mover-os 4.7.8 → 4.7.10

package/src/dashboard/lib/memory-index.js

@@ -15,6 +15,7 @@
 
 const fs = require("fs");
 const path = require("path");
+const crypto = require("crypto");
 const { tokenize, termFreq, buildVocab } = require("./memory-text");
 const { enumerateSessions, parseTranscript, deriveProject } = require("./transcript-parser");
 const { parseSessionLogs } = require("./session-log-parser");
@@ -46,9 +47,34 @@ function ensureDirs() {
 }
 
 function atomicWrite(file, obj) {
-  const tmp = file + ".tmp";
+  // terra T-MH-2: a fixed `file + ".tmp"` name means two concurrent SessionEnd
+  // hooks writing the same segment/manifest share one temp path and can interleave
+  // into a torn file. A per-write unique temp name makes each write's rename
+  // independent (the last full write wins cleanly; no half-written temp survives).
+  const tmp = file + "." + process.pid + "-" + crypto.randomBytes(4).toString("hex") + ".tmp";
   fs.writeFileSync(tmp, JSON.stringify(obj));
-  fs.renameSync(tmp, file);
+  try { fs.renameSync(tmp, file); }
+  catch (e) { try { fs.unlinkSync(tmp); } catch (_) {} throw e; }
+}
+
+// terra T-MH-1: safeReadJson() collapses "file absent" and "file present but
+// MALFORMED" both to null, so `safeReadJson(segFile) || newSeg()` would overwrite
+// a corrupt segment with an empty one — discarding every indexed doc for that
+// month. Distinguish the two: a MISSING segment is a fresh newSeg(); a present-
+// but-unparseable segment THROWS, so the fail-open SessionEnd hook skips indexing
+// this one session and PRESERVES the existing file rather than nuking it.
+function readSegOrNew(segFile) {
+  let raw;
+  try { raw = fs.readFileSync(segFile, "utf8"); }
+  catch (e) { if (e.code === "ENOENT") return newSeg(); throw e; }
+  let parsed;
+  try { parsed = JSON.parse(raw); }
+  catch (_) { throw Object.assign(new Error("memory segment is malformed; refusing to overwrite it: " + segFile), { code: "ESEGCORRUPT" }); }
+  // A parsed-but-wrong-shape file is also not safe to fold into — treat as corrupt.
+  if (!parsed || typeof parsed !== "object" || !parsed.docs || !parsed.postings) {
+    throw Object.assign(new Error("memory segment has an unexpected shape; refusing to overwrite it: " + segFile), { code: "ESEGCORRUPT" });
+  }
+  return parsed;
 }
 
 function monthOf(ts, fallbackMs) {
@@ -377,19 +403,43 @@ async function indexSession(file, opts = {}) {
   if (!man) return { error: "no index — run --backfill first" };
   man.docFreq = man.docFreq || {}; man.linkFreq = man.linkFreq || {}; man.indexedSessions = man.indexedSessions || {};
   const vault = opts.vault || man.vault;
-  const sessionId = opts.sessionId || path.basename(file).replace(/\.jsonl$/, "");
-  // Derive the project from the transcript's parent dir (…/projects/<encoded-dir>/<uuid>.jsonl)
-  // when not passed — the SessionEnd hook calls indexSession(file, {}), and without this every
-  // live-indexed session would be project=null, making the cross-project scope guard a no-op.
-  const project = opts.project || deriveProject(path.basename(path.dirname(file))) || null;
+  const pathSessionId = path.basename(file).replace(/\.jsonl$/, "");
+  const pathProject = deriveProject(path.basename(path.dirname(file))) || null;
   let mtime = null, size = 0;
   try { const st = fs.statSync(file); mtime = st.mtimeMs; size = st.size; } catch {}
-  const prev = man.indexedSessions[sessionId];
-  if (prev && mtime && prev.mtime === mtime && !opts.force) return { skipped: true, sessionId };
 
-  const r = await parseTranscript(file, { vocab: buildVocab(vault), sessionId, project });
+  // Parse before selecting identity. Claude stores sessions under an encoded project directory, but
+  // Codex stores rollouts under date folders and carries the real session id + cwd in session_meta.
+  const r = await parseTranscript(file, {
+    vocab: buildVocab(vault),
+    sessionId: opts.sessionId,
+    project: opts.project,
+    agent: opts.agent,
+  });
+  const sessionId = opts.sessionId || r.sessionId || pathSessionId;
+  const project = opts.project || r.project || pathProject;
   if (r.error) return { error: "parse failed", sessionId };
 
+  let reindexed = false;
+  // Remove a pre-fix Codex entry keyed by the rollout filename. Without this migration the same
+  // transcript survives twice: once under rollout-* and once under its canonical session id.
+  if (pathSessionId !== sessionId) {
+    const legacy = man.indexedSessions[pathSessionId];
+    if (legacy && legacy.month) {
+      const legacyFile = path.join(SEG_DIR, "raw-" + legacy.month + ".json");
+      const legacySeg = safeReadJson(legacyFile);
+      if (legacySeg && legacySeg.docs["session:" + pathSessionId]) {
+        removeDocContribution(legacySeg, "session:" + pathSessionId, man);
+        atomicWrite(legacyFile, legacySeg);
+      }
+      delete man.indexedSessions[pathSessionId];
+      reindexed = true;
+    }
+  }
+
+  const prev = man.indexedSessions[sessionId];
+  if (prev && mtime && prev.mtime === mtime && !opts.force && !reindexed) return { skipped: true, sessionId };
+
   const month = monthOf(r.firstTs, mtime);
   const id = "session:" + sessionId;
 
@@ -398,7 +448,6 @@ async function indexSession(file, opts = {}) {
   // lives in the PREVIOUSLY recorded month's segment — remove it from THERE too, else it orphans
   // (ghost doc) and permanently inflates docFreq/totalDocs/linkFreq, degrading IDF until a full
   // --backfill. Only fires on a genuine month change; the common same-month re-index skips it.
-  let reindexed = false;
   const prevMonth = prev && prev.month;
   if (prevMonth && prevMonth !== month) {
     const prevSegFile = path.join(SEG_DIR, "raw-" + prevMonth + ".json");
@@ -411,7 +460,7 @@ async function indexSession(file, opts = {}) {
   }
 
   const segFile = path.join(SEG_DIR, "raw-" + month + ".json");
-  const seg = safeReadJson(segFile) || newSeg();
+  const seg = readSegOrNew(segFile); // terra T-MH-1: never clobber a malformed segment
 
   // remove old contribution (same-month re-index case) — scan only this segment's postings.
   if (seg.docs[id]) { removeDocContribution(seg, id, man); reindexed = true; }

package/src/dashboard/lib/pid-markers.js

@@ -0,0 +1,80 @@
+"use strict";
+
+/**
+ * pid-markers.js — crash-orphan bookkeeping shared by AgentSessionManager
+ * (Chat/onboarding) and RunRegistry (Run tab).
+ *
+ * Every dashboard-spawned agent child is detached into its own process group
+ * and recorded here as one marker file per pid, tagged with the owning
+ * dashboard's pid. On startup each manager reaps any group whose OWNER is
+ * gone — children escaped by a crashed dashboard (kill -9, OOM, update crash)
+ * that no graceful shutdown path could ever reach.
+ *
+ * Extracted verbatim from agent-session.js (MF2, Codex r2 hardening) so the
+ * Run tab gets the same guarantee. One file per pid: no shared-file
+ * read-modify-write race across concurrent dashboards; a corrupt write only
+ * loses its own marker. Writes are atomic (tmp + rename). Both managers share
+ * ONE directory on purpose: whichever starts first reaps the other's orphans.
+ */
+
+const os = require("os");
+const path = require("path");
+const fs = require("fs");
+
+const MARKERS_DIR = path.join(os.homedir(), ".mover", "dashboard", "agent-pids");
+
+function markerPath(pid) { return path.join(MARKERS_DIR, String(pid) + ".json"); }
+
+function writeMarker(pid, data) {
+  try {
+    fs.mkdirSync(MARKERS_DIR, { recursive: true });
+    const f = markerPath(pid), tmp = f + ".tmp";
+    fs.writeFileSync(tmp, JSON.stringify(data));
+    fs.renameSync(tmp, f); // atomic: a reader never sees a half-written marker
+  } catch (_) {}
+}
+
+function removeMarker(pid) { try { fs.unlinkSync(markerPath(pid)); } catch (_) {} }
+
+function readMarkers() {
+  let files; try { files = fs.readdirSync(MARKERS_DIR); } catch (_) { return []; }
+  const out = [];
+  for (const fn of files) {
+    if (!fn.endsWith(".json")) continue;
+    try { out.push(JSON.parse(fs.readFileSync(path.join(MARKERS_DIR, fn), "utf8"))); } catch (_) {}
+  }
+  return out;
+}
+
+function isAlive(pid) {
+  if (!pid) return false;
+  try { process.kill(pid, 0); return true; } catch (e) { return e && e.code === "EPERM"; }
+}
+
+// True if ANY member of the process group still exists (not just the leader) —
+// process.kill(-pid, 0) throws ESRCH only when the whole group is gone.
+function groupAlive(pid) {
+  if (!pid) return false;
+  try { process.kill(-pid, 0); return true; } catch (e) { return e && e.code === "EPERM"; }
+}
+
+function killGroup(pid, sig) {
+  if (!pid) return false;
+  try { process.kill(-pid, sig); return true; }
+  catch (_) { try { process.kill(pid, sig); return true; } catch (__) { return false; } }
+}
+
+// Reap any recorded group whose owning dashboard is gone. Idempotent; safe to
+// call from every manager's constructor (they share the directory).
+function reapOrphans() {
+  for (const m of readMarkers()) {
+    if (!m || !m.pid) continue;
+    // Keep markers whose owning dashboard is still alive (this process OR a
+    // concurrent one). Only a marker whose owner is GONE is a real orphan.
+    if (m.ownerPid && isAlive(m.ownerPid)) continue;
+    if (groupAlive(m.pid)) killGroup(m.pid, "SIGKILL"); // owner gone → orphaned group
+    removeMarker(m.pid);
+  }
+}
+
+module.exports = { MARKERS_DIR, writeMarker, removeMarker, readMarkers, isAlive, groupAlive, killGroup, reapOrphans };

package/src/dashboard/lib/run-registry.js

@@ -29,9 +29,11 @@
  */
 
 const { spawn } = require("child_process");
+const { writeMarker, removeMarker, groupAlive, killGroup, reapOrphans } = require("./pid-markers");
 
 const DEFAULTS = {
   maxRuns: 40,                       // retain at most N runs (live + finished)
+  maxConcurrent: 4,                  // live child processes at once; excess requests are refused
   maxBuffer: 1024 * 1024,            // 1 MB per-run output cap (head dropped, tail kept)
   finishedTtlMs: 6 * 60 * 60 * 1000, // evict finished runs 6h after they end
   idleSweepMs: 5 * 60 * 1000,        // sweep cadence
@@ -43,10 +45,21 @@ class RunRegistry {
     this.opt = { ...DEFAULTS, ...opts };
     this.runs = new Map(); // id -> run record
     this._seq = 0;
+    // R5-A: reap children escaped by a crashed dashboard (same MF2 guarantee
+    // AgentSessionManager has; the marker dir is shared so either manager's
+    // startup cleans up both kinds of orphan).
+    reapOrphans();
     this._sweep = setInterval(() => this._evict(), this.opt.idleSweepMs);
     if (this._sweep.unref) this._sweep.unref();
   }
 
+  /** Live (running/stopping) child count — the concurrency the cap guards. */
+  liveCount() {
+    let n = 0;
+    for (const r of this.runs.values()) if (r.status === "running" || r.status === "stopping") n++;
+    return n;
+  }
+
   /**
    * Spawn a tracked run. The CALLER builds the command (agentCommand) and the
    * final prompt (buildAgentPrompt); this owns the process + buffer lifecycle.
@@ -54,6 +67,13 @@ class RunRegistry {
    * Returns the run record (its `.id` is the handle for subscribe/get/stop).
    */
   start(spec) {
+    // Concurrency cap (R5-A): every run is a real long-lived CLI child with
+    // full tool access; a buggy retry loop must not fork-bomb the machine.
+    if (this.liveCount() >= this.opt.maxConcurrent) {
+      const err = new Error(`${this.opt.maxConcurrent} agents are already running. Stop one or let it finish first.`);
+      err.code = "RUN_LIMIT";
+      throw err;
+    }
     const id = `run_${process.pid}_${++this._seq}`;
     const run = {
       id,
@@ -73,17 +93,26 @@ class RunRegistry {
 
     let child;
     try {
-      child = spawn(spec.cmd, spec.args, { cwd: spec.cwd, env: spec.env, stdio: ["pipe", "pipe", "pipe"] });
+      // detached: own process group, so Stop/shutdown can signal the whole
+      // tree (a run's tool calls spawn grandchildren the bare child.kill()
+      // never reached), and the pid marker lets a post-crash startup reap it.
+      child = spawn(spec.cmd, spec.args, { cwd: spec.cwd, env: spec.env, stdio: ["pipe", "pipe", "pipe"], detached: true });
     } catch (e) {
       this._append(run, `\n[mover-studio] failed to start ${run.agent}: ${e && e.message}\n`);
       this._finish(run, "failed", null);
       return run;
     }
     run.child = child;
+    if (child.pid) writeMarker(child.pid, { pid: child.pid, ownerPid: process.pid, at: Date.now(), kind: "run" });
 
     const timeout = setTimeout(() => {
+      // Mark stopping BEFORE the kill so the close handler reports "stopped",
+      // not a false "done" (terra run-path F2).
+      run.status = "stopping";
       this._append(run, "\n[mover-studio] timeout after 10 minutes; stopping agent.\n", true);
-      try { child.kill("SIGTERM"); } catch (_) {}
+      killGroup(child.pid, "SIGTERM");
+      const esc = setTimeout(() => { if (groupAlive(child.pid)) killGroup(child.pid, "SIGKILL"); }, 2500);
+      if (esc.unref) esc.unref();
     }, this.opt.timeoutMs);
     if (timeout.unref) timeout.unref();
 
@@ -102,12 +131,14 @@ class RunRegistry {
       this._append(run, `\n[mover-studio] failed to start ${run.agent}: ${err && err.message}\n`, true);
       this._finish(run, "failed", null);
     });
-    child.on("close", (code) => {
+    child.on("close", (code, signal) => {
       clearTimeout(timeout);
-      this._append(run, `\n[mover-studio] agent exited with code ${code}\n`, true);
-      // A run we SIGTERM'd via stop() keeps its "stopped" status; otherwise
-      // derive from the exit code (0/null = done, non-zero = exited).
-      const status = run.status === "stopping" ? "stopped" : (code === 0 || code == null) ? "done" : "exited";
+      this._append(run, `\n[mover-studio] agent exited with code ${code}${signal ? ` (signal ${signal})` : ""}\n`, true);
+      // A run we SIGTERM'd (stop OR timeout) keeps "stopping" -> "stopped". A
+      // clean exit (code 0) is "done"; ANY other termination — a non-zero code OR
+      // code==null from a signal we did not send — is "exited", never a false
+      // "done" (terra run-path F2: a signal-killed run was reported as success).
+      const status = run.status === "stopping" ? "stopped" : code === 0 ? "done" : "exited";
       this._finish(run, status, code);
     });
 
@@ -123,6 +154,10 @@ class RunRegistry {
     // Snapshot + register atomically (no I/O between) so no chunk is lost.
     cb({ type: "replay", text: run.output, status: run.status, exit: run.exit });
     if (run.status === "running" || run.status === "stopping") {
+      // Cap live subscribers per run so a flood of stream connections can't pile
+      // up callbacks/sockets (terra run-path F3). Over the cap, the client still
+      // got the full replay above; end it rather than live-stream.
+      if (run.subscribers.size >= 64) { cb({ type: "end", status: run.status, exit: run.exit }); return () => {}; }
       run.subscribers.add(cb);
       return () => run.subscribers.delete(cb);
     }
@@ -130,15 +165,17 @@ class RunRegistry {
     return () => {};
   }
 
-  /** Really stop a run (SIGTERM the child). Distinct from a client merely
+  /** Really stop a run (SIGTERM the child's whole process group — a run's
+   *  tool calls spawn grandchildren). Distinct from a client merely
    *  detaching its stream ("stop watching"). */
   stop(id) {
     const run = this.runs.get(id);
     if (!run || !run.child || (run.status !== "running")) return false;
     run.status = "stopping";
-    try { run.child.kill("SIGTERM"); } catch (_) {}
-    // Escalate if the child ignores SIGTERM.
-    const t = setTimeout(() => { if (run.status === "stopping" && run.child) { try { run.child.kill("SIGKILL"); } catch (_) {} } }, 2500);
+    const pid = run.child.pid;
+    killGroup(pid, "SIGTERM");
+    // Escalate if the group ignores SIGTERM.
+    const t = setTimeout(() => { if (run.status === "stopping" && groupAlive(pid)) killGroup(pid, "SIGKILL"); }, 2500);
     if (t.unref) t.unref();
     return true;
   }
@@ -149,11 +186,30 @@ class RunRegistry {
     return [...this.runs.values()].sort((a, b) => b.started - a.started).map((r) => this._summary(r, false));
   }
 
-  shutdownAll() {
+  /** Kill every live run's process group and WAIT for it to die, escalating
+   *  to SIGKILL after graceMs — mirrors AgentSessionManager.shutdownAll (MF1)
+   *  so the server's hard-exit timer can't strand a stubborn child. If a
+   *  group somehow survives SIGKILL, its marker stays on disk so the next
+   *  startup reaps it — never a silent orphan. */
+  shutdownAll(graceMs = 1500) {
     if (this._sweep) { clearInterval(this._sweep); this._sweep = null; }
-    for (const r of [...this.runs.values()]) {
-      if (r.child && (r.status === "running" || r.status === "stopping")) { try { r.child.kill("SIGTERM"); } catch (_) {} }
-    }
+    const live = [...this.runs.values()].filter((r) => r.child && (r.status === "running" || r.status === "stopping"));
+    return Promise.all(live.map((r) => new Promise((resolve) => {
+      const pid = r.child.pid;
+      killGroup(pid, "SIGTERM");
+      const start = Date.now();
+      let killed = false;
+      const tick = () => {
+        if (!groupAlive(pid)) { removeMarker(pid); return resolve(); }
+        if (!killed && Date.now() - start >= graceMs) { killGroup(pid, "SIGKILL"); killed = true; }
+        if (killed && Date.now() - start >= graceMs + 700) {
+          if (!groupAlive(pid)) removeMarker(pid);
+          return resolve();
+        }
+        const t = setTimeout(tick, 150); if (t.unref) t.unref();
+      };
+      tick();
+    })));
   }
 
   // ── internals ──────────────────────────────────────────────────────────────
@@ -185,6 +241,10 @@ class RunRegistry {
     // "failed"/"stopped" with the close code (null -> "done") and emits a
     // second "end". First finish wins. (Found by a Codex review, 2026-06-30.)
     if (run.ended) return;
+    // Drop the crash marker only once the whole GROUP is gone; if a tool
+    // grandchild outlived the leader, the marker survives and the next
+    // dashboard startup reaps it.
+    if (run.child && run.child.pid && !groupAlive(run.child.pid)) removeMarker(run.child.pid);
     run.status = status;
     run.exit = exit;
     run.ended = Date.now();

package/src/dashboard/lib/state-core/backfill.js

@@ -0,0 +1,298 @@
+"use strict";
+
+// backfill.js — CORE-LOOP PHASE 2 (SCHEMA-SPEC v0.2 section 4, migration).
+// Turns a vault COPY's existing records into v0.2 events. Copy-first is the
+// owner-approved default #5: nothing in this module is wired to any workflow,
+// hook, or server route, and applyState (dryrun.js) refuses a non-pristine
+// target. The live vault is never touched until the owner has inspected a
+// dry-run manifest on a copy.
+//
+// WHAT v1 MIGRATES (mechanically faithful sources only):
+//   - ~/.mover/pattern-manifest.json override_history[] -> override.logged
+//   - Dailies "## Tasks" checkboxes -> plan.observed + plan.ticked
+//
+// WHAT v1 DOES NOT MIGRATE (spec amendment, recorded 2026-07-11): the v0.1
+// spec table sourced receipt.filed from "Metrics_Log receipt lines", but the
+// real Metrics_Log.md is a Fitbit vitality analysis with no receipts section
+// — its dated lines are sleep scores. Fabricating receipts from them (or
+// from session-log prose via keyword heuristics) would inflate the record
+// this system exists to keep honest. Undercount over inflate: prose receipts
+// are declared non-recoverable; receipt.filed/ship.published begin at
+// Close-time capture going forward. Every skip is returned in `skipped`
+// with a reason — absence is reported, never papered over.
+//
+// Every migrated event carries source {path, sourceHash, parserVersion,
+// locator} per v0.2 amendment 2 — a locator for audit, never an identity.
+
+const fs = require("fs");
+const path = require("path");
+const { sha256Hex } = require("./event-log");
+const { overrideLogged, planTicked, planObserved } = require("./events");
+
+// v2: literal NUL bytes dropped from identity + variable-length backtick
+// fences parsed per CommonMark (terra round 3 findings 2 and 3).
+const PARSER_VERSION = 2;
+
+// ── time ────────────────────────────────────────────────────────────────────
+
+// Day-precision source dates land at UTC noon: projections.dateKeyFromTs is
+// UTC, so noon round-trips to the same YYYY-MM-DD for any writer zone within
+// +/-11h, without pretending we know the time of day.
+function tsFromDateKey(dateKey) {
+  const t = Date.parse(`${dateKey}T12:00:00Z`);
+  return Number.isFinite(t) ? t : null;
+}
+
+// Datetime strings ("2026-04-20T11:11") parse as local time by JS spec —
+// deterministic per machine, which is all a backfill needs.
+function tsFromLoose(value) {
+  if (typeof value !== "string" || !value.trim()) return null;
+  if (/^\d{4}-\d{2}-\d{2}$/.test(value.trim())) return tsFromDateKey(value.trim());
+  const t = Date.parse(value);
+  return Number.isFinite(t) ? t : null;
+}
+
+// ── shared ──────────────────────────────────────────────────────────────────
+
+function sourceFor(relPath, fileText, locator) {
+  return {
+    path: relPath,
+    sourceHash: sha256Hex(fileText),
+    parserVersion: PARSER_VERSION,
+    locator,
+  };
+}
+
+// Code spans open with a run of N backticks and close at the next run of
+// EXACTLY N (CommonMark). The old single-backtick regex corrupted
+// ``a`b``-style spans (terra round 3 finding 3). An unclosed run stays
+// literal text.
+function extractCodeSpans(text, codeSpans) {
+  let out = "";
+  let i = 0;
+  while (i < text.length) {
+    if (text[i] !== "`") { out += text[i]; i += 1; continue; }
+    let n = 0;
+    while (text[i + n] === "`") n += 1;
+    let j = i + n;
+    let close = -1;
+    while (j < text.length) {
+      if (text[j] !== "`") { j += 1; continue; }
+      let m = 0;
+      while (text[j + m] === "`") m += 1;
+      if (m === n) { close = j; break; }
+      j += m;
+    }
+    if (close === -1) { out += text.slice(i, i + n); i += n; continue; }
+    codeSpans.push(text.slice(i + n, close));
+    out += "\u0000" + (codeSpans.length - 1) + "\u0000";
+    i = close + n;
+  }
+  return out;
+}
+
+function normalizeTask(text) {
+  // Markdown canonicalization (terra attack 7 + re-verdict #7): `Send
+  // **proposal**` and `Send proposal` are the same task; formatting must not
+  // fork identity. But a CODE SPAN is literal text - stripping its backticks
+  // AND its inner asterisks merged `Run \`a*b*\`` with `Run a*b` (distinct
+  // tasks). Code spans are held out verbatim (minus the backticks), emphasis
+  // stripping applies only OUTSIDE them; links tolerate one level of nested
+  // brackets in the label.
+  // Literal NUL bytes are dropped BEFORE the sentinel pass (terra round 3
+  // finding 2: task text containing a literal NUL-digit-NUL sequence
+  // resolved as a sentinel and collapsed to a colliding identity). NUL is
+  // not representable markdown content, so dropping it is canonicalization,
+  // not data loss.
+  const codeSpans = [];
+  let t = extractCodeSpans(text.replace(/\u0000/g, ""), codeSpans);
+  t = t
+    .replace(/\[((?:[^\[\]]|\[[^\]]*\])*)\]\([^)]*\)/g, "$1") // [text [nested]](url) -> text [nested]
+    .replace(/(\*\*|__|~~)/g, "")
+    .replace(/(^|\s)[*_](\S)/g, "$1$2") // leading emphasis marker on a word
+    .replace(/(\S)[*_](\s|$)/g, "$1$2"); // trailing emphasis marker on a word
+  t = t.replace(/\u0000(\d+)\u0000/g, (_, i) => codeSpans[Number(i)] || "");
+  return t.trim().replace(/\s+/g, " ");
+}
+
+// Stable across backfill runs AND across [x]/[ ] flips of the same task on
+// the same note date — the taskId is (date, text), never checkbox state.
+function taskIdFor(noteDate, text) {
+  return sha256Hex(`${noteDate}\n${normalizeTask(text)}`).slice(0, 16);
+}
+
+// ── override_history -> override.logged ─────────────────────────────────────
+
+// Field fallbacks mirror lib/override-summary.js normalizeOverrides — the
+// manifest has grown several field spellings over its life. A missing text
+// field becomes the composed absence "not recorded" (the constructor requires
+// non-empty strings; an honest placeholder beats dropping a real override).
+// A missing/unparseable date is different: a fabricated timestamp would
+// corrupt every date-keyed projection, so the entry is SKIPPED with a reason.
+function backfillOverrides(manifestText, { manifestPath = "pattern-manifest.json" } = {}) {
+  const events = [];
+  const skipped = [];
+
+  let manifest;
+  try {
+    manifest = JSON.parse(manifestText);
+  } catch (e) {
+    return { events, skipped: [{ locator: manifestPath, reason: `manifest is not valid JSON: ${e.message}` }] };
+  }
+
+  const raw = (manifest && (manifest.override_history || manifest.overrideHistory)) || [];
+  if (!Array.isArray(raw)) {
+    return { events, skipped: [{ locator: `${manifestPath}#override_history`, reason: "override_history is not an array" }] };
+  }
+
+  raw.forEach((o, i) => {
+    const locator = `override_history[${i}]`;
+    if (o === null || typeof o !== "object") {
+      skipped.push({ locator, reason: "entry is not an object" });
+      return;
+    }
+    const ts = tsFromLoose(o.date || o.timestamp);
+    if (ts === null) {
+      skipped.push({ locator, reason: `no parseable date (got ${JSON.stringify(o.date || o.timestamp || null)})` });
+      return;
+    }
+    const str = (v) => (typeof v === "string" && v.trim() ? v.trim() : null);
+    events.push(
+      overrideLogged(
+        {
+          what: str(o.what) || str(o.action) || str(o.task) || "not recorded",
+          over: str(o.over) || str(o.plan_item) || str(o.conflicted_with) || "not recorded",
+          reason: str(o.reason) || str(o.user_override) || str(o.justification) || "not recorded",
+          level: typeof o.level === "number" ? o.level : str(o.level) || "UNKNOWN",
+        },
+        { ts, source: sourceFor(manifestPath, manifestText, locator) }
+      )
+    );
+  });
+
+  return { events, skipped };
+}
+
+// ── Daily Note "## Tasks" -> plan.observed + plan.ticked ────────────────────
+
+const NOTE_NAME_RE = /^Daily - (\d{4}-\d{2}-\d{2})\.md$/;
+const CHECKBOX_RE = /^\s*[-*]\s*\[([ xX~])\]\s+(.+?)\s*$/;
+
+// One plan.observed (the honest denominator, v0.2 amendment 5) + one
+// plan.ticked per [x] line. [ ] contributes to the denominator only.
+// [~] means "written, not verified" in this house — it is NEVER migrated as
+// done; only /morning or the user promotes it, and backfill does not get to
+// promote what a human never verified.
+function backfillDailyTasks(noteText, { noteDate, relPath }) {
+  const events = [];
+  const skipped = [];
+  const ts = tsFromDateKey(noteDate);
+  if (ts === null) {
+    return { events, skipped: [{ locator: relPath, reason: `invalid note date ${JSON.stringify(noteDate)}` }] };
+  }
+
+  const lines = noteText.split("\n");
+  const headIdx = lines.findIndex((l) => /^#{1,4}\s*Tasks\b/i.test(l));
+  if (headIdx === -1) {
+    return { events, skipped: [{ locator: `${relPath}#tasks`, reason: "no Tasks section" }] };
+  }
+
+  const taskIds = [];
+  const texts = [];
+  const ticks = [];
+  for (let i = headIdx + 1; i < lines.length; i++) {
+    if (/^#{1,4}\s/.test(lines[i])) break; // next heading ends the section
+    const m = lines[i].match(CHECKBOX_RE);
+    if (!m) continue;
+    const text = normalizeTask(m[2]);
+    const taskId = taskIdFor(noteDate, text);
+    if (taskIds.includes(taskId)) continue; // duplicate line, one denominator slot
+    taskIds.push(taskId);
+    texts.push(text);
+    if (m[1] === "x" || m[1] === "X") ticks.push({ taskId, task: text, line: i + 1 });
+  }
+
+  if (taskIds.length === 0) {
+    return { events, skipped: [{ locator: `${relPath}#tasks`, reason: "Tasks section has no checkboxes" }] };
+  }
+
+  events.push(
+    planObserved({ noteDate, taskIds, texts }, { ts, source: sourceFor(relPath, noteText, "tasks") })
+  );
+  for (const t of ticks) {
+    events.push(
+      planTicked(
+        { taskId: t.taskId, task: t.task, note_date: noteDate, done: true },
+        { ts, source: sourceFor(relPath, noteText, `tasks:line:${t.line}`) }
+      )
+    );
+  }
+  return { events, skipped };
+}
+
+// ── whole-vault sweep ────────────────────────────────────────────────────────
+
+function collectDailyNotes(vaultRoot) {
+  const dir = path.join(vaultRoot, "02_Areas", "Engine", "Dailies");
+  const notes = [];
+  if (!fs.existsSync(dir)) return notes;
+  for (const month of fs.readdirSync(dir).sort()) {
+    const monthDir = path.join(dir, month);
+    let entries;
+    try {
+      entries = fs.readdirSync(monthDir);
+    } catch {
+      continue; // a stray file at the month level, not a folder
+    }
+    for (const name of entries.sort()) {
+      const m = name.match(NOTE_NAME_RE);
+      if (!m) continue;
+      notes.push({
+        noteDate: m[1],
+        absPath: path.join(monthDir, name),
+        relPath: path.join("02_Areas", "Engine", "Dailies", month, name),
+      });
+    }
+  }
+  return notes;
+}
+
+// The full copy-first backfill: manifest overrides + every Daily's tasks,
+// returned in a deterministic order (ts ascending, locator as tiebreak) so
+// two runs over the same copy produce the same append sequence and the same
+// dedupeKey set (ids are fresh UUIDs by design — identity is opaque).
+function backfillVault(vaultRoot, { manifestPath } = {}) {
+  const events = [];
+  const skipped = [];
+
+  if (manifestPath && fs.existsSync(manifestPath)) {
+    const text = fs.readFileSync(manifestPath, "utf8");
+    const r = backfillOverrides(text, { manifestPath: path.basename(manifestPath) });
+    events.push(...r.events);
+    skipped.push(...r.skipped);
+  } else if (manifestPath) {
+    skipped.push({ locator: manifestPath, reason: "manifest file not found" });
+  }
+
+  for (const note of collectDailyNotes(vaultRoot)) {
+    const text = fs.readFileSync(note.absPath, "utf8");
+    const r = backfillDailyTasks(text, { noteDate: note.noteDate, relPath: note.relPath });
+    events.push(...r.events);
+    skipped.push(...r.skipped);
+  }
+
+  events.sort((a, b) => a.ts - b.ts || String(a.source && a.source.locator).localeCompare(String(b.source && b.source.locator)) || a.type.localeCompare(b.type));
+  return { events, skipped };
+}
+
+module.exports = {
+  PARSER_VERSION,
+  tsFromDateKey,
+  tsFromLoose,
+  taskIdFor,
+  normalizeTask,
+  backfillOverrides,
+  backfillDailyTasks,
+  collectDailyNotes,
+  backfillVault,
+};