mixdog 1.4.2 → 1.4.3

package/src/runtime/agent/orchestrator/session/manager/turn-checkpoint-journal.mjs

@@ -1,12 +1,12 @@
 // manager/turn-checkpoint-journal.mjs
 // Bounded-cost, crash-safe turn checkpointing.
 //
-// PROBLEM. The turn checkpoint used to be a single full-snapshot file that was
-// rewritten on every flush (up to ~6/s per live session): the WHOLE growing
+// PROBLEM. A single full-snapshot checkpoint file rewritten on every flush (up
+// to ~6/s per live session) would re-sanitize and re-serialize the WHOLE growing
 // turn — every committed message, every buffered partial character, every
-// observed tool call — was re-sanitized and re-serialized on the engine thread.
-// Cost per flush grew with the turn (O(turn^2) over a long tool-heavy turn) and
-// at maximum agent fan-out every live session paid it on the SAME event loop.
+// observed tool call — on the engine thread. Cost per flush would grow with the
+// turn (O(turn^2) over a long tool-heavy turn) and at maximum agent fan-out
+// every live session would pay it on the SAME event loop.
 //
 // DESIGN. Split the checkpoint into a write-once header plus an append-only
 // delta journal:
@@ -15,9 +15,11 @@
 //                     before the provider ever runs, and store-summary-reader
 //                     keeps probing this exact path to detect a live turn.
 //   <session>.jsonl   append-only JSONL deltas — NEW/CHANGED turn messages (by
-//                     turn-relative index), a one-time full replacement when
-//                     compaction removes the opening prompt, APPENDED partial
-//                     text/reasoning and small interruption-state transitions.
+//                     index relative to the header's message list), APPENDED
+//                     partial text/reasoning, small interruption-state
+//                     transitions and the terminal seal. A history rewrite is
+//                     never a delta: the recorder rewrites the header with
+//                     the whole resulting context (turn-checkpoint.mjs).
 //                     A normal flush costs O(new bytes), never O(turn).
 // Appends ride a bounded coalescing lane (one in-flight write, one pending
 // buffer, synchronous drain above the byte ceiling) so the engine thread never
@@ -25,23 +27,32 @@
 //
 // Change detection is reference identity on message objects — the same contract
 // the session store's delta saves already rely on ("Replace, never mutate":
-// manager/prompt-utils.mjs, manager/session-lifecycle.mjs). A wholesale
-// transcript rewrite (image-strip splice, pre-send compaction) replaces the
-// refs, so it journals as changed indices plus a truncation record.
+// manager/prompt-utils.mjs, manager/session-lifecycle.mjs). Messages the turn
+// itself replaced journal as changed indices plus a truncation record.
 //
 // Reads replay header+journal into the EXACT object shape the full-snapshot
 // writer produced, so recovery/projection semantics are unchanged. A crash-torn
 // trailing line is discarded: replay stops at the first unparsable record and
 // keeps the durable prefix.
-import { appendFileSync, existsSync, mkdirSync, readFileSync, unlinkSync, writeFileSync } from 'node:fs';
+import { createHash } from 'node:crypto';
+import {
+  appendFileSync,
+  existsSync,
+  mkdirSync,
+  readdirSync,
+  readFileSync,
+  renameSync,
+  unlinkSync,
+  writeFileSync,
+} from 'node:fs';
 import { appendFile, unlink, writeFile } from 'node:fs/promises';
 import { join } from 'node:path';
 import { getPluginData } from '../../config.mjs';
 import { writeFileAtomicSync } from '../../../../shared/atomic-file.mjs';
+import { withFileLockSync } from '../../../../shared/file-lock.mjs';
 import { sanitizeContentForStoredHistory } from '../../providers/media-normalization.mjs';
 import { redactSettledText, sensitiveValuesVersion } from '../sensitive-values.mjs';
 import { redactSensitiveContent, redactSensitiveMessage, redactSensitiveToolCall } from '../sensitive-projection.mjs';
-import { promptContentText } from './prompt-utils.mjs';
 
 const TURN_CHECKPOINT_VERSION = 1;
 const SESSION_ID = /^[A-Za-z0-9_-]+$/;
@@ -98,30 +109,6 @@ export function checkpointMessage(message) {
   return content === message.content ? message : { ...message, content };
 }
 
-function matchingUserMessage(message, currentUserContent) {
-  return (
-    message?.role === 'user' &&
-    (message.content === currentUserContent ||
-      promptContentText(message.content) === promptContentText(currentUserContent))
-  );
-}
-
-/** Index of the user message that opened this turn, or -1. */
-export function findTurnStart(messages, currentUserContent) {
-  const source = Array.isArray(messages) ? messages : [];
-  for (let index = source.length - 1; index >= 0; index -= 1) {
-    if (matchingUserMessage(source[index], currentUserContent)) return index;
-  }
-  return -1;
-}
-
-export function turnMessagesForCheckpoint(messages, currentUserContent) {
-  const source = Array.isArray(messages) ? messages : [];
-  const start = findTurnStart(source, currentUserContent);
-  const turn = start >= 0 ? source.slice(start) : [];
-  return turn.map(checkpointMessage);
-}
-
 export function emptyInterruptionSnapshot() {
   return {
     responseStarted: false,
@@ -168,6 +155,10 @@ function redactInterruptionSnapshot(sessionId, snapshot) {
 
 export function writeCheckpointHeader(checkpoint) {
   const { sessionId } = checkpoint;
+  // A half-moved checkpoint is finished before anything replaces its files.
+  if (finishPendingSetAside(sessionId).pending) {
+    throw new Error(`[turn-checkpoint] session ${sessionId}: an unrecovered checkpoint is still being set aside`);
+  }
   const target = turnCheckpointPath(sessionId);
   const payload = {
     ...checkpoint,
@@ -196,8 +187,11 @@ export function readTurnCheckpointHeader(sessionId) {
 }
 
 /** `present` is false only when the header file does not exist (ENOENT);
- * an unreadable or invalid header is present with a null `header`. */
+ * an unreadable or invalid header is present with a null `header`, and so
+ * are the files of an unfinished set-aside (`settingAside`), which are never
+ * read as a checkpoint. */
 export function readTurnCheckpointHeaderState(sessionId) {
+  if (finishPendingSetAside(sessionId).pending) return { present: true, header: null, settingAside: true };
   let text;
   try {
     text = readFileSync(turnCheckpointReadPath(sessionId), 'utf8');
@@ -207,6 +201,164 @@ export function readTurnCheckpointHeaderState(sessionId) {
   return { present: true, header: parseTurnCheckpointHeader(text, sessionId) };
 }
 
+// ── Unrecovered checkpoints, set aside ──────────────────────────────────────
+// A checkpoint recovery cannot apply (it names no base revision, or the record
+// is not of its base) must never be overwritten by the session's next turn.
+// It is renamed, header and journal as they are, to
+// `<session>.unrecovered-<key>.json(l)`, `key` a digest of the header bytes.
+//
+// The move is several filesystem steps, so it is made one recoverable unit by
+// an intent record, `<session>.setaside` ({ key }), written durably FIRST and
+// removed LAST:
+//   1. intent   2. journal → <stem>.jsonl   3. header → <stem>.json   4. drop intent
+// While the intent exists the primary files are never read as a checkpoint,
+// cleared, or written over (readTurnCheckpointHeaderState, clearTurnCheckpoint
+// in turn-checkpoint.mjs, writeCheckpointHeader): every access first finishes
+// the move, and when that is still refused it reports the set-aside as
+// pending instead. A crash or a refused rename after any step therefore
+// resolves only to finishing it. A moved journal is never overwritten: a
+// primary journal found once `<stem>.jsonl` exists is not this checkpoint's.
+const UNRECOVERED = '.unrecovered-';
+const SET_ASIDE_KEY = /^[0-9a-f]{16}$/;
+
+// Test seam: called with the step name ('intent' | 'journal' | 'header' |
+// 'done') before each step; throwing simulates a crash or a refused rename there.
+let _setAsideFault = null;
+export function _setSetAsideFaultForTest(fault) {
+  _setAsideFault = typeof fault === 'function' ? fault : null;
+}
+
+function setAsideIntentPath(sessionId) {
+  return checkpointFilePath(sessionId, '.setaside', { ensureDir: false });
+}
+
+function unrecoveredStem(sessionId, key) {
+  return join(checkpointDirPath(), `${sessionId}${UNRECOVERED}${key}`);
+}
+
+const headerKey = (text) => createHash('sha256').update(text).digest('hex').slice(0, 16);
+
+function readFileOrNull(path) {
+  try {
+    return readFileSync(path, 'utf8');
+  } catch (error) {
+    if (error?.code === 'ENOENT') return null;
+    throw error;
+  }
+}
+
+/** The key of the set-aside in progress for `sessionId`, or null. */
+function pendingSetAsideKey(sessionId) {
+  const text = readFileOrNull(setAsideIntentPath(sessionId));
+  if (text === null) return null;
+  try {
+    const key = JSON.parse(text)?.key;
+    if (typeof key === 'string' && SET_ASIDE_KEY.test(key)) return key;
+  } catch {
+    /* an intent is written atomically; fall back to the header's own key */
+  }
+  const header = readFileOrNull(turnCheckpointReadPath(sessionId));
+  return header === null ? '' : headerKey(header);
+}
+
+function renameIfPresent(from, to) {
+  try {
+    renameSync(from, to);
+  } catch (error) {
+    if (error?.code !== 'ENOENT') throw error;
+  }
+}
+
+/** Steps 2-4 for `key` ('' when no primary header is left to name it). */
+function completeSetAside(sessionId, key) {
+  if (key) {
+    const stem = unrecoveredStem(sessionId, key);
+    _setAsideFault?.('journal');
+    if (!existsSync(`${stem}.jsonl`)) renameIfPresent(turnJournalReadPath(sessionId), `${stem}.jsonl`);
+    _setAsideFault?.('header');
+    renameIfPresent(turnCheckpointReadPath(sessionId), `${stem}.json`);
+  }
+  _setAsideFault?.('done');
+  try {
+    unlinkSync(setAsideIntentPath(sessionId));
+  } catch (error) {
+    if (error?.code !== 'ENOENT') throw error;
+  }
+}
+
+/** Finish an interrupted set-aside of `sessionId`. Returns `{ pending }`:
+ *  true when one is still unfinished (its files must not be touched);
+ *  `key` names the one it finished. */
+export function finishPendingSetAside(sessionId) {
+  let key;
+  try {
+    key = pendingSetAsideKey(sessionId);
+    if (key === null) return { pending: false, key: null };
+    completeSetAside(sessionId, key);
+    return { pending: false, key: key || null };
+  } catch {
+    return { pending: true, key: key || null };
+  }
+}
+
+/** Move `sessionId`'s current checkpoint aside (finishing an interrupted move
+ *  first). Returns the key of what it moved, or null when there was nothing.
+ *  Throws when the files cannot be moved: the caller must not then write a
+ *  new checkpoint, and every reader keeps treating them as being set aside. */
+export function setAsideTurnCheckpoint(sessionId) {
+  const pending = pendingSetAsideKey(sessionId);
+  if (pending !== null) completeSetAside(sessionId, pending);
+  const text = readFileOrNull(turnCheckpointReadPath(sessionId));
+  if (text === null) return pending || null;
+  const key = headerKey(text);
+  checkpointDir();
+  _setAsideFault?.('intent');
+  writeFileAtomicSync(setAsideIntentPath(sessionId), JSON.stringify({ key }));
+  completeSetAside(sessionId, key);
+  return key;
+}
+
+/** `[{ key, checkpoint, pending? }]` for every checkpoint of `sessionId` set
+ *  aside; `checkpoint` is null when its header is unreadable or its move is
+ *  still unfinished (`pending`). */
+export function listUnrecoveredTurnCheckpoints(sessionId) {
+  const prefix = `${assertSessionId(sessionId)}${UNRECOVERED}`;
+  const unfinished = finishPendingSetAside(sessionId);
+  let names;
+  try {
+    names = readdirSync(checkpointDirPath());
+  } catch {
+    names = [];
+  }
+  const found = unfinished.pending ? [{ key: unfinished.key, checkpoint: null, pending: true }] : [];
+  for (const name of names) {
+    if (!name.startsWith(prefix) || !name.endsWith('.json')) continue;
+    if (unfinished.pending && name === `${prefix}${unfinished.key}.json`) continue;
+    const stem = join(checkpointDirPath(), name.slice(0, -'.json'.length));
+    let checkpoint = null;
+    try {
+      const header = parseTurnCheckpointHeader(readFileSync(`${stem}.json`, 'utf8'), sessionId);
+      checkpoint = header ? replayTurnJournal(header, `${stem}.jsonl`) : null;
+    } catch {
+      checkpoint = null;
+    }
+    found.push({ key: name.slice(prefix.length, -'.json'.length), checkpoint });
+  }
+  return found;
+}
+
+/** Delete one set-aside checkpoint (only on evidence that disk covers it). */
+export function removeUnrecoveredTurnCheckpoint(sessionId, key) {
+  const stem = unrecoveredStem(assertSessionId(sessionId), key);
+  for (const path of [`${stem}.json`, `${stem}.jsonl`]) {
+    try {
+      unlinkSync(path);
+    } catch (error) {
+      if (error?.code !== 'ENOENT') throw error;
+    }
+  }
+}
+
 function parseTurnCheckpointHeader(text, sessionId) {
   try {
     const value = JSON.parse(text);
@@ -293,11 +445,14 @@ function _drainJournalOpsSync(sessionId, entry) {
   const ops = entry.ops;
   entry.ops = [];
   entry.bytes = 0;
-  for (const op of ops) {
+  for (const [index, op] of ops.entries()) {
     try {
       _runJournalOpSync(op);
+      op.settle?.(true);
     } catch (error) {
       _warnJournalOnce(sessionId, error);
+      // The rest of the queue is dropped: a removal among it did not happen.
+      for (const dropped of ops.slice(index)) dropped.settle?.(false);
       break;
     }
   }
@@ -323,9 +478,13 @@ function _pumpJournal(sessionId) {
   entry.writing = true;
   entry.inFlight = op;
   _runJournalOpAsync(op)
-    .catch((error) => {
-      _warnJournalOnce(sessionId, error);
-    })
+    .then(
+      () => op.settle?.(true),
+      (error) => {
+        _warnJournalOnce(sessionId, error);
+        op.settle?.(false);
+      }
+    )
     .finally(() => {
       entry.writing = false;
       entry.inFlight = null;
@@ -361,13 +520,21 @@ export function cancelJournalWrites(sessionId) {
   _releaseIdleEntry(sessionId, entry);
 }
 
-export function appendJournalLines(sessionId, lines) {
+/** `immediate`: written on the calling thread when nothing is queued or in
+ *  flight (the terminal seal), otherwise queued in order like any append. */
+export function appendJournalLines(sessionId, lines, { immediate = false } = {}) {
   if (!Array.isArray(lines) || lines.length === 0) return false;
-  _enqueueJournalOp(sessionId, {
-    kind: 'append',
-    path: turnJournalPath(sessionId),
-    data: lines.join(''),
-  });
+  const op = { kind: 'append', path: turnJournalPath(sessionId), data: lines.join('') };
+  if (immediate && !_journalWrites.has(sessionId)) {
+    try {
+      _runJournalOpSync(op);
+      return true;
+    } catch (error) {
+      _warnJournalOnce(sessionId, error);
+      return false;
+    }
+  }
+  _enqueueJournalOp(sessionId, op);
   return true;
 }
 
@@ -398,10 +565,102 @@ export function openJournalForTurn(sessionId, openLines) {
  * the file behind it) and before any later turn's open, which the lane fences
  * behind it. A crash before it lands leaves a journal whose header is already
  * gone, which replay never reads; process exit re-runs it synchronously.
+ * Resolves true once the file is gone, false when the removal failed (or was
+ * dropped behind a failed older write) — it never rejects.
  */
 export function removeTurnJournal(sessionId) {
   cancelJournalWrites(sessionId);
-  _enqueueJournalOp(sessionId, { kind: 'remove', path: turnJournalReadPath(sessionId) });
+  return new Promise((settle) => {
+    _enqueueJournalOp(sessionId, { kind: 'remove', path: turnJournalReadPath(sessionId), settle });
+  });
+}
+
+// ── Header publish + journal open vs. the orphan sweep ──────────────────────
+// A journal is only read through its header, so one without a header is
+// removable. The sweep checks "no header" and then unlinks; a turn in another
+// process publishing its header and opening its journal in between would
+// lose the opening record, and its later appends would never replay. Both are
+// therefore done under one per-session cross-process lock (file-lock.mjs).
+const CHECKPOINT_LOCK_WAIT_MS = 200;
+
+export function checkpointLockPath(sessionId) {
+  return join(checkpointDir(), `${assertSessionId(sessionId)}.lock`);
+}
+
+/** Run `fn` (a header publish plus journal open) under the session's
+ *  checkpoint lock. A turn never fails or stalls on the lock: it waits at most
+ *  CHECKPOINT_LOCK_WAIT_MS (holders keep it for one existence check and one
+ *  unlink), and when the lock cannot be taken at all `fn` runs without it —
+ *  its own errors still propagate. */
+export function withCheckpointOpenLock(sessionId, fn) {
+  let ran = false;
+  try {
+    return withFileLockSync(
+      checkpointLockPath(sessionId),
+      () => {
+        ran = true;
+        return fn();
+      },
+      { timeoutMs: CHECKPOINT_LOCK_WAIT_MS }
+    );
+  } catch (error) {
+    if (ran) throw error;
+    return fn();
+  }
+}
+
+/**
+ * Remove `sessionId`'s journal when no header stands behind it. A journal is
+ * only ever read through its header, so one without it can never be
+ * recovered; it is a removal that failed once (or was cut short by a restart)
+ * and still holds whatever it held. The header check and the unlink run under
+ * the session's checkpoint lock, so a turn cannot publish its header and open
+ * its journal between them (withCheckpointOpenLock). A busy lock skips the
+ * session instead of waiting, and so does a write lane still active for it
+ * (that process is removing or recording it itself). A header being set aside
+ * counts as present (readTurnCheckpointHeaderState). True when it removed one.
+ */
+export function removeOrphanTurnJournal(sessionId) {
+  const journalPath = turnJournalReadPath(sessionId);
+  if (!existsSync(journalPath)) return false;
+  try {
+    return withFileLockSync(
+      checkpointLockPath(sessionId),
+      () => {
+        if (readTurnCheckpointHeaderState(sessionId).present) return false;
+        if (_journalWrites.has(sessionId)) return false;
+        try {
+          unlinkSync(journalPath);
+        } catch (error) {
+          if (error?.code === 'ENOENT') return false;
+          throw error;
+        }
+        return true;
+      },
+      { timeoutMs: 0 }
+    );
+  } catch {
+    // Contended or unremovable: the next recovery or start tries again.
+    return false;
+  }
+}
+
+/** removeOrphanTurnJournal for every primary journal in the checkpoint
+ *  directory (set-aside journals, `<id>.unrecovered-<key>.jsonl`, are not
+ *  primary). Returns how many were removed. */
+export function removeOrphanTurnJournals() {
+  let names;
+  try {
+    names = readdirSync(checkpointDirPath());
+  } catch {
+    return 0;
+  }
+  let removed = 0;
+  for (const name of names) {
+    const match = /^([A-Za-z0-9_-]+)\.jsonl$/.exec(name);
+    if (match && removeOrphanTurnJournal(match[1])) removed += 1;
+  }
+  return removed;
 }
 
 /** Test/shutdown helper: resolve once the write lane for a session is idle. */
@@ -492,15 +751,16 @@ function applyInterruptionDelta(state, delta) {
 /** Merge the append-only journal onto its header. Returns the header unchanged
  * when no journal exists, when the journal belongs to another turn, or when it
  * has no usable head record. */
-export function replayTurnJournal(header) {
+export function replayTurnJournal(header, journalPath = header ? turnJournalReadPath(header.sessionId) : null) {
   if (!header) return null;
   let raw;
   try {
-    raw = readFileSync(turnJournalReadPath(header.sessionId), 'utf8');
+    raw = readFileSync(journalPath, 'utf8');
   } catch {
     return header;
   }
   let messages = header.turnMessages.slice();
+  let sealed = header.sealed === true;
   let fullTranscript = header.fullTranscript === true;
   let contextState = header.contextState ?? null;
   const state = interruptionStateFromSnapshot(header.interruption);
@@ -545,7 +805,11 @@ export function replayTurnJournal(header) {
       if (Number.isInteger(index) && index >= 0 && index <= messages.length) {
         messages[index] = record.m;
       }
+    } else if (record.t === 'seal') {
+      sealed = true;
     } else if (record.t === 'full' && Array.isArray(record.ms)) {
+      // Legacy journals (before checkpoints named their base) replaced the
+      // whole context this way; read them so they are not misread as a turn.
       messages = record.ms.slice();
       fullTranscript = true;
     } else if (record.t === 'len') {
@@ -565,6 +829,7 @@ export function replayTurnJournal(header) {
   return {
     ...header,
     turnMessages: messages,
+    ...(sealed ? { sealed: true } : {}),
     ...(fullTranscript ? { fullTranscript: true } : {}),
     interruption: interruptionSnapshotFromState(state),
     contextState,
@@ -573,13 +838,14 @@ export function replayTurnJournal(header) {
 }
 
 /**
- * Per-turn delta encoder. Holds the message refs already journaled (by
- * turn-relative index) plus an opaque interruption cursor, so each encode()
- * touches only what changed since the previous flush.
+ * Per-turn delta encoder. Holds the message refs already journaled (by index
+ * relative to the header's first message, `offset` in the working transcript)
+ * plus an opaque interruption cursor, so each encode() touches only what
+ * changed since the previous flush.
  */
 export function createTurnJournalEncoder({ turnToken, sessionId = null } = {}) {
   let journaled = [];
-  let fullTranscript = false;
+  let offset = 0;
   let cursor = null;
   let contextStateKey = null;
   // Per-turn record sequence. It is assigned where records are produced, so
@@ -620,16 +886,15 @@ export function createTurnJournalEncoder({ turnToken, sessionId = null } = {}) {
     return out;
   };
   return {
-    /** Seed from the turn's opening state; returns the header's messages
+    /** Seed from `turnOutgoing[offset..]`; returns the header's messages
      * and the journal's opening lines (head record, plus — defensively —
      * the delta that makes the journal authoritative if the tracker already
      * carried state at open time). `snapshot` is the tracker snapshot the
      * header stores; `epoch` names the journal a rewritten header starts. */
-    seed(turnOutgoing, currentUserContent, interruption, contextState = null, { snapshot = null, epoch = 0 } = {}) {
+    seed(turnOutgoing, interruption, contextState = null, { offset: from = 0, snapshot = null, epoch = 0 } = {}) {
       const source = Array.isArray(turnOutgoing) ? turnOutgoing : [];
-      const start = findTurnStart(source, currentUserContent);
-      fullTranscript = start < 0;
-      journaled = fullTranscript ? source.slice() : source.slice(start);
+      offset = from;
+      journaled = source.slice(offset);
       mirror = sensitiveValuesVersion(sessionId)
         ? {
             raw: interruptionStateFromSnapshot(snapshot),
@@ -646,40 +911,25 @@ export function createTurnJournalEncoder({ turnToken, sessionId = null } = {}) {
         openLines.push(line({ t: 'x', d: seededDelta, at: Date.now() }));
       return {
         turnMessages: journaled.map(checkpointMessage),
-        fullTranscript,
         contextState,
         openLines,
       };
     },
-    encode({ turnOutgoing, currentUserContent, interruption, contextState = null }) {
+    /** Lines for what changed since the previous flush; `sealed` adds the
+     *  record that marks the turn finished. */
+    encode({ turnOutgoing, interruption, contextState = null, sealed = false }) {
       const source = Array.isArray(turnOutgoing) ? turnOutgoing : [];
-      const start = findTurnStart(source, currentUserContent);
       const records = [];
-      if (!fullTranscript && start < 0) {
-        // Pre-send compaction may replace the whole history, including
-        // the user message that defined our turn-relative origin. The
-        // replacement is normally small; persist it once so reconnect
-        // and crash recovery never splice an empty turn onto the stale
-        // pre-compaction prefix.
-        fullTranscript = true;
-        journaled = source.slice();
-        records.push({
-          t: 'full',
-          ms: journaled.map(stored),
-        });
-      } else {
-        const offset = fullTranscript ? 0 : start;
-        const length = offset >= 0 ? source.length - offset : 0;
-        for (let index = 0; index < length; index += 1) {
-          const raw = source[offset + index];
-          if (journaled[index] === raw) continue;
-          journaled[index] = raw;
-          records.push({ t: 'm', i: index, m: stored(raw) });
-        }
-        if (journaled.length > length) {
-          journaled.length = length;
-          records.push({ t: 'len', n: length });
-        }
+      const length = Math.max(0, source.length - offset);
+      for (let index = 0; index < length; index += 1) {
+        const raw = source[offset + index];
+        if (journaled[index] === raw) continue;
+        journaled[index] = raw;
+        records.push({ t: 'm', i: index, m: stored(raw) });
+      }
+      if (journaled.length > length) {
+        journaled.length = length;
+        records.push({ t: 'len', n: length });
       }
       if (typeof interruption?.journalDelta === 'function') {
         const next = interruption.journalDelta(cursor);
@@ -692,6 +942,7 @@ export function createTurnJournalEncoder({ turnToken, sessionId = null } = {}) {
         contextStateKey = nextContextStateKey;
         records.push({ t: 'c', c: contextState });
       }
+      if (sealed) records.push({ t: 'seal' });
       if (records.length === 0) return [];
       // One timestamp per batch keeps `updatedAt` fresh for the
       // newer-than-session recovery guard without a per-record cost.