pi-codex-marketplace 0.2.0 → 0.3.0

package/README.md

@@ -1,6 +1,6 @@
 # pi-codex-marketplace
 
-Bridge Package for Codex Marketplace compatibility in Pi (`Pi 0.84.2`).
+Bridge Package for Codex and Claude Marketplace compatibility in Pi (`Pi 0.84.2`).
 
 > **One-line:** `pi install npm:pi-codex-marketplace` → `/codex-marketplace` opens a responsive Bridge Ledger with Global authority, guarded lifecycle transactions, and three-orthogonal Receipt reporting.
 
@@ -42,9 +42,9 @@ Every mutation uses the shared transaction sequence **`Intent → Validation →
 
 The Ledger exposes these existing capabilities without changing their lifecycle semantics:
 
-- **檢視 Global 分區** — single `Global Scope` (`{getAgentDir()}/codex-marketplace/state.json`) workspace. Shows `schemaVersion` (v2), `stateRevision`, registrations/installations, empty-state guidance, and provenance notes.
-- **註冊本地 / Git Marketplace…** — local or Git Marketplace Source Registration. Local uses canonical real path; Git uses Canonical Git Locator (credential-free) + Normalized Git Selector (`default` / `branch refs/heads/*` / `tag refs/tags/*` / `commit` lower 40/64 hex) → Resolved Revision. Validation Disclosure shows source, Marketplace name, State Revision, Validation Snapshot fingerprint, entry outcomes, findings summary. **Registration Confirmation** is snapshot+revision bound, Default No. Blocking Findings (Contained Path / Contained Symlink / Budget / duplicate Source Key / locator/selector trust) block the attempt; concurrent attempt is blocked by Attempt Fence (`FENCE-01`); changed State Revision or snapshot yields `Rejected as Stale` (`STALE-01/02`).
-- **安裝 Compatible Plugin…** — the Plugins ledger is keyed directly by stable **Marketplace Entry ID** (`/plugins/<序號>`), classification, skills, Invocation Policies, and resources; each compatible row exposes `Install Disabled` and `Install and Enable` without reopening a display-label Entry selector. Unavailable rows remain visible with their exact reason (unsupported source kind / parse failure / Invalid / Incompatible / Plugin ID collision). Compatibility Profile v1 classifies every Plugin atomically as Compatible / Incompatible / Invalid; collision never changes classification. `Install Disabled` persists provenance without Activation Confirmation; `Install and Enable` discloses exact Plugin, skill list, Skill Resources, Invocation Policies, `Pi → Global` precedence and findings, then requires a separate **Default No** Activation Confirmation (bound to same snapshot+revision). Re-enabling a disabled Installation repeats validation and confirmation; disabling preserves its Installation ID.
+- **檢視 Global 分區** — single `Global Scope` (`{getAgentDir()}/codex-marketplace/state.json`) workspace. Shows `schemaVersion` (v3), `stateRevision`, registrations/installations, empty-state guidance, and provenance notes.
+- **註冊本地 / Git Marketplace…** — local or Git Marketplace Source Registration supporting dual Marketplace Formats (`codex` via `.agents/plugins/marketplace.json` and `claude` via `.claude-plugin/marketplace.json`, with codex precedence when both exist; missing both fails closed as `CATALOG_MISSING`). The derived `format` is fixed to the Registration record. Local uses canonical real path; Git uses Canonical Git Locator (credential-free) + Normalized Git Selector (`default` / `branch refs/heads/*` / `tag refs/tags/*` / `commit` lower 40/64 hex) → Resolved Revision. Validation Disclosure shows source, Marketplace name, Marketplace Format, State Revision, Validation Snapshot fingerprint, entry outcomes, findings summary. **Registration Confirmation** is snapshot+revision bound, Default No. Blocking Findings (Contained Path / Contained Symlink / Budget / duplicate Source Key / locator/selector trust) block the attempt; concurrent attempt is blocked by Attempt Fence (`FENCE-01`); changed State Revision or snapshot yields `Rejected as Stale` (`STALE-01/02`).
+- **安裝 Compatible Plugin…** — the Plugins ledger is keyed directly by stable **Marketplace Entry ID** (`/plugins/<序號>`), classification, skills, Invocation Policies, and resources; each compatible row exposes `Install Disabled` and `Install and Enable` without reopening a display-label Entry selector. Unavailable rows remain visible with their exact reason (unsupported source kind / entry-defined strict:false / parse failure / Invalid / Incompatible / Plugin ID collision). Compatibility Profile v2 classifies every Plugin atomically across Codex and Claude manifests as Compatible / Incompatible / Invalid; collision never changes classification. `Install Disabled` persists provenance without Activation Confirmation; `Install and Enable` discloses exact Plugin, skill list, Skill Resources, Invocation Policies, `Pi → Global` precedence and findings, then requires a separate **Default No** Activation Confirmation (bound to same snapshot+revision). Re-enabling a disabled Installation repeats validation and confirmation; disabling preserves its Installation ID.
 - **管理已安裝 Plugin（Enable / Disable）…** — toggle Installation State; disabling preserves provenance, enabling re-validates under current profile/ruleset/budget.
 - **檢視 Effective State 與 Projected Skills…** — read-time derived Effective State (Global Scope enabled installations) and Projected Skills with Runtime Skill Collision resolution (`Pi → Global Scope` exact name layering: pre-existing Pi skills reserve their names; non-colliding Bridge skills are projected; colliding Bridge skills within the same layer are unavailable). Whole-Plugin Blocking Findings block the Plugin; collision affects only that skill; `Available` is established only by independent host evidence (`AVAIL-01`).
 - **Refresh / 更新 Registration… (Marketplace Refresh → Update Candidate → Update Plan Checklist → Apply Update)** — Refresh is non-mutating and produces an Update Candidate when the validated source state differs (Plugin version alone does not; full-commit Git selector ref movement alone does not). Update Plan Checklist requires fresh **Registration Confirmation** + one explicit outcome per Installation (`update` / `disable` / `remove`, with `update` only when a Compatible candidate exists) + **Activation Confirmation** per enabled installation that remains enabled. Commit is a single atomic Lifecycle Operation replacing the Registration's Validation Snapshot and applying every disclosed consequence without mixing revisions.
@@ -61,9 +61,9 @@ Bridge State is the sole authority, stored in a **single Global Scope document**
 
 ```jsonc
 {
-  "schemaVersion": 2,
+  "schemaVersion": 3,
   "stateRevision": "1", // opaque monotonic (string "0" -> "1" -> "2" ...)
-  "registrations": [],  // immutable Registration ID = UUIDv4 allocated before preflight
+  "registrations": [],  // immutable Registration ID = UUIDv4, with format: "codex" | "claude"
   "installations": []   // Installed Plugins (enabled/disabled), each bound to a Validation Snapshot
 }
 ```
@@ -73,7 +73,7 @@ Only authoritative fields are persisted. `Effective State`, catalogs, compatibil
 - `State Revision` increments monotonically under file lock; commit is CAS-guarded by `expectedStateRevision` when supplied.
 - Writes are **atomic**: `write-to-temp → fsync → rename` + `fsync` parent dir + **file lock** (`.lock` sibling) + **WAL** (`state.json.wal`) + **read-after-verify**.
 - Cross-process concurrency is safe: lock serializes RMW; rename prevents torn reads; per-fingerprint `flock` guards Source Cache fetches with `p50 <200ms` on cache hit.
-- **WAL migration** (`src/bridge-state/migrate.ts`): supported forward migrations are applied atomically via WAL (`state.json.wal` fsynced before commit, replayed on the next read after a crash, cleaned after commit success). Migrations are **non-waivable, opt-in per version**, require no implicit activation, and preserve the active recovery chain. Schema v1 → v2 migration strips legacy `scopeOverrides` (non-empty overrides generate a non-blocking `MIGRATE-01` diagnostic finding without fail-closed) and normalizes Installation IDs (stripping legacy `global/` prefix). Unknown/older-without-path and newer (`schemaVersion > CURRENT_SCHEMA_VERSION`) versions are treated as **incompatible** — fail-closed, no auto-migration, no rollback. **Downgrade never writes back** (`isDowngradeAttempt` guard): a newer durable file is never overwritten by an older Bridge Package; the operator must update the package first.
+- **WAL migration** (`src/bridge-state/migrate.ts`): supported forward migrations are applied atomically via WAL (`state.json.wal` fsynced before commit, replayed on the next read after a crash, cleaned after commit success). Migrations are **non-waivable, opt-in per version**, require no implicit activation, and preserve the active recovery chain. Schema v1 → v2 migration strips legacy `scopeOverrides` (non-empty overrides generate a non-blocking `MIGRATE-01` diagnostic finding without fail-closed) and normalizes Installation IDs (stripping legacy `global/` prefix). Schema v2 → v3 migration populates `format: "codex"` on existing registrations without data loss while newly written registrations store `format: "codex" | "claude"`. Unknown/older-without-path and newer (`schemaVersion > CURRENT_SCHEMA_VERSION`) versions are treated as **incompatible** — fail-closed, no auto-migration, no rollback. **Downgrade never writes back** (`isDowngradeAttempt` guard): a newer durable file is never overwritten by an older Bridge Package; the operator must update the package first.
 - Corrupted / unknown `schemaVersion` → classified as **corrupted / incompatible (Persistence Indeterminate)**, **never auto-rollback** — fail-closed. `validateSchema` and `migrateForward` enforce the closed set `CORRUPTED_JSON` / `INVALID_SCHEMA` / `INCOMPATIBLE_SCHEMA_VERSION` / `UNKNOWN_OLD_VERSION` / `MIGRATION_FAILED`.
 
 See `src/bridge-state/` for `store.ts`, `atomic.ts`, `schema.ts`, `migrate.ts`, `paths.ts`.
@@ -113,7 +113,7 @@ Every row is a **release blocker**: `v*` may not publish unless the full matrix
 | E2E (highest seam — **TUI**) | pinned | macOS + Linux | 22.19.0 | **0.84.2** | full lifecycle (Register → Install Disabled / Install and Enable → Disable/Enable → Refresh → Update Plan Checklist → Apply Update / Rebind → Removal) with fence/cache/external observability |
 | E2E (highest seam — **TUI**) | adversarial | macOS + Linux | 22.19.0 | **0.84.2** | collision (`Pi → Global`), cache (`offline exact fingerprint hit` vs `stale never success`) |
 
-Fixtures: `tests/fixtures/synthetic/`, `tests/fixtures/pinned/` (captured `SamWang32191/codex-plugins@98e78ca` snapshot + fingerprint manifest), `tests/fixtures/adversarial/` (path-escape / symlink-loop / budget-overflow / malformed frontmatter corpora). See `tests/acceptance/` for the matrix runner that enforces per-row gating (any row failure blocks publish).
+Fixtures: `tests/fixtures/synthetic/` (including synthetic Claude and mattpocock-shaped marketplace fixtures), `tests/fixtures/pinned/` (captured `SamWang32191/codex-plugins@98e78ca` snapshot + fingerprint manifest), `tests/fixtures/adversarial/` (path-escape / symlink-loop / budget-overflow / malformed frontmatter corpora). See `tests/acceptance/` for the matrix runner that enforces per-row gating (any row failure blocks publish).
 
 Run locally:
 

package/extensions/pi/git-registration.ts

@@ -14,9 +14,10 @@ import type { ExtensionCommandContext, ExtensionUIContext } from '@earendil-work
 import {
   preflightGitRegistration,
   confirmGitRegistration,
+  type GitRegistrationFlowOptions,
 } from '../../src/registration/git-flow.js';
 import type { GitSelectorInput } from '../../src/registration/git-selector.js';
-import { uiText } from './ui-strings.js';
+import { marketplaceFormatText, uiText } from './ui-strings.js';
 import {
   fullValidationDisclosureLines,
   reportOutcome,
@@ -36,8 +37,14 @@ async function transactionStep(
   return false;
 }
 
+/**
+ * One interactive git registration flow invocation.
+ * The optional flow options thread the Acquisition Trust Base seams (executor / trust / cache)
+ * for tests and embedders; production callers rely on the real Git executor.
+ */
 export async function runGitRegistrationFlow(
   ctx: ExtensionCommandContext,
+  flowOpts: Pick<GitRegistrationFlowOptions, 'executor' | 'trust' | 'cache'> = {},
 ): Promise<void> {
   const ui: ExtensionUIContext = ctx.ui;
 
@@ -99,7 +106,7 @@ export async function runGitRegistrationFlow(
     ],
   })) return;
 
-  const opts = {};
+  const opts: GitRegistrationFlowOptions = { ...flowOpts };
   const res = await preflightGitRegistration(locator, selectorInput, opts);
   if (!res.ok) {
     await reportTerminalPreflightOutcome(ctx, res.outcome);
@@ -121,6 +128,7 @@ export async function runGitRegistrationFlow(
     }),
     uiText('reg.git.detail.resolvedRevision', { revision: quoteTerminalText(pf.resolvedRevision) }),
     uiText('reg.detail.marketplace', { name: quoteTerminalText(pf.marketplaceName) }),
+    uiText('reg.detail.format', { format: marketplaceFormatText(pf.format) }),
     uiText('reg.detail.entries', {
       total: pf.catalog.entries.length,
       locatable: pf.catalog.entries.filter((entry) => entry.available).length,

package/extensions/pi/journal.ts

@@ -18,7 +18,7 @@ import { acquireAttemptFence } from '../../src/registration/fence.js';
 import { blocking, CODE, notice, RULE, type ValidationFinding } from '../../src/registration/findings.js';
 import { createReceipt, type AttemptReceipt } from '../../src/registration/receipt.js';
 import { fullValidationDisclosureLines, reportOutcome } from './registration.js';
-import { attemptSummaryText, uiText } from './ui-strings.js';
+import { attemptSummaryText, marketplaceFormatText, uiText } from './ui-strings.js';
 import { quoteTerminalText } from './terminal-presentation.js';
 import { openTransactionSheet, type TransactionSheetModel } from './transaction-sheet.js';
 
@@ -478,6 +478,9 @@ export async function runReceiptJournalView(
         expected: quote(rc.expectedStateRevision),
         observed: quote(rc.observedStateRevision ?? rc.targetStateRevision ?? '?'),
       }));
+      if (rc.marketplaceFormat) {
+        lines.push('  ' + uiText('journal.view.receipt.format', { format: marketplaceFormatText(rc.marketplaceFormat) }));
+      }
       if (rc.recoversReceiptId) {
         lines.push('  ' + uiText('journal.view.receipt.recovers', { receiptId: quote(rc.recoversReceiptId) }));
       }

package/extensions/pi/registration.ts

@@ -17,7 +17,7 @@ import {
 } from '../../src/registration/flow.js';
 import { sortFindings, type ValidationFinding } from '../../src/registration/findings.js';
 import type { AttemptReceipt } from '../../src/registration/receipt.js';
-import { attemptSummaryText, findingOutcomeText, uiText, verdictText } from './ui-strings.js';
+import { attemptSummaryText, findingOutcomeText, marketplaceFormatText, uiText, verdictText } from './ui-strings.js';
 import { quoteTerminalText } from './terminal-presentation.js';
 import { openTransactionSheet, type TransactionSheetModel } from './transaction-sheet.js';
 
@@ -101,6 +101,7 @@ export async function runLocalRegistrationFlow(
     uiText('reg.detail.registrationId', { id: quoteTerminalText(pf.registrationId) }),
     uiText('reg.detail.source', { source: quoteTerminalText(pf.canonicalPath) }),
     uiText('reg.detail.marketplace', { name: quoteTerminalText(pf.marketplaceName) }),
+    uiText('reg.detail.format', { format: marketplaceFormatText(pf.format) }),
     uiText('reg.detail.entries', {
       total: pf.catalog.entries.length,
       locatable: pf.catalog.entries.filter((entry) => entry.available).length,
@@ -210,8 +211,12 @@ export async function reportOutcome(
     validationSnapshot: rc.validationSnapshot,
     receipt: rc,
   });
+  const notifyMessage = rc.marketplaceFormat
+    ? `${uiText('reg.outcome.notify', { summary: attemptSummaryText(rc.summary), receiptId: quoteTerminalText(rc.id) })} · ${
+        uiText('reg.outcome.notify.formatSuffix', { format: marketplaceFormatText(rc.marketplaceFormat) })}`
+    : uiText('reg.outcome.notify', { summary: attemptSummaryText(rc.summary), receiptId: quoteTerminalText(rc.id) });
   ctx.ui.notify(
-    uiText('reg.outcome.notify', { summary: attemptSummaryText(rc.summary), receiptId: quoteTerminalText(rc.id) }),
+    notifyMessage,
     notifyType,
   );
 }

package/extensions/pi/transaction-sheet.ts

@@ -13,6 +13,7 @@ import {
   attemptSummaryGloss,
   closedValue,
   findingOutcomeText,
+  marketplaceFormatText,
   recoveryActionGloss,
   transactionStepLabel,
   uiText,
@@ -98,6 +99,9 @@ function receiptAxes(receipt: AttemptReceipt, theme: TransactionSheetTheme): [st
     field(theme, uiText('sheet.field.kind'), receipt.kind),
     field(theme, uiText('sheet.field.operation'), receipt.operation),
     field(theme, uiText('sheet.field.trigger'), receipt.trigger),
+    ...(receipt.marketplaceFormat === undefined
+      ? []
+      : [field(theme, uiText('sheet.field.marketplaceFormat'), marketplaceFormatText(receipt.marketplaceFormat))]),
   ];
   return [durable, findings, runtime];
 }

package/extensions/pi/ui-strings.ts

@@ -15,6 +15,7 @@
  */
 
 import type { AttemptSummary, RecoveryAction } from '../../src/registration/receipt.js';
+import type { MarketplaceFormat } from '../../src/bridge-state/types.js';
 import type { ValidationFinding } from '../../src/registration/findings.js';
 import type { TransactionStep } from './transaction-sheet.js';
 
@@ -52,6 +53,8 @@ const zhTW = {
 
   // --- closed-value glosses (canonical always rendered first) ---------------
 
+  'format.gloss.codex': 'Codex 格式',
+  'format.gloss.claude': 'Claude 格式',
   'summary.gloss.Completed': '完成',
   'summary.gloss.Completed with diagnostics': '完成但有診斷',
   'summary.gloss.Declined': '已婉拒',
@@ -114,6 +117,7 @@ const zhTW = {
   'sheet.field.kind': '種類',
   'sheet.field.operation': '操作',
   'sheet.field.trigger': '觸發',
+  'sheet.field.marketplaceFormat': 'Marketplace Format',
   'sheet.attemptSummary': 'Attempt Summary',
   'sheet.recoveryActions': 'Recovery Actions（復原動作）',
   'sheet.keys': 'Enter：繼續｜Esc/q/Ctrl-C：取消',
@@ -225,6 +229,7 @@ const zhTW = {
   'reg.detail.registrationId': 'Registration ID {id}',
   'reg.detail.source': '來源 {source}',
   'reg.detail.marketplace': 'Marketplace {name}',
+  'reg.detail.format': 'Marketplace Format {format}',
   'reg.detail.entries': 'Entries {total}（可定位 {locatable} / 無法定位 {unavailable}）',
   'reg.detail.profile': 'Compatibility Profile {profile}',
   'reg.detail.ruleset': 'Validation Ruleset {ruleset}',
@@ -263,6 +268,7 @@ const zhTW = {
   'reg.commit.persist': '寫入 Registration ID {id}',
   'reg.commit.authority': '於 {scope} 以 State Revision {revision} 寫入授權文件',
   'reg.outcome.notify': 'Attempt Summary：{summary} · Receipt {receiptId}',
+  'reg.outcome.notify.formatSuffix': 'Marketplace Format {format}',
 
   // --- installation.ts ---------------------------------------------------------
   'inst.select.registered': '選擇已註冊 Marketplace',
@@ -390,6 +396,7 @@ const zhTW = {
   'journal.view.recent.empty': '（Journal 為空）',
   'journal.view.receipt.summary': '摘要：{summary}｜持久：{durable}｜運行時：{runtime}',
   'journal.view.receipt.revision': 'State Revision：{expected} → {observed}',
+  'journal.view.receipt.format': 'Marketplace Format：{format}',
   'journal.view.receipt.recovers': '復原對象：{receiptId}',
   'journal.view.receipt.findings': 'Findings：{findings}',
   'journal.notFound': 'Receipt Journal 找不到精確 Receipt ID {receiptId}。',
@@ -560,6 +567,11 @@ export function recoveryActionGloss(action: RecoveryAction): string {
   return glossId ? uiText(glossId) : '';
 }
 
+/** Marketplace Format closed value presented canonical-first with its zh_TW gloss. */
+export function marketplaceFormatText(format: MarketplaceFormat): string {
+  return closedValue(format, uiText(format === 'claude' ? 'format.gloss.claude' : 'format.gloss.codex'));
+}
+
 const STEP_GLOSS: Record<TransactionStep, MessageId> = {
   Intent: 'step.gloss.Intent',
   Validation: 'step.gloss.Validation',

package/package.json

@@ -1,13 +1,14 @@
 {
   "name": "pi-codex-marketplace",
-  "version": "0.2.0",
-  "description": "Bridge Package for Codex Marketplace compatibility in Pi — Global Bridge State, atomic persistence, and /codex-marketplace TUI",
+  "version": "0.3.0",
+  "description": "Bridge Package for Codex and Claude Marketplace compatibility in Pi — Global Bridge State, atomic persistence, and /codex-marketplace TUI",
   "type": "module",
   "keywords": [
     "pi-package",
     "pi",
     "pi-coding-agent",
     "codex",
+    "claude",
     "marketplace"
   ],
   "license": "MIT",

package/src/bridge-state/migrate.ts

@@ -48,6 +48,21 @@ const MIGRATIONS: Record<number, Migrator> = {
     }
     return { state: cloned, findings };
   },
+  2: (state: any) => {
+    // Issue #44 — registration `format` attribute (codex | claude) persistence foundation.
+    // Backfill a lossless 'codex' default onto every Registration missing a valid format; any
+    // already-declared 'codex' | 'claude' value is preserved untouched (no content loss).
+    const cloned = structuredClone(state);
+    if (Array.isArray(cloned.registrations)) {
+      cloned.registrations = cloned.registrations.map((reg: any) => {
+        if (typeof reg !== 'object' || reg === null) return reg;
+        if (reg.format === 'codex' || reg.format === 'claude') return reg;
+        return { ...reg, format: 'codex' };
+      });
+    }
+    cloned.schemaVersion = 3;
+    return { state: cloned };
+  },
 };
 
 export interface MigrationResult {

package/src/bridge-state/types.ts

@@ -11,15 +11,23 @@
 
 import type { ValidationFinding } from '../registration/findings.js';
 
-export const CURRENT_SCHEMA_VERSION = 2;
+export const CURRENT_SCHEMA_VERSION = 3;
 
 /** Opaque monotonic identifier. Stored as decimal string, incremented on each successful commit. */
 export type StateRevision = string;
 
+/** Marketplace Format — codex | claude (persistence foundation, issue #44).
+ *  Format detection / claude parsing is delivered by later tickets; the persistence
+ *  layer carries the value through and legacy registrations are backfilled to 'codex'
+ *  by the v2→v3 migration. Absence (pre-v3) always reads back as 'codex' after migration. */
+export type MarketplaceFormat = 'codex' | 'claude';
+
 /** Minimal shape for scaffold — later tickets extend with Source Key, Validation Snapshot, etc. */
 export interface Registration {
   /** Immutable lowercase UUIDv4, allocated before preflight */
   id: string;
+  /** Marketplace Format carried by this Registration. v2→v3 migration backfills 'codex' for legacy records. */
+  format?: MarketplaceFormat;
   /** Human-readable alias, derived from marketplace name */
   alias?: string;
   /** Declared marketplace name (kebab-case) */
@@ -54,6 +62,8 @@ export interface Registration {
   resolvedRevision?: string;
   /** Validation Snapshot fingerprint bound to Registration Confirmation */
   validationSnapshot?: string;
+  /** Per-entry Validation Snapshot fingerprints bound to Registration Confirmation (issue #50). */
+  entrySnapshots?: Record<string, string>;
   /** Bound Compatibility Profile / Ruleset / Budget ids at confirmation time */
   snapshotBinds?: { profile?: string; ruleset?: string; budget?: string };
 }

package/src/cache/source-cache.ts

@@ -59,6 +59,7 @@ export interface CacheIndexRecord {
 
 export interface PendingUpdateRecord {
   registrationId: string;
+  entryId?: string;
   fingerprint: string;
   recordedAtMs: number;
 }
@@ -254,7 +255,7 @@ export class SourceCache {
   // ---- Pending Update Candidate registry ---------------------------------
 
   recordPendingUpdate(rec: Omit<PendingUpdateRecord, 'recordedAtMs'>): void {
-    const records = this.pendingUpdates().filter((r) => !(r.registrationId === rec.registrationId));
+    const records = this.pendingUpdates().filter((r) => !(r.registrationId === rec.registrationId && r.entryId === rec.entryId));
     records.push({ ...rec, recordedAtMs: this.now() });
     atomicWriteFile(getCachePendingPath(this.root), JSON.stringify(records));
   }