 0; index < args.length; index += 1) {
-    const arg = args[index] as string;
-    if (spec.flags.includes(arg)) {
-      flags.add(arg);
-    } else if (spec.valued.includes(arg)) {
-      const value = args[index + 1];
-      if (value === undefined)
-        return { flags, values, error: `argument ${arg}: expected one argument` };
-      values.set(arg, value);
-      index += 1;
-    } else {
-      unrecognized.push(arg);
-    }
-  }
-  return {
-    flags,
-    values,
-    error: unrecognized.length > 0 ? `unrecognized arguments: ${unrecognized.join(" ")}` : null,
-  };
-}
-
 function usageError(usage: string, program: string, message: string): number {
   process.stderr.write(`${usage}\n${program}: error: ${message}\n`);
   return 2;

package/ts/src/frontDoor/importedConversationsRoute.ts

@@ -0,0 +1,337 @@
+// `mirror conversations imported` (CR154): see the Pi conversations an earlier
+// version imported rather than logged, and remove the ones a person names.
+//
+//   conversations imported [--project TEXT]
+//   conversations imported remove (ID... | --all [--project FOLDER]) [--apply]
+//
+// Folders first: a home holds hundreds of imports, and the decision a person
+// makes is about where they came from. Removal is a dry run until `--apply`,
+// which decides the set first (refusals and an empty set stop there, with no
+// backup), takes the dated backup and verifies it, and only then removes, in
+// one transaction that decides the set again and refuses if it moved. Every
+// option is declared: a typo is refused before anything opens, because under a
+// lenient parser a misspelled `--project` would widen a removal to every import
+// in the home.
+//
+// The module that decides what an import is, and removes it, is
+// `#conversation/importedConversations.ts`; this file parses, opens, and
+// prints. Nothing here is offered to a model: no MCP tool, no skill.
+
+import { existsSync, readdirSync } from "node:fs";
+import { dirname, join } from "node:path";
+import { parseArchiveStamp, RETENTION_DAYS } from "#backup/zipBackup.ts";
+import {
+  countLiveSessionsByFolder,
+  type ImportedConversation,
+  ImportRemovalRefusedError,
+  type ImportRemovalRequest,
+  ImportRemovalSetMovedError,
+  listImportedPiConversations,
+  planImportRemoval,
+  removeImportedConversations,
+  summarizeImports,
+} from "#conversation/importedConversations.ts";
+import type { Database, WritableDatabase } from "#db/database.ts";
+import { PROGRAM } from "#util/program.ts";
+import { shellWord } from "#util/shellWord.ts";
+import { parseArgs } from "#util/strictArgs.ts";
+import { backupPathFor } from "./liveBackup.ts";
+
+const USAGE = [
+  `usage: ${PROGRAM} conversations imported [--project TEXT] [--mirror-home PATH] [--db-path PATH]`,
+  `       ${PROGRAM} conversations imported remove (ID ... | --all [--project FOLDER]) [--apply] [--mirror-home PATH] [--db-path PATH]`,
+].join("\n");
+
+/** How argparse names the program in an error line. */
+const PROG = `${PROGRAM} conversations imported`;
+
+const WHAT_AN_IMPORT_IS =
+  "Mirror copied these from Pi's session files instead of logging them as they happened. " +
+  "Since v0.36.1 it imports none.";
+
+const HOME_OPTIONS = ["--mirror-home", "--db-path"] as const;
+
+export interface ImportedConversationsIo {
+  /** The home's database, read-only: the listing and the dry run. */
+  withReadOnlyDatabase: (read: (db: Database) => number) => number;
+  /** The home's database behind the front door's pre-write backup: `--apply` only. */
+  withLiveWriteDatabase: (write: (db: WritableDatabase, dbPath: string) => number) => number;
+  /** The dated archive `repair-journeys --apply` gates on; its path, or null on failure. */
+  backup: (dbPath: string) => string | null;
+  verifyBackup: (archivePath: string) => { valid: boolean; note: string | null };
+  stdout?: (line: string) => void;
+  stderr?: (line: string) => void;
+}
+
+export function isImportedConversationsCommand(argv: readonly string[]): boolean {
+  return argv[0] === "conversations" && argv[1] === "imported";
+}
+
+function plural(count: number, word: string): string {
+  return `${count} ${word}${count === 1 ? "" : "s"}`;
+}
+
+function day(instant: string): string {
+  return instant.slice(0, 10);
+}
+
+function localDay(date: Date): string {
+  const pad = (value: number) => String(value).padStart(2, "0");
+  return `${date.getFullYear()}-${pad(date.getMonth() + 1)}-${pad(date.getDate())}`;
+}
+
+function byFolder(conversations: readonly ImportedConversation[]): [string, number][] {
+  const counts = new Map<string, number>();
+  for (const item of conversations) counts.set(item.folder, (counts.get(item.folder) ?? 0) + 1);
+  return [...counts.entries()].sort((a, b) => b[1] - a[1] || a[0].localeCompare(b[0]));
+}
+
+function messagesIn(conversations: readonly ImportedConversation[]): number {
+  return conversations.reduce((sum, item) => sum + item.messageCount, 0);
+}
+
+export function runImportedConversationsRoute(
+  argv: readonly string[],
+  io: ImportedConversationsIo,
+): number {
+  const out = io.stdout ?? ((line: string) => process.stdout.write(`${line}\n`));
+  const err = io.stderr ?? ((line: string) => process.stderr.write(`${line}\n`));
+  const usageError = (message: string): number => {
+    err(USAGE);
+    err(`${PROG}: error: ${message}`);
+    return 2;
+  };
+
+  const rest = argv.slice(2);
+  if (rest.includes("-h") || rest.includes("--help")) {
+    out(USAGE);
+    return 0;
+  }
+  const removing = rest[0] === "remove";
+  const parsed = parseArgs(removing ? rest.slice(1) : rest, {
+    flags: removing ? ["--all", "--apply"] : [],
+    valued: ["--project", ...HOME_OPTIONS],
+    positionals: removing,
+  });
+  if (parsed.error) return usageError(parsed.error);
+  const project = parsed.values.get("--project") ?? null;
+
+  if (!removing) return list(io, out, project);
+
+  const ids = parsed.positionals;
+  const all = parsed.flags.has("--all");
+  if (ids.length > 0 && all) return usageError("give conversation ids or --all, not both");
+  if (ids.length === 0 && !all) return usageError("give conversation ids, or --all");
+  if (project !== null && !all) {
+    return usageError("--project narrows --all; give it with --all, not with ids");
+  }
+  const request: ImportRemovalRequest = all ? { all: true, folder: project } : { ids };
+
+  if (!parsed.flags.has("--apply")) {
+    // The command that applies this dry run, to the same home, every value quoted.
+    const words = ["conversations", "imported", "remove"];
+    if (all) {
+      words.push("--all");
+      if (project !== null) words.push("--project", project);
+    } else {
+      words.push(...ids);
+    }
+    for (const option of HOME_OPTIONS) {
+      const value = parsed.values.get(option);
+      if (value !== undefined) words.push(option, value);
+    }
+    words.push("--apply");
+    const applyCommand = [PROGRAM, ...words.map(shellWord)].join(" ");
+    return dryRun(io, out, err, request, applyCommand);
+  }
+  return apply(io, out, err, request);
+}
+
+function list(
+  io: ImportedConversationsIo,
+  out: (line: string) => void,
+  project: string | null,
+): number {
+  return io.withReadOnlyDatabase((db) => {
+    const imports = listImportedPiConversations(db);
+    if (imports.length === 0) {
+      out("No imported Pi conversations in this home.");
+      return 0;
+    }
+    const needle = project?.toLowerCase() ?? null;
+    const shown =
+      needle === null
+        ? imports
+        : imports.filter((item) => item.folder.toLowerCase().includes(needle));
+    if (shown.length === 0) {
+      out(`No imported Pi conversations from a folder matching '${project}'.`);
+      return 0;
+    }
+    const summary = summarizeImports(shown, countLiveSessionsByFolder(db));
+    const scope = project === null ? "" : `, from folders matching '${project}'`;
+    out(
+      `Imported Pi conversations: ${summary.conversations} (${plural(summary.messages, "message")}), ` +
+        `imported ${day(summary.firstImportedAt ?? "")} to ${day(summary.lastImportedAt ?? "")}${scope}.`,
+    );
+    out(WHAT_AN_IMPORT_IS);
+    out("");
+    out("  imported  logged live here  folder");
+    for (const folder of summary.folders) {
+      const live = folder.loggedLive === null ? "-" : String(folder.loggedLive);
+      out(`${String(folder.imported).padStart(10)}${live.padStart(18)}  ${folder.folder}`);
+    }
+    if (project !== null) {
+      out("");
+      for (const item of shown) {
+        out(
+          `  ${day(item.importedAt)}  ${item.id}  ${plural(item.messageCount, "msg")}  ${item.folder}  ${item.title ?? "(untitled)"}`,
+        );
+      }
+    }
+    out("");
+    out(`To see a folder's conversations:  ${PROGRAM} conversations imported --project <text>`);
+    out(
+      `To remove a folder's imports:     ${PROGRAM} conversations imported remove --all --project <folder>`,
+    );
+    out("                                  (it shows what it would remove; add --apply to remove)");
+    return 0;
+  });
+}
+
+function dryRun(
+  io: ImportedConversationsIo,
+  out: (line: string) => void,
+  err: (line: string) => void,
+  request: ImportRemovalRequest,
+  applyCommand: string,
+): number {
+  return io.withReadOnlyDatabase((db) => {
+    const plan = planImportRemoval(db, request);
+    if (!plan.ok) {
+      err(`${plan.refusal}. Nothing was removed.`);
+      return 1;
+    }
+    if (plan.conversations.length === 0) {
+      out("Nothing to remove.");
+      return 0;
+    }
+    out(
+      `Would remove ${plural(plan.conversations.length, "imported Pi conversation")} ` +
+        `(${plural(messagesIn(plan.conversations), "message")}):`,
+    );
+    for (const [folder, count] of byFolder(plan.conversations)) {
+      out(`${String(count).padStart(10)}  ${folder}`);
+    }
+    out("Nothing was removed. To remove them, run:");
+    out(`  ${applyCommand}`);
+    return 0;
+  });
+}
+
+function apply(
+  io: ImportedConversationsIo,
+  out: (line: string) => void,
+  err: (line: string) => void,
+  request: ImportRemovalRequest,
+): number {
+  // Decide first, read-only: a refusal or an empty set stops here, and takes no
+  // backup. A holder rather than a variable: it is assigned inside a callback.
+  const decided: { conversations: ImportedConversation[] | null } = { conversations: null };
+  const decidedCode = io.withReadOnlyDatabase((db) => {
+    const plan = planImportRemoval(db, request);
+    if (!plan.ok) {
+      err(`${plan.refusal}. Nothing was removed.`);
+      return 1;
+    }
+    if (plan.conversations.length === 0) {
+      out("Nothing to remove.");
+      return 0;
+    }
+    decided.conversations = plan.conversations;
+    return 0;
+  });
+  const expected = decided.conversations;
+  if (decidedCode !== 0 || expected === null) return decidedCode;
+
+  return io.withLiveWriteDatabase((db, dbPath) => {
+    let archive: string | null;
+    try {
+      archive = io.backup(dbPath);
+    } catch {
+      archive = null;
+    }
+    if (archive === null) {
+      err("The backup failed, so nothing was removed.");
+      return 1;
+    }
+    const verification = io.verifyBackup(archive);
+    if (!verification.valid) {
+      err(
+        `The backup ${archive} did not verify (${verification.note ?? "no reason given"}), so nothing was removed.`,
+      );
+      return 1;
+    }
+    let removed: { conversations: ImportedConversation[]; messages: number };
+    try {
+      removed = removeImportedConversations(
+        db,
+        request,
+        expected.map((item) => item.id),
+      );
+    } catch (error) {
+      if (error instanceof ImportRemovalSetMovedError) {
+        err(
+          "The imports changed while the backup was taken, so nothing was removed. Run it again.",
+        );
+        return 1;
+      }
+      if (error instanceof ImportRemovalRefusedError) {
+        err(`${error.message}. Nothing was removed.`);
+        return 1;
+      }
+      throw error;
+    }
+    out(`Backup: ${archive} (verified).`);
+    out(
+      `Removed ${plural(removed.conversations.length, "imported Pi conversation")} ` +
+        `(${plural(removed.messages, "message")}) from ${plural(byFolder(removed.conversations).length, "folder")}.`,
+    );
+    out("Memories and provider-call records that named them were kept, unlinked.");
+    for (const line of backupsHoldingCopies(dbPath, removed.conversations)) out(line);
+    return 0;
+  });
+}
+
+/**
+ * Where copies of what was just removed still live: the dated archives made
+ * since the earliest removed import, and the pre-write backup. Named so a person
+ * can delete them; nothing here deletes them.
+ */
+function backupsHoldingCopies(dbPath: string, removed: readonly ImportedConversation[]): string[] {
+  // An archive made before the earliest removed import cannot hold any of them.
+  const since = Math.min(...removed.map((item) => Date.parse(item.importedAt)));
+  const backupsDir = join(dirname(dbPath), "backups");
+  const archives = existsSync(backupsDir)
+    ? readdirSync(backupsDir)
+        .map((name) => ({ name, made: parseArchiveStamp(name) }))
+        .filter((entry): entry is { name: string; made: Date } => entry.made !== null)
+        .filter((entry) => entry.made.getTime() >= since)
+        .sort((a, b) => a.made.getTime() - b.made.getTime())
+    : [];
+  const preWrite = backupPathFor(dbPath);
+  const lines: string[] = [];
+  if (archives.length > 0) {
+    const oldest = localDay((archives[0] as { made: Date }).made);
+    const newest = localDay((archives[archives.length - 1] as { made: Date }).made);
+    const made = oldest === newest ? oldest : `${oldest} to ${newest}`;
+    lines.push(
+      `  ${plural(archives.length, "dated archive")} in ${backupsDir}, made ${made} ` +
+        `(archives are removed after ${RETENTION_DAYS} days);`,
+    );
+  }
+  if (existsSync(preWrite)) {
+    lines.push(`  the pre-write backup ${preWrite} (replaced by the next write).`);
+  }
+  if (lines.length === 0) return ["No backup in this home holds a copy."];
+  return ["Copies remain in this home's backups until you delete them or they age out:", ...lines];
+}

package/ts/src/frontDoor/routing.ts

@@ -579,6 +579,18 @@ export function routeByFamily(
         reason: "DS7.US10 conversations append boundary ported to TS",
       };
     }
+    // CR154: allowlisted by name for the same reason, before it shipped. Its
+    // apply is named apart, so the front-door log tells a removal from a look.
+    if (argv[1] === "imported") {
+      const applying = argv[2] === "remove" && argv.includes("--apply");
+      return {
+        command,
+        engine: "ts",
+        reason: applying
+          ? "CR154 conversations imported remove --apply"
+          : "CR154 conversations imported",
+      };
+    }
     const writeFlag = TS4_LIFECYCLE_WRITE_FLAGS.find((flag) => argv.includes(flag));
     if (writeFlag) {
       return { command, engine: "ts", reason: `DS7.TS4 ${writeFlag} ported to TS` };