niceeval 0.16.2-canary.98 → 0.16.2

package/dist/view/function-runtime.mjs

@@ -10344,6 +10344,7 @@ Object.freeze({
 //#region src/record/sqlite/types.ts
 var RECORD_SQLITE_FORMAT = "niceeval.project-database/0.18";
 var RECORD_SQLITE_MAX_ROW_BYTES = 1048576;
+var RECORD_SQLITE_MAX_VALIDATION_RUNS = 1e5;
 var RECORD_SQLITE_VALIDATION_DEADLINE_MS = 3e4;
 //#endregion
 //#region src/coordination/platform/node-process-identity.ts
@@ -10797,9 +10798,6 @@ function openRecordReaderAfterRuntimeAdmission(path) {
 		db.setAuthorizer(readerAuthorizer);
 		validateExactSchema(connection);
 		requireMigrationReady(connection);
-		const integrity = currentStatement(db, "PRAGMA quick_check").get();
-		if (integrity === void 0 || decodeText(integrity.quick_check, "quick_check") !== "ok") throw sqliteError("record-database-invalid", "open", "ProjectDatabase integrity check failed");
-		if (currentStatement(db, "PRAGMA foreign_key_check").get() !== void 0) throw sqliteError("record-database-invalid", "open", "ProjectDatabase foreign key closure is invalid");
 		return connection;
 	} catch (cause) {
 		db.close();
@@ -11003,137 +11001,8 @@ function hashCanonicalTuple(domain, parts) {
 	for (const part of parts) updatePart(hash, part);
 	return hash.digest("hex");
 }
-/** Durable Record identities keep both their domain and canonical tuple order here. */
-function attachmentId(input) {
-	return hashCanonicalTuple("niceeval.record.attachment-id/v1", [
-		input.runId,
-		input.owner,
-		input.owner === "attempt" ? input.attemptId ?? null : null,
-		input.family
-	]);
-}
-function contentId(attachment, logicalHandle) {
-	return hashCanonicalTuple("niceeval.record.content-id/v1", [attachment, logicalHandle]);
-}
-function attachmentLogicalIdentity(attachment, canonicalDigest, inventoryDigest) {
-	return hashCanonicalTuple("niceeval.record.attachment-logical-identity/v1", [
-		attachment,
-		canonicalDigest,
-		inventoryDigest
-	]);
-}
-function collectionItemLogicalIdentity(ordinal, canonicalDigest) {
-	return hashCanonicalTuple("niceeval.record.collection-item-logical-identity/v1", [ordinal, canonicalDigest]);
-}
-function entry(kind, identity, closure) {
-	return Object.freeze({
-		kind,
-		logicalIdentity: hashCanonicalTuple(`niceeval.record.seal.${kind}.identity/v1`, identity),
-		digest: hashCanonicalTuple(`niceeval.record.seal.${kind}.closure/v1`, closure)
-	});
-}
-var recordSealEntry = (recordDigest) => entry("record", ["record"], [recordDigest]);
-var runSealEntry = (input) => entry("run", [input.runId], [
-	input.writerGeneration,
-	input.startedAt,
-	input.coreDigest
-]);
-var slotSealEntry = (runId, slot) => entry("slot", [runId, slot.slotId], [slot.ordinal, slot.coreDigest]);
-var attemptSealEntry = (runId, attemptId, attemptLocator, coreDigest) => entry("attempt", [runId, attemptId], [attemptLocator, coreDigest]);
-var memberSealEntry = (runId, member) => entry("member", [runId, member.slotId], [
-	member.originRunId ?? null,
-	member.attemptId ?? null,
-	member.action,
-	member.coreDigest
-]);
-var attachmentSealEntry = (input) => entry("attachment", [input.attachmentId], [
-	input.ownerKind,
-	input.ownerRunId,
-	input.ownerAttemptId ?? null,
-	input.family,
-	input.familyRevision,
-	input.logicalIdentity,
-	input.canonicalDigest,
-	input.inventoryDigest
-]);
-var referenceSealEntry = (attachmentId, reference) => entry("attachment-reference", [attachmentId, reference.ordinal], [
-	reference.owner,
-	reference.family,
-	reference.referenceDigest
-]);
-var collectionItemSealEntry = (attachmentId, item) => entry("collection-item", [attachmentId, item.ordinal], [item.logicalIdentity, item.canonicalDigest]);
-var contentSealEntry = (attachmentId, content) => entry("content", [content.contentId], [
-	attachmentId,
-	content.logicalHandle,
-	content.byteLength,
-	content.digest,
-	content.chunkCount
-]);
-var contentChunkSealEntry = (contentId, ordinal, chunkDigest) => entry("content-chunk", [contentId, ordinal], [chunkDigest]);
-/** Hashes an already canonically ordered iterator without materializing it. */
-function exactLogicalSealIdentityFromOrdered(entries, count) {
-	if (!Number.isSafeInteger(count) || count < 0) throw new TypeError("logical Seal entry count is invalid");
-	const hash = createHash("sha256");
-	updatePart(hash, "niceeval.record.logical-seal/v1");
-	updatePart(hash, count);
-	let observed = 0;
-	for (const value of entries) {
-		updatePart(hash, value.kind);
-		updatePart(hash, value.logicalIdentity);
-		updatePart(hash, value.digest);
-		observed += 1;
-	}
-	if (observed !== count) throw new TypeError("logical Seal ordered iterator count changed");
-	return hash.digest("hex");
-}
 //#endregion
 //#region src/record/sqlite/storage.ts
-var DIGEST = /^[0-9a-f]{64}$/u;
-function ensurePreparedSealTables(connection) {
-	if (connection.mode !== "reader") connection.db.exec(RECORD_SQLITE_PREPARED_SEAL_TEMP_SQL);
-}
-function spillPreparedSealEntries(connection, runId, visitClosure) {
-	ensurePreparedSealTables(connection);
-	connection.db.exec("SAVEPOINT niceeval_prepare_seal");
-	try {
-		recordStatement(connection, "DELETE FROM temp.niceeval_prepared_seal_raw WHERE run_id=?").run(runId);
-		recordStatement(connection, "DELETE FROM temp.niceeval_prepared_seal_ordered WHERE run_id=?").run(runId);
-		const insertRaw = recordStatement(connection, `INSERT INTO temp.niceeval_prepared_seal_raw
-      (run_id,entry_kind,logical_identity,digest) VALUES (?,?,?,?)`);
-		let count = 0;
-		visitClosure((entry) => {
-			insertRaw.run(runId, entry.kind, entry.logicalIdentity, entry.digest);
-			count += 1;
-		});
-		const insertOrdered = recordStatement(connection, `INSERT INTO temp.niceeval_prepared_seal_ordered
-      (run_id,ordinal,entry_kind,logical_identity,digest) VALUES (?,?,?,?,?)`);
-		const orderedRows = recordStatement(connection, `SELECT entry_kind,logical_identity,digest
-      FROM temp.niceeval_prepared_seal_raw WHERE run_id=? ORDER BY entry_kind,logical_identity,digest`).iterate(runId);
-		function* ordered() {
-			let ordinal = 0;
-			for (const row of orderedRows) {
-				const entry = Object.freeze({
-					kind: sealEntryKind(row, "entry_kind"),
-					logicalIdentity: text$2(row, "logical_identity"),
-					digest: text$2(row, "digest")
-				});
-				insertOrdered.run(runId, ordinal, entry.kind, entry.logicalIdentity, entry.digest);
-				ordinal += 1;
-				yield entry;
-			}
-		}
-		const identity = exactLogicalSealIdentityFromOrdered(ordered(), count);
-		recordStatement(connection, "DELETE FROM temp.niceeval_prepared_seal_raw WHERE run_id=?").run(runId);
-		connection.db.exec("RELEASE niceeval_prepare_seal");
-		return Object.freeze({
-			identity,
-			count
-		});
-	} catch (cause) {
-		connection.db.exec("ROLLBACK TO niceeval_prepare_seal; RELEASE niceeval_prepare_seal");
-		throw cause;
-	}
-}
 function text$2(row, field) {
 	const value = row[field];
 	if (typeof value !== "string") throw sqliteError("record-database-invalid", "decode-row", `${field} is not text`);
@@ -11186,11 +11055,6 @@ function absenceMember(row) {
 		coreDigest: digestBytes(coreBytes)
 	});
 }
-function sealEntryKind(row, field) {
-	const value = text$2(row, field);
-	if (value !== "record" && value !== "run" && value !== "slot" && value !== "member" && value !== "attempt" && value !== "attachment" && value !== "attachment-reference" && value !== "collection-item" && value !== "content" && value !== "content-chunk") throw sqliteError("record-database-invalid", "decode-row", `${field} is not a Seal entry kind`);
-	return value;
-}
 function bytes(row, field) {
 	const value = row[field];
 	if (!(value instanceof Uint8Array)) throw sqliteError("record-database-invalid", "decode-row", `${field} is not bytes`);
@@ -11202,9 +11066,6 @@ function digestBytes(value) {
 function transferableBytes(value) {
 	return value.buffer instanceof ArrayBuffer && value.byteOffset === 0 && value.byteLength === value.buffer.byteLength ? value : Uint8Array.from(value);
 }
-function requireDigest(value, field) {
-	if (!DIGEST.test(value)) throw sqliteError("record-content-invalid", "persist-sealed-run", `${field} is not a lowercase sha256 digest`);
-}
 function requireIdentity$1(value, field) {
 	try {
 		assertCanonicalIdentity(value, field);
@@ -11212,269 +11073,112 @@ function requireIdentity$1(value, field) {
 		throw sqliteError("record-content-invalid", "persist-sealed-run", cause instanceof Error ? cause.message : `${field} is invalid`);
 	}
 }
-function requireAttemptLocator(attemptId, locator, operation = "persist-sealed-run") {
-	if (!parseAttemptLocator(locator).valid || encodeAttemptLocator(attemptId) !== locator) throw sqliteError("record-content-invalid", operation, `Attempt ${attemptId} locator is not its canonical projection`);
-}
 function rows(connection, sql, ...parameters) {
 	return recordStatement(connection, sql).all(...parameters);
 }
-function visitRunSealEntries(connection, runId, visit, verifyPayloadBytes = true, verifyContentChunkBytes = verifyPayloadBytes) {
-	const verified = (row, digestField, payloadField) => {
-		const value = text$2(row, digestField);
-		requireDigest(value, digestField);
-		if (verifyPayloadBytes && digestBytes(bytes(row, payloadField)) !== value) throw sqliteError("record-seal-incomplete", "verify-seal", `${payloadField} does not match ${digestField}`);
-		return value;
-	};
-	visit(recordSealEntry(verified(recordStatement(connection, "SELECT record_payload,record_digest FROM ne18_record_metadata WHERE singleton=1").get(), "record_digest", "record_payload")));
-	const run = recordStatement(connection, `SELECT run_id,writer_generation,started_at,core_payload,core_digest FROM ne18_runs WHERE run_id=?`).get(runId);
-	if (run === void 0) throw sqliteError("record-seal-incomplete", "verify-seal", `Run ${runId} is missing`);
-	visit(runSealEntry({
-		runId: text$2(run, "run_id"),
-		writerGeneration: text$2(run, "writer_generation"),
-		startedAt: text$2(run, "started_at"),
-		coreDigest: verified(run, "core_digest", "core_payload")
-	}));
-	for (const row of recordStatement(connection, "SELECT slot_id,ordinal,core_payload,core_digest FROM ne18_slots WHERE run_id=?").iterate(runId)) visit(slotSealEntry(runId, {
-		slotId: text$2(row, "slot_id"),
-		ordinal: integer$1(row, "ordinal"),
-		coreDigest: verified(row, "core_digest", "core_payload")
-	}));
-	for (const row of recordStatement(connection, "SELECT attempt_id,attempt_locator,core_payload,core_digest FROM ne18_attempts WHERE origin_run_id=?").iterate(runId)) visit(attemptSealEntry(runId, text$2(row, "attempt_id"), text$2(row, "attempt_locator"), verified(row, "core_digest", "core_payload")));
-	for (const row of recordStatement(connection, `SELECT slot_id,origin_run_id,attempt_id,action,core_payload,core_digest FROM ne18_members WHERE target_run_id=?`).iterate(runId)) visit(memberSealEntry(runId, {
-		slotId: text$2(row, "slot_id"),
-		originRunId: optionalText$1(row, "origin_run_id"),
-		attemptId: optionalText$1(row, "attempt_id"),
-		action: memberAction(row, "action"),
-		coreDigest: verified(row, "core_digest", "core_payload")
-	}));
-	for (const row of recordStatement(connection, `SELECT attachment_id,owner_kind,owner_run_id,owner_attempt_id,family,family_revision,logical_identity,
-    canonical_payload,canonical_digest,logical_inventory,inventory_digest FROM ne18_attachments WHERE owner_run_id=?`).iterate(runId)) {
-		const canonicalDigest = verified(row, "canonical_digest", "canonical_payload");
-		const inventoryDigest = verified(row, "inventory_digest", "logical_inventory");
-		visit(attachmentSealEntry({
-			attachmentId: text$2(row, "attachment_id"),
-			ownerKind: ownerKind(row, "owner_kind"),
-			ownerRunId: text$2(row, "owner_run_id"),
-			ownerAttemptId: optionalText$1(row, "owner_attempt_id"),
-			family: text$2(row, "family"),
-			familyRevision: integer$1(row, "family_revision"),
-			logicalIdentity: text$2(row, "logical_identity"),
-			canonicalDigest,
-			inventoryDigest
-		}));
-	}
-	for (const row of recordStatement(connection, `SELECT r.attachment_id,r.ordinal,r.target_owner_kind,r.target_family,r.canonical_payload,r.reference_digest
-    FROM ne18_attachment_references r JOIN ne18_attachments a ON a.attachment_id=r.attachment_id WHERE a.owner_run_id=?`).iterate(runId)) visit(referenceSealEntry(text$2(row, "attachment_id"), {
-		ordinal: integer$1(row, "ordinal"),
-		owner: ownerKind(row, "target_owner_kind"),
-		family: text$2(row, "target_family"),
-		referenceDigest: verified(row, "reference_digest", "canonical_payload")
-	}));
-	for (const row of recordStatement(connection, `SELECT i.attachment_id,i.ordinal,i.logical_identity,i.canonical_payload,i.canonical_digest
-    FROM ne18_collection_items i JOIN ne18_attachments a ON a.attachment_id=i.attachment_id WHERE a.owner_run_id=?`).iterate(runId)) visit(collectionItemSealEntry(text$2(row, "attachment_id"), {
-		ordinal: integer$1(row, "ordinal"),
-		logicalIdentity: text$2(row, "logical_identity"),
-		canonicalDigest: verified(row, "canonical_digest", "canonical_payload")
-	}));
-	for (const row of recordStatement(connection, `SELECT c.content_id,c.attachment_id,c.logical_handle,c.byte_length,c.overall_digest,c.chunk_count
-    FROM ne18_contents c JOIN ne18_attachments a ON a.attachment_id=c.attachment_id WHERE a.owner_run_id=?`).iterate(runId)) visit(contentSealEntry(text$2(row, "attachment_id"), {
-		contentId: text$2(row, "content_id"),
-		logicalHandle: text$2(row, "logical_handle"),
-		byteLength: integer$1(row, "byte_length"),
-		digest: text$2(row, "overall_digest"),
-		chunkCount: integer$1(row, "chunk_count")
-	}));
-	const chunkSql = verifyContentChunkBytes ? `SELECT c.content_id,c.ordinal,c.bytes,c.chunk_digest FROM ne18_content_chunks c
-      JOIN ne18_contents n ON n.content_id=c.content_id JOIN ne18_attachments a ON a.attachment_id=n.attachment_id WHERE a.owner_run_id=?` : `SELECT c.content_id,c.ordinal,c.chunk_digest FROM ne18_content_chunks c
-      JOIN ne18_contents n ON n.content_id=c.content_id JOIN ne18_attachments a ON a.attachment_id=n.attachment_id WHERE a.owner_run_id=?`;
-	for (const row of recordStatement(connection, chunkSql).iterate(runId)) {
-		const chunkDigest = text$2(row, "chunk_digest");
-		requireDigest(chunkDigest, "chunk_digest");
-		if (verifyContentChunkBytes && digestBytes(bytes(row, "bytes")) !== chunkDigest) throw sqliteError("record-seal-incomplete", "verify-seal", "bytes does not match chunk_digest");
-		visit(contentChunkSealEntry(text$2(row, "content_id"), integer$1(row, "ordinal"), chunkDigest));
-	}
-}
-function runRow(connection, runId) {
-	return recordStatement(connection, `SELECT run_id,status,writer_generation,started_at,core_payload,core_digest,mutation_sequence,
-    candidate_seal_identity,candidate_seal_entry_count,candidate_seal_staged_count,logical_seal_identity FROM ne18_runs WHERE run_id=?`).get(runId);
-}
 function assertBoundedBatch(operation, rowCount, byteCount) {
 	if (!Number.isSafeInteger(rowCount) || rowCount < 0 || !Number.isSafeInteger(byteCount) || byteCount < 0 || rowCount > 4096 || byteCount > 8388608) throw sqliteError("record-resource-limit-exceeded", operation, `staging batch exceeds its bound (${rowCount} rows, ${byteCount} bytes)`);
 }
-function verifyStoredSealStreaming(connection, runId, identity, expectedCount) {
-	ensurePreparedSealTables(connection);
-	try {
-		verifyRunPayloadClosures(connection, runId, true);
-		const actual = spillPreparedSealEntries(connection, runId, (visit) => visitRunSealEntries(connection, runId, visit, true, false));
-		if (actual.count !== expectedCount || actual.identity !== identity) throw sqliteError("record-seal-incomplete", "verify-seal", `Run ${runId} exact Seal identity or count differs from its closure`);
-		const statement = recordStatement(connection, `SELECT entry_kind,logical_identity,digest FROM ne18_run_seal_entries
-      WHERE run_id=? AND ordinal=?`);
-		let ordinal = 0;
-		for (const row of recordStatement(connection, `SELECT ordinal,entry_kind,logical_identity,digest
-      FROM temp.niceeval_prepared_seal_ordered WHERE run_id=? ORDER BY ordinal`).iterate(runId)) {
-			if (integer$1(row, "ordinal") !== ordinal) throw sqliteError("record-seal-incomplete", "verify-seal", `Run ${runId} prepared Seal ordinals are not contiguous`);
-			const entry = {
-				kind: sealEntryKind(row, "entry_kind"),
-				logicalIdentity: text$2(row, "logical_identity"),
-				digest: text$2(row, "digest")
-			};
-			const stored = statement.get(runId, ordinal);
-			if (stored === void 0 || sealEntryKind(stored, "entry_kind") !== entry.kind || text$2(stored, "logical_identity") !== entry.logicalIdentity || text$2(stored, "digest") !== entry.digest) throw sqliteError("record-seal-incomplete", "verify-seal", `Run ${runId} Seal entry ${ordinal} differs from its closure`);
-			ordinal += 1;
-		}
-		const storedCount = recordStatement(connection, "SELECT count(*) AS count FROM ne18_run_seal_entries WHERE run_id=?").get(runId);
-		if (ordinal !== expectedCount || integer$1(storedCount, "count") !== ordinal) throw sqliteError("record-seal-incomplete", "verify-seal", `Run ${runId} exact Seal does not match its closure`);
-	} finally {
-		recordStatement(connection, "DELETE FROM temp.niceeval_prepared_seal_raw WHERE run_id=?").run(runId);
-		recordStatement(connection, "DELETE FROM temp.niceeval_prepared_seal_ordered WHERE run_id=?").run(runId);
-	}
-}
-function verifyAllSealedRuns(connection, requireSealedOnly = false, deadlineEpochMs = Date.now() + RECORD_SQLITE_VALIDATION_DEADLINE_MS) {
-	const checkDeadline = () => {
-		if (!Number.isSafeInteger(deadlineEpochMs) || Date.now() >= deadlineEpochMs) throw sqliteError("record-resource-limit-exceeded", "verify-database", "Record validation exceeded its deadline");
-	};
-	checkDeadline();
-	const admission = recordStatement(connection, `SELECT
-    (SELECT count(*) FROM ne18_runs) run_count,
-    (SELECT count(*) FROM ne18_runs)+(SELECT count(*) FROM ne18_slots)+(SELECT count(*) FROM ne18_attempts)+(SELECT count(*) FROM ne18_members)+
-      (SELECT count(*) FROM ne18_attachments)+(SELECT count(*) FROM ne18_attachment_references)+(SELECT count(*) FROM ne18_collection_items)+
-      (SELECT count(*) FROM ne18_contents)+(SELECT count(*) FROM ne18_content_chunks)+(SELECT count(*) FROM ne18_run_seal_entries) row_count`).get();
-	if (integer$1(admission, "run_count") > 1e5 || integer$1(admission, "row_count") > 2e6) throw sqliteError("record-resource-limit-exceeded", "verify-database", "Record validation inventory exceeds its hostile-input ceiling");
-	const integrity = recordStatement(connection, "PRAGMA quick_check").all();
-	checkDeadline();
-	if (integrity.length !== 1 || text$2(integrity[0], "quick_check") !== "ok") throw sqliteError("record-database-invalid", "verify-database", "SQLite quick_check failed");
-	if (recordStatement(connection, "PRAGMA foreign_key_check").all().length !== 0) throw sqliteError("record-database-invalid", "verify-database", "foreign key check failed");
-	const runRows = recordStatement(connection, "SELECT run_id,status,logical_seal_identity FROM ne18_runs ORDER BY run_id").iterate();
-	let sealed = 0;
-	for (const row of runRows) {
-		checkDeadline();
-		const runId = text$2(row, "run_id");
-		if (text$2(row, "status") !== "sealed") {
-			if (requireSealedOnly) throw sqliteError("record-database-invalid", "verify-database", `database contains unpublished run ${runId}`);
-			continue;
-		}
-		sealed += 1;
-		const header = runRow(connection, runId);
-		if (integer$1(header, "candidate_seal_staged_count") !== integer$1(header, "candidate_seal_entry_count")) throw sqliteError("record-seal-incomplete", "verify-database", `Run ${runId} staged Seal inventory is incomplete`);
-		verifyStoredSealStreaming(connection, runId, text$2(row, "logical_seal_identity"), integer$1(header, "candidate_seal_entry_count"));
-	}
-	checkDeadline();
-	return sealed;
-}
-function verifyRunPayloadClosures(connection, runId, verifyPayloadBytes = true) {
-	const attempts = recordStatement(connection, "SELECT attempt_id,attempt_locator FROM ne18_attempts WHERE origin_run_id=?").iterate(runId);
-	for (const attempt of attempts) {
-		const attemptId = text$2(attempt, "attempt_id");
-		const locator = text$2(attempt, "attempt_locator");
-		try {
-			requireAttemptLocator(attemptId, locator, "verify-seal");
-		} catch (cause) {
-			throw sqliteError("record-seal-incomplete", "verify-seal", cause instanceof Error ? cause.message : `Attempt ${attemptId} locator is invalid`);
-		}
-	}
-	const attachments = recordStatement(connection, `SELECT attachment_id,owner_kind,owner_run_id,owner_attempt_id,family,family_revision,
-    logical_identity,canonical_digest,logical_inventory,inventory_digest FROM ne18_attachments WHERE owner_run_id=?`).iterate(runId);
-	for (const attachment of attachments) {
-		const attachmentId$1 = text$2(attachment, "attachment_id");
-		if (digestBytes(bytes(attachment, "logical_inventory")) !== text$2(attachment, "inventory_digest")) throw sqliteError("record-seal-incomplete", "verify-seal", `attachment ${attachmentId$1} inventory digest is invalid`);
-		const owner = ownerKind(attachment, "owner_kind");
-		const expectedAttachmentId = attachmentId({
-			runId: text$2(attachment, "owner_run_id"),
-			owner,
-			...owner === "attempt" ? { attemptId: optionalText$1(attachment, "owner_attempt_id") ?? void 0 } : {},
-			family: text$2(attachment, "family")
-		});
-		const expectedLogicalIdentity = attachmentLogicalIdentity(attachmentId$1, text$2(attachment, "canonical_digest"), text$2(attachment, "inventory_digest"));
-		if (attachmentId$1 !== expectedAttachmentId || text$2(attachment, "logical_identity") !== expectedLogicalIdentity || integer$1(attachment, "family_revision") < 1) throw sqliteError("record-seal-incomplete", "verify-seal", `attachment ${attachmentId$1} logical identity is invalid`);
-		for (const [label, counts] of [["reference", recordStatement(connection, "SELECT count(*) AS count,min(ordinal) AS minimum,max(ordinal) AS maximum FROM ne18_attachment_references WHERE attachment_id=?").get(attachmentId$1)], ["collection item", recordStatement(connection, "SELECT count(*) AS count,min(ordinal) AS minimum,max(ordinal) AS maximum FROM ne18_collection_items WHERE attachment_id=?").get(attachmentId$1)]]) {
-			const decoded = counts;
-			const count = integer$1(decoded, "count");
-			if (count > 0 && (optionalInteger(decoded, "minimum") !== 0 || optionalInteger(decoded, "maximum") !== count - 1)) throw sqliteError("record-seal-incomplete", "verify-seal", `attachment ${attachmentId$1} ${label} ordinals are not contiguous`);
-		}
-	}
-	const items = recordStatement(connection, `SELECT i.attachment_id,i.ordinal,i.logical_identity,i.canonical_digest FROM ne18_collection_items i
-    JOIN ne18_attachments a ON a.attachment_id=i.attachment_id WHERE a.owner_run_id=?`).iterate(runId);
-	for (const item of items) {
-		const expected = collectionItemLogicalIdentity(integer$1(item, "ordinal"), text$2(item, "canonical_digest"));
-		if (text$2(item, "logical_identity") !== expected) throw sqliteError("record-seal-incomplete", "verify-seal", `collection item ${text$2(item, "attachment_id")}/${integer$1(item, "ordinal")} logical identity is invalid`);
-	}
-	const coverage = recordStatement(connection, `SELECT
-    (SELECT count(*) FROM ne18_slots WHERE run_id=?) slot_count,
-    (SELECT count(*) FROM ne18_members WHERE target_run_id=?) member_count,
-    (SELECT count(*) FROM ne18_slots s LEFT JOIN ne18_members m ON m.target_run_id=s.run_id AND m.slot_id=s.slot_id
-      WHERE s.run_id=? AND m.slot_id IS NULL) missing_count`).get(runId, runId, runId);
-	if (integer$1(coverage, "slot_count") !== integer$1(coverage, "member_count") || integer$1(coverage, "missing_count") !== 0) throw sqliteError("record-seal-incomplete", "verify-seal", `Run ${runId} does not have exactly one Member per Slot`);
-	const references = recordStatement(connection, `SELECT r.attachment_id,r.ordinal,r.target_owner_kind,r.target_family,
-    a.owner_kind source_owner_kind,a.owner_run_id,a.owner_attempt_id FROM ne18_attachment_references r
-    JOIN ne18_attachments a ON a.attachment_id=r.attachment_id WHERE a.owner_run_id=?`).iterate(runId);
-	for (const reference of references) {
-		const targetOwner = text$2(reference, "target_owner_kind");
-		const sourceOwner = text$2(reference, "source_owner_kind");
-		if (targetOwner === "attempt" && sourceOwner !== "attempt") throw sqliteError("record-seal-incomplete", "verify-seal", `run-owned attachment ${text$2(reference, "attachment_id")} cannot resolve an attempt reference`);
-		if (integer$1(targetOwner === "run" ? recordStatement(connection, `SELECT count(*) AS count FROM ne18_attachments WHERE owner_kind='run' AND owner_run_id=? AND family=?`).get(text$2(reference, "owner_run_id"), text$2(reference, "target_family")) : recordStatement(connection, `SELECT count(*) AS count FROM ne18_attachments WHERE owner_kind='attempt' AND owner_run_id=? AND owner_attempt_id=? AND family=?`).get(text$2(reference, "owner_run_id"), text$2(reference, "owner_attempt_id"), text$2(reference, "target_family")), "count") !== 1) throw sqliteError("record-seal-incomplete", "verify-seal", `reference ${text$2(reference, "attachment_id")}/${integer$1(reference, "ordinal")} target family is missing`);
-	}
-	const contents = recordStatement(connection, `SELECT c.content_id,c.attachment_id,c.logical_handle,c.byte_length,c.overall_digest,c.chunk_count FROM ne18_contents c
-    JOIN ne18_attachments a ON a.attachment_id=c.attachment_id WHERE a.owner_run_id=?`).iterate(runId);
-	for (const content of contents) {
-		const contentId$1 = text$2(content, "content_id");
-		if (contentId$1 !== contentId(text$2(content, "attachment_id"), text$2(content, "logical_handle"))) throw sqliteError("record-seal-incomplete", "verify-seal", `content ${contentId$1} logical handle is invalid`);
-		if (verifyPayloadBytes) {
-			const hash = createHash("sha256");
-			let byteLength = 0;
-			let ordinal = 0;
-			const chunks = recordStatement(connection, "SELECT ordinal,bytes,chunk_digest FROM ne18_content_chunks WHERE content_id=? ORDER BY ordinal").iterate(contentId$1);
-			for (const chunk of chunks) {
-				if (integer$1(chunk, "ordinal") !== ordinal) throw sqliteError("record-seal-incomplete", "verify-seal", `content ${contentId$1} chunk ordinals are invalid`);
-				const value = bytes(chunk, "bytes");
-				if (digestBytes(value) !== text$2(chunk, "chunk_digest")) throw sqliteError("record-seal-incomplete", "verify-seal", `content ${contentId$1}/${ordinal} digest is invalid`);
-				hash.update(value);
-				byteLength += value.byteLength;
-				ordinal += 1;
-			}
-			if (ordinal !== integer$1(content, "chunk_count") || byteLength !== integer$1(content, "byte_length") || hash.digest("hex") !== text$2(content, "overall_digest")) throw sqliteError("record-seal-incomplete", "verify-seal", `content ${contentId$1} whole digest is invalid`);
-		} else {
-			const aggregate = recordStatement(connection, `SELECT count(*) AS count,min(ordinal) AS minimum,max(ordinal) AS maximum,
-        coalesce(sum(length(bytes)),0) AS byte_length FROM ne18_content_chunks WHERE content_id=?`).get(contentId$1);
-			const chunkCount = integer$1(content, "chunk_count");
-			if (integer$1(aggregate, "count") !== chunkCount || integer$1(aggregate, "byte_length") !== integer$1(content, "byte_length") || chunkCount > 0 && (optionalInteger(aggregate, "minimum") !== 0 || optionalInteger(aggregate, "maximum") !== chunkCount - 1)) throw sqliteError("record-seal-incomplete", "verify-seal", `content ${contentId$1} durable chunk closure is invalid`);
-			for (const chunk of recordStatement(connection, "SELECT chunk_digest FROM ne18_content_chunks WHERE content_id=?").iterate(contentId$1)) requireDigest(text$2(chunk, "chunk_digest"), `content ${contentId$1} chunk digest`);
-		}
-	}
-}
+/** Summary metadata never materializes Core, Attachment payload or collection rows. */
 function readSealedRunSummary(connection, runId) {
-	const published = readPublishedSealedRun(connection, runId);
-	if (published === void 0) return;
-	return published.summary;
+	const row = recordStatement(connection, `SELECT r.run_id,r.writer_generation,r.started_at,
+    coalesce(r.logical_seal_identity,'published:' || (SELECT max(p.published_revision)
+      FROM ne18_attempt_publications p WHERE p.origin_run_id=r.run_id)) logical_seal_identity,
+    (SELECT count(*) FROM ne18_slots WHERE run_id=r.run_id) slot_count,
+    CASE WHEN EXISTS (SELECT 1 FROM ne18_run_resources WHERE run_id=r.run_id) THEN
+      (SELECT count(*) FROM ne18_run_slot_bindings WHERE target_run_id=r.run_id)+
+      (SELECT count(*) FROM ne18_run_slot_absences WHERE run_id=r.run_id)
+      ELSE (SELECT count(*) FROM ne18_members WHERE target_run_id=r.run_id) END member_count,
+    (SELECT count(*) FROM ne18_attempts a WHERE a.origin_run_id=r.run_id AND
+      (NOT EXISTS (SELECT 1 FROM ne18_run_resources WHERE run_id=r.run_id) OR EXISTS
+       (SELECT 1 FROM ne18_attempt_publications p WHERE p.origin_run_id=a.origin_run_id AND p.attempt_id=a.attempt_id))) attempt_count,
+    (SELECT count(*) FROM ne18_attachments a WHERE a.owner_run_id=r.run_id AND a.canonical_payload IS NOT NULL AND
+      (a.owner_kind='run' OR NOT EXISTS (SELECT 1 FROM ne18_run_resources WHERE run_id=r.run_id) OR EXISTS
+       (SELECT 1 FROM ne18_attempt_publications p WHERE p.origin_run_id=a.owner_run_id AND p.attempt_id=a.owner_attempt_id))) attachment_count,
+    (SELECT count(*) FROM ne18_contents c JOIN ne18_attachments a ON a.attachment_id=c.attachment_id
+      WHERE a.owner_run_id=r.run_id AND a.canonical_payload IS NOT NULL AND
+      (a.owner_kind='run' OR NOT EXISTS (SELECT 1 FROM ne18_run_resources WHERE run_id=r.run_id) OR EXISTS
+       (SELECT 1 FROM ne18_attempt_publications p WHERE p.origin_run_id=a.owner_run_id AND p.attempt_id=a.owner_attempt_id))) content_count,
+    (SELECT coalesce(sum(c.byte_length),0) FROM ne18_contents c JOIN ne18_attachments a ON a.attachment_id=c.attachment_id
+      WHERE a.owner_run_id=r.run_id AND a.canonical_payload IS NOT NULL AND
+      (a.owner_kind='run' OR NOT EXISTS (SELECT 1 FROM ne18_run_resources WHERE run_id=r.run_id) OR EXISTS
+       (SELECT 1 FROM ne18_attempt_publications p WHERE p.origin_run_id=a.owner_run_id AND p.attempt_id=a.owner_attempt_id))) content_bytes,
+    (SELECT count(*) FROM ne18_run_seal_entries WHERE run_id=r.run_id) seal_count
+    FROM ne18_runs r WHERE r.run_id=? AND NOT EXISTS
+      (SELECT 1 FROM ne18_run_deletion_tombstones d WHERE d.run_id=r.run_id)
+      AND (r.status='sealed' OR EXISTS (SELECT 1 FROM ne18_attempt_publications p WHERE p.origin_run_id=r.run_id))`).get(runId);
+	if (row === void 0) return void 0;
+	return Object.freeze({
+		runId: text$2(row, "run_id"),
+		writerGeneration: text$2(row, "writer_generation"),
+		startedAt: text$2(row, "started_at"),
+		logicalSealIdentity: text$2(row, "logical_seal_identity"),
+		slotCount: integer$1(row, "slot_count"),
+		memberCount: integer$1(row, "member_count"),
+		attemptCount: integer$1(row, "attempt_count"),
+		attachmentCount: integer$1(row, "attachment_count"),
+		contentCount: integer$1(row, "content_count"),
+		contentByteLength: integer$1(row, "content_bytes"),
+		sealEntryCount: integer$1(row, "seal_count")
+	});
+}
+/** Pinned publication identity, plus a metadata-only count; no Seal hashing. */
+function readSealedRunCutoff(connection, identity) {
+	const row = recordStatement(connection, `SELECT count(*) count FROM ne18_runs r
+    WHERE NOT EXISTS (SELECT 1 FROM ne18_run_deletion_tombstones d WHERE d.run_id=r.run_id)
+      AND (status='sealed' OR EXISTS (SELECT 1 FROM ne18_attempt_publications p WHERE p.origin_run_id=r.run_id))`).get();
+	return Object.freeze({
+		identity,
+		runCount: integer$1(row, "count")
+	});
+}
+/** Filter lightweight Run metadata before loading any selected Core or payload. */
+function findExperimentRunIds(connection, experimentId) {
+	requireIdentity$1(experimentId, "experimentId");
+	const selected = rows(connection, `SELECT r.run_id FROM ne18_runs r
+    LEFT JOIN ne18_run_resources resource ON resource.run_id=r.run_id
+    WHERE coalesce(resource.experiment_id,json_extract(r.core_payload,'$.experimentId'))=?
+      AND NOT EXISTS (SELECT 1 FROM ne18_run_deletion_tombstones d WHERE d.run_id=r.run_id)
+      AND (r.status='sealed' OR EXISTS (SELECT 1 FROM ne18_attempt_publications p WHERE p.origin_run_id=r.run_id))
+    ORDER BY r.run_id LIMIT ?`, experimentId, RECORD_SQLITE_MAX_VALIDATION_RUNS + 1);
+	if (selected.length > 1e5) throw sqliteError("record-resource-limit-exceeded", "find-experiment-runs", "Experiment exceeds its Run ceiling");
+	return Object.freeze(selected.map((row) => text$2(row, "run_id")));
 }
 /**
 * Computes the stable sealed cutoff without retaining the inventory, then
 * returns one bounded page from the same caller-owned read transaction.
 */
-function readSealedRunSummaryPage(connection, afterRunId = "", pageSize = 100, expectedCutoffIdentity, deadlineEpochMs = Date.now() + RECORD_SQLITE_VALIDATION_DEADLINE_MS) {
+function readSealedRunSummaryPage(connection, afterRunId = "", pageSize = 100, expectedCutoffIdentity, deadlineEpochMs = Date.now() + RECORD_SQLITE_VALIDATION_DEADLINE_MS, pinnedCutoff) {
 	requireIdentity$1(afterRunId === "" ? "start" : afterRunId, "afterRunId");
 	if (!Number.isSafeInteger(pageSize) || pageSize < 1 || pageSize > 256) throw sqliteError("record-resource-limit-exceeded", "page-sealed-runs", "page size must be between 1 and 256");
-	const cutoffHash = createHash("sha256");
-	cutoffHash.update("[");
-	let runCount = 0;
-	const inventory = recordStatement(connection, `SELECT run_id,
-    coalesce(logical_seal_identity,'published:' || (SELECT max(p.published_revision) FROM ne18_attempt_publications p
-      WHERE p.origin_run_id=ne18_runs.run_id)) logical_seal_identity
-    FROM ne18_runs WHERE NOT EXISTS (SELECT 1 FROM ne18_run_deletion_tombstones d WHERE d.run_id=ne18_runs.run_id)
-      AND (status='sealed' OR EXISTS
-        (SELECT 1 FROM ne18_attempt_publications p WHERE p.origin_run_id=ne18_runs.run_id))
-    ORDER BY run_id`).iterate();
-	for (const row of inventory) {
-		if (runCount >= 1e5) throw sqliteError("record-resource-limit-exceeded", "page-sealed-runs", "sealed cutoff exceeds its Run ceiling");
-		if ((runCount & 255) === 0 && Date.now() >= deadlineEpochMs) throw sqliteError("record-resource-limit-exceeded", "page-sealed-runs", "sealed cutoff exceeded its deadline");
-		if (runCount > 0) cutoffHash.update(",");
-		cutoffHash.update(JSON.stringify({
-			runId: text$2(row, "run_id"),
-			logicalSealIdentity: text$2(row, "logical_seal_identity")
-		}));
-		runCount += 1;
-	}
-	cutoffHash.update("]");
-	const identity = cutoffHash.digest("hex");
+	const { identity, runCount } = pinnedCutoff ?? (() => {
+		const cutoffHash = createHash("sha256");
+		cutoffHash.update("[");
+		let runCount = 0;
+		const inventory = recordStatement(connection, `SELECT run_id,
+      coalesce(logical_seal_identity,'published:' || (SELECT max(p.published_revision) FROM ne18_attempt_publications p
+        WHERE p.origin_run_id=ne18_runs.run_id)) logical_seal_identity
+      FROM ne18_runs WHERE NOT EXISTS (SELECT 1 FROM ne18_run_deletion_tombstones d WHERE d.run_id=ne18_runs.run_id)
+        AND (status='sealed' OR EXISTS
+          (SELECT 1 FROM ne18_attempt_publications p WHERE p.origin_run_id=ne18_runs.run_id))
+      ORDER BY run_id`).iterate();
+		for (const row of inventory) {
+			if (runCount >= 1e5) throw sqliteError("record-resource-limit-exceeded", "page-sealed-runs", "sealed cutoff exceeds its Run ceiling");
+			if ((runCount & 255) === 0 && Date.now() >= deadlineEpochMs) throw sqliteError("record-resource-limit-exceeded", "page-sealed-runs", "sealed cutoff exceeded its deadline");
+			if (runCount > 0) cutoffHash.update(",");
+			cutoffHash.update(JSON.stringify({
+				runId: text$2(row, "run_id"),
+				logicalSealIdentity: text$2(row, "logical_seal_identity")
+			}));
+			runCount += 1;
+		}
+		cutoffHash.update("]");
+		const identity = cutoffHash.digest("hex");
+		return Object.freeze({
+			identity,
+			runCount
+		});
+	})();
 	if (expectedCutoffIdentity !== void 0 && expectedCutoffIdentity !== identity) throw sqliteError("record-command-conflict", "page-sealed-runs", "sealed cutoff changed; restart pagination");
 	const pageRows = rows(connection, `SELECT run_id FROM ne18_runs WHERE run_id>?
     AND NOT EXISTS (SELECT 1 FROM ne18_run_deletion_tombstones d WHERE d.run_id=ne18_runs.run_id)
@@ -11593,8 +11297,15 @@ function readCollectionItemPage(connection, attachmentId, afterOrdinal, pageSize
 		nextOrdinal
 	});
 }
-/** Bounded sealed Core projection. Collection item bytes and Content chunk bytes are never selected. */
-function readPublishedSealedRun(connection, runId) {
+function memoRecordRead(read, defer) {
+	if (defer === void 0) {
+		const value = read();
+		return () => value;
+	}
+	let cached;
+	return () => defer(() => (cached ??= { value: read() }).value);
+}
+function readPublishedSealedRun(connection, runId, defer) {
 	const run = recordStatement(connection, `SELECT run_id,writer_generation,started_at,status,
     coalesce(logical_seal_identity,'published:' || (SELECT max(p.published_revision) FROM ne18_attempt_publications p
       WHERE p.origin_run_id=ne18_runs.run_id)) logical_seal_identity,core_payload,core_digest,
@@ -11706,30 +11417,42 @@ function readPublishedSealedRun(connection, runId) {
 		});
 	});
 	const attachments = rows(connection, `SELECT attachment_id,owner_kind,owner_run_id,owner_attempt_id,family,family_revision,
-    logical_identity,canonical_payload,canonical_digest,logical_inventory,inventory_digest,
-    (SELECT count(*) FROM ne18_collection_items i WHERE i.attachment_id=a.attachment_id) item_count,
-    (SELECT coalesce(sum(length(i.canonical_payload)),0) FROM ne18_collection_items i WHERE i.attachment_id=a.attachment_id) item_bytes
+    logical_identity,canonical_digest,inventory_digest
     FROM ne18_attachments a WHERE owner_run_id=?${publicationManaged ? ` AND canonical_payload IS NOT NULL AND
       (owner_kind='run' OR EXISTS (SELECT 1 FROM ne18_attempt_publications p
         WHERE p.origin_run_id=a.owner_run_id AND p.attempt_id=a.owner_attempt_id))` : ""} ORDER BY attachment_id`, runId).map((row) => {
 		const attachmentId = text$2(row, "attachment_id");
-		if (!(row.canonical_payload instanceof Uint8Array)) throw sqliteError("record-database-invalid", "read-published-run-core", `Attachment ${attachmentId} is not published`);
-		const references = rows(connection, `SELECT ordinal,target_owner_kind,target_family,canonical_payload,reference_digest
+		const payload = memoRecordRead(() => {
+			const stored = recordStatement(connection, `SELECT canonical_payload,logical_inventory FROM ne18_attachments WHERE attachment_id=?`).get(attachmentId);
+			return {
+				canonicalBytes: transferableBytes(bytes(stored, "canonical_payload")),
+				logicalInventoryBytes: transferableBytes(bytes(stored, "logical_inventory"))
+			};
+		}, defer);
+		const references = memoRecordRead(() => Object.freeze(rows(connection, `SELECT ordinal,target_owner_kind,target_family,canonical_payload,reference_digest
       FROM ne18_attachment_references WHERE attachment_id=? ORDER BY ordinal`, attachmentId).map((reference) => Object.freeze({
 			ordinal: integer$1(reference, "ordinal"),
 			owner: ownerKind(reference, "target_owner_kind"),
 			family: text$2(reference, "target_family"),
 			canonicalBytes: transferableBytes(bytes(reference, "canonical_payload")),
 			referenceDigest: text$2(reference, "reference_digest")
-		}));
-		const contents = rows(connection, `SELECT content_id,logical_handle,byte_length,overall_digest,chunk_count
+		}))), defer);
+		const contents = memoRecordRead(() => Object.freeze(rows(connection, `SELECT content_id,logical_handle,byte_length,overall_digest,chunk_count
       FROM ne18_contents WHERE attachment_id=? ORDER BY content_id`, attachmentId).map((content) => Object.freeze({
 			contentId: text$2(content, "content_id"),
 			logicalHandle: text$2(content, "logical_handle"),
 			byteLength: integer$1(content, "byte_length"),
 			digest: text$2(content, "overall_digest"),
 			chunkCount: integer$1(content, "chunk_count")
-		}));
+		}))), defer);
+		const collection = memoRecordRead(() => {
+			const aggregate = recordStatement(connection, `SELECT count(*) item_count,coalesce(sum(length(canonical_payload)),0) item_bytes
+        FROM ne18_collection_items WHERE attachment_id=?`).get(attachmentId);
+			return {
+				count: integer$1(aggregate, "item_count"),
+				byteLength: integer$1(aggregate, "item_bytes")
+			};
+		}, defer);
 		return Object.freeze({
 			attachmentId,
 			ownerKind: ownerKind(row, "owner_kind"),
@@ -11738,14 +11461,26 @@ function readPublishedSealedRun(connection, runId) {
 			family: text$2(row, "family"),
 			familyRevision: integer$1(row, "family_revision"),
 			logicalIdentity: text$2(row, "logical_identity"),
-			canonicalBytes: transferableBytes(bytes(row, "canonical_payload")),
+			get canonicalBytes() {
+				return payload().canonicalBytes;
+			},
 			canonicalDigest: text$2(row, "canonical_digest"),
-			logicalInventoryBytes: transferableBytes(bytes(row, "logical_inventory")),
+			get logicalInventoryBytes() {
+				return payload().logicalInventoryBytes;
+			},
 			inventoryDigest: text$2(row, "inventory_digest"),
-			references: Object.freeze(references),
-			collectionItemCount: integer$1(row, "item_count"),
-			collectionItemByteLength: integer$1(row, "item_bytes"),
-			contents: Object.freeze(contents)
+			get references() {
+				return references();
+			},
+			get contents() {
+				return contents();
+			},
+			get collectionItemCount() {
+				return collection().count;
+			},
+			get collectionItemByteLength() {
+				return collection().byteLength;
+			}
 		});
 	});
 	const core = Object.freeze({
@@ -11766,30 +11501,16 @@ function readPublishedSealedRun(connection, runId) {
 		members: Object.freeze(members),
 		attachments: Object.freeze(attachments)
 	});
-	const contentCount = core.attachments.reduce((count, attachment) => count + attachment.contents.length, 0);
-	const contentByteLength = core.attachments.reduce((count, attachment) => count + attachment.contents.reduce((subtotal, content) => subtotal + content.byteLength, 0), 0);
-	const seal = recordStatement(connection, "SELECT count(*) seal_count FROM ne18_run_seal_entries WHERE run_id=?").get(runId);
-	const summary = Object.freeze({
-		runId: core.runId,
-		writerGeneration: core.writerGeneration,
-		startedAt: core.startedAt,
-		logicalSealIdentity: core.logicalSealIdentity,
-		slotCount: core.slots.length,
-		memberCount: core.members.length,
-		attemptCount: core.attempts.length,
-		attachmentCount: core.attachments.length,
-		contentCount,
-		contentByteLength,
-		sealEntryCount: integer$1(seal, "seal_count")
-	});
 	return Object.freeze({
 		core,
-		summary
+		get summary() {
+			return readSealedRunSummary(connection, runId);
+		}
 	});
 }
-/** Compatibility-shaped Core read backed by the sole publication projection. */
-function readSealedRunCore(connection, runId) {
-	return readPublishedSealedRun(connection, runId)?.core;
+/** Inspection may defer Attachment reads within its existing pinned session. */
+function readSealedRunCore(connection, runId, defer) {
+	return readPublishedSealedRun(connection, runId, defer)?.core;
 }
 /** Fixed, decoded projection sufficient to rebuild sealed Core and attachment metadata. */
 function readSealedRunDocument(connection, runId) {
@@ -12670,7 +12391,7 @@ function publicationCutoffIdentity(cutoff) {
 }
 //#endregion
 //#region src/record/sqlite/index.ts
-function openPinnedRecordReadSession(path, kind, deadlineEpochMs, validation = "complete") {
+function openPinnedRecordReadSession(path, kind, deadlineEpochMs) {
 	if (!Number.isSafeInteger(deadlineEpochMs) || deadlineEpochMs <= Date.now()) throw sqliteError("record-resource-limit-exceeded", "open-read-session", "pinned read deadline must be a future safe integer");
 	const connection = openImmutableRecordReader(path);
 	let closed = false;
@@ -12701,13 +12422,15 @@ function openPinnedRecordReadSession(path, kind, deadlineEpochMs, validation = "
 		const publicationCutoff = currentPublicationCutoffOnConnection(connection);
 		const cutoffIdentity = publicationCutoffIdentity(publicationCutoff);
 		validateExactSchema(connection);
-		if (validation === "complete") verifyAllSealedRuns(connection, false, deadlineEpochMs);
-		else if (kind !== "private-generation") throw sqliteError("record-database-invalid", "open-read-session", "only an admitted private generation may skip repeated validation");
+		let sealedCutoff;
+		const readCutoff = () => sealedCutoff ??= readBounded("read-sealed-cutoff", () => readSealedRunCutoff(connection, cutoffIdentity));
 		assertUsable("open-read-session");
 		return Object.freeze({
 			kind,
 			deadlineEpochMs,
 			publicationCutoff: () => publicationCutoff,
+			sealedCutoff: readCutoff,
+			findExperimentRunIds: (experimentId) => readBounded("find-experiment-runs", () => findExperimentRunIds(connection, experimentId)),
 			readRunResource: (runId) => readBounded("read-run-resource", () => readRunResourceOnConnection(connection, runId, publicationCutoff)),
 			listRunResources: (input) => readBounded("list-run-resources", () => listRunResourcesOnConnection(connection, {
 				...input,
@@ -12716,7 +12439,7 @@ function openPinnedRecordReadSession(path, kind, deadlineEpochMs, validation = "
 			readSealedRunSummary: (runId) => readBounded("read-sealed-run-summary", () => readSealedRunSummary(connection, runId)),
 			readSealedRunSummaryPage: (afterRunId = "", pageSize = 100, expectedCutoffIdentity) => readBounded("page-sealed-runs", () => {
 				if (expectedCutoffIdentity !== void 0 && expectedCutoffIdentity !== cutoffIdentity) throw sqliteError("record-command-conflict", "page-sealed-runs", "publication cutoff changed; restart pagination");
-				const page = readSealedRunSummaryPage(connection, afterRunId, pageSize, void 0, deadlineEpochMs);
+				const page = readSealedRunSummaryPage(connection, afterRunId, pageSize, void 0, deadlineEpochMs, readCutoff());
 				return Object.freeze({
 					...page,
 					cutoff: Object.freeze({
@@ -12727,7 +12450,7 @@ function openPinnedRecordReadSession(path, kind, deadlineEpochMs, validation = "
 			}),
 			findAttemptLocatorCandidates: (locator, maximumCandidateRuns) => readBounded("find-attempt-locator", () => findAttemptLocatorCandidates(connection, locator, maximumCandidateRuns)),
 			readSealedRunDocument: (runId) => readBounded("read-sealed-run-document", () => readSealedRunDocument(connection, runId)),
-			readSealedRunCore: (runId) => readBounded("read-sealed-run-core", () => readSealedRunCore(connection, runId)),
+			readSealedRunCore: (runId, lazyAttachments = false) => readBounded("read-sealed-run-core", () => readSealedRunCore(connection, runId, lazyAttachments ? (read) => readBounded("read-sealed-attachment", read) : void 0)),
 			readContentChunkPage: (contentId, afterOrdinal, pageSize) => readBounded("read-content-page", () => readContentChunkPage(connection, contentId, afterOrdinal, pageSize)),
 			readCollectionItemPage: (attachmentId, afterOrdinal, pageSize) => readBounded("read-collection-page", () => readCollectionItemPage(connection, attachmentId, afterOrdinal, pageSize)),
 			close
@@ -12764,7 +12487,7 @@ Effect.fn("acquireProjectRecordReadSession")(function* (recordStorageRoot) {
 });
 /** Opens only a private generation already admitted by the hostile importer. */
 function openHostOwnedRecordReadSession(generationPath, deadlineEpochMs = Date.now() + RECORD_SQLITE_VALIDATION_DEADLINE_MS) {
-	return openPinnedRecordReadSession(generationPath, "private-generation", deadlineEpochMs, "host-validated-generation");
+	return openPinnedRecordReadSession(generationPath, "private-generation", deadlineEpochMs);
 }
 //#endregion
 //#region src/inspection/source.ts
@@ -12797,11 +12520,12 @@ function sessionFacts(session, kind) {
 	const readPage = (afterRunId = "", pageSize = 100, expectedCutoffIdentity) => remember(session.readSealedRunSummaryPage(afterRunId, pageSize, expectedCutoffIdentity ?? observedCutoff?.identity));
 	return Object.freeze({
 		kind,
-		cutoff: () => observedCutoff ?? readPage("", 1).cutoff,
+		cutoff: () => observedCutoff ??= session.sealedCutoff(),
+		findExperimentRunIds: session.findExperimentRunIds,
 		readRunResource: (runId) => session.readRunResource(runId),
 		readSealedRunSummaryPage: readPage,
 		findAttemptLocatorCandidates: (locator, maximumCandidateRuns) => session.findAttemptLocatorCandidates(locator, maximumCandidateRuns),
-		readSealedRunCore: (runId) => session.readSealedRunCore(runId),
+		readSealedRunCore: (runId) => session.readSealedRunCore(runId, true),
 		readContentPage: (contentId, afterOrdinal, pageSize) => session.readContentChunkPage(contentId, afterOrdinal, pageSize),
 		readCollectionPage: (attachmentId, afterOrdinal, pageSize) => session.readCollectionItemPage(attachmentId, afterOrdinal, pageSize)
 	});
@@ -13723,6 +13447,18 @@ var NiceEvalCurrentRecordAttachments = Object.freeze({
 var RUN_PAGE_SIZE = 100;
 var ATTEMPT_CANDIDATE_RUN_LIMIT = 64;
 var ATTEMPT_TARGET_MEMBER_LIMIT = 256;
+var decodedRuns = /* @__PURE__ */ new WeakMap();
+function readInspectionRun(source, runId) {
+	let cache = decodedRuns.get(source);
+	if (cache === void 0) decodedRuns.set(source, cache = /* @__PURE__ */ new Map());
+	const cached = cache.get(runId);
+	if (cached !== void 0) return cached;
+	const physical = source.readSealedRunCore(runId);
+	if (physical === void 0) return void 0;
+	const decoded = decodeInspectionRun(source, physical);
+	cache.set(runId, decoded);
+	return decoded;
+}
 /**
 * Pins the source cutoff, exhausts the fixed Run-summary pagination, then
 * reads and strictly decodes every Run Core in that exact sealed generation.
@@ -13749,9 +13485,9 @@ function loadInspectionRuns(source) {
 	}
 	if (summaries.length !== cutoff.runCount) throw factsError("Run pagination did not close the pinned sealed cutoff");
 	return Object.freeze(summaries.map((summary) => {
-		const physical = source.readSealedRunCore(summary.runId);
-		if (physical === void 0) throw factsError(`Sealed Run ${summary.runId} disappeared from the pinned cutoff`);
-		return decodeInspectionRun(source, physical);
+		const run = readInspectionRun(source, summary.runId);
+		if (run === void 0) throw factsError(`Sealed Run ${summary.runId} disappeared from the pinned cutoff`);
+		return run;
 	}));
 }
 /** Reads a bounded, explicit Run selection without changing its caller order. */
@@ -13759,8 +13495,8 @@ function loadSelectedInspectionRuns(source, runIds) {
 	const cutoff = source.cutoff();
 	const loaded = [];
 	for (const runId of new Set(runIds)) {
-		const physical = source.readSealedRunCore(runId);
-		if (physical !== void 0) loaded.push(decodeInspectionRun(source, physical));
+		const run = readInspectionRun(source, runId);
+		if (run !== void 0) loaded.push(run);
 	}
 	requireCutoff(source.cutoff(), cutoff);
 	return Object.freeze(loaded);
@@ -13770,8 +13506,7 @@ function loadInspectionRunResource(source, runId) {
 	const cutoff = source.cutoff();
 	const resource = source.readRunResource(runId);
 	if (resource === void 0) return void 0;
-	const physical = source.readSealedRunCore(runId);
-	const published = physical === void 0 ? void 0 : decodeInspectionRun(source, physical);
+	const published = readInspectionRun(source, runId);
 	requireCutoff(source.cutoff(), cutoff);
 	if (resource.published > 0 && published === void 0) throw factsError(`Run ${runId} has published bindings without a readable Core`);
 	if (published !== void 0) validateRunResourceCore(resource, published);
@@ -13789,23 +13524,23 @@ function validateRunResourceCore(resource, published) {
 		if (expected === void 0 || slot.slotId !== expected.slotId || slot.evalId !== expected.evalId || slot.attemptOrdinal !== expected.attemptOrdinal || slot.executionIdentityDigest !== expected.executionIdentityDigest) throw factsError(`Run ${resource.runId} expected Slot does not match its published Core`);
 	}
 }
-/** Strictly decodes all Core documents and Attachment JSON for one sealed Run. */
+/** Strictly decodes Core, then decodes each Attachment only on first use. */
 function decodeInspectionRun(source, physical) {
-	const run = decodedRight(decodeRunDocument(parseJson$1(physical.runCoreBytes, "Run Core")), "Run Core is invalid");
+	const run = decodedRight(decodeRunDocument(parseVerifiedJson(physical.runCoreBytes, physical.runCoreDigest, "Run Core")), "Run Core is invalid");
 	if (run.runId !== physical.runId) throw factsError("Run Core identity does not match its sealed row");
 	if (physical.slots.length !== run.expectedSlots.length) throw factsError("Run Core Slot rows do not match its expected denominator");
 	for (const [index, stored] of physical.slots.entries()) {
-		const slot = decodedRight(Schema.decodeUnknownResult(RecordSlotIdentitySchema, RecordExactParseOptions)(parseJson$1(stored.coreBytes, "Slot Core")), "Slot Core is invalid");
+		const slot = decodedRight(Schema.decodeUnknownResult(RecordSlotIdentitySchema, RecordExactParseOptions)(parseVerifiedJson(stored.coreBytes, stored.coreDigest, "Slot Core")), "Slot Core is invalid");
 		const expected = run.expectedSlots[index];
 		if (expected === void 0 || stored.ordinal !== index || stored.slotId !== slot.slotId || slot.slotId !== expected.slotId || slot.evalId !== expected.evalId || slot.attemptOrdinal !== expected.attemptOrdinal || slot.executionIdentityDigest !== expected.executionIdentityDigest) throw factsError("Slot Core does not match its sealed Run denominator");
 	}
 	const members = physical.members.map((stored) => {
-		const member = decodedRight(decodeMemberDocument(parseJson$1(stored.coreBytes, "Member Core")), "Member Core is invalid");
+		const member = decodedRight(decodeMemberDocument(parseVerifiedJson(stored.coreBytes, stored.coreDigest, "Member Core")), "Member Core is invalid");
 		if (member.slotId !== stored.slotId || member.action !== stored.action || (member.attempt?.originRunId ?? void 0) !== stored.originRunId || (member.attempt?.attemptId ?? void 0) !== stored.attemptId) throw factsError("Member Core does not match its sealed row");
 		return member;
 	});
 	const attempts = physical.attempts.map((stored) => {
-		const attempt = decodedRight(decodeAttemptDocument(parseJson$1(stored.coreBytes, "Attempt Core")), "Attempt Core is invalid");
+		const attempt = decodedRight(decodeAttemptDocument(parseVerifiedJson(stored.coreBytes, stored.coreDigest, "Attempt Core")), "Attempt Core is invalid");
 		if (attempt.attemptId !== stored.attemptId || attempt.originRunId !== run.runId || encodeAttemptLocator(attempt.attemptId) !== stored.attemptLocator) throw factsError("Attempt Core does not match its sealed row");
 		return attempt;
 	});
@@ -13813,9 +13548,19 @@ function decodeInspectionRun(source, physical) {
 	const localAttemptIds = new Set(attempts.map(({ attemptId }) => attemptId));
 	const attachments = physical.attachments.map((attachment) => {
 		if (attachment.ownerRunId !== run.runId || attachment.ownerKind === "run" && attachment.ownerAttemptId !== void 0 || attachment.ownerKind === "attempt" && (attachment.ownerAttemptId === void 0 || !localAttemptIds.has(attachment.ownerAttemptId))) throw factsError("Attachment ownership does not match its sealed Run");
+		let value;
+		let decoded = false;
 		return Object.freeze({
 			physical: attachment,
-			value: parseInspectionJson(attachment.canonicalBytes, "Attachment")
+			get value() {
+				if (!decoded) {
+					verifyDigest(attachment.canonicalBytes, attachment.canonicalDigest, "Attachment");
+					verifyDigest(attachment.logicalInventoryBytes, attachment.inventoryDigest, "Attachment inventory");
+					value = parseInspectionJson(attachment.canonicalBytes, "Attachment");
+					decoded = true;
+				}
+				return value;
+			}
 		});
 	});
 	return Object.freeze({
@@ -13861,23 +13606,51 @@ function resolveInspectionAttempt(source, locator) {
 		targets: Object.freeze(targets)
 	});
 }
-/** Resolves one already loaded target Member without consulting a platform index. */
+var memberIndexes = /* @__PURE__ */ new WeakMap();
+function memberIndex(runs) {
+	const cached = memberIndexes.get(runs);
+	if (cached !== void 0) return cached;
+	const origins = new Map(runs.map((run) => [run.run.runId, {
+		run,
+		attempts: new Map(run.attempts.map((attempt) => [attempt.attemptId, attempt])),
+		members: new Map(run.members.map((member) => [member.slotId, member]))
+	}]));
+	const targets = /* @__PURE__ */ new Map();
+	for (const run of runs) for (const member of run.members) {
+		if (member.attempt === null) continue;
+		const { originRunId, attemptId } = member.attempt;
+		let byAttempt = targets.get(originRunId);
+		if (byAttempt === void 0) targets.set(originRunId, byAttempt = /* @__PURE__ */ new Map());
+		let members = byAttempt.get(attemptId);
+		if (members === void 0) byAttempt.set(attemptId, members = []);
+		members.push(Object.freeze({
+			run,
+			member
+		}));
+	}
+	for (const byAttempt of targets.values()) for (const members of byAttempt.values()) Object.freeze(members);
+	const index = {
+		origins,
+		targets
+	};
+	memberIndexes.set(runs, index);
+	return index;
+}
+/** Resolves already loaded facts through one shared identity index. */
 function resolveInspectionMemberAttempt(runs, target, member) {
 	if (member.attempt === null) return void 0;
-	const origin = runs.find(({ run }) => run.runId === member.attempt.originRunId);
-	const attempt = origin?.attempts.find((candidate) => candidate.attemptId === member.attempt.attemptId && candidate.originRunId === member.attempt.originRunId);
-	if (origin === void 0 || attempt === void 0) return void 0;
-	const locator = encodeAttemptLocator(attempt.attemptId);
-	const targets = runs.flatMap((run) => targetMembers(run, attempt).map((candidate) => Object.freeze({
-		run,
-		member: candidate
-	})));
-	if (!targets.some(({ run, member: candidate }) => run.run.runId === target.run.runId && candidate.slotId === member.slotId)) return;
+	const index = memberIndex(runs);
+	const origin = index.origins.get(member.attempt.originRunId);
+	const attempt = origin?.attempts.get(member.attempt.attemptId);
+	if (origin === void 0 || attempt === void 0 || attempt.originRunId !== member.attempt.originRunId) return void 0;
+	const targets = index.targets.get(attempt.originRunId)?.get(attempt.attemptId) ?? [];
+	const targetMember = index.origins.get(target.run.runId)?.members.get(member.slotId);
+	if (targetMember?.attempt?.originRunId !== attempt.originRunId || targetMember.attempt.attemptId !== attempt.attemptId) return void 0;
 	return Object.freeze({
 		attempt,
-		origin,
-		locator,
-		targets: Object.freeze(targets)
+		origin: origin.run,
+		locator: encodeAttemptLocator(attempt.attemptId),
+		targets
 	});
 }
 function attemptAttachment(resolved, family) {
@@ -14027,6 +13800,13 @@ function factsError(reason, cause) {
 function compareText$1(left, right) {
 	return left < right ? -1 : left > right ? 1 : 0;
 }
+function verifyDigest(bytes, digest, label) {
+	if (new RecordSha256().update(bytes).digestHex() !== digest) throw factsError(`${label} digest is invalid`);
+}
+function parseVerifiedJson(bytes, digest, label) {
+	verifyDigest(bytes, digest, label);
+	return parseJson$1(bytes, label);
+}
 //#endregion
 //#region src/shared/types.ts
 /** 一次 Attempt 的互斥终态；跳过是已结束但不构成可执行结论的结果。 */
@@ -16112,6 +15892,7 @@ function isLoadedInspectionRuns(facts) {
 	return Array.isArray(facts);
 }
 function selectLatestSlots(runs, resolutionRuns = runs) {
+	const membersByRun = new Map(runs.map((run) => [run, new Map(run.members.map((member) => [member.slotId, member]))]));
 	const latest = /* @__PURE__ */ new Map();
 	for (const target of runs) for (const slot of target.run.expectedSlots) {
 		const key = `${target.run.experimentId}\u0000${slot.evalId}\u0000${slot.attemptOrdinal}`;
@@ -16122,7 +15903,7 @@ function selectLatestSlots(runs, resolutionRuns = runs) {
 		}));
 	}
 	return Object.freeze([...latest.values()].sort((left, right) => compareText(left.target.run.experimentId, right.target.run.experimentId) || compareText(left.slot.evalId, right.slot.evalId) || left.slot.attemptOrdinal - right.slot.attemptOrdinal || compareText(left.target.run.runId, right.target.run.runId)).map(({ target, slot }) => {
-		const member = target.members.find((candidate) => candidate.slotId === slot.slotId);
+		const member = membersByRun.get(target)?.get(slot.slotId);
 		const resolved = member === void 0 ? void 0 : resolveInspectionMemberAttempt(resolutionRuns, target, member);
 		return Object.freeze({
 			experimentId: target.run.experimentId,
@@ -19066,8 +18847,9 @@ function selectOperation(source, operation) {
 			});
 		}
 		case "experiment.get": {
-			const selected = loadInspectionRuns(source);
-			const overview = selectInspectionOverview(selected);
+			const matching = loadSelectedInspectionRuns(source, source.findExperimentRunIds(operation.experimentId));
+			const selected = loadReferencedOrigins(source, matching);
+			const overview = selectInspectionOverview(matching, selected);
 			const experiment = overview.experiments.find(({ experimentId }) => experimentId === operation.experimentId);
 			if (experiment === void 0) throw selectionMissing(operation.kind, `Experiment ${operation.experimentId} was not found`);
 			const experimentCells = Object.freeze(overview.cells.filter(({ experimentId }) => experimentId === operation.experimentId));
@@ -19075,6 +18857,10 @@ function selectOperation(source, operation) {
 			let unresolvedAttemptCount = 0;
 			let selectedSlotCount = 0;
 			let resolvedSlotCount = 0;
+			const origins = new Map(selected.map((origin) => [origin.run.runId, {
+				origin,
+				attempts: new Map(origin.attempts.map((attempt) => [attempt.attemptId, attempt]))
+			}]));
 			for (const cell of experimentCells) for (const member of cell.members) {
 				selectedSlotCount++;
 				if (member.publication.state !== "published") {
@@ -19082,8 +18868,9 @@ function selectOperation(source, operation) {
 					continue;
 				}
 				const identity = member.publication;
-				const origin = selected.find(({ run }) => run.runId === identity.originRunId);
-				const attempt = origin?.attempts.find((candidate) => candidate.attemptId === identity.attemptId && candidate.originRunId === identity.originRunId);
+				const indexed = origins.get(identity.originRunId);
+				const origin = indexed?.origin;
+				const attempt = indexed?.attempts.get(identity.attemptId);
 				if (origin === void 0 || attempt === void 0) {
 					unresolvedAttemptCount++;
 					continue;