opencode-swarm 7.158.0 → 7.158.1

package/dist/cli/{index-x4ftmdha.js → index-mc9qgkwd.js}

@@ -29,12 +29,14 @@ var PR_SUBSCRIPTIONS_AUDIT_FILE = "pr-monitor/subscriptions.audit.jsonl";
 var LEGACY_ARCHIVE_FILE = "pr-monitor/subscriptions.legacy.jsonl";
 var FOREIGN_CHECKPOINT_FILE = "pr-monitor/subscriptions.checkpoint.foreign.json";
 var CORRUPT_CHECKPOINT_FILE = "pr-monitor/subscriptions.checkpoint.corrupt.json";
+var FOREIGN_LEGACY_FILE = "pr-monitor/subscriptions.legacy.foreign.jsonl";
 var STORE_LOCK_AGENT = "pr-monitor";
 var STORE_LOCK_TASK = "pr-subscriptions";
 var PR_SUBSCRIPTION_LIMITS = {
   readChunkBytes: 64 * 1024,
   maxRecordBytes: 64 * 1024,
   migrationChunkBytes: 1024 * 1024,
+  migrationMaxBytesPerOperation: 8 * 1024 * 1024,
   legacySourceMaxBytes: 64 * 1024 * 1024,
   defaultMaxActiveSubscriptions: 20,
   maxCheckpointRecords: 512,
@@ -76,7 +78,7 @@ var RecordSchema = exports_external.object({
   errorCount: exports_external.number().int().min(0),
   customPollIntervalSeconds: exports_external.number().int().positive().optional(),
   customFailureThreshold: exports_external.number().int().min(0).optional(),
-  customCooldownSeconds: exports_external.number().int().positive().optional()
+  customCooldownSeconds: exports_external.number().int().min(0).optional()
 }).strict();
 var TerminalSummarySchema = exports_external.object({
   removed: exports_external.number().int().min(0),
@@ -88,6 +90,13 @@ var MigrationSchema = exports_external.object({
   sourceBytes: exports_external.number().int().nonnegative(),
   sourceMtimeMs: exports_external.number().nonnegative(),
   corruptLines: exports_external.number().int().nonnegative(),
+  discardingOversizeLine: exports_external.boolean().optional().default(false),
+  baselineRecords: exports_external.record(exports_external.string(), RecordSchema).optional().default({}),
+  baselineTerminalSummary: TerminalSummarySchema.optional().default({
+    removed: 0,
+    expired: 0,
+    lastTerminalAt: null
+  }),
   done: exports_external.boolean(),
   archived: exports_external.boolean(),
   startedAt: exports_external.number().int().nonnegative()
@@ -121,12 +130,31 @@ function auditPath(directory) {
 function legacyArchivePath(directory) {
   return validateSwarmPath(directory, LEGACY_ARCHIVE_FILE);
 }
+function legacyArchiveNextPath(directory) {
+  return `${legacyArchivePath(directory)}.next`;
+}
+function legacyArchivePreviousPath(directory) {
+  return `${legacyArchivePath(directory)}.previous`;
+}
+function fileExistsStrict(filePath) {
+  try {
+    fs.statSync(filePath);
+    return true;
+  } catch (err) {
+    if (err.code === "ENOENT")
+      return false;
+    throw err;
+  }
+}
 function foreignSlotPath(directory) {
   return validateSwarmPath(directory, FOREIGN_CHECKPOINT_FILE);
 }
 function corruptSlotPath(directory) {
   return validateSwarmPath(directory, CORRUPT_CHECKPOINT_FILE);
 }
+function foreignLegacySlotPath(directory) {
+  return validateSwarmPath(directory, FOREIGN_LEGACY_FILE);
+}
 function ensureSwarmDir(directory) {
   fs.mkdirSync(path.resolve(directory, ".swarm", "pr-monitor"), {
     recursive: true
@@ -167,20 +195,22 @@ function renameWithRetry(from, to) {
   }
   throw lastError;
 }
-function foldLegacyRegion(filePath, startByte, maxBytes) {
+function foldLegacyRegion(filePath, startByte, maxBytes, discardingOversizeLine = false) {
   const folded = new Map;
   let corruptLines = 0;
   let consumedTo = startByte;
   let fd;
   try {
     fd = fs.openSync(filePath, "r");
-  } catch {
+  } catch (err) {
     return {
       folded,
       nextByte: startByte,
       eof: true,
       aborted: true,
-      corruptLines
+      corruptLines,
+      ioError: err instanceof Error ? err.message : String(err),
+      discardingOversizeLine
     };
   }
   const processLineBytes = (line) => {
@@ -210,25 +240,25 @@ function foldLegacyRegion(filePath, startByte, maxBytes) {
     folded.set(rec.correlationId, rec);
   };
   try {
-    const size = fs.fstatSync(fd).size;
+    const size = _internals.legacyFstatSync(fd).size;
     if (startByte >= size) {
       return {
         folded,
         nextByte: startByte,
         eof: true,
         aborted: false,
-        corruptLines
+        corruptLines,
+        ioError: null,
+        discardingOversizeLine: false
       };
     }
     const chunk = Buffer.alloc(PR_SUBSCRIPTION_LIMITS.readChunkBytes);
     let pending = [];
     let pendingLen = 0;
-    let oversize = false;
+    let oversize = discardingOversizeLine;
     let pos = startByte;
     const flushPendingAtEof = () => {
-      if (oversize) {
-        corruptLines += 1;
-      } else if (pendingLen > 0) {
+      if (!oversize && pendingLen > 0) {
         processLineBytes(Buffer.concat(pending));
       }
       consumedTo = Math.max(consumedTo, pos);
@@ -240,14 +270,16 @@ function foldLegacyRegion(filePath, startByte, maxBytes) {
         nextByte: consumedTo,
         eof: true,
         aborted: false,
-        corruptLines
+        corruptLines,
+        ioError: null,
+        discardingOversizeLine: false
       };
     };
     while (true) {
       const want = Math.min(chunk.length, size - pos);
       if (want <= 0)
         return flushPendingAtEof();
-      const n = fs.readSync(fd, chunk, 0, want, pos);
+      const n = _internals.readSync(fd, chunk, 0, want, pos);
       if (n <= 0)
         return flushPendingAtEof();
       const data = chunk.subarray(0, n);
@@ -257,14 +289,16 @@ function foldLegacyRegion(filePath, startByte, maxBytes) {
       while (scan < data.length) {
         const nl = data.indexOf(10, scan);
         if (nl === -1) {
-          pending.push(Buffer.from(data.subarray(scan)));
-          pendingLen += data.length - scan;
+          if (!oversize) {
+            pending.push(Buffer.from(data.subarray(scan)));
+            pendingLen += data.length - scan;
+          }
           break;
         }
         const lineLen = pendingLen + (nl - scan);
-        if (oversize || lineLen > PR_SUBSCRIPTION_LIMITS.maxRecordBytes) {
+        if (!oversize && lineLen > PR_SUBSCRIPTION_LIMITS.maxRecordBytes) {
           corruptLines += 1;
-        } else {
+        } else if (!oversize) {
           const pieces = pending.length > 0 ? [...pending, data.subarray(scan, nl)] : [data.subarray(scan, nl)];
           processLineBytes(Buffer.concat(pieces));
         }
@@ -273,9 +307,21 @@ function foldLegacyRegion(filePath, startByte, maxBytes) {
         oversize = false;
         consumedTo = base + nl + 1;
         scan = nl + 1;
+        if (consumedTo - startByte >= maxBytes) {
+          return {
+            folded,
+            nextByte: consumedTo,
+            eof: consumedTo >= size,
+            aborted: false,
+            corruptLines,
+            ioError: null,
+            discardingOversizeLine: false
+          };
+        }
       }
       if (!oversize && pendingLen > PR_SUBSCRIPTION_LIMITS.maxRecordBytes) {
         oversize = true;
+        corruptLines += 1;
         pending = [];
         pendingLen = 0;
       }
@@ -286,22 +332,37 @@ function foldLegacyRegion(filePath, startByte, maxBytes) {
           nextByte: consumedTo,
           eof,
           aborted: false,
-          corruptLines
+          corruptLines,
+          ioError: null,
+          discardingOversizeLine: false
+        };
+      }
+      if (oversize && pos - startByte >= maxBytes) {
+        return {
+          folded,
+          nextByte: pos,
+          eof: pos >= size,
+          aborted: false,
+          corruptLines,
+          ioError: null,
+          discardingOversizeLine: pos < size
         };
       }
     }
   } catch (err) {
     log(`[pr-monitor] foldLegacyRegion failed: ${err instanceof Error ? err.message : String(err)}`);
     return {
-      folded,
-      nextByte: consumedTo,
+      folded: new Map,
+      nextByte: startByte,
       eof: true,
       aborted: true,
-      corruptLines
+      corruptLines: 0,
+      ioError: err instanceof Error ? err.message : String(err),
+      discardingOversizeLine
     };
   } finally {
     try {
-      fs.closeSync(fd);
+      _internals.legacyCloseSync(fd);
     } catch {}
   }
 }
@@ -317,9 +378,11 @@ function mergeFoldedRecords(view, overlay) {
   return replaced;
 }
 function readCheckpoint(directory) {
+  const filePath = checkpointPath(directory);
+  let fd;
   let stat;
   try {
-    stat = fs.statSync(checkpointPath(directory));
+    fd = fs.openSync(filePath, "r");
   } catch (err) {
     if (err.code === "ENOENT") {
       return { kind: "absent" };
@@ -329,20 +392,45 @@ function readCheckpoint(directory) {
       reason: `unreadable (${err.code ?? "unknown"})`
     };
   }
-  if (stat.size > PR_SUBSCRIPTION_LIMITS.checkpointHardReadBytes) {
+  try {
+    stat = fs.fstatSync(fd);
+  } catch (err) {
+    try {
+      fs.closeSync(fd);
+    } catch {}
     return {
       kind: "invalid",
-      reason: `checkpoint exceeds hard read ceiling (${stat.size} > ${PR_SUBSCRIPTION_LIMITS.checkpointHardReadBytes} bytes)`
+      reason: `unreadable (${err.code ?? "unknown"})`
     };
   }
   let raw;
   try {
-    raw = fs.readFileSync(checkpointPath(directory), "utf-8");
+    if (stat.size > PR_SUBSCRIPTION_LIMITS.checkpointHardReadBytes) {
+      return {
+        kind: "invalid",
+        reason: `checkpoint exceeds hard read ceiling (${stat.size} > ${PR_SUBSCRIPTION_LIMITS.checkpointHardReadBytes} bytes)`
+      };
+    }
+    _internals.afterCheckpointFstat(filePath);
+    const buffer = Buffer.alloc(stat.size);
+    let bytesRead = 0;
+    while (bytesRead < stat.size) {
+      const read = _internals.readSync(fd, buffer, bytesRead, stat.size - bytesRead, bytesRead);
+      if (read <= 0) {
+        throw new Error(`premature checkpoint EOF (${bytesRead}/${stat.size} bytes)`);
+      }
+      bytesRead += read;
+    }
+    raw = buffer.subarray(0, bytesRead).toString("utf-8");
   } catch (err) {
     return {
       kind: "invalid",
       reason: `unreadable (${err.code ?? "unknown"})`
     };
+  } finally {
+    try {
+      fs.closeSync(fd);
+    } catch {}
   }
   let parsed;
   try {
@@ -373,6 +461,23 @@ function readCheckpoint(directory) {
       };
     }
   }
+  if (checkpoint.migration !== null) {
+    const baselineEntries = Object.entries(checkpoint.migration.baselineRecords);
+    if (baselineEntries.length > PR_SUBSCRIPTION_LIMITS.maxCheckpointRecords) {
+      return {
+        kind: "invalid",
+        reason: `migration baseline count ${baselineEntries.length} exceeds guard ${PR_SUBSCRIPTION_LIMITS.maxCheckpointRecords}`
+      };
+    }
+    for (const [key, rec] of baselineEntries) {
+      if (key !== rec.correlationId || rec.correlationId !== buildCorrelationId(rec.sessionID, rec.repoFullName, rec.prNumber)) {
+        return {
+          kind: "invalid",
+          reason: `migration baseline identity mismatch at key "${key}"`
+        };
+      }
+    }
+  }
   return { kind: "ok", value: checkpoint };
 }
 function freshCheckpoint(directory) {
@@ -426,14 +531,14 @@ function quarantineCheckpoint(directory, slot) {
     try {
       fs.renameSync(to, `${to}.prev`);
     } catch {}
-    renameWithRetry(from, to);
+    _internals.renameWithRetry(from, to);
     return true;
   } catch (err) {
     log(`[pr-monitor] checkpoint quarantine (${slot}) failed: ${err instanceof Error ? err.message : String(err)} \u2014 the next checkpoint write replaces it`);
     return false;
   }
 }
-function flushAuditEvents(directory, events, sequence, maintenance) {
+function flushAuditEvents(directory, events, sequence, _maintenance) {
   if (events.length === 0)
     return;
   ensureSwarmDir(directory);
@@ -451,42 +556,58 @@ function flushAuditEvents(directory, events, sequence, maintenance) {
     log(`[pr-monitor] audit append failed (non-fatal): ${err instanceof Error ? err.message : String(err)}`);
     return;
   }
-  compactAuditTail(directory, maintenance);
 }
-function compactAuditTail(directory, maintenance) {
+function storageErrorCode(err) {
+  if (typeof err === "object" && err !== null && "code" in err) {
+    const code = err.code;
+    if (typeof code === "string" && code.length > 0)
+      return code;
+  }
+  return "unknown";
+}
+function planAuditCompaction(directory) {
   let size;
   try {
     size = fs.statSync(auditPath(directory)).size;
   } catch {
-    return;
+    return null;
   }
   if (size <= PR_SUBSCRIPTION_LIMITS.auditMaxBytesLow)
-    return;
-  const windowBytes = 2 * PR_SUBSCRIPTION_LIMITS.auditMaxBytesHigh;
+    return null;
   let content;
+  let omittedPrefix = false;
   try {
-    if (size > windowBytes) {
-      const fd = fs.openSync(auditPath(directory), "r");
-      try {
-        const tail = Buffer.alloc(windowBytes);
-        const n = fs.readSync(fd, tail, 0, windowBytes, size - windowBytes);
-        const text = tail.subarray(0, n).toString("utf-8");
-        const firstNl = text.indexOf(`
-`);
-        content = firstNl === -1 ? "" : text.slice(firstNl + 1);
-      } finally {
-        fs.closeSync(fd);
+    const filePath = auditPath(directory);
+    const maxRead = PR_SUBSCRIPTION_LIMITS.auditMaxBytesHigh;
+    const start = Math.max(0, size - maxRead);
+    const length = Math.min(size, maxRead);
+    const buffer = Buffer.alloc(length);
+    const fd = fs.openSync(filePath, "r");
+    try {
+      let bytesRead = 0;
+      while (bytesRead < length) {
+        const read = _internals.readSync(fd, buffer, bytesRead, length - bytesRead, start + bytesRead);
+        if (read <= 0)
+          return null;
+        bytesRead += read;
       }
-    } else {
-      content = fs.readFileSync(auditPath(directory), "utf-8");
+      content = buffer.toString("utf-8");
+    } finally {
+      fs.closeSync(fd);
+    }
+    if (start > 0) {
+      omittedPrefix = true;
+      const firstNewline = content.indexOf(`
+`);
+      content = firstNewline >= 0 ? content.slice(firstNewline + 1) : "";
     }
   } catch {
-    return;
+    return null;
   }
   const all = content.split(`
 `).filter((line) => line.trim().length > 0);
   if (all.length <= PR_SUBSCRIPTION_LIMITS.auditMaxLinesHigh && size <= PR_SUBSCRIPTION_LIMITS.auditMaxBytesHigh) {
-    return;
+    return null;
   }
   const kept = [];
   let bytes = 0;
@@ -498,14 +619,40 @@ function compactAuditTail(directory, maintenance) {
     kept.unshift(all[i]);
     bytes += lineBytes;
   }
-  const dropped = all.length - kept.length;
-  try {
-    atomicWriteSwarmFileSync(auditPath(directory), kept.length > 0 ? `${kept.join(`
+  const dropped = all.length - kept.length + (omittedPrefix ? 1 : 0);
+  return {
+    content: kept.length > 0 ? `${kept.join(`
 `)}
-` : "");
-    maintenance.droppedAuditTransitions += dropped;
+` : "",
+    dropped
+  };
+}
+function applyAuditCompaction(directory, plan) {
+  if (!plan)
+    return false;
+  try {
+    _internals.auditCompactionWrite(auditPath(directory), plan.content);
+    return true;
+  } catch (err) {
+    log(`[pr-monitor] audit compaction failed (non-fatal): ${storageErrorCode(err)}`);
+    return false;
+  }
+}
+function prepareAuditCompaction(directory) {
+  const plan = planAuditCompaction(directory);
+  return plan;
+}
+function persistCheckpointWithAuditCompaction(directory, checkpoint, plan) {
+  _internals.writeCheckpointFile(directory, checkpoint);
+  if (!applyAuditCompaction(directory, plan) || !plan)
+    return;
+  const previousDropped = checkpoint.maintenance.droppedAuditTransitions;
+  checkpoint.maintenance.droppedAuditTransitions += plan.dropped;
+  try {
+    _internals.writeCheckpointFile(directory, checkpoint);
   } catch (err) {
-    log(`[pr-monitor] audit compaction failed (non-fatal): ${err instanceof Error ? err.message : String(err)}`);
+    checkpoint.maintenance.droppedAuditTransitions = previousDropped;
+    log(`[pr-monitor] audit compaction accounting failed (non-fatal): ${storageErrorCode(err)}`);
   }
 }
 function auditStats(directory) {
@@ -565,20 +712,74 @@ function maybeArchiveLegacy(directory, checkpoint) {
   if (!migration || !migration.done || migration.archived)
     return null;
   const legacy = storePath(directory);
-  const size = fileSizeOrNull(legacy);
-  if (size === null) {
-    migration.archived = true;
+  let stat;
+  try {
+    stat = _internals.archiveStatSync(legacy);
+  } catch (err) {
+    if (err.code === "ENOENT") {
+      migration.archived = true;
+    } else {
+      log(`[pr-monitor] legacy archive inspection deferred: ${storageErrorCode(err)}`);
+    }
+    return null;
+  }
+  if (stat.size !== migration.sourceBytes || stat.mtimeMs !== migration.sourceMtimeMs)
+    return null;
+  _internals.beforeArchiveLegacy(directory);
+  try {
+    stat = _internals.archiveStatSync(legacy);
+  } catch {
     return null;
   }
-  if (size !== migration.sourceBytes)
+  if (stat.size !== migration.sourceBytes || stat.mtimeMs !== migration.sourceMtimeMs)
     return null;
+  const archive = legacyArchivePath(directory);
+  const next = legacyArchiveNextPath(directory);
+  const previous = legacyArchivePreviousPath(directory);
   try {
+    _internals.beforeArchiveRename(directory);
     try {
-      fs.unlinkSync(legacyArchivePath(directory));
+      fs.unlinkSync(next);
+    } catch {}
+    _internals.renameWithRetry(legacy, next);
+    const archivedStat = _internals.archiveStatSync(next);
+    if (archivedStat.size !== migration.sourceBytes || archivedStat.mtimeMs !== migration.sourceMtimeMs) {
+      _internals.renameWithRetry(next, legacy);
+      return null;
+    }
+    const archivedAt = new Date;
+    fs.utimesSync(next, archivedAt, archivedAt);
+    let movedPrevious = false;
+    try {
+      fs.unlinkSync(previous);
     } catch {}
-    renameWithRetry(legacy, legacyArchivePath(directory));
+    try {
+      _internals.renameWithRetry(archive, previous);
+      movedPrevious = true;
+    } catch (err) {
+      if (err.code !== "ENOENT")
+        throw err;
+    }
+    try {
+      _internals.renameWithRetry(next, archive);
+    } catch (err) {
+      if (movedPrevious)
+        _internals.renameWithRetry(previous, archive);
+      _internals.renameWithRetry(next, legacy);
+      throw err;
+    }
+    if (movedPrevious) {
+      try {
+        fs.unlinkSync(previous);
+      } catch {}
+    }
   } catch (err) {
-    log(`[pr-monitor] legacy archive deferred: ${err instanceof Error ? err.message : String(err)}`);
+    try {
+      if (fs.existsSync(next) && !fs.existsSync(legacy)) {
+        _internals.renameWithRetry(next, legacy);
+      }
+    } catch {}
+    log(`[pr-monitor] legacy archive deferred: ${storageErrorCode(err)}`);
     return null;
   }
   try {
@@ -588,6 +789,70 @@ function maybeArchiveLegacy(directory, checkpoint) {
   migration.archived = true;
   return { kind: "archive" };
 }
+function reconcileLegacyArchiveStaging(directory, migration) {
+  const legacy = storePath(directory);
+  const archive = legacyArchivePath(directory);
+  const next = legacyArchiveNextPath(directory);
+  const previous = legacyArchivePreviousPath(directory);
+  let legacyExists = fileExistsStrict(legacy);
+  let archiveExists = fileExistsStrict(archive);
+  let nextExists = fileExistsStrict(next);
+  let previousExists = fileExistsStrict(previous);
+  if (!nextExists && !previousExists)
+    return;
+  if (legacyExists) {
+    if (!archiveExists && previousExists) {
+      _internals.renameWithRetry(previous, archive);
+      archiveExists = true;
+      previousExists = false;
+    }
+    if (!archiveExists && nextExists) {
+      const candidate = fs.statSync(next);
+      if (migration.done && candidate.size === migration.sourceBytes && candidate.mtimeMs === migration.sourceMtimeMs) {
+        _internals.renameWithRetry(next, archive);
+        archiveExists = true;
+        nextExists = false;
+      }
+    }
+    if (archiveExists && previousExists)
+      fs.unlinkSync(previous);
+    if (nextExists)
+      fs.unlinkSync(next);
+    return;
+  }
+  if (archiveExists) {
+    if (nextExists) {
+      _internals.renameWithRetry(next, legacy);
+      migration.archived = false;
+      legacyExists = true;
+      nextExists = false;
+    }
+    if (previousExists)
+      fs.unlinkSync(previous);
+    return;
+  }
+  if (previousExists) {
+    _internals.renameWithRetry(previous, archive);
+    archiveExists = true;
+    previousExists = false;
+    if (nextExists) {
+      _internals.renameWithRetry(next, legacy);
+      migration.archived = false;
+      legacyExists = true;
+      nextExists = false;
+    }
+    return;
+  }
+  if (nextExists) {
+    const candidate = fs.statSync(next);
+    if (migration.done && candidate.size === migration.sourceBytes && candidate.mtimeMs === migration.sourceMtimeMs) {
+      _internals.renameWithRetry(next, archive);
+    } else {
+      _internals.renameWithRetry(next, legacy);
+      migration.archived = false;
+    }
+  }
+}
 function cleanupStaleLegacyArchive(directory) {
   try {
     const stat = fs.statSync(legacyArchivePath(directory));
@@ -605,7 +870,8 @@ function emitHealthTelemetry(trigger, checkpoint) {
     compactions: checkpoint.maintenance.compactions,
     corrupt_count: checkpoint.maintenance.corruptLegacyRecords,
     dropped_audit_count: checkpoint.maintenance.droppedAuditTransitions,
-    checkpoint_bytes: Buffer.byteLength(JSON.stringify(checkpoint), "utf-8"),
+    checkpoint_bytes: Buffer.byteLength(`${JSON.stringify(checkpoint)}
+`, "utf-8"),
     limit_bytes: PR_SUBSCRIPTION_LIMITS.maxCheckpointBytes,
     recovery_resets: checkpoint.maintenance.resets
   });
@@ -631,7 +897,7 @@ function warnMigrationCapacity(directory, records) {
   log(`[pr-monitor] legacy subscriptions.jsonl folds to ${records} records (>checkpoint capacity ${PR_SUBSCRIPTION_LIMITS.maxCheckpointRecords}); migration refused \u2014 archive or split the file so its subscriptions can be re-subscribed, then remove it`);
 }
 function overlayLegacy(directory, checkpoint) {
-  const view = { ...checkpoint.records };
+  let view = { ...checkpoint.records };
   const legacy = storePath(directory);
   let stat = null;
   try {
@@ -660,10 +926,25 @@ function overlayLegacy(directory, checkpoint) {
   }
   const migration = checkpoint.migration;
   if (migration === null || !migration.done) {
-    let cursor = migration?.scannedBytes ?? 0;
-    if (cursor > stat.size)
-      cursor = 0;
-    const fold2 = foldLegacyRegion(legacy, cursor, Number.MAX_SAFE_INTEGER);
+    const baselineRecords = migration?.baselineRecords ?? {
+      ...checkpoint.records
+    };
+    const sameGeneration = migration !== null && stat.size === migration.sourceBytes && stat.mtimeMs === migration.sourceMtimeMs;
+    const cursor = sameGeneration ? migration.scannedBytes : 0;
+    const discardingOversizeLine = sameGeneration ? migration.discardingOversizeLine : false;
+    if (!sameGeneration && migration !== null) {
+      view = { ...baselineRecords };
+    }
+    const fold2 = foldLegacyRegion(legacy, cursor, Number.MAX_SAFE_INTEGER, discardingOversizeLine);
+    if (fold2.ioError)
+      return {
+        view,
+        usedLegacy: false,
+        absorbed: 0,
+        corruptLines: 0,
+        overLimit: false,
+        aborted: true
+      };
     const absorbed2 = mergeFoldedRecords(view, fold2.folded);
     return {
       view,
@@ -685,6 +966,15 @@ function overlayLegacy(directory, checkpoint) {
     };
   }
   const fold = foldLegacyRegion(legacy, 0, Number.MAX_SAFE_INTEGER);
+  if (fold.ioError)
+    return {
+      view,
+      usedLegacy: false,
+      absorbed: 0,
+      corruptLines: 0,
+      overLimit: false,
+      aborted: true
+    };
   const absorbed = mergeFoldedRecords(view, fold.folded);
   return {
     view,
@@ -713,31 +1003,38 @@ async function loadViewForRead(directory) {
     const size = fileSizeOrNull(legacy);
     if (size !== null && size <= PR_SUBSCRIPTION_LIMITS.legacySourceMaxBytes) {
       const fold2 = foldLegacyRegion(legacy, 0, Number.MAX_SAFE_INTEGER);
-      mergeFoldedRecords(view2, fold2.folded);
+      if (!fold2.ioError)
+        mergeFoldedRecords(view2, fold2.folded);
     } else if (size !== null) {
       warnLegacyOverLimit(directory, size);
     }
     return { view: view2, recoverySource: "corrupt-recovered" };
   }
   const legacyPath = storePath(directory);
-  const legacySize = fileSizeOrNull(legacyPath);
-  if (legacySize === null) {
+  let legacyStat;
+  try {
+    legacyStat = fs.statSync(legacyPath);
+  } catch {
     return { view: {}, recoverySource: "empty" };
   }
+  const legacySize = legacyStat.size;
   if (legacySize > PR_SUBSCRIPTION_LIMITS.legacySourceMaxBytes) {
     warnLegacyOverLimit(directory, legacySize);
     return { view: {}, recoverySource: "legacy-log" };
   }
   const fold = foldLegacyRegion(legacyPath, 0, Number.MAX_SAFE_INTEGER);
   const view = {};
+  if (fold.ioError)
+    return { view, recoverySource: "legacy-log" };
   mergeFoldedRecords(view, fold.folded);
   if (!fold.aborted) {
-    await bootstrapCheckpointFromLegacy(directory, view, fold);
+    _internals.beforeBootstrapLock(directory);
+    await bootstrapCheckpointFromLegacy(directory);
   }
   return { view, recoverySource: "legacy-log" };
 }
 var bootstrapAttempted = new Map;
-async function bootstrapCheckpointFromLegacy(directory, foldedView, fold) {
+async function bootstrapCheckpointFromLegacy(directory) {
   if (bootstrapAttempted.has(directory))
     return;
   if (bootstrapAttempted.size >= 32) {
@@ -748,49 +1045,108 @@ async function bootstrapCheckpointFromLegacy(directory, foldedView, fold) {
     await withEvidenceLock(directory, PR_SUBSCRIPTIONS_FILE, STORE_LOCK_AGENT, STORE_LOCK_TASK, async () => {
       if (readCheckpoint(directory).kind !== "absent")
         return;
+      let beforeFold;
+      try {
+        beforeFold = fs.statSync(storePath(directory));
+      } catch {
+        return;
+      }
+      const lockedFold = foldLegacyRegion(storePath(directory), 0, PR_SUBSCRIPTION_LIMITS.legacySourceMaxBytes);
+      if (lockedFold.ioError)
+        return;
+      let afterFold;
+      try {
+        afterFold = fs.statSync(storePath(directory));
+      } catch {
+        return;
+      }
+      if (afterFold.size !== beforeFold.size || afterFold.mtimeMs !== beforeFold.mtimeMs)
+        return;
+      const foldedView = {};
+      mergeFoldedRecords(foldedView, lockedFold.folded);
       const checkpoint = freshCheckpoint(directory);
       checkpoint.records = { ...foldedView };
       const terminals = Object.values(foldedView).filter((rec) => rec.status !== "active");
       checkpoint.terminalSummary.lastTerminalAt = terminals.length ? Math.max(...terminals.map((rec) => rec.updatedAt)) : null;
-      checkpoint.maintenance.corruptLegacyRecords = fold.corruptLines;
-      let bootstrapMtime = 0;
-      try {
-        bootstrapMtime = fs.statSync(storePath(directory)).mtimeMs;
-      } catch {}
+      checkpoint.maintenance.corruptLegacyRecords = lockedFold.corruptLines;
       checkpoint.migration = {
-        scannedBytes: fold.nextByte,
-        sourceBytes: fold.nextByte,
-        sourceMtimeMs: bootstrapMtime,
-        corruptLines: fold.corruptLines,
+        scannedBytes: lockedFold.nextByte,
+        sourceBytes: beforeFold.size,
+        sourceMtimeMs: beforeFold.mtimeMs,
+        corruptLines: lockedFold.corruptLines,
+        discardingOversizeLine: false,
+        baselineRecords: {},
+        baselineTerminalSummary: {
+          removed: 0,
+          expired: 0,
+          lastTerminalAt: null
+        },
         done: true,
         archived: false,
         startedAt: Date.now()
       };
       checkpoint.sequence = 1;
       checkpoint.updatedAt = Date.now();
-      writeCheckpointFile(directory, checkpoint);
-      flushAuditEvents(directory, [{ kind: "migrate-complete" }], checkpoint.sequence, checkpoint.maintenance);
+      const auditCompaction = prepareAuditCompaction(directory);
+      persistCheckpointWithAuditCompaction(directory, checkpoint, auditCompaction);
+      const archiveEvent = maybeArchiveLegacy(directory, checkpoint);
+      if (archiveEvent) {
+        checkpoint.sequence += 1;
+        checkpoint.updatedAt = Date.now();
+        _internals.writeCheckpointFile(directory, checkpoint);
+      }
+      flushAuditEvents(directory, [
+        { kind: "migrate-complete" },
+        ...archiveEvent ? [archiveEvent] : []
+      ], checkpoint.sequence, checkpoint.maintenance);
       emitHealthTelemetry("migrate-complete", checkpoint);
+      if (archiveEvent)
+        emitHealthTelemetry("archive", checkpoint);
     }, PR_SUBSCRIPTION_LIMITS.bootstrapLockTimeoutMs);
   } catch (err) {
-    log(`[pr-monitor] read-bootstrap skipped: ${err instanceof Error ? err.message : String(err)}`);
+    log(`[pr-monitor] read-bootstrap skipped: ${storageErrorCode(err)}`);
   }
 }
 function loadViewForWrite(directory) {
   const audit = [];
   let dirty = false;
+  let reboundForeign = false;
   let checkpoint;
   const read = readCheckpoint(directory);
   if (read.kind === "ok" && sameProjectRoot(read.value.rootPath, directory)) {
     checkpoint = cloneCheckpoint(read.value);
   } else if (read.kind === "ok") {
     const displaced = Object.keys(read.value.records).length;
-    quarantineCheckpoint(directory, "foreign");
+    const legacy2 = storePath(directory);
+    let foreignLegacyExists = false;
+    try {
+      _internals.statSync(legacy2);
+      foreignLegacyExists = true;
+    } catch (err) {
+      if (err.code !== "ENOENT") {
+        throw new Error(`PR subscription foreign legacy log could not be inspected; refusing to rebind (${storageErrorCode(err)})`);
+      }
+    }
+    if (foreignLegacyExists) {
+      const foreignLegacy = foreignLegacySlotPath(directory);
+      try {
+        try {
+          fs.unlinkSync(foreignLegacy);
+        } catch {}
+        _internals.renameWithRetry(legacy2, foreignLegacy);
+      } catch (err) {
+        throw new Error(`PR subscription foreign legacy log could not be quarantined; refusing to rebind (${storageErrorCode(err)})`);
+      }
+    }
+    if (!quarantineCheckpoint(directory, "foreign")) {
+      throw new Error("PR subscription foreign checkpoint could not be quarantined; refusing to rebind");
+    }
     checkpoint = freshCheckpoint(directory);
     checkpoint.maintenance.resets += read.value.maintenance.resets + 1;
     audit.push({ kind: "foreign-rebind" });
     dirty = true;
     log(`[pr-monitor] foreign checkpoint quarantined (${displaced} displaced records, recorded root ${read.value.rootPath}); store rebound to ${directory}`);
+    reboundForeign = true;
   } else if (read.kind === "invalid") {
     quarantineCheckpoint(directory, "corrupt");
     checkpoint = freshCheckpoint(directory);
@@ -801,12 +1157,25 @@ function loadViewForWrite(directory) {
   } else {
     checkpoint = freshCheckpoint(directory);
   }
+  if (!reboundForeign && checkpoint.migration !== null) {
+    try {
+      reconcileLegacyArchiveStaging(directory, checkpoint.migration);
+    } catch (err) {
+      throw new Error(`PR subscription legacy archive staging could not be reconciled; refusing mutation (${storageErrorCode(err)})`);
+    }
+  }
   const legacy = storePath(directory);
   let legacyStat = null;
   try {
-    legacyStat = fs.statSync(legacy);
-  } catch {}
+    legacyStat = _internals.statSync(legacy);
+  } catch (err) {
+    if (err.code !== "ENOENT") {
+      throw new Error(`PR subscription legacy store could not be inspected; refusing mutation (${storageErrorCode(err)})`);
+    }
+  }
   let view;
+  if (reboundForeign)
+    legacyStat = null;
   if (legacyStat === null) {
     view = { ...checkpoint.records };
     if (checkpoint.migration?.done && !checkpoint.migration.archived) {
@@ -817,25 +1186,44 @@ function loadViewForWrite(directory) {
   }
   if (legacyStat.size > PR_SUBSCRIPTION_LIMITS.legacySourceMaxBytes) {
     warnLegacyOverLimit(directory, legacyStat.size);
-    return { checkpoint, view: { ...checkpoint.records }, audit, dirty };
+    throw new Error(`PR subscription legacy store exceeds the ${PR_SUBSCRIPTION_LIMITS.legacySourceMaxBytes}-byte migration ceiling; refusing mutation until the file is archived or split`);
   }
   const legacySize = legacyStat.size;
   const legacyMtime = legacyStat.mtimeMs;
   const migration = checkpoint.migration;
   if (migration === null || !migration.done) {
-    let cursor = migration?.scannedBytes ?? 0;
-    if (cursor > legacySize)
-      cursor = 0;
-    const startedAt = migration?.startedAt ?? Date.now();
-    let corruptTotal = migration?.corruptLines ?? 0;
+    const baselineRecords = migration?.baselineRecords ?? {
+      ...checkpoint.records
+    };
+    const baselineTerminalSummary = migration?.baselineTerminalSummary ?? {
+      ...checkpoint.terminalSummary
+    };
+    const sameGeneration = migration !== null && legacySize === migration.sourceBytes && legacyMtime === migration.sourceMtimeMs;
+    let cursor = sameGeneration ? migration.scannedBytes : 0;
+    const startedAt = sameGeneration ? migration.startedAt : Date.now();
+    let corruptTotal = sameGeneration ? migration.corruptLines : 0;
+    let discardingOversizeLine = sameGeneration ? migration.discardingOversizeLine : false;
+    if (!sameGeneration && migration !== null) {
+      checkpoint.records = { ...baselineRecords };
+      checkpoint.terminalSummary = { ...baselineTerminalSummary };
+      checkpoint.maintenance.corruptLegacyRecords = Math.max(0, checkpoint.maintenance.corruptLegacyRecords - migration.corruptLines);
+    }
     view = { ...checkpoint.records };
     let capacityRefused = false;
+    let foldedThisOperation = 0;
     while (true) {
-      const fold = foldLegacyRegion(legacy, cursor, PR_SUBSCRIPTION_LIMITS.migrationChunkBytes);
+      const chunkStart = cursor;
+      const remainingOperationBytes = Math.max(1, PR_SUBSCRIPTION_LIMITS.migrationMaxBytesPerOperation - foldedThisOperation);
+      const fold = foldLegacyRegion(legacy, cursor, Math.min(PR_SUBSCRIPTION_LIMITS.migrationChunkBytes, remainingOperationBytes), discardingOversizeLine);
+      if (fold.ioError) {
+        throw new Error("PR subscription legacy migration read failed (I/O error)");
+      }
       mergeFoldedRecords(view, fold.folded);
       checkpoint.maintenance.corruptLegacyRecords += fold.corruptLines;
       corruptTotal += fold.corruptLines;
+      discardingOversizeLine = fold.discardingOversizeLine;
       cursor = fold.nextByte;
+      foldedThisOperation += Math.max(0, cursor - chunkStart);
       if (fold.aborted) {
         const progress = cloneCheckpoint(checkpoint);
         progress.records = { ...view };
@@ -844,6 +1232,9 @@ function loadViewForWrite(directory) {
           sourceBytes: legacySize,
           sourceMtimeMs: legacyMtime,
           corruptLines: corruptTotal,
+          discardingOversizeLine,
+          baselineRecords: { ...baselineRecords },
+          baselineTerminalSummary: { ...baselineTerminalSummary },
           done: false,
           archived: false,
           startedAt
@@ -872,6 +1263,9 @@ function loadViewForWrite(directory) {
           sourceBytes: legacySize,
           sourceMtimeMs: legacyMtime,
           corruptLines: corruptTotal,
+          discardingOversizeLine,
+          baselineRecords: { ...baselineRecords },
+          baselineTerminalSummary: { ...baselineTerminalSummary },
           done: false,
           archived: false,
           startedAt
@@ -881,6 +1275,9 @@ function loadViewForWrite(directory) {
         writeCheckpointFile(directory, progress);
         checkpoint.sequence = progress.sequence;
         dirty = true;
+        if (foldedThisOperation >= PR_SUBSCRIPTION_LIMITS.migrationMaxBytesPerOperation) {
+          throw new Error(`PR subscription legacy migration is in progress (${cursor}/${legacySize} bytes); retry the operation to continue`);
+        }
         continue;
       }
       checkpoint.migration = {
@@ -888,6 +1285,13 @@ function loadViewForWrite(directory) {
         sourceBytes: legacySize,
         sourceMtimeMs: legacyMtime,
         corruptLines: corruptTotal,
+        discardingOversizeLine: false,
+        baselineRecords: {},
+        baselineTerminalSummary: {
+          removed: 0,
+          expired: 0,
+          lastTerminalAt: null
+        },
         done: true,
         archived: false,
         startedAt
@@ -919,20 +1323,32 @@ function finalizeWrite(directory, loaded, opAudit) {
   const compactEvent = compactTerminalRecords(loaded.view, checkpoint);
   if (compactEvent)
     events.push(compactEvent);
-  if (!loaded.dirty && events.length === 0)
+  if (!loaded.dirty && events.length === 0) {
+    const archiveEvent2 = maybeArchiveLegacy(directory, checkpoint);
+    if (!archiveEvent2)
+      return;
+    checkpoint.updatedAt = Date.now();
+    checkpoint.sequence += 1;
+    const auditCompaction2 = prepareAuditCompaction(directory);
+    persistCheckpointWithAuditCompaction(directory, checkpoint, auditCompaction2);
+    flushAuditEvents(directory, [archiveEvent2], checkpoint.sequence, checkpoint.maintenance);
+    cleanupStaleLegacyArchive(directory);
+    emitHealthTelemetry("archive", checkpoint);
     return;
+  }
   checkpoint.records = loaded.view;
   checkpoint.updatedAt = Date.now();
   checkpoint.rootPath = path.resolve(directory);
   checkpoint.sequence += 1;
+  const auditCompaction = prepareAuditCompaction(directory);
+  persistCheckpointWithAuditCompaction(directory, checkpoint, auditCompaction);
   flushAuditEvents(directory, events, checkpoint.sequence, checkpoint.maintenance);
-  writeCheckpointFile(directory, checkpoint);
   const archiveEvent = maybeArchiveLegacy(directory, checkpoint);
   if (archiveEvent) {
     events.push(archiveEvent);
     checkpoint.sequence += 1;
+    _internals.writeCheckpointFile(directory, checkpoint);
     flushAuditEvents(directory, [archiveEvent], checkpoint.sequence, checkpoint.maintenance);
-    writeCheckpointFile(directory, checkpoint);
   }
   cleanupStaleLegacyArchive(directory);
   for (const kind of [
@@ -1061,6 +1477,7 @@ async function updateSnapshot(directory, correlationId, updates) {
       createdAt: match.createdAt,
       updatedAt: Date.now()
     };
+    validateRecord(updated);
     loaded.view[correlationId] = updated;
     loaded.dirty = true;
     finalizeWrite(directory, loaded, []);
@@ -1139,7 +1556,8 @@ async function getPrSubscriptionHealth(directory) {
       if (legacySize !== null && !legacyOverLimit) {
         const fold = foldLegacyRegion(storePath(directory), 0, Number.MAX_SAFE_INTEGER);
         const view = {};
-        mergeFoldedRecords(view, fold.folded);
+        if (!fold.ioError)
+          mergeFoldedRecords(view, fold.folded);
         health = healthFromView(view, freshCheckpoint(directory));
         health.corruptLegacyRecords = fold.corruptLines;
       } else {
@@ -1152,7 +1570,8 @@ async function getPrSubscriptionHealth(directory) {
       } else {
         const fold = foldLegacyRegion(storePath(directory), 0, Number.MAX_SAFE_INTEGER);
         const view = {};
-        mergeFoldedRecords(view, fold.folded);
+        if (!fold.ioError)
+          mergeFoldedRecords(view, fold.folded);
         health = healthFromView(view, freshCheckpoint(directory));
         health.corruptLegacyRecords = fold.corruptLines;
       }
@@ -1166,7 +1585,7 @@ async function getPrSubscriptionHealth(directory) {
     applyFileStats(health, checkpointBytes, audit, archiveBytes);
     return health;
   } catch (err) {
-    log(`[pr-monitor] getPrSubscriptionHealth failed: ${err instanceof Error ? err.message : String(err)}`);
+    log(`[pr-monitor] getPrSubscriptionHealth failed: ${storageErrorCode(err)}`);
     return emptyHealth();
   }
 }
@@ -1223,9 +1642,21 @@ function healthFromView(view, checkpoint) {
   return health;
 }
 var _internals = {
+  afterCheckpointFstat: (_filePath) => {},
+  archiveStatSync: fs.statSync,
+  auditCompactionWrite: atomicWriteSwarmFileSync,
+  beforeBootstrapLock: (_directory) => {},
+  beforeArchiveLegacy: (_directory) => {},
+  beforeArchiveRename: (_directory) => {},
   foldLegacyRegion,
+  legacyCloseSync: fs.closeSync,
+  legacyFstatSync: fs.fstatSync,
   mergeFoldedRecords,
-  sameProjectRoot
+  readSync: fs.readSync,
+  renameWithRetry,
+  sameProjectRoot,
+  statSync: fs.statSync,
+  writeCheckpointFile
 };
 
 export { PR_SUBSCRIPTIONS_FILE, PR_SUBSCRIPTIONS_CHECKPOINT_FILE, PR_SUBSCRIPTIONS_AUDIT_FILE, PR_SUBSCRIPTION_LIMITS, setOnSubscriptionCreated, buildCorrelationId, subscribe, unsubscribe, listActive, lookupByPr, updateSnapshot, sweepStale, getPrSubscriptionHealth, _internals };