task-pipeline-skill 1.97.1 → 1.99.0

package/plugins/task-pipeline/skills/task-pipeline/scripts/lessons.py

@@ -9,8 +9,10 @@ lesson/1), and the index projects every such entry from every project on this ma
 one file that stage 0 queries by the task's nouns.
 
 **The retro stays canonical; the index is a projection.** It can be lost and rebuilt from
-the retros (`rebuild`), and a rebuild equals the incremental index byte for byte, because an
-entry is a pure function of its origins.
+the retros (`rebuild`). An entry is a pure function of its origins, so a complete rebuild of
+the same retros from the same checkouts, with nothing carried and no memory id recorded,
+equals the incremental index byte for byte. Otherwise the rebuild also holds what only the
+previous index knew: carried origins, their provenance and memory ids.
 
     lessons.py add --retro FILE (--entry ANCHOR ... | --all) [--root DIR]
     lessons.py add --json FILE|-                              [--root DIR]
@@ -18,9 +20,26 @@ entry is a pure function of its origins.
         classKey makes it a candidate, a repeat from the same project revises, never mints
     lessons.py query NOUN ... [--limit 5]
         at most --limit lines: `[lesson L-<sha12>] title — trigger — check (seen N, projects K)`
-    lessons.py rebuild --roots DIR ... [--depth 3]
-        re-derive the whole index from every retro found under the roots; incomplete
-        discovery or an unreadable/invalid lesson source refuses without changing the index
+    lessons.py rebuild --roots DIR ... [--depth 3] [--prune-carried [--prune-carried-reason R]]
+        re-derive the index from every retro found under the roots and their git worktrees.
+        A rebuild never removes or moves anything on its own: every previous origin it does
+        not re-derive is carried forward, marked `carried: <reason>`, and named, keeping its
+        memory id — except an origin v1.95.0 wrote (no provenance) that this run proves is the
+        same repository under a new key (its commit resolves in that checkout, descends from the
+        new key's root, and v1.95.0 would have keyed that checkout as the origin; its project is
+        not known to the index): it is re-keyed, its memory id kept and its source key recorded
+        (`rekeyedFrom`). When that source project is read later (rebuild or add) or records
+        the id, it takes the id back, named as `reclaimed:`, so the final owner never depends
+        on which verb ran first. One memory id stays on one live project (the earlier holder),
+        in rebuild and add; the other is named. `--prune-carried` (optionally one reason) is
+        the only way an origin leaves the index; --prune-carried-reason needs --prune-carried
+        and takes only a reason a rebuild produces. An origin whose every checkout now holds another project, without
+        the origin's own commit, is kept but not counted. A shallow clone — or one whose
+        shallow check does not answer — is never a source. Memory ids follow (project,
+        classKey). Messages — stdout and stderr, in every verb but `path` — name checkouts and
+        files, never an absolute path. Exit 1, touching nothing, only when nothing could be
+        read: every root missing or unreadable; a readable empty root exits 0 and writes the
+        index
     lessons.py candidates [--min-projects 2]
         lessons two or more projects hold: the `retro.publish` queue for learned.md
     lessons.py show L-<sha12>
@@ -30,9 +49,16 @@ entry is a pure function of its origins.
         session lists it, else `observatory_record` (the default; memoryId and expectedRevision
         once recorded). The same pseudonymous project key, never a `project:<slug>` id; the
         commit as `commit:` + 12 hex. The agent calls the tool
-    lessons.py record L-<sha12> --answer FILE|- [--ledger PATH] [--root DIR]
+    lessons.py record L-<sha12> --answer FILE|- [--ledger PATH] [--root DIR] [--replace]
         keep the store's memory id beside this project's origin; a refusal becomes one ledger
-        line (`event: lessons — store refused — <code>`) and the local entry stays
+        line (`event: lessons — store refused — <code>`) and the local entry stays. Replacing a
+        different id this origin holds needs --replace; an id another project's or class's
+        origin holds is refused (exit 1) — unless that origin is carried as `checkout holds
+        another project` from this very checkout (the re-attach after a re-init), or took the
+        id by a re-key from this project (then this project reclaims it) — and one the
+        index cannot hold (`mem:<id>@<rev>`, no
+        quote, backslash or space) exits 2. add, emit-observatory and record refuse in a
+        shallow clone: its project key is not stable until it is deepened
     lessons.py path
         the index this invocation would use
 
@@ -65,7 +91,8 @@ SHA or a repository name in text no pattern can tell from an ordinary word — t
 writer's duty, with names. A person's or a customer's
 name a pattern cannot see; that stays the writer's duty (`references/retrospective.md` →
 *What may leave the project*). The project is a pseudonymous key — `p-` and 12 hex digits
-of the repository's root commit — never its name, and the evidence commit must resolve in
+of the repository's root commit, the first-parent root of its default branch (else the branch
+init.defaultBranch names, then the main worktree's HEAD), shared by every worktree of it; never its name, and the evidence commit must resolve in
 the repository it came from.
 
 **The retro line it reads**, inside a `### ` entry of the retro or its archive:
@@ -76,9 +103,14 @@ with the entry's own `**Surfaced at:** stage N · **Owned by:** stage M`, `**Fix
 `**The check:**` and `**Commit:** `<sha>`` lines. An entry with no Lesson line is private to
 its project and is skipped, counted aloud.
 
-Exit codes: 0 done (an absent index on `query` is a state, printed); 1 a refusal — a lesson
-that fails lesson/1, a commit that does not resolve, a held lock, an unknown id; 2 usage or an
-unreadable input. Stdlib only (`references/portability.md`).
+Exit codes: 0 done (an absent index on `query` is a state, printed; a `rebuild` that named
+what it skipped or carried); 1 a refusal — a lesson that fails lesson/1 or whose commit does
+not resolve on `add`, a held lock, an unknown id, a `rebuild` whose every root was missing or
+unreadable, a `record` naming an id another class or another project holds, an older
+revision or (without --replace) a different id, and add/emit/record in a shallow clone; 2 usage
+(--prune-carried-reason without --prune-carried, or a reason a rebuild never produces), a
+memory id the index cannot hold, or an unreadable input. Stdlib only
+(`references/portability.md`).
 """
 from __future__ import annotations
 
@@ -188,17 +220,30 @@ def set_aside(path: pathlib.Path) -> pathlib.Path:
 def open_index(idx: pathlib.Path, notes: list[str]) -> dict[str, dict]:
     """The index's entries — the same corrupt handling for the family index and the standalone
     one: a file that does not parse is a DERIVED file gone bad, never a reason to exit 1. It is
-    set aside as `.corrupt-<date>[-n]` and the run goes on from empty; `rebuild --roots`
-    re-derives it. A file that cannot be READ (permissions) is the one refusal: its contents may
-    be good, so nothing replaces it."""
+    set aside whole as `.corrupt-<date>[-n]`; every line that still parses (memory ids and
+    carried origins included) is salvaged into the live index at once, and the run goes on from
+    that; `rebuild --roots` re-derives the rest. A file that cannot be READ (permissions) is the
+    one refusal: its contents may be good, so nothing replaces it."""
     try:
-        return load(idx)
+        mine: list[str] = []
+        out = load(idx, mine)
+        notes += mine
+        return out
     except IndexCorrupt:
+        good, future, bad, only = _salvage(idx, notes)
         dest = set_aside(idx)
-        notes.append(f"the index {idx} could not be parsed — kept as {dest.name}; "
-                     "`lessons.py rebuild --roots <dir>` re-derives it from the retros")
-        _FUTURE[str(idx)] = []
-        return {}
+        notes.append(f"the index {idx} could not be parsed — kept whole as {dest.name}; "
+                     f"{len(good)} lesson line{'' if len(good) == 1 else 's'} salvaged into the "
+                     f"live index, {bad} bad line{'' if bad == 1 else 's'} left only in {dest.name}; "
+                     "`lessons.py rebuild --roots <dir>` re-derives the rest from the retros")
+        if only:
+            notes.append(f"memory id{'' if len(only) == 1 else 's'} held only by a bad line, kept "
+                         f"in {dest.name} and nowhere else: {', '.join(sorted(only))}")
+        _CORRUPT_ONLY[str(idx)] = (dest.name, only)
+        _FUTURE[str(idx)] = future
+        if good or future:
+            save(idx, good)  # under the session's lock: a read-only verb keeps the salvage too
+        return good
 
 
 def _merge_legacy(idx: pathlib.Path, notes: list[str]) -> None:
@@ -223,6 +268,9 @@ def _merge_legacy(idx: pathlib.Path, notes: list[str]) -> None:
     old_future = list(_FUTURE.get(str(legacy), []))
     both = idx.exists()
     new = open_index(idx, notes) if both else {}
+    # A family file that did not parse was set aside by open_index: only one file was read.
+    set_aside_family = both and not idx.exists()
+    both = both and not set_aside_family
     copied = [k for k in sorted(old) if k not in new]
     for k in copied:
         new[k] = old[k]
@@ -236,9 +284,12 @@ def _merge_legacy(idx: pathlib.Path, notes: list[str]) -> None:
     except OSError as exc:
         raise Refused(f"merged the old index into {idx} but could not rename {legacy} "
                       f"({type(exc).__name__}) — remove it by hand so one index is read")
-    what = "both index files existed — read both: merged" if both else "moved the local index from"
-    notes.append(f"{what} {legacy} into {idx} — {len(copied)} of {len(old)} lessons copied, the "
-                 f"family copy kept wherever both had one; the old file is kept as {dest.name}")
+    what = ("both index files existed — read both: merged" if both else
+            "the family index was corrupt and set aside, so only the local one was read: moved"
+            if set_aside_family else "moved the local index from")
+    kept = "" if set_aside_family else ", the family copy kept wherever both had one"
+    notes.append(f"{what} {legacy} into {idx} — {len(copied)} of {len(old)} lessons copied"
+                 f"{kept}; the old file is kept as {dest.name}")
 
 
 class session:
@@ -279,7 +330,7 @@ class session:
             lk.__exit__(None, None, None)
         self.locks = []
         for n in self.notes:
-            print(f"lessons: {n}", file=sys.stderr)
+            print(f"lessons: {_say(n)}", file=sys.stderr)
         self.notes = []
 
     def __exit__(self, *exc):
@@ -312,19 +363,114 @@ def repo_root(start: pathlib.Path) -> pathlib.Path:
     if not top:
         raise Refused(f"{start} is not inside a git repository — a lesson carries its evidence "
                       "commit, and a commit needs a repository")
+    _show(pathlib.Path(top))
     return pathlib.Path(top)
 
 
+_KEYS: dict[str, str] = {}
+# Absolute paths a message shows by name (round 12, E; round 13, O): `rebuild` fills it, and
+# every line it prints — stdout, the session's notes, a refusal — goes through `_say`.
+_SHOWN: dict[str, str] = {}
+
+
+def _show(path: pathlib.Path, home_relative: bool = False) -> None:
+    """Show `path` — as given and as resolved — by its name in every message (round 14, L3). An
+    index file is shown home-relative (`~/.sshlg-skills/lessons/index.jsonl`) where it lies
+    under the home directory, so the family's and the standalone index stay told apart."""
+    try:
+        real = path.resolve()
+    except OSError:
+        real = path
+    name = real.name or path.name
+    if home_relative:
+        try:
+            name = "~/" + real.relative_to(pathlib.Path.home().resolve()).as_posix()
+        except (ValueError, RuntimeError, OSError):
+            pass
+    for form in {str(path), str(real), str(path.expanduser())}:
+        if os.path.isabs(form) and name:
+            _SHOWN[form] = name
+
+
 def project_key(root: pathlib.Path) -> str:
-    """`p-` + 12 hex of the repository's root commit: stable across clones, names nothing."""
-    roots = _git(root, "rev-list", "--max-parents=0", "HEAD")
-    if not roots:
-        raise Refused(f"the repository at {root} has no commit — a project key needs one")
-    return "p-" + sorted(roots.split())[0][:12]
+    """`p-` + 12 hex of the repository's root commit: stable across clones, names nothing.
+
+    The REPOSITORY's root, not the checked-out branch's (round 12): the first-parent root of the
+    default branch: `origin/HEAD`, else `main`, else `master`, else the branch
+    `init.defaultBranch` names (round 17, L1: it names the default, wherever the main worktree
+    stands); without any of them the MAIN worktree's HEAD, read in the common directory (round
+    13: one answer for every worktree, so a linked worktree on an orphan branch is not a second
+    project), else this checkout's HEAD. A worktree on a branch that merged an unrelated history, or a
+    checkout sitting on an orphan `gh-pages`, is still its repository's project. Computed once
+    per `git rev-parse --git-common-dir`, so every worktree of one repository shares it."""
+    common = _git(root, "rev-parse", "--path-format=absolute", "--git-common-dir")
+    key = common or str(root)
+    if key in _KEYS:
+        return _KEYS[key]
+    refs: list[tuple[tuple[str, ...], str]] = []
+    head = _git(root, "symbolic-ref", "-q", "refs/remotes/origin/HEAD")
+    if head:
+        refs.append(((), head))
+    refs += [((), "refs/heads/main"), ((), "refs/heads/master")]
+    # The configured default before the main worktree's HEAD (see the docstring): a main
+    # worktree checked out on an orphan `pages` branch must not move the repository's key.
+    default = _git(root, "config", "--get", "init.defaultBranch")
+    if default:
+        refs.append(((), "refs/heads/" + default))
+    if common:
+        refs.append((("--git-dir", common), "HEAD"))  # the main worktree's HEAD
+    refs.append(((), "HEAD"))
+    for extra, ref in refs:
+        if _git(root, *extra, "rev-parse", "-q", "--verify", ref + "^{commit}") is None:
+            continue
+        roots = _git(root, *extra, "rev-list", "--max-parents=0", "--first-parent", ref)
+        if roots:
+            _KEYS[key] = "p-" + roots.split()[-1][:12]
+            return _KEYS[key]
+    raise Refused(f"the repository {root.name} has no commit — a project key needs one")
+
+
+_RESOLVES: dict[tuple[str, str], bool] = {}
 
 
 def commit_resolves(root: pathlib.Path, sha: str) -> bool:
-    return _git(root, "cat-file", "-e", f"{sha}^{{commit}}") is not None
+    """Does `sha` name a commit in this checkout? Asked of git once per (checkout, sha) in a
+    run (round 14, L2): a rebuild asks it for every carried origin in every checkout of its
+    provenance, and 150 origins over 5 checkouts doubled the run. Only an answer is cached; a
+    git that does not answer raises, uncached, every time."""
+    key = (os.path.realpath(root), sha)
+    if key not in _RESOLVES:
+        _RESOLVES[key] = _git(root, "cat-file", "-e", f"{sha}^{{commit}}") is not None
+    return _RESOLVES[key]
+
+
+_LEGACY_KEYS: dict[str, str | None] = {}
+_ROOTS: dict[tuple[str, str], frozenset] = {}
+
+
+def _legacy_key(checkout: str) -> str | None:
+    """The key v1.95.0 gave this checkout: `p-` + the SMALLEST root commit of HEAD (round 14,
+    F1). None when git cannot say. Cached per checkout."""
+    if checkout not in _LEGACY_KEYS:
+        try:
+            roots = _git(pathlib.Path(checkout), "rev-list", "--max-parents=0", "HEAD")
+        except Refused:
+            roots = None
+        _LEGACY_KEYS[checkout] = "p-" + sorted(roots.split())[0][:12] if roots else None
+    return _LEGACY_KEYS[checkout]
+
+
+def _roots_of(checkout: str, sha: str) -> frozenset:
+    """The 12-hex prefixes of the root commits `sha` descends from in this checkout; empty when
+    git cannot say. Cached per (checkout, sha)."""
+    key = (checkout, sha)
+    if key not in _ROOTS:
+        try:
+            roots = _git(pathlib.Path(checkout), "rev-list", "--max-parents=0", sha)
+        except Refused:
+            roots = None
+        _ROOTS[key] = frozenset(r[:12] for r in (roots or "").split())
+    return _ROOTS[key]
 
 
 def slug(text: str) -> str:
@@ -350,8 +496,11 @@ def _check_text(name: str, value: object, lo: int, hi: int) -> list[str]:
     errs = []
     if not lo <= len(value) <= hi:
         errs.append(f"{name} is {len(value)} characters; lesson/1 allows {lo}-{hi}")
-    if "\n" in value or "\r" in value:
-        errs.append(f"{name} carries a line break — one line each")
+    # Every character str.splitlines() breaks on, not only \n and \r (round 12, B): a U+2028 in a
+    # title once made every later read of the index call it corrupt.
+    if value != "".join(value.splitlines()) or any(ch in value for ch in "\r\n"):
+        errs.append(f"{name} carries a line break (\\n, \\r, U+2028, U+2029, U+0085 or "
+                    "another separator) — one line each")
     for rx, what in FORBIDDEN:
         if rx.search(value):
             errs.append(f"{name} carries {what}")
@@ -382,6 +531,12 @@ def validate(lesson: object) -> list[str]:
             or not all(isinstance(v, (int, str)) and not isinstance(v, bool) and str(v).strip()
                        for v in st.values())):
         errs.append("stages is not {owned, surfaced}")
+    else:
+        # A stage id that is a string gets the text fields' checks (round 13, P): one line, at
+        # most 32 characters, no path, URL or credential shape.
+        for k in ("owned", "surfaced"):
+            if isinstance(st[k], str):
+                errs += _check_text(f"stages.{k}", st[k], 1, 32)
     nouns = lesson["nouns"]
     if (not isinstance(nouns, list) or not 3 <= len(nouns) <= 8
             or len(set(map(str, nouns))) != len(nouns)):
@@ -436,8 +591,10 @@ def _relative(root: pathlib.Path, path: pathlib.Path) -> str:
         raise Refused(f"{path} is outside the repository at {root}")
 
 
-def parse_retro(path: pathlib.Path, root: pathlib.Path, project: str) -> tuple[list[dict], int, list[str]]:
-    """Lessons from one retro file: (lessons, entries without a Lesson line, refusals)."""
+def parse_retro(path: pathlib.Path, root: pathlib.Path, project: str,
+                refused: set[str] | None = None) -> tuple[list[dict], int, list[str]]:
+    """Lessons from one retro file: (lessons, entries without a Lesson line, refusals).
+    `refused`, when given, collects the `retro#anchor` of every Lesson entry refused here."""
     try:
         text = path.read_text(encoding="utf-8")
     except (OSError, UnicodeError) as exc:
@@ -481,6 +638,8 @@ def parse_retro(path: pathlib.Path, root: pathlib.Path, project: str) -> tuple[l
         if missing:
             problems.append(f"{rel}#{anchor}: the Lesson line needs the entry's "
                             + ", ".join(missing))
+            if refused is not None:
+                refused.add(f"{rel}#{anchor}")
             continue
 
         def stage(v: str) -> int | str:
@@ -503,37 +662,57 @@ def _origin_key(o: dict) -> tuple:
 
 
 def derive(origins: list[dict]) -> dict:
-    """One index entry as a pure function of its origins — so rebuild equals incremental."""
+    """One index entry as a pure function of its origins (carried ones and their memory ids
+    included) — so a complete rebuild with nothing carried equals the incremental index.
+
+    `seen`, `projects` and `status` count re-derived origins and origins carried for a
+    temporary unavailability; an origin carried as `checkout holds another project` is kept but
+    NOT counted (round 11): a stranger at a path, or one checkout under a new root commit, never
+    makes a phantom second project. Applied at load too, so these fields are never trusted from
+    disk (round 11, #6)."""
     origins = sorted(origins, key=lambda o: (_origin_key(o), json.dumps(o, sort_keys=True)))
     first = origins[0]["lesson"]
     nouns = sorted({n for o in origins for n in o["lesson"]["nouns"]}, key=str.casefold)
-    projects = len({o["project"] for o in origins})
+    counted = [o for o in origins if o.get("carried") != CARRY_FOREIGN]
+    projects = len({o["project"] for o in counted})
     return {"schema": "lesson-index/1", "id": lesson_id(first["classKey"]),
             "classKey": first["classKey"], "title": first["title"], "trigger": first["trigger"],
             "check": first["check"], "grade": min(o["lesson"]["grade"] for o in origins),
-            "stages": first["stages"], "nouns": nouns, "seen": len(origins),
+            "stages": first["stages"], "nouns": nouns, "seen": len(counted),
             "projects": projects, "status": "candidate" if projects >= 2 else "local",
             "origins": origins}
 
 
-def _origin(lesson: dict, memory: str | None = None) -> dict:
+def _origin(lesson: dict, memory: str | None = None, checkouts: list[str] | None = None) -> dict:
     o = lesson["origin"]
     body = {k: lesson[k] for k in FIELDS if k not in ("schema", "origin")}
     rec = {"project": o["project"], "commit": o["commit"], "retro": o["retro"], "lesson": body}
     if memory:
         rec["memory"] = memory
+    if checkouts:
+        rec["checkouts"] = sorted(set(checkouts))
     return rec
 
 
-def merge(entries: dict[str, dict], lessons: list[dict]) -> int:
-    """Merge lessons into {classKey: entry}; returns how many origins changed."""
+def checkout_id(root: pathlib.Path) -> str:
+    """A checkout's provenance: its real top-level path. Stays in the local index; never emitted."""
+    return str(root.resolve())
+
+
+def merge(entries: dict[str, dict], lessons: list[dict], checkout: str | None = None) -> int:
+    """Merge lessons into {classKey: entry}; returns how many origins changed. `checkout` is the
+    checkout the lessons were read from: an origin's provenance is the union of the checkouts
+    that held it (round 9) — the only checkouts that may later show it is gone."""
     changed = 0
     for le in lessons:
         ck = le["classKey"]
         origins = list(entries[ck]["origins"]) if ck in entries else []
         key = (le["origin"]["project"], le["origin"]["retro"])
         old = next((o for o in origins if _origin_key(o) == key), None)
-        new = _origin(le, old.get("memory") if old else None)
+        prov = list((old or {}).get("checkouts") or []) + ([checkout] if checkout else [])
+        new = _origin(le, old.get("memory") if old else None, prov)
+        if old and old.get("memory") and old.get("rekeyedFrom"):
+            new["rekeyedFrom"] = old["rekeyedFrom"]  # the id's source key travels with it (round 16)
         if old == new:
             continue
         origins = [o for o in origins if _origin_key(o) != key] + [new]
@@ -555,9 +734,167 @@ class IndexCorrupt(Refused):
 # Lines in a NEWER format, per index path: skipped on read, counted, and written back on save,
 # so an older script never destroys what a newer one wrote.
 _FUTURE: dict[str, list[str]] = {}
+# Per index path: the `.corrupt-<date>` file name and the memory ids only its bad lines held.
+_CORRUPT_ONLY: dict[str, tuple[str, set[str]]] = {}
+
+
+ENTRY_TEXT = ("id", "title", "trigger", "check")
+LESSON_KEYS = tuple(k for k in FIELDS if k not in ("schema", "origin"))
+MEM_RE = re.compile(r"mem:[^@\s\"\\]+@[1-9][0-9]*")  # revisions start at 1 (round 11, #5)
+
+
+def mem_base(memory: str) -> str:
+    """A memory id without its revision: `mem:x@3` → `mem:x`. Ids compare on this (round 9, L3)."""
+    return memory.rsplit("@", 1)[0]
+
+
+def mem_rev(memory: str) -> int:
+    try:
+        return int(memory.rsplit("@", 1)[1])
+    except (IndexError, ValueError):
+        return 0
+
+
+def _entry_shape(e: object) -> bool:
+    """A lesson-index/1 line every verb can use (rounds 8–11, L1/L2/H2): the entry's own fields
+    with their types — class key, id, title, trigger, check, nouns (strings), seen, projects —
+    and a non-empty list of origins, each with its project, retro, commit and a lesson that
+    lesson/1 itself accepts (`validate`, with that origin), of the entry's class. Optional
+    fields keep their types: memory `mem:<id>@<rev>` with rev from 1, checkouts non-empty
+    strings, carried one of CARRY_REASONS. Anything less is a corrupt line — set aside, its good
+    neighbours salvaged — never a TypeError in the middle of a verb. Derived fields (seen,
+    projects, status, id…) are recomputed by `_put` anyway."""
+    if not isinstance(e, dict) or not isinstance(e.get("classKey"), str):
+        return False
+    if not all(isinstance(e.get(k), str) for k in ENTRY_TEXT):
+        return False
+    if not isinstance(e.get("nouns"), list) or not all(isinstance(n, str) for n in e["nouns"]):
+        return False
+    if not all(isinstance(e.get(k), int) and not isinstance(e.get(k), bool) for k in ("seen", "projects")):
+        return False
+    origins = e.get("origins")
+    if not isinstance(origins, list) or not origins:
+        return False
+    for o in origins:
+        if not (isinstance(o, dict) and all(isinstance(o.get(k), str) for k in ("project", "retro", "commit"))
+                and isinstance(o.get("lesson"), dict) and all(k in o["lesson"] for k in LESSON_KEYS)):
+            return False
+        body = {k: o["lesson"][k] for k in LESSON_KEYS}
+        whole = dict(body, schema="lesson/1",
+                     origin={"project": o["project"], "commit": o["commit"], "retro": o["retro"]})
+        if validate(whole) or body["classKey"] != e["classKey"]:
+            return False
+        if "memory" in o and not (isinstance(o["memory"], str) and MEM_RE.fullmatch(o["memory"])):
+            return False
+        if "checkouts" in o and not (isinstance(o["checkouts"], list)
+                                     and all(isinstance(c, str) and c for c in o["checkouts"])):
+            return False
+        if "carried" in o and o["carried"] not in CARRY_REASONS:
+            return False
+        if "rekeyedFrom" in o and not (isinstance(o["rekeyedFrom"], str)
+                                       and PROJECT.match(o["rekeyedFrom"]) and o.get("memory")):
+            return False
+    return True
+
+
+def _stage_id(v: object) -> object:
+    """A stage id lesson/1 accepts today, from one v1.95.0 accepted (round 14, L5): a string
+    that fails the text checks (longer than 32 characters, a line break, a path or credential
+    shape) is folded to one line and cut to 32 characters, and one that still fails becomes
+    `stage`. Anything else is returned as it is, for the shape check to judge."""
+    if not isinstance(v, str) or not v.strip() or not _check_text("s", v, 1, 32):
+        return v
+    folded = " ".join(" ".join(v.splitlines()).split())[:32].strip()
+    return folded if folded and not _check_text("s", folded, 1, 32) else "stage"
+
+
+def _migrate_stages(e: object, notes: list[str] | None) -> None:
+    """Normalise, in place, the stage ids of an index line written before lesson/1 checked them
+    (`_stage_id`), and say so — so the line is read, never set aside as corrupt, and no memory
+    id it holds is lost. The next write stores the normalised ids."""
+    if not isinstance(e, dict):
+        return
+    holders = [e] + [o["lesson"] for o in e.get("origins") or []
+                     if isinstance(o, dict) and isinstance(o.get("lesson"), dict)]
+    changed = False
+    for h in holders:
+        st = h.get("stages")
+        if isinstance(st, dict):
+            for k in ("owned", "surfaced"):
+                if k in st and _stage_id(st[k]) != st[k]:
+                    st[k] = _stage_id(st[k])
+                    changed = True
+    if changed and notes is not None:
+        notes.append(f"{e.get('classKey', '?')}: a stage id written before lesson/1 checked stage "
+                     "ids was normalised (one line, at most 32 characters)")
+
+
+def _put(out: dict[str, dict], e: dict, notes: list[str] | None) -> None:
+    """Every line read is normalised: one origin per (project, retro) — the one with the higher
+    memory revision winning (on a tie the lexically smaller id), its provenance the union of both copies' (round 10, G5) — and the
+    entry re-derived from its origins, so `seen`, `projects`, `status` and the rest are never
+    trusted from disk (round 11, #6). Two lines for one class key (a hand-concatenated index)
+    merge their origins, never last-one-wins (round 9, L4/D3), and that is said aloud — naming
+    every memory id the merge dropped (round 12: one origin holds one id)."""
+    ck = e["classKey"]
+    twice = ck in out
+    by_key: dict[tuple, dict] = {}
+    dropped: list[str] = []
+    for o in (out[ck]["origins"] if twice else []) + e["origins"]:
+        k = _origin_key(o)
+        if k in by_key:
+            # The higher revision wins; on equal revisions the lexically smaller id, then the
+            # smaller line — never the order the lines happen to be in (round 13, Q).
+            keep, other = sorted((o, by_key[k]), key=lambda x: (
+                -mem_rev(x.get("memory") or ""), x.get("memory") or "", json.dumps(x, sort_keys=True)))
+            if other.get("memory") and mem_base(other["memory"]) != mem_base(keep.get("memory") or ""):
+                dropped.append(other["memory"])
+            prov = sorted(set(keep.get("checkouts") or []) | set(other.get("checkouts") or []))
+            o = dict(keep, **({"checkouts": prov} if prov else {}))
+        by_key[k] = o
+    out[ck] = derive(list(by_key.values()))
+    if notes is not None and (twice or dropped):
+        lost = f"dropped {', '.join(dropped)}" if dropped else "none dropped"
+        notes.append(f"{'two lines' if twice else 'one line'} for {ck} merged — {len(by_key)} origin"
+                     f"{'' if len(by_key) == 1 else 's'} kept, {lost}")
+
+
+def _salvage(path: pathlib.Path, notes: list[str] | None = None
+             ) -> tuple[dict[str, dict], list[str], int, set[str]]:
+    """The lines of a corrupt index that still parse: (entries, newer-format lines, bad lines,
+    memory ids seen only in bad lines). A corrupt index is set aside whole; what parses is
+    carried into the live index, so one bad line never costs every memory id and carried origin
+    beside it (round 8, L2), and an id only a bad line held is named (round 9, D2)."""
+    out, future, bad, bad_mems = {}, [], 0, set()
+    try:
+        raw = path.read_bytes()
+    except OSError:
+        return out, future, 0, bad_mems
+    for chunk in raw.split(b"\n"):  # "\n" only, as `dump` writes (round 12, B)
+        if not chunk.strip():
+            continue
+        try:
+            line = chunk.decode("utf-8")
+            e = json.loads(line)
+        except (UnicodeDecodeError, ValueError):
+            bad += 1
+            bad_mems |= set(MEM_RE.findall(chunk.decode("utf-8", "replace")))
+            continue
+        if isinstance(e, dict) and e.get("schema", "lesson-index/1") != "lesson-index/1":
+            future.append(line)
+            continue
+        _migrate_stages(e, notes)
+        if _entry_shape(e):
+            _put(out, e, notes)
+        else:
+            bad += 1
+            bad_mems |= set(MEM_RE.findall(line))
+    held = {o["memory"] for e in out.values() for o in e["origins"] if o.get("memory")}
+    return out, future, bad, {m for m in bad_mems
+                              if mem_base(m) not in {mem_base(h) for h in held}}
 
 
-def load(path: pathlib.Path) -> dict[str, dict]:
+def load(path: pathlib.Path, notes: list[str] | None = None) -> dict[str, dict]:
     if not path.exists():
         return {}
     try:
@@ -569,7 +906,10 @@ def load(path: pathlib.Path) -> dict[str, dict]:
         raise IndexUnreadable(f"the index {path} cannot be read ({type(exc).__name__}) — fix "
                               "its permissions; nothing was written")
     out, future = {}, []
-    for i, line in enumerate(text.splitlines(), 1):
+    # One index line per "\n", exactly as `dump` writes it — never str.splitlines(), which also
+    # breaks on U+2028/U+2029/U+0085 inside a JSON string written with ensure_ascii=False and
+    # made every later read call a good index corrupt (round 12, B).
+    for i, line in enumerate(text.split("\n"), 1):
         if not line.strip():
             continue
         try:
@@ -580,14 +920,15 @@ def load(path: pathlib.Path) -> dict[str, dict]:
         if isinstance(e, dict) and e.get("schema", "lesson-index/1") != "lesson-index/1":
             future.append(line)
             continue
-        if not isinstance(e, dict) or not isinstance(e.get("classKey"), str):
+        _migrate_stages(e, notes)
+        if not _entry_shape(e):
             raise IndexCorrupt(f"the index {path} has a line that is not a lesson (line {i}) — "
                                "`lessons.py rebuild` keeps it as .corrupt-<date> and re-derives it")
-        out[e["classKey"]] = e
+        _put(out, e, notes)
     _FUTURE[str(path)] = future
     if future:
-        print(f"lessons: {len(future)} line{'' if len(future) == 1 else 's'} in a newer format "
-              f"skipped in {path} (kept on write; a newer lessons.py reads them)", file=sys.stderr)
+        print(_say(f"lessons: {len(future)} line{'' if len(future) == 1 else 's'} in a newer format "
+                   f"skipped in {path} (kept on write; a newer lessons.py reads them)"), file=sys.stderr)
     return out
 
 
@@ -665,7 +1006,32 @@ def _ensure_dir(d: pathlib.Path) -> None:
                       "nothing was written")
 
 
+def _unloadable(entries: dict[str, dict]) -> list[str]:
+    """The class keys whose line, as `dump` writes it, the loader would refuse (round 17, F1):
+    each line is read back exactly as `load` reads it (JSON, stage ids normalised, then
+    `_entry_shape`). A writer that produced such a line once made the next command set the
+    whole index aside as `.corrupt-<date>`, taking every lesson beside it out of the live index."""
+    bad = []
+    for ck in sorted(entries):
+        try:
+            e = json.loads(json.dumps(entries[ck], ensure_ascii=False, sort_keys=True))
+        except (TypeError, ValueError):
+            bad.append(str(ck))
+            continue
+        _migrate_stages(e, None)
+        if not _entry_shape(e):
+            bad.append(str(ck))
+    return bad
+
+
 def save(path: pathlib.Path, entries: dict[str, dict]) -> None:
+    # Never write a line the loader refuses (round 17, F1): fail loudly, the previous index
+    # intact, rather than hand the next command an index it sets aside.
+    bad = _unloadable(entries)
+    if bad:
+        raise Refused(f"the index would hold {len(bad)} line{'' if len(bad) == 1 else 's'} the "
+                      f"loader refuses ({', '.join(bad[:3])}); nothing was written, the previous "
+                      "index is intact; this is a defect, report it")
     _ensure_dir(path.parent)
     tmp = None
     try:
@@ -698,8 +1064,18 @@ def _resolve(entries: dict[str, dict], lid: str) -> dict:
 # ---------------------------------------------------------------------------- verbs
 
 
+def refuse_shallow(root: pathlib.Path) -> None:
+    """A shallow clone's project key — its root commit — moves whenever its boundary moves, so
+    add, emit and record refuse there (round 11): nothing written, the store never sees a key
+    that will not last."""
+    if _git(root, "rev-parse", "--is-shallow-repository") == "true":
+        raise Refused(f"{root.name} is a shallow clone: its project key changes when it is "
+                      "deepened — deepen it first (git fetch --unshallow); nothing was written")
+
+
 def cmd_add(a, idx: pathlib.Path) -> int:
     root = repo_root(pathlib.Path(a.root or "."))
+    refuse_shallow(root)
     project = project_key(root)
     private, problems = 0, []
     if a.json is not None:
@@ -735,7 +1111,51 @@ def cmd_add(a, idx: pathlib.Path) -> int:
         raise Refused("refused, nothing written:\n  " + "\n  ".join(errors))
     with session(idx, a.default_index) as ss:
         entries = ss.entries
-        changed = merge(entries, lessons)
+        before = json.loads(json.dumps(entries))  # the index as read: who held each id first
+        changed = merge(entries, lessons, checkout_id(root))
+        # The same FOREIGN rule at add time (round 12, repro G): an origin of another project key
+        # that came from THIS checkout, whose commit no longer resolves here, is this checkout's
+        # old identity (a re-init) — kept, marked, not counted, so add never adds a phantom.
+        here = checkout_id(root)
+        rekeyed: list[str] = []
+        # The same live-project rule as rebuild (round 15): never re-key an origin into this
+        # project when its key is a project the index already records with provenance.
+        known = _known_projects(before)
+        for ck in sorted({le["classKey"] for le in lessons}):
+            origins = entries[ck]["origins"]
+            marked = [dict(o, carried=CARRY_FOREIGN)
+                      if o["project"] != project and here in (o.get("checkouts") or [])
+                      and not o.get("carried") and not commit_resolves(root, o["commit"]) else o
+                      for o in origins]
+            # An origin v1.95.0 wrote for this repository — no provenance, keyed on the smallest
+            # root — whose commit resolves here is this checkout's origin under its old key
+            # (round 13, K): it takes this key and gives its memory id to the origin just added.
+            fresh = [o for o in marked if here in (o.get("checkouts") or []) and o["project"] == project]
+            for o in list(marked):
+                n = None if o["project"] in known else _legacy_twin(o, fresh)
+                if n is None or (o.get("memory") and n.get("memory")
+                                 and mem_base(o["memory"]) != mem_base(n["memory"])):
+                    continue
+                memory = _newer_memory(o.get("memory"), n.get("memory"))
+                # The source is o's project only when the id came from o (round 18, L1): a twin
+                # keeping its own id keeps its own source, if any.
+                source = ({"memory": memory} if not o.get("memory") else
+                          {"memory": memory, "rekeyedFrom": o.get("rekeyedFrom") or o["project"]}
+                          ) if memory else {}
+                marked = [dict(x, **source)
+                          if _origin_key(x) == _origin_key(n) else x for x in marked if x is not o]
+                rekeyed.append(f"{ck} — {o['retro']}: {o['project']} is {project} (written before "
+                               "provenance; its commit resolves here)" + (f" · {memory}" if memory else ""))
+            if marked != origins:
+                entries[ck] = derive(marked)
+                changed += 1
+        # The project a re-key took an id from takes it back when it is read (round 16).
+        reclaimed = _reclaim(entries)
+        changed += len(reclaimed)
+        # One memory id stays on one live project at add time too (round 14, F3): an add from
+        # an old clone that brings a carried holder back to life must not leave its id on both.
+        shared = _one_project_per_memory(entries, before)
+        changed += len(shared)
         if changed:
             ss.save()
     n = len(lessons)
@@ -745,6 +1165,12 @@ def cmd_add(a, idx: pathlib.Path) -> int:
     for le in lessons:
         e = entries[le["classKey"]]
         print(f"  {e['id']} {e['classKey']} — {e['status']} (seen {e['seen']}, projects {e['projects']})")
+    for n in rekeyed:
+        print(f"  re-keyed: {n}")
+    for n in reclaimed:
+        print(f"  reclaimed: {n}")
+    for n in shared:
+        print(f"  memory: {n}")
     return 0
 
 
@@ -762,8 +1188,8 @@ def cmd_query(a, idx: pathlib.Path) -> int:
     with session(idx, a.default_index) as ss:
         entries = ss.entries
     if not entries and not idx.exists():
-        print(f"lessons: local index absent ({idx}) — nothing to read; the retro and "
-              "learned.md still run")
+        print(_say(f"lessons: local index absent ({idx}) — nothing to read; the retro and "
+                   "learned.md still run"))
         return 0
     query = [part.strip().casefold() for arg in a.nouns for part in arg.split(",") if part.strip()]
     qwords = set(query) | {w for q in query for w in _words(q)}
@@ -807,11 +1233,57 @@ def _source_stat(path: pathlib.Path):
     return info
 
 
-def find_retros(roots: list[str], depth: int) -> tuple[list[tuple[pathlib.Path, pathlib.Path]], list[str]]:
-    """Discovery and its unknowns, kept separate from a readable empty scope."""
-    found, problems = [], []
+Problem = tuple  # (owner checkout path or None, text)
+
+
+def find_retros(roots: list[str], depth: int) -> tuple[list[tuple[pathlib.Path, pathlib.Path]], list[Problem],
+                                                        dict[pathlib.Path, bool]]:
+    """Discovery and its unknowns, kept separate from a readable empty scope.
+
+    Returns (retro files, problems, checkouts). Each checkout discovered — keyed by its real
+    path — maps to whether its retro sources were discovered in full. Each problem carries its
+    OWNER: the checkout it belongs to, or None when no checkout owns it (an unreadable
+    directory, a missing root). Ownership is structural, never a path-prefix match (round 9).
+
+    Every git worktree of a checkout found is discovered too (`git worktree list --porcelain`,
+    round 8): the walk skips dot-directories, and `.worktrees/` or `.claude/worktrees/` is where
+    a feature branch's retro usually lives. A listing git refuses — a non-zero exit or no answer —
+    is a problem owned by that checkout (round 9, L1)."""
+    found: list[tuple[pathlib.Path, pathlib.Path]] = []
+    problems: list[Problem] = []
+    repos: dict[pathlib.Path, bool] = {}
+
     def unread(exc):
-        problems.append(f"{exc.filename}: cannot discover ({type(exc).__name__})")
+        problems.append((None, f"{pathlib.Path(exc.filename or '?').name}: cannot discover "
+                               f"({type(exc).__name__})"))
+
+    def visit(here: pathlib.Path) -> None:
+        try:
+            here = here.resolve()
+        except OSError:
+            pass
+        if here in repos:
+            return
+        repos[here] = False
+        try:
+            art = _artifact_root(here)
+            archive = art / "retro"
+            archive_info = _source_stat(archive)
+            if archive_info is not None and not stat.S_ISDIR(archive_info.st_mode):
+                raise Refused(f"{archive}: retro archive is not a directory")
+            archived = sorted(archive.iterdir()) if archive_info is not None else []
+            files = [art / "retro.md"] + [p for p in archived if p.suffix == ".md"]
+            for f in files:
+                info = _source_stat(f)
+                if info is None:
+                    continue
+                if not stat.S_ISREG(info.st_mode):
+                    raise Refused(f"{f}: retro source is not a regular file")
+                found.append((here, f))
+            repos[here] = True
+        except (OSError, Refused) as exc:
+            problems.append((here, f"{here.name}: {exc}"))
+
     for r in roots:
         base = pathlib.Path(r).expanduser()
         try:
@@ -819,33 +1291,49 @@ def find_retros(roots: list[str], depth: int) -> tuple[list[tuple[pathlib.Path,
             if base_info is None or not stat.S_ISDIR(base_info.st_mode):
                 raise Refused(f"{base}: root is missing or not a readable directory")
         except (OSError, Refused) as exc:
-            problems.append(str(exc))
+            problems.append((None, str(exc)))
             continue
         for cur, dirs, _files in os.walk(base, followlinks=True, onerror=unread):
             here = pathlib.Path(cur)
             rel_depth = len(here.relative_to(base).parts)
             dirs[:] = sorted(d for d in dirs if d not in SKIP_DIRS and not d.startswith("."))
             try:
-                if _source_stat(here / ".git") is not None:
-                    art = _artifact_root(here)
-                    archive = art / "retro"
-                    archive_info = _source_stat(archive)
-                    if archive_info is not None and not stat.S_ISDIR(archive_info.st_mode):
-                        raise Refused(f"{archive}: retro archive is not a directory")
-                    archived = sorted(archive.iterdir()) if archive_info is not None else []
-                    files = [art / "retro.md"] + [p for p in archived if p.suffix == ".md"]
-                    for f in files:
-                        info = _source_stat(f)
-                        if info is None:
-                            continue
-                        if not stat.S_ISREG(info.st_mode):
-                            raise Refused(f"{f}: retro source is not a regular file")
-                        found.append((here, f))
+                is_repo = _source_stat(here / ".git") is not None
             except (OSError, Refused) as exc:
-                problems.append(f"{here}: {exc}")
+                problems.append((None, f"{here}: {exc}"))
+                is_repo = False
+            if is_repo:
+                visit(here)
             if rel_depth >= depth:
                 dirs[:] = []
-    return found, problems
+    for repo in list(repos):
+        for wt in _worktrees(repo, problems):
+            visit(wt)
+    return found, problems, repos
+
+
+def _worktrees(repo: pathlib.Path, problems: list[Problem]) -> list[pathlib.Path]:
+    """The live worktrees git lists for `repo` (bare and prunable ones skipped). A listing that
+    cannot be read is a problem owned by `repo`: its siblings are unknown."""
+    try:
+        listing = _git(repo, "worktree", "list", "--porcelain")
+    except Refused as exc:
+        listing, why = None, str(exc)
+    else:
+        why = "git exited non-zero"
+    if listing is None:
+        problems.append((repo, f"{repo.name}: worktrees cannot be listed ({why})"))
+        return []
+    out = []
+    for block in listing.split("\n\n"):
+        lines = block.splitlines()
+        head = next((ln[len("worktree "):] for ln in lines if ln.startswith("worktree ")), None)
+        if head is None or any(ln == "bare" or ln.startswith("prunable") for ln in lines):
+            continue
+        path = pathlib.Path(head)
+        if path.is_dir():
+            out.append(path)
+    return out
 
 
 def _artifact_root(repo: pathlib.Path) -> pathlib.Path:
@@ -881,66 +1369,617 @@ def _artifact_root(repo: pathlib.Path) -> pathlib.Path:
     return repo / ARTIFACT_KNOWN[0]
 
 
+CARRY_CHECKOUT = "checkout not read"
+CARRY_FILE = "retro file not read"
+CARRY_LEGACY = "no provenance"
+CARRY_FOREIGN = "checkout holds another project"
+CARRY_UNRESOLVED = "commit does not resolve"
+CARRY_CITES_UNRESOLVED = "retro cites a commit that does not resolve"
+CARRY_REFUSED = "lesson refused"
+CARRY_GONE = "no checkout read holds it"
+CARRY_SOURCE = "source not read"  # the round-7 label, still accepted in an index line
+CARRY_REASONS = (CARRY_CHECKOUT, CARRY_FILE, CARRY_LEGACY, CARRY_FOREIGN, CARRY_UNRESOLVED,
+                 CARRY_CITES_UNRESOLVED, CARRY_REFUSED, CARRY_GONE, CARRY_SOURCE)
+# The reasons `_carry_reason` can produce today — the only ones --prune-carried-reason offers.
+PRUNE_REASONS = tuple(r for r in CARRY_REASONS if r != CARRY_SOURCE)
+
+
+def _redact(text: str, shown: dict[str, str]) -> str:
+    """`text` with every known absolute path replaced by its name, longest path first, so a
+    checkout inside a root is shown as itself and never as the root plus a tail. Only absolute
+    paths with a real name are replaced, and only as whole path components (round 13, N2): a
+    root given as `.` once deleted every dot of every message (`repo.v2`, `mem:v1.2.3`)."""
+    for path in sorted(shown, key=len, reverse=True):
+        name = shown[path]
+        if not os.path.isabs(path) or path == "/" or name in ("", ".", ".."):
+            continue
+        text = re.sub(r"(?<![\w.~/-])" + re.escape(path) + r"(?![\w.~-])", lambda _m: name, text)
+    return text
+
+
+def _say(text: str) -> str:
+    """A message as printed: every path `rebuild` knows shown by its name (`_SHOWN`)."""
+    return _redact(text, _SHOWN)
+
+
+def _legacy_twin(o: dict, candidates: list[dict]) -> dict | None:
+    """The re-derived origin a provenance-less origin is, or None (round 13, K).
+
+    v1.95.0 keyed a project on the SMALLEST root commit of HEAD and recorded no checkouts; a
+    repository that merged an unrelated history whose root sorts lower is keyed differently
+    now. Such an origin is the same repository's — re-keyed, never counted twice — only on
+    positive evidence: it has no `checkouts`, exactly one candidate of another key holds the
+    same `retro#anchor` under the same class key, and in a checkout that candidate was derived
+    from (round 14, F1) the origin's own commit resolves AND descends from the root the
+    candidate's key names (`_roots_of`: its own history, not a history it merged; a commit that
+    does not resolve has no roots, and a git that does not answer is a no), and v1.95.0 would
+    have computed exactly the origin's key there (`_legacy_key`). A monorepo that merged another
+    repository's history holds that repository's commits too, and under v1.95.0 may even have
+    shared its key; the commit's roots tell them apart."""
+    # No `checkouts` check here (round 15): an origin with provenance names a project the
+    # index knows (`_known_projects`), and both callers skip those before asking.
+
+    def same_repository(n: dict, c: str) -> bool:
+        return (_legacy_key(c) == o["project"]
+                and n["project"][2:] in _roots_of(c, o["commit"]))
+    hits = [n for n in candidates if n.get("checkouts") and n["project"] != o["project"]
+            and n["retro"] == o["retro"]
+            and any(same_repository(n, c) for c in n["checkouts"])]
+    return hits[0] if len(hits) == 1 else None
+
+
+def _newer_memory(a: str | None, b: str | None) -> str | None:
+    """Of two ids of ONE record (same base), the higher revision; either when one is absent."""
+    if not a or not b:
+        return a or b
+    return a if mem_rev(a) >= mem_rev(b) else b
+
+
+def _known_projects(index: dict[str, dict]) -> set[str]:
+    """Every project key an index records with provenance — an origin with `checkouts` (round
+    15). Only the current key derivation writes provenance, so such a key is a real project of
+    this version, never v1.95.0's name for another one. Every verb treats it as live: a project
+    absent from THIS run's roots is not thereby another repository's to take."""
+    return {o["project"] for e in index.values() for o in e["origins"] if o.get("checkouts")}
+
+
+def _rekey_legacy(old: dict[str, dict], entries: dict[str, dict],
+                  live: set[str] | frozenset = frozenset()) -> list[str]:
+    """Re-key, in the previous index, every provenance-less origin `_legacy_twin` proves is
+    the same repository as an origin this rebuild re-derived: it takes the new key, so
+    `_attach_memory` carries its memory id to the re-derived origin and it is not carried as a
+    second project. One that holds a different memory id than the previous index's copy under
+    the new key is left as it is — carried, named — since two store records are not one. An
+    origin whose own key this run re-derives is never re-keyed: it is that project's — nor is
+    one whose PROJECT key any checkout read this run holds (round 14, F2), whatever its anchor:
+    that project is here, and its retitled entry is not another repository's. `live` is this
+    run's projects plus every project the previous index records with provenance
+    (`_known_projects`, round 15): which project owns an id never depends on verb order or on
+    which roots a rebuild was given."""
+    said: list[str] = []
+    for ck in sorted(old):
+        if ck not in entries:
+            continue
+        origins, changed = list(old[ck]["origins"]), False
+        for o in list(origins):
+            if o["project"] in live:
+                continue  # its project is here this run (its own origin re-derived or not): never moved
+            n = _legacy_twin(o, entries[ck]["origins"])
+            if n is None:
+                continue
+            twin = next((x for x in origins if _origin_key(x) == _origin_key(n)), None)
+            if (twin and twin.get("memory") and o.get("memory")
+                    and mem_base(twin["memory"]) != mem_base(o["memory"])):
+                said.append(f"{ck} — {o['project']} {o['retro']}: the same repository as "
+                            f"{n['project']}, but each holds its own memory id — left carried")
+                continue
+            moved = {k: v for k, v in o.items() if k not in ("carried", "rekeyedFrom")}
+            moved["project"] = n["project"]
+            memory = _newer_memory(o.get("memory"), (twin or {}).get("memory"))
+            if memory:
+                moved["memory"] = memory
+                # Where the id came from (round 16): the project whose key the legacy store
+                # used may still be read later, and then it takes its id back (`_reclaim`).
+                # Only when the id came from o (round 18, L1): the twin's own id keeps the
+                # twin's own source, if it had one.
+                if o.get("memory"):
+                    moved["rekeyedFrom"] = o.get("rekeyedFrom") or o["project"]
+                elif (twin or {}).get("rekeyedFrom"):
+                    moved["rekeyedFrom"] = twin["rekeyedFrom"]
+            origins = [x for x in origins if x is not o and x is not twin] + [moved]
+            said.append(f"{ck} — {o['retro']}: {o['project']} is {n['project']} (written before "
+                        "provenance; its commit resolves in the checkout that re-derived it)"
+                        + (f" · {memory}" if memory else ""))
+            changed = True
+        if changed:
+            old[ck] = derive(origins)
+    return said
+
+
+def _given(o: dict, memory: str) -> dict:
+    """o holding `memory`. Where the id it held came from (`rekeyedFrom`) stays only while the id
+    is the same one (round 18, M1): an origin given another id (`record --replace`) holds a record
+    of its own, which no other project may take back."""
+    same = bool(o.get("memory")) and mem_base(o["memory"]) == mem_base(memory)
+    return dict(o, memory=memory) if same else {
+        k: v for k, v in dict(o, memory=memory).items() if k != "rekeyedFrom"}
+
+
+def _reclaim(entries: dict[str, dict]) -> list[str]:
+    """Give a re-keyed memory id back to the project it was taken from (round 16).
+
+    A re-key can only judge the projects it has seen: an `add` in X, or a rebuild over X's root
+    alone, may re-key a v1.95.0 origin into X before the repository Y whose key the legacy store
+    used has ever been read. So ownership is made recoverable instead of predicted: the re-keyed
+    origin records `rekeyedFrom: <Y's key>`, and when Y is read with an origin of the same class
+    key (the store's identity is (classKey, project)), the id moves to Y's first READ origin by
+    (project, retro) and is dropped from X.
+
+    Y counts as read only by an origin that carries provenance (`checkouts`) and is not carried
+    (round 17, F2): one this `add` merged, or this rebuild re-derived. A v1.95.0 origin under
+    Y's key that could not be re-keyed (no provenance, carried `no provenance`) proves nothing
+    about Y: it may be X's own entry whose twin X no longer holds. Round 16 counted any Y origin
+    and reclaimed in the very run that re-keyed, to a project nobody had read. A project with
+    provenance is known and never re-keyed (`_known_projects`), so a read Y origin here was read
+    after the re-key. So whichever verb runs first, the final owner is the project the legacy
+    store keyed, once that project is actually read. When Y already holds a different id for
+    that class, two store records are not one: nothing moves, and that is said. Returns the
+    lines to print."""
+    said: list[str] = []
+    for ck in sorted(entries):
+        origins = entries[ck]["origins"]
+        changed = False
+        for o in sorted(origins, key=_origin_key):
+            src = o.get("rekeyedFrom")
+            if not src or not o.get("memory") or src == o["project"]:
+                continue
+            mine = sorted((y for y in origins if y["project"] == src and y.get("checkouts")
+                           and not y.get("carried")), key=_origin_key)
+            if not mine:
+                continue  # Y not read this run: a carried or provenance-less origin proves nothing
+            base = mem_base(o["memory"])
+            other = next((y["memory"] for y in origins if y["project"] == src and y.get("memory")
+                          and mem_base(y["memory"]) != base), None)
+            if other:
+                said.append(f"{ck}: {base} was re-keyed from {src} into {o['project']}, but {src} now "
+                            f"holds its own {mem_base(other)} — nothing moved; two store records are not one")
+                continue
+            keep = _newer_memory(o["memory"], next((y["memory"] for y in origins if y["project"] == src
+                                                    and y.get("memory")), None))
+            new = []
+            for y in origins:
+                if y is o or (y.get("memory") and mem_base(y["memory"]) == base and y["project"] != src):
+                    y = {k: v for k, v in y.items() if k not in ("memory", "rekeyedFrom")}
+                elif y is mine[0]:
+                    y = dict({k: v for k, v in y.items() if k != "rekeyedFrom"}, memory=keep)
+                new.append(y)
+            said.append(f"{ck}: {keep} goes back to {src}, the project the legacy store keyed it under; "
+                        f"{o['project']} {o['retro']} keeps its place without it")
+            origins = new
+            changed = True
+        if changed:
+            entries[ck] = derive(origins)
+    return said
+
+
+def _one_project_per_memory(entries: dict[str, dict], old: dict[str, dict]) -> list[str]:
+    """One memory id is one PROJECT's store record (round 13, M/M2), as `_one_class_per_memory`
+    makes it one class's. Two projects may hold one id only while one of them is carried as
+    `checkout holds another project` (the re-attach `record` allows at the same path). When two
+    LIVE projects hold it — that origin's checkout came back — the id stays on the earlier
+    holder: the project the previous index carried as `checkout holds another project` with it
+    (it held the id before the re-attach), else the smaller project key. The other origin keeps
+    its place without the id, and that is named; nothing is duplicated in silence."""
+    first: dict[str, set] = {}
+    for e in old.values():
+        for o in e["origins"]:
+            if o.get("memory") and o.get("carried") == CARRY_FOREIGN:
+                first.setdefault(mem_base(o["memory"]), set()).add(o["project"])
+    said: list[str] = []
+    for ck in sorted(entries):
+        origins = entries[ck]["origins"]
+        live: dict[str, set] = {}
+        for o in origins:
+            if o.get("memory") and o.get("carried") != CARRY_FOREIGN:
+                live.setdefault(mem_base(o["memory"]), set()).add(o["project"])
+        changed = False
+        for base, projects in sorted(live.items()):
+            if len(projects) < 2:
+                continue
+            keep = (sorted(projects & first.get(base, set())) or sorted(projects))[0]
+            out = []
+            for o in origins:
+                if (o.get("memory") and mem_base(o["memory"]) == base and o["project"] != keep
+                        and o.get("carried") != CARRY_FOREIGN):
+                    said.append(f"{base} is held by {keep} and {o['project']} for {ck}; one id is "
+                                f"one project's store record, so it stays on {keep}, which held it "
+                                f"first — {o['project']} {o['retro']} keeps its place without it "
+                                "(record that project's own id there)")
+                    # `rekeyedFrom` goes with the id (round 17, F1): the loader refuses a source
+                    # beside no memory id, and would set the whole index aside.
+                    o = {k: v for k, v in o.items() if k not in ("memory", "rekeyedFrom")}
+                    changed = True
+                out.append(o)
+            origins = out
+        if changed:
+            entries[ck] = derive(origins)
+    return said
+
+
+def _resolves_in(checkout: str, sha: str) -> bool:
+    """Does `sha` resolve in this checkout? A git that does not answer counts as yes: the
+    cautious side, which keeps the origin counted rather than calling its checkout a stranger."""
+    try:
+        return commit_resolves(pathlib.Path(checkout), sha)
+    except Refused:
+        return True
+
+
+def _carry_reason(ck: str, o: dict, run: dict) -> str:
+    """Why a previous origin this run did not re-derive is carried — every one is (round 11):
+    a rebuild never removes or moves anything on its own. The reason is accurate and decides
+    one thing only: an origin whose every checkout now holds ANOTHER project is not counted in
+    `seen`/`projects`/`status` (`derive`); every other reason is a temporary unavailability.
+
+    Per checkout in the origin's provenance: not discovered, shallow, or owning a problem →
+    `checkout not read`; holding another project AND not holding the origin's own commit →
+    `checkout holds another project` (round 12: the same repository under another key is not a
+    stranger); the
+    entry refused there → `lesson refused`; its retro file not read → `retro file not read`;
+    read, same project, entry absent → `no checkout read holds it`. The most available
+    explanation wins; `checkout holds another project` only when every checkout says so."""
+    k = _origin_key(o)
+    if k in run["unresolved"]:
+        return CARRY_UNRESOLVED if run["unresolved"][k] == o["commit"] else CARRY_CITES_UNRESOLVED
+    prov = o.get("checkouts") or []
+    if not prov:
+        return CARRY_LEGACY
+    states = set()
+    rel = o["retro"].split("#", 1)[0]
+    for c in prov:
+        if c not in run["complete"] or c not in run["project"]:
+            states.add(CARRY_CHECKOUT)
+        elif run["project"][c] != o["project"] and not _resolves_in(c, o["commit"]):
+            # Another project only when the origin's own commit is not there (round 12): the
+            # same repository under another key — a branch, a lost default branch — still holds it.
+            states.add(CARRY_FOREIGN)
+        elif o["retro"] in run["refused"].get(c, ()):
+            states.add(CARRY_REFUSED)
+        elif rel not in run["files"].get(c, ()):
+            states.add(CARRY_FILE)
+        else:
+            states.add(CARRY_GONE)
+    for reason in (CARRY_REFUSED, CARRY_CHECKOUT, CARRY_FILE, CARRY_GONE):
+        if reason in states:
+            return reason
+    return CARRY_FOREIGN
+
+
+def _attach_memory(entries: dict[str, dict], old: dict[str, dict], notes: list[str]) -> None:
+    """Memory ids follow the store's own identity, (project, classKey) — never a retro anchor
+    (round 8, M1): a rotated archive or a reworded heading keeps its id, a class key changed
+    inside one entry never inherits another key's id, and two entries under one heading keep one
+    id each. Ids compare on the part before `@`; the highest revision wins (round 9, L3). Within
+    (project, classKey) the id goes on the first origin by (project, retro); `emit-observatory`
+    and `record` both read the origin of the project that holds the id (`_this_origin`), so the
+    three agree. Only when one (project, classKey) held several ids does the exact
+    (project, retro) decide, and only where that match is unique."""
+    by_pc: dict[tuple, dict[str, set]] = {}
+    best: dict[str, str] = {}
+    # (memory base, project) → the key a re-key took that id from, into that project (round 16).
+    # Keyed by the project too (round 17, F1): another project holding the same id was never
+    # re-keyed, and must not be given a source it never had.
+    source: dict[tuple[str, str], str] = {}
+    for e in old.values():
+        for o in e["origins"]:
+            if o.get("memory") and o.get("rekeyedFrom"):
+                source[(mem_base(o["memory"]), o["project"])] = o["rekeyedFrom"]
+    for ck, e in old.items():
+        for o in e["origins"]:
+            m = o.get("memory")
+            if m:
+                by_pc.setdefault((o["project"], ck), {}).setdefault(mem_base(m), set()).add(o["retro"])
+                if mem_base(m) not in best or mem_rev(m) > mem_rev(best[mem_base(m)]):
+                    best[mem_base(m)] = m  # seeded unconditionally (round 11, #5)
+    for ck, e in list(entries.items()):
+        origins = sorted(e["origins"], key=_origin_key)
+        changed = False
+        for project in sorted({o["project"] for o in origins}):
+            ids = by_pc.get((project, ck), {})
+            mine = [o for o in origins if o["project"] == project]
+            if len(ids) == 1:
+                (base,) = ids
+                mine[0]["memory"] = best[base]
+                if (base, project) in source:
+                    mine[0]["rekeyedFrom"] = source[(base, project)]
+                changed = True
+            elif len(ids) > 1:
+                for o in mine:
+                    exact = [b for b, retros in ids.items() if o["retro"] in retros]
+                    if len(exact) == 1:
+                        o["memory"] = best[exact[0]]
+                        if (exact[0], project) in source:
+                            o["rekeyedFrom"] = source[(exact[0], project)]
+                        changed = True
+                if not any(o.get("memory") for o in mine):
+                    notes.append(f"{ck} — {project}: several memory ids and none matches a retro "
+                                 "anchor uniquely; the previous origins keep them")
+        if changed:
+            entries[ck] = derive(origins)
+
+
+def _one_class_per_memory(entries: dict[str, dict], notes: list[str]) -> None:
+    """One memory id (compared before `@`) is one store record: it carries its highest revision
+    everywhere it appears, and it belongs to one class key. An index that already holds an id on
+    two keys (the round-7 defect) keeps it on the first and says so."""
+    top: dict[str, str] = {}
+    holders: dict[str, list[str]] = {}
+    for ck in sorted(entries):
+        for o in entries[ck]["origins"]:
+            m = o.get("memory")
+            if m:
+                b = mem_base(m)
+                if b not in top or mem_rev(m) > mem_rev(top[b]):
+                    top[b] = m  # seeded unconditionally (round 11, #5)
+                if ck not in holders.setdefault(b, []):
+                    holders[b].append(ck)
+    for ck in list(entries):
+        origins, changed = [], False
+        for o in entries[ck]["origins"]:
+            m = o.get("memory")
+            if m and holders[mem_base(m)][0] != ck:
+                # The id's source goes with it (round 17, F1), as in `_one_project_per_memory`.
+                o = {k: v for k, v in o.items() if k not in ("memory", "rekeyedFrom")}
+                changed = True
+                notes.append(f"memory id {mem_base(m)} was on {holders[mem_base(m)][0]} and {ck}; one id "
+                             f"is one store record, so it stays on {holders[mem_base(m)][0]} only")
+            elif m and m != top[mem_base(m)]:
+                o = dict(o, memory=top[mem_base(m)])
+                changed = True
+            origins.append(o)
+        if changed:
+            entries[ck] = derive(origins)
+    for ck, e in entries.items():
+        for o in e["origins"]:
+            if o.get("memory") and holders[mem_base(o["memory"])][0] != ck:
+                raise Refused(f"memory id {o['memory']} is on two class keys — nothing was written")
+
+
 def cmd_rebuild(a, idx: pathlib.Path) -> int:
-    found, problems = find_retros(a.roots, a.depth)
-    lessons, private, unresolved, seen_files = [], 0, 0, 0
+    """A rebuild never removes or moves anything on its own (rounds 7–11 of release iteration 1;
+    round 11 narrowed the contract under the loop guard).
+
+    The index becomes the lessons derived from every readable retro — under the roots, and in
+    every git worktree of each checkout found — merged with EVERY origin of the previous index
+    this run did not re-derive, CARRIED FORWARD. An origin is one project's copy of a lesson,
+    `(project, retro#anchor)` under its class key; it records its provenance, `checkouts`, the
+    real paths of the checkouts it was derived from (local; `show` and `emit` omit it).
+
+    No implicit removal: the only way an origin leaves the index is `--prune-carried`, narrowed
+    to one reason by `--prune-carried-reason` (which needs `--prune-carried` and offers only the
+    reasons below). No supersede, no move: a memory id stays on the origin that holds it;
+    `_attach_memory` re-attaches it only to the same (project, classKey).
+
+    The project key is the repository's (round 12): the first-parent root of its default
+    branch, computed once per git common dir, so a worktree on a branch that merged an
+    unrelated history, or a checkout sitting on an orphan `gh-pages`, is still its project.
+
+    A carried origin keeps everything recorded on it and is marked `carried: <reason>`
+    (`_carry_reason`): `checkout not read`, `retro file not read`, `no checkout read holds it`,
+    `commit does not resolve`, `retro cites a commit that does not resolve`, `lesson refused`,
+    `no provenance` (one this run proves is the same repository under a new key — no
+    provenance, one re-derived origin of another key at its `retro#anchor`, its commit resolving
+    in that checkout — is re-keyed instead, its memory id following: `_rekey_legacy`) —
+    temporary unavailabilities, counted in `seen`/`projects`/`status` — or
+    `checkout holds another project`, kept but NOT counted: every checkout in its provenance
+    holds another project key AND the origin's own commit does not resolve there (a stranger at
+    the path, a re-initialised history), so neither makes a phantom second project. `add`
+    applies the same rule to this checkout's own old-key origin.
+
+    A shallow clone (`git rev-parse --is-shallow-repository`) is never a source: a problem owned
+    by that checkout, nothing derived under its unstable key, its origins carried as `checkout
+    not read`; a shallow check that does not answer is refused the same way (and, having taught
+    nothing, does not count as something read). Known limit: a project whose root commit
+    changes (re-init, unshallow) starts new store records; the operator re-attaches by
+    `record`-ing the old id on the new origin of the same class key — allowed, because the
+    origin holding it is carried as `checkout holds another project` from that same checkout.
+    The re-key needs the commit to descend from the new key's root and v1.95.0's key for that
+    checkout to equal the origin's, and never touches a project read this run (round 14).
+    One memory id stays on one live project (`_one_project_per_memory`): the earlier holder keeps
+    it, the other is named. Every message — stdout, the session's notes and a refusal on stderr —
+    names checkouts and files by name, never by absolute path (`_redact`, `_say`).
+
+    Retro files are stamped when read and stamped again under the lock: a file that changed in
+    between — an `add` landing mid-run — leaves its checkout not read for this run. Memory ids
+    follow (project, classKey) and compare before `@`; the run refuses to write if a memory id
+    of the previous index would vanish other than by `--prune-carried`, and names an id that only
+    a corrupt line held.
+
+    Exit 0 whenever anything was read — a retro, or a checkout discovered in full — and for a
+    readable root holding no checkout at all (the index is written, every origin carried). Exit 1
+    only when nothing could be read because every root was missing or unreadable — before the
+    session opens, so no index, lock directory or migration is touched — or on a lock or
+    unreadable-index refusal. On the default path the one-time merge of the standalone index,
+    and setting a corrupt index aside (its good lines salvaged), run first, as for every verb."""
+    found, problems, repos = find_retros(a.roots, a.depth)
+    # Messages name checkouts and files, never an absolute path (round 12, E): every root,
+    # checkout and the index itself, as given and as resolved, is shown by its name.
+    # The index's directory and the standalone index are named too: the session's notes and a
+    # refusal go to stderr through the same `_say` (round 13, O).
+    shown = _SHOWN
+    legacy = LEGACY_INDEX()
+    for p in [pathlib.Path(r).expanduser() for r in a.roots] + list(repos):
+        _show(p)
+    for p in (idx, idx.parent, legacy, legacy.parent):
+        _show(p, home_relative=True)
+    def redact(text: str) -> str:
+        return _redact(text, shown)
+    lessons: list[tuple[str, dict]] = []
+    private, seen_files = 0, 0
+    unresolved: list[str] = []
     keys: dict[pathlib.Path, str] = {}
+    stats: dict[tuple, tuple] = {}
+    run: dict = {"files": {}, "refused": {}, "unresolved": {}, "complete": set(), "project": {}}
+    # A shallow clone is never a source (round 11): its root commit — the project key — moves
+    # whenever its boundary does, so nothing is derived from it until it is deepened.
+    shallow: set[pathlib.Path] = set()
+    unchecked: set[pathlib.Path] = set()
+    for repo in repos:
+        try:
+            if _git(repo, "rev-parse", "--is-shallow-repository") == "true":
+                shallow.add(repo)
+                problems.append((repo, f"{repo.name}: a shallow clone — never a source; deepen it "
+                                       "(git fetch --unshallow) for its lessons to be read"))
+        except Refused as exc:
+            # A shallow check that does not answer is refused, not trusted (round 12): the
+            # checkout is no source this run, and that is a problem it owns. Unlike a clone that
+            # answered "shallow", nothing was learned from it: it does not count as read.
+            unchecked.add(repo)
+            problems.append((repo, f"{repo.name}: the shallow check did not answer ({exc}) — not "
+                                   "a source this run"))
     for repo, retro in found:
-        # Read the remaining sources to report every problem, but never replace a complete
-        # prior projection with an incomplete scan. The refusal precedes any index mutation.
+        if repo in shallow or repo in unchecked:
+            continue
+        c = checkout_id(repo)
         try:
             if repo not in keys:
                 keys[repo] = project_key(repo)
-            got, priv, probs = parse_retro(retro, repo, keys[repo])
-            mine, unres = [], 0
+            stats[(repo, retro)] = _stamp(retro)
+            refused: set[str] = set()
+            got, priv, probs = parse_retro(retro, repo, keys[repo], refused)
+            mine, unres = [], []
             for le in got:
                 if validate(le):
                     probs.append(f"{le['classKey']}: refused by lesson/1")
+                    refused.add(le["origin"]["retro"])
                 elif not commit_resolves(repo, le["origin"]["commit"]):
-                    unres += 1
-                    probs.append(f"{le['classKey']}: evidence commit does not resolve")
+                    unres.append(le)
                 else:
                     mine.append(le)
         except Refused as exc:
-            problems.append(f"{repo.name}: {exc}")
+            problems.append((repo, f"{repo.name}: {exc}"))
             continue
         seen_files += 1
         private += priv
-        unresolved += unres
-        lessons += mine
-        problems += [f"{repo.name}: {p}" for p in probs]
-    if problems:
-        for problem in problems:
-            print(f"  not read: {problem}")
-        print("lessons: incomplete rebuild refused — index and migration state unchanged", file=sys.stderr)
+        run["files"].setdefault(c, set()).add(_relative(repo, retro))
+        run["refused"].setdefault(c, set()).update(refused)
+        for le in unres:
+            run["unresolved"][_origin_key(le["origin"])] = le["origin"]["commit"]
+        unresolved += [f"{repo.name}: {le['classKey']} (commit {le['origin']['commit']})" for le in unres]
+        lessons += [(c, le) for le in mine]
+        problems += [(repo, f"{repo.name}: {p}") for p in probs]
+    # Which project each checkout holds: a path is not an identity (round 10, F1).
+    for repo in repos:
+        if repo in shallow or repo in unchecked:
+            continue
+        try:
+            if repo not in keys:
+                keys[repo] = project_key(repo)
+            run["project"][checkout_id(repo)] = keys[repo]
+        except Refused:
+            continue
+    owners = {owner for owner, _ in problems}
+    run["complete"] = {checkout_id(r) for r, whole in repos.items() if whole and r not in owners}
+    # A shallow checkout was found and read far enough to know it is shallow: something was read.
+    if problems and not seen_files and not run["complete"] and not shallow:
+        for _, problem in problems:
+            print(f"  not read: {redact(problem)}")
+        print("lessons: rebuild refused — nothing could be read; the index, its lock directory "
+              "and any migration were not touched", file=sys.stderr)
         return 1
     with session(idx, a.default_index) as ss:
-        # The previous index lends its memory ids. `session` already refused an unreadable one
-        # (its contents may be good) and set a corrupt one aside; its notes go to stderr as for
-        # every verb, and into this verb's report as well.
+        # A retro that changed after it was read — an `add` landing between discovery and this
+        # lock (round 10, H1) — leaves its checkout not read for this run.
+        for (repo, retro), stamp in stats.items():
+            if _stamp(retro) != stamp:
+                problems.append((repo, f"{repo.name}: {_relative(repo, retro)} changed while the "
+                                       "rebuild ran — read again next run"))
+                run["complete"].discard(checkout_id(repo))
+        # The previous index lends its memory ids and its carried origins. `session` already
+        # refused an unreadable one (its contents may be good) and set a corrupt one aside, its
+        # good lines salvaged; its notes go to stderr as for every verb, and into this report.
         old = ss.entries
-        problems += [f"the previous index: {n}" for n in ss.notes]
-        memory = {(o["project"], o["retro"]): o["memory"]
-                  for e in old.values() for o in e["origins"] if o.get("memory")}
+        index_notes = list(ss.notes)
+        corrupt_name, corrupt_only = _CORRUPT_ONLY.get(str(idx), ("", set()))
+        notes: list[str] = []
         entries: dict[str, dict] = {}
-        # Worktrees of one project hold the same entries: one origin per (project, anchor),
-        # and where two copies differ the order below decides, the same way every time.
-        for le in sorted(lessons, key=lambda x: json.dumps(x, sort_keys=True)):
-            merge(entries, [le])
-        for e in entries.values():
-            origins = [dict(o, memory=memory[_origin_key(o)]) if _origin_key(o) in memory else o
-                       for o in e["origins"]]
-            entries[e["classKey"]] = derive(origins)
+        # Worktrees of one project hold the same entries: one origin per (project, anchor), its
+        # provenance the checkouts that hold it in this run; where two copies differ the order
+        # below decides, the same way every time.
+        for c, le in sorted(lessons, key=lambda x: (x[0], json.dumps(x[1], sort_keys=True))):
+            merge(entries, [le], c)
+        # An origin v1.95.0 wrote — no provenance, keyed on the smallest root — that is the same
+        # repository as one re-derived here takes its key first (round 13, K), so its memory id
+        # follows and it is never a second project.
+        rekeyed = _rekey_legacy(old, entries, set(run["project"].values()) | _known_projects(old))
+        _attach_memory(entries, old, notes)
+        derived = {(ck, _origin_key(o)) for ck, e in entries.items() for o in e["origins"]}
+        carried, pruned = [], []
+        for ck, e in sorted(old.items()):
+            for o in e["origins"]:
+                if (ck, _origin_key(o)) in derived:
+                    continue
+                rec = dict(o, carried=_carry_reason(ck, o, run))
+                if a.prune_carried and a.prune_carried_reason in (None, rec["carried"]):
+                    pruned.append((ck, rec))
+                else:
+                    carried.append((ck, rec))
+        for ck, o in carried:
+            held = [x for x in entries[ck]["origins"] if _origin_key(x) != _origin_key(o)] if ck in entries else []
+            entries[ck] = derive(held + [o])
+        _one_class_per_memory(entries, notes)
+        reclaimed = _reclaim(entries)
+        shared = _one_project_per_memory(entries, old)
+        # A memory id of the previous index vanishes only through --prune-carried (compared
+        # before `@`). An id only a corrupt line held is counted and named.
+        before = {mem_base(o["memory"]) for e in old.values() for o in e["origins"] if o.get("memory")}
+        after = {mem_base(o["memory"]) for e in entries.values() for o in e["origins"] if o.get("memory")}
+        gone = before - after - {mem_base(o["memory"]) for _, o in pruned if o.get("memory")}
+        if gone:
+            raise Refused(f"rebuild would lose {len(gone)} memory id(s) ({sorted(gone)[:3]}) — "
+                          "nothing was written; this is a defect, report it")
+        lost_to_corrupt = sorted(m for m in corrupt_only if mem_base(m) not in after)
         ss.entries = entries
         ss.save()
     print(f"lessons: rebuilt from {seen_files} retro file{'s' if seen_files != 1 else ''} in "
-          f"{len(keys)} repositor{'y' if len(keys) == 1 else 'ies'} · {len(entries)} lessons · "
-          f"{private} private entries skipped · {unresolved} with a commit that does not resolve")
-    for p in problems:
-        print(f"  not read: {p}")
+          f"{len(keys)} repositor{'y' if len(keys) == 1 else 'ies'} · {len(entries)} "
+          f"lesson{'' if len(entries) == 1 else 's'} · {private} private entries skipped · "
+          f"{len(unresolved)} with a commit that does not resolve · {len(carried)} origin"
+          f"{'' if len(carried) == 1 else 's'} carried forward (an origin leaves the index only "
+          "by --prune-carried)")
+    for ck, o in carried:
+        print(f"  carried ({o['carried']}): {ck} — {o['project']} {o['retro']}"
+              + (f" · {o['memory']}" if o.get("memory") else ""))
+    for ck, o in pruned:
+        print(f"  pruned ({o['carried']}): {ck} — {o['project']} {o['retro']}")
+    for u in unresolved:
+        print(f"  skipped, commit does not resolve: {u}")
+    for n in rekeyed:
+        print(f"  re-keyed: {redact(n)}")
+    for n in reclaimed:
+        print(f"  reclaimed: {redact(n)}")
+    for n in shared:
+        print(f"  memory: {redact(n)}")
+    for n in notes:
+        print(f"  memory: {redact(n)}")
+    for m in lost_to_corrupt:
+        print(f"  memory: {m} is held only by a bad line, kept in {corrupt_name} — not in the live index")
+    for n in index_notes:
+        print(f"  previous index: {redact(n)}")
+    for _, p in problems:
+        print(f"  not read: {redact(p)}")
     return 0
 
 
+def _stamp(path: pathlib.Path) -> tuple:
+    """A retro file's (mtime_ns, size, inode) — compared under the lock to see it changed."""
+    try:
+        st = path.stat()
+    except OSError:
+        return ()
+    return (st.st_mtime_ns, st.st_size, st.st_ino)
+
+
 def cmd_candidates(a, idx: pathlib.Path) -> int:
     with session(idx, a.default_index) as ss:
         entries = ss.entries
@@ -959,7 +1998,9 @@ def _this_origin(e: dict, root: pathlib.Path) -> dict:
     if not mine:
         raise Refused(f"{e['id']} has no origin in this repository — emit and record from the "
                       "project that learned it")
-    return sorted(mine, key=_origin_key)[0]
+    # The origin that holds this project's memory id first, then the first by (project, retro):
+    # emit revises the record the store already has, and record writes where emit reads (round 9).
+    return sorted(mine, key=lambda o: (not o.get("memory"), _origin_key(o)))[0]
 
 
 def cmd_emit(a, idx: pathlib.Path) -> int:
@@ -975,9 +2016,11 @@ def cmd_emit(a, idx: pathlib.Path) -> int:
     Either way the project travels as the same pseudonymous key the index holds, never a
     `project:<slug>` id, and the commit as `commit:` + 12 hex — the store's redactor removes a
     40-hex SHA as a credential shape and keeps exactly that short form."""
+    root = repo_root(pathlib.Path(a.root or "."))
+    refuse_shallow(root)
     with session(idx, a.default_index) as ss:
         e = _resolve(ss.entries, a.id)
-    o = _this_origin(e, repo_root(pathlib.Path(a.root or ".")))
+    o = _this_origin(e, root)
     le = o["lesson"]
     if a.tool == "observatory_lesson":
         args = {"owner": OWNER, "classKey": le["classKey"], "title": le["title"],
@@ -1015,6 +2058,7 @@ def _ledger_line(ledger: pathlib.Path | None, line: str) -> None:
 
 def cmd_record(a, idx: pathlib.Path) -> int:
     root = repo_root(pathlib.Path(a.root or "."))
+    refuse_shallow(root)
     ledger = pathlib.Path(a.ledger) if a.ledger else (root / DEFAULT_LEDGER)
     ledger = ledger if ledger.exists() or a.ledger else None
     try:
@@ -1049,10 +2093,63 @@ def cmd_record(a, idx: pathlib.Path) -> int:
                   file=sys.stderr)
             return 2
         memory = f"{mid}@{int(rev)}"
-        origins = [dict(x, memory=memory) if _origin_key(x) == _origin_key(o) else x
+        # Only an id the loader itself accepts is written (round 12, H): `mem:`, a quote or a
+        # backslash would make the next read set the whole index aside.
+        if not MEM_RE.fullmatch(memory):
+            print(f"lessons: {mid!r} is not a memory id this index can hold (mem:<id>@<rev>, no "
+                  "quote, backslash or space) — nothing written", file=sys.stderr)
+            return 2
+        # One id is one PROJECT's record (round 12, C): an id another project's origin holds is
+        # refused, naming that project — unless that origin is carried as `checkout holds another
+        # project` FROM THIS CHECKOUT (round 13, M/M2): a re-init at the same path, the known
+        # root-commit limit, where the operator re-attaches the old id on purpose. A stranger
+        # elsewhere never takes it.
+        here = checkout_id(root)
+        # A holder that took the id by a re-key FROM this project gives it back (round 16).
+        reclaim = [y for y in e["origins"] if y["project"] != o["project"]
+                   and mem_base(y.get("memory") or "") == mid and y.get("rekeyedFrom") == o["project"]]
+        holders = sorted({y["project"] for y in e["origins"] if y["project"] != o["project"]
+                          and mem_base(y.get("memory") or "") == mid
+                          and not any(y is r for r in reclaim)
+                          and not (y.get("carried") == CARRY_FOREIGN and here in (y.get("checkouts") or []))})
+        if holders:
+            print(f"lessons: {mid} is the store record of project {', '.join(holders)} for "
+                  f"{e['classKey']} — refused for {o['project']}, nothing written", file=sys.stderr)
+            return 1
+        # One id is one store record of one class (round 10, G1): an answer naming an id another
+        # class key holds is a stale or misplaced answer — refused, nothing written, or `emit`
+        # for this class would revise the other class's record.
+        others = sorted(ck for ck, x in entries.items() if ck != e["classKey"]
+                        and any(mem_base(y.get("memory") or "") == mid for y in x["origins"]))
+        if others:
+            print(f"lessons: {mid} is the store record of {', '.join(others)} — refused for "
+                  f"{e['classKey']}, nothing written", file=sys.stderr)
+            return 1
+        # A revision never goes back (G1b): a replayed older answer is refused.
+        held = max((mem_rev(y["memory"]) for y in e["origins"]
+                    if y.get("memory") and mem_base(y["memory"]) == mid), default=0)
+        if int(rev) < held:
+            print(f"lessons: {mid} is at revision {held}; revision {int(rev)} is older — refused, "
+                  "nothing written", file=sys.stderr)
+            return 1
+        # Replacing the id this origin already holds is a deliberate act (round 11, R5): without
+        # --replace the old store record would be orphaned in silence.
+        if o.get("memory") and mem_base(o["memory"]) != mid and not a.replace:
+            print(f"lessons: this origin holds {o['memory']}; {mid} would replace it — pass "
+                  "--replace to do that on purpose; nothing written", file=sys.stderr)
+            return 1
+        # The same id elsewhere in this entry takes the new revision too: one record, one revision.
+        # A re-keyed holder this project reclaims drops it instead (round 16).
+        origins = [{k: v for k, v in x.items() if k not in ("memory", "rekeyedFrom")}
+                   if any(x is r for r in reclaim) else
+                   _given(x, memory) if _origin_key(x) == _origin_key(o)
+                   or (x.get("memory") and mem_base(x["memory"]) == mid) else x
                    for x in e["origins"]]
         entries[e["classKey"]] = derive(origins)
         ss.save()
+    for y in reclaim:
+        print(f"  reclaimed: {mid} goes back to {o['project']}, the project it was re-keyed from; "
+              f"{y['project']} {y['retro']} keeps its place without it")
     line = f"event: lessons — recorded {e['id']} as {memory} — {_now()}"
     _ledger_line(ledger, line)
     print(line)
@@ -1062,6 +2159,10 @@ def cmd_record(a, idx: pathlib.Path) -> int:
 def cmd_show(a, idx: pathlib.Path) -> int:
     with session(idx, a.default_index) as ss:
         e = _resolve(ss.entries, a.id)
+    # Provenance is local machine state — absolute checkout paths — and stays in the index file:
+    # `show` prints the entry without it (round 10, G3), like everything that leaves the index.
+    e = dict(e, origins=[{k: v for k, v in o.items() if k not in ("checkouts", "worktreeOf")}
+                         for o in e["origins"]])
     print(json.dumps(e, ensure_ascii=True, indent=1, sort_keys=True))
     return 0
 
@@ -1096,6 +2197,11 @@ def main(argv: list[str]) -> int:
     rb = sub.add_parser("rebuild", parents=[common], help="re-derive the index from the retros")
     rb.add_argument("--roots", nargs="+", required=True)
     rb.add_argument("--depth", type=int, default=3, help="directory levels below each root")
+    rb.add_argument("--prune-carried", action="store_true",
+                    help="remove, on purpose, every origin the rebuild would carry forward — the "
+                         "only way an origin leaves the index")
+    rb.add_argument("--prune-carried-reason", choices=PRUNE_REASONS, default=None,
+                    help="with --prune-carried: prune only the origins carried for this reason")
     c = sub.add_parser("candidates", parents=[common], help="lessons two or more projects hold")
     c.add_argument("--min-projects", type=int, default=2)
     sh = sub.add_parser("show", parents=[common], help="one entry with its origins")
@@ -1111,16 +2217,29 @@ def main(argv: list[str]) -> int:
     rc.add_argument("--answer", required=True, help="the tool's JSON answer, a file or -")
     rc.add_argument("--ledger", help=f"the run ledger (default {DEFAULT_LEDGER} when it exists)")
     rc.add_argument("--root")
+    rc.add_argument("--replace", action="store_true",
+                    help="replace a different memory id this origin already holds")
     sub.add_parser("path", parents=[common], help="the index this invocation would use")
     a = p.parse_args(argv)
     if a.cmd == "add" and a.retro and not (a.all or a.entry):
         p.error("add --retro needs --entry ANCHOR or --all")
     if a.cmd == "rebuild" and a.depth < 0:
         p.error("rebuild --depth must be non-negative")
+    if a.cmd == "rebuild" and a.prune_carried_reason and not a.prune_carried:
+        p.error("--prune-carried-reason narrows --prune-carried; it does nothing alone")
     idx = index_path(a.index)
     if a.cmd == "path":
-        print(idx)
+        print(idx)  # the one verb whose answer IS the path
         return 0
+    # Every verb's messages name files and directories, never an absolute path (round 14, L3).
+    legacy = LEGACY_INDEX()
+    for known in (idx, idx.parent, legacy, legacy.parent):
+        _show(known, home_relative=True)
+    _show(pathlib.Path(getattr(a, "root", None) or "."))
+    for given in (getattr(a, "retro", None), getattr(a, "json", None), getattr(a, "answer", None),
+                  getattr(a, "ledger", None)):
+        if given and given != "-":
+            _show(pathlib.Path(given))
     # The default path (no --index, no $TASK_PIPELINE_LESSONS) is the one a standalone index
     # may still need merging into: `session` does it, once, under both directories' locks.
     a.default_index = not a.index and not os.environ.get(ENV_INDEX)
@@ -1129,7 +2248,7 @@ def main(argv: list[str]) -> int:
     try:
         return verbs[a.cmd](a, idx)
     except Refused as exc:
-        print(f"lessons: {exc}", file=sys.stderr)
+        print(f"lessons: {_say(str(exc))}", file=sys.stderr)
         return 1